retro: compound-learning 30-day retrospective + 2 new patterns

New patterns:
- PAT-008: Ansible default_ipv6 fact missing on fresh VMs
- PAT-009: Stale NBD devices after RBD volume swap

Updated:
- index.md: added PAT-008, PAT-009
- log.md: retrospective entry with 4 solution docs + 2 patterns
- Solution docs dispatched to ~/docs/solutions/

patterns/ansible-default-ipv6.md

@@ -0,0 +1,59 @@
+---
+pattern_id: PAT-008
+title: "Ansible default_ipv6 fact missing on fresh VMs → lablabs.rke2 role fails"
+category: tooling
+severity: medium
+status: active
+first_observed: 2026-07-21
+last_updated: 2026-08-30
+related_systems: [rke2-kubernetes]
+related_solution_docs:
+  - docs/solutions/bug-fixes/2026-07-21-ansible-rke2-default-ipv6-bug.md
+related_skills: []
+---
+
+# Ansible default_ipv6 fact missing on fresh VMs → lablabs.rke2 role fails
+
+## Symptom
+
+The `lablabs.rke2` Ansible role fails on freshly provisioned VMs with a Jinja2 error:
+```
+ansible_facts['default_ipv6']['address']
+```
+The `default_ipv6` fact doesn't exist on VMs without IPv6 configured, causing the
+`meta/argument_specs.yml` validation to crash.
+
+## Root Cause
+
+The `lablabs.rke2` role's `meta/argument_specs.yml` references
+`ansible_facts['default_ipv6']['address']` with a hardcoded default. On fresh VMs
+without IPv6, `ansible_facts['default_ipv6']` is undefined → Jinja2 raises
+`UndefinedError`.
+
+A `pre_task` setting `default_ipv6` via `combine()` doesn't help because the
+argument_specs validation runs BEFORE pre_tasks — it re-collects facts and
+overwrites the pre_task fix.
+
+## Mitigation
+
+Patch `meta/argument_specs.yml` directly in the role:
+```yaml
+# Replace:
+default: "{{ ansible_facts['default_ipv6']['address'] }}"
+# With:
+default: "{{ ansible_facts.default_ipv6.address | default(None) }}"
+```
+
+Or: enable IPv6 on the target VMs (faster workaround, no role patching needed).
+
+## Prevention
+
+- Pin Ansible roles and patch argument_specs when they assume facts that may not exist
+- Test roles on fresh VMs without IPv6 before production use
+- Consider forking the role with the fix upstream
+
+## Evidence
+
+- Observed during GPU worker provisioning (worker-04/05, Jul 2026)
+- Solution doc: `docs/solutions/bug-fixes/2026-07-21-ansible-rke2-default-ipv6-bug.md`
+- Session: @session:default/20260721_115501_78b25032