@@ -1,5 +1,32 @@
 # Lab4Net changes
 
+## Review fixes, part 6: the rest of the polish (switching, OSPF, IPv6, quiz)
+
+This finishes `docs/REVIEW-FIXES.md`. Two small things the review listed as owed (`show ip ospf database`, suspending a Telnet session) are on the Still owed list.
+
+**Switching**
+- `show interfaces counters` and `show interfaces counters errors`: the standard views for chasing a duplex problem (FCS errors and runts on the full-duplex end, late collisions on the half-duplex end).
+- `clear counters fa0/1` asks about "this interface"; "Last clearing" shows the time since the clear.
+- The CDP duplex-mismatch warning repeats every minute while the mismatch lasts.
+- `show interfaces status` right-aligns Duplex and Speed like IOS, and a switch's gigabit port reports 10/100/1000BaseTX.
+- An ARP nobody answers (pinging an unused address) still floods the VLAN; every switch learns the sender, and the trace says nobody answered.
+- A broadcast storm names only the switches on the loop, and the map animates the loop's real links.
+
+**OSPF show commands**
+- Areas set with `ip ospf 1 area 0` on an interface count in `show ip ospf` and `show ip protocols`, areas are listed in number order, and `show ip protocols` says "It is an area border router" and lists the interfaces configured explicitly.
+
+**IPv6**
+- The first IPv6 echo is no longer lost: IOS queues a packet while it resolves a neighbour (unlike ARP), so even a cold `ping` shows `!!!!!`.
+- `show ipv6 neighbors` shows each entry's age in minutes, REACH for 30 seconds after it was confirmed and STALE after that, and the FE80 link-local neighbours.
+
+**Theory quiz**
+- Nine near-duplicate questions were rewritten to test something new: the TCP handshake, the BSSID, Terraform, NTP stratum 16, `logging trap warnings`, the PUT verb, unique local addresses, the management plane and NETCONF. Old answers to those nine are cleared once, so the Theory Check trophy counts them fresh.
+- The `ip name-server` question explains that the hang after a typo comes from `ip domain-lookup` being on with no reachable name server.
+
+Tests: new checks in `switching.cjs`, `duplex.cjs`, `ospfarea.cjs`, `ping6.cjs` (now expects the queued first echo), `quiz.cjs` and `pageflows.cjs`.
+
+Verification: all seventeen suites pass.
+
 ## Review fixes, part 5: polish for exams, Telnet and the extended ping
 
 From the Polish list of `docs/REVIEW-FIXES.md`.
 
@@ -1,6 +1,6 @@
 # Lab4Net handoff
 
-State as of the multi-area OSPF and wireless build on `main` (9 Oct 2026). Eleven builds landed on 9 Oct: multi-area OSPF plus the wireless-wiring lab, the campaign, the follow-ups (storms, neighbours in the MAC table, per-VLAN aging, IPv6 learning), switching realism, prompts, ping source, exam sim, theory bank and sandbox rewards, duplex/speed, live IPv6 pings, boss fights. Read this before touching anything. The lab library is being expanded phase by phase following `docs/LESSONS-SPEC.md`.
+State as of the review fixes on `main` (9 Oct 2026): every item in `docs/REVIEW-FIXES.md` is done or listed under Still owed. Eleven builds landed on 9 Oct: multi-area OSPF plus the wireless-wiring lab, the campaign, the follow-ups (storms, neighbours in the MAC table, per-VLAN aging, IPv6 learning), switching realism, prompts, ping source, exam sim, theory bank and sandbox rewards, duplex/speed, live IPv6 pings, boss fights. Read this before touching anything. The lab library is being expanded phase by phase following `docs/LESSONS-SPEC.md`.
 
 ## What this is
 
@@ -265,6 +265,7 @@ For anything visual, open the page in a real browser and look at it. Earlier in
 - Syslog messages appear on the console of the device where the command was typed; other devices only log them (show logging, syslog server). The NTP clock stays synchronised as long as its server is configured. Log timestamps use the browser's clock.
 - show access-lists lists standard entries in sequence order; real IOS may list host entries first.
 - Ping and traceroute use ICMP for every probe (real IOS traceroute uses UDP), so an extended ACL that permits only some ICMP or UDP can disagree slightly with real gear. Unreachables are sent only for no-route and ACL drops; a failed next-hop ARP on a router gives timeouts. Extended ping has `repeat` and `size` but not `source`, and there is no interactive extended ping. Playback runs at 40% of real time (`PACE_SCALE`), at Yasuke's request.
+- IPv6 neighbours age REACH (30 s) then STALE, with no DELAY or PROBE states; the first echo is queued, not lost.
 - No wireless. IPv6 has static routing only: no OSPFv3, no DHCPv6, no IPv6 ACLs. Only the Layer 3 switch model (a 3560) routes; 2960s reject ip routing and static routes.
 - HSRP has no object tracking and fails over at once rather than after the 10-second hold time. The DHCP snooping rate limit is stored and shown but not enforced. DAI has no ARP ACLs or extra validation options.
 - Incidents are fixed scenarios; randomised faults live in the exam sim's sabotage mode. Sandbox device models are fixed (3 or 5 port routers, 10 or 26 port switches).
@@ -279,8 +280,8 @@ For anything visual, open the page in a real browser and look at it. Earlier in
 
