@@ -6,12 +6,12 @@ FROM quay.io/airshipit/neutron:${OPENSTACK_VERSION}-ubuntu_noble AS build
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
 
 # renovate: name=openstack/neutron repo=https://github.com/rackerlabs/neutron.git branch=understack/2026.1
-ARG NEUTRON_GIT_REF=b0678e56e9c5a7ec2f335c4271465fc1c3202e2a
+ARG NEUTRON_GIT_REF=ef5e82f0d278a1e08d7f840f73bd6cefe460f147
 ADD --keep-git-dir=true https://github.com/rackerlabs/neutron.git#${NEUTRON_GIT_REF} /src/neutron
 RUN git -C /src/neutron fetch --unshallow --tags
 
 # renovate: name=openstack/neutron-lib repo=https://github.com/rackerlabs/neutron-lib.git branch=understack/2026.1
-ARG NEUTRON_LIB_GIT_REF=6d0367183cc92656ba449acefd830cb4e11f2f5b
+ARG NEUTRON_LIB_GIT_REF=275d4c95657ed4c3028401b48c15204d8a965420
 ADD --keep-git-dir=true https://github.com/rackerlabs/neutron-lib.git#${NEUTRON_LIB_GIT_REF} /src/neutron-lib
 RUN git -C /src/neutron-lib fetch --unshallow --tags
 
 
@@ -233,6 +233,21 @@ These scenarios load the real neutron trunk service plugin
 adds/removes must reconcile the parent's switch (VLAN group).
 `utils.fetch_network_node_trunk_id` (live OVN + Ironic discovery) is stubbed.
 
+The Understack trunk driver claims unowned subports as `trunk:subport` and
+updates ports it already owns. It never replaces a semantic owner such as
+`network:router_interface` or `network:router_gateway`. It first records the
+trunk and the subports it owns as DOWN. The trunk plugin also forces a trunk
+back to DOWN on each subport add/remove. The Undersync mechanism driver changes
+them to ACTIVE immediately after `undersync.sync()` returns. That means ACTIVE
+records that reconciliation was requested successfully; there is not yet a
+feedback loop confirming that the switch applied the change. Parent unbind
+changes the trunk and subports back to DOWN after requesting reconciliation.
+For an existing `trunk:subport`, removing the legacy OVN/OVS `parent_name` and
+`tag` binding-profile fields is also an ML2 trigger: Undersync resolves the
+subport's trunk, reconciles the bound parent's physical network, and then marks
+the trunk and its eligible subports ACTIVE. This is the transition used by
+`kubectl us net trunk repair` when handing existing subports to Understack.
+
 ### TRUNK-SUB-ADD — subport attach syncs the parent's physnet
 - given: a bound baremetal parent port on `physnet1` with a trunk, and a subport
   port on another network
@@ -248,6 +263,8 @@ adds/removes must reconcile the parent's switch (VLAN group).
     that row is the record that the subport's network is carried on this VLAN
     of the parent's switchport
   - `undersync.sync(physnet1)` reconciles the parent port's switch
+  - the subport is claimed (`device_owner=trunk:subport`, status ACTIVE) and the
+    trunk reports ACTIVE
 
 ### TRUNK-SUB-DEL — subport removal syncs the parent's physnet
 - given: the TRUNK-SUB-ADD setup with the subport attached
@@ -257,7 +274,8 @@ adds/removes must reconcile the parent's switch (VLAN group).
   **because that row was the last reference to it**, and
   `undersync.sync(physnet1)` reconciles the parent port's switch. Had another
   port or subport still been bound to that segment, only the row would go and
-  the segment would stay.
+  the segment would stay. The port is released (`device_owner` cleared, status
+  DOWN) and the trunk reports ACTIVE again.
 
 ### TRUNK-PARENT-NOIP — subport add syncs when the parent has no IP
 - given: a bound baremetal parent on a subnetted network but with no fixed IP,
@@ -291,14 +309,23 @@ adds/removes must reconcile the parent's switch (VLAN group).
 - then: trunk membership is recorded, but no subport binding level row or
   dynamic VLAN segment is created and no `undersync.sync` occurs — with no
   parent binding there is no physnet to carry the subport on and nothing to
-  reconcile
+  reconcile. The parent is a plain port, not a baremetal one, so the trunk is
+  not ours to manage either: it stays DOWN and the subport is left unclaimed.
 
