diff --git a/scripts/dc-plane-ipam.sh b/scripts/dc-plane-ipam.sh
index 305fb9a..1f28dd3 100755
--- a/scripts/dc-plane-ipam.sh
+++ b/scripts/dc-plane-ipam.sh
@@ -9,12 +9,17 @@
 # with no artifact, which is the class the 2026-07-27 audit found twice.
 #
 # ACTIONS
-#   check <site>   READ-ONLY. Compare live MAAS against the ruled expected state
-#                  and report per-plane. Exit 0 only if every assertion passes.
+#   check <site>      READ-ONLY. Compare live MAAS against the ruled expected
+#                     state. Exit 0 only if every assertion passes.
+#   carve-v6 <site>   Create the six v6 plane subnets, each on the SAME MAAS vlan
+#                     as its v4 twin (R2 dual-stack). DRY unless --commit.
+#   reserve <site>    Create the D-134 reserved bands + the FIP pool (R4).
+#                     DRY unless --commit.
 #
-# The MUTATING actions (v6 carve, band reservation) are NOT in this file yet --
-# hard rule 3, verify before mutate: the read-only gate ships and runs first, so
-# the mutation is planned against a MEASURED baseline rather than an assumed one.
+# The read-only gate was shipped and RUN FIRST, deliberately (hard rule 3), so the
+# mutations are planned against a MEASURED baseline rather than an assumed one.
+# Both mutating actions are DRY BY DEFAULT, IDEMPOTENT, and READ BACK every write
+# -- this repo has been bitten by a script whose `apply` always silently dry-ran.
 #
 # EXPECTED STATE IS DERIVED, NEVER HARDCODED (hard rule 3):
 #   v4 plane CIDRs  <- scripts/lib-net.sh via lib_net_select_dc  (site-keyed)
@@ -34,7 +39,11 @@
 
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO="$(cd "$HERE/.." && pwd)"
-ACTION="${1:-}"; SITE="${2:-}"; shift 2 2>/dev/null || true
+ACTION="${1:-}"; SITE="${2:-}"
+# Shift ONLY what actually exists: `shift 2` with a single argument fails, leaving
+# "$@" holding the action itself, which the option loop below then rejected as an
+# unknown option instead of printing usage. Found by the harness, not by review.
+if [ "$#" -gt 2 ]; then shift 2; else set --; fi
 COMMIT=0
 for a in "$@"; do case "$a" in --commit) COMMIT=1 ;; *) echo "FAIL: unknown option '$a'" >&2; exit 2 ;; esac; done
 MAAS_PROFILE="${MAAS_PROFILE:-admin}"
diff --git a/tests/dc-plane-ipam/run-tests.sh b/tests/dc-plane-ipam/run-tests.sh
index 2e0c95e..29d96bf 100755
--- a/tests/dc-plane-ipam/run-tests.sh
+++ b/tests/dc-plane-ipam/run-tests.sh
@@ -50,12 +50,12 @@
   python3 - "$v6" <<'PY'
 import json,sys
 v6=sys.argv[1]
-s=[{"cidr":c,"id":i,"vlan":{"fabric":"f-%d"%i}} for i,c in enumerate(
+s=[{"cidr":c,"id":i,"vlan":{"id":5000+i,"fabric":"f-%d"%i}} for i,c in enumerate(
    ["10.12.4.0/22","10.12.8.0/22","10.12.12.0/22","10.12.16.0/22","10.12.32.0/22","10.12.36.0/22"])]
 if v6=="full":
     for i,c in enumerate(["fd50:840e:74e2:220::/64","fd50:840e:74e2:221::/64","fd50:840e:74e2:230::/64",
                           "fd50:840e:74e2:240::/64","fd50:840e:74e2:250::/64","2602:f3e2:f02:10::/64"]):
-        s.append({"cidr":c,"id":100+i,"vlan":{"fabric":"f-%d"%i}})
+        s.append({"cidr":c,"id":100+i,"vlan":{"id":5000+i,"fabric":"f-%d"%i}})
 print(json.dumps(s))
 PY
   exit 0
@@ -140,6 +140,66 @@
   ok "T9 provider VIP /64 is reported for visibility, deliberately not asserted"
 else bad "T9 provider VIP /64 handling wrong" "$out"; fi
 
+# ============ carve-v6 / reserve (dry by default) ============================
+runact() { # runact <action> <want_rc> <regex> <label> <dir> [extra-args...]
+  local act="$1" want="$2" re="$3" label="$4" d="$5"; shift 5
+  local out rc
+  out="$(cd "$REPO" && PATH="$d/fakebin:$PATH" APEX_RECORD="$d/apex.json" \
+         bash scripts/dc-plane-ipam.sh "$act" vr1-dc0 "$@" 2>&1)"; rc=$?
