docs: complete XML-doc coverage and strip internal tracking IDs from code comments

Resolve all CommentChecker findings across the gateway server, worker, tests,
and .NET client (314 -> 0 real issues): add missing <returns>/<summary>/<param>
on public and test members, convert Stream/interface overrides to <inheritdoc/>,
and remove internal task/issue tracking IDs (SEC-*, IPC-*, WRK-*, GWC-*, TST-*,
Client.Dotnet-*) from shipped code documentation while preserving the design
rationale prose. Shipped comments should not carry internal bookkeeping, and
complete XML docs keep the analyzer/TreatWarningsAsErrors gate and generated API
docs clean. The 6 remaining flags are heuristic false positives (MD5, UTC-4,
capacity-1, near-1601) left intact so real documentation is not corrupted.

Claude-Session: https://claude.ai/code/session_01DMXXvNuPekkkrTEyPNxEkW

src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/DashboardLoginRateLimitTests.cs

@@ -7,7 +7,7 @@ using ZB.MOM.WW.MxGateway.Server.Dashboard;
 namespace ZB.MOM.WW.MxGateway.Tests.Gateway.Dashboard;
 
 /// <summary>
-/// SEC-11: the <c>POST /auth/login</c> fixed-window per-IP rate limiter. Exercised through the same
+/// Tests the <c>POST /auth/login</c> fixed-window per-IP rate limiter. Exercised through the same
 /// partition factory the production policy registers, so the test pins the real permit limit and
 /// per-IP partitioning without standing up an HTTP server.
 /// </summary>

src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/DashboardSessionAdminServiceTests.cs

@@ -203,7 +203,7 @@ public sealed class DashboardSessionAdminServiceTests
     /// <summary>
     /// Verifies that a successful close writes a canonical <c>dashboard-close-session</c>
     /// <see cref="AuditEvent"/> — actor, session-id target, and Success outcome — to the
-    /// audit store, not only the operational log (SEC-12).
+    /// audit store, not only the operational log.
     /// </summary>
     /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
@@ -229,7 +229,7 @@ public sealed class DashboardSessionAdminServiceTests
 
     /// <summary>
     /// Verifies that a successful kill writes a canonical <c>dashboard-kill-worker</c>
-    /// <see cref="AuditEvent"/> to the audit store (SEC-12).
+    /// <see cref="AuditEvent"/> to the audit store.
     /// </summary>
     /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
@@ -253,7 +253,7 @@ public sealed class DashboardSessionAdminServiceTests
 
     /// <summary>
     /// Verifies that an unauthorized (viewer) close attempt still writes a <c>Denied</c>
-    /// audit row, so rejected destructive attempts are durably recorded (SEC-12).
+    /// audit row, so rejected destructive attempts are durably recorded.
     /// </summary>
     /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
@@ -305,7 +305,10 @@ public sealed class DashboardSessionAdminServiceTests
         /// <summary>Gets the audit events written through this writer, in order.</summary>
         public IReadOnlyList<AuditEvent> Events => _events.ToArray();
 
-        /// <inheritdoc />
+        /// <summary>Records the given audit event for later inspection by the test.</summary>
+        /// <param name="evt">The audit event to record.</param>
+        /// <param name="ct">Token to cancel the asynchronous operation.</param>
+        /// <returns>A task that represents the asynchronous operation.</returns>
         public Task WriteAsync(AuditEvent evt, CancellationToken ct = default)
         {
             _events.Enqueue(evt);

src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/HubTokenServiceTests.cs

@@ -145,7 +145,7 @@ public sealed class HubTokenServiceTests
     }
 
     /// <summary>
-    /// The default token lifetime is the short (5-minute) window mandated by SEC-05, not the
+    /// The default token lifetime is the short (5-minute) window, not the
     /// former 30-minute window. Pins the value so a regression that widens the exposure window
     /// of an irrevocable, query-string-carried token is caught in CI.
     /// </summary>

src/ZB.MOM.WW.MxGateway.Tests/Gateway/Grpc/EventStreamServiceTests.cs

@@ -39,7 +39,7 @@ public sealed class EventStreamServiceTests
     }
 
     /// <summary>
-    ///     TST-02 (owner-scoped attach): the API key that opened a session may attach its event
+    ///     Owner-scoped attach: the API key that opened a session may attach its event
     ///     stream — the caller key equals the session owner, so streaming proceeds normally.
     /// </summary>
     /// <returns>A task that represents the asynchronous operation.</returns>
@@ -64,7 +64,7 @@ public sealed class EventStreamServiceTests
     }
 
