External IP attachment validates IP version against all NICs instead of primary NIC only, contradicting error message / schema docs

[charliepark]

I was working through an issue in Console around networking interfaces during instance creation with Claude, while cross-referencing the Omicron API, and Claude reported the following.

---

Omicron has a bug where:

1. The error message claims it checks the primary NIC
2. The actual implementation checks if there exists at least one NIC with the IP version (uses EXISTS() in SQL via the EVERY((...)) wrapper when there are multiple rows)
3. The correct behavior (per the error message and schema docs) should be to check only the primary NIC

Current Code (lines 569-577 of external_ip.rs):

  let base_nic_query = nic_table
      .into_boxed()
      .filter(nic_dsl::parent_id.eq(instance_id.into_untyped_uuid()))
      .filter(nic_dsl::time_deleted.is_null())
      .filter(nic_dsl::kind.eq(NetworkInterfaceKind::Instance));
  let has_matching_ip_stack = match ip_version {
      IpVersion::V4 => base_nic_query.select(nic_dsl::ip.is_not_null()),
      IpVersion::V6 => base_nic_query.select(nic_dsl::ipv6.is_not_null()),
  };

There is no .filter(nic_dsl::is_primary.eq(true)) filter.

History:

• The bug was introduced in commit 078f636 (Jan 3, 2026) when dual-stack NIC support was added
• The error message says "primary network interface" but the implementation checks all NICs
• There are zero references to is_primary in the entire external_ip.rs file

---

I don't have enough context to know whether this needs addressing in the code vs. the schema docs / error message, but wanted to pass it along in case it's a bug in the code that needs to get patched up.