diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index 6cf0021..0fc662c 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -1371,6 +1371,33 @@
   possible: whether juju REQUESTS a v6 address for a container when an allocatable v6 range
   exists.** Adding a range is necessary; it is not proven sufficient. That must be measured
   before any range is created, not after.
+  **^ OPERATOR CLARIFIED, AND IT WIDENS THE FINDING: "The dual stack was only a safety net
+  instead of jumping straight into a ipv6 only deployment but it appears that more items were
+  not configured with IPv6 like they should have been."** So IPv6 is the TARGET and v4 the
+  fallback -- matching D-101's own rationale ("v6 wherever possible, v4 only where forced")
+  rather than a co-equal dual-stack. A SYSTEMATIC v6 SWEEP was therefore run across dc0
+  instead of fixing the container layer alone. **RESULT: the v6 half is carved as ADDRESSES
+  but was never made OPERATIONAL.**
+  **BUILT on v6:** node interface statics (54 links); the six v6 plane subnets in MAAS; juju's
+  per-plane host bridges all carrying global v6 (machine 0: `br-ex 2602:f3e2:f02:10::100`,
+  `br-enp1s0 :220::100`, plus `:221 :230 :240 :250`); spaces in both families; the dual-family
+  VIPs (13 apps x 3 v6 legs); Octavia PKI v6 IP SANs.
+  **ABSENT on v6, all MEASURED 2026-07-31:** (i) **ALL SIX v6 plane subnets carry ZERO ip
+  ranges**, against every v4 plane holding its D-134 `reserved` bands and metal-admin v4 also
+  holding `dynamic .201-.254` -- uniform, not a metal-admin quirk, so nothing can be allocated
+  to anything on v6. (ii) **THE RACK HAS NO GLOBAL v6 AT ALL** (`ip -6 -o addr show scope
+  global` returns EMPTY), so every rack-hosted service -- the D-135 mirror, the D-131 node-DNS
+  forwarder, the MAAS rack agent -- is v4-only by construction; this is F2 from 2026-07-30,
+  now measured as the WHOLE RACK rather than one plane. (iii) **THE MIRROR DOES NOT ANSWER
+  OVER v6** (`http://[fd50:840e:74e2:220::4]/...` -> 000), following directly from (ii).
+  (iv) **NODES HAVE NO v6 DEFAULT ROUTE** (`ip -6 route show default` EMPTY) -- no RA, no
+  gateway.
+  **CONSEQUENCE FOR THE BLOCKER, stated plainly: completing IPv6 to the charm layer is a
+  PROJECT, not a fix.** An allocatable range alone would give containers v6 addresses with no
+  v6 default route and no v6-reachable services to talk to, so `prefer-ipv6: true` -- which
+  makes a charm advertise v6 for EVERY relation -- would still not produce a working cloud.
+  **THE SAFETY NET IS DOING EXACTLY WHAT IT WAS PUT THERE FOR.** The decision this forces is
+  put to the operator separately, with a recommendation.
   **memcached SCALED to 3 in `overlays/dc-ha-scaleup.yaml`** (operator-directed 2026-07-31);
   its exclusion comment is RE-POINTED rather than left stale. **`ceph-rbd-mirror` is PINNED,
   NOT SETTLED** -- gap register **item 22** carries four options and the recommendation