docs(tests): fix CommentChecker findings across tests/ — 13,392 → 0 (repo-wide scan clean)

Comment/XML-doc changes only:
- add summaries to ~10k test methods, fixtures, fakes and helpers
  (+ <param> on theories, <returns> on async Task methods,
  <inheritdoc/> on interface implementations the checker can resolve)
- strip ~2.6k project-tracking references (WP*, P*-*, row-NN, Task N,
  #NN, Component-0NN) from comments, keeping the explanatory text;
  reword false positives in comments only
- real docs on fakes implementing BCL/library interfaces
  (IDisposable, ILogger, IOptionsMonitor, IAsyncLifetime)
- reword the last 5 src/ false positives (CWE-1236, failures-1,
  year-0001, M365)

Only non-comment edits: four one-line nested classes split across lines
so members can carry docs. Build 0 errors / 0 warnings.

tests/ZB.MOM.WW.ScadaBridge.Security.Tests/LoginThrottleTests.cs

@@ -17,8 +17,13 @@ public class LoginThrottleTests
     private sealed class TestTimeProvider : TimeProvider
     {
         private DateTimeOffset _now;
+        /// <summary>Creates a clock fixed at the given start time.</summary>
+        /// <param name="start">The initial time reported by the clock.</param>
         public TestTimeProvider(DateTimeOffset start) => _now = start;
+        /// <inheritdoc />
         public override DateTimeOffset GetUtcNow() => _now;
+        /// <summary>Advances the clock by the given amount.</summary>
+        /// <param name="by">The amount of time to advance.</param>
         public void Advance(TimeSpan by) => _now = _now.Add(by);
     }
 
@@ -31,6 +36,7 @@ public class LoginThrottleTests
         return (Create(clock), clock);
     }
 
+    /// <summary>Verifies that five failures within the window lock the user out until the window expires.</summary>
     [Fact]
     public void FiveFailuresInWindow_LocksOut_ThenWindowExpiryUnlocks()
     {
@@ -47,6 +53,7 @@ public class LoginThrottleTests
         Assert.False(throttle.IsLockedOut("alice", "10.0.0.1"));
     }
 
+    /// <summary>Verifies that a successful login resets the failure count.</summary>
     [Fact]
     public void SuccessResets()
     {
@@ -63,6 +70,7 @@ public class LoginThrottleTests
         Assert.False(throttle.IsLockedOut("alice", "10.0.0.1"));
     }
 
+    /// <summary>Verifies that the throttle key is case-insensitive on the username.</summary>
     [Fact]
     public void KeyIsCaseInsensitiveOnUsername()
     {
@@ -75,6 +83,7 @@ public class LoginThrottleTests
         Assert.True(throttle.IsLockedOut("ALICE", "10.0.0.1"));
     }
 
+    /// <summary>Verifies that failures outside the window do not accumulate.</summary>
     [Fact]
     public void FailuresOutsideWindow_DoNotAccumulate()
     {
@@ -90,6 +99,7 @@ public class LoginThrottleTests
         Assert.False(throttle.IsLockedOut("alice", "10.0.0.1"));
     }
 
+    /// <summary>Verifies that the lockout persists until the configured lockout minutes elapse.</summary>
     [Fact]
     public void LockoutPersistsUntilLockoutMinutesElapse()
     {
@@ -106,6 +116,7 @@ public class LoginThrottleTests
         Assert.False(throttle.IsLockedOut("alice", "10.0.0.1"));
     }
 
+    /// <summary>Verifies that a maximum of zero failures disables throttling.</summary>
     [Fact]
     public void ZeroMaxFailures_DisablesThrottling()
     {
@@ -119,6 +130,7 @@ public class LoginThrottleTests
 
