docs: six VLANs and the untagged LAN, and count them from the table (#209)

[Gerrrt]

Closes #209.

There were six, not five

File	Was
README.md:29	"Seven VLANs behind a pfSense firewall…"
README.md:49	"Seven VLANs; IoT, media and…"
docs/network.md:3	"Seven VLANs behind a pfSense firewall…"
docs/adr/0002-vlan-segmentation-strategy.md:36	"Seven VLANs, assigned by how much a compromise…"
docs/adr/0008-place-services-by-data-trust.md:43	"the seven VLANs stand" — not in #209's list
docs/runbooks/restore-the-firewall.md:16	"It routes all seven\nVLANs…" — only visible to a multi-line search

The two the issue missed are the same defect it is about. restore-the-firewall.md's claim wraps across a line break, so no line-based grep could see it; ADR-0008 was simply not swept. A number asserted six times and enumerated zero times is hard to count by hand, which is the argument for the guard below.

What the wording does

Per the issue, seven is nearly right and the fix keeps what is true in it — morpheus routes seven internal networks: six VLANs plus the untagged switch-management LAN at 10.7.7.1/24, which network.md's table already records with a dash because it carries no tag.

restore-the-firewall.md gets the issue's own suggested wording, since it is the load-bearing one:

morpheus routes six VLANs and the untagged switch-management LAN — seven internal networks in total

The ADRs are corrected in place, not annotated

This is deliberately the opposite of how #161 handled ADR-0008's "long earmarked as the spare", which was left alone. That sentence was an accurate record of a belief that shaped a decision, and rewriting it would have destroyed the reasoning.

This is not that. ADR-0002's own table has enumerated exactly six since the day it was written, so "Seven VLANs" contradicted the document containing it — never true, rather than true-when-written. Correcting it makes the ADR self-consistent. Neither decision changes.

The guard

check_docs.py derives the count from network.md's segment table, reading the tag column rather than the row count, so the untagged LAN stays uncounted and "seven internal networks" stays sayable.

Test	Result
Same-line drift (Seven VLANs in README)	caught
Wrapped drift (seven\nVLANs in the runbook)	caught, reported at the right line
A VLAN added to the table	every prose claim fails — "the repository has 7"

One thing this changes beyond #209

check_counts scanned line by line, so every claim in it was blind to a claim that wraps — including the receiver count added for #212 a few commits ago. It now matches whole files, with a whitespace run that may cross one line break and never a blank line, so a count ending one paragraph cannot bind to a noun starting the next.

That gap is why this issue existed for as long as it did.

Checks

validate.sh — 45 PASS, 0 FAIL, 2 SKIP (the usual environmental two).

Worth recording: the first validation run failed, with docs/network.md:3 claims Seven VLANs; the repository has 6. A git checkout -- cleaning up after a guard test also reverted the uncommitted fix to that file. The check added by this PR caught a regression of the very issue this PR closes, in the PR that closes it.

🤖 Generated with Claude Code