docs+test(closeout): final-review reservations — stale ACL prose, worker test gaps, config sample fix

src/ZB.MOM.WW.MxGateway.Server/Dashboard/Hubs/DashboardEventBroadcaster.cs

@@ -20,9 +20,12 @@ namespace ZB.MOM.WW.MxGateway.Server.Dashboard.Hubs;
 /// values are stripped from a redacted copy of the event before it reaches any
 /// dashboard client. The source <see cref="MxEvent"/> is shared with the gRPC
 /// event path and the reconnect replay ring, so it is never mutated in place —
-/// the redaction is applied to a deep clone. This closes the value-leak seam at
-/// the mirror independently of the still-outstanding per-session hub ACL
-/// (see <see cref="EventsHub"/>).
+/// the redaction is applied to a deep clone. This is the second of two
+/// independent layers: <see cref="IDashboardSessionAcl"/> decides at the
+/// subscribe seam <em>which</em> sessions a caller may observe at all (see
+/// <see cref="EventsHub"/>), while the redaction decides what a permitted
+/// subscriber sees — so the value-leak seam stays closed whatever the ACL
+/// admits.
 /// </remarks>
 /// <param name="hubContext">Hub context used to send to the session's group.</param>
 /// <param name="viewerRegistry">

src/ZB.MOM.WW.MxGateway.Server/Dashboard/IDashboardSessionAcl.cs

@@ -23,9 +23,12 @@ public interface IDashboardSessionAcl
     /// session identified by <paramref name="sessionId"/>.
     /// </summary>
     /// <param name="principal">
-    /// The dashboard caller. <see langword="null"/>, unauthenticated, or claim-less
-    /// principals (including the anonymous-localhost path) are treated as Viewers
-    /// holding an empty tag grant.
+    /// The dashboard caller. <see langword="null"/> is denied outright — there is no
+    /// caller to grant tags to, so it never reaches the untagged-session branch and is
+    /// refused even under <c>UntaggedSessionVisibility=AllViewers</c>. An
+    /// unauthenticated or claim-less principal (the anonymous-localhost path included)
+    /// is a Viewer holding an empty tag grant, which denies every tagged session but
+    /// still follows that branch.
     /// </param>
     /// <param name="sessionId">Session id the caller wants to observe.</param>
     /// <returns><see langword="true"/> when the caller may observe the session; otherwise <see langword="false"/>.</returns>