Loopback node-segment template and startup migration check

[ben-malbeclabs]

Add flex-algo node-segment lines to loopback template, one per entry in flex_algo_node_segments. Conditional on FlexAlgoNodeSegments being non-empty — if empty, only the algo-0 node-segment line is rendered.

Controller MUST check at startup with enabled: true that no Vpnv4 loopback has an empty flex_algo_node_segments list. If any are found, enabled: true MUST be treated as a no-op for that startup cycle — no flex-algo config pushed to any device. Controller MUST emit a prominent error identifying unset loopbacks by pubkey and direct the operator to run the migration command.

Milestone: RFC-18: Controller — Topology Config
RFC: #3288

---

Files affected:

• controlplane/controller/internal/controller/ (loopback template, startup check)

Size: Small

Tests:

• Loopback with flex_algo_node_segments entries renders one node-segment ... flex-algo <name> line per entry
• Loopback with empty flex_algo_node_segments produces only the algo-0 node-segment line
• Startup check fires and emits correct error when any Vpnv4 loopback has empty list
• Startup check passes and flex-algo config is applied when all loopbacks are migrated

Blockers: #3351 (IS-IS TE templates), #3349 (migration command)

[ben-malbeclabs]

Implemented in #3515 (RFC-18 PR 5).

[ben-malbeclabs]

Partially implemented in #3515:

• ✅ Loopback node-segment template: renders one node-segment ipv4 index N flex-algo NAME line per entry in flex_algo_node_segments; emits no node-segment cleanup lines on rollback
• ⚠️ Startup migration check: the controller logs an error when a VPNv4 loopback has empty flex_algo_node_segments with enabled: true, but does not yet treat it as a no-op for that startup cycle (i.e. config is still pushed to all devices). The blocking behaviour specified in this issue remains outstanding.

[ben-malbeclabs]

PR #3648 addresses the node segment assignment gap discovered during devnet validation:

• The activator (now removed) used to call BackfillTopology after activating a VPNv4 loopback. With the activator gone, new/reprovisioned devices were missing FlexAlgoNodeSegment entries.
• Fix: CreateDeviceInterface now accepts optional topology PDA accounts and assigns FlexAlgoNodeSegment entries atomically during VPNv4 loopback creation. The CLI auto-discovers existing topologies.
• Also renamed BackfillTopology → AssignTopologyNodeSegments (instruction discriminant 110 unchanged).

Validated on devnet 2026-05-02: doublezero-admin migrate flex-algo --dry-run reports 0 devices needing backfill after interface recreation.

[ben-malbeclabs]

This issue can be closed — the template work was completed in earlier PRs, and the node segment assignment gap (from the activator removal) is fixed in PR #3648 which assigns FlexAlgoNodeSegments atomically during CreateDeviceInterface. The startup migration check is no longer needed since the activator is removed.