Reframe IPv6-egress docs: explain the real fast/slow mechanism

The previous wording implied IPv6 "falls back to IPv4" cleanly. Correct it:
with transit_gateway_ipv6_egress off there is no IPv6 default route, so an
IPv6 connection attempt fails immediately (ENETUNREACH) and the client uses
IPv4 with no delay. The slow case is the opposite — enabling it against a TGW
that does not carry IPv6 points ::/0 at a black hole, and clients without
Happy Eyeballs (e.g. Python requests/urllib3) stall on the connection timeout.
So the warning belongs on enabling it, not on the (safe) default-off path.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: sir-sigurd

README.md

@@ -812,9 +812,13 @@ accordingly if more than one Quilt stack shares a TGW (the default is
 `10.0.0.0/16`).
 
 **IPv6** egress through the TGW is opt-in (`transit_gateway_ipv6_egress`,
-default `false`). Enable it only if your TGW actually carries IPv6 egress;
-otherwise leave it off — IPv6 then has no default route and falls back to IPv4,
-rather than being black-holed at a TGW that can't route it.
+default `false`). The VPC is dual-stack, so set this `true` **only if your TGW
+actually carries IPv6 egress**: pointing `::/0` at a TGW that can't route IPv6
+black-holes those packets, and clients without Happy Eyeballs (e.g. Python's
+`requests`/`urllib3`) then stall on the connection timeout before falling back
+to IPv4. Left `false`, the new VPC has no IPv6 default route, so an IPv6
+attempt fails immediately (`ENETUNREACH`) and the client uses IPv4 with no
+delay.
 
 **Reversibility:** removing `enable_transit_gateway` (or setting it `false`)
 restores the NAT gateways and IPv6 egress-only IGW. Toggling it on or off for an

modules/quilt/variables.tf

@@ -48,7 +48,7 @@ variable "transit_gateway_id" {
 variable "transit_gateway_ipv6_egress" {
   type        = bool
   default     = false
-  description = "When enable_transit_gateway is true, also route the private subnets' IPv6 default route (::/0) through the Transit Gateway. Leave false unless the Transit Gateway is configured for IPv6 egress; otherwise IPv6 traffic would be black-holed (with no route, IPv4 still falls back cleanly). No effect when enable_transit_gateway is false."
+  description = "When enable_transit_gateway is true, also route IPv6 (::/0) egress through the Transit Gateway. Set true only if the Transit Gateway carries IPv6 egress: pointing ::/0 at a TGW that can't route IPv6 black-holes the traffic and stalls clients without Happy Eyeballs (e.g. Python requests/urllib3) on the connection timeout. Left false (default), the VPC has no IPv6 default route, so IPv6 attempts fail immediately and clients use IPv4 with no delay. No effect when enable_transit_gateway is false."
 }
 
 variable "db_snapshot_identifier" {

modules/vpc/variables.tf

@@ -42,7 +42,7 @@ variable "transit_gateway_id" {
 variable "transit_gateway_ipv6_egress" {
   type        = bool
   default     = false
-  description = "When enable_transit_gateway is true, also route the private subnets' IPv6 default route (::/0) through the Transit Gateway. Leave false unless the Transit Gateway is configured for IPv6 egress; otherwise IPv6 traffic would be black-holed (with no route, IPv4 still falls back cleanly). No effect when enable_transit_gateway is false."
+  description = "When enable_transit_gateway is true, also route IPv6 (::/0) egress through the Transit Gateway. Set true only if the Transit Gateway carries IPv6 egress: pointing ::/0 at a TGW that can't route IPv6 black-holes the traffic and stalls clients without Happy Eyeballs (e.g. Python requests/urllib3) on the connection timeout. Left false (default), the VPC has no IPv6 default route, so IPv6 attempts fail immediately and clients use IPv4 with no delay. No effect when enable_transit_gateway is false."
 }
 
 variable "existing_vpc_id" {