diff --git a/CLAUDE.md b/CLAUDE.md
index aab9928..03ea0e7 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -246,6 +246,33 @@ Per-tower /44s + central server LAN at `2606:1c80::/64` on edge. Full
 allocation plan in `mikrotik-tool/ipv6.md`. NetBox has these as IPAM
 prefixes.
 
+### graham's home network — IPv6
+Home (`RB5009`, identity `graham`, `10.0.19.254`) takes a **`/56`** from
+verona via DHCPv6-PD on `ether5-vntx-static` (verona's `verona-wired-pd`
+dhcp-server on `vlan9_sfpplus1`, drawing from `verona-cust-pd-1`).
+Currently `2606:1c80:1001:e00::/56`. Key config on home:
+- `/ipv6 dhcp-client` on `ether5-vntx-static`: `request=prefix`,
+  `pool-name=home-pd-vntx`, **`pool-prefix-length=64`** (must be 64, not
+  56, so the pool yields /64s — changing this only takes effect on a
+  client disable/enable, not live), `default-route-tables=v6-verona`.
+- `/ipv6 address` with `from-pool=home-pd-vntx address=::1 advertise=yes`
+  on `bridge` (→ `:e00::1/64`) and `ether3-servers` (→ `:e01::1/64`).
+  Remaining 254 /64s of the /56 stay in the pool for internal use.
+- Egress policy: `/routing rule` `src-address=2606:1c80::/32
+  action=lookup-only-in-table table=v6-verona` — the verona /56 is
+  single-homed, so traffic sourced from it must egress via verona only
+  (T-Mobile/Starlink would BCP38-drop it). No v6 WAN failover for the
+  internal /56, by design. The PD client's default lands in the
+  `v6-verona` table, not `main`.
+- Stateless DHCPv6 servers (`home-bridge-stateless`,
+  `home-servers-stateless`) carry the `v6-dns` option (Cloudflare).
+- Stale `tunnerbroker` `/ipv6 pool` (HE.net `2001:470:ba50::/48`) is
+  unused — leave or remove.
+- The `mikrotik-tool script` SSH path can't handle bare ROS verbs like
+  `release`/`disable`/`enable` or `:delay` (flattenRSC only knows
+  add/set/remove/print/get) — use `set [find] disabled=yes/no` instead,
+  and sequence delays from the shell side.
+
 ## Claude Assistant Guidelines
 
 - Any time Claude learns something new, automatically add it to CLAUDE.md
diff --git a/mikrotik-tool/494.rsc b/mikrotik-tool/494.rsc
index 57dae6a..4fefb7d 100644
--- a/mikrotik-tool/494.rsc
+++ b/mikrotik-tool/494.rsc
@@ -1,4 +1,4 @@
-# 2026-05-14 08:38:20 by RouterOS 7.21.4
+# 2026-05-14 09:28:51 by RouterOS 7.21.4
 # software id = K4QG-8NQV
 #
 # model = RB5009UG+S+
@@ -218,7 +218,7 @@ add add-arp=yes address-pool=mgmt interface=management lease-script="{\
 /ip smb users
 set [ find default=yes ] disabled=yes
 /ipv6 dhcp-server option
-add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
+add code=23 name=v6-dns value="'2606:1c80::240''2606:1c80::250'"
 /ipv6 pool
 add name=494-cust-pd-1 prefix=2606:1c80:1a01::/48 prefix-length=56
 /ppp profile
@@ -412,7 +412,7 @@ add address=10.10.160.0/20 dns-server=204.110.191.240,204.110.191.20 domain=\
 add address=100.64.160.0/20 dns-server=204.110.191.240,204.110.191.20 domain=\
     vntx.net gateway=100.64.175.254 ntp-server=204.110.191.19
 /ip dns
-set servers=9.9.9.9,1.1.1.1
+set servers=9.9.9.9,1.1.1.1,2606:1c80::240,2606:1c80::250
 /ip firewall address-list
