diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index a64b5d0..2c39b7e 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -3196,9 +3196,30 @@
   rc=0. **POST-STATE MEASURED:** six GUA `/64`s remain, one ULA held; machines unchanged at
   **9 Ready + 1 Deployed**, total 10.
   **STILL OPEN:** the held subnet -- migrate the controller/region v6 to GUA then delete, or
-  delete and accept losing those records, or leave it. **AND: NO REPO TOOL EXISTS for the
-  MAAS half** -- these were hand-issued `maas subnet delete` calls, so the dc1 rebuild
-  cannot reproduce them. Owed, not built.
+  delete and accept losing those records, or leave it.
+  **>>> THE MAAS HALF NOW HAS A TOOL, AND ITS FIRST LIVE RUN CAUGHT A DEFECT IN MY OWN
+  BY-HAND CHECK. <<<** `scripts/dc-plane-ipam.sh retire-v6-ula <site> [--commit]` (harness
+  **25 -> 32**, R1-R7). It refuses on any ULA subnet holding an allocation OR an interface
+  link, NAMES the holder, deletes one at a time, and READS BACK that the row is gone.
+  **THE DEFECT: my by-hand link check reported ZERO links for all five subnets and COULD
+  NOT HAVE FOUND ANY** -- the subnet id was interpolated as `sid=\"'$id'\"`, so the
+  comparison ran against `"'2'"` and never matched. A checker that could not fail, written
+  in the same session that landed exactly that rule into `script-authoring.md`. The tool
+  found `subtle-grouse:enp1s0` on subnet 2 the moment it ran. **CONSEQUENCE: the earlier
+  claim that the four deletes were "proven safe twice" was HALF FALSE** -- the allocation
+  count was sound, the link half was inert, so link status was UNKNOWN at deletion time.
+  **THE OUTCOME WAS SAFE ANYWAY, MEASURED NOT ASSUMED:** all nine role nodes read **v4=6,
+  v6=6**, so every v6 link they hold is GUA and the four deleted ULA subnets held none
+  (`enp2s0` unlinked on all nine is EXPECTED -- provider-public carries no L3 link, the
+  static lands on `br-ex`). `subtle-grouse` (the controller, `Deployed`) reads **v4=2,
+  v6=1**, its one v6 link being the ULA `::5` -- INDEPENDENTLY confirming the hold was
+  right. Right outcome, unsound verification; recorded separately on purpose.
+  **THE HELD SUBNET IS STILL HELD.** `retire-v6-ula vr1-dc0` REFUSES on it, naming all
+  three holders (`::5` juju-vr1-dc0, `::6` MAAS, link `subtle-grouse:enp1s0`). Deleting it
+  requires re-homing the juju controller's and region's v6 to GUA first -- **re-addressing
+  the DEPLOY CLIENT immediately before the deploy**, and this project has already lost three
+  bootstrap attempts to under-carved controller networking. Not covered by the four-empty-
+  subnet approval, and **NOT deploy-blocking**: an extra ULA subnet in MAAS harms nothing.
 - Project: Omega Cloud, VR1 DC-DC rehearsal -- a two-DC + Office1-headend
   virtual rehearsal on KVM (vcloud host), rehearsing the future bare-metal
   Roosevelt deployment (D-100, `docs/design-decisions.md:1946`).
diff --git a/docs/changelog-20260802-queued-items.md b/docs/changelog-20260802-queued-items.md
index 7d0653f..25d103a 100644
--- a/docs/changelog-20260802-queued-items.md
+++ b/docs/changelog-20260802-queued-items.md
@@ -609,3 +609,62 @@
 - **Revert:** apex -- flip the 35 statuses back (the 26 creates are additive and wanted).
   MAAS -- the four subnets can be recreated (`dc-region-topology.sh` carries the shape),
   but their identities are gone; they held nothing, so nothing else is lost.
+
+## Item 12 -- the MAAS half gets a tool, and it immediately caught a defect in MY OWN check
+
+**OPERATOR DIRECTION: "Proceed with 1 and 2"** -- 1 = the held ULA subnet, 2 = build the
+repo tool for the MAAS half. Item 2 is delivered here. **Item 1 is NOT executed** and is
+explained below.
+
+**`scripts/dc-plane-ipam.sh` gains `retire-v6-ula <site> [--commit]`.** It belongs there
+rather than in a new script: `dc-region-topology.sh`'s own header assigns v6 plane subnets
+to `dc-plane-ipam.sh`, and a one-off script would have split that ownership. Harness
+**25 -> 32 cases** (R1-R7), delta checked.
+
+The mode: enumerate this site's subnets inside the retired ULA `/48`; for each, REFUSE if
+it holds an allocation OR a machine-interface link, NAMING the holder; otherwise delete --
+one at a time, never looped -- and READ BACK that the row is gone, because a delete
+returning success is not evidence the row went away (R6 proves that assertion has teeth).
+
+**>>> THE TOOL'S FIRST LIVE RUN CAUGHT A DEFECT IN THE BY-HAND CHECK I USED AN HOUR
+EARLIER, AND IT IS THE MORE IMPORTANT FINDING HERE. <<<** Its dry run reported:
+
+```
+interface links: subtle-grouse:enp1s0
+```
+
+My by-hand link check (item 11) reported **ZERO links for all five subnets**. The cause is
+a quoting bug in my own one-liner: the subnet id was interpolated as `sid=\"'$id'\"`, so
+the comparison ran `str(id) == "'2'"` and **could never match**. It was a checker that
+could not fail -- written by me, in the same session in which I landed exactly that rule
+into `script-authoring.md`. The tool found a real link the moment it ran.
+
+**CONSEQUENCE, STATED PLAINLY: item 11's claim that the four deletes were "proven safe
+twice" was HALF FALSE.** The allocation count was sound; the link half was inert, so link
+status was in fact UNKNOWN at the time of those four deletions.
+
+**THE OUTCOME WAS NEVERTHELESS SAFE, and that is measured, not assumed.** After the
+deletes, all nine role nodes hold **v4=6, v6=6** -- six planes in each family -- so every
+v6 link they carry is GUA and the four deleted ULA subnets genuinely held none.
+`enp2s0` reads unlinked on all nine, which is EXPECTED (provider-public carries no L3 link;
+the static lands on `br-ex`, D-133/D-100), not damage. **Right outcome, unsound
+verification** -- the two are recorded separately on purpose.
+
+`subtle-grouse` (the juju controller, `Deployed`) reads **v4=2 v6=1**: two planes per the
+role-dependent carve, and its single v6 link is the ULA `::5`. That INDEPENDENTLY confirms
+holding subnet 2 was correct.
+
+**ITEM 1 IS NOT EXECUTED, and the tool is why.** Run against the live region,
+`retire-v6-ula vr1-dc0` REFUSES on `fd50:840e:74e2:220::/64` and names all three holders:
+`::5` (`juju-vr1-dc0`), `::6` (`MAAS`), and the interface link `subtle-grouse:enp1s0`.
+Deleting it still requires re-homing the juju controller's and the MAAS region's v6 onto
+GUA first -- which re-addresses the DEPLOY CLIENT immediately before the deploy, and this
+project has already lost three bootstrap attempts to under-carved controller networking.
+That is a mutation with its own risk profile and is NOT covered by "I approve the MAAS
+deletes to clean up the data and config", which was given about four empty subnets.
+**It is also NOT deploy-blocking:** an extra ULA subnet in MAAS harms nothing.
+
+- Changed: `scripts/dc-plane-ipam.sh` (new mode), `tests/dc-plane-ipam/run-tests.sh`
+  (R1-R7).
+- **Revert:** drop the `retire-v6-ula` block, its usage lines and the `ACTION` case entry;
+  drop R1-R7 and the two retire helpers.
diff --git a/tests/dc-plane-ipam/run-tests.sh b/tests/dc-plane-ipam/run-tests.sh
index ffea561..54d7487 100755
--- a/tests/dc-plane-ipam/run-tests.sh
+++ b/tests/dc-plane-ipam/run-tests.sh
@@ -218,5 +218,95 @@
 else bad "T20 dc1 FIP pool wrong" "$(grep -i fip <<<"$out" | head -3)"; fi
 
 echo
+
+# ============================================================================
+# retire-v6-ula (D-139 step 6, MAAS half)
+# ============================================================================
+# R3 is the case that matters most: a subnet with NO allocation but WITH an
+# interface link. The by-hand check used on dc0 2026-08-02 had a quoting bug
+# (the subnet id was interpolated as "'2'" and never matched), so it returned
+# ZERO links for every subnet and could not have failed. The tool found a real
+# link the moment it ran. This case exists so that cannot recur silently.
+mkmaas_retire() { # <dir> <holders:none|sticky> <links:none|one> [delete_sticks:0|1] [machines_rc]
+  local d="$1" holders="$2" links="$3" sticks="${4:-0}" mrc="${5:-0}"
+  mkdir -p "$d/fakebin"
+  cat > "$d/fakebin/maas" <<FB
+#!/usr/bin/env bash
+STATE="$d/deleted"
+if [ "\$2" = "subnets" ]; then
+  python3 - "\$STATE" <<'PY'
+import json,os,sys
+gone=set()
+if os.path.exists(sys.argv[1]): gone={l.strip() for l in open(sys.argv[1])}
+s=[{"cidr":"10.12.4.0/22","id":1,"vlan":{"id":5001}}]
+for i,c in enumerate(["fd50:840e:74e2:221::/64","fd50:840e:74e2:230::/64"]):
+    if str(200+i) not in gone: s.append({"cidr":c,"id":200+i,"vlan":{"id":5001}})
+print(json.dumps(s))
+PY
+  exit 0
+fi
+if [ "\$2" = "ipranges" ]; then echo '[]'; exit 0; fi
+if [ "\$2" = "machines" ]; then
+  [ "$mrc" -ne 0 ] && exit $mrc
+  if [ "$links" = "one" ]; then
+    echo '[{"hostname":"node-a","interface_set":[{"name":"enp1s0","links":[{"subnet":{"id":200}}]}]}]'
+  else
+    echo '[{"hostname":"node-a","interface_set":[{"name":"enp1s0","links":[]}]}]'
+  fi
+  exit 0
+fi
+if [ "\$2" = "subnet" ] && [ "\$3" = "ip-addresses" ]; then
+  if [ "$holders" = "sticky" ] && [ "\$4" = "200" ]; then
+    echo '[{"ip":"fd50:840e:74e2:221::5","alloc_type":1,"user":"juju-vr1-dc0"}]'
+  else
+    echo '[]'
+  fi
+  exit 0
+fi
+if [ "\$2" = "subnet" ] && [ "\$3" = "delete" ]; then
+  [ "$sticks" -eq 1 ] || echo "\$4" >> "\$STATE"
+  exit 0
+fi
+if [ "\$2" = "subnet" ] && [ "\$3" = "read" ]; then
+  if [ -f "\$STATE" ] && grep -qx "\$4" "\$STATE"; then exit 1; fi
+  echo '{"id":'"\$4"',"cidr":"fd50:840e:74e2:221::/64"}'; exit 0
+fi
+exit 1
+FB
+  chmod +x "$d/fakebin/maas"
+  rm -f "$d/deleted"
+}
+
+run_retire() { # run_retire <want_rc> <regex> <label> <dir> [--commit]
+  local want="$1" re="$2" label="$3" d="$4" extra="${5:-}"
+  local out rc
+  out="$(cd "$REPO" && PATH="$d/fakebin:$PATH" \
+         bash scripts/dc-plane-ipam.sh retire-v6-ula vr1-dc0 $extra 2>&1)"; rc=$?
+  if [ "$rc" = "$want" ] && grep -qE "$re" <<<"$out"; then ok "$label"
+  else bad "$label (rc=$rc want=$want)" "$(printf '%s' "$out" | tail -5)"; fi
+}
+
+D2="$(mktemp -d)"
+mkmaas_retire "$D2" none none
+run_retire 0 'EMPTY -- would delete' "R1 empty ULA subnets are planned for deletion (dry)" "$D2"
+
+mkmaas_retire "$D2" sticky none
+run_retire 1 'is NOT empty -- REFUSING' "R2 a sticky allocation REFUSES the delete" "$D2"
+mkmaas_retire "$D2" sticky none
+run_retire 1 'user=juju-vr1-dc0' "R3 the refusal NAMES the holder, not just a count" "$D2"
+
+mkmaas_retire "$D2" none one
+run_retire 1 'interface links: node-a:enp1s0' "R4 an interface link with NO allocation still REFUSES (the dc0 blind spot)" "$D2"
+
+mkmaas_retire "$D2" none none
+run_retire 0 'deleted and verified gone' "R5 --commit deletes and reads back that the row is gone" "$D2" --commit
+
+mkmaas_retire "$D2" none none 1
+run_retire 1 'STILL READABLE' "R6 a delete that returns success but leaves the row REPORTS it (read-back has teeth)" "$D2" --commit
+
+mkmaas_retire "$D2" none none 0 2
+run_retire 2 'REFUSE' "R7 'machines read' failing REFUSES -- could not look is never nothing there" "$D2"
+rm -rf "$D2"
+
 echo "RESULT: PASS=$PASS FAIL=$FAIL"
 [ "$FAIL" -eq 0 ] || exit 1