# Changelog 2026-07-09 -- Adversarial review pass: 3 findings fixed (DOCFIX-160)

No live infrastructure touched. Operator's standing instruction ("check
back over current work, review for errors/assumptions") applied to
everything built this evening: `scripts/lib-net.sh`/`lib-hosts.sh`'s
selector functions, `netbox/dc-dc-prefixes-import.py`, and all seven
Stage 1-7 runbooks. Ran a dedicated adversarial-review subagent (fresh
eyes, no authoring context) instructed to find real defects, not summarize
-- it read every file in full, cross-checked claims against
`design-decisions.md`/`bundle.yaml`/`opentofu/*.tf` directly, and ran both
new test harnesses live rather than trusting their reported pass counts.

## Items

### 1. DOCFIX-160a -- dead-code bug in `tests/dc-dc-prefixes-import/test_logic.py`
FILE: `tests/dc-dc-prefixes-import/test_logic.py`.

WHAT: `expect_ok()`'s `try: return fn(...) / except SystemExit: ... / else:
ok(label)` structure has a real Python control-flow bug -- a `return`
statement inside a `try` block causes the function to exit immediately,
so the `else` clause (which only runs when the `try` block completes
WITHOUT a `return`/exception) is UNREACHABLE dead code whenever `fn()`
succeeds. Verified empirically (`python3 -c` reproduction): the `else`
branch's `print`/`ok()` call never executes on the success path.

CONCRETE IMPACT: three happy-path assertions --
`"ula48 valid /48 within fc00::/7"`, `"gua valid /40 within
2602:f3e2::/32"`, `"dc2 supernet valid /19 no overlap"` -- were silently
never counted as PASS *or* FAIL. The harness's "ALL PASS (37 checks)"
banner was true for the 37 checks that DID run, but overstated what was
actually verified: the safety property (rejecting bad input) was still
exercised correctly (that path lives in `except`, unaffected by the bug),
but "valid input is accepted, not spuriously rejected" was unverified and
uncounted. This "37/37" figure was quoted in `docs/dc-dc-deployment-
workflow.md`, `docs/changelog-20260709-netbox-dc-dc-pipeline.md`, and
`docs/session-ledger.md` -- all now stale by 3 checks (see item 3 below).

FIX: restructured to assign the result inside `try`, call `ok(label)`
unconditionally after the `except` block (which itself still returns
early on failure), and return the result:
```python
def expect_ok(label, fn, *a, **kw):
    try:
        result = fn(*a, **kw)
    except SystemExit as exc:
        no(label, f"unexpectedly raised SystemExit({exc})")
        return None
    ok(label)
    return result
```

VERIFIED: re-ran the harness -- the three previously-silent labels now
print `PASS`, and the total moved from 37 to **40 checks, all passing**.

### 2. DOCFIX-160b -- self-contradictory comment in `netbox/dc-dc-prefixes-import.py`
FILE: `netbox/dc-dc-prefixes-import.py` (lines 165-168).

WHAT: two adjacent comments about the same arithmetic fact contradicted
each other -- one claimed a /19 "exactly fits six /22s with zero slack,"
the other correctly stated "a /19 = exactly 8x /22." 2^(22-19) = 8, so a
/19 holds eight /22s (six used, two spare), not six with no slack. No
functional bug -- the code only requires prefixlen <= 19 and slices the
first six subnets, which was always correct -- but a genuine, verifiable
self-contradiction a few lines apart, exactly the class of thing an
adversarial pass should catch.

FIX: corrected the wrong comment to match the arithmetic the other
comment (and the code itself) already had right.

### 3. DOCFIX-160c -- stale self-referential text in Stage 4 runbook
FILE: `runbooks/dc-dc-phase3-maas-enlist-deploy.md`.

WHAT: written mid-session when Stage 3's runbook didn't exist yet, two
spots said so explicitly ("Stage 3's own runbook does not exist yet as of
this writing... state NOT STARTED"). By the time the full session
finished, Stage 3 (and Stage 4 itself) were both written and reflected as
such in `docs/dc-dc-deployment-workflow.md` -- these two spots were never
reconciled against that final state. Not misleading in practice (the
runbook already hedged with "if it has been written and run by the time
you execute this..."), but stale phrasing left behind.

FIX: reworded both spots to state Stage 3's runbook is now written but not
yet EXECUTED, and to check its actual execution state (not just its
existence) before proceeding.

VERIFIED (all three items): `bash scripts/repo-lint.sh` 0 fail, 1
documented legacy warn. `bash tests/dc-dc-prefixes-import/run-tests.sh`:
40/40 PASS (up from 37, item 1's fix). `bash tests/dc-selector/run-
tests.sh`: 21/21 PASS (unaffected, re-run to confirm no regression from
touching a neighboring file in the same review pass).

**What the review found nothing wrong with, despite genuinely trying:**
the `$DC` selector asymmetry description (identical and correct across
every file that mentions it); the ULA/GUA carve arithmetic (hand-verified
deterministic, no cross-DC collision); Stage 6's `bundle.yaml` claims
(confirmed byte-for-byte); 3+ direct D-NNN quotes spot-checked verbatim;
DOCFIX numbering and D-100..D-110 ratification consistency across every
changelog/tracker/ledger entry; every `opentofu/main.tf`/`variables.tf`
claim in the Stage 1/3 runbooks. No inferred/invented literal value was
found anywhere in the reviewed material.

REVERT: not applicable -- all three fixes are themselves corrections to
today's own deliverables, reverting them would reintroduce the bugs.

## Next actionable step

Adversarial review pass complete (this session's task list item). Final
consolidation (workflow doc cross-check, gap register, companion artifact,
changelog roll-up, session ledger) is the last remaining item before this
evening's work is fully wrapped for the operator's return in the morning.