The XML doc on AccountSecurity.RepairMigratedPasswords still described the
superseded single-switch design: it presented the flag as the only control
and never mentioned Account.RepairPasswordTag, so an operator reading only
that comment would enable the flag, watch nothing get repaired, and conclude
the feature was broken. Its cost rationale was overstated too -- the second
verify now runs only for tagged accounts, not on every failed login, so the
flag alone does not widen the credential-stuffing surface.
Rewrite it to say what the code does: master switch, tag independently
required, set from the admin gump and cleared on a successful repair, and
only ever on an account whose owner has reported the lockout -- because the
repair cannot tell a mis-migrated hash from a password that merely begins
with the username.
Cross-reference the two by cref in both directions so either comment leads
to the other. Comment-only; no behaviour change.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
da0d993186