feat(scripting): expose the run token to scripts as ctx.CancellationToken

ScriptContext.CancellationToken is backed by an AsyncLocal that
ScriptEvaluator.RunAsync scopes around the compiled delegate, so it is
exactly the token ScriptRunGuard cancels on timeout. A polling script
can now end its own abandoned run and free the slot. AsyncLocal rather
than a field because the scripted-alarm engine reuses one context per
alarm: an orphan keeps seeing its own cancelled token. The scoping
entry point is internal (IVT to Core.Scripting) so a script cannot
replace its own token.

Editor parity: ScriptAnalysisService dot-completion now walks the
receiver's base chain (instance members only, stopping before
System.Object). Before this, a member declared only on ScriptContext
compiled and published but never completed. DiagnoseTests pins the
member as allow-listed; CompletionTests pins the completion.

Refs #731 #734
Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT

src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting.Abstractions/ScriptContext.cs

@@ -80,6 +80,49 @@ public abstract class ScriptContext
     /// </summary>
     public abstract ILogger Logger { get; }
 
+    /// <summary>
+    ///     The current run's cancellation token. The run guard cancels it when the run exceeds its wall-clock
+    ///     budget, so a long-running script can poll <c>ctx.CancellationToken.IsCancellationRequested</c> (or call
+    ///     <c>ThrowIfCancellationRequested()</c>) and end its own abandoned run instead of holding a pool thread
+    ///     until it returns. Cooperative only: a script that never looks at it still runs to completion as an
+    ///     orphan. <see cref="CancellationToken.None"/> outside a run.
+    /// </summary>
+    /// <remarks>
+    ///     Scoped per run through an <see cref="AsyncLocal{T}"/>, not stored on the context, because a context
+    ///     object can be reused across runs (the scripted-alarm engine keeps one per alarm). An abandoned orphan
+    ///     therefore keeps seeing its own cancelled token even after a newer run starts on the same context.
+    /// </remarks>
+    public CancellationToken CancellationToken => s_runToken.Value;
+
+    private static readonly AsyncLocal<CancellationToken> s_runToken = new();
+
+    /// <summary>
+    ///     Makes <paramref name="token"/> the script-visible <see cref="CancellationToken"/> on the calling
+    ///     execution context until the returned scope is disposed. Called by <c>ScriptEvaluator.RunAsync</c>
+    ///     around the compiled delegate.
+    /// </summary>
+    /// <param name="token">The run token.</param>
+    /// <returns>A scope that restores the previous token.</returns>
+    internal static RunTokenScope EnterRun(CancellationToken token)
+    {
+        var previous = s_runToken.Value;
+        s_runToken.Value = token;
+        return new RunTokenScope(previous);
+    }
+
+    /// <summary>Restores the token that was current before <see cref="EnterRun"/>.</summary>
+    internal readonly struct RunTokenScope : IDisposable
+    {
+        private readonly CancellationToken _previous;
+
+        /// <summary>Captures the token to restore.</summary>
+        /// <param name="previous">The token current before the run.</param>
+        public RunTokenScope(CancellationToken previous) => _previous = previous;
+
+        /// <inheritdoc />
+        public void Dispose() => s_runToken.Value = _previous;
+    }
+
     /// <summary>
     ///     Deadband helper — returns <c>true</c> when <paramref name="current"/> differs
     ///     from <paramref name="previous"/> by more than <paramref name="tolerance"/>.

src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting.Abstractions/ZB.MOM.WW.OtOpcUa.Core.Scripting.Abstractions.csproj

@@ -16,4 +16,10 @@
     <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Core.Abstractions\ZB.MOM.WW.OtOpcUa.Core.Abstractions.csproj"/>
   </ItemGroup>
 
+  <ItemGroup>
+    <!-- ScriptEvaluator scopes the script-visible run token (ScriptContext.EnterRun). Internal so a script
+         cannot replace its own token. -->
+    <InternalsVisibleTo Include="ZB.MOM.WW.OtOpcUa.Core.Scripting"/>
+  </ItemGroup>
+
 </Project>

src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting/ScriptEvaluator.cs

@@ -185,7 +185,13 @@ public sealed class ScriptEvaluator<TContext, TResult> : IDisposable
         // TResult directly). We surface a Task<TResult> only to keep the existing
         // RunAsync contract consumers depend on. TimedScriptEvaluator wraps this in
         // Task.Run so a long-running script still honours its wall-clock budget.
-        var result = _func(globals);
+        // The run token is the script-visible ctx.CancellationToken for exactly this call. ScriptRunGuard passes
+        // the token it cancels on timeout, so a polling script can end its own abandoned run.
+        TResult result;
+        using (ScriptContext.EnterRun(ct))
+        {
+            result = _func(globals);
+        }
         return Task.FromResult(result);
     }
 

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/ScriptAnalysis/ScriptAnalysisService.cs

@@ -268,7 +268,14 @@ public sealed class ScriptAnalysisService
         var typeInfo = model.GetTypeInfo(memberAccess.Expression);
         var type = typeInfo.Type ?? typeInfo.ConvertedType;
         if (type == null) return null;
-        return type.GetMembers()
+        // The type's own members, then the INSTANCE members it inherits (stopping before System.Object, whose
+        // ToString/GetHashCode noise was never offered). Without the base chain, a member declared only on
+        // ScriptContext — ctx.CancellationToken — compiled and published but never completed. Inherited statics
+        // (ScriptContext.Deadband) are left out: they are not reachable through an instance receiver.
+        var inherited = new List<ISymbol>();
+        for (var b = type.BaseType; b is not null && b.SpecialType != SpecialType.System_Object; b = b.BaseType)
+            inherited.AddRange(b.GetMembers().Where(m => !m.IsStatic));
+        return type.GetMembers().Concat(inherited)
             .Where(m => m.CanBeReferencedByName && !m.IsImplicitlyDeclared)
             // NotApplicable covers members (e.g. some BCL/special members) that carry no explicit accessibility but are referenceable.
             .Where(m => m.DeclaredAccessibility == Accessibility.Public || m.DeclaredAccessibility == Accessibility.NotApplicable)