DOCFIX-205 CAPTURE -- 2026-07-30 -- Q1 withdrawal + the D-117 annotation half
==============================================================================

1. THE SUPERSESSION, quoted from D-117's Status line (docs/design-decisions.md):
   "Supersedes the `docs/dc-dc-netbox-buildout-scope.md` G5 recommendation (which
    proposed the opposite, Option A) and the D-106 `dc1`/`dc2` zone labels. Closes G5."

   And D-117's amendment rules the replacement:
   "The repo's `dc1`/`dc2` labels are retired in favour of `dc0`/`dc1`."

2. D-119 scopes its discharge to the SELECTOR half only:
it executes D-117's own amendment (region-qualify the shell selectors) across the three surfaces
D-117 never touched. D-117 stays ADOPTED; its "partially executed" caveat is discharged here.

3. ANNOTATION COVERAGE, measured (was 0/4 before this batch):
   D-101 annotated: YES
   D-106 annotated: YES
   D-111 annotated: YES
   D-115 annotated: YES

4. THE EXECUTABLE DEFECT, expansion measured in a real shell:
   OLD (selector interpolated): keystone.omega.vr1-dc0.vr1.cloud.neumatrix.local
   NEW (both labels derived)  : keystone.omega.dc0.vr1.cloud.neumatrix.local
   OLD (selector interpolated): keystone.omega.vr1-dc1.vr1.cloud.neumatrix.local
   NEW (both labels derived)  : keystone.omega.dc1.vr1.cloud.neumatrix.local

5. LIVE A12 ON THE HEADEND (the only host holding the PKI):
   vr1-dc0: PASS 29/0, expected zone omega.dc0.vr1.cloud.neumatrix.local
   vr1-dc1: PASS 29/0, expected zone omega.dc1.vr1.cloud.neumatrix.local
   Both INERT (os-public-hostname set in no deploy artifact) -- so this was
   NOT blocking, contrary to the queued finding's framing.

6. GATES, both hosts:
   vcloud   : gauntlet ALL GREEN (89); repo-lint 0 fail, 1 warn (legacy L1)
   voffice1 : gauntlet ALL GREEN (89); repo-lint 0 fail, 1 warn (legacy L1)
   octavia-pki harness: 21/21 -> 23/23 (T21 replaced; T21b/T21c new)
   ledger-scan: UNCHANGED -- 3 decisions, 21 SEC, D 138 / BUNDLEFIX 053; DOCFIX 205 used

Commit: 1ddb078 on dc-dc-stage5-preconditions