docs: strip task-tracking IDs from code comments and fill missing XML docs

Tracking IDs are review bookkeeping that rots in shipped source; the rationale they tagged is kept. Comment-only change (CommentChecker 458 -> 16 false positives).
2026-10-07 15:34:32 -04:00
parent f2e0861709
commit f40409a688
115 changed files with 549 additions and 411 deletions
@@ -32,8 +32,8 @@ public sealed class GatewayBrowseScopeProviderTests

    /// <summary>
    ///     An authenticated key with no BrowseSubtrees constraint is legitimately unscoped: the
-    ///     empty list is what the library reads as "no scoping". This is the state GWC-38 required
-    ///     to stay distinguishable from an absent identity, so it is asserted alongside its
+    ///     empty list is what the library reads as "no scoping". This is the state that must
+    ///     stay distinguishable from an absent identity, so it is asserted alongside its
    ///     denying twin below rather than left implicit.
    /// </summary>
    [Fact]
@@ -49,7 +49,7 @@ public sealed class GatewayBrowseScopeProviderTests
    }

    /// <summary>
-    ///     GWC-38: with API-key authentication enabled, an absent ambient identity means the
+    ///     With API-key authentication enabled, an absent ambient identity means the
    ///     interceptor-ordering invariant is broken — the request's browse scope cannot be
    ///     established. The provider must DENY rather than resolve to the full hierarchy, because
    ///     a silently-unscoped browse is an invisible authorization bypass. The status code is