docs: truth sweep — Galaxy adoption, Auth 0.1.5, redaction seam, resolved A2 caveats

Claude-Session: https://claude.ai/code/session_014WNM4vjoVksyyBraTXSZE1

docs/Diagnostics.md

@@ -123,9 +123,9 @@ The split uses `count: 3` because the secret portion may itself contain undersco
 
 ### Command value redaction
 
-> **Not yet implemented.** Command-value logging is *not* wired end-to-end. There is no `MxGateway:Diagnostics:LogCommandValues` (or equivalent) configuration knob, and `RedactCommandValue` / `IsCredentialBearingCommand` have no call sites in the gateway — no command values are logged anywhere today, which is the safest posture. The helpers below exist as the intended redaction seam for a future opt-in value-logging feature; that wiring is deferred until secured-bulk command variants are covered by the redactor's credential list (the `WriteSecuredBulk` / `WriteSecured2Bulk` gap), so enabling value logging cannot leak a secured-bulk payload. Until then, treat this section as describing the planned shape, not current behavior.
+> **Redaction seam wired; value logging still has no opt-in knob** (updated 2026-08-07). Since commit `47c0b64` (2026-07-27), `RedactCommandValue` **is** wired: `GatewayLogRedactorSeam` (`Diagnostics/GatewayLogRedactorSeam.cs`) calls it for any non-null `CommandValue` log property, gated on `CommandMethod`, so a command payload that reaches a log event is masked on every sink through the shared `ILogRedactor` seam. What remains true from the original note: there is still no `MxGateway:Diagnostics:LogCommandValues` (or equivalent) configuration knob — the seam exposes no opt-in, `valueLoggingEnabled` is never passed `true`, so **every** non-null command value is redacted, credential-bearing or not. In practice no log statement currently emits a `CommandValue` property, but one that does can no longer leak a payload in the clear.
 
-The intended `RedactCommandValue` would enforce the "values are opt-in and redacted by default" rule:
+`RedactCommandValue` enforces the "values are opt-in and redacted by default" rule:
 
 ```csharp
 public static object? RedactCommandValue(

docs/GalaxyRepository.md

@@ -1,5 +1,18 @@
 # Galaxy Repository Browse
 
+> **Adopted as a shared package (2026-06-25, commit `8e196a7`).** The Galaxy browse
+> implementation described in this document no longer lives in this repository. The
+> gateway consumes the shared **`ZB.MOM.WW.GalaxyRepository`** library (pinned at
+> `0.2.0` from the Gitea NuGet feed; sources hosted in the `scadaproj` repo), wired
+> in `GatewayApplication.cs` via `AddZbGalaxyRepository` (registration) and
+> `MapZbGalaxyRepository` (endpoint mapping). The former in-repo `Server/Galaxy/`
+> classes and `Grpc/GalaxyRepositoryGrpcService.cs` / `Grpc/GalaxyProtoMapper.cs`
+> were deleted with the adoption. The wire contract (`galaxy_repository.v1`) is
+> unchanged, so the RPC behavior, filters, paging, caching, and snapshot semantics
+> below still apply as documented — but any `src/ZB.MOM.WW.MxGateway.Server/...`
+> file path cited below is historical; the equivalent class now lives in the
+> shared library.
+
 The gateway exposes a read-only browse surface over the AVEVA System Platform
 Galaxy Repository (the SQL Server database named `ZB`). Clients use it to
 enumerate the deployed object hierarchy and each object's attributes
@@ -107,7 +120,8 @@ server and dashboard views are consistent.
 ## Hierarchy Cache
 
 The gateway holds a single shared `IGalaxyHierarchyCache`
-(`src/ZB.MOM.WW.MxGateway.Server/Galaxy/GalaxyHierarchyCache.cs`) — every
+(`GalaxyHierarchyCache`, library-side in `ZB.MOM.WW.GalaxyRepository` — formerly
+`src/ZB.MOM.WW.MxGateway.Server/Galaxy/GalaxyHierarchyCache.cs`) — every
 `DiscoverHierarchy` and `GetLastDeployTime` request reads from this cache
 rather than hitting SQL. Many clients can browse concurrently with at most
 one SQL query in flight.
@@ -174,7 +188,8 @@ record: deleting it only forces the next cold start to wait for live SQL.
 ## Deploy Notifications
 
 `WatchDeployEvents` is a server-streaming RPC backed by
-`IGalaxyDeployNotifier` (`src/ZB.MOM.WW.MxGateway.Server/Galaxy/GalaxyDeployNotifier.cs`).
+`IGalaxyDeployNotifier` (`GalaxyDeployNotifier`, library-side in
+`ZB.MOM.WW.GalaxyRepository`).
 The notifier maintains a private bounded channel per subscriber so a slow
 client cannot back-pressure other subscribers or the publisher.
 
@@ -322,7 +337,7 @@ fields cannot express null. Use it to distinguish "no dimension reported" from
 
