perf(ipc): WaitAsync command timeouts + forward WorkerCancel so a timed-out COM call frees the STA

docs/GatewayProcessDesign.md

@@ -593,6 +593,20 @@ Pending command handling:
 Timeouts should not assume the COM call stopped. A timed-out command may still
 finish inside the worker.
 
+On timeout the client also forwards a `WorkerCancel` carrying the abandoned
+correlation id, best-effort: the gateway has stopped waiting, but the worker has
+not stopped working, and the worker owns a single STA. `WorkerPipeSession` routes
+the cancel to `CancelCommand`, which drops the correlation from the STA queue if
+it has not started and replies `Canceled` for it. A cancel that arrives after the
+command reached MXAccess is a no-op — there is no way to abort an in-flight COM
+call — so this shortens the STA backlog rather than freeing a call already
+running on it, and the rule above still holds. A command whose envelope is still
+in the gateway's outbound queue needs no special handling: the queue is FIFO, so
+the worker reads the command and then its cancel and drops it before execution.
+
+Failing to send the cancel is logged at debug and never replaces the
+`CommandTimeout` the caller is owed.
+
 ## Fault Model
 
 Fault categories: