d139-steps2-3-dc0-20260801.txt
===============================
D-139 execution STEPS 2 and 3 for vr1-dc0. EXECUTED 2026-08-01, operator-gated.
Run from voffice1 (D-128 Plane-2) via the restored :5241 forward, profile
vr1-dc0-region asserted by rack identity before any call.

STEP 2 -- MAAS GUA /64s alongside the existing ULA
  scripts/dc-plane-ipam.sh carve-v6 vr1-dc0 --commit
  planned=5 applied=5 skipped=7 errors=2
  Each GUA /64 created on the SAME vlan as its v4 twin, each read back:
    2602:f3e2:f02:20::/64 vlan 5001 (metal-admin)     + fd50:840e:74e2:220::/64
    2602:f3e2:f02:21::/64 vlan 5004 (metal-internal)  + fd50:840e:74e2:221::/64
    2602:f3e2:f02:30::/64 vlan 5005 (data-tenant)     + fd50:840e:74e2:230::/64
    2602:f3e2:f02:40::/64 vlan 5006 (storage)         + fd50:840e:74e2:240::/64
    2602:f3e2:f02:50::/64 vlan 5007 (replication)     + fd50:840e:74e2:250::/64
    2602:f3e2:f02:10::/64 vlan 5002 (provider-public) -- already GUA, untouched
  The 2 errors are CORRECT REFUSALS, not failures: lbaas-mgmt and oob have no v4
  plane to pair with ("refusing to guess a fabric"). lb-mgmt is D-139 step 5; oob's
  10.12.40.0/22 is ruled-but-not-built.
  Independent read-back: 11 v6 subnets, 6 GUA + 5 ULA, every GUA paired on one vlan.

STEP 3 -- node v6 statics migrated ULA -> GUA, WHILE v4 IS STILL PRESENT
  scripts/dc-node-v6-carve.py replace vr1-dc0 --v6-family gua --commit
  applied=45 skipped=9 errors=0;  READ-BACK: 45/45 link(s) verified live
  PRE : 54 v6 links on tagged nodes -- GUA 9, ULA 45
  POST: 54 v6 links on tagged nodes -- GUA 54, ULA 0
  NICs carrying more than one global v6: 0  (G19's sole-global predicate holds)
  The 9 skipped are br-ex on provider-public, already GUA before this step.
  v4 was NOT touched -- that is the ordering step 3 exists to enforce, because
  dc-node-v6-carve.py pivots on IPv4 existing.

GATES AFTER
  dc-node-v6-carve check vr1-dc0 --v6-family gua : PASS, 54 correct, 0 missing, 0 errors
  dc-plane-ipam check vr1-dc0                   : 29 pass / 2 fail
    The 2 are EXACTLY the two expected absences and neither is new:
      v6 lbaas-mgmt 2602:f3e2:f02:80::/64 ABSENT  (D-139 step 5 creates that plane)
      v6 oob        2602:f3e2:f02:f0::/64 ABSENT  (oob has no plane in MAAS at all)
    It was 7 fail before step 2; the 5 closed are the 5 planes carved.

REVERSIBLE: `replace vr1-dc0 --v6-family ula --commit` swaps the node statics back --
both /64s remain in MAAS until step 6 retires the ULA rows. Nothing has been deleted.

NOT DONE BY THESE STEPS: no v4 was removed (step 7, still gated on the unmeasured
`network-get` question); no ULA prefix was retired (step 6); lb-mgmt's plane does not
exist (step 5); vr1-dc1 is untouched throughout.