 ### TRUNK-SEGID-RANGE-01 — subport seg_id outside the allowed range is rejected
 - given: a bound baremetal parent with a trunk
 - when: a subport is added with a segmentation_id outside `[1, 3799]`
 - then: `SubportSegmentationIDError` (raised in the SUBPORTS PRECOMMIT_CREATE
   callback, surfaced as `CallbackFailure`), with no binding level or dynamic
-  segment allocated
+  segment allocated and the port left unclaimed
+
+### TRUNK-STATUS-PARENT-BIND-01 — a trunk activates when its parent is attached
+- given: an *unbound* baremetal parent with a trunk and one subport — the usual
+  order of events, since a trunk is built before the node is deployed
+- when: the parent port is vif-attached to `physnet1`
+- then: while unbound, trunk and subport are DOWN with nothing allocated; the
+  vif-attach then binds the subport (dynamic segment + level-0 row), syncs
+  `physnet1` and takes both to ACTIVE
 
 ### TRUNK-ORDER-01 — subport removal deallocates before it notifies Undersync
 - given: a bound baremetal parent with a trunk and an attached subport
@@ -473,8 +500,13 @@ Port create / bind / delete (no new test doubles):
   (early return, no sync).
 
 Trunk (no new test doubles):
-- TRUNK-CREATE-WITH-SUBPORTS-01 — trunk created with subports present
-  (`trunk_created` path); confirm whether it syncs (it may not — possible gap).
+- TRUNK-CREATE-WITH-SUBPORTS-01 — trunk created with subports inline. The driver
+  handles it (TRUNK PRECOMMIT_CREATE allocates, AFTER_CREATE pushes and sets the
+  status; unit-tested in `test_trunk.py`), but it is not observable here: the
+  precommit allocation writes through its own session (`utils.get_admin_session`),
+  and closing that session rolls the trunk's own insert back on the harness's
+  shared sqlite connection. Needs the precommit writes to join the caller's
+  transaction — which would also stop them leaking if the create is rolled back.
 - TRUNK-PARENT-UNBIND-01 — unbinding a trunked baremetal parent runs `clean_trunk`
   (subport teardown) alongside BM-BIND-04's segment handling.
 
 
@@ -109,12 +109,11 @@ def baremetal_binding_profile(physnet=DEFAULT_PHYSNET, port_id="Ethernet1/1"):
             profile["physical_network"] = physnet
         return profile
 
-    def _bind_baremetal_port(self, net_id, physnet, host, fixed_ips=None):
-        """Create a baremetal port on the network and vif-attach it to physnet.
+    def _create_baremetal_port(self, net_id, fixed_ips=None):
+        """Create an unbound baremetal port on the network. Returns its id.
 
-        Returns the bound port's id. binding:host_id / binding:profile writes
-        require the service role under secure RBAC. Pass ``fixed_ips=[]`` to force
-        a port with no IP even on a subnetted network.
+        Pass ``fixed_ips=[]`` to force a port with no IP even on a subnetted
+        network.
         """
         create_kwargs = {portbindings.VNIC_TYPE: portbindings.VNIC_BAREMETAL}
         if fixed_ips is not None:
@@ -127,7 +126,14 @@ def _bind_baremetal_port(self, net_id, physnet, host, fixed_ips=None):
             **create_kwargs,
         )
         assert res.status_int == 201, res.body
-        port_id = self.deserialize(self.fmt, res)["port"]["id"]
+        return self.deserialize(self.fmt, res)["port"]["id"]
+
+    def _vif_attach_port(self, port_id, physnet, host):
+        """vif-attach a port to a switch, as Ironic does on deploy.
+
+        binding:host_id / binding:profile writes require the service role under
+        secure RBAC.
+        """
         data = {
             "port": {
                 portbindings.HOST_ID: host,
@@ -136,6 +142,14 @@ def _bind_baremetal_port(self, net_id, physnet, host, fixed_ips=None):
         }
         req = self.new_update_request("ports", data, port_id, as_service=True)
         assert req.get_response(self.api).status_int == 200
+
+    def _bind_baremetal_port(self, net_id, physnet, host, fixed_ips=None):
+        """Create a baremetal port on the network and vif-attach it to physnet.
+
+        Returns the bound port's id.
+        """
+        port_id = self._create_baremetal_port(net_id, fixed_ips=fixed_ips)
+        self._vif_attach_port(port_id, physnet, host)
         return port_id
 
     def _trunk_subports(self, trunk_id):
 
@@ -13,6 +13,7 @@
 from neutron.services.trunk import exceptions as trunk_exc
 from neutron_lib import constants as p_const
 from neutron_lib.callbacks import exceptions as cb_exc
+from neutron_lib.services.trunk import constants as trunk_consts
 
 from neutron_understack.tests.scenarios.base import DEFAULT_PHYSNET
 from neutron_understack.tests.scenarios.base import UnderstackMl2TrunkScenarioBase
@@ -74,6 +75,15 @@ def _remove_subport(self, trunk_id, subport_id):
                 self.context, trunk_id, {"sub_ports": [{"port_id": subport_id}]}
             )
 