 add address=154.66.115.255 list=CPF
 add address=10.0.0.0/8 list=CPF
@@ -467,7 +467,7 @@ add address=2606:1c80:0:17::2 advertise=no comment="P2P 494<->climax" \
     interface=ether2-climax
 add address=2606:1c80:1a00::1 comment="494 mgmt LAN" interface=management
 /ipv6 dhcp-server
-add interface=management name=494-mgmt-stateless
+add dhcp-option=v6-dns interface=management name=494-mgmt-stateless
 /ipv6 firewall filter
 add action=accept chain=input comment=established connection-state=\
     established,related
diff --git a/mikrotik-tool/982.rsc b/mikrotik-tool/982.rsc
index 5e3f49a..b61a263 100644
--- a/mikrotik-tool/982.rsc
+++ b/mikrotik-tool/982.rsc
@@ -1,4 +1,4 @@
-# 2026-05-14 08:38:20 by RouterOS 7.21.4
+# 2026-05-14 09:28:52 by RouterOS 7.21.4
 # software id = FUVS-HCM5
 #
 # model = CCR1009-7G-1C-1S+
@@ -121,7 +121,7 @@ add address-pool=mgmt interface=mgmt lease-script="{\
 /ip smb users
 set [ find default=yes ] disabled=yes
 /ipv6 dhcp-server option
-add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
+add code=23 name=v6-dns value="'2606:1c80::240''2606:1c80::250'"
 /ipv6 pool
 add name=982-cust-pd-1 prefix=2606:1c80:1301::/48 prefix-length=56
 /ppp profile
@@ -325,7 +325,7 @@ add address=10.10.48.0/20 dns-server=204.110.191.240,204.110.191.20 domain=\
 add address=100.64.28.0/22 dns-server=204.110.191.240,204.110.191.20 domain=\
     vntx.net gateway=100.64.31.254 ntp-server=204.110.191.19
 /ip dns
-set servers=9.9.9.9,1.1.1.1
+set servers=9.9.9.9,1.1.1.1,2606:1c80::240,2606:1c80::250
 /ip firewall address-list
 add address=100.64.35.199 comment="Scott Anderson (2203)" list=BusinessUltra
 add address=100.64.35.199 comment="Scott Anderson (2203)" list=Active
@@ -413,7 +413,7 @@ add address=2606:1c80:0:14::2 advertise=no comment="P2P 982<->core (60GHz)" \
     interface=ether7-380
 add address=2606:1c80:1300::1 comment="982 mgmt LAN" interface=mgmt
 /ipv6 dhcp-server
-add interface=mgmt name=982-mgmt-stateless
+add dhcp-option=v6-dns interface=mgmt name=982-mgmt-stateless
 /ipv6 firewall filter
 add action=accept chain=input comment=established connection-state=\
     established,related
diff --git a/mikrotik-tool/climax.rsc b/mikrotik-tool/climax.rsc
index 1f722ea..7dcd81c 100644
--- a/mikrotik-tool/climax.rsc
+++ b/mikrotik-tool/climax.rsc
@@ -1,4 +1,4 @@
-# 2026-05-14 08:38:19 by RouterOS 7.21.4
+# 2026-05-14 09:28:51 by RouterOS 7.21.4
 # software id = UETF-WF31
 #
 # model = CCR2004-16G-2S+
@@ -134,7 +134,7 @@ add address-pool=climax-mgmt interface=mgmt lease-script="{\
     \n}\
     \n" name=climax-mgmt
 /ipv6 dhcp-server option
-add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
+add code=23 name=v6-dns value="'2606:1c80::240''2606:1c80::250'"
 /ipv6 pool
 add name=climax-cust-pd-1 prefix=2606:1c80:1101::/48 prefix-length=56
 /ppp profile
@@ -333,7 +333,7 @@ add address=100.64.4.0/22 dns-server=204.110.191.240,204.110.191.20 domain=\
 add address=204.110.188.32/27 dns-server=204.110.191.240,204.110.191.20 \
     domain=vntx.net gateway=204.110.188.62 ntp-server=204.110.191.19
 /ip dns
-set servers=9.9.9.9,1.1.1.1
+set servers=9.9.9.9,1.1.1.1,2606:1c80::240,2606:1c80::250
