# Changelog 2026-07-10 -- Proposed netem parameters + ULA/GUA generation guidance (DOCFIX-168)

No live infrastructure touched -- documentation only, no repo mutation
beyond a new doc and gap-register/ledger pointers. Addresses tooling gap
register items #4(d) and #11.

## Item

### 1. DOCFIX-168 -- `docs/dc-dc-netem-and-ula-gua-proposal.md`
FILES: `docs/dc-dc-netem-and-ula-gua-proposal.md` (new), `docs/dc-dc-
deployment-workflow.md` (gap items #4(d) and #11 updated to reference it).

WHAT: two independent parts, neither of which invents or decides a value
the operator/NetBox must own -- both make the NEXT step fast once the
operator is ready, per this repo's discipline of presenting options
rather than silently deciding anything not yet ADOPTED.

**Part 1 -- proposed `tc netem` parameters (D-100 gap #4(d)):** a concrete
recommendation (1ms delay, 0.2ms jitter, 0.01% loss, uncapped rate), each
with reasoning grounded directly in the buildout design's own stated
"same-metro dark fiber, low single-digit ms" lean (not invented from
nothing) -- presented as a table for explicit operator ratification, with
instructions to record the ruling as a D-100 sub-item amendment in
`docs/design-decisions.md` (mirroring how every other Stage-0 redline item
was recorded) once accepted or adjusted.

**Part 2 -- ULA/GUA/DC2-supernet generation guidance (D-101 gap #11 + gap
#3's data half):** explicitly does NOT generate the org ULA /48, obtain
the real per-DC GUA carve, or assign DC2's supernet -- gives the operator
the exact, safe command to generate a real RFC 4193-compliant ULA /48
themselves (`openssl rand -hex 5`, confirmed via research this evening
that a cryptographically random 40 bits satisfies RFC 4193's statistical-
uniqueness requirement, matching what every independent ULA-generator
tool checked tonight actually does), and explains precisely why the GUA
carve and DC2 supernet are NOT generation tasks at all but real IPAM/ARIN
coordination requiring visibility and authority this session does not
have.

VERIFIED: `bash scripts/repo-lint.sh` 0 fail, 1 documented legacy warn.

REVERT: `rm docs/dc-dc-netem-and-ula-gua-proposal.md && git checkout
HEAD~ -- docs/dc-dc-deployment-workflow.md` (safe -- no infrastructure
touched, no value generated or applied).

## Next actionable step

Both parts wait on the operator: Part 1 needs an explicit accept/adjust
ruling (recordable as a D-100 amendment in one sitting); Part 2's ULA
command takes two minutes to run once the operator is ready, after which
`netbox/dc-dc-prefixes-import.py --dc dc1` becomes runnable for real (only
`ORG_ULA_48`/`DC_GUA_PREFIX` are needed for dc1; `DC2_V4_SUPERNET`
additionally for dc2).