[Gerrrt]

What changed

Prose only, in one bullet of ADR-0010's Consequences. No fact changes, no config touched.

Why

#126 and #295 edited ADR-0010 within the same hour — one the detection consequence, one the verification section below it. Git merged both without a conflict and neither changed a measured fact, but nobody read the result end to end. Three things came out of it:

• A sentence that reads as a typo. "two dns modules on the blackbox-exporter Probe the services this was filed for, and probe TLS expiry #91 landed" is missing its "that". The clause is now gone rather than repaired — which exporter the probes run on is not what this consequence is about, and Probe the services this was filed for, and probe TLS expiry #91 is already credited where the exporter is described.
• A half-named blocker. The bullet said the targets stay disabled until ADR-0008: the sensitive-tier services and two new firewall rules are untracked #102 builds the box. They also wait on Unbound actually forwarding — the finding recorded in the verification section immediately below, and the thing this whole decision turns on. Naming one blocker and not the other in the paragraph that connects detection to implementation is the more misleading half to omit.
• Length. It had grown to the longest bullet in Consequences by half again, mostly by restating a test described two screens down. It now points at that section instead.

Blast radius

None. One markdown file.

• No change to network segmentation or firewall rules
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml

Verification

scripts/lint.sh and scripts/check_docs.py both pass. Diff is 11 lines removed, 8 added, all inside one bullet.

• make validate passes
• Deployed to the lab and confirmed working — documentation only
• Docs updated

🤖 Generated with Claude Code