diff --git a/src/Server/ZB.MOM.WW.OtOpcUa.Host/appsettings.json b/src/Server/ZB.MOM.WW.OtOpcUa.Host/appsettings.json
index 68dce0ba..f5e98869 100644
--- a/src/Server/ZB.MOM.WW.OtOpcUa.Host/appsettings.json
+++ b/src/Server/ZB.MOM.WW.OtOpcUa.Host/appsettings.json
@@ -20,7 +20,7 @@
     "RunMigrationsOnStartup": true,
     "ResolveCacheTtl": "00:00:30",
     "Replication": {
-      "_comment": "Peer-to-peer secret replication over the Akka cluster. OPT-IN: Enabled=false keeps the plain local SQLite store on every node. KNOWN NON-FUNCTIONAL against ZB.MOM.WW.Secrets.Replicator.AkkaDotNet 0.2.0 — that version's ISecretReplicator registration is shadowed by the NoOp one AddZbSecrets registers first, so enabling this decorates the store but replicates nothing and starts no actor. Do not enable until the library is fixed. All nodes must also share the same KEK.",
+      "_comment": "Peer-to-peer secret replication over the Akka cluster. OPT-IN: Enabled=false keeps the plain local SQLite store on every node. FUNCTIONAL since ZB.MOM.WW.Secrets.Replicator.AkkaDotNet 0.2.2 (0.2.1 fixed the shadowed ISecretReplicator registration, 0.2.2 the hosted-process DI deadlock) and live-gated PASS 4/4 on 2026-08-07 — see docs/plans/2026-08-07-secrets-pair-local-live-gate.md. SCOPE: replication is PAIR-LOCAL. Since mesh Phase 6 each application cluster is its own 2-node Akka mesh, so a secret converges within its pair and nowhere else — seed every pair independently (central via /admin/secrets, site pairs via the secret CLI or a ciphertext-only bundle import). Both nodes of a pair MUST share the same KEK, and re-wraps do not replicate, so 'secret rewrap-all' runs against each node's store individually.",
       "Enabled": false,
       "AnnounceInterval": "00:00:30",
       "ActorName": "zb-secret-replication"