diff --git a/CLAUDE.md b/CLAUDE.md
index 673d80e..4df06f1 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -284,7 +284,15 @@ the rule.
 
 ### IGP / routing
 - OSPFv2 area `backbone-v2` (id 0.0.0.0) on all spine links, SHA-512 auth
-  with `auth-id=1` and a shared key. PTP type, BFD enabled where supported.
+  with `auth-id=1` and a shared key. PTP type. **BFD is off on every
+  wireless backbone interface (AF11/AF24/60GHz)** — the global timers
+  (`/routing/bfd/configuration` = 200ms×5 = 1s detection) are too
+  aggressive for AF RF: a single >1s burst tore down OSPF on
+  climax↔494 every ~15–40 min until `use-bfd=false` was applied to both
+  ends 2026-05-09. Wired fiber links may keep BFD if desired. If
+  sub-second failover on a wireless link is genuinely needed, also
+  loosen the BFD timers (e.g. min-rx/min-tx=500ms, multiplier=3) — do
+  not flip `use-bfd=true` alone.
 - OSPFv3 area `backbone-v3` for IPv6 (some interfaces only).
 - All instances `redistribute=connected` with passthrough filters
   (`/routing filter rule chain=ospf-out rule="accept;"`).
diff --git a/mikrotik-tool/494.rsc b/mikrotik-tool/494.rsc
index 1ae28dd..ba27091 100644
--- a/mikrotik-tool/494.rsc
+++ b/mikrotik-tool/494.rsc
@@ -1,4 +1,4 @@
-# 2026-05-09 09:00:22 by RouterOS 7.21.4
+# 2026-05-09 09:26:03 by RouterOS 7.21.4
 # software id = K4QG-8NQV
 #
 # model = RB5009UG+S+
diff --git a/mikrotik-tool/982.rsc b/mikrotik-tool/982.rsc
index c317d47..924f8de 100644
--- a/mikrotik-tool/982.rsc
+++ b/mikrotik-tool/982.rsc
@@ -1,4 +1,4 @@
-# 2026-05-09 09:00:22 by RouterOS 7.21.4
+# 2026-05-09 09:26:03 by RouterOS 7.21.4
 # software id = FUVS-HCM5
 #
 # model = CCR1009-7G-1C-1S+
diff --git a/mikrotik-tool/climax-v6-apply.rsc b/mikrotik-tool/climax-v6-apply.rsc
new file mode 100644
index 0000000..8b706ee
--- /dev/null
+++ b/mikrotik-tool/climax-v6-apply.rsc
@@ -0,0 +1,152 @@
+# =============================================================================
+# climax — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3)
+# =============================================================================
+#
+# Climax sits between verona (south-west) and the rest of the network
+# (via core). One v6 default upstream — toward core via :12::1.
+#
+# P2P interfaces:
+#   ether4-380-airfiber24   :12::/64  (climax .2, core .1)
+#   ether6-verona-11ghz     :20::/64  (verona .1, climax .2)
+#   ether3-culleoka-11ghz   :21::/64  (climax .1, culleoka .2)
+#   ether5-494              :17::/64  (climax .1, 494 .2)
+#
+# Mgmt LAN: bridge `mgmt`, v6 = 2606:1c80:1100::1/64
+# PPPoE customers: profile name `pppoe`, customer pool 2606:1c80:1101::/48 → /56
+#
+# BFD on wireless OSPFv2 templates was already turned off on this router
+# earlier today (2026-05-09) — verified via the freshly-pulled climax.rsc.
+# No BFD changes here.
+# =============================================================================
+
+# -----------------------------------------------------------------------------
+# WIPE — drop OSPFv3 + stale internal v6
+# -----------------------------------------------------------------------------
+/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool=""
+/ipv6 dhcp-server remove [find]
+/ipv6 dhcp-server option remove [find]
+/ipv6 dhcp-client remove [find]
+/ipv6 nd prefix remove [find]
+/ipv6 nd remove [find !default]
+/ipv6 pool remove [find]
+/ipv6 route remove [find !dynamic]
+/ipv6 firewall filter remove [find]
+/ipv6 firewall mangle remove [find]
+/ipv6 firewall raw remove [find]
+/ipv6 address remove [find !dynamic]
+
+# OSPFv3 — instance, area, and the orphan culleoka-11ghz template entry
+# (currently lives under area=backbone-v3) all get removed.
+/routing ospf interface-template remove [find area=backbone-v3]
+/routing ospf area remove [find name=backbone-v3]
+/routing ospf instance remove [find name=default-v3]
+
+# Drop any stale internal v6 iBGP peers (none present, but defensive).
+/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"]
+
+# -----------------------------------------------------------------------------
+# APPLY — BGP instance (climax has none today)
+# -----------------------------------------------------------------------------
+/routing bgp instance
+add name=bgp-instance-1 as=393837 router-id=10.254.254.102
+
+# -----------------------------------------------------------------------------
+# APPLY — addresses
+# -----------------------------------------------------------------------------
+/ipv6 settings set forward=yes accept-router-advertisements=no
+
+/ipv6 address
+add address=2606:1c80:0:10::102/128 interface=lo                       advertise=no  comment="loopback"
+add address=2606:1c80:0:12::2/127   interface=ether4-380-airfiber24    advertise=no  comment="P2P climax<->core"
+add address=2606:1c80:0:20::2/127   interface=ether6-verona-11ghz      advertise=no  comment="P2P climax<->verona"
+add address=2606:1c80:0:21::1/127   interface=ether3-culleoka-11ghz    advertise=no  comment="P2P climax<->culleoka"
+add address=2606:1c80:0:17::1/127   interface=ether5-494               advertise=no  comment="P2P climax<->494"
+add address=2606:1c80:1100::1/64    interface=mgmt                     advertise=yes comment="climax mgmt LAN"
+
+# -----------------------------------------------------------------------------
+# APPLY — static routes (replace what an IGP would have learned)
+# -----------------------------------------------------------------------------
+/ipv6 route
+# Default upstream toward core (only one path from climax — core forwards
+# upward via preseem/direct).
