docs(src): fix CommentChecker findings across src/ — 1,032 → 5 (all false positives)

Comment/XML-doc changes only, no code logic:
- strip project-tracking references (WP*, P*-*, row-NN, #NN, Task N) from
  comments, keeping the explanatory rationale
- add missing summaries, <param>, <returns>, <typeparam> and <inheritdoc/>
- replace misused <inheritdoc/> with real docs; where <inheritdoc/> was
  combined with useful remarks, move the rationale into // comments
- drop stale replicationActor <param> on DeploymentManagerActor ctor

Remaining 5 are false positives (CWE-1236 x2, failures-1, year-0001, M365).
Build 0 errors / 0 warnings.

src/ZB.MOM.WW.ScadaBridge.CLI/Commands/AuditCommands.cs

@@ -220,8 +220,8 @@ public static class AuditCommands
 
             // Ctrl-C is the one way to abort an in-flight export other than the
             // headers/inactivity deadlines below — mirrors the CancellationTokenSource
-            // owned by DebugCommands' streaming debug-view command (arch-review
-            // 2026-08-19 P6-8: this was the one CLI HTTP path with NO deadline at all).
+            // owned by DebugCommands' streaming debug-view command (this was the
+            // one CLI HTTP path with NO deadline at all).
             using var cts = new CancellationTokenSource();
             ConsoleCancelEventHandler onCancel = (_, e) =>
             {

src/ZB.MOM.WW.ScadaBridge.CLI/Commands/AuditExportHelpers.cs

@@ -115,7 +115,7 @@ public static class AuditExportHelpers
     /// and <see cref="SocketsHttpHandler.ConnectTimeout"/> bounds only the TCP/TLS
     /// connect phase, not a connected-but-silent server. Reuses
     /// <see cref="ManagementHttpClient.DefaultConnectTimeout"/> as the standard CLI
-    /// per-call default (arch-review 2026-08-19 P6-8).
+    /// per-call default.
     /// </summary>
     public static readonly TimeSpan DefaultHeadersTimeout = ManagementHttpClient.DefaultConnectTimeout;
 
@@ -126,7 +126,7 @@ public static class AuditExportHelpers
     /// hung/crashed server holding the connection open) is bounded rather than
     /// hanging the CLI forever — the residual gap the timeout-honesty fix
     /// (<c>ManagementHttpClient.DefaultConnectTimeout</c> doc comment) left in this
-    /// one path (arch-review 2026-08-19 P6-8).
+    /// one path.
     /// </summary>
     public static readonly TimeSpan DefaultInactivityTimeout = ManagementHttpClient.DefaultConnectTimeout;
 
@@ -204,7 +204,7 @@ public static class AuditExportHelpers
                 // Honour the documented "authorization failure → exit 2"
                 // contract on the REST audit surface as well. HTTP 403 is the
                 // primary signal; the server may also surface UNAUTHORIZED /
-                // FORBIDDEN via the JSON error envelope on a non-403 status.
+                // FORBIDDEN via the JSON error envelope on a status other than 403.
                 var errorCode = TryExtractErrorCode(message);
                 var isAuthFailure = (int)response.StatusCode == 403
                     || string.Equals(errorCode, "FORBIDDEN", StringComparison.OrdinalIgnoreCase)

src/ZB.MOM.WW.ScadaBridge.CLI/Commands/BundleCommands.cs

@@ -404,7 +404,7 @@ public static class BundleCommands
     // RunBundleCommandAsync that re-implemented URL/credential resolution and
     // skipped the IsAuthorizationFailure(...) check that ExecuteCommandAsync
     // enforces — a server that signalled FORBIDDEN/UNAUTHORIZED via the error
-    // code on a non-403 status would exit 1 instead of the documented exit 2.
+    // code on a status other than 403 would exit 1 instead of the documented exit 2.
     // The bundle path now delegates to CommandHelpers.ExecuteCommandAsync with
     // the longer BundleCommandTimeout and a per-command success handler, so the
     // exit-code contract is unified across every command group.

src/ZB.MOM.WW.ScadaBridge.CLI/Commands/CommandHelpers.cs

@@ -262,7 +262,7 @@ internal static class CommandHelpers
                 var objectItems = items.Where(i => i.ValueKind == JsonValueKind.Object).ToList();
 
