D-131 sub-3 decisive check -- rendered dhcpd.conf option 6 on the dc0 rack
Date: 2026-07-21 (evening session, queue pass)
Runner: OPERATOR (command classifier-walled for the agent; operator ran via
the session's `!` prefix and pasted output back -- gated copy-paste model).
Command + output VERBATIM:

jessea123@vcloud:~$ ! ssh -i ~/vr1-dc0-creds/vr1-dc0_svc_ed25519 -J voffice1 jessea123@172.31.0.2 'sudo grep -B2 -A12 "subnet 10.12.8.0" /var/snap/maas/common/maas/dhcpd.conf'
#
shared-network vlan-5005 {
    subnet 10.12.8.0 netmask 255.255.252.0 {
           ignore-client-uids true;
           next-server 10.12.8.2;
           option subnet-mask 255.255.252.0;
           option broadcast-address 10.12.11.255;
           option domain-name-servers 10.12.8.3;
           option domain-name "maas";
           option domain-search "maas";
           option ntp-servers 10.12.8.2;
           #
           # Bootloaders
           #
           if option user-class = "iPXE" or (exists ipxe.http and ( exists ipxe.bzimage or exists ipxe.efi )) {

ADJUDICATION (pre-committed interpretation, stated before the run):
option domain-name-servers = 10.12.8.3 ONLY. The 2026-07-21 morning
observation (option 6 = "10.12.8.2, 10.12.8.3") was a STALE READ taken
before the Temporal-driven DHCP re-render propagated the allow_dns=false
flip -- consistent with the shipped source (snap rev 41649, MAAS 3.7.2,
maasserver/dhcp.py: get_default_dns_servers() returns [] when
not subnet.allow_dns, BEFORE any rack-IP/use_rack_proxy logic runs;
make_subnet_config() then appends only subnet.dns_servers). The
maastemporalworker DHCP workflow carries no DNS composition of its own.
CONCLUSION: no defect, no LP report of its own; nodes do NOT rely on
SERVFAIL failover -- they receive the forwarder address alone. dhcpd.conf
mtime at check time: Jul 21 19:16 (re-rendered since the observation).
Config file itself remains root-only (0640); this capture is the citable
evidence for the sub-3 closure.