The MAAS half of step 6 was executed BY HAND for dc0 on 2026-08-02 -- four maas subnet
delete calls -- which is the 'no repo tool, mutations live only in a transcript' gap D-132
q1 already forced this repo to close once for the region carve. Without this the dc1
rebuild cannot reproduce the dc0 end state.

The guard is the point and it is not theoretical: on dc0 fd50:840e:74e2:220::/64 looked
like the other four but held two STICKY allocations -- ::5 user juju-vr1-dc0 (the deploy
client) and ::6 user MAAS (the region the delete is issued to), neither with a GUA
counterpart. So a holder or an interface link is a REFUSAL, and the refusal NAMES the
holder: '2 allocations' does not tell you it is the controller.

Both checks are required -- zero allocated IPs does not mean nothing references a subnet.
Deletes one at a time, never looped (hard rule 3), and READS BACK that each row is gone,
because a delete returning success is not evidence the row went away.

Harness update follows in the next commit.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf