d139-carve-dryrun-20260801.txt =============================== READ-ONLY dry run of netbox/d139-gua-carve.py against the VR1 WORKING apex (office1-netbox http://10.10.1.10:8000, DOCFIX-195 -- NOT baldurkeep). Host: vcloud. Date: 2026-08-01T00:08:57Z. NO write of any kind was made: the apex prefix count was 139 before and 139 after, and none of the 22 CREATE rows exists. Governing decision: D-139 ruling B. Retirement is REPORTED, never executed. TOTALS ACROSS BOTH DCs: CREATE 22 | EXISTS 6 (untouched) | RETIRE-REPORT 18 ULA rows, holding 52 dependent ip-addresses that a later delete would orphan. STANDING NOTE: commit 633da1c (same day, concurrent session) REFUTED D-139 ruling B's stated deciding reason (glibc 2.35 does not implement RFC 6724's precedence table) and FLAGGED the ruling for operator reconsideration. D-139's text is UNCHANGED, so this dry run reflects the ruling as it stands -- but the --commit push is gated on that reconsideration, not merely on operator approval. MEASURED STRUCTURAL ASYMMETRY, reported not acted on (outside D-139 table): VR0 DC0 and Willamette -- the two sites D-139 cites as the org standard -- each carry a role=Cloud /56 (e02::/56, 102::/56), a :e0::/60 VPN and a :f0::/60+/64 OOB. VR1 DC0/DC1 carry NONE of these; they hold only the /48 container. D-139 does not rule them, so this tool does not create them. ======================================================================= == d139-gua-carve vr1-dc0 (DRY RUN) == apex: http://10.10.1.10:8000 site: VR1 DC0 (id=8) apex prefixes scoped to vr1-dc0: 21 (read this run) CREATE 11 | EXISTS 3 | RETIRE-REPORT 9 CREATE: 2602:f3e2:f02:20::/60 role=metal-admin VR1 DC0 metal-admin (GUA /60; D-139) 2602:f3e2:f02:20::/64 role=metal-admin VR1 DC0 metal-admin (GUA /64; D-139) 2602:f3e2:f02:21::/64 role=metal-internal VR1 DC0 metal-internal (GUA /64; D-139) 2602:f3e2:f02:30::/60 role=data-tenant VR1 DC0 data-tenant (GUA /60; D-139) 2602:f3e2:f02:30::/64 role=data-tenant VR1 DC0 data-tenant (GUA /64; D-139) 2602:f3e2:f02:40::/60 role=storage VR1 DC0 storage (GUA /60; D-139) 2602:f3e2:f02:40::/64 role=storage VR1 DC0 storage (GUA /64; D-139) 2602:f3e2:f02:50::/60 role=replication VR1 DC0 replication (GUA /60; D-139) 2602:f3e2:f02:50::/64 role=replication VR1 DC0 replication (GUA /64; D-139) 2602:f3e2:f02:80::/60 role=lbaas-mgmt VR1 DC0 lb-mgmt (GUA /60; D-139) 2602:f3e2:f02:80::/64 role=lbaas-mgmt VR1 DC0 lb-mgmt (GUA /64; D-139) EXISTS (idempotent -- left untouched): 2602:f3e2:f02:10::/60 role=provider-public provider-public 2602:f3e2:f02:10::/64 role=provider-public provider-public 2602:f3e2:f02:11::/64 role=provider-public provider-public VIP RETIRE -- REPORTED ONLY, this tool never deletes: fd50:840e:74e2:220::/60 role=metal-admin VR1 DC0 metal-admin (ULA metal /60 (admin+internal); D-101/D-111) fd50:840e:74e2:220::/64 role=metal-admin VR1 DC0 metal-admin (ULA /64 active; D-101/D-111) fd50:840e:74e2:221::/64 role=metal-internal