diff --git a/migration/window-evidence/2026-09-06-dhcpv6.txt b/migration/window-evidence/2026-09-06-dhcpv6.txt
index 7c16d2d..ca45a85 100644
--- a/migration/window-evidence/2026-09-06-dhcpv6.txt
+++ b/migration/window-evidence/2026-09-06-dhcpv6.txt
@@ -54,3 +54,12 @@ A SECOND FINDING, unrelated and worse if unnoticed
   `set service dhcpv6-server listen-interface bond0.2` plus a subnet-level
   `interface bond0.2`; both routers now render interfaces: ["bond0.2"].
 
+OPTION (b) RULED OUT IN-WINDOW: VyOS's dhcpv6-server global-parameters accepts
+only `name-server` -- there is no knob to pass kea `mac-sources`, and editing
+/run/kea/kea-dhcp6.conf directly is the hand-sed drift this estate already
+banned (it is regenerated on every commit anyway). Worth knowing for the
+attended decision: worker0's link-local IS EUI-64 (fe80::7a55:36ff:fe08:28fb
+embeds 78:55:36:08:28:fb) so a mac-source of ipv6-link-local could match it --
+but at least one client on the VLAN uses a privacy-style link-local
+(fe80::b2c3:ee96:e630:519d), so even upstream support would not cover everyone.
+That pushes toward option (a) DUID keys or (c) dynamic range + discovery.