diff --git a/archreview/plans/R2-01-s7-fault-hardening-plan.md.tasks.json b/archreview/plans/R2-01-s7-fault-hardening-plan.md.tasks.json
index 1eff77e8..7070e3ab 100644
--- a/archreview/plans/R2-01-s7-fault-hardening-plan.md.tasks.json
+++ b/archreview/plans/R2-01-s7-fault-hardening-plan.md.tasks.json
@@ -64,7 +64,7 @@
     {
       "id": 10,
       "subject": "Doc: R2-09 connect-throttle seam note on EnsureConnectedAsync <remarks> (STAB-8 S7 part, note-only)",
-      "status": "pending",
+      "status": "completed",
       "blockedBy": [3]
     },
     {
diff --git a/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7/S7Driver.cs b/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7/S7Driver.cs
index df642c02..c25eeedc 100644
--- a/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7/S7Driver.cs
+++ b/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7/S7Driver.cs
@@ -1211,6 +1211,15 @@ public sealed class S7Driver
     ///     MUST be called while holding <see cref="_gate"/> — it mutates <see cref="Plc"/> /
     ///     <see cref="_plcDead"/> and reuses the single-connection-per-PLC invariant the gate
     ///     enforces. The read / write / probe paths all take the gate before calling it.
+    ///     <para>
+    ///         While the PLC is down every data call and probe tick pays a full connect attempt
+    ///         bounded only by <c>_options.Timeout</c> (STAB-8). This method is the single
+    ///         choke-point all S7 reconnects flow through (already gate-serialized), so the
+    ///         fleet-wide connect-attempt throttle planned in R2-09 plugs in here: a
+    ///         last-failed-attempt timestamp checked at the top of the slow path. Deliberately NOT
+    ///         implemented driver-locally — see
+    ///         <c>archreview/plans/R2-01-s7-fault-hardening-plan.md</c> Finding 3.
+    ///     </para>
     /// </remarks>
     /// <param name="ct">Cancellation token for the (re)connect attempt.</param>
     /// <returns>A live <see cref="IS7Plc"/>.</returns>