diff --git a/scripts/dc-plane-ipam.sh b/scripts/dc-plane-ipam.sh
index 1f28dd3..ab276c8 100755
--- a/scripts/dc-plane-ipam.sh
+++ b/scripts/dc-plane-ipam.sh
@@ -363,10 +363,33 @@
     base="${pre%%::/64}"
     # The ruled mirror is TEXTUAL, not numeric: keystone at v4 octet .50 is `::50`,
     # i.e. the same DIGITS in the v6 host part. Converting 50 to hex would give
-    # `::32` -- a different, unruled band that would still look plausible. The band
-    # bounds 4/49/50/99 are all digit-only and therefore valid hex literals as-is.
-    mk "$pre" "${base}::${BAND_UTIL_LO}" "${base}::${BAND_UTIL_HI}" "D-134 v6 utility band ($role)"
-    mk "$pre" "${base}::${BAND_VIP_LO}"  "${base}::${BAND_VIP_HI}"  "D-134 v6 VIP band ($role)"
+    # `::32` -- a different, unruled band that would still look plausible.
+    #
+    # MEASURED 2026-07-27: an explicit reserved range CANNOT be created here, and
+    # does not need to be. MAAS auto-reserves `::1`-`::ffff:ffff` on EVERY IPv6
+    # subnet (purpose "reserved"), plus `::` itself under RFC 4291 s2.6.1. The ruled
+    # bands sit entirely inside that, so `ipranges create` returns
+    #   "Requested reserved range conflicts with an existing range."
+    # and the addresses are ALREADY protected -- far more broadly than the band.
+    # So this VERIFIES the property instead of attempting a write. R4's "v6 bands
+    # follow as a second pass" is satisfied by MAAS's own default, not by our range.
+    sid="$(subnet_id_of "$pre")"
+    if [ -z "$sid" ]; then err "$role $pre has no subnet id"; continue; fi
+    covered="$(maas "$MAAS_PROFILE" subnet reserved-ip-ranges "$sid" 2>/dev/null | python3 -c "
+import json,sys,ipaddress
+try: d=json.load(sys.stdin)
+except Exception: print('ERR'); sys.exit()
+lo=ipaddress.ip_address(sys.argv[1]); hi=ipaddress.ip_address(sys.argv[2])
+for r in d:
+    if ipaddress.ip_address(r['start'])<=lo and ipaddress.ip_address(r['end'])>=hi:
+        print('yes'); break
+else: print('no')
+" "${base}::${BAND_UTIL_LO}" "${base}::${BAND_VIP_HI}")"
+    case "$covered" in
+      yes) skip "$role $pre bands ${BAND_UTIL_LO}-${BAND_VIP_HI} already protected by MAAS's default IPv6 reservation (::1-::ffff:ffff) -- no explicit range needed or possible" ;;
+      no)  err "$role $pre ruled bands are NOT inside MAAS's reserved space -- investigate before deploy" ;;
+      *)   err "$role $pre could not read reserved-ip-ranges (could not look is not nothing there)" ;;
+    esac
   done <<< "$V6_MAP"
 
   echo