+add dst-address=::/0                    gateway=2606:1c80:0:12::1 distance=1 comment="default via core"
+
+# Edge loopback explicit (recursively resolved through default; explicit
+# entry helps iBGP control plane converge quickly on first bring-up).
+add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:12::1 distance=1 comment="edge loopback via core"
+
+# Blackhole climax's /44 aggregate so iBGP has the prefix to advertise.
+add dst-address=2606:1c80:1100::/44 blackhole distance=200 comment="climax /44 aggregate (iBGP origin)"
+
+# -----------------------------------------------------------------------------
+# APPLY — neighbour discovery on the mgmt LAN (SLAAC + RDNSS)
+# -----------------------------------------------------------------------------
+/ipv6 nd
+add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
+
+/ipv6 nd prefix
+add interface=mgmt prefix=2606:1c80:1100::/64 autonomous=yes on-link=yes
+
+/ipv6 dhcp-server
+add interface=mgmt name=climax-mgmt-stateless address-pool=static-only
+
+/ipv6 dhcp-server option
+add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
+
+# -----------------------------------------------------------------------------
+# APPLY — customer PD pool + bind to the climax PPPoE profile
+# -----------------------------------------------------------------------------
+/ipv6 pool
+add name=climax-cust-pd-1 prefix=2606:1c80:1101::/48 prefix-length=56
+
+/ppp profile
+set [find name=pppoe] remote-ipv6-prefix-pool=climax-cust-pd-1 dhcpv6-pd-pool=climax-cust-pd-1
+
+# -----------------------------------------------------------------------------
+# APPLY — firewall (mirrors v4 hygiene; deny by default)
+# -----------------------------------------------------------------------------
+/ipv6 firewall filter
+add chain=input action=accept connection-state=established,related comment="established"
+add chain=input action=drop   connection-state=invalid             comment="invalid"
+add chain=input action=accept protocol=icmpv6                      comment="icmpv6"
+add chain=input action=accept src-address=fe80::/10                comment="link-local"
+add chain=input action=accept src-address=2606:1c80::/32           comment="internal"
+add chain=input action=drop                                        comment="default deny"
+
+add chain=forward action=accept connection-state=established,related              comment="established"
+add chain=forward action=drop   connection-state=invalid                          comment="invalid"
+add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1                 comment="PMTUD"
+add chain=forward action=accept protocol=icmpv6                                   comment="icmpv6"
+add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal"
+add chain=forward action=accept in-interface-list=customer                        comment="v6 outbound from customers"
+add chain=forward action=drop                                                     comment="default deny"
+
+# -----------------------------------------------------------------------------
+# APPLY — iBGP to edge (v4 transport / v6 NLRI)
+# -----------------------------------------------------------------------------
+/routing filter rule
+add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1100::/44) { accept; } else { reject; }"
+
+/routing bgp connection
+add name=ibgp-edge-v6 instance=bgp-instance-1 templates=default \
+    afi=ip,ipv6 local.role=ibgp local.address=10.254.254.102 \
+    remote.address=10.254.254.254 remote.as=393837 multihop=yes \
+    nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
+    comment="iBGP to edge, v4 transport / v6 NLRI"
+
+# -----------------------------------------------------------------------------
+# VERIFY (paste after apply)
+# -----------------------------------------------------------------------------
+# /ipv6 address print
+# /ipv6 route print where active
+# /routing ospf neighbor print            ;; only OSPFv2 should remain
+# /routing bgp instance print
+# /routing bgp connection print
+# /routing bgp session print
+#
+# After core + edge have applied:
+#   /ping 2606:1c80:0:12::1 count=3      ;; core P2P side
+#   /ping 2606:1c80:0:10::253 count=3    ;; core loopback
+#   /ping 2606:1c80:0:10::254 count=3    ;; edge loopback
+#   /ping 2606:4700:4700::1111 count=3   ;; cloudflare end-to-end
+#   /routing bgp session print           ;; ibgp-edge-v6 should be Established
diff --git a/mikrotik-tool/climax.rsc b/mikrotik-tool/climax.rsc
index ba3ff0c..452b0c7 100644
--- a/mikrotik-tool/climax.rsc
+++ b/mikrotik-tool/climax.rsc
@@ -1,4 +1,4 @@
-# 2026-05-09 09:00:22 by RouterOS 7.21.4
+# 2026-05-09 09:26:02 by RouterOS 7.21.4
 # software id = UETF-WF31
 #
 # model = CCR2004-16G-2S+
@@ -133,11 +133,14 @@ add address-pool=climax-mgmt interface=mgmt lease-script="{\
     \n} while ( \$attempts < \$max )\
     \n}\
     \n" name=climax-mgmt
+/ipv6 dhcp-server option
+add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
 /ipv6 pool
-add name=climax-v6 prefix=2606:1c80:1:2000::/52 prefix-length=64
+add name=climax-cust-pd-1 prefix=2606:1c80:1101::/48 prefix-length=56
 /ppp profile
-add bridge-learning=no change-tcp-mss=yes dns-server=\
-    204.110.191.240,204.110.191.20 local-address=cgnat name=pppoe on-down="{\
+add bridge-learning=no change-tcp-mss=yes dhcpv6-pd-pool=climax-cust-pd-1 \
+    dns-server=204.110.191.240,204.110.191.20 local-address=cgnat name=pppoe \
+    on-down="{\
     \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
     uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
     7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
@@ -245,8 +248,8 @@ add bridge-learning=no change-tcp-mss=yes dns-server=\
     \n  }\
     \n} while ( \$attempts < \$max )\