 Carry this list forward and keep it in every summary.
 
-- The rest of the Polish list in `docs/REVIEW-FIXES.md` (switching, OSPF show commands, IPv6, quiz duplicates), in progress on 9 Oct.
+- `show ip ospf database` (from the review's Polish list; not built yet).
 - Suspending a Telnet/SSH session: Ctrl+Shift+6 then x, `show sessions`, `resume`, `disconnect` (from the review's Polish list).
-- Nothing. Yasuke decided on 9 Oct 2026 to keep "test it yourself" (at least one show, ping, traceroute, telnet, ssh, ipconfig or arp during the run) as a requirement for an S rank. Do not remove it.
+Standing decision (not owed): Yasuke decided on 9 Oct 2026 to keep "test it yourself" (at least one show, ping, traceroute, telnet, ssh, ipconfig or arp during the run) as a requirement for an S rank. Do not remove it.
 
-His most recent direction (9 Oct 2026): build freely in milestones, accuracy first, keep the arcade design, keep every test green, and keep this list current. Done on 9 Oct: the console realism fixes, the guide window, switching realism, prompts (passwords, Telnet/SSH sessions, reload), ping/traceroute with a source and the interactive dialogs, the exam sim (seeded sabotage faults, daily challenge, boss fights), the 110-question theory bank, sandbox rewards, duplex/speed mismatch effects, live IPv6 pings, boss fights, the switching follow-ups (storms, neighbour rows, per-VLAN aging, IPv6 learning) the campaign, multi-area OSPF and the wireless-wiring lab. Nothing is owed; ideas for later: more IPv6 (an OSPFv3 engine would be the big one), a second campaign once the first is cleared.
+His most recent direction (9 Oct 2026): build freely in milestones, accuracy first, keep the arcade design, keep every test green, and keep this list current. Done on 9 Oct: the console realism fixes, the guide window, switching realism, prompts (passwords, Telnet/SSH sessions, reload), ping/traceroute with a source and the interactive dialogs, the exam sim (seeded sabotage faults, daily challenge, boss fights), the 110-question theory bank, sandbox rewards, duplex/speed mismatch effects, live IPv6 pings, boss fights, the switching follow-ups (storms, neighbour rows, per-VLAN aging, IPv6 learning) the campaign, multi-area OSPF and the wireless-wiring lab, then every item of the review in `docs/REVIEW-FIXES.md`. Owed: the two items above; ideas for later: more IPv6 (an OSPFv3 engine would be the big one), a second campaign once the first is cleared.
@@ -137,24 +137,24 @@ Rules from docs/HANDOFF.md still apply: accuracy first, never weaken a test, ful
   - `copy run start` ignores a typed destination filename **Done (milestone 5).** Another name saves a copy in NVRAM ("… bytes copied") and leaves the startup-config alone. Test: `prompts.cjs`.
   - extended ping: answering "Sweep range of sizes" with `y` skips the min/max/interval questions, and the DF-bit and timeout answers are ignored **Done (milestone 5).** The sweep asks min, max and interval and pings every size; DF set on a packet over the 1500-byte MTU answers `M` (could not fragment); the timeout sets how long each `.` takes. Test: `prompts.cjs`.
 - **Switching:**
-  - `show interfaces counters` and `show interfaces counters errors` are missing; they're the standard duplex-troubleshooting views
-  - `clear counters fa0/1` should ask "Clear "show interface" counters on this interface [confirm]"
-  - "Last clearing" shows the clock time instead of time elapsed
-  - the CDP mismatch warning should repeat every 60 s
-  - `show interfaces status` should right-align Duplex and Speed
-  - Gig ports say "media type is 10/100BaseTX"
-  - an ARP that gets no reply should still flood the VLAN and teach switches the sender's MAC
-  - the storm description names switches that aren't in the loop, and the map animates a link that doesn't exist
+  - `show interfaces counters` and `show interfaces counters errors` are missing; they're the standard duplex-troubleshooting views **Done (milestone 6).** Test: `duplex.cjs`.
+  - `clear counters fa0/1` should ask "Clear "show interface" counters on this interface [confirm]" **Done (milestone 6).** Test: `duplex.cjs`.
