docs(src): restore substantive rationale prose the fca978d marker sweep deleted

Targeted re-read of the 203-file fca978d sweep (docs(src): add missing
XML docs and strip tracking-ID comments): a mechanical pre-pass narrowed
1,383 deletions to 68 files / 816 residual prose lines, and a judged
review of every one found 17 collateral deletions across 10 files —
rationale prose deleted alongside resolved markers with no equivalent
surviving anywhere in the tree. Restored (markers stay stripped, per the
sweep's intent):

- SessionManager: the three metrics-accounting invariants (kill-path
  gauge decrement safety, shutdown kill-fallback registry guard vs
  double bookkeeping, SessionClosed-not-SessionRemoved on failed close)
- SessionManagerTests: the matching accounting expectation note and the
  reason-string propagation pins (test summary + FakeWorkerClient.LastKillReason)
- MxAccessGatewayService.AcknowledgeAlarm: the routing remarks (GUID vs
  Provider!Group.Tag vs InvalidRequest; session-less via IGatewayAlarmService)
  — inheritdoc resolves to nothing (proto-generated base is undocumented)
- HubTokenService.Validate: why the hollow-token guard exists
  (non-empty AuthenticationType alone satisfies IsAuthenticated)
- DashboardSessionAdminService: why both broad catches exist (keep raw
  teardown exceptions out of Blazor's error boundary), Close + Kill paths
- WorkerPipeSession.RunAsync: why the factory result throws instead of
  NREing (unambiguous failure; finally-block Dispose can't no-op)
- LmxSubtagAlarmSource: Advise idempotency; Write is always unsecured
  (user id 0), never WriteSecured semantics
- WnWrapAlarmConsumer: the v1-prefix path is what WIN-911-style code uses
- DashboardSnapshotPublisherTests: what the 10ms slack absorbs
  (Task.Delay's coarse Windows timer quantum)
- DashboardBrowseAndAlarmModelTests: why the label text is pinned, not
  just the CSS class

Everything else flagged verified benign: inheritdoc replacements resolve
to equal-or-richer interface docs, or the substance survives relocated.
NonWindows slnx 0W/0E; touched gateway test classes 65/65.

src/ZB.MOM.WW.MxGateway.Worker/Ipc/WorkerPipeSession.cs

@@ -142,6 +142,13 @@ public sealed class WorkerPipeSession
     /// <returns>A task that represents the asynchronous operation.</returns>
     public async Task RunAsync(CancellationToken cancellationToken = default)
     {
+        // The factory delegate itself is null-checked in the constructor, but its
+        // return value is not — a factory that returned null would NRE on the
+        // StartAsync lambda below. Throw a diagnostic exception instead so the
+        // failure is unambiguous (and so the finally block's
+        // _runtimeSession?.Dispose() can't silently no-op on a torn
+        // half-initialized session). Mirrors the same pattern
+        // AlarmCommandHandler.Subscribe uses for its consumerFactory().
         _runtimeSession = _runtimeSessionFactory()
             ?? throw new InvalidOperationException(
                 "Worker runtime session factory returned null.");

src/ZB.MOM.WW.MxGateway.Worker/MxAccess/LmxSubtagAlarmSource.cs

@@ -108,6 +108,10 @@ public sealed class LmxSubtagAlarmSource : ISubtagAlarmSource
     public event EventHandler<SubtagValueChange>? ValueChanged;
 
     /// <inheritdoc />
+    /// <remarks>
+    ///     Idempotent per address: an address already advised is skipped
+    ///     rather than re-registered.
+    /// </remarks>
     public void Advise(IReadOnlyCollection<string> itemAddresses)
     {
         if (itemAddresses is null)
@@ -140,6 +144,10 @@ public sealed class LmxSubtagAlarmSource : ISubtagAlarmSource
     }
 
     /// <inheritdoc />
+    /// <remarks>
+    ///     Writes with MXAccess user id 0 — always an unsecured Write, never
+    ///     WriteSecured semantics.
+    /// </remarks>
     public void Write(string itemAddress, object? value)
     {
         if (itemAddress is null)

src/ZB.MOM.WW.MxGateway.Worker/MxAccess/WnWrapAlarmConsumer.cs

@@ -198,7 +198,9 @@ public sealed class WnWrapAlarmConsumer : IMxAccessAlarmConsumer
             // 2026-08-18) this is the only path that lets AlarmAckByName
             // return rc=0 afterwards. The v2 Initialize/Register/Subscribe
             // methods on the class succeed (return 0) but acks against that
-            // consumer state return -55. Note rc=0 means the call was
+            // consumer state return -55. The v1 prefix path is what
+            // WIN-911-style code uses against the same wnwrap library.
+            // Note rc=0 means the call was
             // accepted, not that an acknowledgement was applied — see
             // AcknowledgeByName below and docs/AlarmProbeFindings.md.
             int init = com.IwwAlarmConsumer_InitializeConsumer(DefaultApplicationName);