A thought:
Being obsessed with having an exact "export" rather than a configuration script is,
in my opinion, making this project a mess.
Do you want an "export" or a script to configure the device?
So, forget about all the weird constraints to make it look like an "export"...
This is how I set the correct MAC in my scripts, for each bridge:
/int bridge
:foreach ifb in=[find] do={:local brname [get $ifb name] ; set $brname admin-mac=[/int get [/int bri port get ([find where bridge=$brname]->0) interface] mac-address] auto-mac=no}
The IPv6 firewall must exist and be implemented correctly.
Whether one wants to use IPv6 or not is ONE OPINION.
It has happened several times that RouterOS updates re-enable IPv6,
so there MUST be protection against this,
and the default rules must be in place (even on models without default configuration).
This is a fact, not an opinion.
These are the default rules.
The post is updated only if there are any differecy with new versions.
The rules are written for readability, but they are identical to the export rules.
The rules are also updated with MikroTik bugfixes.
Fix for default rules of old RouterOS versions (already present on RouterOS 7.2x).