gai-conf-rfc6724-verification-20260801.txt
==========================================
READ-ONLY verification of the one premise D-139 ruling B was declared on:
that RFC 6724's default precedence table governs address selection on the
deployed node image. Host: vcloud. No cloud mutation. Nothing installed.

RESULT: THE PREMISE IS REFUTED FOR THIS DEPLOYMENT. Details below.

STEP 1 -- which package ships /etc/gai.conf, and does the image override it?
  $ dpkg -S /etc/gai.conf   ->  libc-bin: /etc/gai.conf
  jammy libc-bin version: 2.35-0ubuntu3
  pool/main/g/glibc/libc-bin_2.35-0ubuntu3_amd64.deb, /etc/gai.conf = 2584 bytes
  ACTIVE (uncommented, non-blank) lines in the SHIPPED jammy file: 0
  => the image applies NO override; glibc's COMPILED-IN table governs.
  (vcloud/noble also measured: 0 active lines.)

STEP 2 -- what IS glibc 2.35's compiled-in table?
Source: sourceware.org glibc.git, tag glibc-2.35, sysdeps/posix/getaddrinfo.c
(fetched and read in full, 65016 bytes -- not cited from memory).

  static const struct prefixentry default_precedence[] =
    {
      /* See RFC 3484 for the details.  */          <-- glibc's OWN comment
      ::1/128           -> 50
      2002::/16         -> 30
      ::/96             -> 20
      ::ffff:0:0/96     -> 10      <-- IPv4-mapped
      ::/0              -> 40      <-- catch-all
    };

  THERE IS NO fc00::/7 ENTRY IN THE PRECEDENCE TABLE.
  ULA therefore falls through to ::/0 = 40, exactly as GUA does.

  The fc00::/7 entry that DOES exist is in default_labels[] (label 6), beside
  fec0::/10 (5) and 2001::/32 (7), under glibc's comment "The next two entries
  differ from RFC 3484." Labels drive SOURCE-selection rules 5/6 (prefer a
  matching label), NOT destination precedence. So ULA<->ULA source pairing is
  correct; that is a different mechanism from the one the ruling cited.

STEP 3 -- consequence, stated plainly.

  ON glibc 2.35 (jammy, the node image):
      ULA  = 40   GUA = 40   IPv4-mapped = 10
  => ULA and GUA are EQUAL, and BOTH outrank IPv4.

  D-139 ruling B was declared on: "RFC 6724 ranks IPv4-mapped at 35 and ULA at
  3 while GUA falls under ::/0 at 40, so on a dual-stack plane a ULA leg LOSES
  address selection to IPv4 and is decorative, whereas GUA WINS."
  That is the RFC 6724 table. RFC 6724 obsoletes RFC 3484 and does introduce
  those values -- but GLIBC 2.35 DOES NOT IMPLEMENT IT. The claim is correct
  about the RFC and WRONG about the software this cloud runs.

  => The stated DECIDING REASON for full GUA does not hold here.

STEP 4 -- what survives, and what does not.

  REFUTED  (1) the RFC 6724 precedence argument.
  STANDS   (2) conformance with Willamette (a REAL site) and VR0 DC0, both of
               which carve GUA on every plane.
  STANDS   (3) minimize delta to Roosevelt -- the governing project constraint.
               Roosevelt holds 2602:f3e2:103::/48, GUA, no ULA, and no plane
               carve yet, so whatever VR1 proves it inherits.
  STANDS   (4) isolation is unaffected either way -- containment is at the
               FORWARDING layer (SEC-010, D-125, D-107), not addressing scope.

  Reasons 2 and 3 are the governing-constraint arguments and are independent of
  the refuted one. The ruling MAY well stand on them. THAT IS THE OPERATOR'S
  CALL, NOT MINE (GA-R5): the operator answered a question whose stated
  deciding reason has since been refuted, so the ruling is FLAGGED FOR
  RECONSIDERATION rather than silently amended or silently kept.

  NOT ARGUED EITHER WAY HERE, because it is now the honest state: with the
  precedence argument gone, ULA and GUA are equivalent for selection behaviour
  on jammy, so the choice rests purely on conformance and Roosevelt delta.