     \n}\
-    \n" remote-address=cgnat use-compression=no use-encryption=no use-ipv6=no \
-    use-mpls=no use-upnp=no
+    \n" remote-address=cgnat remote-ipv6-prefix-pool=climax-cust-pd-1 \
+    use-compression=no use-encryption=no use-ipv6=no use-mpls=no use-upnp=no
 /queue type
 add kind=fq-codel name=fq-codel
 /queue interface
@@ -268,16 +271,15 @@ set ether15 queue=fq-codel
 set ether16 queue=fq-codel
 set sfp-sfpplus1 queue=fq-codel
 set sfp-sfpplus2 queue=fq-codel
+/routing bgp instance
+add as=393837 name=bgp-instance-1 router-id=10.254.254.102
 /routing id
 add disabled=no id=10.254.254.102 name=id-1 select-dynamic-id=""
 /routing ospf instance
 add disabled=no in-filter-chain=ospf-in name=default-v2 originate-default=\
     never out-filter-chain=ospf-out redistribute=connected router-id=id-1
-add disabled=no in-filter-chain=ospf-in name=default-v3 out-filter-chain=\
-    ospf-out redistribute=connected router-id=id-1 version=3
 /routing ospf area
 add disabled=no instance=default-v2 name=backbone-v2
-add disabled=no instance=default-v3 name=backbone-v3
 /snmp community
 set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\
     kdyyJrT0Mm
@@ -297,14 +299,20 @@ add bridge=climax-bridge interface=sfp-sfpplus1
 add bridge=mgmt interface=vlan10_ether7
 add bridge=mgmt interface=vlan10_sfp-sfpplus1
 /ip firewall connection tracking
+# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
 set enabled=yes icmp-timeout=30s tcp-close-wait-timeout=1m \
     tcp-established-timeout=4h tcp-fin-wait-timeout=2m tcp-last-ack-timeout=\
     30s tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
     tcp-time-wait-timeout=2m udp-stream-timeout=2m
 /ip neighbor discovery-settings
+# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
 set discover-interface-list=!dynamic
 /ip settings
+# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
 set max-neighbor-entries=8192 tcp-syncookies=yes
+/ipv6 settings
+# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
+set accept-router-advertisements=no
 /interface pppoe-server server
 add authentication=chap,mschap2 default-profile=pppoe disabled=no interface=\
     climax-bridge max-mru=1492 max-mtu=1492 one-session-per-host=yes \
@@ -388,6 +396,13 @@ add dst-address=100.64.160.0/20 gateway=10.250.1.65
 add dst-address=204.110.188.64/27 gateway=10.250.1.65
 add disabled=no dst-address=10.254.254.101/32 gateway=10.250.1.25 \
     routing-table=main
+/ipv6 route
+add comment="default via core" distance=1 dst-address=::/0 gateway=\
+    2606:1c80:0:12::1
+add comment="edge loopback via core" distance=1 dst-address=\
+    2606:1c80:0:10::254/128 gateway=2606:1c80:0:12::1
+add blackhole comment="climax /44 aggregate (iBGP origin)" distance=200 \
+    dst-address=2606:1c80:1100::/44
 /ip service
 set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
 set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
@@ -399,10 +414,45 @@ set api address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10
 set api-ssl certificate=MyCA
 /ip ssh
 set host-key-type=ed25519 strong-crypto=yes
+/ipv6 address
+add address=2606:1c80:0:10::102/128 advertise=no comment=loopback interface=\
+    lo
+add address=2606:1c80:0:12::2/127 advertise=no comment="P2P climax<->core" \
+    interface=ether4-380-airfiber24
+add address=2606:1c80:0:20::2/127 advertise=no comment="P2P climax<->verona" \
+    interface=ether6-verona-11ghz
+add address=2606:1c80:0:21::1/127 advertise=no comment=\
+    "P2P climax<->culleoka" interface=ether3-culleoka-11ghz
+add address=2606:1c80:0:17::1/127 advertise=no comment="P2P climax<->494" \
+    interface=ether5-494
+add address=2606:1c80:1100::1 comment="climax mgmt LAN" interface=mgmt
 /ipv6 dhcp-relay option
 set client_mac value="0x0001\$(CLIENT_MAC)"
+/ipv6 dhcp-server
+add interface=mgmt name=climax-mgmt-stateless
+/ipv6 firewall filter
+add action=accept chain=input comment=established connection-state=\
+    established,related
+add action=drop chain=input comment=invalid connection-state=invalid
+add action=accept chain=input comment=icmpv6 protocol=icmpv6
+add action=accept chain=input comment=link-local src-address=fe80::/10
+add action=accept chain=input comment=internal src-address=2606:1c80::/32
+add action=drop chain=input comment="default deny"
+add action=accept chain=forward comment=established connection-state=\
+    established,related
+add action=drop chain=forward comment=invalid connection-state=invalid
+add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
+    icmpv6
+add action=accept chain=forward comment=icmpv6 protocol=icmpv6
+add action=accept chain=forward comment=internal-to-internal dst-address=\
+    2606:1c80::/32 src-address=2606:1c80::/32
+add action=accept chain=forward comment=\
+    "v6 outbound from climax tower (customer + mgmt)" src-address=\
+    2606:1c80:1100::/44
+add action=drop chain=forward comment="default deny"
 /ipv6 nd
 set [ find default=yes ] advertise-dns=yes
+add advertise-dns=yes interface=mgmt other-configuration=yes
 /mpls interface
 add interface=ether6-verona-11ghz mpls-mtu=1508
 add interface=ether4-380-airfiber24 mpls-mtu=1508
@@ -426,17 +476,21 @@ set accept=yes
 /routing bfd configuration
 add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5 vrf=\
     main
+/routing bgp connection
+add afi=ip,ipv6 comment="iBGP to edge, v4 transport / v6 NLRI" instance=\
+    bgp-instance-1 local.address=10.254.254.102 .role=ibgp multihop=yes name=\
+    ibgp-edge-v6 nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
+    remote.address=10.254.254.254 .as=393837 templates=default
 /routing filter rule
 add chain=ospf-in disabled=no rule=accept
 add chain=ospf-out disabled=no rule=accept
+add chain=v6-ibgp-out disabled=no rule=\
