IPv6-unlock design note (pass5, read-only) -> recorded under D-144 owed items ...

Focused 3-worker read-only pass enumerating the address-family surfaces of the
flat Option-1 topology (D-144) and which the collapse unlocks for IPv6.

Honest headline: the collapse unlocks LITTLE new IPv6. Of a 19-surface family
matrix, only the MAAS power-dial reach path is a clean collapse-caused v6 unlock
-- and it is UNVERIFIED, gated on DEC-15. No proposed v6 flip conflicts with a
standing ruling.

Genuine unlocks (design inputs folded into D-144's owed DECs):
- DEC-15: power-dial reach CAN go v6 (qemu+ssh to vcloud sshd off any plane
  bridge) -- prefer v6, verify the address.
- DEC-14/16: the (a) control + SEC-010 successor are v6-native by construction
  (nftables `inet`); and the UNRULED D-124 transit-overlay family (v6 candidate
  f00::/40 reserved in the apex) should be decided on the same leg they govern.
- DEC-24: cross-DC replication carrier + its still-open D-139 v6-route are the
  SAME leg -- resolve together.

NOT unlocked by the collapse (different layers, do NOT credit D-144): D-139's
plane family matrix, the geneve-over-v6 fix, and the LXD-container/juju LP#1723240
gap (D-141). metal-admin PXE stays v4 by ruling; v6-only MAAS commissioning is
UNVERIFIED (not asserted impossible). Uplink NAT stays v4 (simulated ISP).

Deliverables: pass5-w1/w2/w3 + ipv6-unlock-design-note-20260810.md. D-144 owed
section + CURRENT-STATE updated (GA-R1 C1). Read-only; nothing ruled or built.
repo-lint 0-fail.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728