+  if [ "$rc" = "$want" ] && grep -qE "$re" <<<"$out"; then ok "$label"
+  else bad "$label (rc=$rc want=$want)" "$(printf '%s' "$out" | tail -5)"; fi
+}
+
+# --- carve-v6 ---
+D="$TMP/carve"; mkdir -p "$D"; mkapex "$D/apex.json"; mkmaas "$D" none none
+runact carve-v6 0 'planned=6 applied=0' "T10 carve-v6 dry run plans 6 and writes NOTHING" "$D"
+runact carve-v6 0 'DRY RUN -- nothing was written' "T11 carve-v6 says plainly that it is a dry run" "$D"
+runact carve-v6 0 'provider VIP block, deliberately not a MAAS subnet' \
+  "T12 carve-v6 SKIPS the provider VIP /64 rather than creating it" "$D"
+D="$TMP/carve2"; mkdir -p "$D"; mkapex "$D/apex.json"; mkmaas "$D" full none
+runact carve-v6 0 'planned=0 applied=0 skipped=7' "T13 carve-v6 is IDEMPOTENT -- all present, nothing planned" "$D"
+
+# --- reserve ---
+D="$TMP/res"; mkdir -p "$D"; mkapex "$D/apex.json"; mkmaas "$D" none none
+runact reserve 0 'reserve 10.12.4.50-10.12.4.99' "T14 reserve plans the D-134 VIP band" "$D"
+runact reserve 0 'reserve 10.12.4.4-10.12.4.49'  "T15 reserve plans the D-134 utility band" "$D"
+runact reserve 0 'not in MAAS yet -- run carve-v6 first' \
+  "T16 v6 bands SKIP until carve-v6 has run (forced sequencing, not a silent pass)" "$D"
+D="$TMP/res2"; mkdir -p "$D"; mkapex "$D/apex.json"; mkmaas "$D" none full
+runact reserve 0 'already reserved' "T17 reserve is IDEMPOTENT -- existing reserved bands are skipped" "$D"
+D="$TMP/res3"; mkdir -p "$D"; mkapex "$D/apex.json"; mkmaas "$D" none wrongtype
+runact reserve 1 "REFUSING to rewrite an existing range" \
+  "T18 a same-bounds range of the WRONG type REFUSES rather than being overwritten" "$D"
+
+# --- T19: the v6 band mirror is TEXTUAL, not numeric ---
+# Caught pre-ship: printf '%%x' 50 yields 32, which would have silently created
+# ::32-::63 -- a plausible-looking band that is NOT the one ruled. The ruling
+# mirrors the DIGITS: v4 .50 -> ::50.
+D="$TMP/v6band"; mkdir -p "$D"; mkapex "$D/apex.json"; mkmaas "$D" full none
+out="$(cd "$REPO" && PATH="$D/fakebin:$PATH" APEX_RECORD="$D/apex.json" \
+       bash scripts/dc-plane-ipam.sh reserve vr1-dc0 2>&1)"
+if grep -q 'fd50:840e:74e2:220::50-fd50:840e:74e2:220::99' <<<"$out" \
+   && ! grep -q '::32-' <<<"$out"; then
+  ok "T19 v6 VIP band is ::50-::99 (textual octet mirror), NOT the hex ::32-::63"
+else bad "T19 v6 band mirror wrong" "$(grep -E '::' <<<"$out" | head -4)"; fi
+
+# --- T20: dc1 must REFUSE to invent the FIP pool ---
+# lib-net deliberately unsets FIP_POOL_* for dc1 ("UNSET so any use fails loud").
+# Mirroring dc0's shape would be an inferred value -- hard rule 2.
+mkapex1() { python3 - "$1" <<'PY2'
+import json,sys
+out=[{"prefix":"fd50:840e:74e2:320::/64","scope":{"name":"vr1-dc1"},
+      "role":{"slug":"metal-admin"},"description":"VR1 DC1 metal-admin (ULA /64 active)"}]
+json.dump({"ipam/prefixes":out},open(sys.argv[1],"w"))
+PY2
+}
+D="$TMP/dc1fip"; mkdir -p "$D"; mkapex1 "$D/apex.json"; mkmaas "$D" none none
+out="$(cd "$REPO" && PATH="$D/fakebin:$PATH" APEX_RECORD="$D/apex.json" \
+       bash scripts/dc-plane-ipam.sh reserve vr1-dc1 2>&1)"; rc=$?
+if [ "$rc" = 1 ] && grep -q 'Refusing to infer it from dc0' <<<"$out"; then
+  ok "T20 dc1 REFUSES to invent the unruled FIP pool (hard rule 2), exit 1"
+else bad "T20 dc1 FIP refusal wrong (rc=$rc)" "$(printf '%s' "$out" | tail -4)"; fi
+
 echo
 echo "RESULT: PASS=$PASS FAIL=$FAIL"
 [ "$FAIL" -eq 0 ] || exit 1