=== MAINTENANCE WINDOW 2026-09-06 (unattended) — HANDOFF ===

WHAT HAPPENED
  VLAN 2 (the k8s VLAN) now has IPv6, applied to both routers and pinned in the
  Pulumi model. Addressing only, NOT egress (default-lifetime 0 -- routers are
  not v6 default routers yet). IPv4 untouched the whole time; a watchdog was
  armed on both routers and never reverted (0 reverts).

  The window's open question is ANSWERED: production NetworkManager nodes take a
  DHCPv6 lease from the managed flag, and MAC-keyed reservations match. worker0
  and worker2 hold their exact reserved ::23 / ::25.

WHAT DID NOT WORK (for you to decide, attended)
  The two arm64 nodes -- worker1 (Asahi) and spark-2935 (DGX) -- ran a DHCPv6
  transaction but did not bind an address. Per-node client issue, not the
  reservation scheme (two x86 nodes prove the scheme). Untouched, deliberately.

  A mistake worth knowing about: I first committed "MAC reservations do NOT work"
  after checking before a full RA cycle. My own timed observation caught it and
  it is corrected in git (lab@d9f74aa, k8s-deployment@75af36d) and in
  2026-09-06-dhcpv6.txt. The scheme works.

WHAT IS NEXT
  - decide the two arm64 nodes' DHCPv6 (why they don't bind), and whether to keep
    MAC keys or move to DUID / dynamic+discovery for uniformity.
  - THEN egress: flip default-lifetime 0 -> 1800 + a default-preference pair,
    WITH the tunnel throughput measured (1480/1472). One line, attended.
  - the cluster steps (Cilium IPAM switch, k3s dual CIDRs, Cilium IPv6) were
    deliberately NOT started -- they need someone watching and the 3-server etcd
    rehearsal harness still to be built.

Nothing here is load-bearing yet: no node depends on its v6 address, so this is
fully reversible with migration/vlan2-v6-apply revert.

=== FINAL STATE 2026-09-06T22:51:14+01:00 ===
--- 10.0.1.252 ---
vyos001
  internet/ipv6: UP/UP
  vrrp:       6 MASTER 
  route: default via 87.192.96.1 dev bond0.53 proto failover metric 1 
  bond0.2 v6: 2001:470:187e:2::1/64
--- 10.0.1.253 ---
vyos002
  internet/ipv6: DOWN/DOWN
  vrrp:       6 BACKUP 
  route: 
  bond0.2 v6: 2001:470:187e:2::2/64
--- nodes v6 ---
  192.168.8.23   2001:470:187e:2::23
  192.168.8.13   
  192.168.8.25   2001:470:187e:2::25
  192.168.8.12   
--- cluster ---
  5 Ready