stellio: drop IPv6 workarounds now upstream in cnx-network

Both interim blocks are in cnx-network b2b5daa:

- 27c697a adds vlans.<name>.ipv6SubnetId (lan -> 0, others -> VLAN id),
  replacing the SubnetId=auto race the mkForce pins worked around. mgmt
  moves from 0x1 to 0xA; on AIS's bare /64 both are skipped alike.
- 45643d6 is the router-radv-deprecate unit this file carried a copy
  of. Keeping both concatenated the two scripts into one unit running
  two ip-monitor loops.

flake.lock

@@ -2,7 +2,7 @@
   "nodes": {
     "arion": {
       "inputs": {
-        "flake-parts": "flake-parts_2",
+        "flake-parts": "flake-parts_3",
         "haskell-flake": "haskell-flake",
         "nixpkgs": [
           "frappix",
@@ -169,9 +169,11 @@
         "clan-core": [
           "clan-core"
         ],
+        "devshell": "devshell",
         "flake-parts": [
           "flake-parts"
         ],
+        "hermes-agent": "hermes-agent",
         "nixos-mailserver": "nixos-mailserver",
         "nixpkgs": [
           "nixpkgs"
@@ -181,11 +183,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1790583225,
+        "lastModified": 1793614125,
-        "narHash": "sha256-Nhgf1hptHA9pgcGN4U1wQqDg1cc3t6oCT/HCgBcRs/w=",
+        "narHash": "sha256-BsitI6IZ727mUtKQjN14eYHbnAsskuDB5A9co16R+oc=",
         "ref": "refs/heads/main",
-        "rev": "b2749dcc6ebe5d055b691f32dd47039f745a7d0e",
+        "rev": "b2b5daaed71c7d4f0b9a8b3cf31b5c1469dfdc2e",
-        "revCount": 203,
+        "revCount": 497,
         "type": "git",
         "url": "https://git.b4l.co.th/B4L/cnx-network-clan"
       },
@@ -222,6 +224,27 @@
       }
     },
     "devshell": {
+      "inputs": {
+        "nixpkgs": [
+          "cnx-network",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1791918082,
+        "narHash": "sha256-oN9JrhRfHa7MUTdUq+11dHn7u0Z4WfEA4mhzBq0/zoQ=",
+        "owner": "numtide",
+        "repo": "devshell",
+        "rev": "9e29c63dde99a2d80c94b3d024c9768c01544558",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "devshell",
+        "type": "github"
+      }
+    },
+    "devshell_2": {
       "inputs": {
         "nixpkgs": [
           "nixpkgs"
@@ -312,6 +335,28 @@
       }
     },
     "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "cnx-network",
+          "hermes-agent",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1782949081,
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_2": {
       "inputs": {
         "nixpkgs-lib": [
           "nixpkgs"
@@ -331,7 +376,7 @@
         "type": "github"
       }
     },
-    "flake-parts_2": {
+    "flake-parts_3": {
       "inputs": {
         "nixpkgs-lib": [
           "frappix",
@@ -522,7 +567,57 @@
         "type": "github"
       }
     },
+    "hermes-agent": {
+      "inputs": {
+        "flake-parts": "flake-parts",
+        "home-manager": "home-manager",
+        "nixpkgs": [
+          "cnx-network",
+          "nixpkgs"
+        ],
+        "npm-lockfile-fix": "npm-lockfile-fix",
+        "pyproject-build-systems": "pyproject-build-systems",
+        "pyproject-nix": "pyproject-nix",
+        "uv2nix": "uv2nix"
+      },
+      "locked": {
+        "lastModified": 1792043576,
+        "narHash": "sha256-i9rob9jtBv6XTV0acNbHDEUM+9f3ZsN1zJkD6dMBzTc=",
+        "owner": "NousResearch",
+        "repo": "hermes-agent",
+        "rev": "d923a5eb487a17c0a68801bba9ef0f56c81040a8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NousResearch",
+        "ref": "v0.22.2",
+        "repo": "hermes-agent",
+        "type": "github"
+      }
+    },
     "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "cnx-network",
+          "hermes-agent",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1786487128,
