docs(secrets): close out scadaproj#3 — gRPC hub shipped 0.4.1, both live gates PASS; residual filed as #4

Task 9 (closeout) of the Secrets gRPC-hub program. Bookkeeping only; no code.

- clustered-secrets.md, Production enablement: the gRPC hub is no longer
  pending. It is BUILT, SHIPPED (0.4.1) and LIVE-GATED PASS 4/4 (ScadaBridge
  main @ f6c3f7c5, docs/plans/2026-08-07-secrets-grpc-hub-live-gate.md), so the
  "until that ships, ScadaBridge replication stays off" line is replaced with
  the truth: the code path is merged and gated, and production enablement is a
  separate operator action behind a still-default-off flag. OtOpcUa's
  pair-local topology is recorded as live-gated (lmxopcua master @ 1bd79c8e)
  rather than pending re-gate. Rotation fan-out corrected: on ScadaBridge it is
  BOTH central nodes plus both nodes of every site pair, because each central
  node has its own independent store.

- components/secrets/GAPS.md: new "gRPC hub delivered" section recording the
  0.4.0/0.4.1 publish, both gates with SHAs and gate-doc paths, and the
  residual. Existing narrative left intact and amended, not rewritten.

- CLAUDE.md Secrets row: lib version 0.3.0 -> 0.4.1 and the app-pin claim
  corrected (ScadaBridge pins 0.4.1 for the Grpc replicator; the other three
  still pin 0.2.3); the "production topologies DECIDED" region now records
  delivery, both gates, default-off, and the residual.

- Plan ledger: task 9 completed.

Residual carried forward as scadaproj#4 — ScadaBridge's central pair does not
converge with itself (central-b served an authenticated but EMPTY manifest all
gate while central-a held every secret) and the site client dials a single
endpoint; these are one design question, since failover to an empty hub would
succeed and silently stop convergence. scadaproj#3 is closed.

Claude-Session: https://claude.ai/code/session_014WNM4vjoVksyyBraTXSZE1

docs/plans/2026-08-07-secrets-grpc-hub-implementation.md.tasks.json

@@ -5,11 +5,11 @@
     {"id": 2, "subject": "Task 2: Server half — hub service + bearer auth + DI", "status": "completed", "classification": "high-risk", "blockedBy": [1], "parallelizableWith": [3], "note": "7fc77f2 + 353af72 (review fixes: GetSecrets batch cap, DI single-registration guard) merged ff into feat/secrets-grpc-hub; spec ✅ 16/16, code review Approved; 73 server tests"},
     {"id": 3, "subject": "Task 3: Client half — pull-only sweep service + DI", "status": "completed", "classification": "high-risk", "blockedBy": [1], "parallelizableWith": [2], "note": "c5ea3a7 + 1c31e6b (review Critical fix: per-row parse isolation, WireToDomain batch methods deleted, real-client CallInvoker tests) merged 55e0178; spec ✅ 8/8, code review Approved on re-review; merged suite 140/140"},
     {"id": 4, "subject": "Task 4: Integration tests + no-write-surface pin", "status": "completed", "classification": "standard", "blockedBy": [2, 3], "note": "3e3748b + 5f81e65 (harness drift-fix via internal validateEagerly seam); spec ✅ 6/6, code review Approved; Grpc suite 158, solution 436/0/15"},
-    {"id": 5, "subject": "Task 5: Version bump + pack + publish 0.4.0", "status": "pending", "classification": "small", "blockedBy": [4]},
-    {"id": 6, "subject": "Task 6: ScadaBridge wiring — central hub + site sweep client", "status": "pending", "classification": "high-risk", "blockedBy": [5]},
-    {"id": 7, "subject": "Task 7: ScadaBridge live gate (docker cluster)", "status": "pending", "classification": "high-risk", "blockedBy": [6], "parallelizableWith": [8]},
+    {"id": 5, "subject": "Task 5: Version bump + pack + publish 0.4.0", "status": "completed", "classification": "small", "blockedBy": [4], "note": "321ab22 = main, pushed; 6 packages @ 0.4.0 on dohertj2-gitea feed incl. new Replicator.Grpc, restore-verified from fresh cache; CHANGELOG.md created (backfilled 0.2.0–0.3.0)"},
+    {"id": 6, "subject": "Task 6: ScadaBridge wiring — central hub + site sweep client", "status": "completed", "classification": "high-risk", "blockedBy": [5], "note": "ScadaBridge feat/secrets-grpc-hub 57f08c21+127ec254+c8e90daa+fc784b41 (predicate-sharing review fix); role is a method parameter (not config); mode key Secrets:Replication:Mode default SqlServer; 31/31 wiring pins; spec ✅ 8/8, code review Approved; residual: sweep dials single endpoint (no central-pair failover) — carry to closeout"},
+    {"id": 7, "subject": "Task 7: ScadaBridge live gate (docker cluster)", "status": "completed", "classification": "high-risk", "blockedBy": [6], "parallelizableWith": [8], "note": "PASS 4/4 (check 4 on 2nd pass after 0.4.1 denial-warning fix, scadaproj c86cead); ScadaBridge main @ f6c3f7c5 merged+pushed; gate doc docs/plans/2026-08-07-secrets-grpc-hub-live-gate.md; residuals: central pair doesn't converge with itself + single-endpoint client = one design issue to file; delete-while-follower-offline untested"},
     {"id": 8, "subject": "Task 8: OtOpcUa Akka pair-local re-gate (three-mesh rig)", "status": "completed", "classification": "high-risk", "parallelizableWith": [1, 2, 3, 4, 5, 6, 7], "note": "PASS 4/4, OtOpcUa master @ 1bd79c8e pushed; gate doc docs/plans/2026-08-07-secrets-pair-local-live-gate.md; rig fix: Secrets__SqlitePath onto per-node volume; follow-up for Task 9: stale KNOWN-NON-FUNCTIONAL comment in OtOpcUa appsettings.json Secrets block"},
-    {"id": 9, "subject": "Task 9: Closeout — issue #3, runbook, GAPS, index", "status": "pending", "classification": "small", "blockedBy": [7, 8]}
+    {"id": 9, "subject": "Task 9: Closeout — issue #3, runbook, GAPS, index", "status": "completed", "classification": "small", "blockedBy": [7, 8], "note": "Runbook clustered-secrets.md Production-enablement + rotation fan-out updated (ScadaBridge = both central nodes + both nodes of every site pair); components/secrets/GAPS.md gained a 'gRPC hub delivered' section (0.4.0/0.4.1, both gates with SHAs, residual); CLAUDE.md Secrets row updated (lib 0.4.1, ScadaBridge pins 0.4.1, both gates PASS 4/4, default-off, residual). OtOpcUa stale appsettings _comment corrected: lmxopcua master @ 01256344, pushed. scadaproj#3 all 6 boxes checked with SHA annotations, closing comment posted, CLOSED. Residual filed as scadaproj#4 (central-pair convergence + client endpoint failover are one design question; plus delete-while-follower-offline untested and denial-warning alerting must sum per-window deltas)."}
   ],
   "lastUpdated": "2026-08-07"
 }