docs(src): add missing XML docs and strip tracking-ID comments

Sweep of 203 source files resolving CommentChecker findings: add
<summary>/<param>/<returns>/<inheritdoc> where missing, and remove
resolved task/issue tracking markers (Tests-NNN, Worker-NNN, Server-NNN,
Task N) from code comments. Comment/doc-only — no logic changes.
Server+Tests build clean under TreatWarningsAsErrors.

src/ZB.MOM.WW.MxGateway.Tests/Security/Authorization/ConstraintEnforcerTests.cs

@@ -16,6 +16,7 @@ namespace ZB.MOM.WW.MxGateway.Tests.Security.Authorization;
 public sealed class ConstraintEnforcerTests
 {
     /// <summary>Verifies that read outside allowed subtree returns failure.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task CheckReadTagAsync_WhenOutsideReadSubtree_ReturnsFailure()
     {
@@ -35,6 +36,7 @@ public sealed class ConstraintEnforcerTests
     }
 
     /// <summary>Verifies that write with high classification returns failure and audits.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task CheckWriteHandleAsync_WhenClassificationTooHigh_ReturnsFailureAndAudits()
     {
@@ -84,6 +86,7 @@ public sealed class ConstraintEnforcerTests
     }
 
     /// <summary>A denial carrying a parseable correlation id stores it on the audit record.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task RecordDenialAsync_WithGuidCorrelationId_StoresCorrelationId()
     {
@@ -106,6 +109,7 @@ public sealed class ConstraintEnforcerTests
     ///     A denial with a non-GUID correlation id leaves the typed audit correlation id null but
     ///     still preserves the raw client correlation id in DetailsJson so it is not lost.
     /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task RecordDenialAsync_WithNonGuidCorrelationId_LeavesCorrelationIdNullButPreservesRawInDetails()
     {
@@ -130,6 +134,7 @@ public sealed class ConstraintEnforcerTests
     }
 
     /// <summary>A denial with no identity records the canonical "anonymous" actor.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task RecordDenialAsync_WithoutIdentity_UsesAnonymousActor()
     {
@@ -150,6 +155,7 @@ public sealed class ConstraintEnforcerTests
     }
 
     /// <summary>Verifies that historized-only constraint requires historized attribute.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task CheckReadTagAsync_WithHistorizedOnly_RequiresRequestedAttributeToBeHistorized()
     {
@@ -169,6 +175,7 @@ public sealed class ConstraintEnforcerTests
     }
 
     /// <summary>Verifies that alarm-only constraint requires alarm attribute.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task CheckReadTagAsync_WithAlarmOnly_RequiresRequestedAttributeToBeAlarm()
     {
@@ -188,6 +195,7 @@ public sealed class ConstraintEnforcerTests
     }
 
