docs(secrets): OtOpcUa on 0.2.2 - Akka gate re-run vs feed packages 6/6

Claude-Session: https://claude.ai/code/session_01BL2Vu1ESDQ9SCN4gVKkdts

components/secrets/GAPS.md

@@ -141,11 +141,16 @@ project 38/38 green.
   scratch consumer — 5 pinned refs, clean restore + build). Also folds in the deterministic rewrite
   of the `ActorContextAfterAwaitTests` pin (its old pool-thread formulation asserted a
   non-guaranteed property and flaked under parallel load).
-- ⬜ OtOpcUa may now adopt the Akka topology: bump to `0.2.2`, re-run its gate,
-  then consider enabling `Secrets:Replication:Enabled`.
+- ✅ **OtOpcUa bumped to `0.2.2` (2026-07-18, `lmxopcua master @ 2254ae3d`)** and the **gate re-run
+  against the published feed packages passes 6/6**. The long-promised
+  `The_startup_hook_actually_creates_the_replication_actor` test now exists for real: a
+  provider-based resolve of OtOpcUa's own `AddOtOpcUaSecrets` wiring on a self-joined single-node
+  cluster, watchdogged at the exact point 0.2.1 deadlocked (`SecretsReplicationRegistrationTests`
+  8/8; plain `ActorSystem`, no TestKit — xunit.v3-compatible).
   **Tracked:** [`scadaproj#1`](https://gitea.dohertylan.com/dohertj2/scadaproj/issues/1) (the defect —
-  fixed) and [`lmxopcua#482`](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/482)
-  (the consumer-side tracker: bump the package, re-run the gate, then consider enabling).
+  fixed, CLOSED) and [`lmxopcua#482`](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/482)
+  (open only for the per-environment decision to enable `Secrets:Replication:Enabled`, which stays
+  default-false and requires the same KEK on every node first).
 - ✅ ScadaBridge's hub topology **is** live-validated and safe to enable (config + a shared KEK).
 
 Harness: `scratchpad/livegate/` (two scenarios, `akka` / `sql`; not committed).