[Gerrrt]

What changed

Records the firewall restore rehearsal run on trinity on 2026-09-27. It no longer describes a procedure nobody had tried; it says what happened.

• docs/runbooks/restore-the-firewall.md
  • "Rehearse the restore on the spare" is now a dated record: the box, the export, the release, the time, and a table of results. The "hypothesis" and "Nobody has done this yet" sentences are gone. The procedure stays so it can be run again.
  • §3 now contains what the runbook had not said, in a new step 0 and updates to steps 1–3:
    • Secure Boot has to be off, and the change only takes effect after typing HP's four-digit code on the next boot.
    • The undisclosed Wireless-AC 9560 makes the kernel panic under iwm. The BIOS Wi-Fi switch doesn't stop it; hint.iwm.0.disabled does.
    • The Netgate Installer needs the internet, because there has been no offline CE installer since 2.7.2.
    • The installer lists the interfaces, and you choose WAN and LAN.
    • The UI restore path works.
  • The note at the top about the installer stick is updated, and so is the Time estimate: 42 minutes measured.
• docs/roadmap.md: the Rehearse the firewall restore on trinity #92 entry now records the result.
• docs/hardware.md: the trinity entry records the rehearsal, why the 9560 can't be switched off in the BIOS (it's CNVi), and the firmware state the box was left in for Build the sensitive-tier host on the ProDesk (ADR-0034) #404. The installer-stick entry says it holds the online installer.

Why

Closes #92. Its "done when" condition was met on the bench. A restore of config-20260926T043704Z, taken from oracle, onto pfSense CE 2.9.0 on trinity with the I226 card booted with no interface-assignment prompt. A client tagged into VLAN 99 got a lease from that VLAN's scope.

Blast radius

Docs only. Nothing in the running lab changes.

• No change to network segmentation or firewall rules
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml

Verification

On the bench, from trinity's console shell and a MacBook on the I226 port:

Check	Expected	Got
grep -c '<rule>' /cf/conf/config.xml	112	112
Tripwire rules (§4 step 5)	4	4
<Tunnel_Peers> rules	12	12, and the table holds a subnet
Kea DHCP scopes	6	6
Interfaces	WAN em0, LAN igc0, six VLANs	all present, each on its .1/24
Client on VLAN 99	lease from that scope	10.0.99.100, and the gateway answered ping

§4's segmentation checks and the SNMP target checks need the rack, so they weren't run on the bench.

• make validate passes (16 checks skipped in this environment), and markdownlint-cli2 reports 0 issues
• Deployed to the lab and confirmed working: the rehearsal itself
• Docs updated (docs/, docs/roadmap.md)

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ee5oBrtHGsV2Fch9j6enYz

---

Generated by Claude Code