+    "if (dst==2606:1c80:1100::/44) { accept; } else { reject; }"
 /routing ospf interface-template
-add area=backbone-v3 cost=10 disabled=no use-bfd=no
 add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
     ether6-verona-11ghz priority=1 type=ptp use-bfd=no
 add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
     ether5-494 priority=1 type=ptp use-bfd=no
-add area=backbone-v3 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
-    ether3-culleoka-11ghz priority=1 type=ptp use-bfd=no
 add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
     ether4-380-airfiber24 priority=1 type=ptp use-bfd=no
 /routing ospf static-neighbor
diff --git a/mikrotik-tool/core-v6-apply.rsc b/mikrotik-tool/core-v6-apply.rsc
new file mode 100644
index 0000000..6ed1313
--- /dev/null
+++ b/mikrotik-tool/core-v6-apply.rsc
@@ -0,0 +1,169 @@
+# =============================================================================
+# core (380) — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3)
+# =============================================================================
+#
+# Core sits between edge and the towers. Two paths to edge mirror v4:
+#   1. PRIMARY: sfp-sfpplus1-edge-preseem, /127 :1002::2 — edge cost 10
+#   2. BACKUP: ether3-edge-direct, /127 :11::2 — OSPFv2 cost 100 on both
+#      ends; v6 mirrors via static distance.
+#
+# Tower-facing P2Ps (per ipv6.md):
+#   ether5-climax           :12::/64  (core .1, climax .2)
+#   ether4-newhope          :13::/64  (core .1, newhope .2)
+#   ether1-982-60ghz        :14::/64  (core .1, 982 .2)
+#   ether6-culleoka-11ghz   :15::/64  (core .1, culleoka .2)
+#
+# Mgmt LAN: vlan10_combo1 (vlan 10 on combo1-380), v6 = 2606:1c80:1400::1/64
+# PPPoE customers: profile name `380`, customer pool 2606:1c80:1401::/48 → /56
+#
+# Two pre-apply fixes required on core:
+#   (a) /routing/bgp/instance bgp-instance-1 currently has as=65530 — must
+#       be 393837 to peer iBGP with edge. We update it in place.
+#   (b) BFD is currently on for ether5-climax (AF24), ether4-newhope, and
+#       ether6-culleoka-11ghz (AF11). Per fleet policy (no BFD on
+#       wireless), we set use-bfd=no on those three OSPFv2 templates.
+#       Wired backbone (sfp-sfpplus1-edge-preseem, ether3-edge-direct)
+#       keeps BFD as-is.
+# =============================================================================
+
+# -----------------------------------------------------------------------------
+# WIPE — drop OSPFv3 + stale internal v6
+# -----------------------------------------------------------------------------
+/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool=""
+/ipv6 dhcp-server remove [find]
+/ipv6 dhcp-server option remove [find]
+/ipv6 dhcp-client remove [find]
+/ipv6 nd prefix remove [find]
+/ipv6 nd remove [find !default]
+/ipv6 pool remove [find]
+/ipv6 route remove [find !dynamic]
+/ipv6 firewall filter remove [find]
+/ipv6 firewall mangle remove [find]
+/ipv6 firewall raw remove [find]
+/ipv6 address remove [find !dynamic]
+
+/routing ospf interface-template remove [find area=backbone-v3]
+/routing ospf area remove [find name=backbone-v3]
+/routing ospf instance remove [find name=default-v3]
+
+/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"]
+# also remove the disabled placeholder climax connection (will be replaced
+# by the future climax tower's own iBGP-to-edge session).
+/routing bgp connection remove [find name=climax and disabled=yes]
+
+# -----------------------------------------------------------------------------
+# APPLY — fix BGP instance AS (65530 → 393837 to match the fleet)
+# -----------------------------------------------------------------------------
+/routing bgp instance set [find name=bgp-instance-1] as=393837
+
+# -----------------------------------------------------------------------------
+# APPLY — turn off BFD on wireless backbone OSPFv2 templates
+# -----------------------------------------------------------------------------
+/routing ospf interface-template set [find interfaces=ether5-climax]          use-bfd=no
+/routing ospf interface-template set [find interfaces=ether4-newhope]         use-bfd=no
+/routing ospf interface-template set [find interfaces=ether6-culleoka-11ghz]  use-bfd=no
+
+# -----------------------------------------------------------------------------
+# APPLY — addresses
+# -----------------------------------------------------------------------------
+/ipv6 settings set forward=yes accept-router-advertisements=no
+
+/ipv6 address
+add address=2606:1c80:0:10::253/128 interface=lo                          advertise=no  comment="loopback"
+add address=2606:1c80:0:11::2/127   interface=ether3-edge-direct          advertise=no  comment="P2P core<->edge direct (backup)"
+add address=2606:1c80:0:1002::2/127 interface=sfp-sfpplus1-edge-preseem   advertise=no  comment="P2P core<->edge via preseem (primary)"
+add address=2606:1c80:0:12::1/127   interface=ether5-climax               advertise=no  comment="P2P core<->climax"
+add address=2606:1c80:0:13::1/127   interface=ether4-newhope              advertise=no  comment="P2P core<->newhope"
+add address=2606:1c80:0:14::1/127   interface=ether1-982-60ghz            advertise=no  comment="P2P core<->982 60GHz"
+add address=2606:1c80:0:15::1/127   interface=ether6-culleoka-11ghz       advertise=no  comment="P2P core<->culleoka"
+add address=2606:1c80:1400::1/64    interface=vlan10_combo1               advertise=yes comment="380 mgmt LAN"
+
+# -----------------------------------------------------------------------------
+# APPLY — static routes (replace what an IGP would have learned)
+# -----------------------------------------------------------------------------
+/ipv6 route
+# v6 default toward edge — preseem primary, direct backup (mirrors v4 cost relationship).
