# 2026-07-13 -- D-113(a2) write path PROVEN on the live edge

The READ half was proven earlier today. This closes the other half: **configuration written
through the REST API reaches the running daemon.** (a2) is now demonstrated end to end, not
argued.

## What was executed (live, operator-approved)

    POST kea/dhcpv4/set_subnet/93473635-f2aa-5c0a-986c-438e59088c6c   -> {"result":"saved"}
    POST kea/service/reconfigure                                       -> {"status":"ok"}
    GET  kea/service/status                                            -> {"status":"running"}

Deliberately IDEMPOTENT: the payload was the exact values read back from the API moments before
(`subnet 10.10.0.0/24`, `pools 10.10.0.100-10.10.0.199`, `routers`/`domain_name_servers`
`10.10.0.1`, `description "LAN DHCP"`). Nothing about the edge's behaviour should change -- the
point was to exercise the WRITE path, not to alter the edge.

## GROUND TRUTH after the write (not the API's self-report)

The API saying `{"result":"saved"}` is the service's own verdict. What was actually measured on
the box:

    kea-dhcp4 pid 30027 (RESTARTED), bound udp4 10.10.0.1:67

Kea's OWN generated config (`/usr/local/etc/kea/kea-dhcp4.conf` -- the daemon's JSON, not
OPNsense's XML):

    interfaces           : ['vtnet0']
    subnet               : 10.10.0.0/24
    pools                : ['10.10.0.100-10.10.0.199']
    routers              : 10.10.0.1
    domain-name-servers  : 10.10.0.1
    domain-name          : office1.vr1.cloud.neumatrix.local

Router unaffected (the endpoint touches only Kea, but verify, never assume):
WAN 172.30.1.2, LAN 10.10.0.1, default route 172.30.1.1, 8 LAN pass rules loaded in pf,
egress to 1.1.1.1 at **0.0% packet loss**.

**The full chain works: API write -> OPNsense renders -> Kea loads -> daemon serves.**

## Payload shape (measured -- do not infer this)

OPNsense GET returns select fields as `{value: {selected: 0|1}}`; SET expects the comma-joined
selected values. A GET response is therefore NOT directly re-POSTable -- it must be flattened:

    {"routers": {"10.10.0.1": {"value": "10.10.0.1", "selected": 1}}}   # what GET returns
    {"routers": "10.10.0.1"}                                            # what SET expects

`kea/service/reconfigure` is the apply verb (ServiceController extends
ApiMutableServiceControllerBase; `$internalServiceName = 'kea'`). Without it the config is saved
but the daemon is not reloaded.

## Consequence: the config.xml push path is now RETIRED IN PRACTICE

DHCP on this edge is now API-managed. **Pushing a full rendered `config.xml` would clobber it.**
Do not run the old scp/install/reboot path against Office1. The template must be reduced to a
minimal bootstrap (sshd + root key + console) before it is used again -- that is the next step
under D-113(a2), and it is NOT yet done.

## Revert

Re-POST the previous values (they are unchanged, so nothing to undo), or from the GUI:
Services > Kea DHCP > DHCPv4 > Subnets. The pre-API `config.xml` backups remain in
`/conf/backup/` on the edge.