docs(secrets): clustered replication ENABLED + proven on the OtOpcUa docker-dev rig; #482 closed

Claude-Session: https://claude.ai/code/session_01BL2Vu1ESDQ9SCN4gVKkdts

components/secrets/GAPS.md

@@ -149,8 +149,18 @@ project 38/38 green.
   8/8; plain `ActorSystem`, no TestKit — xunit.v3-compatible).
   **Tracked:** [`scadaproj#1`](https://gitea.dohertylan.com/dohertj2/scadaproj/issues/1) (the defect —
   fixed, CLOSED) and [`lmxopcua#482`](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/482)
-  (open only for the per-environment decision to enable `Secrets:Replication:Enabled`, which stays
-  default-false and requires the same KEK on every node first).
+  (CLOSED 2026-07-18 — fully adopted).
+- ✅ **ENABLED on the OtOpcUa docker-dev rig (2026-07-18, `lmxopcua master @ c878fbbd`)** — all six
+  host nodes run `Secrets:Replication:Enabled=true` with one shared dev KEK (compose `x-secrets-env`
+  anchor, `${OTOPCUA_SECRETS_KEK:-…}` dev default). Live-proven on the rig: no startup deadlock across
+  repeated restarts; a secret seeded into site-a-1's store alone converged to all five peers within
+  ≤60 s with **byte-identical ciphertext on all six nodes** (same sha256/kek_id), decrypt-verified on
+  central-2 + site-b-2; site-b-2 restart rejoined with the row intact. Found during verification and
+  filed as [`lmxopcua#483`](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/483): the AdminUI
+  `/admin/secrets` page is non-interactive (Secrets.Ui RCL has no `@rendermode`; hosts applying render
+  modes per-page get a dead page — check the other three apps for the same pattern).
+  **Production/wonder enablement is deliberately NOT done** — needs its own decision + real KEK
+  distribution (never the committed dev key) per the clustered-secrets runbook.
 - ✅ ScadaBridge's hub topology **is** live-validated and safe to enable (config + a shared KEK).
 
 Harness: `scratchpad/livegate/` (two scenarios, `akka` / `sql`; not committed).