     /// <summary>
-    ///     TST-02 (owner-scoped attach, security control): a caller whose API key differs from
+    ///     Owner-scoped attach, security control: a caller whose API key differs from
     ///     the key that opened the session is rejected with a <see cref="SessionManagerErrorCode.PermissionDenied"/>
     ///     fault before any events are streamed — closing the reconnect/fan-out trust-boundary hole.
     /// </summary>

src/ZB.MOM.WW.MxGateway.Tests/Gateway/Grpc/MxAccessGrpcRequestValidatorTests.cs

@@ -18,8 +18,9 @@ public sealed class MxAccessGrpcRequestValidatorTests
 
     /// <summary>
     /// Verifies a DrainEvents request within the per-request ceiling passes validation, including the
-    /// <c>max_events = 0</c> "worker default cap" sentinel (IPC-04).
+    /// <c>max_events = 0</c> "worker default cap" sentinel.
     /// </summary>
+    /// <param name="maxEvents">The requested drain-events ceiling to validate.</param>
     [Theory]
     [InlineData(0u)]
     [InlineData(1u)]
@@ -32,7 +33,7 @@ public sealed class MxAccessGrpcRequestValidatorTests
 
     /// <summary>
     /// Verifies a DrainEvents request above the per-request ceiling is rejected with InvalidArgument
-    /// so one accepted request cannot pack an unbounded reply frame (IPC-04).
+    /// so one accepted request cannot pack an unbounded reply frame.
     /// </summary>
     [Fact]
     public void ValidateInvoke_RejectsDrainEvents_AboveCeiling()

src/ZB.MOM.WW.MxGateway.Tests/Gateway/Sessions/GatewaySessionDashboardMirrorTests.cs

@@ -108,7 +108,7 @@ public sealed class GatewaySessionDashboardMirrorTests
     }
 
     /// <summary>
-    ///     GWC-01 regression: with the internal dashboard mirror active, a second internal
+    ///     With the internal dashboard mirror active, a second internal
     ///     subscriber (the alarm monitor's feed, attached via
     ///     <see cref="GatewaySession.AttachInternalEventSubscriber"/>) receives EVERY event —
     ///     including the alarm <c>Acknowledge</c> transition — rather than the two consumers

src/ZB.MOM.WW.MxGateway.Tests/Gateway/Workers/WorkerClientTests.cs

@@ -59,7 +59,7 @@ public sealed class WorkerClientTests
     /// <summary>
     /// Verifies that a command whose serialized envelope exceeds the negotiated worker-frame maximum
     /// fails only that command with <see cref="WorkerClientErrorCode.CommandTooLarge"/> at the enqueue
-    /// boundary, leaving the client ready for subsequent commands (IPC-03). Without the pre-check the
+    /// boundary, leaving the client ready for subsequent commands. Without the pre-check the
     /// oversized frame would reach the write loop and fault the whole session.
     /// </summary>
     /// <returns>A task that represents the asynchronous operation.</returns>
@@ -170,7 +170,7 @@ public sealed class WorkerClientTests
 
     /// <summary>
     ///     The worker event channel is single-reader: a second <see cref="WorkerClient.ReadEventsAsync"/>
-    ///     enumerator must throw rather than silently split events between two consumers (GWC-01).
+    ///     enumerator must throw rather than silently split events between two consumers.
     /// </summary>
     /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
@@ -221,7 +221,7 @@ public sealed class WorkerClientTests
     /// <summary>
     /// Verifies that a command reply arriving on the pipe after events is dispatched promptly even
     /// when the event channel is full and has no consumer — event enqueue is decoupled from the read
-    /// loop, so a blocked event writer cannot delay a reply (GWC-04). The event full-mode timeout is
+    /// loop, so a blocked event writer cannot delay a reply. The event full-mode timeout is
     /// set far above the command timeout: without the decoupling the read loop would block behind the
     /// full event channel and the in-flight InvokeAsync would hit CommandTimeout.
     /// </summary>