docs(audit): AbLegacy-Test-Fixture.md — accuracy pass

STALE-STATUS: TL;DR claimed "Wire-level round-trip against ab_server PCCC
mode currently fails with BadCommunicationError on read/write (verified
2026-04-20)."  Docker/README.md §Known limitations explicitly states the
root cause was ab_server's empty-CIP-path gate, not a pccc.c gap, and that
N/F/L files round-trip cleanly with the /1,0 path.  AbLegacyReadSmokeTests.cs
confirms tests pass against the fixture.  Rewrote TL;DR + What-the-fixture-is
opening to reflect current passing state; residual gap is only B3 bit-file
writes (0x803D0000).

STALE-STATUS: Lifecycle probe listed as localhost:44818.
AbLegacyServerFixture.cs:57,119 default is 10.100.0.35:44818 (shared Docker
host, migrated 2026-04-28). Fixed.

INLINE COMPLETENESS: Follow-up item 1 phrased as future work ("smoke suite
passes today for N/F/L…"); tightened to describe the current passing state
and narrowed the remaining action to the bit-file write gap.

Verified: python3 .docs-audit/check_links.py — zero rows for this doc.

docs/drivers/AbLegacy-Test-Fixture.md

@@ -6,26 +6,26 @@ MicroLogix / PLC-5 / LogixPccc-mode.
 **TL;DR:** Docker integration-test scaffolding lives at
 `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.IntegrationTests/` (task #224),
 reusing the AB CIP `ab_server` image in PCCC mode with per-family
-compose profiles (`slc500` / `micrologix` / `plc5`). Scaffold passes
-the skip-when-absent contract cleanly. **Wire-level round-trip against
-`ab_server` PCCC mode currently fails** with `BadCommunicationError`
-on read/write (verified 2026-04-20) — ab_server's PCCC server-side
-coverage is narrower than libplctag's PCCC client expects. The smoke
-tests target the correct shape for real hardware + should pass when
-`AB_LEGACY_ENDPOINT` points at a real SLC 5/05 / MicroLogix. Unit tests
-via `FakeAbLegacyTag` still carry the contract coverage.
+compose profiles (`slc500` / `micrologix` / `plc5`). The smoke tests pass
+for N-file (Int16), F-file (Float32), and L-file (Int32) reads across all
+three families when `AB_LEGACY_CIP_PATH=1,0` (the default). The earlier
+`BadCommunicationError` was traced to `ab_server` requiring a non-empty CIP
+routing path before forwarding to the PCCC dispatcher — the `/1,0` workaround
+resolves it (see `Docker/README.md §Known limitations`). Residual gap: bit-file
+writes (`B3:0/5`) still surface `0x803D0000` against `ab_server`. Unit tests
+via `FakeAbLegacyTag` carry full contract coverage for all paths.
 
 ## What the fixture is
 
-**Integration layer** (task #224, scaffolded with a known ab_server
-gap):
+**Integration layer** (task #224):
 `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.IntegrationTests/` with
-`AbLegacyServerFixture` (TCP-probes `localhost:44818`) + three smoke
-tests (parametric read across families, SLC500 write-then-read). Reuses
-the AB CIP `otopcua-ab-server:libplctag-release` image via a relative
-`build:` context in `Docker/docker-compose.yml` — one image, different
-`--plc` flags. See `Docker/README.md` §Known limitations for the
-ab_server PCCC round-trip gap + resolution paths.
+`AbLegacyServerFixture` (TCP-probes `10.100.0.35:44818` — the shared Docker
+host; override with `AB_LEGACY_ENDPOINT`) + three smoke tests (parametric read
+across families, SLC500 write-then-read). Reuses the AB CIP
+`otopcua-ab-server:libplctag-release` image via a relative `build:` context in
+`Docker/docker-compose.yml` — one image, different `--plc` flags. See
+`Docker/README.md §Known limitations` for the CIP-path gate + bit-file write
+gap.
 
 **Unit layer**: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Tests/` is
 still the primary coverage. All tests tagged `[Trait("Category", "Unit")]`.
@@ -93,13 +93,12 @@ cover the common ones but uncommon ones (`R` counters, `S` status files,
 
 ## Follow-up candidates
 
-1. **Expand ab_server PCCC coverage** — the smoke suite passes today
-   for N (Int16), F (Float32), and L (Int32) files across SLC500 /
-   MicroLogix / PLC-5 modes with the `/1,0` cip-path workaround in
-   place. Known residual gap: bit-file writes (`B3:0/5`) surface
-   `0x803D0000`. Contributing a patch to `libplctag/libplctag` to close
-   this + documenting ab_server's empty-path rejection in its README
-   would remove the last Docker-vs-hardware divergences.
+1. **Close residual ab_server bit-file write gap** — N (Int16), F (Float32),
+   and L (Int32) files round-trip cleanly across SLC500 / MicroLogix / PLC-5
+   modes with the `/1,0` cip-path workaround in place. Remaining gap: bit-file
+   writes (`B3:0/5`) surface `0x803D0000` against `ab_server --plc=SLC500`.
+   Contributing a patch to `libplctag/libplctag` to close this would remove
+   the last Docker-vs-hardware divergence for bit writes.
 2. **Rockwell RSEmulate 500 golden-box tier** — Rockwell's real emulator
    for SLC/MicroLogix/PLC-5. Would close UDT-equivalent (integer-file
    indirection), timer/counter decomposition, and real ladder execution