     // ── arch-review R2 N8: amortized prune ─────────────────────────────────────
 
+    /// <summary>Verifies that a key spray keeps the tracking map bounded at the hard cap.</summary>
     [Fact]
     public void KeySpray_MapStaysBounded_AtTheHardCap()
     {
@@ -130,6 +142,7 @@ public class LoginThrottleTests
         Assert.True(throttle.TrackedKeyCount <= LoginThrottle.MaxTrackedKeys);
     }
 
+    /// <summary>Verifies that expired entries are eventually swept on the amortized cadence.</summary>
     [Fact]
     public void ExpiredEntries_AreEventuallySwept_OnTheAmortizedCadence()
     {
@@ -138,7 +151,7 @@ public class LoginThrottleTests
         clock.Advance(TimeSpan.FromMinutes(10)); // window fully expired
         // Distinct IPs (not just distinct usernames) so this stays a pure per-pair prune-cadence
         // test — hammering PruneEveryNFailures (64) failures from a SINGLE IP would itself trip
-        // the P6-9 per-IP spray ceiling (default 25) and lock "10.0.0.1" out, which would make
+        // the per-IP spray ceiling (default 25) and lock "10.0.0.1" out, which would make
         // the IsLockedOut("stale", "10.0.0.1") assertion below fail for an unrelated reason.
         for (var i = 0; i < LoginThrottle.PruneEveryNFailures; i++)
             throttle.RecordFailure($"fresh{i}", $"10.0.1.{i}"); // cadence tick fires within these
@@ -146,8 +159,9 @@ public class LoginThrottleTests
         Assert.True(throttle.TrackedKeyCount <= LoginThrottle.PruneEveryNFailures); // "stale" swept
     }
 
-    // ── arch-review 2026-08-19 P6-9: per-IP spray ceiling ──────────────────────
+    // ── Per-IP spray ceiling ──────────────────────
 
+    /// <summary>Verifies that spraying one password across many usernames from one IP trips the per-IP ceiling.</summary>
     [Fact]
     public void Spray_OnePasswordAcrossManyUsernamesFromOneIp_TripsThePerIpCeiling()
     {
@@ -176,6 +190,7 @@ public class LoginThrottleTests
         Assert.True(throttle.IsLockedOut("brand-new-user", "10.0.0.1"));
     }
 
+    /// <summary>Verifies that distinct IPs are unaffected by one IP's lockout.</summary>
     [Fact]
     public void Spray_DistinctIpsAreUnaffectedByOneIpsLockout()
     {
@@ -191,6 +206,7 @@ public class LoginThrottleTests
         Assert.False(throttle.IsLockedOut("user0", "10.0.0.2"));
     }
 
+    /// <summary>Verifies that the per-pair lockout still fires before the per-IP ceiling so the normal flow is unchanged.</summary>
     [Fact]
     public void PerPairLockout_StillFiresBeforeThePerIpCeiling_NormalFlowUnchanged()
     {
@@ -205,6 +221,7 @@ public class LoginThrottleTests
         Assert.False(throttle.IsLockedOut("bob", "10.0.0.1")); // IP itself is nowhere near its ceiling
     }
 
+    /// <summary>Verifies that a few failures across a few users behind one address stay under the per-IP ceiling.</summary>
     [Fact]
     public void NatFriendly_AFewFailuresAcrossAFewUsers_StaysUnderThePerIpCeiling()
     {
@@ -223,6 +240,7 @@ public class LoginThrottleTests
         Assert.False(throttle.IsLockedOut("eve", "10.0.0.1"));
     }
 
+    /// <summary>Verifies that the per-IP lockout is released when the window expires.</summary>
     [Fact]
     public void PerIpLockout_ReleasesOnWindowExpiry()
     {
@@ -238,6 +256,7 @@ public class LoginThrottleTests
         Assert.False(throttle.IsLockedOut("brand-new-user", "10.0.0.1"));
     }
 
+    /// <summary>Verifies that recording a success does not reset the per-IP counter.</summary>
     [Fact]
     public void RecordSuccess_DoesNotResetThePerIpCounter()
     {