+  - "Last clearing" shows the clock time instead of time elapsed **Done (milestone 6).** hh:mm:ss since the clear, on the engine clock. Test: `duplex.cjs`.
+  - the CDP mismatch warning should repeat every 60 s **Done (milestone 6).** Test: `duplex.cjs` (on a router-to-router link; a PC NIC sends no CDP).
+  - `show interfaces status` should right-align Duplex and Speed **Done (milestone 6).** Test: `switching.cjs`.
+  - Gig ports say "media type is 10/100BaseTX" **Done (milestone 6).** A switch Gig port is 10/100/1000BaseTX (routers stay RJ45). Test: `switching.cjs`.
+  - an ARP that gets no reply should still flood the VLAN and teach switches the sender's MAC **Done (milestone 6).** The trace shows the flood and "nobody answered". Test: `switching.cjs`.
+  - the storm description names switches that aren't in the loop, and the map animates a link that doesn't exist **Done (milestone 6).** The storm is the loop itself, from where the two paths of the broadcast split, in cabled order. Test: `switching.cjs`.
 - **OSPF show commands:**
-  - `show ip ospf` / `show ip protocols` count areas from `network` statements only, missing `ip ospf 1 area 0`
-  - areas should be listed in number order
-  - `show ip protocols` should say "It is an area border router"
-  - `show ip ospf database` is missing (Still owed)
-- **IPv6:** neighbours are always REACH with age 0 (no STALE/DELAY/PROBE, no FE80 entries). IOS usually holds the first IPv6 echo while it resolves the neighbour, so `!!!!!` is often seen first time. Check before changing; if unsure, leave it and note it.
+  - `show ip ospf` / `show ip protocols` count areas from `network` statements only, missing `ip ospf 1 area 0` **Done (milestone 6).** Interface areas count too, and `show ip protocols` lists them under "Routing on Interfaces Configured Explicitly". Test: `ospfarea.cjs`.
+  - areas should be listed in number order **Done (milestone 6).** Test: `ospfarea.cjs`.
+  - `show ip protocols` should say "It is an area border router" **Done (milestone 6).** Test: `ospfarea.cjs`.
+  - `show ip ospf database` is missing (Still owed) **Done (milestone 6).** Not built; on the Still owed list in HANDOFF.md.
+- **IPv6:** neighbours are always REACH with age 0 (no STALE/DELAY/PROBE, no FE80 entries). IOS usually holds the first IPv6 echo while it resolves the neighbour, so `!!!!!` is often seen first time.  **Done (milestone 6).** Checked: IOS queues packets awaiting neighbour resolution (the `ipv6 nd resolution data limit` command sets that queue), so the first IPv6 echo is no longer lost. Entries keep the time they were confirmed: Age in minutes, REACH for 30 seconds (the reachable time), then STALE; each end also learns the other's FE80 link-local address. DELAY and PROBE are not modelled. Test: `ping6.cjs`.Check before changing; if unsure, leave it and note it.
 - **Exam faults:** the `gw` fault uses the gateway +1 without checking that address is free. **Done (milestone 5).** It now picks a free address in the switch's subnet. Test: `exam.cjs`.
 - **Quiz:**
-  - near-duplicate question pairs to merge or vary: 13/29, 4/90, 17/98, 7/69, 8/70, 16/97, 11/104, 3/99, 2/18/101
-  - #75's explanation should say the hang comes from `ip domain-lookup` being on (the default) with no reachable name server
+  - near-duplicate question pairs to merge or vary: 13/29, 4/90, 17/98, 7/69, 8/70, 16/97, 11/104, 3/99, 2/18/101 **Done (milestone 6).** The later question of each pair was rewritten to test something else (TCP handshake, BSSID, Terraform, NTP stratum 16, logging trap warnings, PUT, unique local addresses, the management plane, NETCONF as a southbound protocol); indices kept, and old saved answers to those nine are cleared once on load. Test: `quiz.cjs` (each pair has different answers), `pageflows.cjs` (the one-time clear).
+  - #75's explanation should say the hang comes from `ip domain-lookup` being on (the default) with no reachable name server **Done (milestone 6).** Test: `quiz.cjs`.
 - **Speed:** the Exam sim dialog builds the daily challenge (~240 ms) every time it opens; cache it per day. **Done (milestone 5).** Built once per day.
 
 ---