fix(code-review): resolve Batch 2 open findings (AbCip, AbLegacy, Galaxy, FOCAS)

- Driver.AbCip.Contracts-001: parse 'writable' from TagConfig JSON (default true) instead of hardcoding
- Driver.AbCip.Contracts-002/-003: Dt type comment; drop dead [Display]/[Range] annotations
- Driver.AbCip.Contracts-004: dedicated AbCipEquipmentTagParser test class (+15)
- Driver.AbCip-017: document Tick severity Low-fallback on Bad severity read
- Driver.AbLegacy.Contracts-002/-003/-004: isArray-scalar remarks (+tests), MaxTagBytes/ForFamily docs
- Driver.Galaxy.Browser-003 + Driver.Galaxy.Contracts-003: extract ResolveApiKey -> GalaxySecretRef (dedup)
- Driver.Galaxy-019: cache buffered-interval only on Ok + ILogger warnings + ClassifyIntervalReply (+tests)
- Driver.FOCAS.Contracts-002: thread WriteIdempotent through DiscoverAsync (+test)

code-reviews/Driver.Galaxy.Browser/findings.md

@@ -11,7 +11,7 @@
 | Review date | 2026-06-19 |
 | Commit reviewed | `7286d320` |
 | Status | Reviewed |
-| Open findings | 1 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -27,7 +27,7 @@ a category produced nothing rather than leaving it blank.
 | 5 | Security | No issues found |
 | 6 | Performance & resource management | No issues found |
 | 7 | Design-document adherence | No issues found |
-| 8 | Code organization & conventions | Driver.Galaxy.Browser-003 (Low): ResolveApiKey duplicated from GalaxyDriver with no sync mechanism |
+| 8 | Code organization & conventions | Driver.Galaxy.Browser-003 (Low, Resolved): ResolveApiKey duplicated from GalaxyDriver; extracted to `GalaxySecretRef` in Driver.Galaxy.Contracts |
 | 9 | Testing coverage | Driver.Galaxy.Browser-004 (Low): MapSecurityClass not unit-tested; pure static method with no gateway dependency |
 | 10 | Documentation & comments | No issues found |
 
@@ -119,7 +119,7 @@ mirroring the existing pattern for `_client.DisposeAsync()`. Regression test
 | Severity | Low |
 | Category | Code organization & conventions |
 | Location | `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser/GalaxyDriverBrowser.cs:149` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `GalaxyDriverBrowser.ResolveApiKey` is a verbatim copy of
 `GalaxyDriver.ResolveApiKey`. The comment acknowledges this and explains why the Browser
@@ -133,8 +133,17 @@ and emit a spurious warning.
 which both `Driver.Galaxy` and `Driver.Galaxy.Browser` already reference. This is a
 one-line addition to Contracts — no migration, no public-contract break.
 
-**Resolution:** _(deferred — requires a change in the Galaxy.Contracts project, outside
-this module's boundary; tracked for a future consolidation pass)_
+**Resolution:** Resolved 2026-06-20 — closed by the same fix as the cross-referenced
+Driver.Galaxy.Contracts-003. The resolver was extracted into a new
+`public static class GalaxySecretRef` in `Driver.Galaxy.Contracts`
+(`ResolveApiKey(string secretRef, ILogger? logger = null)`), which both Driver.Galaxy
+and Driver.Galaxy.Browser already reference. `GalaxyDriverBrowser.BuildClientOptions`
+now calls `GalaxySecretRef.ResolveApiKey(gw.ApiKeySecretRef, _logger)` and its private
+`ResolveApiKey` copy is deleted — eliminating the drift risk (a future `vault:` prefix
+is now added in one place). Behaviour is preserved exactly: the Browser's `_logger` is
+never null (defaults to `NullLogger`), so the literal-arm cleartext warning still fires.
+The Browser project builds clean against the shared resolver. See
+Driver.Galaxy.Contracts-003 for the full extraction details.
 
 ---