docs: rewrite IncrementalSync + AddressSpace for v3, fix driver-specs/driver-stability tier claims, update Secrets runbook for pair replication + KEK rotation (#623)

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

docs/v2/driver-specs.md

@@ -1,6 +1,22 @@
 # OtOpcUa v2 — Driver Implementation Specifications
 
-> **Status**: DRAFT — reference document for plan.md
+> **Status (2026-10)**: v2-era DRAFT, **not authoritative**. It covers 8 of the 12 shipped drivers and
+> several of its architecture claims are stale. The current per-driver references are the pages in
+> [`docs/drivers/`](../drivers/README.md) (the README there lists all 12 and is the accurate overview).
+>
+> - **Not covered here at all:** MQTT/Sparkplug ([Mqtt.md](../drivers/Mqtt.md)), MTConnect
+>   ([MTConnect.md](../drivers/MTConnect.md)), Sql ([Sql.md](../drivers/Sql.md)), Calculation
+>   ([Calculation.md](../drivers/Calculation.md)).
+> - **Hosting/tier claims are stale:** every driver runs in-process as Tier A (Galaxy reaches MXAccess over
+>   gRPC to `mxaccessgw`; FOCAS is a pure-managed in-process `FocasWireClient`, not a `Focas.Host` pipe
+>   service) — see `docs/v2/driver-stability.md`'s banner. The "SystemPlatform namespace kind" is retired:
+>   Galaxy is a standard Equipment-kind driver, and the address space is the dual Raw/UNS namespace
+>   ([../AddressSpace.md](../AddressSpace.md)).
+> - **Modbus:** the driver has its own socket layer (no NModbus dependency) and a driver-level
+>   `transport` key — `Tcp` (default, MBAP framing) or `RtuOverTcp` (RTU `[addr][PDU][CRC-16]` framing tunnelled
+>   to a serial-to-Ethernet gateway); see [Modbus.md](../drivers/Modbus.md).
+> - **AB CIP / AB Legacy:** a second, managed `Transport` (`Native` | `Libplctag`) exists — `CLAUDE.md`
+>   §"AB drivers: native transport" and the driver pages.
 >
 > **Created**: 2026-04-16
 

docs/v2/driver-stability.md

@@ -49,6 +49,10 @@ Driver stability needs to be a first-class architectural concern, not a per-driv
 
 Every driver is assigned to one of three tiers based on the trust level of its dependency stack:
 
+> **Design intent, not the shipped assignment.** The per-driver tier tables below record the proposed
+> assignment (Galaxy/FOCAS in Tier C, the Ab/S7/TwinCAT drivers in Tier B). As shipped every driver is Tier A —
+> see the banner above and `docs/drivers/README.md`, which is the accurate reference.
+
 ### Tier A — Pure Managed
 
 Drivers whose entire dependency chain is verifiable .NET. Standard exception handling and Polly are sufficient. Run in-process in the main server.