 /ip firewall filter
 add action=accept chain=forward comment=\
     "bypass fasttrack for MPLS spine (out)" out-interface=ether5-494
@@ -431,9 +431,9 @@ add address=2606:1c80:1100:1::1 comment="climax customer LAN (PPPoE+DHCP)" \
 /ipv6 dhcp-relay option
 set client_mac value="0x0001\$(CLIENT_MAC)"
 /ipv6 dhcp-server
-add interface=mgmt name=climax-mgmt-stateless
-add address-pool=climax-cust-pd-1 interface=climax-bridge name=\
-    climax-cust-pd-server
+add dhcp-option=v6-dns interface=mgmt name=climax-mgmt-stateless
+add address-pool=climax-cust-pd-1 dhcp-option=v6-dns interface=climax-bridge \
+    name=climax-cust-pd-server
 /ipv6 firewall filter
 add action=accept chain=input comment=established connection-state=\
     established,related
diff --git a/mikrotik-tool/core.rsc b/mikrotik-tool/core.rsc
index 299b00c..ec6e51d 100644
--- a/mikrotik-tool/core.rsc
+++ b/mikrotik-tool/core.rsc
@@ -1,4 +1,4 @@
-# 2026-05-14 08:38:20 by RouterOS 7.21.4
+# 2026-05-14 09:28:52 by RouterOS 7.21.4
 # software id = XS5B-41QR
 #
 # model = CCR1009-7G-1C-1S+
@@ -221,7 +221,7 @@ add address-pool=380-mgmt interface=vlan10_combo1 lease-script="{\
 /ip smb users
 set [ find default=yes ] disabled=yes
 /ipv6 dhcp-server option
-add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
+add code=23 name=v6-dns value="'2606:1c80::240''2606:1c80::250'"
 /ipv6 pool
 add name=core-cust-pd-1 prefix=2606:1c80:1401::/48 prefix-length=56
 /ppp profile
@@ -410,7 +410,7 @@ add address=10.10.64.0/20 dns-server=204.110.191.240,204.110.191.20 domain=\
 add address=100.64.8.0/22 dns-server=204.110.191.240,204.110.191.20 domain=\
     vntx.net gateway=100.64.11.254 ntp-server=204.110.191.19
 /ip dns
-set servers=9.9.9.9,1.1.1.1
+set servers=9.9.9.9,1.1.1.1,2606:1c80::240,2606:1c80::250
 /ip firewall filter
 add action=accept chain=forward comment=\
     "bypass fasttrack for MPLS spine (out)" out-interface=ether1-982-60ghz
@@ -534,8 +534,9 @@ add address=2606:1c80:1400::1 comment="380 mgmt LAN" interface=vlan10_combo1
 add address=2606:1c80:1400:1::1 comment="380 customer LAN (PPPoE+DHCP)" \
     interface=combo1-380
 /ipv6 dhcp-server
-add interface=vlan10_combo1 name=core-mgmt-stateless
-add address-pool=core-cust-pd-1 interface=combo1-380 name=core-cust-pd-server
+add dhcp-option=v6-dns interface=vlan10_combo1 name=core-mgmt-stateless
+add address-pool=core-cust-pd-1 dhcp-option=v6-dns interface=combo1-380 name=\
+    core-cust-pd-server
 /ipv6 firewall filter
 add action=accept chain=input comment=established connection-state=\
     established,related
diff --git a/mikrotik-tool/culleoka.rsc b/mikrotik-tool/culleoka.rsc
index ebcd1f0..d07e559 100644
--- a/mikrotik-tool/culleoka.rsc
+++ b/mikrotik-tool/culleoka.rsc
@@ -1,4 +1,4 @@
-# 2026-05-14 08:38:20 by RouterOS 7.21.4
+# 2026-05-14 09:28:52 by RouterOS 7.21.4
 # software id = HVP9-3G0K
 #
 # model = CCR1009-7G-1C-1S+
@@ -213,7 +213,7 @@ add address-pool=clayton disabled=yes interface=vlan_30_clayton lease-time=\
 /ip smb users
 set [ find default=yes ] disabled=yes
 /ipv6 dhcp-server option
