docs(tests): fix CommentChecker findings across tests/ — 13,392 → 0 (repo-wide scan clean)

Comment/XML-doc changes only:
- add summaries to ~10k test methods, fixtures, fakes and helpers
  (+ <param> on theories, <returns> on async Task methods,
  <inheritdoc/> on interface implementations the checker can resolve)
- strip ~2.6k project-tracking references (WP*, P*-*, row-NN, Task N,
  #NN, Component-0NN) from comments, keeping the explanatory text;
  reword false positives in comments only
- real docs on fakes implementing BCL/library interfaces
  (IDisposable, ILogger, IOptionsMonitor, IAsyncLifetime)
- reword the last 5 src/ false positives (CWE-1236, failures-1,
  year-0001, M365)

Only non-comment edits: four one-line nested classes split across lines
so members can carry docs. Build 0 errors / 0 warnings.

tests/ZB.MOM.WW.ScadaBridge.Host.Tests/ControlPlaneAuthInterceptorTests.cs

@@ -52,22 +52,34 @@ public class ControlPlaneAuthInterceptorTests
     private sealed class FakeServerCallContext(string method, Metadata requestHeaders)
         : ServerCallContext
     {
+        /// <inheritdoc />
         protected override string MethodCore => method;
+        /// <inheritdoc />
         protected override string HostCore => "localhost";
+        /// <inheritdoc />
         protected override string PeerCore => "ipv4:127.0.0.1:12345";
+        /// <inheritdoc />
         protected override DateTime DeadlineCore => DateTime.UtcNow.AddMinutes(1);
+        /// <inheritdoc />
         protected override Metadata RequestHeadersCore => requestHeaders;
+        /// <inheritdoc />
         protected override CancellationToken CancellationTokenCore => CancellationToken.None;
+        /// <inheritdoc />
         protected override Metadata ResponseTrailersCore { get; } = [];
+        /// <inheritdoc />
         protected override Status StatusCore { get; set; }
+        /// <inheritdoc />
         protected override WriteOptions? WriteOptionsCore { get; set; }
+        /// <inheritdoc />
         protected override AuthContext AuthContextCore { get; } =
             new(null, new Dictionary<string, List<AuthProperty>>());
 
+        /// <inheritdoc />
         protected override ContextPropagationToken CreatePropagationTokenCore(
             ContextPropagationOptions? options)
             => throw new NotSupportedException();
 
+        /// <inheritdoc />
         protected override Task WriteResponseHeadersAsyncCore(Metadata responseHeaders)
             => Task.CompletedTask;
     }
@@ -78,6 +90,8 @@ public class ControlPlaneAuthInterceptorTests
         => interceptor.UnaryServerHandler<string, string>(
             "request", context, (_, _) => Task.FromResult("ok"));
 
+    /// <summary>Verifies that the LocalDb sync method passes through because it has its own gate and its own key.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task LocalDbSyncMethod_PassesThrough_BecauseItHasItsOwnGateAndItsOwnKey()
     {
@@ -90,6 +104,8 @@ public class ControlPlaneAuthInterceptorTests
         Assert.Equal("ok", await Invoke(interceptor, context));
     }
 
+    /// <summary>Verifies that a gated method is denied when no key is configured, even with a bearer token.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task GatedMethod_WithNoKeyConfigured_IsDenied_EvenWithABearerToken()
     {
@@ -103,6 +119,8 @@ public class ControlPlaneAuthInterceptorTests
         Assert.Equal(StatusCode.PermissionDenied, ex.StatusCode);
     }
 
+    /// <summary>Verifies that a gated method is denied when no bearer token is supplied.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task GatedMethod_WithNoBearerToken_IsDenied()
     {
@@ -113,6 +131,8 @@ public class ControlPlaneAuthInterceptorTests
         Assert.Equal(StatusCode.PermissionDenied, ex.StatusCode);
     }
 
+    /// <summary>Verifies that a gated method is denied when the bearer token is wrong.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task GatedMethod_WithWrongBearerToken_IsDenied()
     {
@@ -123,6 +143,8 @@ public class ControlPlaneAuthInterceptorTests
         Assert.Equal(StatusCode.PermissionDenied, ex.StatusCode);
     }
 
+    /// <summary>Verifies that a gated method passes through when the bearer token is correct.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task GatedMethod_WithCorrectBearerToken_PassesThrough()
     {
@@ -132,6 +154,8 @@ public class ControlPlaneAuthInterceptorTests
         Assert.Equal("ok", await Invoke(interceptor, context));
     }
 
+    /// <summary>Verifies that a gated method is denied when the correct key is sent without the Bearer scheme.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task GatedMethod_WithCorrectKey_ButNoBearerScheme_IsDenied()
     {
@@ -144,6 +168,8 @@ public class ControlPlaneAuthInterceptorTests
         Assert.Equal(StatusCode.PermissionDenied, ex.StatusCode);
     }
 
+    /// <summary>Verifies that token comparison requires an exact match rather than a prefix match.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task GatedMethod_TokenComparison_IsNotAPrefixMatch()
     {
@@ -156,6 +182,8 @@ public class ControlPlaneAuthInterceptorTests
         Assert.Equal(StatusCode.PermissionDenied, ex.StatusCode);
     }
 
+    /// <summary>Verifies that server-streaming calls are gated, since that is how subscriptions actually run.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task ServerStreaming_IsGated_BecauseThatIsHowSubscriptionsActuallyRun()
     {
@@ -174,6 +202,8 @@ public class ControlPlaneAuthInterceptorTests
         Assert.Equal(StatusCode.PermissionDenied, ex.StatusCode);
     }
 
+    /// <summary>Verifies that the pull RPCs are gated because they return audit rows.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task PullRpcs_AreGated_BecauseTheyReturnAuditRows()
     {
@@ -187,6 +217,8 @@ public class ControlPlaneAuthInterceptorTests
         Assert.Equal(StatusCode.PermissionDenied, ex.StatusCode);
     }
 
+    /// <summary>Verifies that the gated prefixes are supplied through the constructor, so later phases add services rather than interceptors.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task GatedPrefixes_AreConstructorProvided_SoLaterPhasesAddServicesNotInterceptors()
     {
@@ -205,6 +237,7 @@ public class ControlPlaneAuthInterceptorTests
         Assert.Equal("ok", await Invoke(interceptor, notGated));
     }
 
+    /// <summary>Verifies that the interceptor exposes exactly one public constructor.</summary>
     [Fact]
     public void TheInterceptorHasExactlyOnePublicConstructor()
     {
@@ -221,6 +254,7 @@ public class ControlPlaneAuthInterceptorTests
         Assert.Single(publicCtors);
     }
 
+    /// <summary>Verifies that the default gated prefixes match the real site stream service path.</summary>
     [Fact]
     public void DefaultGatedPrefixes_MatchTheRealSiteStreamServicePath()
     {