docs(secrets): mxaccessgw G-4/G-5/G-6 adopted + merged (mxaccessgw @ e088dfa)

CLAUDE.md

@@ -143,7 +143,7 @@ each project's **code-verified current state**, and the **gaps** between. See
 | Config + validation (options / startup validation) | Adopted (lib `0.1.0`; all 3 apps, local) | Shared `ZB.MOM.WW.Configuration` lib | [`components/configuration/`](components/configuration/) | [`ZB.MOM.WW.Configuration/`](ZB.MOM.WW.Configuration/) |
 | Audit (event model + writer seam) | Adopted (lib `0.1.0`; all 3 apps, merged to **local default** main/master + **pushed to origin** (gitea)) | Shared `ZB.MOM.WW.Audit` lib | [`components/audit/`](components/audit/) | [`ZB.MOM.WW.Audit/`](ZB.MOM.WW.Audit/) |
 | Galaxy Repository (object-hierarchy SQL browse + gRPC service) | Built (lib `0.1.0`, **published to the Gitea feed**; consumed by HistorianGateway as a feed `PackageReference`) | Shared `ZB.MOM.WW.GalaxyRepository` lib | _(design in histsdk + design doc 2026-06-23)_ | [`ZB.MOM.WW.GalaxyRepository/`](ZB.MOM.WW.GalaxyRepository/) |
-| Secrets (encrypted store + `${secret:}` resolution) | Built (libs `0.1.2`, **published to the Gitea feed**; **HistorianGateway adopted + live-proven** 2026-07-16; 3 apps not yet adopted) | Shared `ZB.MOM.WW.Secrets` lib (3 packages + CLI) | [`components/secrets/`](components/secrets/) | [`ZB.MOM.WW.Secrets/`](ZB.MOM.WW.Secrets/) |
+| Secrets (encrypted store + `${secret:}` resolution) | Built (libs `0.1.2`, **published to the Gitea feed**; **HistorianGateway adopted + live-proven** 2026-07-16; **mxaccessgw adopted G-4/G-5/G-6 + merged to `origin/main` @ `e088dfa`** 2026-07-16, box-verified fail-closed + encrypt-at-rest; OtOpcUa + ScadaBridge planned, not yet adopted) | Shared `ZB.MOM.WW.Secrets` lib (3 packages + CLI) | [`components/secrets/`](components/secrets/) | [`ZB.MOM.WW.Secrets/`](ZB.MOM.WW.Secrets/) |
 
 The auth component is fully populated: a normalized [`spec`](components/auth/spec/SPEC.md), a
 proposed [`shared-contract`](components/auth/shared-contract/ZB.MOM.WW.Auth.md), three

components/secrets/GAPS.md

@@ -5,6 +5,22 @@ The delta between each project's [`current-state`](current-state/) and the
 reference-consumer-proven**; everything here is per-app adoption of an existing lib (not lib
 construction).
 
+## Execution status (2026-07-16)
+
+- **mxaccessgw — G-4 + G-5 + G-6 DONE.** Executed via the plan below (8 tasks, subagent-driven,
+  classification-driven reviews), **merged + pushed to `origin/main` (mxaccessgw @ `e088dfa`)**.
+  Offline: 0-warning build, full suite 781 pass / 44 pre-existing worker-COM (0 non-worker),
+  behavioral claim-type authz test, no Data-Protection disturbance. Box-verified on windev
+  (real .NET 10.0.8): fail-closed on unseeded `${secret:}` (`SecretNotFoundException`, refuses
+  to start) + CLI seed/`get` decrypt round-trip + **zero plaintext in the SQLite store at rest**.
+  (`/admin/secrets` interactive reveal not re-proven on this box — same shared `.Ui` component
+  already live-proven via HistorianGateway; box gateway runs LDAP-disabled/anonymous so a real
+  LDAP-via-secret login wasn't exercised there.) Two review-caught fixes folded in: the LDAP
+  password change's test/doc blast radius (validator-helper + host-test-bootstrap + doc truth),
+  and the live-LDAP integration suite now honors the `MxGateway__Ldap__ServiceAccountPassword`
+  env override. **G-4/G-5/G-6 below are the remaining OtOpcUa + ScadaBridge scope.**
+- **OtOpcUa, ScadaBridge — planned, NOT executed** (recommended order: OtOpcUa next, then ScadaBridge).
+
 ## Design + implementation plans (2026-07-16)
 
 G-2 … G-6 are now planned. Shared design +  three per-repo executable plans (task-metadata'd,