2026-07-13 -- safety sweep: the config.xml push path is now a LIVE HAZARD

After D-113(a2) was proven (edge config is API-managed), every instruction in the repo that still said "render a config.xml and push it to the edge" became actively dangerous. This sweep finds them and marks them. No behaviour changes; no live system touched. Warnings and headers only.

Why this was urgent

Office1's DHCP is now API-managed. A full config.xml push REPLACES /conf/config.xml wholesale and drops ~667 migration-populated elements (measured 2026-07-13), including the only two firewall pass rules on the box. Following the old runbook steps against the live edge would clobber it. An instruction that destroys a working router is worse than no instruction.

What the sweep also caught (a PRE-EXISTING landmine, unrelated to today)

runbooks/dc-dc-phase2 Step 4 still instructs building a config ISO for DC1's edge -- but D-112 established that ISO can never be read. opnsense-importer -b probes for a read-only root; on a pre-installed nano the root is writable and a factory /conf/config.xml already exists, so it bootstrap_and_exit 0s without enumerating a single device. That runbook has been telling anyone who follows it to build an inert artifact and then wonder why the edge came up on factory defaults -- which is EXACTLY the day we lost on 2026-07-12. It was never corrected at the source.

Its WAN_IF/LAN_IF "chicken-and-egg" discussion is likewise moot: that problem only exists if you try to seed a full config before first boot. D-112(c) measures the real vtnetN mapping after boot, where it is knowable.

Marked (5 files)

file	what was done
`runbooks/dc-dc-phase1-office1-standup.md`	DANGER banner; the config.xml render + ISO sub-steps REMOVED as runnable instructions (they would clobber the live Office1 edge). Image-prep retained. History preserved in git + the build changelog.
`runbooks/dc-dc-phase2-tofu-dc-substrate.md`	STOP banner on Step 4: the ISO is inert (D-112), full-config rendering is superseded (D-113(a2)), and the WAN_IF/LAN_IF problem is moot. Points at the proven Office1 path.
`scripts/opnsense-render-config.sh`	DANGER header at point-of-use. NOT dead -- under D-113(a2) it is to be REDUCED to a minimal bootstrap render (sshd + key + console). Until then, safe only for a brand-new, not-yet-booted edge.
`scripts/opnsense-build-config-iso.sh`	RETIRED header quoting the upstream source that proves the importer can never fire on nano. Kept (not deleted) because D-112 says retire it in the same change that reduces the template -- which has not landed.
`docs/dc-dc-deployment-workflow.md`	STALE-CONTENT warning at the top of the tooling gap register (the doc a fresh session reads first).

Changelogs were deliberately NOT touched: they are history, not instructions. Marking history is noise; marking instructions is safety.

Verification

Harnesses still green (headers only): opnsense-render-config 24 PASS, opnsense-build-config-iso 2 PASS, opnsense-api 21 PASS. repo-lint 0 fail.

Still OPEN (the actual D-113(a2) migration -- NOT done)

Reduce the template to a minimal bootstrap, retire the config-ISO path and the opnsense-edge module's config_seed/cdrom wiring, and rewrite Stage 3's edge steps around the API. This sweep makes the repo SAFE in the meantime; it does not make it FINISHED.

Revert

git revert <this commit>

Restores the previous (dangerous) instructions verbatim. Nothing else changes.