VR1 DC0 metal-internal (ULA /64 active (in metal /60); D-101/D-111) fd50:840e:74e2:230::/60 role=data-tenant VR1 DC0 data-tenant (ULA /60; D-101/D-111) fd50:840e:74e2:230::/64 role=data-tenant VR1 DC0 data-tenant (ULA /64 active; D-101/D-111) fd50:840e:74e2:240::/60 role=storage VR1 DC0 storage (ULA /60; D-101/D-111) fd50:840e:74e2:240::/64 role=storage VR1 DC0 storage (ULA /64 active; D-101/D-111) fd50:840e:74e2:250::/60 role=replication VR1 DC0 replication (ULA /60; D-101/D-111) fd50:840e:74e2:250::/64 role=replication VR1 DC0 replication (ULA /64 active; D-101/D-111) dependent objects inside those prefixes: 26 ip-address(es), 0 ip-range(s) DRY RUN -- nothing was written. Re-run with --commit to apply. == d139-gua-carve vr1-dc1 (DRY RUN) == apex: http://10.10.1.10:8000 site: VR1 DC1 (id=9) apex prefixes scoped to vr1-dc1: 21 (read this run) CREATE 11 | EXISTS 3 | RETIRE-REPORT 9 CREATE: 2602:f3e2:f03:20::/60 role=metal-admin VR1 DC1 metal-admin (GUA /60; D-139) 2602:f3e2:f03:20::/64 role=metal-admin VR1 DC1 metal-admin (GUA /64; D-139) 2602:f3e2:f03:21::/64 role=metal-internal VR1 DC1 metal-internal (GUA /64; D-139) 2602:f3e2:f03:30::/60 role=data-tenant VR1 DC1 data-tenant (GUA /60; D-139) 2602:f3e2:f03:30::/64 role=data-tenant VR1 DC1 data-tenant (GUA /64; D-139) 2602:f3e2:f03:40::/60 role=storage VR1 DC1 storage (GUA /60; D-139) 2602:f3e2:f03:40::/64 role=storage VR1 DC1 storage (GUA /64; D-139) 2602:f3e2:f03:50::/60 role=replication VR1 DC1 replication (GUA /60; D-139) 2602:f3e2:f03:50::/64 role=replication VR1 DC1 replication (GUA /64; D-139) 2602:f3e2:f03:80::/60 role=lbaas-mgmt VR1 DC1 lb-mgmt (GUA /60; D-139) 2602:f3e2:f03:80::/64 role=lbaas-mgmt VR1 DC1 lb-mgmt (GUA /64; D-139) EXISTS (idempotent -- left untouched): 2602:f3e2:f03:10::/60 role=provider-public provider-public 2602:f3e2:f03:10::/64 role=provider-public provider-public 2602:f3e2:f03:11::/64 role=provider-public provider-public VIP RETIRE -- REPORTED ONLY, this tool never deletes: fd50:840e:74e2:320::/60 role=metal-admin VR1 DC1 metal-admin (ULA metal /60 (admin+internal); D-101/D-111) fd50:840e:74e2:320::/64 role=metal-admin VR1 DC1 metal-admin (ULA /64 active; D-101/D-111) fd50:840e:74e2:321::/64 role=metal-internal VR1 DC1 metal-internal (ULA /64 active (in metal /60); D-101/D-111) fd50:840e:74e2:330::/60 role=data-tenant VR1 DC1 data-tenant (ULA /60; D-101/D-111) fd50:840e:74e2:330::/64 role=data-tenant VR1 DC1 data-tenant (ULA /64 active; D-101/D-111) fd50:840e:74e2:340::/60 role=storage VR1 DC1 storage (ULA /60; D-101/D-111) fd50:840e:74e2:340::/64 role=storage VR1 DC1 storage (ULA /64 active; D-101/D-111) fd50:840e:74e2:350::/60 role=replication VR1 DC1 replication (ULA /60; D-101/D-111) fd50:840e:74e2:350::/64 role=replication VR1 DC1 replication (ULA /64 active; D-101/D-111) dependent objects inside those prefixes: 26 ip-address(es), 0 ip-range(s) DRY RUN -- nothing was written. Re-run with --commit to apply.