diff --git a/persistent-memory.md b/persistent-memory.md
index 30b0c19..ab4d462 100644
--- a/persistent-memory.md
+++ b/persistent-memory.md
@@ -127,6 +127,8 @@ _As of 2026-08-18 — **gen seat SWAPPED to `absolute-heresy` and operator-confi
 
 - **EVIDENCE HOLD (partial):** WT #394 FILE half STILL STANDS — do NOT delete on-disk gen dirs (`fiction/rex390-dcc`, `rex392-dcc`, `b59c147c5ce0`); rex393-fiction-* + r42-gate-* KEEP.
 
+- **⏳ COGENT IPv6 PROVISIONING REQUESTED for Anaheim/colo (operator, 2026-08-19).** The colo is the last site with no v6 (ESH has a `/56` from Cityside, NH3 has AT&T v6 on `2600:1700:b25:c110::48`). **Diagnosis from our side before the ticket:** `diagnose sniffer packet wan1 "ip6"` on ana-gw caught **exactly one RA in 90s, from `fe80::ea0a:b9ff:fe3b:2c16`** — so an IPv6-capable router IS one hop away on the circuit terminating `38.120.12.42/29` — but `set autoconf enable` (SLAAC) got no global address after 2min of RA intervals, and `execute ping6` to both `2606:4700:4700::1111` and `2001:4860:4860::8888` was 100% loss. **That pattern = router present, circuit not provisioned for v6** (RA likely carries no Prefix Information Option). FortiGate-side v6 config was **fully reverted** after testing — `wan1` is back to no v6, v4/IPsec untouched throughout. ⚠ FortiOS gotcha for when it lands: SLAAC is `config ipv6 / set autoconf enable`, NOT an `ip6-mode` (that only takes static/dhcp/pppoe/delegated). **WHEN COGENT PROVISIONS:** ask for DHCPv6-PD size (ESH got a `/56` from Cityside; NH3 only gets a single `/64` from AT&T, so a `/56` or better is the ask), then the colo becomes the fleet's only site with BOTH a static public v4 (`38.120.12.42`) and routable v6 — which makes it the natural v6 hub, since ESH is CGNAT'd on v4 and NH3 is prefix-constrained.
+
 - **🟡 ESH IPv6 LAN naming — a DOCS CONVENTION ONLY, not wire-level.** Fun hexspeak names picked 2026-08-18 for the six ESH LANs: **RESERVED for a future DMZ** = **4411:DBAD** ("FOR ALL DA BAD" — no DMZ network exists on the ESH UDM yet; name claimed 2026-08-19 against the day one is built). `esh-cameras`=**1533:FACE5** ("I SEE FACES" — operator's pick 2026-08-19, and the best of the set), `esh-mgmt`=**15DA:B055** ("IS DA BOSS" — 15=IS, DA literal, B055=BOSS; revised 2026-08-19), `esh-server`=**4411:B105** ("FOR ALL BIOS" — operator's pick 2026-08-19; shares the 411 with userland's CAFE:4411), `esh-userland`=**CAFE:4411** ("CAFE FOR ALL" — operator's pick 2026-08-19; 411 also being US directory assistance is a bonus), `esh-iot`=**4DBA:D107** ("FOR DA BAD IOT" — 4=FOR, D=DA, BAD, 107=IOT; same 8 digits, re-glossed 2026-08-19), Default=**4BA5:3417** ("A BASE FOR IT" — operator's pick 2026-08-19; 8 digits, words straddle the group boundary like `4DBA:D107`). **Investigated and confirmed these CANNOT be made literal on the wire**: (1) a network's only nameable slot is its `/64` subnet id (`ipv6_pd_prefixid`), which is 2 hex digits (0-255) — not enough room to spell a 4-char word; (2) the gateway's own address is fixed at `::1` by the UniFi platform, no field to customize it (`ipv6_aliases` exists but schema unknown, not attempted blind); (3) UniFi has **no IPv6 equivalent of `use_fixedip`/`fixed_ip`** (checked the client schema directly) — individual devices cannot be pinned to a chosen v6 address the way v4 static reservations work; SLAAC devices self-assign via EUI-64 (MAC-derived, stable) or privacy-extension (random, rotates). So the names are a mnemonic for humans/docs, not something that will ever appear in a `dig`/`ip -6` output. Only `esh-cameras` has v6 live at all (`2607:73c0:402:1d00::/64`, PD from the ESH `/56`); the other five stay `ipv6_interface_type: none` pending a firewall-policy pass before enabling SLAAC fleet-wide. ⚠ **Precision that matters here: SLAAC gives hosts globally *ADDRESSABLE* addresses, NOT globally *reachable* ones.** Addressability is a property of the address; reachability is a firewall policy decision, and operator's position (2026-08-19) is unambiguous — **no 1:1 inbound pass-through, ever**. v6 removes NAT, it does not remove the firewall, and conflating the two is how people talk themselves into thinking v6 means automatic exposure. The firewall-policy pass is about writing explicit default-deny inbound rules for each v6 segment, not about deciding whether to expose anything.
 
