window 2026-09-06: final state + handoff note

VLAN 2 IPv6 live on both routers and in the model. IPv4 untouched (6 MASTER /
6 BACKUP, default route on bond0.53, watchdog 0 reverts, 5/5 Ready). worker0 and
worker2 hold their reserved ::23/::25; the two arm64 nodes are the open item.
Watchdog disarmed. Full handoff at the top of window-evidence/2026-09-06-final.txt.

vyos002 showing internet DOWN is the correct resting state of the gated backup,
not a fault.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DMVzWZgiKW2wquf5z8S1yH

migration/window-evidence/2026-09-06-final.txt

@@ -0,0 +1,54 @@
+=== MAINTENANCE WINDOW 2026-09-06 (unattended) — HANDOFF ===
+
+WHAT HAPPENED
+  VLAN 2 (the k8s VLAN) now has IPv6, applied to both routers and pinned in the
+  Pulumi model. Addressing only, NOT egress (default-lifetime 0 -- routers are
+  not v6 default routers yet). IPv4 untouched the whole time; a watchdog was
+  armed on both routers and never reverted (0 reverts).
+
+  The window's open question is ANSWERED: production NetworkManager nodes take a
+  DHCPv6 lease from the managed flag, and MAC-keyed reservations match. worker0
+  and worker2 hold their exact reserved ::23 / ::25.
+
+WHAT DID NOT WORK (for you to decide, attended)
+  The two arm64 nodes -- worker1 (Asahi) and spark-2935 (DGX) -- ran a DHCPv6
+  transaction but did not bind an address. Per-node client issue, not the
+  reservation scheme (two x86 nodes prove the scheme). Untouched, deliberately.
+
+  A mistake worth knowing about: I first committed "MAC reservations do NOT work"
+  after checking before a full RA cycle. My own timed observation caught it and
+  it is corrected in git (lab@d9f74aa, k8s-deployment@75af36d) and in
+  2026-09-06-dhcpv6.txt. The scheme works.
+
+WHAT IS NEXT
+  - decide the two arm64 nodes' DHCPv6 (why they don't bind), and whether to keep
+    MAC keys or move to DUID / dynamic+discovery for uniformity.
+  - THEN egress: flip default-lifetime 0 -> 1800 + a default-preference pair,
+    WITH the tunnel throughput measured (1480/1472). One line, attended.
+  - the cluster steps (Cilium IPAM switch, k3s dual CIDRs, Cilium IPv6) were
+    deliberately NOT started -- they need someone watching and the 3-server etcd
+    rehearsal harness still to be built.
+
+Nothing here is load-bearing yet: no node depends on its v6 address, so this is
+fully reversible with migration/vlan2-v6-apply revert.
+
+=== FINAL STATE 2026-09-06T22:51:14+01:00 ===
+--- 10.0.1.252 ---
+vyos001
+  internet/ipv6: UP/UP
+  vrrp:       6 MASTER 
+  route: default via 87.192.96.1 dev bond0.53 proto failover metric 1 
+  bond0.2 v6: 2001:470:187e:2::1/64
+--- 10.0.1.253 ---
+vyos002
+  internet/ipv6: DOWN/DOWN
+  vrrp:       6 BACKUP 
+  route: 
+  bond0.2 v6: 2001:470:187e:2::2/64
+--- nodes v6 ---
+  192.168.8.23   2001:470:187e:2::23
+  192.168.8.13   
+  192.168.8.25   2001:470:187e:2::25
+  192.168.8.12   
+--- cluster ---
+  5 Ready