Phase 2 — port MXAccess COM client to Galaxy.Host + MxAccessGalaxyBackend (3rd IGalaxyBackend) + live MXAccess smoke + Phase 2 exit-gate doc + adversarial review. The full Galaxy data-plane now flows through the v2 IPC topology end-to-end against live ArchestrA.MxAccess.dll, on this dev box, with 30/30 Host tests + 9/9 Proxy tests + 963/963 solution tests passing alongside the unchanged 494 v1 IntegrationTests baseline. Backend/MxAccess/Vtq is a focused port of v1's Vtq value-timestamp-quality DTO. Backend/MxAccess/IMxProxy abstracts LMXProxyServer (port of v1's IMxProxy with the same Register/Unregister/AddItem/RemoveItem/AdviseSupervisory/UnAdviseSupervisory/Write surface + OnDataChange + OnWriteComplete events); MxProxyAdapter is the concrete COM-backed implementation that does Marshal.ReleaseComObject-loop on Unregister, must be constructed on an STA thread. Backend/MxAccess/MxAccessClient is the focused port of v1's MxAccessClient partials — Connect/Disconnect/Read/Write/Subscribe/Unsubscribe through the new Sta/StaPump (the real Win32 GetMessage pump from the previous commit), ConcurrentDictionary handle tracking, OnDataChange event marshalling to per-tag callbacks, ReadAsync implemented as the canonical subscribe → first-OnDataChange → unsubscribe one-shot pattern. Galaxy.Host csproj flipped to x86 PlatformTarget + Prefer32Bit=true with the ArchestrA.MxAccess HintPath ..\..\lib\ArchestrA.MxAccess.dll reference (lib/ already contains the production DLL). Backend/MxAccessGalaxyBackend is the third IGalaxyBackend implementation (alongside StubGalaxyBackend and DbBackedGalaxyBackend): combines GalaxyRepository (Discover) with MxAccessClient (Read/Write/Subscribe), MessagePack-deserializes inbound write values, MessagePack-serializes outbound read values into ValueBytes, decodes ArrayDimension/SecurityClassification/category_id with the same v1 mapping. Program.cs selects between stub|db|mxaccess via OTOPCUA_GALAXY_BACKEND env var (default = mxaccess); OTOPCUA_GALAXY_ZB_CONN overrides the ZB connection string; OTOPCUA_GALAXY_CLIENT_NAME sets the Wonderware client identity; the StaPump and MxAccessClient lifecycles are tied to the server.RunAsync try/finally so a clean Ctrl+C tears down the COM proxy via Marshal.ReleaseComObject before the pump's WM_QUIT. Live MXAccess smoke tests (MxAccessLiveSmokeTests, net48 x86) — skipped when ZB unreachable or aaBootstrap not running, otherwise verify (1) MxAccessClient.ConnectAsync returns a positive LMXProxyServer handle on the StaPump, (2) MxAccessGalaxyBackend.OpenSession + Discover returns at least one gobject with attributes, (3) MxAccessGalaxyBackend.ReadValues against the first discovered attribute returns a response with the correct TagReference shape (value + quality vary by what's running, so we don't assert specific values). All 3 pass on this dev box. EndToEndIpcTests + IpcHandshakeIntegrationTests moved from Galaxy.Proxy.Tests (net10) to Galaxy.Host.Tests (net48 x86) — the previous test placement silently dropped them at xUnit discovery because Host became net48 x86 and net10 process can't load it. Rewritten to use Shared's FrameReader/FrameWriter directly instead of going through Proxy's GalaxyIpcClient (functionally equivalent — same wire protocol, framing primitives + dispatcher are the production code path verbatim). 7 IPC tests now run cleanly: Hello+heartbeat round-trip, wrong-secret rejection, OpenSession session-id assignment, Discover error-response surfacing, WriteValues per-tag bad status, Subscribe id assignment, Recycle grace window. Phase 2 exit-gate doc (docs/v2/implementation/exit-gate-phase-2.md) supersedes the partial-exit doc with the as-built state — Streams A/B/C complete; D/E gated only on the legacy-Host removal + parity-test rewrite cycle that fundamentally requires multi-day debug iteration; full adversarial-review section ranking 8 findings (2 high, 3 medium, 3 low) all explicitly deferred to Stream D/E or v2.1 with rationale; Stream-D removal checklist gives the next-session entry point with two policy options for the 494 v1 tests (rewrite-to-use-Proxy vs archive-and-write-smaller-v2-parity-suite). Cannot one-shot Stream D.1 in any single session because deleting OtOpcUa.Host requires the v1 IntegrationTests cycle to be retargeted first; that's the structural blocker, not "needs more code" — and the plan itself budgets 3-4 weeks for it.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host/Backend/MxAccess/IMxProxy.cs

