# 2026-07-13 -- safety sweep: the config.xml push path is now a LIVE HAZARD

After D-113(a2) was proven (edge config is API-managed), every instruction in the repo that
still said "render a config.xml and push it to the edge" became **actively dangerous**. This
sweep finds them and marks them. **No behaviour changes; no live system touched.** Warnings and
headers only.

## Why this was urgent

Office1's DHCP is now **API-managed**. A full `config.xml` push REPLACES `/conf/config.xml`
wholesale and drops ~667 migration-populated elements (measured 2026-07-13), including the only
two firewall pass rules on the box. Following the old runbook steps against the live edge would
clobber it. An instruction that destroys a working router is worse than no instruction.

## What the sweep also caught (a PRE-EXISTING landmine, unrelated to today)

`runbooks/dc-dc-phase2` Step 4 still instructs building a **config ISO** for DC1's edge -- but
**D-112 established that ISO can never be read**. `opnsense-importer -b` probes for a read-only
root; on a pre-installed nano the root is writable and a factory `/conf/config.xml` already
exists, so it `bootstrap_and_exit 0`s without enumerating a single device. That runbook has been
telling anyone who follows it to build an inert artifact and then wonder why the edge came up on
factory defaults -- which is EXACTLY the day we lost on 2026-07-12. It was never corrected at the
source.

Its `WAN_IF`/`LAN_IF` "chicken-and-egg" discussion is likewise **moot**: that problem only exists
if you try to seed a full config before first boot. D-112(c) measures the real `vtnetN` mapping
*after* boot, where it is knowable.

## Marked (5 files)

| file | what was done |
|---|---|
| `runbooks/dc-dc-phase1-office1-standup.md` | DANGER banner; the config.xml render + ISO sub-steps REMOVED as runnable instructions (they would clobber the live Office1 edge). Image-prep retained. History preserved in git + the build changelog. |
| `runbooks/dc-dc-phase2-tofu-dc-substrate.md` | STOP banner on Step 4: the ISO is inert (D-112), full-config rendering is superseded (D-113(a2)), and the WAN_IF/LAN_IF problem is moot. Points at the proven Office1 path. |
| `scripts/opnsense-render-config.sh` | DANGER header at point-of-use. NOT dead -- under D-113(a2) it is to be REDUCED to a minimal bootstrap render (sshd + key + console). Until then, safe only for a brand-new, not-yet-booted edge. |
| `scripts/opnsense-build-config-iso.sh` | RETIRED header quoting the upstream source that proves the importer can never fire on nano. Kept (not deleted) because D-112 says retire it in the same change that reduces the template -- which has not landed. |
| `docs/dc-dc-deployment-workflow.md` | STALE-CONTENT warning at the top of the tooling gap register (the doc a fresh session reads first). |

Changelogs were deliberately NOT touched: they are history, not instructions. Marking history is
noise; marking instructions is safety.

## Verification

Harnesses still green (headers only): `opnsense-render-config` 24 PASS, `opnsense-build-config-iso`
2 PASS, `opnsense-api` 21 PASS. `repo-lint` 0 fail.

## Still OPEN (the actual D-113(a2) migration -- NOT done)

Reduce the template to a minimal bootstrap, retire the config-ISO path and the
`opnsense-edge` module's `config_seed`/cdrom wiring, and rewrite Stage 3's edge steps around the
API. This sweep makes the repo SAFE in the meantime; it does not make it FINISHED.

## Revert

    git revert <this commit>

Restores the previous (dangerous) instructions verbatim. Nothing else changes.