-add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
+add code=23 name=v6-dns value="'2606:1c80::240''2606:1c80::250'"
 /ipv6 pool
 add name=culleoka-cust-pd-1 prefix=2606:1c80:1601::/48 prefix-length=56
 /ppp profile
@@ -536,7 +536,7 @@ add address=204.110.188.128/27 dns-server=204.110.191.240,204.110.191.20 \
 /ip dhcp-server option sets
 add name=vntx options=*1
 /ip dns
-set servers=9.9.9.9,1.1.1.1
+set servers=9.9.9.9,1.1.1.1,2606:1c80::240,2606:1c80::250
 /ip firewall address-list
 add address=10.254.254.104 disabled=yes list=bgp-networks
 add address=10.10.96.0/20 disabled=yes list=bgp-networks
@@ -617,7 +617,7 @@ add address=2606:1c80:0:21::2 advertise=no comment=\
     "P2P culleoka<->climax (radio DOWN)" interface=ether1-climax-11ghz
 add address=2606:1c80:1600::1 comment="culleoka mgmt LAN" interface=mgmt
 /ipv6 dhcp-server
-add interface=mgmt name=culleoka-mgmt-stateless
+add dhcp-option=v6-dns interface=mgmt name=culleoka-mgmt-stateless
 /ipv6 firewall filter
 add action=accept chain=input comment=established connection-state=\
     established,related
diff --git a/mikrotik-tool/edge.rsc b/mikrotik-tool/edge.rsc
index 7d26c03..f7d1784 100644
--- a/mikrotik-tool/edge.rsc
+++ b/mikrotik-tool/edge.rsc
@@ -1,4 +1,4 @@
-# may/14/2026 08:38:19 by RouterOS 6.49.18
+# may/14/2026 09:28:51 by RouterOS 6.49.18
 # software id = 8XZE-R7EJ
 #
 # model = CCR2004-1G-12S+2XS
diff --git a/mikrotik-tool/home.rsc b/mikrotik-tool/home.rsc
index 321bdce..d3bc6d2 100644
--- a/mikrotik-tool/home.rsc
+++ b/mikrotik-tool/home.rsc
@@ -1,4 +1,4 @@
-# 2026-05-14 08:38:20 by RouterOS 7.22.3
+# 2026-05-14 09:28:51 by RouterOS 7.22.3
 # software id = ZGNY-ZJW7
 #
 # model = RB5009UG+S+
@@ -51,6 +51,7 @@ set 0 kind=fq-codel
 /routing table
 add disabled=no fib name=vntx
 add disabled=no fib name=tmo
+add comment="vntx v6 /56 egress via verona" disabled=no fib name=v6-verona
 /snmp community
 set [ find default=yes ] addresses=10.0.16.0/22,10.0.0.0/8,204.110.188.0/22 \
     name=kdyyJrT0Mm
@@ -455,18 +456,19 @@ set enabled=yes
 add disabled=yes interface=ether6-tmobile type=external
 add interface=*14 type=external
 add interface=bridge type=internal
+/ipv6 address
+add address=::1 comment="home LAN (verona PD /64)" from-pool=home-pd-vntx \
+    interface=bridge
+add address=::1:0:0:0:1 comment="servers LAN (verona PD /64)" from-pool=\
+    home-pd-vntx interface=ether3-servers
 /ipv6 dhcp-client
-add add-default-route=yes comment=\
-    "DHCPv6-PD from TMHI (disabled - TMHI runs SLAAC only, no PD server)" \
-    disabled=yes interface=ether6-tmobile pool-name=home-pd \
-    pool-prefix-length=64 prefix-hint=::/56 request=address,prefix
-add add-default-route=yes comment=\
-    "DHCPv6-PD from verona (disabled, fallback)" default-route-distance=2 \
-    interface=ether5-vntx-static pool-name=home-pd-vntx pool-prefix-length=56 \
-    request=prefix
+add add-default-route=yes comment="DHCPv6-PD /56 from verona" \
+    default-route-distance=2 default-route-tables=v6-verona interface=\
+    ether5-vntx-static pool-name=home-pd-vntx pool-prefix-length=64 request=\
+    prefix
 /ipv6 dhcp-server