+add dst-address=::/0                  gateway=2606:1c80:0:1002::1 distance=1 comment="default via preseem (primary)"
+add dst-address=::/0                  gateway=2606:1c80:0:11::1   distance=2 comment="default via direct (backup)"
+
+# Edge loopback static fallback (so iBGP TCP control plane can reach edge
+# even before BGP populates anything beyond defaults).
+add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:1002::1 distance=1 comment="edge loopback via preseem"
+add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:11::1   distance=2 comment="edge loopback via direct"
+
+# Blackhole core's /44 aggregate so iBGP has the prefix to advertise upward.
+add dst-address=2606:1c80:1400::/44 blackhole distance=200 comment="core /44 aggregate (iBGP origin)"
+
+# -----------------------------------------------------------------------------
+# APPLY — neighbour discovery on the 380 mgmt LAN (SLAAC + RDNSS)
+# -----------------------------------------------------------------------------
+/ipv6 nd
+add interface=vlan10_combo1 ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
+
+/ipv6 nd prefix
+add interface=vlan10_combo1 prefix=2606:1c80:1400::/64 autonomous=yes on-link=yes
+
+/ipv6 dhcp-server
+add interface=vlan10_combo1 name=core-mgmt-stateless address-pool=static-only
+
+/ipv6 dhcp-server option
+add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
+
+# -----------------------------------------------------------------------------
+# APPLY — customer PD pool + bind to the 380 PPPoE profile
+# -----------------------------------------------------------------------------
+/ipv6 pool
+add name=core-cust-pd-1 prefix=2606:1c80:1401::/48 prefix-length=56
+
+/ppp profile
+set [find name=380] remote-ipv6-prefix-pool=core-cust-pd-1 dhcpv6-pd-pool=core-cust-pd-1
+
+# -----------------------------------------------------------------------------
+# APPLY — firewall (mirrors v4 hygiene; deny by default)
+# -----------------------------------------------------------------------------
+/ipv6 firewall filter
+add chain=input action=accept connection-state=established,related comment="established"
+add chain=input action=drop   connection-state=invalid             comment="invalid"
+add chain=input action=accept protocol=icmpv6                      comment="icmpv6"
+add chain=input action=accept src-address=fe80::/10                comment="link-local"
+add chain=input action=accept src-address=2606:1c80::/32           comment="internal"
+add chain=input action=drop                                        comment="default deny"
+
+add chain=forward action=accept connection-state=established,related              comment="established"
+add chain=forward action=drop   connection-state=invalid                          comment="invalid"
+add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1                 comment="PMTUD"
+add chain=forward action=accept protocol=icmpv6                                   comment="icmpv6"
+add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal"
+add chain=forward action=accept in-interface-list=customer                        comment="v6 outbound from customers"
+add chain=forward action=drop                                                     comment="default deny"
+
+# -----------------------------------------------------------------------------
+# APPLY — iBGP to edge (v4 transport / v6 NLRI)
+# -----------------------------------------------------------------------------
+/routing filter rule
+add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1400::/44) { accept; } else { reject; }"
+
+/routing bgp connection
+add name=ibgp-edge-v6 instance=bgp-instance-1 templates=default \
+    afi=ip,ipv6 local.role=ibgp local.address=10.254.254.253 \
+    remote.address=10.254.254.254 remote.as=393837 multihop=yes \
+    nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
+    comment="iBGP to edge, v4 transport / v6 NLRI"
+
+# -----------------------------------------------------------------------------
+# VERIFY (paste after apply)
+# -----------------------------------------------------------------------------
+# /ipv6 address print
+# /ipv6 route print where active
+# /routing ospf neighbor print
+# /routing ospf interface-template print where use-bfd=yes  ;; should be wired-only
+# /routing bgp instance print
+# /routing bgp connection print
+# /routing bgp session print
+#
+# After edge has applied:
+#   /ping 2606:1c80:0:1002::1 count=3   ;; edge preseem-side
+#   /ping 2606:1c80:0:11::1 count=3     ;; edge direct-side
+#   /ping 2606:1c80:0:10::254 count=3   ;; edge loopback
+#   /ping 2606:4700:4700::1111 count=3  ;; cloudflare end-to-end
+#   /routing bgp session print          ;; ibgp-edge-v6 should be Established
diff --git a/mikrotik-tool/core.rsc b/mikrotik-tool/core.rsc
index f53435d..8ad7115 100644
--- a/mikrotik-tool/core.rsc
+++ b/mikrotik-tool/core.rsc
@@ -1,4 +1,4 @@
-# 2026-05-09 09:00:22 by RouterOS 7.21.4
+# 2026-05-09 09:26:03 by RouterOS 7.21.4
 # software id = XS5B-41QR
 #
 # model = CCR1009-7G-1C-1S+
diff --git a/mikrotik-tool/culleoka.rsc b/mikrotik-tool/culleoka.rsc
index c18a90e..40b53bb 100644
--- a/mikrotik-tool/culleoka.rsc
+++ b/mikrotik-tool/culleoka.rsc
@@ -1,4 +1,4 @@
-# 2026-05-09 09:00:22 by RouterOS 7.21.4
+# 2026-05-09 09:26:03 by RouterOS 7.21.4
 # software id = HVP9-3G0K
 #
 # model = CCR1009-7G-1C-1S+
diff --git a/mikrotik-tool/edge-v6-apply.rsc b/mikrotik-tool/edge-v6-apply.rsc
new file mode 100644
index 0000000..14ad538
--- /dev/null
+++ b/mikrotik-tool/edge-v6-apply.rsc
@@ -0,0 +1,168 @@
+# =============================================================================
+# edge — IPv6 apply script (ROS 6.49.18, BGP-only / no OSPFv3)
+# =============================================================================
+#
+# Edge is the iBGP hub: it terminates the TWC v6 eBGP peering and the v4
+# transport iBGP sessions to every tower. v6 NLRI rides v4 transport (so the
+# existing v4 OSPF reachability between loopbacks is reused; no v6 IGP is
+# needed). This matches the verona-v6-apply.rsc design choice.
+#
+# Two paths edge<->core:
+#   1. PRIMARY: sfp-sfpplus11-preseem, /127 via the Preseem shaper
+#      (transparent L2). OSPFv2 cost on edge is the default 10. v6 P2P:
+#      2606:1c80:0:1002::1 (edge) <-> :2 (core)
+#   2. BACKUP: sfp-sfpplus7-core-direct, /127 direct fiber. OSPFv2 cost on
+#      edge is 100 (same on core's side). v6 P2P:
+#      2606:1c80:0:11::1 (edge) <-> :2 (core)
+# Static v6 routes for the infra /48 mirror that cost relationship by
+# distance (lower = preferred): preseem at distance=1, direct at
+# distance=2.
+#
+# What this script DOES NOT touch (USER CONSTRAINT 2026-05-09):
+#   * TWC v6 eBGP peer `twc-v6` (remote 2605:6000:0:8::f:372, AS11427) —
+#     name doesn't match the ^ibgp- wipe pattern, so it survives.
+#   * The 2606:1c80::/32 BGP network announcement upstream.
+#   * The TWC P2P address 2605:6000:0:8::f:373/127 on sfp-sfpplus12-spectrum
+#     — enabled, so it survives the [find disabled=yes] wipe.
+#   * The existing server LAN address 2606:1c80::1 on vlan9_sfpplus8 —
+#     enabled, so it survives. We only ADD a per-interface ND override
+#     to suppress RA there; the IP and prefix are unmodified.
+#   * v4 OSPFv2 / RIP / firewall rules — v4 control plane is unchanged.
+#
+# Apply order: review -> paste in winbox/SSH on edge -> verify with checks
+# at the bottom -> only then run the matching `core-v6-apply.rsc` so the
+# preseem and direct /127 endpoints come up symmetrically.
+# =============================================================================
+
+# -----------------------------------------------------------------------------
+# WIPE — only the stale internal-only v6 state on edge. Leaves TWC peering,
+# the upstream /32 announcement, the server LAN address, and v4 alone.
+# -----------------------------------------------------------------------------
+# Drop any disabled placeholder v6 internal addresses (none on edge today,
+# but harmless if present).
+/ipv6 address remove [find disabled=yes]
+
+# Drop any leftover OSPFv3 interface entries (we are committing to BGP-only
+# for v6; any v3 instances on edge have been minimal/stub).
+/routing ospf-v3 interface remove [find]
+
+# Drop only internal iBGP v6 peers if any exist; never touch twc-v6.
+/routing bgp peer remove [find name~"^ibgp-" and address-families~"ipv6"]
+
+# -----------------------------------------------------------------------------
+# APPLY — addresses
+# -----------------------------------------------------------------------------
+/ipv6 settings set forward=yes accept-router-advertisements=no
+
+/ipv6 address
+add address=2606:1c80:0:10::254/128 interface=loopback advertise=no comment="edge loopback"
+add address=2606:1c80:0:11::1/127   interface=sfp-sfpplus7-core-direct advertise=no comment="P2P edge<->core direct (backup)"
+add address=2606:1c80:0:1002::1/127 interface=sfp-sfpplus11-preseem    advertise=no comment="P2P edge<->core via preseem (primary)"
+
+# NOTE: the server LAN address 2606:1c80::1 on vlan9_sfpplus8 is left
+# untouched per user constraint. The ND override below makes it RA-free
+# without modifying the address itself.
+
+# -----------------------------------------------------------------------------
+# APPLY — neighbour discovery: SUPPRESS RA on the server LAN
+# -----------------------------------------------------------------------------
+# Server LAN is static-only per the IPv6 plan — disable RA + DHCPv6 hints.
+# A per-interface entry overrides the global default.
+/ipv6 nd
+add interface=vlan9_sfpplus8 disabled=no advertise=no managed-address-configuration=no other-configuration=no comment="server LAN: static only, no SLAAC"
+
+# -----------------------------------------------------------------------------
+# APPLY — static routes (replace what an IGP would have learned)
+# -----------------------------------------------------------------------------
+# Infra /48 covers all router loopbacks (2606:1c80:0:10::/64), all P2P
+# /127s, and any future infra slots. Two entries with different distances
+# pin preseem as primary and direct as backup. The connected /64 server
+# LAN at 2606:1c80::/64 wins by longest-prefix-match, so this /48 doesn't
+# steal local server traffic.
+/ipv6 route
+add dst-address=2606:1c80::/48 gateway=2606:1c80:0:1002::2 distance=1 comment="infra: via preseem (primary)"
+add dst-address=2606:1c80::/48 gateway=2606:1c80:0:11::2   distance=2 comment="infra: via direct (backup)"
+
+# Tower /44s are learned via iBGP from each tower (next-hop = tower's v6
+# loopback inside :10::/64, recursively resolved through the /48 above).