 - **🟢 ESH↔colo IPsec FIXED 2026-08-18 — dialup + NAT-T.** Broke when ESH lost its public IP (Cox unplugged for the fiber install; 5G handed out RFC1918 `192.168.200.111`). **TWO causes:** phase1 `ana-to-eshudm` was `type static` pinned to the dead `70.181.90.232`, AND **`nattraversal disable`** — so even re-pinning the IP would have failed, since ESP cannot cross NAT without UDP-4500. `pfi-ana-nh3` survived only because NH3 is publicly addressed. ⚠ **FortiOS REFUSES `set type dynamic` on an existing tunnel** ("Cannot change tunnel type once configured", clean rollback). **Fix = ADDITIVE, not a recreate:** new phase1+phase2 **`ana-eshudm-dyn`** (`type dynamic`, ikev2, aes256-sha1, dh14, NAT-T default on, PSK read from the ESH UDM API), static route id **10** (`dstaddr ana-to-eshudm_remote` → `device ana-eshudm-dyn`, distance 20), policies **73/74** (consolidated multi-zone in/out). Old `ana-to-eshudm` LEFT IN PLACE, dead and harmless, as rollback. Verified: `ana-eshudm-dyn_0 97.170.236.56:4500 selectors 1/1` (`_0`=dialup child, `:4500`=NAT-T, carrier IP), ESH→colo all hosts 40-56ms, colo→ESH OK, traceroute now 3 hops encapsulated vs 8 leaking to the carrier. FortiGate config backed up first at `nh3-dev:~/backups/ana-gw/` (1.17MB, 36903 lines). ⚠ **RESIDUAL: the UDM's `ipsec_local_ip` needs a LITERAL IP** (empty rejected `api.err.InvalidPayload`) — currently `192.168.200.111`, so **it must be updated again when the fiber lands** or the tunnel drops. Gateway end is address-agnostic now; UniFi end is not — **it will drop on ANY ESH WAN change: Cox reclaiming WAN1 (still `failover_priority=1`), the fiber cutover, or a DHCP renewal.** **MANUAL FIX (seconds):** read the UDM's live `wan_ip` from `/stat/health` and PUT it into `esh-ana.ipsec_local_ip` via `rest/networkconf/<id>` using `unifi/esh-udmpm-api-key`. A self-healing watcher is **PARKED (`self-healing-ipsec-local-ip-watcher-for-the-esh`), trigger = once the new ESH fiber is live and its addressing has settled** — operator's call 2026-08-18, deliberately not built now because it would target an address that is about to change. Park item also carries the follow-up to delete the old `ana-to-eshudm` tunnel, whose distance-10 route would silently reclaim traffic if Cox ever returns on `70.181.90.232`.