     /// <summary>Verifies that attribute-only constraint fails closed for object tag.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task CheckReadTagAsync_WithAttributeOnlyConstraint_FailsClosedForObjectTag()
     {
@@ -212,6 +220,7 @@ public sealed class ConstraintEnforcerTests
     ///     Without the <c>[]</c> fallback in ResolveTarget the bare name misses the index and a
     ///     read-constrained key gets a spurious tag_metadata denial for an AddItem it should allow.
     /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task CheckReadTagAsync_WithBareArrayName_ResolvesViaArraySuffixFallback()
     {
@@ -236,6 +245,7 @@ public sealed class ConstraintEnforcerTests
     ///     A bare non-array name that is genuinely absent from the index still resolves to null:
     ///     the <c>[]</c> probe must not manufacture a false positive for a scalar/missing tag.
     /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task CheckReadTagAsync_WithMissingNonArrayName_StillFailsToResolve()
     {
@@ -265,8 +275,9 @@ public sealed class ConstraintEnforcerTests
     /// <summary>
     ///     The <c>[]</c>-suffix fallback widened *resolution* of a bare array name, not *authorization*:
     ///     a bare array attribute that resolves through the fallback but is outside the key's read scope
-    ///     must still be denied with a <c>read_scope</c> failure (Server-058).
+    ///     must still be denied with a <c>read_scope</c> failure.
     /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task CheckReadTagAsync_WithBareArrayName_OutOfScope_StillDeniedReadScope()
     {
@@ -289,8 +300,9 @@ public sealed class ConstraintEnforcerTests
     /// <summary>
     ///     A write against an array handle whose registration carries the suffixed form ("Pump_001.Levels[]")
     ///     resolves through <c>ResolveTarget</c> and is denied with a <c>write_scope</c> failure when the
-    ///     array attribute is outside the key's write scope (Server-058).
+    ///     array attribute is outside the key's write scope.
     /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task CheckWriteHandleAsync_WithSuffixedArrayRegistration_OutOfScope_StillDeniedWriteScope()
     {
@@ -331,9 +343,9 @@ public sealed class ConstraintEnforcerTests
     /// <summary>
     ///     A write against an in-scope array handle whose registration carries the suffixed form is still
     ///     denied when the array attribute's <c>SecurityClassification</c> exceeds the key's
-    ///     <c>MaxWriteClassification</c>, resolved through <c>ResolveTarget</c> via the suffixed address
-    ///     (Server-058).
+    ///     <c>MaxWriteClassification</c>, resolved through <c>ResolveTarget</c> via the suffixed address.
     /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task CheckWriteHandleAsync_WithSuffixedArrayRegistration_ClassificationTooHigh_StillDenied()
     {
@@ -490,10 +502,14 @@ public sealed class ConstraintEnforcerTests
         /// <summary>Gets the current cache entry.</summary>
         public GalaxyHierarchyCacheEntry Current { get; } = current;
 
-        /// <inheritdoc />
+        /// <summary>No-op refresh; the stub's <see cref="Current"/> entry never changes.</summary>
+        /// <param name="cancellationToken">Token to cancel the asynchronous operation.</param>
+        /// <returns>A task that represents the asynchronous operation.</returns>
         public Task RefreshAsync(CancellationToken cancellationToken) => Task.CompletedTask;
 
-        /// <inheritdoc />
+        /// <summary>No-op wait; the stub's <see cref="Current"/> entry is already loaded.</summary>
+        /// <param name="cancellationToken">Token to cancel the asynchronous operation.</param>
+        /// <returns>A task that represents the asynchronous operation.</returns>
         public Task WaitForFirstLoadAsync(CancellationToken cancellationToken) => Task.CompletedTask;
     }
 
@@ -502,7 +518,10 @@ public sealed class ConstraintEnforcerTests
         /// <summary>Gets the recorded canonical audit events.</summary>
         public List<AuditEvent> Events { get; } = [];
 
-        /// <inheritdoc />
+        /// <summary>Records the audit event in <see cref="Events"/> for later assertions.</summary>
+        /// <param name="auditEvent">The audit event to record.</param>
+        /// <param name="cancellationToken">Token to cancel the asynchronous operation.</param>
+        /// <returns>A task that represents the asynchronous operation.</returns>
         public Task WriteAsync(AuditEvent auditEvent, CancellationToken cancellationToken = default)
         {
             Events.Add(auditEvent);

src/ZB.MOM.WW.MxGateway.Tests/Security/Authorization/GatewayGrpcAuthorizationInterceptorTests.cs

@@ -23,6 +23,7 @@ namespace ZB.MOM.WW.MxGateway.Tests.Security.Authorization;
 public sealed class GatewayGrpcAuthorizationInterceptorTests
 {
     /// <summary>Verifies that missing API key returns unauthenticated status.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task UnaryServerHandler_MissingApiKey_ReturnsUnauthenticated()
     {
@@ -41,6 +42,7 @@ public sealed class GatewayGrpcAuthorizationInterceptorTests
     }
 
     /// <summary>Verifies that invalid API key error does not expose raw credentials.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task UnaryServerHandler_InvalidApiKey_DoesNotExposeRawCredentialInStatus()
     {
@@ -59,6 +61,7 @@ public sealed class GatewayGrpcAuthorizationInterceptorTests
     }
 