+# No static needed for them.
+
+# -----------------------------------------------------------------------------
+# APPLY — firewall (extend the existing minimal v6 ruleset)
+# -----------------------------------------------------------------------------
+# The existing v6 firewall already accepts BGP (179) and established. Add
+# the rules required for internal-network forwarding + ICMPv6 / link-local.
+/ipv6 firewall filter
+add chain=input  action=accept protocol=icmpv6                  comment="icmpv6 input"
+add chain=input  action=accept src-address=fe80::/10            comment="link-local input"
+add chain=input  action=accept src-address=2606:1c80::/32       comment="internal input"
+
+add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD forward"
+add chain=forward action=accept protocol=icmpv6                   comment="icmpv6 forward"
+add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal<->internal"
+
+# (we do not add a default-deny; edge has long-running customer transit
+# paths and a sudden v6 default-deny would break them. existing rules at
+# the bottom of /ipv6 firewall filter remain authoritative.)
+
+# -----------------------------------------------------------------------------
+# APPLY — iBGP route filters (v6)
+# -----------------------------------------------------------------------------
+# in-filter: accept any /44 inside the tower allocation block 2606:1c80:1000::/36.
+# Anything else from a tower iBGP peer is rejected (defense in depth — we
+# don't want a tower advertising the world to us).
+/routing filter
+add chain=ibgp-tower-in-v6  prefix=2606:1c80:1000::/36 prefix-length=44     action=accept comment="tower /44 customer aggregate"
+add chain=ibgp-tower-in-v6  prefix=2606:1c80:0:10::/64 prefix-length=128    action=accept comment="tower v6 loopback"
+add chain=ibgp-tower-in-v6  action=discard                                   comment="default deny"
+
+# out-filter: edge sends ONLY the v6 default to towers. Towers don't need
+# anything else from edge — they reach customers via their own routes and
+# transit upstream via the default.
+add chain=ibgp-tower-out-v6 prefix=::/0 prefix-length=0 action=accept comment="default route to tower"
+add chain=ibgp-tower-out-v6 action=discard                            comment="default deny"
+
+# -----------------------------------------------------------------------------
+# APPLY — iBGP peer to verona (over v4 transport, carrying v6 NLRI)
+# -----------------------------------------------------------------------------
+# ROS6 syntax: address-families=ipv6 with a v4 remote-address gives
+# MP-BGP v6-NLRI-over-v4-TCP. update-source=loopback ensures the TCP
+# session sources from the v4 loopback (10.254.254.254).
+# nexthop-choice=force-self pins the v6 next-hop edge advertises to
+# its own v6 loopback (2606:1c80:0:10::254), reachable from verona once
+# climax has its v6 apply.
+/routing bgp peer
+add name=ibgp-verona-v6 \
+    remote-address=10.254.254.101 remote-as=393837 \
+    update-source=loopback \
+    address-families=ipv6 \
+    nexthop-choice=force-self \
+    in-filter=ibgp-tower-in-v6 out-filter=ibgp-tower-out-v6 \
+    default-originate=always \
+    comment="iBGP to verona, v4 transport / v6 NLRI"
+
+# -----------------------------------------------------------------------------
+# VERIFY (paste after apply)
+# -----------------------------------------------------------------------------
+# /ipv6 address print
+# /ipv6 route print where active
+# /ipv6 nd print
+# /routing bgp peer print where name~"v6"
+# /routing bgp advertisements print peer=ibgp-verona-v6
+#
+# Expected immediately:
+#   * /ipv6 address print  shows 2606:1c80:0:10::254/128 (loopback),
+#     :11::1/127 (direct), :1002::1/127 (preseem), :1::/64 server LAN
+#   * /ipv6 nd print  shows the vlan9_sfpplus8 entry with advertise=no
+#   * the new /48 routes show as inactive (gateway unreachable until core
+#     applies), which is fine
+#   * ibgp-verona-v6 is in `connecting` state until verona reaches edge's
+#     v6 loopback (which needs core configured) — for the bare TCP
+#     session, v4 loopback reachability is enough so the session SHOULD
+#     come up immediately. confirm with /routing bgp peer print.
