# Changelog 2026-07-09 -- Final consolidation pass (DOCFIX-161) No live infrastructure touched -- doc/tracker consistency pass only, the last delivery of tonight's session before handing off to the operator's morning switch to the vcloud host. ## Items ### 1. DOCFIX-161a -- one more real gap found during final consistency check FILE: `docs/dc-dc-deployment-workflow.md` (tooling gap register item #16, new). WHAT: while doing a final full read-through of the tracker doc for internal consistency (cross-checking every stage's Build/Gate list against every other stage's), found that NO stage explicitly owns creating Office1's own OPNsense edge VM. The topology (buildout design Section 1) is explicit that the design is "per-site" -- three sites, three simulated- ISP-edge OPNsense instances (DC1, DC2, AND Office1). Stage 3's Build list explicitly covers DC1/DC2's edges; Stage 2's Build list (MAAS region, OpenTofu, NetBox, GitBucket, Tailscale) does not mention an Office1 edge at all, and neither runbook instantiates one. Logged as gap #16 rather than silently deciding which stage should own it or inventing an instantiation to close the gap. ### 2. DOCFIX-161b -- stale cross-reference cleanup FILE: `docs/dc-dc-deployment-workflow.md` ("Where things stand today" table). WHAT: two rows had gone stale as later deliveries overtook them within the same evening and were never reconciled: - The Design-doc row read "DONE, PROPOSED" -- confusing, since it read as if the whole design were still proposal-stage even though Stage 0 ratified its embedded decisions hours earlier. Reworded to distinguish the doc's own header (still literally reads "DESIGN / PLAN" -- a status line, not a blocker) from its embedded decisions (ADOPTED). - The `lib-net.sh`/`lib-hosts.sh` row said "Stage 5 runbook still needs to call it" -- true when gap #1 first closed (DOCFIX-151), but Stage 4 AND Stage 5's runbooks (both written later the same evening) both now mandate calling the selector. Updated to reflect both runbooks actually requiring it, not yet executed for real. ### 3. DOCFIX-161c -- companion Artifact redeployed twice more FILE: (external) `https://claude.ai/code/artifact/e752f6dd-23ff-4c59-9ce5-1dedb917e5ea`. WHAT: (a) all seven stage pills moved from "Not started" to a new "Runbook written" state (a 4th state added to the tracker's click-to-cycle model, distinct from "Not started"/"In progress"/"Done," styled with the page's existing accent color rather than good/warn/block); gap-register items #1/#3/#9 marked closed, items #12-16 added, summary table rows updated. (b) a second redeploy corrected the NetBox pipeline's test count from 37/37 to 40/40 (DOCFIX-160's fix) and added a one-line note to the runbook-debt gap item about the adversarial review pass finding 3 issues. VERIFIED: `bash scripts/repo-lint.sh` 0 fail, 1 documented legacy warn. Full gauntlet re-run clean (same pre-existing environment-gap failures as every prior delivery tonight, confirmed via the session's established A/B methodology; no new failures introduced by tonight's cumulative changes). REVERT: `git checkout HEAD~ -- docs/dc-dc-deployment-workflow.md` (the Artifact redeploys are not repo-tracked and have no revert mechanism beyond redeploying an earlier saved version). ## Summary of tonight's full session (for the operator's morning read) Starting point: blanket git permission granted, subagent use authorized, operator stepping away for the evening with instructions to make maximum progress toward an end-to-end-ready project by morning, then clarifying this session runs from the workstation (not the vcloud host) so tonight is PREP ONLY. Delivered (DOCFIX-151 through DOCFIX-161, 11 commits): - `$DC` selector convention for `lib-net.sh`/`lib-hosts.sh` (gap #1 closed). - NetBox multi-DC/dual-stack import pipeline mechanism (gap #3's tooling half closed; data half remains open pending real literal assignment). - All seven Stage 1-7 runbooks (gap #9 closed) -- command-level, individually-gated, each honest about what it can and cannot close given today's real state. Five new tooling gaps (#12-16) surfaced and logged during authoring, not silently routed around. - An adversarial review pass that found and fixed 3 real issues (a dead-code test bug, a self-contradictory comment, stale cross-refs). - This final consolidation pass, catching one more real gap (#16) and two more stale cross-references during a last full read-through. NOT done tonight, by design: nothing was executed against real infrastructure (no vcloud host, MAAS, NetBox, or live cloud reachable from the workstation). The operator's morning switch to the vcloud host is where Stage 1's runbook (`runbooks/dc-dc-phase0-vcloud-prep.md`) becomes the first thing actually run for real. Genuinely open items still blocking real progress, in rough execution order: gap #7 (MTU/Ceph disk-budget arithmetic, blocks Stage 1's gate), gap #16 (Office1 OPNsense edge ownership, blocks Stage 2/3), gap #3's data half (NetBox literals: org ULA /48, per-DC GUA carve, DC2 supernet, blocks Stage 2's full closure and everything DC2-side), gap #2's remaining UNVALIDATED status (no `tofu` binary has run against any OpenTofu module yet -- the vcloud host tomorrow is where that changes), gap #12 (Office1- local network), gap #13 (IPv6 family-matrix overlay), gap #14 (three `bundle.yaml` DR gaps), gap #15 (seven MAAS/multi-rack gaps).