Applied live after the repo build: overlay re-staged hash-verified, the seven set
to false and each read back, every erroring unit resolved. MEASURED: units in
error went 17 -> 4 and all seven prefer-ipv6 apps CLEARED.

THE REMAINING BLOCKER IS ONE CLASS -- snap installs from an airgapped node, and
it is the already-recorded D-135 items 2-3 gap hitting for real:
  mysql-innodb-cluster  snap install mysql-shell  (api.snapcraft.io unreachable)
  ovn-central           snap install prometheus-ovn-exporter
  vault                 snap install core

This document already records the shape: three artifact classes, only ONE local
-- apt to 10.12.8.4 (local), MAAS boot images to images.maas.io (not local),
juju agent stream and snaps to streams.canonical.com / api.snapcraft.io (not
local). It will hit dc1 EQUALLY, since apt-cacher-ng proxies apt and not snaps,
so unlike the UCA finding this is NOT a full-mirror-only asymmetry.

LOGGED NOT FIXED: a D-107 (airgap) / D-135 (items 2-3) decision, not an
engineering choice.

D2 (the upstream UCA) is still unfixed and still owed -- it stopped being the
visible error only because those units now block earlier on snaps.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf