d139-carve-dryrun-20260801.txt
===============================
READ-ONLY dry run of netbox/d139-gua-carve.py against the VR1 WORKING apex
(office1-netbox http://10.10.1.10:8000, DOCFIX-195 -- NOT baldurkeep). Host:
vcloud. Date: 2026-08-01T00:08:57Z. NO write of any kind was made: the apex prefix
count was 139 before and 139 after, and none of the 22 CREATE rows exists.
Governing decision: D-139 ruling B. Retirement is REPORTED, never executed.

TOTALS ACROSS BOTH DCs: CREATE 22 | EXISTS 6 (untouched) | RETIRE-REPORT 18
ULA rows, holding 52 dependent ip-addresses that a later delete would orphan.

STANDING NOTE: commit 633da1c (same day, concurrent session) REFUTED D-139
ruling B's stated deciding reason (glibc 2.35 does not implement RFC 6724's
precedence table) and FLAGGED the ruling for operator reconsideration. D-139's
text is UNCHANGED, so this dry run reflects the ruling as it stands -- but the
--commit push is gated on that reconsideration, not merely on operator approval.

MEASURED STRUCTURAL ASYMMETRY, reported not acted on (outside D-139 table):
VR0 DC0 and Willamette -- the two sites D-139 cites as the org standard --
each carry a role=Cloud /56 (e02::/56, 102::/56), a :e0::/60 VPN and a
:f0::/60+/64 OOB. VR1 DC0/DC1 carry NONE of these; they hold only the /48
container. D-139 does not rule them, so this tool does not create them.

=======================================================================
== d139-gua-carve vr1-dc0 (DRY RUN) ==
   apex: http://10.10.1.10:8000   site: VR1 DC0 (id=8)
   apex prefixes scoped to vr1-dc0: 21  (read this run)
   CREATE 11 | EXISTS 3 | RETIRE-REPORT 9

  CREATE:
    2602:f3e2:f02:20::/60    role=metal-admin      VR1 DC0 metal-admin (GUA /60; D-139)
    2602:f3e2:f02:20::/64    role=metal-admin      VR1 DC0 metal-admin (GUA /64; D-139)
    2602:f3e2:f02:21::/64    role=metal-internal   VR1 DC0 metal-internal (GUA /64; D-139)
    2602:f3e2:f02:30::/60    role=data-tenant      VR1 DC0 data-tenant (GUA /60; D-139)
    2602:f3e2:f02:30::/64    role=data-tenant      VR1 DC0 data-tenant (GUA /64; D-139)
    2602:f3e2:f02:40::/60    role=storage          VR1 DC0 storage (GUA /60; D-139)
    2602:f3e2:f02:40::/64    role=storage          VR1 DC0 storage (GUA /64; D-139)
    2602:f3e2:f02:50::/60    role=replication      VR1 DC0 replication (GUA /60; D-139)
    2602:f3e2:f02:50::/64    role=replication      VR1 DC0 replication (GUA /64; D-139)
    2602:f3e2:f02:80::/60    role=lbaas-mgmt       VR1 DC0 lb-mgmt (GUA /60; D-139)
    2602:f3e2:f02:80::/64    role=lbaas-mgmt       VR1 DC0 lb-mgmt (GUA /64; D-139)

  EXISTS (idempotent -- left untouched):
    2602:f3e2:f02:10::/60    role=provider-public  provider-public
    2602:f3e2:f02:10::/64    role=provider-public  provider-public
    2602:f3e2:f02:11::/64    role=provider-public  provider-public VIP