-add interface=bridge name=home-bridge-stateless
-add interface=ether3-servers name=home-servers-stateless
+add dhcp-option=v6-dns interface=bridge name=home-bridge-stateless
+add dhcp-option=v6-dns interface=ether3-servers name=home-servers-stateless
 /ipv6 firewall filter
 add action=accept chain=input comment=established connection-state=\
     established,related
@@ -494,6 +496,8 @@ add advertise-dns=yes interface=ether3-servers other-configuration=yes
 /routing rule
 add action=lookup-only-in-table disabled=no dst-address=0.0.0.0/0 \
     src-address=10.0.16.1 table=*400
+add action=lookup-only-in-table comment="vntx /56 egress via verona only" \
+    src-address=2606:1c80::/32 table=v6-verona
 /snmp
 set contact="Graham McIntire" enabled=yes location=Verona
 /system clock
diff --git a/mikrotik-tool/lowry.rsc b/mikrotik-tool/lowry.rsc
index 0d1a2fb..92e6f94 100644
--- a/mikrotik-tool/lowry.rsc
+++ b/mikrotik-tool/lowry.rsc
@@ -1,4 +1,4 @@
-# 2026-05-14 08:38:20 by RouterOS 7.21.4
+# 2026-05-14 09:28:52 by RouterOS 7.21.4
 # software id = 2I9X-PQZP
 #
 # model = CCR1009-7G-1C-1S+
@@ -144,7 +144,7 @@ add address-pool=mgmt interface=management lease-script="{\
 /ip smb users
 set [ find default=yes ] disabled=yes
 /ipv6 dhcp-server option
-add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
+add code=23 name=v6-dns value="'2606:1c80::240''2606:1c80::250'"
 /ipv6 pool
 add name=lowry-cust-pd-1 prefix=2606:1c80:1901::/48 prefix-length=56
 /ppp profile
@@ -503,7 +503,7 @@ add address=204.110.188.192/27 dns-server=204.110.191.240,204.110.191.20 \
 /ip dhcp-server option sets
 add name=vntx options=*1
 /ip dns
-set servers=9.9.9.9,1.1.1.1
+set servers=9.9.9.9,1.1.1.1,2606:1c80::240,2606:1c80::250
 /ip firewall address-list
 add address=204.110.191.229 list=whitelist
 add address=portal.vntx.net list=whitelist
@@ -1288,7 +1288,7 @@ add address=2606:1c80:0:18::2 advertise=no comment="P2P lowry<->newhope" \
     interface=ether1-newhope
 add address=2606:1c80:1900::1 comment="lowry mgmt LAN" interface=management
 /ipv6 dhcp-server
-add interface=management name=lowry-mgmt-stateless
+add dhcp-option=v6-dns interface=management name=lowry-mgmt-stateless
 /ipv6 firewall filter
 add action=accept chain=input comment=established connection-state=\
     established,related
diff --git a/mikrotik-tool/mikrotik-tool b/mikrotik-tool/mikrotik-tool
index 8ab4b43..b659c31 100755
Binary files a/mikrotik-tool/mikrotik-tool and b/mikrotik-tool/mikrotik-tool differ
diff --git a/mikrotik-tool/newhope.rsc b/mikrotik-tool/newhope.rsc
index d5af8b8..33ebac6 100644
--- a/mikrotik-tool/newhope.rsc
+++ b/mikrotik-tool/newhope.rsc
@@ -1,4 +1,4 @@
-# 2026-05-14 08:38:20 by RouterOS 7.21.4
+# 2026-05-14 09:28:52 by RouterOS 7.21.4
 # software id = 5HTF-YFWV
 #
 # model = CCR1009-7G-1C-1S+
@@ -151,7 +151,7 @@ add address-pool=dhcp_pool6 interface=ether7-tower lease-time=1h name=\
 /ip smb users
 set [ find default=yes ] disabled=yes
 /ipv6 dhcp-server option
-add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
+add code=23 name=v6-dns value="'2606:1c80::240''2606:1c80::250'"
 /ipv6 pool