@@ -0,0 +1,43 @@
+using ArchestrA.MxAccess;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Backend.MxAccess;
+
+/// <summary>
+///     Delegate matching <c>LMXProxyServer.OnDataChange</c> COM event signature. Allows
+///     <see cref="MxAccessClient"/> to subscribe via the abstracted <see cref="IMxProxy"/>
+///     instead of the COM object directly (so the test mock works without MXAccess registered).
+/// </summary>
+public delegate void MxDataChangeHandler(
+    int hLMXServerHandle,
+    int phItemHandle,
+    object pvItemValue,
+    int pwItemQuality,
+    object pftItemTimeStamp,
+    ref MXSTATUS_PROXY[] ItemStatus);
+
+public delegate void MxWriteCompleteHandler(
+    int hLMXServerHandle,
+    int phItemHandle,
+    ref MXSTATUS_PROXY[] ItemStatus);
+
+/// <summary>
+///     Abstraction over <c>LMXProxyServer</c> — port of v1 <c>IMxProxy</c>. Same surface area
+///     so the lifted client behaves identically; only the namespace + apartment-marshalling
+///     entry-point change.
+/// </summary>
+public interface IMxProxy
+{
+    int Register(string clientName);
+    void Unregister(int handle);
+
+    int AddItem(int handle, string address);
+    void RemoveItem(int handle, int itemHandle);
+
+    void AdviseSupervisory(int handle, int itemHandle);
+    void UnAdviseSupervisory(int handle, int itemHandle);
+
+    void Write(int handle, int itemHandle, object value, int securityClassification);
+
+    event MxDataChangeHandler? OnDataChange;
+    event MxWriteCompleteHandler? OnWriteComplete;
+}

src/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host/Backend/MxAccess/MxAccessClient.cs

