docs(ipv6): close the NH3 multi-prefix question by operator ruling

The gateway has no IP-passthrough mode, confirmed by the operator with
admin access to it, so the inexpensive path of letting the UDM take the
delegation whole and carve it natively is unavailable at this site.

What remains is a separate DHCPv6 client presenting several identities,
which needs recabling to reach the gateway, splits routing so that one
device handles v4 and another v6, and above all moves IPv6 off the
UDM's zone firewall, leaving the entire policy to be rebuilt elsewhere
before any host could safely hold a globally routable address. The
operator has declined it and the LANs stay without v6.

The index entry also still asserted the superseded single-delegation
conclusion as fact; it now carries the corrected reading alongside the
ruling, so the finding and the decision not to act on it arrive
together rather than the first inviting a retry of the second.

persistent-memory.d/2026-08-17-fleet-ipv6-mesh.md

@@ -165,3 +165,21 @@ looks like BGW rationing rather than a provisioning-profile limit.
 
 Live state at correction time: `wan_dhcpv6_pd_size: 64`, `wan1 v6
 2600:1700:b25:c110::48`, all 5 NH3 LANs still `ipv6_interface_type: none`.
+
+### ⛔ CLOSED 2026-08-24 — operator ruling, do not re-raise
+
+The seven unclaimed `/64`s stay unclaimed. Two facts close it:
+
+- **The BGW has no IP-passthrough mode.** Operator confirmed, and we hold admin
+  on it — so the cheap path (let the UDM take the `/60` directly and carve it
+  natively, as it already does at ESH) does not exist here.
+- **The only remaining route is a multi-DUID DHCPv6 client on a VM**, which
+  requires re-cabling to reach the BGW's DHCPv6 server, split-stack routing
+  (UDM for v4, VM for v6), and — the actual cost — **rebuilding the whole IPv6
+  firewall policy in nftables on that VM**, because routing v6 around the UDM
+  bypasses its zone firewall entirely and would leave every LAN host globally
+  reachable.
+
+Operator's call: not worth it. **NH3 LANs stay `ipv6_interface_type: none`.**
+Do not re-propose on the strength of "there are seven free prefixes" — the
+prefixes are real, the firewall rebuild is why nobody wants them.