1bd79c8e4a
Re-gates Akka peer-to-peer secret replication on the current three-mesh docker-dev rig and supersedes the 2026-07-18 six-node gate (lmxopcua#482,c878fbbd) as evidence. That gate proved convergence to all five peers on the old single fleet-wide mesh; after mesh Phase 6 (2839deb5) partitioned the rig into three independent 2-node meshes, six-node convergence would be a FAILURE, not a pass. Phase 6's own leg 6 recorded "PASS (by fallback criterion)" — it inferred pair-locality structurally and never seeded a secret. This replaces that inference with direct evidence. All four checks PASS, on master @21009874with one image (OtOpcUa.Host.dll a434b04f byte-identical on all six nodes), Secrets libs 0.2.3: 1. Pair convergence — seeded on site-a-1 alone, on site-a-2 in <=7s (budget 60s), byte-identical ciphertext + kek_id + updated_utc, decrypt-verified on the partner. 2. No cross-pair propagation — absent from site-b and central across 8 samples / 240s / 48 announce intervals, and clean in the reverse direction too. Isolation controls seeded on site-b-1 and central-1 converged within their OWN pairs, so the absence is isolation rather than a dead replicator. 3. Delete propagates within the pair — issued on site-a-2 (the receiving node, so this also covers the reverse intra-pair direction); tombstone on site-a-1 in <1s. 4. Clean pair restart (both together) — mesh re-formed in 7s, no resurrection of the tombstone, live secret survived and decrypted correctly on both nodes. Zero secret-related warnings or errors fleet-wide across the whole run. Satisfies the scadaproj#3 precondition for the OtOpcUa production topology (Akka pair-local). Secrets:Replication:Enabled remains default-false in the product; the rig KEK is dev-only. Rig config: SqlitePath moved onto each node's existing per-node /app/data volume. The appsettings default resolves to /app, inside the image's writable container layer, so the store was destroyed by any `up -d --build` recreate and was unreachable from the host — seeding or inspecting a node meant stopping the container to docker cp the file out. Still one private store per node; replication is still what syncs them. Residuals in the gate doc: the live-push path is not covered (anti-entropy is what a driver-only node can be gated on), and appsettings.json still carries a stale "KNOWN NON-FUNCTIONAL against 0.2.0 / do not enable" comment that this gate disproves — left uncorrected here because this run is config-only. Claude-Session: https://claude.ai/code/session_014WNM4vjoVksyyBraTXSZE1