fix(alarms): fetch/poll ceilings; truncation-semantics docs; log-format conformance

src/ZB.MOM.WW.MxGateway.Server/Configuration/AlarmsOptions.cs

@@ -49,22 +49,26 @@ public sealed class AlarmsOptions
     /// <summary>
     ///     Cadence at which the worker's STA polls the AVEVA alarm consumer
     ///     (<c>GetXmlCurrentAlarms2</c>) for the current active-alarm snapshot.
-    ///     Default 500 ms; must be at least 100 ms. Every poll is a COM call
-    ///     plus an XML parse on the STA that also serves reads and writes, so
-    ///     driving it below 100 ms starves the command path. Conveyed to the
-    ///     worker through the <c>MXGATEWAY_ALARM_POLL_INTERVAL_MS</c>
-    ///     environment variable.
+    ///     Default 500 ms; must be between 100 ms and 3,600,000 ms (one hour).
+    ///     Every poll is a COM call plus an XML parse on the STA that also
+    ///     serves reads and writes, so driving it below 100 ms starves the
+    ///     command path; above an hour the cadence stops being a cadence and
+    ///     silently disables alarm polling. Conveyed to the worker through the
+    ///     <c>MXGATEWAY_ALARM_POLL_INTERVAL_MS</c> environment variable.
     /// </summary>
     public int PollIntervalMilliseconds { get; init; } = 500;
 
     /// <summary>
     ///     Cap the worker passes to <c>GetXmlCurrentAlarms2</c>'s
-    ///     <c>maxAlmCnt</c> argument. Default 1024; must be at least 64. A
-    ///     fetch that comes back holding exactly this many records is treated
-    ///     as truncated: the worker keeps the alarms the capped fetch could
-    ///     not mention in its snapshot rather than letting their absence read
-    ///     as a clear. Raise it on galaxies whose steady-state active-alarm
-    ///     count approaches the cap. Conveyed to the worker through the
+    ///     <c>maxAlmCnt</c> argument. Default 1024; must be between 64 and
+    ///     65,536 — the worker is a 32-bit process that materializes each
+    ///     fetch as one BSTR plus a full XmlDocument, so an unbounded cap
+    ///     faults the STA rather than merely slowing it. A fetch that comes
+    ///     back holding exactly this many records is treated as truncated: the
+    ///     worker keeps the alarms the capped fetch could not mention in its
+    ///     snapshot rather than letting their absence read as a clear. Raise it
+    ///     on galaxies whose steady-state active-alarm count approaches the
+    ///     cap. Conveyed to the worker through the
     ///     <c>MXGATEWAY_ALARM_MAX_ALARMS_PER_FETCH</c> environment variable.
     /// </summary>
     public int MaxAlarmsPerFetch { get; init; } = 1024;