docs: queue BL-E13 (da07 subnet bits/mask entry) as next up in the backlog

docs/BACKLOG.md

@@ -14,6 +14,12 @@ here when starting a work session.
 **Status key:** `TODO` · `IN PROGRESS` · `DONE` · `WONTFIX`
 **Priority:** P1 (do soon) · P2 (normal) · P3 (nice-to-have)
 
+> **▶ Next up (2026-06-12):**
+> [BL-E13 — DA-07 subnet bits/mask dual display + entry](#bl-e13--da-07-subnet-bitsmask-dual-display--mask-aware-entry--p1--todo)
+> — spec is written and approved
+> (`docs/superpowers/specs/2026-06-12-da07-subnet-mask-display-and-input-design.md`);
+> next step is the implementation plan, then build.
+
 ---
 
 ## Suite / monorepo
@@ -1137,6 +1143,33 @@ that work routes through this builder instead of hand-rolling a raw `~O` frame a
 inherits the block. Two tests cover the normal path and the `0x42` rejection.
 - **Files:** `protocol/encoder.py`, `tests/da07/test_encoder.py`.
 
+### BL-E13 — DA-07 subnet bits/mask dual display + mask-aware entry · P1 · TODO
+*Added 2026-06-12. **▶ Next up — first thing to work on.** Spec written and approved:
+`docs/superpowers/specs/2026-06-12-da07-subnet-mask-display-and-input-design.md`.*
+**Category:** Missing-feature · **HW:** `[no-hw]` (firmware-source-verified 2026-06-12)
+
+Replicate the DA-12's subnet UX on the DA-07 Station tab: display the "Subnet Mask
+Bits" row as both the stored host-bit count *and* its dotted mask
+(`8 (mask 255.255.255.0)`), and edit through a modal accepting **either** form,
+always storing the host-bit count.
+
+**Firmware-verified findings that shape it** (read directly from the DA-07 source,
+`netburner.c:464-481` — recorded as **BUG-ICD-13** in the ICD by this work): the
+DA-07 uses the same XPort host-bits encoding as the DA-12C, but only `0` is a
+default sentinel (`255` is **not**), and two firmware bugs (a 16-bit shift overflow
+and a byte-swap precedence bug) mean **only stored 0–8 (masks /24–/31) are applied
+correctly** — stored 9–15 go out with scrambled middle octets, 16–255 (including
+the common /16 and /8) degenerate to `0.0.0.0`. Decision: the tool **rejects input
+outside 1–8** with a message naming the firmware limitation; values 9–255 read back
+from a device display flagged, never crash, never silently rewritten.
+
+Pieces (per spec): new pure `da07/protocol/subnet.py` + `da07/ui/subnet_dialog.py`
+(DA-07-local — deliberately *not* extracted to core; the DA-12/DA-07 rules differ
+and rule-of-three says wait), SettingsList custom-row wiring in
+`da07/ui/station_tab.py` + `station_settings_meta.py`, refreshed `help.py` text,
+BUG-ICD-13 entry in `docs/DA-07 SERVICE-TOOL-ICD.md`, three new test files.
+Next step: implementation plan (writing-plans), then build.
+
 ---
 
 ## IOModbus module