+#
+# Once core has its matching v6 apply:
+#   /ping 2606:1c80:0:1002::2 count=3   ;; core preseem-side
+#   /ping 2606:1c80:0:11::2 count=3     ;; core direct-side
+#   /ping 2606:1c80:0:10::253 count=3   ;; core loopback (via preseem)
+#   /ip route check dst=2606:1c80:0:10::101  ;; verona loopback path
diff --git a/mikrotik-tool/edge.rsc b/mikrotik-tool/edge.rsc
index 5984b42..be3ab0d 100644
--- a/mikrotik-tool/edge.rsc
+++ b/mikrotik-tool/edge.rsc
@@ -1,4 +1,4 @@
-# may/09/2026 09:00:22 by RouterOS 6.49.18
+# may/09/2026 09:26:02 by RouterOS 6.49.18
 # software id = 8XZE-R7EJ
 #
 # model = CCR2004-1G-12S+2XS
@@ -65,6 +65,8 @@ set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
 set discover-interface-list=!dynamic
 /ip settings
 set rp-filter=strict tcp-syncookies=yes
+/ipv6 settings
+set accept-router-advertisements=no
 /ip address
 add address=71.41.226.118/30 interface=sfp-sfpplus12-spectrum network=\
     71.41.226.116
@@ -530,6 +532,12 @@ set always-allow-password-login=yes forwarding-enabled=remote strong-crypto=\
 add address=2605:6000:0:8::f:373/127 advertise=no interface=\
     sfp-sfpplus12-spectrum
 add address=2606:1c80::1 interface=vlan9_sfpplus8
+add address=2606:1c80:0:10::254/128 advertise=no comment="edge loopback" \
+    interface=loopback
+add address=2606:1c80:0:11::1/127 advertise=no comment=\
+    "P2P edge<->core direct (backup)" interface=sfp-sfpplus7-core-direct
+add address=2606:1c80:0:1002::1/127 advertise=no comment=\
+    "P2P edge<->core via preseem (primary)" interface=sfp-sfpplus11-preseem
 /ipv6 firewall address-list
 add address=2606:1c80::/32 list=bgp-networks
 /ipv6 firewall filter
@@ -545,6 +553,21 @@ add action=accept chain=input comment="IPv6 Established Input" \
     connection-state=established,related
 add action=accept chain=forward comment="IPv6 Established Forward" \
     connection-state=established,related
+add action=accept chain=input comment="icmpv6 input" protocol=icmpv6
+add action=accept chain=input comment="link-local input" src-address=\
+    fe80::/10
+add action=accept chain=input comment="internal input" src-address=\
+    2606:1c80::/32
+add action=accept chain=forward comment="PMTUD forward" hop-limit=equal:1 \
+    protocol=icmpv6
+add action=accept chain=forward comment="icmpv6 forward" protocol=icmpv6
+add action=accept chain=forward comment=internal<->internal dst-address=\
+    2606:1c80::/32 src-address=2606:1c80::/32
+/ipv6 route
+add comment="infra: via preseem (primary)" distance=1 dst-address=\
+    2606:1c80::/48 gateway=2606:1c80:0:1002::2
+add comment="infra: via direct (backup)" distance=2 dst-address=\
+    2606:1c80::/48 gateway=2606:1c80:0:11::2
 /mpls interface
 set [ find default=yes ] mpls-mtu=1530
 add interface=sfp-sfpplus8-server-switch mpls-mtu=1530
@@ -584,6 +607,10 @@ add comment="TEAM-CYMRU BOGON Server #2" disabled=yes in-filter=\
 add address-families=ip,ipv6 default-originate=always disabled=yes name=\
     edge_core_preseem nexthop-choice=propagate out-filter=bgp-default-only \
     remote-address=204.110.191.185 remote-as=393837
+add address-families=ipv6 comment="iBGP to verona, v4 transport / v6 NLRI" \
+    default-originate=always in-filter=ibgp-tower-in-v6 name=ibgp-verona-v6 \
+    nexthop-choice=force-self out-filter=ibgp-tower-out-v6 remote-address=\
+    10.254.254.101 remote-as=393837 update-source=loopback
 /routing filter
 add action=accept chain=twc-out comment=blackhole disabled=yes prefix=\
     204.110.188.197 prefix-length=32 set-bgp-communities=7486:666
@@ -603,6 +630,15 @@ add action=accept chain=bgp-default-only disabled=yes prefix=0.0.0.0/0 \
     prefix-length=0
 add action=discard chain=bgp-default-only disabled=yes prefix=0.0.0.0/0 \
     prefix-length=0-32
+add action=accept chain=ibgp-tower-in-v6 comment=\
+    "tower /44 customer aggregate" prefix=2606:1c80:1000::/36 prefix-length=\
+    44
+add action=accept chain=ibgp-tower-in-v6 comment="tower v6 loopback" prefix=\
+    2606:1c80:0:10::/64 prefix-length=128
+add action=discard chain=ibgp-tower-in-v6 comment="default deny"
+add action=accept chain=ibgp-tower-out-v6 comment="default route to tower" \
+    prefix=::/0 prefix-length=0
+add action=discard chain=ibgp-tower-out-v6 comment="default deny"
 /routing ospf interface
 add interface=sfp-sfpplus12-spectrum network-type=broadcast passive=yes
 add interface=sfp-sfpplus11-preseem network-type=point-to-point use-bfd=yes
@@ -623,10 +659,6 @@ add address=204.110.191.185 poll-interval=10s
 add address=204.110.191.252 poll-interval=10s
 /routing ospf network
 add area=backbone
-/routing ospf-v3 interface
-add area=backbone
-add area=backbone interface=sfp-sfpplus12-spectrum network-type=broadcast \
-    passive=yes
 /routing rip
 set distribute-default=always redistribute-connected=yes redistribute-ospf=\
     yes
diff --git a/mikrotik-tool/lowry.rsc b/mikrotik-tool/lowry.rsc
index 2eae334..b0bb0b0 100644
--- a/mikrotik-tool/lowry.rsc
+++ b/mikrotik-tool/lowry.rsc
@@ -1,4 +1,4 @@
-# 2026-05-09 09:00:22 by RouterOS 7.21.4
+# 2026-05-09 09:26:03 by RouterOS 7.21.4
 # software id = 2I9X-PQZP
 #
 # model = CCR1009-7G-1C-1S+
diff --git a/mikrotik-tool/newhope.rsc b/mikrotik-tool/newhope.rsc
index 8d29c4f..3a769b2 100644
--- a/mikrotik-tool/newhope.rsc
+++ b/mikrotik-tool/newhope.rsc
@@ -1,4 +1,4 @@
-# 2026-05-09 09:00:22 by RouterOS 7.21.4
+# 2026-05-09 09:26:03 by RouterOS 7.21.4
 # software id = 5HTF-YFWV
 #
 # model = CCR1009-7G-1C-1S+
diff --git a/mikrotik-tool/verona.rsc b/mikrotik-tool/verona.rsc
index 7ee997e..14a2b79 100644
--- a/mikrotik-tool/verona.rsc
+++ b/mikrotik-tool/verona.rsc
@@ -1,4 +1,4 @@
-# 2026-05-09 09:00:22 by RouterOS 7.21.4
+# 2026-05-09 09:26:02 by RouterOS 7.21.4
 # software id = Y1CT-1WB1
 #
 # model = CCR2004-16G-2S+