Changelog 2026-07-09 -- Adversarial review pass: 3 findings fixed (DOCFIX-160)

No live infrastructure touched. Operator's standing instruction ("check back over current work, review for errors/assumptions") applied to everything built this evening: scripts/lib-net.sh/lib-hosts.sh's selector functions, netbox/dc-dc-prefixes-import.py, and all seven Stage 1-7 runbooks. Ran a dedicated adversarial-review subagent (fresh eyes, no authoring context) instructed to find real defects, not summarize -- it read every file in full, cross-checked claims against design-decisions.md/bundle.yaml/opentofu/*.tf directly, and ran both new test harnesses live rather than trusting their reported pass counts.

Items

1. DOCFIX-160a -- dead-code bug in tests/dc-dc-prefixes-import/test_logic.py

FILE: tests/dc-dc-prefixes-import/test_logic.py.

WHAT: expect_ok()'s try: return fn(...) / except SystemExit: ... / else: ok(label) structure has a real Python control-flow bug -- a return statement inside a try block causes the function to exit immediately, so the else clause (which only runs when the try block completes WITHOUT a return/exception) is UNREACHABLE dead code whenever fn() succeeds. Verified empirically (python3 -c reproduction): the else branch's print/ok() call never executes on the success path.

CONCRETE IMPACT: three happy-path assertions -- "ula48 valid /48 within fc00::/7", "gua valid /40 within 2602:f3e2::/32", "dc2 supernet valid /19 no overlap" -- were silently never counted as PASS or FAIL. The harness's "ALL PASS (37 checks)" banner was true for the 37 checks that DID run, but overstated what was actually verified: the safety property (rejecting bad input) was still exercised correctly (that path lives in except, unaffected by the bug), but "valid input is accepted, not spuriously rejected" was unverified and uncounted. This "37/37" figure was quoted in docs/dc-dc-deployment- workflow.md, docs/changelog-20260709-netbox-dc-dc-pipeline.md, and docs/session-ledger.md -- all now stale by 3 checks (see item 3 below).

FIX: restructured to assign the result inside try, call ok(label) unconditionally after the except block (which itself still returns early on failure), and return the result:

def expect_ok(label, fn, *a, **kw):
    try:
        result = fn(*a, **kw)
    except SystemExit as exc:
        no(label, f"unexpectedly raised SystemExit({exc})")
        return None
    ok(label)
    return result

VERIFIED: re-ran the harness -- the three previously-silent labels now print PASS, and the total moved from 37 to 40 checks, all passing.

2. DOCFIX-160b -- self-contradictory comment in netbox/dc-dc-prefixes-import.py

FILE: netbox/dc-dc-prefixes-import.py (lines 165-168).

WHAT: two adjacent comments about the same arithmetic fact contradicted each other -- one claimed a /19 "exactly fits six /22s with zero slack," the other correctly stated "a /19 = exactly 8x /22." 2^(22-19) = 8, so a /19 holds eight /22s (six used, two spare), not six with no slack. No functional bug -- the code only requires prefixlen <= 19 and slices the first six subnets, which was always correct -- but a genuine, verifiable self-contradiction a few lines apart, exactly the class of thing an adversarial pass should catch.

FIX: corrected the wrong comment to match the arithmetic the other comment (and the code itself) already had right.

3. DOCFIX-160c -- stale self-referential text in Stage 4 runbook

FILE: runbooks/dc-dc-phase3-maas-enlist-deploy.md.

WHAT: written mid-session when Stage 3's runbook didn't exist yet, two spots said so explicitly ("Stage 3's own runbook does not exist yet as of this writing... state NOT STARTED"). By the time the full session finished, Stage 3 (and Stage 4 itself) were both written and reflected as such in docs/dc-dc-deployment-workflow.md -- these two spots were never reconciled against that final state. Not misleading in practice (the runbook already hedged with "if it has been written and run by the time you execute this..."), but stale phrasing left behind.

FIX: reworded both spots to state Stage 3's runbook is now written but not yet EXECUTED, and to check its actual execution state (not just its existence) before proceeding.

VERIFIED (all three items): bash scripts/repo-lint.sh 0 fail, 1 documented legacy warn. bash tests/dc-dc-prefixes-import/run-tests.sh: 40/40 PASS (up from 37, item 1's fix). bash tests/dc-selector/run- tests.sh: 21/21 PASS (unaffected, re-run to confirm no regression from touching a neighboring file in the same review pass).

What the review found nothing wrong with, despite genuinely trying: the $DC selector asymmetry description (identical and correct across every file that mentions it); the ULA/GUA carve arithmetic (hand-verified deterministic, no cross-DC collision); Stage 6's bundle.yaml claims (confirmed byte-for-byte); 3+ direct D-NNN quotes spot-checked verbatim; DOCFIX numbering and D-100..D-110 ratification consistency across every changelog/tracker/ledger entry; every opentofu/main.tf/variables.tf claim in the Stage 1/3 runbooks. No inferred/invented literal value was found anywhere in the reviewed material.

REVERT: not applicable -- all three fixes are themselves corrections to today's own deliverables, reverting them would reintroduce the bugs.

Next actionable step

Adversarial review pass complete (this session's task list item). Final consolidation (workflow doc cross-check, gap register, companion artifact, changelog roll-up, session ledger) is the last remaining item before this evening's work is fully wrapped for the operator's return in the morning.