Section 5: redirects, binding durability, ARP responder lifecycle

[remcovanmook]

The three Section 5 issues, one commit each.

#6 - scope out ICMPv4 redirects

The old sentence offered redirects as the route to host-to-host IPv4 on the segment. They cannot carry the (destination, interface, sentinel) form that next-hop resolution takes here, so on a multi-homed host a redirect is ambiguous, and they are widely filtered or ignored in practice. The text now states plainly that the mechanism does not rely on them, and points multi-router steering at RFC 4191 Default Router Preference - which is per interface and already required for router selection, so nothing new is introduced.

#3 - router-to-host binding durability (new 5.2, normative)

A first-hop router MUST be able, for the lifetime of a host's IPv4 address assignment, to deliver IPv4 traffic to that host's /32 without depending on opportunistically learned neighbor cache state.

The failure mode is spelled out because it is not obvious and it is unrecoverable: if the /32 route derives from a neighbor cache entry learned only as a side effect of traffic, garbage collection of that entry withdraws the route, and the inbound traffic that would provoke re-resolution is then dropped upstream for want of a route. Nothing restores it. The host cannot detect or repair the condition, because it has no way to learn it has become unreachable from outside - an idle host stays unreachable indefinitely.

Mechanisms stay out of the document per the issue. The closing paragraph names the shape of acceptable answers (lease-derived binding, lease-provoked ND, orchestrated distribution, PD anchoring) and defers the catalogue to the companion draft.

#4 - ARP responder is migration machinery (5.4)

The responder read as a permanent property of the router. It is now explicitly operator-controlled and transitional: SHOULD be enabled while unmodified hosts remain, SHOULD be disabled once none do, and a fully migrated segment exchanges no ARP at all, responder included.

The second paragraph records the design position behind the strict host-side MUST NOT rather than leaving it implicit: a sanctioned ARP fallback would make the responder unretirable from any segment, since a conformant host might fall back at any time. That permanently forecloses the zero-ARP end state, in exchange for masking a misconfiguration better surfaced.

Cross-references

Inserting 5.2 renumbers the two subsections after it, so the four hardcoded Section 4 / Section 5.2 / Section 5.3 mentions are converted to anchors. They now resolve automatically and cannot go stale on the next insertion. Verified in the built text.

Closes #6, closes #3, closes #4

🤖 Generated with Claude Code

[remcovanmook]

Superseded by #42.