docs: record Galaxy library adoption (0.2.0) complete + caveats

Mark A2 handoff and stillpending §2 adopted; note the host-side design
(GatewayBrowseScopeProvider, dashboard summary projector), the lib 0.2.0
upstream changes, and caveats (NSSM deploy config, pre-existing NU1903 +
IntegrationTests EventStreamService breaks). Point CLAUDE.md at the package.

A2-galaxyrepository-adoption-handoff.md

@@ -1,5 +1,24 @@
 # A2 — Adopt the shared `ZB.MOM.WW.GalaxyRepository` library
 
+> **✅ ADOPTED 2026-06-25 (branch `feat/galaxyrepository-adoption`).** mxaccessgw now consumes
+> `ZB.MOM.WW.GalaxyRepository` **0.2.0** and the inline Galaxy code is deleted (27 files, −2959 LOC).
+> What shipped:
+> - **Lib 0.2.0** (published to Gitea) closed the two real upstream gaps: **alarm-attribute discovery**
+>   (`GalaxyAlarmAttributeRow` + `IGalaxyRepository.GetAlarmAttributesAsync` + `AlarmAttributesSql`) and an
+>   injectable **`IGalaxyBrowseScopeProvider`** (default `NullGalaxyBrowseScopeProvider` = no scoping;
+>   HistorianGateway @ 0.1.0 unaffected) wired into the lib's gRPC service. Lib test suite: 64 green.
+> - **mxaccessgw** registers `GatewayBrowseScopeProvider : IGalaxyBrowseScopeProvider` (reads the API key's
+>   `EffectiveConstraints.BrowseSubtrees`) before `AddZbGalaxyRepository(config,"MxGateway:Galaxy")`, maps
+>   `MapZbGalaxyRepository()`, and switched `GatewayGrpcScopeResolver` galaxy request types to the lib
+>   `.Grpc` namespace (the global authz interceptor now intercepts the lib service). The **dashboard summary
+>   stays host-side** (`DashboardGalaxySummaryProjector`, memoized by cache `Sequence`) since the lib entry
+>   doesn't carry it. Server build zero-warning; 327 targeted tests green.
+> - The end-to-end host authz chain is covered (`GalaxyRepositoryHostWiringTests`), and the lib gained the
+>   ported browse-projector / deploy-notifier / refresh-service (Server-005 timeout guard) tests.
+>
+> **Caveats / follow-ups** (see "Post-adoption notes" at the bottom).
+> Original handoff (now historical) follows.
+
 > Handoff note. Written 2026-06-25 from the HistorianGateway side, where the shared lib is
 > already consumed in production. This is the mxaccessgw half of the cross-repo
 > "Galaxy-browse normalization" follow-on (HistorianGateway `pending.md` A2 /
@@ -153,17 +172,39 @@ be **deleted**. **Keep** the mxaccessgw-specific ones that exercise behavior the
 `GalaxyAlarmAttributeMappingTests`, `GalaxyFilterInputSafetyTests`, `GalaxyRepositoryGrpcServiceTests`
 (unless their subjects move upstream too), and the live `IntegrationTests/Galaxy/**`.
 
-## Suggested order
+## Suggested order — all DONE (2026-06-25)
 
-1. ~~Verify the **gRPC-service authz parity** question~~ **DONE (2026-06-25):** wholesale swap is unsafe —
-   per-key browse-subtree filtering is baked into the service body. The service must keep an mxaccessgw
-   subtree-scoping hook (push the provider upstream, or wrap). See the ⚠️ block above.
-2. Decide alarm-attributes: **upstream into the lib (`0.2.0`)** vs keep inline on top of shared interfaces.
-3. If upstreaming: do that in `scadaproj/ZB.MOM.WW.GalaxyRepository` first, publish, bump the version.
-4. `nuget.config` + `csproj` + DI/endpoint wiring; delete the superseded inline files; rebind namespaces
-   in dashboard/alarms/security consumers.
-5. Delete duplicated tests; build zero-warning; run the suite; live-validate browse + alarm watch-list.
-6. Propagate to the scadaproj umbrella index + HistorianGateway's `pending.md` A2 (mark adopted).
+1. ~~Verify the **gRPC-service authz parity** question~~ **DONE:** wholesale swap was unsafe — per-key
+   browse-subtree filtering was baked into the service body. Resolved by pushing an injectable
+   `IGalaxyBrowseScopeProvider` hook **upstream** into the lib (option preferred in the ⚠️ block).
+2. ~~Decide alarm-attributes~~ **DONE:** upstreamed into the lib as part of `0.2.0`.
+3. ~~Upstream + publish + bump~~ **DONE:** lib `0.1.0 → 0.2.0`, packed and pushed to the Gitea feed (verified live).
+4. ~~`nuget.config` + `csproj` + DI/endpoint wiring; delete inline; rebind~~ **DONE.**
+5. ~~Delete duplicated tests; build zero-warning; run the suite~~ **DONE** (lib 64 green; gateway 327 targeted green).
+   Live-validate browse + alarm watch-list is the one remaining **manual** step (needs Galaxy SQL + a running
+   gateway — opt-in `MXGATEWAY_RUN_LIVE_GALAXY_TESTS=1`); not runnable from the dev Mac.
+6. **Remaining:** propagate to the scadaproj umbrella index + HistorianGateway's `pending.md` §A2 (mark adopted)
+   — cross-repo, do in those repos.
+
+## Post-adoption notes / caveats
+
+- **Deployment config (NSSM):** the deployed services (`MxAccessGw` on 10.100.0.48; the wonder host) read
+  config from **NSSM environment variables, not `appsettings.json`**. The lib's `SnapshotCachePath` default
+  is empty (persistence no-ops). `appsettings.json` sets `MxGateway:Galaxy:SnapshotCachePath` +
+  `PersistSnapshot`, but the deployments must carry `MxGateway__Galaxy__SnapshotCachePath` and
+  `MxGateway__Galaxy__PersistSnapshot` in their NSSM env on redeploy, or snapshot persistence silently
+  no-ops in production.
+- **Pre-existing NU1903 (unrelated):** adding the package surfaced a transitive `SQLitePCLRaw.lib.e_sqlite3`
+  2.1.11 advisory (GHSA-2m69-gcr7-jv3q, no upstream patch) that breaks the build under `TreatWarningsAsErrors`
+  — already red on `main`. Resolved with a targeted `NuGetAuditSuppress` in `src/Directory.Build.props`
+  (its own commit). Remove the suppression once a patched e_sqlite3 ships.
+- **Pre-existing IntegrationTests break (unrelated, NOT fixed here):** `IntegrationTests/WorkerLiveMxAccessSmokeTests.cs`
+  constructs `EventStreamService` with 6 ctor args, but a prior event-stream refactor reduced that ctor — so
+  the IntegrationTests project does not compile (already broken on `main`, independent of Galaxy). The Galaxy
+  live tests there were rebound to the lib and compile in isolation, but the project won't build until that
+  unrelated call site is fixed. Track separately.
+- **No republish needed for the lib test additions:** the browse-projector / deploy-notifier / refresh-service
+  tests were added to the lib AFTER 0.2.0 was published; tests aren't shipped, so 0.2.0 is unchanged.
 
 ## Reference pointers