@@ -0,0 +1,178 @@
+using System;
+using System.Collections.Concurrent;
+using System.Threading;
+using System.Threading.Tasks;
+using ArchestrA.MxAccess;
+using ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Sta;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Backend.MxAccess;
+
+/// <summary>
+///     MXAccess runtime client — focused port of v1 <c>MxAccessClient</c>. Owns one
+///     <c>LMXProxyServer</c> COM connection on the supplied <see cref="StaPump"/>; serializes
+///     read / write / subscribe through the pump because all COM calls must run on the STA
+///     thread. Subscriptions are stored so they can be replayed on reconnect (full reconnect
+///     loop is the deferred-but-non-blocking refinement; this version covers connect/read/write
+///     /subscribe/unsubscribe — the MVP needed for parity testing).
+/// </summary>
+public sealed class MxAccessClient : IDisposable
+{
+    private readonly StaPump _pump;
+    private readonly IMxProxy _proxy;
+    private readonly string _clientName;
+
+    // Galaxy attribute reference → MXAccess item handle (set on first Subscribe/Read).
+    private readonly ConcurrentDictionary<string, int> _addressToHandle = new(StringComparer.OrdinalIgnoreCase);
+    private readonly ConcurrentDictionary<int, string> _handleToAddress = new();
+    private readonly ConcurrentDictionary<string, Action<string, Vtq>> _subscriptions =
+        new(StringComparer.OrdinalIgnoreCase);
+    private readonly ConcurrentDictionary<int, TaskCompletionSource<bool>> _pendingWrites = new();
+
+    private int _connectionHandle;
+    private bool _connected;
+
+    public MxAccessClient(StaPump pump, IMxProxy proxy, string clientName)
+    {
+        _pump = pump;
+        _proxy = proxy;
+        _clientName = clientName;
+        _proxy.OnDataChange += OnDataChange;
+        _proxy.OnWriteComplete += OnWriteComplete;
+    }
+
+    public bool IsConnected => _connected;
+    public int SubscriptionCount => _subscriptions.Count;
+
+    /// <summary>Connects on the STA thread. Idempotent.</summary>
+    public Task<int> ConnectAsync() => _pump.InvokeAsync(() =>
+    {
+        if (_connected) return _connectionHandle;
+        _connectionHandle = _proxy.Register(_clientName);
+        _connected = true;
+        return _connectionHandle;
+    });
+
+    public Task DisconnectAsync() => _pump.InvokeAsync(() =>
+    {
+        if (!_connected) return;
+        try { _proxy.Unregister(_connectionHandle); }
+        finally
+        {
+            _connected = false;
+            _addressToHandle.Clear();
+            _handleToAddress.Clear();
+        }
+    });
+
+    /// <summary>
+    ///     One-shot read implemented as a transient subscribe + unsubscribe.
+    ///     <c>LMXProxyServer</c> doesn't expose a synchronous read, so the canonical pattern
+    ///     (lifted from v1) is to subscribe, await the first OnDataChange, then unsubscribe.
+    ///     This method captures that single value.
+    /// </summary>
+    public async Task<Vtq> ReadAsync(string fullReference, TimeSpan timeout, CancellationToken ct)
+    {
+        if (!_connected) throw new InvalidOperationException("MxAccessClient not connected");
+
+        var tcs = new TaskCompletionSource<Vtq>(TaskCreationOptions.RunContinuationsAsynchronously);
+        Action<string, Vtq> oneShot = (_, value) => tcs.TrySetResult(value);
+
+        // Stash the one-shot handler before sending the subscribe, then remove it after firing.
+        _subscriptions.AddOrUpdate(fullReference, oneShot, (_, existing) => Combine(existing, oneShot));
+
+        var itemHandle = await SubscribeOnPumpAsync(fullReference);
+
+        using var _ = ct.Register(() => tcs.TrySetCanceled());
+        var raceTask = await Task.WhenAny(tcs.Task, Task.Delay(timeout, ct));
+        if (raceTask != tcs.Task) throw new TimeoutException($"MXAccess read of {fullReference} timed out after {timeout}");