+        "narHash": "sha256-ad60hrRVhH/bo3Jl1YLzO+QcS3mUNZr9LNJdzhMO2P4=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "f404edbfa4117810c96b97048299242fc50e5362",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "home-manager_2": {
       "inputs": {
         "nixpkgs": [
           "nixpkgs"
@@ -843,11 +938,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785198005,
+        "lastModified": 1792432400,
-        "narHash": "sha256-falBPi+PJtMx0vwII8L24wjDGXNZMwRiVXsw8WTXLEo=",
+        "narHash": "sha256-ayqyWcMFat+/FPyzm6iABDWyQwqKw4dG5yY6tcmN53Y=",
         "owner": "simple-nixos-mailserver",
         "repo": "nixos-mailserver",
-        "rev": "d357b9f048c5532ec81b0e0034c0b8463d5ddd46",
+        "rev": "b3e735a82a531e34ea3df3495026ca1d8a4e62fe",
         "type": "gitlab"
       },
       "original": {
@@ -919,6 +1014,28 @@
         "type": "github"
       }
     },
+    "npm-lockfile-fix": {
+      "inputs": {
+        "nixpkgs": [
+          "cnx-network",
+          "hermes-agent",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1775903712,
+        "narHash": "sha256-2GV79U6iVH4gKAPWYrxUReB0S41ty/Y3dBLquU8AlaA=",
+        "owner": "jeslie0",
+        "repo": "npm-lockfile-fix",
+        "rev": "c6093acb0c0548e0f9b8b3d82918823721930fe8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "jeslie0",
+        "repo": "npm-lockfile-fix",
+        "type": "github"
+      }
+    },
     "paisano": {
       "inputs": {
         "call-flake": "call-flake",
@@ -988,15 +1105,69 @@
         "type": "github"
       }
     },
+    "pyproject-build-systems": {
+      "inputs": {
+        "nixpkgs": [
+          "cnx-network",
+          "hermes-agent",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "cnx-network",
+          "hermes-agent",
+          "pyproject-nix"
+        ],
+        "uv2nix": [
+          "cnx-network",
+          "hermes-agent",
+          "uv2nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1785115949,
+        "narHash": "sha256-8AM37BfyGaL2v/SZyg4PupRxJ01Y4htvM+WrTjWrPpo=",
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "rev": "62c0d86027edb1c4f39a5facc09876348144f7c9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "type": "github"
+      }
+    },
+    "pyproject-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "cnx-network",
+          "hermes-agent",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1784591072,
+        "narHash": "sha256-zP/WaDxrRu8GANZM61+V2LT/7ycEEdoyLWn7M6WzU7M=",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "rev": "e3b599ca2e7fcf93d4edf65d7f19bbf6491724f3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "clan-community": "clan-community",
         "clan-core": "clan-core",
         "cnx-network": "cnx-network",
-        "devshell": "devshell",
+        "devshell": "devshell_2",
-        "flake-parts": "flake-parts",
+        "flake-parts": "flake-parts_2",
         "frappix": "frappix",
-        "home-manager": "home-manager",
+        "home-manager": "home-manager_2",
         "import-tree": "import-tree",
         "liminix": "liminix",
         "matthew-hardware": "matthew-hardware",
@@ -1187,6 +1358,33 @@
         "url": "https://git.atagen.co/atagen/unf"
       }
     },
+    "uv2nix": {
+      "inputs": {
+        "nixpkgs": [
+          "cnx-network",
+          "hermes-agent",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "cnx-network",
+          "hermes-agent",
+          "pyproject-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1785277507,
+        "narHash": "sha256-9Tq3UDX2hD/aveW/HvkBlAmEwJTOlY5HQXJM+L5BGmE=",
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "rev": "5a836d395cbf5fc22670eb98dd4aa4fc4d406977",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "type": "github"
+      }
+    },
     "yants": {
       "inputs": {
         "nixpkgs": [

machines/stellio/configuration.nix

@@ -84,97 +84,6 @@
       22
     ];
 
-    # AIS delegates a single /64 over PPPoE (seen 2026-10-02: "ppp0: DHCP:
-    # received delegated prefix 2405:9800:b910:1f5d::/64"). The router
-    # service hands out sub-prefixes with SubnetId=auto, so whichever VLAN
-    # interface comes up first takes the whole /64 -- on this box vlan-mgmt
-    # did, and vlan-lan logged "Couldn't find a suitable prefix. Ran out of
-    # address space": no RA prefix on lan, so clients had no global IPv6.
-    # Pin the ids: lan (where the clients are) always gets subnet 0, i.e.
-    # the entire prefix when it is a /64; mgmt asks for subnet 1, which
-    # fails harmlessly on a /64 (mgmt is reached over v4 and the meshes) and
-    # starts working unchanged if AIS ever delegates wider. Drop once
-    # cnx-network's router service exposes a per-VLAN subnet id.
-    systemd.network.networks."40-vlan-lan".dhcpPrefixDelegationConfig.SubnetId = lib.mkForce "0x0";
-    systemd.network.networks."40-vlan-mgmt".dhcpPrefixDelegationConfig.SubnetId = lib.mkForce "0x1";
-
-    # Interim copy of cnx-network-clan 45643d6 (router/ipv6: deprecate
-    # withdrawn DHCPv6-PD prefixes); drop when the input is bumped past it.
-    # networkd never deprecates a prefix it stops announcing (systemd#29651):
-    # on every reboot the first PPPoE session lands on another AIS BNG, is
-    # torn down minutes later, and the reconnect brings a different /64.
-    # networkd announces the new prefix at once but clients keep the old
-    # one preferred for the rest of its 1800 s lifetime, so RFC 6724 source
-    # selection picks the dead prefix and every v6 connection fails for up
-    # to 30 minutes (2026-10-08 07:57). Watch vlan-* for networkd removing a
-    # dynamic (PD) address and send up to three RAs with that /64 at
-    # preferred lifetime 0, one short-lived radvd per RA (SIGKILLed: no
-    # shutdown RA with router lifetime 0), stopping as soon as the prefix is
-    # back on the interface -- a plain flap re-delegates the same /64 within
-    # seconds and a deprecating RA sent after networkd re-announced it would
-    # leave clients deprecated until the next periodic RA (08:19 today).
-    systemd.services.router-radv-deprecate = {
-      description = "Deprecate withdrawn DHCPv6-PD prefixes on the VLANs";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "systemd-networkd.service" ];
-      path = [
-        pkgs.iproute2
-        pkgs.ipcalc
-        pkgs.radvd
-      ];
-      serviceConfig = {
-        Restart = "always";
-        RestartSec = 2;
-        RuntimeDirectory = "router-radv-deprecate";
-      };
-      script = ''
-        conf=$RUNTIME_DIRECTORY/radvd.conf
-        pid=$RUNTIME_DIRECTORY/radvd.pid
-
-        # /64s of the global addresses currently on an interface.
-        prefixes_on() {
-          ip -o -6 addr show dev "$1" scope global | while read -r _ _ _ a _; do
-            echo "$(ipcalc --no-decorate -n "$a")/''${a##*/}"
-          done
-        }
-
-        # "Deleted 4: vlan-lan    inet6 2001:db8::1/64 scope global dynamic mngtmpaddr \ valid_lft ..."
-        ip -o -6 monitor address | while read -r event _ dev _ addr _ scope rest; do
-          [[ $event == Deleted && $dev == vlan-* && $scope == global && $rest == *dynamic* ]] || continue
-          prefix="$(ipcalc --no-decorate -n "$addr")/''${addr##*/}"
-          cat > "$conf" <<EOF
-        interface $dev {
-          AdvSendAdvert on;
-          MinRtrAdvInterval 3;
-          MaxRtrAdvInterval 4;
-          AdvDefaultLifetime 1800;
-          AdvCurHopLimit 0;
-          prefix $prefix {
-            AdvOnLink on;
-            AdvAutonomous on;
-            AdvPreferredLifetime 0;
-            AdvValidLifetime 7200;
-          };
-        };
-        EOF
-          for _ in 1 2 3; do
-            if prefixes_on "$dev" | grep -qxF "$prefix"; then
-              echo "$dev: $prefix is back, leaving it announced"
-              break
-            fi
-            echo "$dev: deprecating withdrawn prefix $prefix"
-            rm -f "$pid"
-            # radvd sends its first RA on start; the next would follow 3-4 s later.
-            radvd -C "$conf" -p "$pid" -n -m stderr &
-            sleep 1
-            kill -KILL $! 2>/dev/null || true
-            wait $! || true
-            sleep 2
-          done
-        done
-      '';
-    };
-
     systemd.services.heartbeat-push = {
       description = "Heartbeat push to uptime monitor";
       serviceConfig = {