STEP 3 BAND/CARVE EXECUTION -- AS-EXECUTED, 2026-07-28T10:10:24Z
Operator-gated: 'Process 1,2,3. All approved'. No run-logged.sh window (P0-4 class).
SEQUENCE: carve-v6 dc1 --commit; reserve dc0 --commit; reserve dc1 --commit
RESULTS
carve-v6 vr1-dc1 : 6 applied / 1 skipped / 0 errors, each READ BACK
reserve vr1-dc0 : 13 applied (12 D-134 bands + FIP pool) / 0 errors
reserve vr1-dc1 : 12 applied (12 D-134 bands) / 1 error = FIP pool REFUSED
GATE, both DCs: dc-plane-ipam check = pass=24 fail=0 (baseline was 6/18 each)
ipranges 3 -> 28 (3 dynamic unchanged + 25 reserved created)
subnets 18 -> 30 (12 v6 planes created, 6 per DC)
machines 18 Ready + 2 Deployed -- UNCHANGED THROUGHOUT
FINDING -- MAAS ALREADY RESERVES THE WHOLE LOW IPv6 BLOCK.
Every explicit v6 band create FAILED with:
'Requested reserved range conflicts with an existing range.'
Measured cause via 'maas admin subnet reserved-ip-ranges <id>': MAAS
auto-reserves ::1 - ::ffff:ffff (purpose 'reserved') on EVERY IPv6 subnet,
plus :: itself under RFC 4291 s2.6.1. Allocatable space begins only at
<prefix>:0:1::. The ruled v6 bands sit entirely inside that block, so they
are ALREADY protected -- far more broadly than the band itself.
CONSEQUENCE: R4's 'v6 bands follow as a second pass with the same tool' is
NOT EXECUTABLE in MAAS and does not need to be. The tool now VERIFIES the
coverage property instead of attempting a write. This is an execution-level
correction to R4; the INTENT (v6 planes carry band discipline) is satisfied.
Verified identically on ULA and GUA subnets.
STILL OPEN: dc1's FIP pool is UNSET in lib-net BY DESIGN, so R4 cannot close
for dc1 until it is ruled. Not inferred from dc0's shape (hard rule 2).
########## check vr1-dc0 ##########
[ok] v6 metal-internal fd50:840e:74e2:221::/64 present
[ok] v6 provider-public 2602:f3e2:f02:10::/64 present
[note] provider-public 2602:f3e2:f02:11::/64 provider VIP block, MAAS subnet=no (not asserted)
[ok] v6 replication fd50:840e:74e2:250::/64 present
[ok] v6 storage fd50:840e:74e2:240::/64 present
-- D-134 reserved bands (v4) --
[ok] provider-public util band 10.12.4.4-10.12.4.49 reserved
[ok] provider-public vip band 10.12.4.50-10.12.4.99 reserved
[ok] metal-admin util band 10.12.8.4-10.12.8.49 reserved
[ok] metal-admin vip band 10.12.8.50-10.12.8.99 reserved
[ok] metal-internal util band 10.12.12.4-10.12.12.49 reserved
[ok] metal-internal vip band 10.12.12.50-10.12.12.99 reserved
[ok] data-tenant util band 10.12.16.4-10.12.16.49 reserved
[ok] data-tenant vip band 10.12.16.50-10.12.16.99 reserved
[ok] storage util band 10.12.32.4-10.12.32.49 reserved
[ok] storage vip band 10.12.32.50-10.12.32.99 reserved
[ok] replication util band 10.12.36.4-10.12.36.49 reserved
[ok] replication vip band 10.12.36.50-10.12.36.99 reserved
RESULT: pass=24 fail=0
PASS: dc-plane-ipam check vr1-dc0
########## check vr1-dc1 ##########
[ok] v6 metal-internal fd50:840e:74e2:321::/64 present
[ok] v6 provider-public 2602:f3e2:f03:10::/64 present
[note] provider-public 2602:f3e2:f03:11::/64 provider VIP block, MAAS subnet=no (not asserted)
[ok] v6 replication fd50:840e:74e2:350::/64 present
[ok] v6 storage fd50:840e:74e2:340::/64 present
-- D-134 reserved bands (v4) --
[ok] provider-public util band 10.12.64.4-10.12.64.49 reserved
[ok] provider-public vip band 10.12.64.50-10.12.64.99 reserved
[ok] metal-admin util band 10.12.68.4-10.12.68.49 reserved
[ok] metal-admin vip band 10.12.68.50-10.12.68.99 reserved
[ok] metal-internal util band 10.12.72.4-10.12.72.49 reserved
[ok] metal-internal vip band 10.12.72.50-10.12.72.99 reserved
[ok] data-tenant util band 10.12.76.4-10.12.76.49 reserved
[ok] data-tenant vip band 10.12.76.50-10.12.76.99 reserved
[ok] storage util band 10.12.80.4-10.12.80.49 reserved
[ok] storage vip band 10.12.80.50-10.12.80.99 reserved
[ok] replication util band 10.12.84.4-10.12.84.49 reserved
[ok] replication vip band 10.12.84.50-10.12.84.99 reserved
RESULT: pass=24 fail=0
PASS: dc-plane-ipam check vr1-dc1