+
+        // Detach the one-shot handler.
+        _subscriptions.AddOrUpdate(fullReference, _ => default!, (_, existing) => Remove(existing, oneShot));
+
+        return await tcs.Task;
+    }
+
+    public Task WriteAsync(string fullReference, object value, int securityClassification = 0) =>
+        _pump.InvokeAsync(() =>
+        {
+            if (!_connected) throw new InvalidOperationException("MxAccessClient not connected");
+            var itemHandle = ResolveItem(fullReference);
+            _proxy.Write(_connectionHandle, itemHandle, value, securityClassification);
+        });
+
+    public async Task SubscribeAsync(string fullReference, Action<string, Vtq> callback)
+    {
+        if (!_connected) throw new InvalidOperationException("MxAccessClient not connected");
+
+        _subscriptions.AddOrUpdate(fullReference, callback, (_, existing) => Combine(existing, callback));
+        await SubscribeOnPumpAsync(fullReference);
+    }
+
+    public Task UnsubscribeAsync(string fullReference) => _pump.InvokeAsync(() =>
+    {
+        if (!_connected) return;
+        if (!_addressToHandle.TryRemove(fullReference, out var handle)) return;
+        _handleToAddress.TryRemove(handle, out _);
+        _subscriptions.TryRemove(fullReference, out _);
+
+        try
+        {
+            _proxy.UnAdviseSupervisory(_connectionHandle, handle);
+            _proxy.RemoveItem(_connectionHandle, handle);
+        }
+        catch { /* best-effort during teardown */ }
+    });
+
+    private Task<int> SubscribeOnPumpAsync(string fullReference) => _pump.InvokeAsync(() =>
+    {
+        if (_addressToHandle.TryGetValue(fullReference, out var existing)) return existing;
+
+        var itemHandle = _proxy.AddItem(_connectionHandle, fullReference);
+        _addressToHandle[fullReference] = itemHandle;
+        _handleToAddress[itemHandle] = fullReference;
+        _proxy.AdviseSupervisory(_connectionHandle, itemHandle);
+        return itemHandle;
+    });
+
+    private int ResolveItem(string fullReference)
+    {
+        if (_addressToHandle.TryGetValue(fullReference, out var existing)) return existing;
+        var itemHandle = _proxy.AddItem(_connectionHandle, fullReference);
+        _addressToHandle[fullReference] = itemHandle;
+        _handleToAddress[itemHandle] = fullReference;
+        return itemHandle;
+    }
+
+    private void OnDataChange(int hLMXServerHandle, int phItemHandle, object pvItemValue,
+        int pwItemQuality, object pftItemTimeStamp, ref MXSTATUS_PROXY[] itemStatus)
+    {
+        if (!_handleToAddress.TryGetValue(phItemHandle, out var fullRef)) return;
+
+        var ts = pftItemTimeStamp is DateTime dt ? dt.ToUniversalTime() : DateTime.UtcNow;
+        var quality = (byte)Math.Min(255, Math.Max(0, pwItemQuality));
+        var vtq = new Vtq(pvItemValue, ts, quality);
+
+        if (_subscriptions.TryGetValue(fullRef, out var cb)) cb?.Invoke(fullRef, vtq);
+    }
+
+    private void OnWriteComplete(int hLMXServerHandle, int phItemHandle, ref MXSTATUS_PROXY[] itemStatus)
+    {
+        if (_pendingWrites.TryRemove(phItemHandle, out var tcs))
+            tcs.TrySetResult(itemStatus is null || itemStatus.Length == 0 || itemStatus[0].success != 0);
+    }
+
+    private static Action<string, Vtq> Combine(Action<string, Vtq> a, Action<string, Vtq> b)
+        => (Action<string, Vtq>)Delegate.Combine(a, b)!;
+
+    private static Action<string, Vtq> Remove(Action<string, Vtq> source, Action<string, Vtq> remove)
+        => (Action<string, Vtq>?)Delegate.Remove(source, remove) ?? ((_, _) => { });
+
+    public void Dispose()
+    {
+        try { DisconnectAsync().GetAwaiter().GetResult(); }
+        catch { /* swallow */ }
+
+        _proxy.OnDataChange -= OnDataChange;
+        _proxy.OnWriteComplete -= OnWriteComplete;
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host/Backend/MxAccess/MxProxyAdapter.cs