     /// <summary>Verifies that valid key without required scope returns permission denied.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task UnaryServerHandler_ValidApiKeyMissingScope_ReturnsPermissionDenied()
     {
@@ -77,6 +80,7 @@ public sealed class GatewayGrpcAuthorizationInterceptorTests
     }
 
     /// <summary>Verifies that valid key with scope sets request identity for the handler.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task UnaryServerHandler_ValidApiKeyWithScope_SetsRequestIdentity()
     {
@@ -103,6 +107,7 @@ public sealed class GatewayGrpcAuthorizationInterceptorTests
     }
 
     /// <summary>Verifies that server stream handler requires proper scope.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task ServerStreamingServerHandler_ValidApiKeyMissingScope_ReturnsPermissionDenied()
     {
@@ -122,6 +127,7 @@ public sealed class GatewayGrpcAuthorizationInterceptorTests
     }
 
     /// <summary>Verifies that server stream handler allows streams with proper scope.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task ServerStreamingServerHandler_ValidApiKeyWithScope_AllowsStream()
     {
@@ -147,6 +153,7 @@ public sealed class GatewayGrpcAuthorizationInterceptorTests
     }
 
     /// <summary>Verifies that disabled authentication skips API key verification.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task UnaryServerHandler_AuthenticationDisabled_SkipsApiKeyVerification()
     {
@@ -173,6 +180,7 @@ public sealed class GatewayGrpcAuthorizationInterceptorTests
     /// that lacks the <c>session:open</c> scope, and asserts the interceptor denies the
     /// call with <see cref="StatusCode.PermissionDenied"/> before the service runs.
     /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task InterceptorComposedWithService_OpenSessionMissingScope_DeniesBeforeServiceRuns()
     {
@@ -200,6 +208,7 @@ public sealed class GatewayGrpcAuthorizationInterceptorTests
     /// that holds <c>session:open</c>, and asserts the service runs and observes the
     /// interceptor-supplied identity.
     /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task InterceptorComposedWithService_OpenSessionWithScope_RunsServiceWithIdentity()
     {
@@ -226,6 +235,7 @@ public sealed class GatewayGrpcAuthorizationInterceptorTests
     /// because the wrapped command is a write, confirming command-scope mapping is
     /// enforced through the full composition.
     /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task InterceptorComposedWithService_InvokeWriteCommandWithReadScope_DeniesBeforeServiceRuns()
     {
@@ -261,6 +271,7 @@ public sealed class GatewayGrpcAuthorizationInterceptorTests
     /// <see cref="GatewayScopes.InvokeWrite"/>. Ack is a write-shaped mutation against
     /// alarm state, so it carries the same scope as <c>MxCommandKind.Write</c>.
     /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task UnaryServerHandler_AcknowledgeAlarmMissingScope_ReturnsPermissionDenied()
     {
@@ -279,6 +290,7 @@ public sealed class GatewayGrpcAuthorizationInterceptorTests
     }
 
     /// <summary>Verifies that an API key holding <c>invoke:write</c> may call <c>AcknowledgeAlarm</c>.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task UnaryServerHandler_AcknowledgeAlarmWithScope_RunsHandler()
     {
@@ -305,6 +317,7 @@ public sealed class GatewayGrpcAuthorizationInterceptorTests
     /// lack <see cref="GatewayScopes.EventsRead"/>. Active-alarm snapshots are part of the
     /// alarm/event surface and share the same scope as <c>StreamEvents</c>.
     /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task ServerStreamingServerHandler_QueryActiveAlarmsMissingScope_ReturnsPermissionDenied()
     {
@@ -324,6 +337,7 @@ public sealed class GatewayGrpcAuthorizationInterceptorTests
     }
 
     /// <summary>Verifies that an API key holding <c>events:read</c> may call <c>QueryActiveAlarms</c>.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task ServerStreamingServerHandler_QueryActiveAlarmsWithScope_RunsHandler()
     {