  RETIRE -- REPORTED ONLY, this tool never deletes:
    fd50:840e:74e2:220::/60  role=metal-admin      VR1 DC0 metal-admin (ULA metal /60 (admin+internal); D-101/D-111)
    fd50:840e:74e2:220::/64  role=metal-admin      VR1 DC0 metal-admin (ULA /64 active; D-101/D-111)
    fd50:840e:74e2:221::/64  role=metal-internal   VR1 DC0 metal-internal (ULA /64 active (in metal /60); D-101/D-111)
    fd50:840e:74e2:230::/60  role=data-tenant      VR1 DC0 data-tenant (ULA /60; D-101/D-111)
    fd50:840e:74e2:230::/64  role=data-tenant      VR1 DC0 data-tenant (ULA /64 active; D-101/D-111)
    fd50:840e:74e2:240::/60  role=storage          VR1 DC0 storage (ULA /60; D-101/D-111)
    fd50:840e:74e2:240::/64  role=storage          VR1 DC0 storage (ULA /64 active; D-101/D-111)
    fd50:840e:74e2:250::/60  role=replication      VR1 DC0 replication (ULA /60; D-101/D-111)
    fd50:840e:74e2:250::/64  role=replication      VR1 DC0 replication (ULA /64 active; D-101/D-111)
    dependent objects inside those prefixes: 26 ip-address(es), 0 ip-range(s)

DRY RUN -- nothing was written. Re-run with --commit to apply.

== d139-gua-carve vr1-dc1 (DRY RUN) ==
   apex: http://10.10.1.10:8000   site: VR1 DC1 (id=9)
   apex prefixes scoped to vr1-dc1: 21  (read this run)
   CREATE 11 | EXISTS 3 | RETIRE-REPORT 9

  CREATE:
    2602:f3e2:f03:20::/60    role=metal-admin      VR1 DC1 metal-admin (GUA /60; D-139)
    2602:f3e2:f03:20::/64    role=metal-admin      VR1 DC1 metal-admin (GUA /64; D-139)
    2602:f3e2:f03:21::/64    role=metal-internal   VR1 DC1 metal-internal (GUA /64; D-139)
    2602:f3e2:f03:30::/60    role=data-tenant      VR1 DC1 data-tenant (GUA /60; D-139)
    2602:f3e2:f03:30::/64    role=data-tenant      VR1 DC1 data-tenant (GUA /64; D-139)
    2602:f3e2:f03:40::/60    role=storage          VR1 DC1 storage (GUA /60; D-139)
    2602:f3e2:f03:40::/64    role=storage          VR1 DC1 storage (GUA /64; D-139)
    2602:f3e2:f03:50::/60    role=replication      VR1 DC1 replication (GUA /60; D-139)
    2602:f3e2:f03:50::/64    role=replication      VR1 DC1 replication (GUA /64; D-139)
    2602:f3e2:f03:80::/60    role=lbaas-mgmt       VR1 DC1 lb-mgmt (GUA /60; D-139)
    2602:f3e2:f03:80::/64    role=lbaas-mgmt       VR1 DC1 lb-mgmt (GUA /64; D-139)

  EXISTS (idempotent -- left untouched):
    2602:f3e2:f03:10::/60    role=provider-public  provider-public
    2602:f3e2:f03:10::/64    role=provider-public  provider-public
    2602:f3e2:f03:11::/64    role=provider-public  provider-public VIP

  RETIRE -- REPORTED ONLY, this tool never deletes:
    fd50:840e:74e2:320::/60  role=metal-admin      VR1 DC1 metal-admin (ULA metal /60 (admin+internal); D-101/D-111)
    fd50:840e:74e2:320::/64  role=metal-admin      VR1 DC1 metal-admin (ULA /64 active; D-101/D-111)
    fd50:840e:74e2:321::/64  role=metal-internal   VR1 DC1 metal-internal (ULA /64 active (in metal /60); D-101/D-111)
    fd50:840e:74e2:330::/60  role=data-tenant      VR1 DC1 data-tenant (ULA /60; D-101/D-111)
    fd50:840e:74e2:330::/64  role=data-tenant      VR1 DC1 data-tenant (ULA /64 active; D-101/D-111)
    fd50:840e:74e2:340::/60  role=storage          VR1 DC1 storage (ULA /60; D-101/D-111)
    fd50:840e:74e2:340::/64  role=storage          VR1 DC1 storage (ULA /64 active; D-101/D-111)
    fd50:840e:74e2:350::/60  role=replication      VR1 DC1 replication (ULA /60; D-101/D-111)
    fd50:840e:74e2:350::/64  role=replication      VR1 DC1 replication (ULA /64 active; D-101/D-111)
    dependent objects inside those prefixes: 26 ip-address(es), 0 ip-range(s)

DRY RUN -- nothing was written. Re-run with --commit to apply.