 add name=newhope-cust-pd-1 prefix=2606:1c80:1801::/48 prefix-length=56
 /ppp profile
@@ -456,7 +456,7 @@ add address=204.110.188.160/27 dns-server=204.110.191.240,204.110.191.20 \
 /ip dhcp-server option sets
 add name=vntx options=*1
 /ip dns
-set servers=9.9.9.9,1.1.1.1
+set servers=9.9.9.9,1.1.1.1,2606:1c80::240,2606:1c80::250
 /ip firewall filter
 add action=accept chain=forward comment=\
     "bypass fasttrack for MPLS spine (out)" out-interface=\
@@ -548,7 +548,7 @@ add address=2606:1c80:0:18::1 advertise=no comment="P2P newhope<->lowry" \
 add address=2606:1c80:1800::1 comment="newhope mgmt LAN" interface=\
     bridge_cpe_mgmt
 /ipv6 dhcp-server
-add interface=bridge_cpe_mgmt name=newhope-mgmt-stateless
+add dhcp-option=v6-dns interface=bridge_cpe_mgmt name=newhope-mgmt-stateless
 /ipv6 firewall filter
 add action=accept chain=input comment=established connection-state=\
     established,related
diff --git a/mikrotik-tool/verona.rsc b/mikrotik-tool/verona.rsc
index f95b542..4c163cc 100644
--- a/mikrotik-tool/verona.rsc
+++ b/mikrotik-tool/verona.rsc
@@ -1,4 +1,4 @@
-# 2026-05-14 08:38:20 by RouterOS 7.21.4
+# 2026-05-14 09:28:51 by RouterOS 7.21.4
 # software id = Y1CT-1WB1
 #
 # model = CCR2004-16G-2S+
@@ -174,14 +174,8 @@ add address-pool=verona-cgnat addresses-per-mac=unlimited interface=verona \
     name=hotspot1 profile=hsprof1
 /ip smb users
 set [ find default=yes ] disabled=yes
-/ipv6 dhcp-server
-add address-pool=verona-cust-pd-1 interface=verona name=verona-cust-pd-server
-add address-pool=altoga-cust-pd-1 interface=ether6-switch name=\
-    altoga-cust-pd-server
-add interface=vlan9_sfpplus1 name=verona-wired-pd prefix-pool=\
-    verona-cust-pd-1
 /ipv6 dhcp-server option
-add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
+add code=23 name=v6-dns value="'2606:1c80::240''2606:1c80::250'"
 /ipv6 pool
 add name=verona-cust-pd-1 prefix=2606:1c80:1001::/48 prefix-length=56
 add name=altoga-cust-pd-1 prefix=2606:1c80:1501::/48 prefix-length=56
@@ -615,7 +609,7 @@ add address=204.110.188.224/27 dns-server=204.110.191.240,204.110.191.250 \
 /ip dhcp-server option sets
 add name=vntx options=*1
 /ip dns
-set servers=9.9.9.9,1.1.1.1
+set servers=9.9.9.9,1.1.1.1,2606:1c80::240,2606:1c80::250
 /ip firewall address-list
 add address=204.110.188.225 comment="Graham McIntire (1)" list=VeronaEmployee
 add address=204.110.188.231 comment="James Hardin (1475)" list=VeronaEmployee
@@ -916,6 +910,13 @@ add address=2606:1c80:1500::1 comment="altoga mgmt LAN" interface=\
     ether6-switch
 add address=2606:1c80:0:30::1 advertise=no comment="P2P verona<->graham home" \
     interface=vlan9_sfpplus1
+/ipv6 dhcp-server
+add address-pool=verona-cust-pd-1 dhcp-option=v6-dns interface=verona name=\
+    verona-cust-pd-server
+add address-pool=altoga-cust-pd-1 dhcp-option=v6-dns interface=ether6-switch \
+    name=altoga-cust-pd-server
+add dhcp-option=v6-dns interface=vlan9_sfpplus1 name=verona-wired-pd \
+    prefix-pool=verona-cust-pd-1
 /ipv6 firewall filter
 add action=accept chain=input comment=established connection-state=\
     established,related