# Changelog 2026-07-09 -- Final consolidation pass (DOCFIX-161)

No live infrastructure touched -- doc/tracker consistency pass only, the
last delivery of tonight's session before handing off to the operator's
morning switch to the vcloud host.

## Items

### 1. DOCFIX-161a -- one more real gap found during final consistency check
FILE: `docs/dc-dc-deployment-workflow.md` (tooling gap register item #16,
new).

WHAT: while doing a final full read-through of the tracker doc for
internal consistency (cross-checking every stage's Build/Gate list against
every other stage's), found that NO stage explicitly owns creating
Office1's own OPNsense edge VM. The topology (buildout design Section 1)
is explicit that the design is "per-site" -- three sites, three simulated-
ISP-edge OPNsense instances (DC1, DC2, AND Office1). Stage 3's Build list
explicitly covers DC1/DC2's edges; Stage 2's Build list (MAAS region,
OpenTofu, NetBox, GitBucket, Tailscale) does not mention an Office1 edge
at all, and neither runbook instantiates one. Logged as gap #16 rather
than silently deciding which stage should own it or inventing an
instantiation to close the gap.

### 2. DOCFIX-161b -- stale cross-reference cleanup
FILE: `docs/dc-dc-deployment-workflow.md` ("Where things stand today"
table).

WHAT: two rows had gone stale as later deliveries overtook them within
the same evening and were never reconciled:
- The Design-doc row read "DONE, PROPOSED" -- confusing, since it read as
  if the whole design were still proposal-stage even though Stage 0
  ratified its embedded decisions hours earlier. Reworded to distinguish
  the doc's own header (still literally reads "DESIGN / PLAN" -- a status
  line, not a blocker) from its embedded decisions (ADOPTED).
- The `lib-net.sh`/`lib-hosts.sh` row said "Stage 5 runbook still needs to
  call it" -- true when gap #1 first closed (DOCFIX-151), but Stage 4 AND
  Stage 5's runbooks (both written later the same evening) both now
  mandate calling the selector. Updated to reflect both runbooks actually
  requiring it, not yet executed for real.

### 3. DOCFIX-161c -- companion Artifact redeployed twice more
FILE: (external) `https://claude.ai/code/artifact/e752f6dd-23ff-4c59-9ce5-1dedb917e5ea`.

WHAT: (a) all seven stage pills moved from "Not started" to a new
"Runbook written" state (a 4th state added to the tracker's click-to-cycle
model, distinct from "Not started"/"In progress"/"Done," styled with the
page's existing accent color rather than good/warn/block); gap-register
items #1/#3/#9 marked closed, items #12-16 added, summary table rows
updated. (b) a second redeploy corrected the NetBox pipeline's test count
from 37/37 to 40/40 (DOCFIX-160's fix) and added a one-line note to the
runbook-debt gap item about the adversarial review pass finding 3 issues.

VERIFIED: `bash scripts/repo-lint.sh` 0 fail, 1 documented legacy warn.
Full gauntlet re-run clean (same pre-existing environment-gap failures as
every prior delivery tonight, confirmed via the session's established A/B
methodology; no new failures introduced by tonight's cumulative changes).

REVERT: `git checkout HEAD~ -- docs/dc-dc-deployment-workflow.md` (the
Artifact redeploys are not repo-tracked and have no revert mechanism
beyond redeploying an earlier saved version).

## Summary of tonight's full session (for the operator's morning read)

Starting point: blanket git permission granted, subagent use authorized,
operator stepping away for the evening with instructions to make maximum
progress toward an end-to-end-ready project by morning, then clarifying
this session runs from the workstation (not the vcloud host) so tonight
is PREP ONLY.

Delivered (DOCFIX-151 through DOCFIX-161, 11 commits):
- `$DC` selector convention for `lib-net.sh`/`lib-hosts.sh` (gap #1 closed).
- NetBox multi-DC/dual-stack import pipeline mechanism (gap #3's tooling
  half closed; data half remains open pending real literal assignment).
- All seven Stage 1-7 runbooks (gap #9 closed) -- command-level,
  individually-gated, each honest about what it can and cannot close given
  today's real state. Five new tooling gaps (#12-16) surfaced and logged
  during authoring, not silently routed around.
- An adversarial review pass that found and fixed 3 real issues (a
  dead-code test bug, a self-contradictory comment, stale cross-refs).
- This final consolidation pass, catching one more real gap (#16) and two
  more stale cross-references during a last full read-through.

NOT done tonight, by design: nothing was executed against real
infrastructure (no vcloud host, MAAS, NetBox, or live cloud reachable from
the workstation). The operator's morning switch to the vcloud host is
where Stage 1's runbook (`runbooks/dc-dc-phase0-vcloud-prep.md`) becomes
the first thing actually run for real.

Genuinely open items still blocking real progress, in rough execution
order: gap #7 (MTU/Ceph disk-budget arithmetic, blocks Stage 1's gate),
gap #16 (Office1 OPNsense edge ownership, blocks Stage 2/3), gap #3's data
half (NetBox literals: org ULA /48, per-DC GUA carve, DC2 supernet, blocks
Stage 2's full closure and everything DC2-side), gap #2's remaining
UNVALIDATED status (no `tofu` binary has run against any OpenTofu module
yet -- the vcloud host tomorrow is where that changes), gap #12 (Office1-
local network), gap #13 (IPv6 family-matrix overlay), gap #14 (three
`bundle.yaml` DR gaps), gap #15 (seven MAAS/multi-rack gaps).
