Operator asked to re-examine option (a) (bake /conf/config.xml into the nano) before
committing to (c). Done, and it is BLOCKED on this host -- measured, not assumed:

  CONFIG_UFS_FS=m but "# CONFIG_UFS_FS_WRITE is not set"  -> UFS driver is READ-ONLY
  partition table: MBR, a single FreeBSD a5 partition     -> UFS only, no FAT to write
  fuse-ufs / ufs2-tools                                   -> not present, not packaged
  libguestfs (guestfish / virt-copy-in)                   -> not installed

Two ways (a) could be forced, both rejected and recorded so they are not re-litigated:
a FreeBSD helper VM (works, xorriso is present to remaster a live ISO -- but it means
maintaining a builder VM forever to deliver one 4.5 KB file), and a raw byte-patch of
the image (probably works; silently corrupts if the file is not block-contiguous, and
is NON-TRANSFERABLE -- you cannot byte-patch a real appliance on Roosevelt hardware,
which is exactly what this repo's governing constraint forbids).

Examining (a) properly STRENGTHENED (c): (a) is not merely less mainstream here, it is
unavailable without a detour costing more than (c)'s entire bootstrap.

Bootstrap RULED (operator): B1 = temporary host leg on virbr2 (reversible; no change to
the D-100 network definition). B2 = one interactive console login to enable SSH and
install the ed25519 pubkey already generated in ~/vr1-office1-creds/, after which
everything is plain SSH/SCP.

Module change enabling B2: the edge's serial becomes a unix socket + a log file, rather
than a write-only file source. Both roles are needed and they are different:
  source.unix -> INTERACTIVE bidirectional console. A `file` source is write-only capture
                 and cannot be typed into, so it cannot bootstrap anything. A unix socket
                 is scriptable with `socat - UNIX-CONNECT:`, unlike a pty, which needs a
                 controlling TTY.
  log         -> preserves full boot capture from power-on (a socket loses anything
                 emitted before a client connects). That capture is what made both
                 2026-07-12 boot bugs legible; it is not being dropped.

S1+S2 guards PASS, harness 6/6, repo-lint 0 fail, tofu fmt/validate clean.
Live recreate + host leg remain separately gated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y117t1F525ba9r1vXSBETk