 ```text
 gRPC client(s)
-  -> GalaxyRepositoryGrpcService (src/ZB.MOM.WW.MxGateway.Server/Grpc/)
+  -> Galaxy repository gRPC service (library-side; mapped via MapZbGalaxyRepository)
     DiscoverHierarchy, GetLastDeployTime, BrowseChildren -> IGalaxyHierarchyCache.Current
     WatchDeployEvents                                    -> IGalaxyDeployNotifier
     TestConnection                                       -> GalaxyRepository  (direct SQL)
@@ -341,41 +356,44 @@ GalaxyHierarchyRefreshService (BackgroundService)
     -> IGalaxyDeployNotifier.Publish (only on deploy change)
 ```
 
-Component breakdown:
+Component breakdown (all of these classes are **library-side**, in the shared
+`ZB.MOM.WW.GalaxyRepository` package — the in-repo files formerly at the paths
+below were deleted in commit `8e196a7`):
 
-- `GalaxyRepository` (`src/ZB.MOM.WW.MxGateway.Server/Galaxy/GalaxyRepository.cs`) holds
+- `GalaxyRepository` (formerly `src/ZB.MOM.WW.MxGateway.Server/Galaxy/GalaxyRepository.cs`) holds
   the SQL. Both `HierarchySql` and `AttributesSql` walk template-derivation and
   package-derivation chains via recursive CTEs and pick the most-derived
   override per object. `HierarchySql` still matches the OtOpcUa original;
   `AttributesSql` does not — it additionally enumerates built-in primitive
   attributes (see [Built-in vs configured attributes](#built-in-vs-configured-attributes)).
 - `GalaxyHierarchyCache`
-  (`src/ZB.MOM.WW.MxGateway.Server/Galaxy/GalaxyHierarchyCache.cs`) holds the most
+  (formerly `src/ZB.MOM.WW.MxGateway.Server/Galaxy/GalaxyHierarchyCache.cs`) holds the most
   recent immutable `GalaxyHierarchyCacheEntry` (materialized objects +
   precomputed dashboard summary + counts + status). All gRPC clients share the
   same entry.
 - `GalaxyHierarchyRefreshService`
-  (`src/ZB.MOM.WW.MxGateway.Server/Galaxy/GalaxyHierarchyRefreshService.cs`) is a
+  (formerly `src/ZB.MOM.WW.MxGateway.Server/Galaxy/GalaxyHierarchyRefreshService.cs`) is a
   hosted `BackgroundService` that drives `RefreshAsync` on the configured
   interval, with deploy-time gating to avoid unnecessary heavy queries.
 - `GalaxyDeployNotifier`
-  (`src/ZB.MOM.WW.MxGateway.Server/Galaxy/GalaxyDeployNotifier.cs`) is a thin
+  (formerly `src/ZB.MOM.WW.MxGateway.Server/Galaxy/GalaxyDeployNotifier.cs`) is a thin
   per-subscriber-channel fan-out for streaming clients.
 - `GalaxyProtoMapper`
-  (`src/ZB.MOM.WW.MxGateway.Server/Grpc/GalaxyProtoMapper.cs`) converts row models to
+  (formerly `src/ZB.MOM.WW.MxGateway.Server/Grpc/GalaxyProtoMapper.cs`) converts row models to
   proto messages. Used by the cache during refresh to materialize the reply
   once.
 - `GalaxyBrowseProjector`
-  (`src/ZB.MOM.WW.MxGateway.Server/Galaxy/GalaxyBrowseProjector.cs`) projects one level
+  (formerly `src/ZB.MOM.WW.MxGateway.Server/Galaxy/GalaxyBrowseProjector.cs`) projects one level
   of children out of an immutable cache entry. Memoizes the filtered child list
   per cache-entry instance so repeated paging is an O(pageSize) slice rather than an
   O(siblings) filter scan. The memo is keyed on the cache entry reference, so a new
   entry from the background refresh makes the stale memo unreachable and it is
   collected with it. `DashboardBrowseService` wraps this projector to drive the
   dashboard's lazy-expand tree.
-- `GalaxyRepositoryGrpcService`
-  (`src/ZB.MOM.WW.MxGateway.Server/Grpc/GalaxyRepositoryGrpcService.cs`) implements
-  the five RPCs.
+- The Galaxy repository gRPC service (formerly
+  `src/ZB.MOM.WW.MxGateway.Server/Grpc/GalaxyRepositoryGrpcService.cs`, deleted
+  with the adoption) implements the five RPCs; it is now supplied by the library
+  and mapped via `MapZbGalaxyRepository`.
 
 ## Configuration