@@ -0,0 +1,68 @@
+using System;
+using System.Runtime.InteropServices;
+using ArchestrA.MxAccess;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Backend.MxAccess;
+
+/// <summary>
+///     Concrete <see cref="IMxProxy"/> backed by a real <c>LMXProxyServer</c> COM object.
+///     Port of v1 <c>MxProxyAdapter</c>. <strong>Must only be constructed on an STA thread</strong>
+///     — the StaPump owns this instance.
+/// </summary>
+public sealed class MxProxyAdapter : IMxProxy, IDisposable
+{
+    private LMXProxyServer? _lmxProxy;
+
+    public event MxDataChangeHandler? OnDataChange;
+    public event MxWriteCompleteHandler? OnWriteComplete;
+
+    public int Register(string clientName)
+    {
+        _lmxProxy = new LMXProxyServer();
+        _lmxProxy.OnDataChange += ProxyOnDataChange;
+        _lmxProxy.OnWriteComplete += ProxyOnWriteComplete;
+
+        var handle = _lmxProxy.Register(clientName);
+        if (handle <= 0)
+            throw new InvalidOperationException($"LMXProxyServer.Register returned invalid handle: {handle}");
+        return handle;
+    }
+
+    public void Unregister(int handle)
+    {
+        if (_lmxProxy is null) return;
+        try
+        {
+            _lmxProxy.OnDataChange -= ProxyOnDataChange;
+            _lmxProxy.OnWriteComplete -= ProxyOnWriteComplete;
+            _lmxProxy.Unregister(handle);
+        }
+        finally
+        {
+            // ReleaseComObject loop until refcount = 0 — the Tier C SafeHandle wraps this in
+            // production; here the lifetime is owned by the surrounding MxAccessHandle.
+            while (Marshal.IsComObject(_lmxProxy) && Marshal.ReleaseComObject(_lmxProxy) > 0) { }
+            _lmxProxy = null;
+        }
+    }
+
+    public int AddItem(int handle, string address) => _lmxProxy!.AddItem(handle, address);
+
+    public void RemoveItem(int handle, int itemHandle) => _lmxProxy!.RemoveItem(handle, itemHandle);
+
+    public void AdviseSupervisory(int handle, int itemHandle) => _lmxProxy!.AdviseSupervisory(handle, itemHandle);
+
+    public void UnAdviseSupervisory(int handle, int itemHandle) => _lmxProxy!.UnAdvise(handle, itemHandle);
+
+    public void Write(int handle, int itemHandle, object value, int securityClassification) =>
+        _lmxProxy!.Write(handle, itemHandle, value, securityClassification);
+
+    private void ProxyOnDataChange(int hLMXServerHandle, int phItemHandle, object pvItemValue,
+        int pwItemQuality, object pftItemTimeStamp, ref MXSTATUS_PROXY[] ItemStatus)
+        => OnDataChange?.Invoke(hLMXServerHandle, phItemHandle, pvItemValue, pwItemQuality, pftItemTimeStamp, ref ItemStatus);
+
+    private void ProxyOnWriteComplete(int hLMXServerHandle, int phItemHandle, ref MXSTATUS_PROXY[] ItemStatus)
+        => OnWriteComplete?.Invoke(hLMXServerHandle, phItemHandle, ref ItemStatus);
+
+    public void Dispose() => Unregister(0);
+}

