# changelog 2026-08-09 -- geneve-over-v6 root cause (bracket bug) LIVE-CONFIRMED + executable gate

Session body (GA-R2, one per session). Status lives ONLY in `docs/CURRENT-STATE.md`.
Branch `dc-dc-stage5-preconditions`. Live work ran FROM the dc0 rack `172.31.0.2`
(`vvr1-dc0`) via `voffice1` (D-138). dc0 is throwaway (10.13 rebuild follows); live
mutations were test scaffold, all torn down.

## Item 1 -- geneve-over-v6 ROOT-CAUSED (bracket bug) + LIVE-CONFIRMED working
Extends the 2026-08-08 family-split root cause. Diagnostic (bounded, after a fable advisory
caught an INVALID first test -- pings sourced from an OVN `localport`/ovnmeta namespace, which
OVN never tunnels by design; that wrong "v6 broken" conclusion was retracted). REAL cause of the
v6 tunnel failing: `ovn-chassis` 24.03 sets `external_ids:ovn-encap-ip` BRACKETED
(`"[2602:f3e2:f02:30::120]"`); OVS geneve rejects it (`bad geneve 'remote_ip'`), tunnel
`ofport -1`. Isolated test proved kernel 5.15/OVS 3.3 accept an UNbracketed v6 geneve remote_ip
(ofport valid) and reject the bracketed form. Live fix + confirm on dc0: `ovs-vsctl set
open_vswitch . external_ids:ovn-encap-ip=<unbracketed>` on both computes -> `ovn0-vr1-d-0`
ofport `-1`->`14` -> real VM->VM cross-compute ping over geneve-over-IPv6 = 8/8, 0% loss.
**geneve-over-v6 WORKS on this stack; v4-forced is OFF the table.**
- Files: `docs/audit/geneve-over-v6-rootcause-20260808.md` (RETRACTION + RESOLVED + LIVE-CONFIRMED
  sections, with the tested sequence), `docs/CURRENT-STATE.md` (section 1 UPDATE 2026-08-09).
- **Revert:** `git checkout <prev> -- docs/audit/geneve-over-v6-rootcause-20260808.md docs/CURRENT-STATE.md`.
  Live: the manual encap override is transient (charm re-asserts on next hook) and on throwaway dc0;
  no revert needed. Test scaffold (`geneve-proof-*`, `lb-smoke`) already deleted.

## Item 2 -- NEW GATE: scripts/geneve-encap-assert.sh (+ harness 16/16)
Makes the phase-04 "geneve-over-v6 verified" gate EXECUTABLE (was ruled-not-built). Asserts
C1 (all chassis Encap.ip single-family, optional `--expect-family v6` for the D-139 ruled family)
AND C2 (every geneve tunnel `ofport >= 0` -- catches the bracket bug that C1 alone misses).
Offline (fixture-testable) + `--live` (gathers via juju on the rack). Harness proves BOTH failing
directions (split -> C1 FAIL; ofport -1 -> C2 FAIL) + refuse-not-pass on empty + rc-2 usage.
- Files: `scripts/geneve-encap-assert.sh`, `tests/geneve-encap-assert/run-tests.sh` (16 pass).
- **Revert:** `git rm scripts/geneve-encap-assert.sh tests/geneve-encap-assert/run-tests.sh`.

## Item 3 -- Runbook phase-04 CORRECTED (Step 12.2 gate + Step 6 note)
Step 12.2 was FAMILY-ONLY (would PASS on a bracketed v6 encap with no working tunnel) and cited
the retired ULA (D-139 is full-GUA). Rewrote it to lead with `bash scripts/geneve-encap-assert.sh
--live`, add the C2 tunnel-health check + the bracket-bug fix, and correct ULA->GUA. Step 6's
"geneve family follows the interface once the plane is v6-only" note gained a measured CAVEAT
(necessary-not-sufficient: containerized-chassis v6 carve + unbracketed encap).
- File: `runbooks/dc-dc-phase4-juju-bundle-per-dc.md` (Step 12.2, Step 6).
- **Revert:** `git checkout <prev> -- runbooks/dc-dc-phase4-juju-bundle-per-dc.md`.

## Item 4 -- GUA carve completion proposal (context; superseded framing corrected)
`docs/audit/gua-carve-completion-proposal-20260809.md` (Rev 2, fable-reviewed) carries the DC1
GUA carve gap + missing-assignment scan + matrix. Its section-5.1 geneve decision is RESOLVED by
Item 1 (v6 viable). Proposal-doc update to reflect the resolution is the next task (operator flow
"A then B").
- **Revert:** `git rm docs/audit/gua-carve-completion-proposal-20260809.md` (if unwanted).

## Owed (rebuild / ruling)
- D-number for the containerized-chassis-v6 + bracket finding (amendment vs new -- operator's call).
- Confirm the fixed `ovn-chassis` charm revision (LP charm-ovn-chassis IPv6 bracket family) OR a
  persistent post-deploy unbracket override; wire into the deploy.
- neutron `overlay_ip_version=6` (tenant MTU ~1422) for the v6 overlay.