# Changelog 2026-07-11 -- DOCFIX-182: D-111 v6 subcarve aligned to deployed NN mnemonic

**Context.** The Chat/planning stream handed the Code stream the VR1 NetBox buildout
(`docs/dc-dc-netbox-buildout-scope.md`). A read-only export of the live
`netbox.baldurkeep.com` (2026-07-11) confirmed the deployed VR0-DC0/Willamette clouds
use a net-byte (`NN`) mnemonic (provider `:10`+VIP `:11`, metal `:20`, data `:30`,
storage `:40`, repl `:50`) with `/60`-per-plane + `/64`-active. `dc-dc-prefixes-import.py`
did NOT match it (arbitrary contiguous plane indices, `/64`-only) -- scope-doc
sub-decision #1. Operator deferred to the Code stream's recommendation; ratified as
**D-111**. This implements it.

## What changed

### `netbox/dc-dc-prefixes-import.py`
- **Replaced `carve_ula` + `carve_gua` with `carve_v6(dc, org_ula_48, dc_gua_prefix)`**
  returning `[(cidr, role_slug, kind)]` on the D-111 layout: provider-public GUA
  `/60`+`/64`@`:10` + VIP `/64`@`:11`; metal-admin/metal-internal SHARE the metal `/60`@`:20`
  (`:20`/`:21`); data `:30`, storage `:40`, replication `:50` each `/60`+`/64` ULA.
- **New `_sub_at()` helper** -- computes the Nth subnet by direct integer arithmetic,
  NEVER `list(base.subnets())` enumeration (preserves the DOCFIX-181 no-hang property;
  the old `carve_gua` `next()` fix is subsumed).
- **`DC_V6_INDEX`** maps the per-DC ULA `/56` to the GUA site nibble (dc1->`:02xx`,
  dc2->`:03xx`) so the 4th hextet reads `DC.NN` in both families.
- `main()` + `verify()` updated to consume the record list; docstring SUBCARVE SCHEME
  rewritten. Per-DC prefix count is now 18 (6 v4 + 12 v6), was 12.

### `tests/dc-dc-prefixes-import/test_logic.py`
- `carve_ula`/`carve_gua` tests replaced with `carve_v6` structure/family/NN-offset/
  non-overlap/no-hang assertions; end-to-end counts 12 -> 18; e2e GUA blocks use the real
  `2602:f3e2:f02::/48` / `f03::/48`. **53/53 PASS** (was 40/40).

### `docs/design-decisions.md`
- **D-111 ADOPTED** (the ruling above), incl. the metal `/60`-sharing resolution and the
  explicit out-of-scope note (lbaas-mgmt/vpn/oob mirrored separately; G5 naming is its own D).

### `docs/dc-dc-netbox-buildout-scope.md`
- Sub-decision #1 marked RATIFIED as D-111.

## Verification
- `bash tests/dc-dc-prefixes-import/run-tests.sh` -> ALL PASS (53 checks).
- `bash scripts/repo-lint.sh` -> 0 fail. Standalone address math confirmed for dc1/dc2.
- NOT yet run against a real NetBox (the Office1 simulation instance doesn't exist yet;
  it will be the first real target, then refinements flow back to `netbox.baldurkeep.com`).

## Revert
- `git checkout netbox/dc-dc-prefixes-import.py tests/dc-dc-prefixes-import/test_logic.py`
  to the pre-DOCFIX-182 revision; remove the D-111 entry from `design-decisions.md` and the
  scope-doc ratification note; `git rm` this changelog.