fix(code-review): resolve Batch 2 open findings (AbCip, AbLegacy, Galaxy, FOCAS)

- Driver.AbCip.Contracts-001: parse 'writable' from TagConfig JSON (default true) instead of hardcoding
- Driver.AbCip.Contracts-002/-003: Dt type comment; drop dead [Display]/[Range] annotations
- Driver.AbCip.Contracts-004: dedicated AbCipEquipmentTagParser test class (+15)
- Driver.AbCip-017: document Tick severity Low-fallback on Bad severity read
- Driver.AbLegacy.Contracts-002/-003/-004: isArray-scalar remarks (+tests), MaxTagBytes/ForFamily docs
- Driver.Galaxy.Browser-003 + Driver.Galaxy.Contracts-003: extract ResolveApiKey -> GalaxySecretRef (dedup)
- Driver.Galaxy-019: cache buffered-interval only on Ok + ILogger warnings + ClassifyIntervalReply (+tests)
- Driver.FOCAS.Contracts-002: thread WriteIdempotent through DiscoverAsync (+test)

code-reviews/Driver.Galaxy.Contracts/findings.md

@@ -11,7 +11,7 @@
 | Review date | 2026-06-19 |
 | Commit reviewed | `7286d320` |
 | Status | Reviewed |
-| Open findings | 1 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -27,7 +27,7 @@ a category produced nothing rather than leaving it blank.
 | 5 | Security | No issues found (ApiKeySecretRef is documented as an indirection reference; no defaults store a cleartext secret; no ToString override leaks the ref) |
 | 6 | Performance & resource management | No issues found (pure records; no allocations, disposables, or resource lifetimes) |
 | 7 | Design-document adherence | No issues found (records match CLAUDE.md Gateway/MxAccess/Repository/Reconnect section layout) |
-| 8 | Code organization & conventions | Driver.Galaxy.Contracts-003 (Low, Open): ResolveApiKey helper duplicated between GalaxyDriver and GalaxyBrowseSession; Contracts is the natural home |
+| 8 | Code organization & conventions | Driver.Galaxy.Contracts-003 (Low, Resolved): ResolveApiKey helper duplicated between GalaxyDriver and GalaxyBrowseSession; extracted to `GalaxySecretRef` in Contracts |
 | 9 | Testing coverage | No issues found (no logic to test; pure data records with default values) |
 | 10 | Documentation & comments | Driver.Galaxy.Contracts-001 (Low, Resolved): Internal code-review finding ID `(Driver.Galaxy-010)` in shipped XML doc |
 
@@ -108,7 +108,7 @@ note the minimum and that `EventPump` enforces it at construction. Verified by b
 | Severity | Low |
 | Category | Code organization & conventions |
 | Location | `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser/GalaxyDriverBrowser.cs:149` (duplicate) and `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy/GalaxyDriver.cs:472` (original) |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `GalaxyDriver.ResolveApiKey` (the four-form `env:`/`file:`/`dev:`/literal
 resolver, ~45 LOC) is duplicated verbatim as `GalaxyDriverBrowser.ResolveApiKey`. The
@@ -135,6 +135,20 @@ which ships in-box with .NET 10's BCL and adds no new NuGet dependency.
 overload) into a `GalaxySecretRef` static class in this project; update both call sites
 to delegate to it.
 
-**Resolution:** _(deferred — cross-module coordination change; Driver.Galaxy and
-Driver.Galaxy.Browser must both be updated in the same commit. Tracked for a future
-consolidation pass. See also Driver.Galaxy.Browser-003.)_
+**Resolution:** Resolved 2026-06-20 — extracted the four-form resolver into a new
+`public static class GalaxySecretRef` (`src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Contracts/GalaxySecretRef.cs`,
+namespace `ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Config`) as a single
+`ResolveApiKey(string secretRef, ILogger? logger = null)` method (the two former
+`GalaxyDriver` overloads collapsed into one optional-logger signature). The exact
+resolution semantics are preserved byte-for-byte: `env:NAME` (throws when unset),
+`file:PATH` (throws when missing/empty, trims), `dev:KEY` (literal, no warning), and
+the back-compat literal arm (returns the literal and emits the same `Warning` when a
+logger is supplied). The Contracts `.csproj` gained a single
+`Microsoft.Extensions.Logging.Abstractions` PackageReference for the `ILogger`
+parameter. Both call sites now delegate: `GalaxyDriver.BuildClientOptions` calls
+`GalaxySecretRef.ResolveApiKey(gw.ApiKeySecretRef, _logger)` and the two private
+`GalaxyDriver.ResolveApiKey` overloads are deleted; `GalaxyDriverBrowser.BuildClientOptions`
+likewise delegates (passing its non-null `_logger`) and its private copy is deleted. No
+migration, no public wire-contract change. Regression coverage: `GalaxyDriverApiKeyResolverTests`
+was repointed at `GalaxySecretRef.ResolveApiKey` (all 10 facts green). This finding and
+the sibling Driver.Galaxy.Browser-003 are closed by this one extraction.