# 2026-07-13 -- safety sweep: the config.xml push path is now a LIVE HAZARD After D-113(a2) was proven (edge config is API-managed), every instruction in the repo that still said "render a config.xml and push it to the edge" became **actively dangerous**. This sweep finds them and marks them. **No behaviour changes; no live system touched.** Warnings and headers only. ## Why this was urgent Office1's DHCP is now **API-managed**. A full `config.xml` push REPLACES `/conf/config.xml` wholesale and drops ~667 migration-populated elements (measured 2026-07-13), including the only two firewall pass rules on the box. Following the old runbook steps against the live edge would clobber it. An instruction that destroys a working router is worse than no instruction. ## What the sweep also caught (a PRE-EXISTING landmine, unrelated to today) `runbooks/dc-dc-phase2` Step 4 still instructs building a **config ISO** for DC1's edge -- but **D-112 established that ISO can never be read**. `opnsense-importer -b` probes for a read-only root; on a pre-installed nano the root is writable and a factory `/conf/config.xml` already exists, so it `bootstrap_and_exit 0`s without enumerating a single device. That runbook has been telling anyone who follows it to build an inert artifact and then wonder why the edge came up on factory defaults -- which is EXACTLY the day we lost on 2026-07-12. It was never corrected at the source. Its `WAN_IF`/`LAN_IF` "chicken-and-egg" discussion is likewise **moot**: that problem only exists if you try to seed a full config before first boot. D-112(c) measures the real `vtnetN` mapping *after* boot, where it is knowable. ## Marked (5 files) | file | what was done | |---|---| | `runbooks/dc-dc-phase1-office1-standup.md` | DANGER banner; the config.xml render + ISO sub-steps REMOVED as runnable instructions (they would clobber the live Office1 edge). Image-prep retained. History preserved in git + the build changelog. | | `runbooks/dc-dc-phase2-tofu-dc-substrate.md` | STOP banner on Step 4: the ISO is inert (D-112), full-config rendering is superseded (D-113(a2)), and the WAN_IF/LAN_IF problem is moot. Points at the proven Office1 path. | | `scripts/opnsense-render-config.sh` | DANGER header at point-of-use. NOT dead -- under D-113(a2) it is to be REDUCED to a minimal bootstrap render (sshd + key + console). Until then, safe only for a brand-new, not-yet-booted edge. | | `scripts/opnsense-build-config-iso.sh` | RETIRED header quoting the upstream source that proves the importer can never fire on nano. Kept (not deleted) because D-112 says retire it in the same change that reduces the template -- which has not landed. | | `docs/dc-dc-deployment-workflow.md` | STALE-CONTENT warning at the top of the tooling gap register (the doc a fresh session reads first). | Changelogs were deliberately NOT touched: they are history, not instructions. Marking history is noise; marking instructions is safety. ## Verification Harnesses still green (headers only): `opnsense-render-config` 24 PASS, `opnsense-build-config-iso` 2 PASS, `opnsense-api` 21 PASS. `repo-lint` 0 fail. ## Still OPEN (the actual D-113(a2) migration -- NOT done) Reduce the template to a minimal bootstrap, retire the config-ISO path and the `opnsense-edge` module's `config_seed`/cdrom wiring, and rewrite Stage 3's edge steps around the API. This sweep makes the repo SAFE in the meantime; it does not make it FINISHED. ## Revert git revert Restores the previous (dangerous) instructions verbatim. Nothing else changes.