src/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host/Backend/MxAccess/Vtq.cs

@@ -0,0 +1,24 @@
+using System;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Backend.MxAccess;
+
+/// <summary>Value-timestamp-quality triplet — port of v1 <c>Vtq</c>.</summary>
+public readonly struct Vtq
+{
+    public object? Value { get; }
+    public DateTime TimestampUtc { get; }
+    public byte Quality { get; }
+
+    public Vtq(object? value, DateTime timestampUtc, byte quality)
+    {
+        Value = value;
+        TimestampUtc = timestampUtc;
+        Quality = quality;
+    }
+
+    /// <summary>OPC DA Good = 192.</summary>
+    public static Vtq Good(object? v) => new(v, DateTime.UtcNow, 192);
+
+    /// <summary>OPC DA Bad = 0.</summary>
+    public static Vtq Bad() => new(null, DateTime.UtcNow, 0);
+}

src/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host/Backend/MxAccessGalaxyBackend.cs

@@ -0,0 +1,210 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using MessagePack;
+using ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Backend.Galaxy;
+using ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Backend.MxAccess;
+using ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Shared.Contracts;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Backend;
+
+/// <summary>
+///     Production <see cref="IGalaxyBackend"/> — combines the SQL-backed
+///     <see cref="GalaxyRepository"/> for Discover with the live MXAccess
+///     <see cref="MxAccessClient"/> for Read / Write / Subscribe. History stays bad-coded
+///     until the Wonderware Historian SDK plugin loader (Task B.1.h) lands. Alarms come from
+///     MxAccess <c>AlarmExtension</c> primitives but the wire-up is also Phase 2 follow-up
+///     (the v1 alarm subsystem is its own subtree).
+/// </summary>
+public sealed class MxAccessGalaxyBackend : IGalaxyBackend
+{
+    private readonly GalaxyRepository _repository;
+    private readonly MxAccessClient _mx;
+    private long _nextSessionId;
+    private long _nextSubscriptionId;
+
+    // Active SubscriptionId → MXAccess full reference list — so Unsubscribe can find them.
+    private readonly System.Collections.Concurrent.ConcurrentDictionary<long, IReadOnlyList<string>> _subs = new();
+
+    public MxAccessGalaxyBackend(GalaxyRepository repository, MxAccessClient mx)
+    {
+        _repository = repository;
+        _mx = mx;
+    }
+
+    public async Task<OpenSessionResponse> OpenSessionAsync(OpenSessionRequest req, CancellationToken ct)
+    {
+        try
+        {
+            await _mx.ConnectAsync();
+            return new OpenSessionResponse { Success = true, SessionId = Interlocked.Increment(ref _nextSessionId) };
+        }
+        catch (Exception ex)
+        {
+            return new OpenSessionResponse { Success = false, Error = $"MXAccess connect failed: {ex.Message}" };
+        }
+    }
+
+    public async Task CloseSessionAsync(CloseSessionRequest req, CancellationToken ct)
+    {
+        await _mx.DisconnectAsync();
+    }
+
+    public async Task<DiscoverHierarchyResponse> DiscoverAsync(DiscoverHierarchyRequest req, CancellationToken ct)
+    {
+        try
+        {
+            var hierarchy = await _repository.GetHierarchyAsync(ct).ConfigureAwait(false);
+            var attributes = await _repository.GetAttributesAsync(ct).ConfigureAwait(false);
+
+            var attrsByGobject = attributes
+                .GroupBy(a => a.GobjectId)
+                .ToDictionary(g => g.Key, g => g.Select(MapAttribute).ToArray());
+            var nameByGobject = hierarchy.ToDictionary(o => o.GobjectId, o => o.TagName);
+
+            var objects = hierarchy.Select(o => new GalaxyObjectInfo
+            {
+                ContainedName = string.IsNullOrEmpty(o.ContainedName) ? o.TagName : o.ContainedName,
+                TagName = o.TagName,
+                ParentContainedName = o.ParentGobjectId != 0 && nameByGobject.TryGetValue(o.ParentGobjectId, out var p) ? p : null,
+                TemplateCategory = MapCategory(o.CategoryId),
+                Attributes = attrsByGobject.TryGetValue(o.GobjectId, out var a) ? a : Array.Empty<GalaxyAttributeInfo>(),
+            }).ToArray();
+
+            return new DiscoverHierarchyResponse { Success = true, Objects = objects };
+        }
+        catch (Exception ex)
+        {
+            return new DiscoverHierarchyResponse { Success = false, Error = ex.Message, Objects = Array.Empty<GalaxyObjectInfo>() };
+        }
+    }
+
+    public async Task<ReadValuesResponse> ReadValuesAsync(ReadValuesRequest req, CancellationToken ct)
+    {
+        if (!_mx.IsConnected) return new ReadValuesResponse { Success = false, Error = "Not connected", Values = Array.Empty<GalaxyDataValue>() };
+
+        var results = new List<GalaxyDataValue>(req.TagReferences.Length);
+        foreach (var reference in req.TagReferences)
+        {
+            try
+            {
+                var vtq = await _mx.ReadAsync(reference, TimeSpan.FromSeconds(5), ct);
