geneve-over-v6 root-caused (bracket bug) + LIVE-CONFIRMED; executable encap gate + phase-04 fix ...

Live diagnosis on vr1-dc0 (D-138): the v6 geneve tunnel failed with ofport -1 because ovn-chassis 24.03 sets ovn-encap-ip BRACKETED ([2602:...]), which OVS geneve rejects. Delivered unbracketed -> tunnel instantiates -> real VM->VM cross-compute ping over geneve-over-IPv6 = 8/8, 0% loss. So v6-only data-tenant is viable and v4-forced is off the table (OVS 3.3.0/OVN 24.03.2/kernel 5.15). A first same-day test wrongly concluded 'v6 broken' from an OVN localport source (never tunnels by design) -- retracted.

scripts/geneve-encap-assert.sh (+ harness 16/16, manifest pinned): asserts C1 encap family consistency (--expect-family v6) AND C2 every geneve tunnel ofport>=0 (the bracket-bug check a family-only gate misses). phase-04 Step 12.2 rewritten (family-only -> family+tunnel-health, ULA->GUA) + Step 6 caveat. CURRENT-STATE section 1 + root-cause record updated; GUA-carve proposal (DC1 gap + matrix + scan) added. repo-lint 0-fail; gauntlet ALL GREEN (103).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728

geneve-over-v6 root-cause: verify on compute-01 (amphora host) + tighten evidence ...

Advisor-flagged corrections to cd1f9cd's root-cause record (claims now measured, not inferred):
 - data-tenant confirmed the SAME dual-stack plane on both node types (lib-net.sh PLANE_CIDRS
   10.12.16.0/22=data-tenant, in SPACES6); divergence is address-family SELECTION, not a binding
   error (both chassis types bind data-tenant).
 - tunnel state re-read on vr1-dc0-compute-01 (ovn-chassis/1, the amphora's ACTUAL host): its
   v6 local encap has IPv4 remote_ip to the 3 control chassis -> cross-family, same pattern.
 - softened the bfd_status claim to AMBIGUOUS (OVN geneve may not populate BFD); decisive
   evidence is the encap-family split + 100% ICMPv6 loss. compute<->compute v6 path noted UNTESTED.
 - dropped the pre-allocated "D-143" (number assigned at ruling per grep-for-next-free).

Revert: git revert this commit (records only; no live cloud state changed).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728

geneve-over-v6 wrap-gate ROOT-CAUSED (FAIL): OVN encap family split control(v4)/compute(v6) ...

The dc0 "verify-live geneve-over-v6" checkpoint gate FAILS, root-caused this session
via the 1-test-LB smoke test. Measured: OVN geneve encap IPs are split across address
families -- containerized control-node chassis (octavia LXD) have IPv4-only data-plane
addresses (10.12.16.x, D-134 auto-picked) -> IPv4 encap; carved compute metal uses IPv6
(2602:f3e2:f02:30::x). Cross-family geneve tunnels never form (bfd_status empty) -> 100%
cross-node overlay loss -> amphora unreachable from o-hm0 -> LB stuck PENDING_CREATE.

Roosevelt-delta: v6 builds must give containerized OVN chassis a v6 data-tenant address
so encap is family-consistent with metal. Candidate D-143 (PROPOSED, operator ruling owed).
Fix NOT applied (substantial + rebuild-relevant). Full record:
docs/audit/geneve-over-v6-rootcause-20260808.md. CURRENT-STATE progress block updated
(clears repo-lint L10 for the audit file).

Revert: git revert this commit (records only; no live cloud state changed).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728