                 // A "note" property that appears ONLY on single-property rows (a trailing
-                // run-level note, or — Task 14 review, 2026-09-09 — a step's folded log/exception
+                // run-level note, or a step's folded log/exception
                 // line) is not a real column: every other row's cell there would render blank,
                 // and column padding would swallow the raw line's own leading indentation. Such
                 // rows print as a raw unpadded line instead, at their position in the sequence,

src/ZB.MOM.WW.ScadaBridge.CLI/Commands/DeployCommands.cs

@@ -96,6 +96,10 @@ public static class DeployCommands
     /// whose summaries all carry <c>failureCount</c> — a per-site failure is a successful HTTP
     /// call, so without this the process exited 0 and scripts could not detect it.
     /// </summary>
+    /// <param name="json">The JSON response body from the management API.</param>
+    /// <param name="format">The output format (e.g. json or table).</param>
+    /// <param name="summaryName">Display name for the summary, used in the invalid-response error.</param>
+    /// <returns>0 when nothing failed; 1 when any failure was reported or the summary was invalid.</returns>
     internal static int HandleSiteDeploymentResponse(string json, string format, string summaryName = "site deployment")
     {
         CommandHelpers.HandleResponse(new ManagementResponse(200, json, null, null), format);

src/ZB.MOM.WW.ScadaBridge.CLI/Commands/FlowDebugCommands.cs

@@ -215,6 +215,8 @@ public static class FlowDebugCommands
     /// means "no parameters". Throws <see cref="JsonException"/> on malformed input or a
     /// non-object root (the inbound API body is always a flat JSON object).
     /// </summary>
+    /// <param name="json">The raw <c>--params</c> JSON text, or null/blank for none.</param>
+    /// <returns>The parsed root object, or null when no parameters were supplied.</returns>
     internal static JsonElement? ParseParameters(string? json)
     {
         if (string.IsNullOrWhiteSpace(json))

src/ZB.MOM.WW.ScadaBridge.CLI/Commands/FlowDebugTableProjection.cs

@@ -45,7 +45,7 @@ internal static class FlowDebugTableProjection
     /// <param name="showLogs">
     /// When true, prints each step's <c>ScriptLog</c> lines and (on a failed step) the first
     /// three lines of its exception detail as additional indented <c>note</c> rows immediately
-    /// following that step's row (step-logs design 2026-09-09, CLI Task 14). The <c>logs</c>
+    /// following that step's row. The <c>logs</c>
     /// column (a count of attached log lines) is always present, independent of this flag.
     /// </param>
     /// <returns>Compact JSON suitable for table rendering.</returns>
@@ -103,7 +103,7 @@ internal static class FlowDebugTableProjection
             if (truncated)
                 notes.Add("event list truncated — the audit rows remain complete (audit tree --execution-id <root>)");
 
-            // Final review M8: the page shows this; the CLI silently dropped it.
+            // The page shows this; the CLI silently dropped it.
             if (logsTruncated)
                 notes.Add("inline log lines capped — replay pulls the rest");
 

src/ZB.MOM.WW.ScadaBridge.CLI/ManagementHttpClient.cs

@@ -97,7 +97,7 @@ public class ManagementHttpClient : IDisposable
     internal ManagementHttpClient(HttpClient httpClient, string baseUrl, string username, string password)
     {
         _httpClient = httpClient;
-        // Test seam (WP2.6e): exposes the constructed HttpClient's effective Timeout
+        // Test seam: exposes the constructed HttpClient's effective Timeout
         // without requiring reflection.
         EffectiveTimeout = httpClient.Timeout;
         _httpClient.BaseAddress = new Uri(baseUrl.TrimEnd('/') + "/");

src/ZB.MOM.WW.ScadaBridge.CLI/OutputFormatter.cs

@@ -36,8 +36,7 @@ public static class OutputFormatter
     /// <summary>
     /// One row for the <see cref="TableRow"/> overload of <c>WriteTable</c>: either padded
     /// column cells like the plain <see cref="string[]"/> overload, or an already-formatted
-    /// line printed verbatim with no column padding/alignment at all (Task 14 review,
-    /// 2026-09-09) — used for a note/log line folded onto a step, which must render as a raw
+    /// line printed verbatim with no column padding/alignment at all — used for a note/log line folded onto a step, which must render as a raw
     /// indented line under that step's row rather than as a cell in a table column (every
     /// other row's cell there would otherwise render blank, and the line's own leading
     /// whitespace would be swallowed by column padding).
@@ -50,14 +49,20 @@ public static class OutputFormatter
             RawLine = rawLine;
         }
 
+        /// <summary>The column cells of a normal row, or null for a raw line.</summary>
         internal string[]? Cells { get; }
 
+        /// <summary>The verbatim line of a raw row, or null for a column row.</summary>
         internal string? RawLine { get; }
 
         /// <summary>A normal row, rendered as padded columns aligned with the header set.</summary>
+        /// <param name="cells">The column cell values.</param>
+        /// <returns>A column row.</returns>
         internal static TableRow Columns(string[] cells) => new(cells, null);
 
         /// <summary>An already-formatted line, printed exactly as given with no column alignment.</summary>
+        /// <param name="line">The preformatted line.</param>
+        /// <returns>A raw row.</returns>
         internal static TableRow Raw(string line) => new(null, line);
     }