diff --git a/docs/dc-dc-deployment-workflow.md b/docs/dc-dc-deployment-workflow.md
index 59ea2cd..404910c 100644
--- a/docs/dc-dc-deployment-workflow.md
+++ b/docs/dc-dc-deployment-workflow.md
@@ -211,9 +211,33 @@
    org ULA /48, and per-DC GUA carves to be NetBox-authoritative via "the
    extended import pipeline" -- that pipeline is not written. Blocks Stage 0's
    exit condition (literals must be real, not placeholders) and Stage 2.
-4. **OPNsense automation + netem application/measurement.** No config, image
-   prep, or scripting exists. Blocks Stage 1 (Office1 edge) and Stage 3
-   (per-DC edges) gates, which require netem parameters "applied and measured."
+4. **OPNsense edge deployment/config, and netem WAN-simulation -- four separable
+   sub-gaps, not one.** Each site (Office1, DC1, DC2) gets its own independent
+   OPNsense edge with a simulated ISP uplink (D-100); OpenTofu owns creating
+   the edge VMs (D-103). Blocks Stage 1 (Office1 edge) and Stage 3 (per-DC
+   edges) gates, which require netem parameters "applied and measured."
+   - **(a) Network substrate -- DONE.** `opentofu/modules/mesh-link` creates
+     the inter-site L2 segments (DC1<->DC2, DC1<->Office1, DC2<->Office1) an
+     OPNsense VM's interfaces would eventually attach to.
+   - **(b) The OPNsense VM/image itself -- BLOCKED on the deferred
+     `libvirt_domain` module** (see gap #2). OPNsense is a VM; it inherits
+     that same schema-verification prerequisite. No image source (official
+     OPNsense qcow2/ISO vs a custom-built image) has been chosen either.
+   - **(c) OPNsense routing/firewall configuration -- NOT STARTED, no
+     mechanism chosen.** Once the VM exists, per-site routing + the "simulated
+     ISP uplink" role need configuring. OPNsense's own config is an XML file
+     (`config.xml`), not something the libvirt provider touches at all --
+     options are a pre-baked config baked into the image, a cloud-init-driven
+     first-boot script, or OPNsense's own API/CLI driven post-boot by a
+     provisioner. None evaluated yet.
+   - **(d) `tc netem` WAN-simulation -- a wholly separate mechanism, not an
+     OPNsense setting.** No Terraform/OpenTofu-native equivalent exists at
+     all (confirmed against the `libvirt_network` schema, gap #2); it is a
+     Linux `tc qdisc` setting applied to the host-side bridge interface after
+     the network exists, needing either a provisioner or a small companion
+     script -- neither written. The exact parameters (latency/jitter/loss/
+     rate) are themselves still an unruled D-100 open sub-item (gap #11), so
+     this needs a decision before it can be scripted, not just scripting.
 5. **Ceph replication tooling (radosgw multisite + rbd-mirror).** No script in
    the repo touches either (checked; `osd-blank-check.sh` is unrelated). D-108's
    entire mechanism -- zonegroup setup, rbd-mirror daemon peering, the
diff --git a/opentofu/README.md b/opentofu/README.md
index 8196e7d..a7e45f8 100644
--- a/opentofu/README.md
+++ b/opentofu/README.md
@@ -57,8 +57,20 @@
   provisioner or a small companion script -- not yet written. The exact
   parameters are themselves a Phase-0 open item (D-100), so this was going to
   need a second pass regardless.
-- **OPNsense edge VM config / MAAS-region / NetBox / GitBucket service VMs.**
-  All depend on the deferred domain module (they're VMs).
+- **OPNsense edges -- four separable pieces, not one, all currently blocked or
+  unstarted:** (a) the network substrate is done (`modules/mesh-link`, above);
+  (b) the VM/image itself is blocked on the deferred domain module, and no
+  image source (official OPNsense qcow2/ISO vs. a custom build) has been
+  chosen; (c) OPNsense's own routing/firewall config is a `config.xml` the
+  libvirt provider never touches -- pre-baked image vs. cloud-init first-boot
+  vs. API/CLI-driven provisioner is an open choice, not started; (d) `tc
+  netem` WAN simulation is a separate OS-level `tc qdisc` setting with no
+  Terraform-native equivalent at all, needing its own provisioner/script, and
+  whose parameters are still an unruled D-100 open item -- a decision, not
+  just scripting, is needed first. Full breakdown in
+  `docs/dc-dc-deployment-workflow.md` gap register item 4.
+- **MAAS-region / NetBox / GitBucket service VMs.** Depend on the deferred
+  domain module (they're VMs too).
 
 ## Schema notes (read before extending)