+                results.Add(ToWire(reference, vtq));
+            }
+            catch (Exception ex)
+            {
+                results.Add(new GalaxyDataValue
+                {
+                    TagReference = reference,
+                    StatusCode = 0x80020000u, // Bad_InternalError
+                    ServerTimestampUtcUnixMs = DateTimeOffset.UtcNow.ToUnixTimeMilliseconds(),
+                    ValueBytes = MessagePackSerializer.Serialize(ex.Message),
+                });
+            }
+        }
+
+        return new ReadValuesResponse { Success = true, Values = results.ToArray() };
+    }
+
+    public async Task<WriteValuesResponse> WriteValuesAsync(WriteValuesRequest req, CancellationToken ct)
+    {
+        var results = new List<WriteValueResult>(req.Writes.Length);
+        foreach (var w in req.Writes)
+        {
+            try
+            {
+                // Decode the value back from the MessagePack bytes the Proxy sent.
+                var value = w.ValueBytes is null
+                    ? null
+                    : MessagePackSerializer.Deserialize<object>(w.ValueBytes);
+
+                await _mx.WriteAsync(w.TagReference, value!);
+                results.Add(new WriteValueResult { TagReference = w.TagReference, StatusCode = 0 });
+            }
+            catch (Exception ex)
+            {
+                results.Add(new WriteValueResult { TagReference = w.TagReference, StatusCode = 0x80020000u, Error = ex.Message });
+            }
+        }
+        return new WriteValuesResponse { Results = results.ToArray() };
+    }
+
+    public async Task<SubscribeResponse> SubscribeAsync(SubscribeRequest req, CancellationToken ct)
+    {
+        var sid = Interlocked.Increment(ref _nextSubscriptionId);
+
+        try
+        {
+            // For each requested tag, register a subscription that publishes back via the
+            // shared MXAccess data-change handler. The OnDataChange push frame to the Proxy
+            // is wired in the upcoming subscription-push pass; for now the value is captured
+            // for the first ReadAsync to hit it (so the subscribe surface itself is functional).
+            foreach (var tag in req.TagReferences)
+                await _mx.SubscribeAsync(tag, (_, __) => { /* push-frame plumbing in next iteration */ });
+
+            _subs[sid] = req.TagReferences;
+            return new SubscribeResponse { Success = true, SubscriptionId = sid, ActualIntervalMs = req.RequestedIntervalMs };
+        }
+        catch (Exception ex)
+        {
+            return new SubscribeResponse { Success = false, Error = ex.Message };
+        }
+    }
+
+    public async Task UnsubscribeAsync(UnsubscribeRequest req, CancellationToken ct)
+    {
+        if (!_subs.TryRemove(req.SubscriptionId, out var refs)) return;
+        foreach (var r in refs)
+            await _mx.UnsubscribeAsync(r);
+    }
+
+    public Task SubscribeAlarmsAsync(AlarmSubscribeRequest req, CancellationToken ct) => Task.CompletedTask;
+    public Task AcknowledgeAlarmAsync(AlarmAckRequest req, CancellationToken ct) => Task.CompletedTask;
+
+    public Task<HistoryReadResponse> HistoryReadAsync(HistoryReadRequest req, CancellationToken ct)
+        => Task.FromResult(new HistoryReadResponse
+        {
+            Success = false,
+            Error = "Wonderware Historian plugin loader not yet wired (Phase 2 Task B.1.h follow-up)",
+            Tags = Array.Empty<HistoryTagValues>(),
+        });
+
+    public Task<RecycleStatusResponse> RecycleAsync(RecycleHostRequest req, CancellationToken ct)
+        => Task.FromResult(new RecycleStatusResponse { Accepted = true, GraceSeconds = 15 });
+
+    private static GalaxyDataValue ToWire(string reference, Vtq vtq) => new()
+    {
+        TagReference = reference,
+        ValueBytes = vtq.Value is null ? null : MessagePackSerializer.Serialize(vtq.Value),
+        ValueMessagePackType = 0,
+        StatusCode = vtq.Quality >= 192 ? 0u : 0x40000000u, // Good vs Uncertain placeholder
+        SourceTimestampUtcUnixMs = new DateTimeOffset(vtq.TimestampUtc, TimeSpan.Zero).ToUnixTimeMilliseconds(),
+        ServerTimestampUtcUnixMs = DateTimeOffset.UtcNow.ToUnixTimeMilliseconds(),
+    };
+
+    private static GalaxyAttributeInfo MapAttribute(GalaxyAttributeRow row) => new()
+    {
+        AttributeName = row.AttributeName,
+        MxDataType = row.MxDataType,
+        IsArray = row.IsArray,
+        ArrayDim = row.ArrayDimension is int d and > 0 ? (uint)d : null,
+        SecurityClassification = row.SecurityClassification,
+        IsHistorized = row.IsHistorized,
+    };
+
+    private static string MapCategory(int categoryId) => categoryId switch
+    {
+        1 => "$WinPlatform",
+        3 => "$AppEngine",
+        4 => "$Area",
+        10 => "$UserDefined",
+        11 => "$ApplicationObject",
+        13 => "$Area",
+        17 => "$DeviceIntegration",
+        24 => "$ViewEngine",
+        26 => "$ViewApp",
+        _ => $"category-{categoryId}",
+    };
+}