+    def _trunk_status(self, trunk_id):
+        return self.trunk_plugin.get_trunk(self.context, trunk_id)["status"]
+
+    def _assert_subport_claimed(self, subport_id, status):
+        """The trunk owns the subport, and the subport follows the trunk."""
+        port = self._show("ports", subport_id)["port"]
+        assert port["device_owner"] == trunk_consts.TRUNK_SUBPORT_OWNER
+        assert port["status"] == status
+
     def _assert_subport_bound(self, trunk_id, subport_id, host, seg_id=SUBPORT_VLAN):
         assert {
             subport["port_id"]: subport for subport in self._trunk_subports(trunk_id)
@@ -93,12 +103,19 @@ def _assert_subport_bound(self, trunk_id, subport_id, host, seg_id=SUBPORT_VLAN)
         assert segment[segments_db.PHYSICAL_NETWORK] == DEFAULT_PHYSNET
         segment_obj = NetworkSegment.get_object(self.context, id=levels[0].segment_id)
         assert segment_obj.is_dynamic
+
+        self._assert_subport_claimed(subport_id, p_const.PORT_STATUS_ACTIVE)
+        assert self._trunk_status(trunk_id) == trunk_consts.TRUNK_ACTIVE_STATUS
         return levels[0].segment_id
 
     def _assert_subport_unbound(self, subport_id, host, segment_id):
         assert not ml2_db.get_binding_level_objs(self.context, subport_id, host)
         assert segments_db.get_segment_by_id(self.context, segment_id) is None
 
+        port = self._show("ports", subport_id)["port"]
+        assert port["device_owner"] == ""
+        assert port["status"] == p_const.PORT_STATUS_DOWN
+
     @pytest.mark.scenario("TRUNK-SUB-ADD")
     def test_subport_add_syncs_parent_physnet(self):
         parent_net = self._make_network(self.fmt, "parent-net", True)["network"]["id"]
@@ -128,6 +145,7 @@ def test_subport_remove_syncs_parent_physnet(self):
 
         assert updated_trunk["sub_ports"] == []
         self._assert_subport_unbound(subport_id, "host-a", segment_id)
+        assert self._trunk_status(trunk_id) == trunk_consts.TRUNK_ACTIVE_STATUS
         self.undersync_mock.sync.assert_any_call(DEFAULT_PHYSNET)
 
     @pytest.mark.scenario("TRUNK-ORDER-01")
@@ -221,6 +239,8 @@ def test_subport_add_unbound_parent_no_sync(self):
         self._add_subport(trunk_id, subport_id)
 
         assert self._trunk_subports(trunk_id)[0]["port_id"] == subport_id
+        assert self._trunk_status(trunk_id) == trunk_consts.TRUNK_DOWN_STATUS
+        assert self._show("ports", subport_id)["port"]["device_owner"] == ""
         assert not ml2_db.get_binding_level_objs(self.context, subport_id, "")
         assert (
             segments_db.get_dynamic_segment(
@@ -274,6 +294,29 @@ def test_multiple_subports_add_syncs(self):
         assert segment_a != segment_b
         self.undersync_mock.sync.assert_any_call(DEFAULT_PHYSNET)
 
+    @pytest.mark.scenario("TRUNK-STATUS-PARENT-BIND-01")
+    def test_trunk_activates_when_the_parent_is_vif_attached(self):
+        parent_net = self._make_network(self.fmt, "parent-net", True)["network"]["id"]
+        parent_id = self._create_baremetal_port(parent_net)
+        subport_net = self._make_network(self.fmt, "subport-net", True)["network"]["id"]
+        subport_id = self._plain_port(subport_net)
+        trunk_id = self._make_trunk(parent_id)
+        self._add_subport(trunk_id, subport_id)
+
+        # Nothing is carried yet: the node has not been deployed.
+        assert self._trunk_status(trunk_id) == trunk_consts.TRUNK_DOWN_STATUS
+        self._assert_subport_claimed(subport_id, p_const.PORT_STATUS_DOWN)
+
+        self.undersync_mock.reset_mock()
+        with mock.patch(
+            "neutron_understack.utils.fetch_network_node_trunk_id",
+            return_value=_FAKE_NN_TRUNK,
+        ):
+            self._vif_attach_port(parent_id, DEFAULT_PHYSNET, "host-a")
+
+        self._assert_subport_bound(trunk_id, subport_id, "host-a")
+        self.undersync_mock.sync.assert_any_call(DEFAULT_PHYSNET)
+
     @pytest.mark.scenario("TRUNK-SEGID-RANGE-01")
     def test_subport_segid_out_of_range_rejected(self):
         parent_net = self._make_network(self.fmt, "parent-net", True)["network"]["id"]
@@ -288,6 +331,7 @@ def test_subport_segid_out_of_range_rejected(self):
         with pytest.raises(cb_exc.CallbackFailure) as exc_info:
             self._add_subport(trunk_id, subport_id, seg_id=4000)
         assert "Segmentation ID" in str(exc_info.value)
+        assert self._show("ports", subport_id)["port"]["device_owner"] == ""
         assert not ml2_db.get_binding_level_objs(self.context, subport_id, "host-a")
         assert (
             segments_db.get_dynamic_segment(