Merge stream E (worker: cache eviction, ReadBulk shared deadline + dedupe, alarm poll threshold, STA loop fault, unhandled-exception hook, live control-command facts)

gateway.md

@@ -571,8 +571,15 @@ returns one result per requested entry — per-entry failures populate
   advised (`was_cached = true`, no subscription side-effects), or by
   taking a full `AddItem` + `Advise` + wait-for-first-OnDataChange +
   `UnAdvise` + `RemoveItem` snapshot lifecycle when no live subscription
-  exists (`was_cached = false`). Per-tag timeouts surface as
-  `was_successful = false` rather than throwing. The cache lives on the
+  exists (`was_cached = false`). `timeout_ms` is one shared deadline for
+  the whole command, not a per-tag budget: the worker adds and advises
+  every uncached tag first, waits once for all of them, then tears them
+  all down, so the STA is held for at most one `timeout_ms` (plus the
+  add/advise and teardown COM calls, during which it pumps every 16 tags).
+  Each tag that has not delivered by the deadline surfaces its own
+  `was_successful = false` timeout rather than throwing. Duplicate
+  addresses that MXAccess resolves to the same item handle share one
+  subscription and receive the same result. The cache lives on the
   worker's `MxAccessValueCache`, populated by `MxAccessBaseEventSink` on
   every `OnDataChange` after the event clears the outbound queue.
   Required scope: `invoke:read`. `timeout_ms == 0` uses the worker's