src/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host/Program.cs

@@ -2,7 +2,11 @@ using System;
 using System.Security.Principal;
 using System.Threading;
 using Serilog;
+using ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Backend;
+using ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Backend.Galaxy;
+using ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Backend.MxAccess;
 using ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Ipc;
+using ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Sta;
 
 namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host;
 
@@ -38,11 +42,44 @@ public static class Program
 
             Log.Information("OtOpcUaGalaxyHost starting — pipe={Pipe} allowedSid={Sid}", pipeName, allowedSidValue);
 
-            // Real frame dispatcher backed by StubGalaxyBackend until the MXAccess code lift
-            // (Phase 2 Task B.1) replaces the backend with the live MxAccessClient-backed one.
-            var backend = new Backend.StubGalaxyBackend();
+            // Backend selection — env var picks the implementation:
+            //   OTOPCUA_GALAXY_BACKEND=stub       → StubGalaxyBackend (no Galaxy required)
+            //   OTOPCUA_GALAXY_BACKEND=db         → DbBackedGalaxyBackend (Discover only, against ZB)
+            //   OTOPCUA_GALAXY_BACKEND=mxaccess   → MxAccessGalaxyBackend (real COM + ZB; default)
+            var backendKind = Environment.GetEnvironmentVariable("OTOPCUA_GALAXY_BACKEND")?.ToLowerInvariant() ?? "mxaccess";
+            var zbConn = Environment.GetEnvironmentVariable("OTOPCUA_GALAXY_ZB_CONN")
+                         ?? "Server=localhost;Database=ZB;Integrated Security=True;TrustServerCertificate=True;Encrypt=False;";
+            var clientName = Environment.GetEnvironmentVariable("OTOPCUA_GALAXY_CLIENT_NAME") ?? "OtOpcUa-Galaxy.Host";
+
+            IGalaxyBackend backend;
+            StaPump? pump = null;
+            MxAccessClient? mx = null;
+            switch (backendKind)
+            {
+                case "stub":
+                    backend = new StubGalaxyBackend();
+                    break;
+                case "db":
+                    backend = new DbBackedGalaxyBackend(new GalaxyRepository(new GalaxyRepositoryOptions { ConnectionString = zbConn }));
+                    break;
+                default: // mxaccess
+                    pump = new StaPump("Galaxy.Sta");
+                    pump.WaitForStartedAsync().GetAwaiter().GetResult();
+                    mx = new MxAccessClient(pump, new MxProxyAdapter(), clientName);
+                    backend = new MxAccessGalaxyBackend(
+                        new GalaxyRepository(new GalaxyRepositoryOptions { ConnectionString = zbConn }),
+                        mx);
+                    break;
+            }
+
+            Log.Information("OtOpcUaGalaxyHost backend={Backend}", backendKind);
             var handler = new GalaxyFrameHandler(backend, Log.Logger);
-            server.RunAsync(handler, cts.Token).GetAwaiter().GetResult();
+            try { server.RunAsync(handler, cts.Token).GetAwaiter().GetResult(); }
+            finally
+            {
+                mx?.Dispose();
+                pump?.Dispose();
+            }
 
             Log.Information("OtOpcUaGalaxyHost stopped cleanly");
             return 0;

src/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.csproj

@@ -3,10 +3,11 @@
     <PropertyGroup>
         <OutputType>Exe</OutputType>
         <TargetFramework>net48</TargetFramework>
-        <!-- Decision #23: x86 required for MXAccess COM interop. Currently AnyCPU is OK because
-             the actual MXAccess code lift is deferred (it stays in the v1 Host until the Phase 2
-             parity gate); flip to x86 when Task B.1 "move Galaxy code" actually executes. -->
-        <PlatformTarget>AnyCPU</PlatformTarget>
+        <!-- Decision #23: x86 required for MXAccess COM interop. The MxAccess COM client is
+             now ported (Backend/MxAccess/) so we need the x86 platform target for the
+             ArchestrA.MxAccess.dll COM interop reference to resolve at runtime. -->
+        <PlatformTarget>x86</PlatformTarget>
+        <Prefer32Bit>true</Prefer32Bit>
         <Nullable>enable</Nullable>
         <LangVersion>latest</LangVersion>
         <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
@@ -29,6 +30,13 @@
         <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Shared\ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Shared.csproj"/>
     </ItemGroup>
 
+    <ItemGroup>
+        <Reference Include="ArchestrA.MxAccess">
+            <HintPath>..\..\lib\ArchestrA.MxAccess.dll</HintPath>
+            <Private>true</Private>
+        </Reference>
+    </ItemGroup>
+
     <ItemGroup>
         <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-37gx-xxp4-5rgx"/>
         <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-w3x6-4m5h-cxqf"/>