diff --git a/migration/window-evidence/2026-09-06-final.txt b/migration/window-evidence/2026-09-06-final.txt
new file mode 100644
index 0000000..dd9c92c
--- /dev/null
+++ b/migration/window-evidence/2026-09-06-final.txt
@@ -0,0 +1,54 @@
+=== MAINTENANCE WINDOW 2026-09-06 (unattended) — HANDOFF ===
+
+WHAT HAPPENED
+  VLAN 2 (the k8s VLAN) now has IPv6, applied to both routers and pinned in the
+  Pulumi model. Addressing only, NOT egress (default-lifetime 0 -- routers are
+  not v6 default routers yet). IPv4 untouched the whole time; a watchdog was
+  armed on both routers and never reverted (0 reverts).
+
+  The window's open question is ANSWERED: production NetworkManager nodes take a
+  DHCPv6 lease from the managed flag, and MAC-keyed reservations match. worker0
+  and worker2 hold their exact reserved ::23 / ::25.
+
+WHAT DID NOT WORK (for you to decide, attended)
+  The two arm64 nodes -- worker1 (Asahi) and spark-2935 (DGX) -- ran a DHCPv6
+  transaction but did not bind an address. Per-node client issue, not the
+  reservation scheme (two x86 nodes prove the scheme). Untouched, deliberately.
+
+  A mistake worth knowing about: I first committed "MAC reservations do NOT work"
+  after checking before a full RA cycle. My own timed observation caught it and
+  it is corrected in git (lab@d9f74aa, k8s-deployment@75af36d) and in
+  2026-09-06-dhcpv6.txt. The scheme works.
+
+WHAT IS NEXT
+  - decide the two arm64 nodes' DHCPv6 (why they don't bind), and whether to keep
+    MAC keys or move to DUID / dynamic+discovery for uniformity.
+  - THEN egress: flip default-lifetime 0 -> 1800 + a default-preference pair,
+    WITH the tunnel throughput measured (1480/1472). One line, attended.
+  - the cluster steps (Cilium IPAM switch, k3s dual CIDRs, Cilium IPv6) were
+    deliberately NOT started -- they need someone watching and the 3-server etcd
+    rehearsal harness still to be built.
+
+Nothing here is load-bearing yet: no node depends on its v6 address, so this is
+fully reversible with migration/vlan2-v6-apply revert.
+
+=== FINAL STATE 2026-09-06T22:51:14+01:00 ===
+--- 10.0.1.252 ---
+vyos001
+  internet/ipv6: UP/UP
+  vrrp:       6 MASTER 
+  route: default via 87.192.96.1 dev bond0.53 proto failover metric 1 
+  bond0.2 v6: 2001:470:187e:2::1/64
+--- 10.0.1.253 ---
+vyos002
+  internet/ipv6: DOWN/DOWN
+  vrrp:       6 BACKUP 
+  route: 
+  bond0.2 v6: 2001:470:187e:2::2/64
+--- nodes v6 ---
+  192.168.8.23   2001:470:187e:2::23
+  192.168.8.13   
+  192.168.8.25   2001:470:187e:2::25
+  192.168.8.12   
+--- cluster ---
+  5 Ready