docs(secrets): ScadaBridge G-3/G-4/G-5/G-6 adopted + merged + live-proven (ScadaBridge @ 128f1596)

components/secrets/GAPS.md

@@ -19,7 +19,25 @@ construction).
   password change's test/doc blast radius (validator-helper + host-test-bootstrap + doc truth),
   and the live-LDAP integration suite now honors the `MxGateway__Ldap__ServiceAccountPassword`
   env override. **G-4/G-5/G-6 below are the remaining OtOpcUa + ScadaBridge scope.**
-- **OtOpcUa, ScadaBridge — planned, NOT executed** (recommended order: OtOpcUa next, then ScadaBridge).
+- **ScadaBridge — G-3 + G-4 + G-5 + G-6 DONE.** Executed via the plan below (10 tasks, subagent-driven,
+  classification-driven reviews), **FF-merged + pushed to `origin/main` (ScadaBridge @ `128f1596`)**.
+  Offline: 0-warning build, all suites green (Host 279, DCL 235 incl. 5 G-3 resolver tests, Security 181,
+  CentralUI 925, InboundAPI 269, SiteRuntime 522/523 [1 pre-existing ScriptActor timing-flake, passes
+  isolated + branch touched no SiteRuntime src], Commons/ConfigDb/ManagementService/Communication/ClusterInfra
+  all green). **G-3 LIVE-PROVEN vs the REAL production MxGateway gateway** (`wonder-app-vd03.zmr.zimmer.com:5120`):
+  a throwaway harness drove the real `MxGatewayDataConnection` through the DI factory + `AddZbSecrets` with a
+  `secret:`-ref `ApiKey` → **dummy key `Unauthenticated`** (proves the resolved value is transmitted, not
+  fail-closed first) → **real read-scoped key → `Connected` + browsed the real Galaxy root (10 nodes)**. Temp
+  key created via the gateway dashboard, then **revoked + deleted + functionally confirmed dead**. Notable
+  deltas from the plan: T3 registers `AddZbSecrets` on **both** the Central branch (UI) and
+  `SiteServiceRegistration` (DCL adapter) — the plan assumed one container; T6 claim-type resolved **MATCH**
+  (`ZbClaimTypes.Role == ClaimTypes.Role`, adversarially verified) → `AddSecretsAuthorization()` used directly;
+  T8 (G-5) shipped as a **docs-only** production-posture runbook (`docs/operations/2026-07-16-secrets-clustered-master-key.md`)
+  because hardcoding `Source=File` + `/shared` paths would break the Central-boot Host.Tests + local dev (the
+  pre-host expander migrates the store unconditionally every Central boot). One review-flagged non-blocking
+  follow-up: a pre-existing xUnit env-mutation CI-flake that T4 amplifies (single `[Collection]` / disable
+  parallelization for Host.Tests).
+- **OtOpcUa — planned, NOT executed (the LAST remaining app; recommended next — carries the highest-value G-2 Layer-B driver secrets).**
 
 ## Design + implementation plans (2026-07-16)