POG-EDGE — field bank-to-bank bridge (same building)
====================================================

Use on **end-of-bank** EtherGold adapters only (`ETHERGOLD_ROLE=edge`). Middle hops and
Atlas topboxes stay EDGE_MODE=0 (standard copper daisy-chain / topbox role).

Field roles (see INSTALL-GUIDE)
-------------------------------

  topbox  — POG Atlas cabinet: ethergold.service + DyzineFrame
  listen  — 19CSTS banks: ethergold-collector.service (progressives)
  edge    — this document: bank-to-bank / VPN terminus

  sudo bash set_ethergold_role.sh edge --role peer-a --uplink eth0

Topology
--------

  Bank A:  T340+ --POG422 copper-- ... -- T340+ --UART-- EtherGold (peer-a)
                                                              |
                                         WireGuard + gretap over shared LAN
                                         (EDGE_UPLINK = eth0 or wlan0)
                                                              |
  Bank B:  EtherGold (peer-b) --UART-- T340+ --POG422 copper-- ...

Within each bank, machines talk on native POG422. Only **one** EtherGold per bank
at the POG422 terminus runs edge mode. The remote game segment is `gretap0`, not
copper.

WLAN star (inside one bank — EG 2.2.2.71+)
------------------------------------------

  EDGE_TOPOLOGY=hub|spoke with EDGE_MODE=1: every Slave has a **direct** WG tunnel
  to the Master hub; meters/jackpots/discovery on signed clear WLAN. See EDGE_HUB.md.
  Software tip still lands via update.sh/SCP; enrollment is keys only.
  EDGE_UPLINK=spe is reserved until >8-node SPE is confirmed.

Modes
-----

  EDGE_MODE=0   Standard prod — ETH_PORTS=eth0,eth1 (copper daisy-chain)
  EDGE_MODE=1   POG-EDGE — ETH_PORTS=eth_game,gretap…; uplink is WG transport only
                + optional EDGE_TOPOLOGY=hub|spoke for wlan-star underlay

**Preferred start (all roles):** from the tip tree:

  bash run_ethergold.sh

Dispatches on ETHERGOLD_ROLE + EDGE_MODE + profile (from FIXTURE_PROD /
ETHERGOLD_PROFILE in env). No CLI prefixes required. EDGE auto-sudo.

Enable / disable
----------------

  # Preferred (sets ETHERGOLD_ROLE=edge + edge.env):
  sudo bash set_ethergold_role.sh edge --role peer-a --uplink eth0

  # Or enable_edge alone (also stamps role=edge):
  sudo bash enable_edge.sh --role peer-a --uplink eth0
  sudo bash enable_edge.sh --role peer-b --uplink wlan0 --wifi-psk 'secret'
  sudo bash enable_edge.sh --role peer-a --uplink eth0 --game-if none

  # Back to copper daisy-chain:
  sudo bash disable_edge.sh
  # Or full role switch:
  sudo bash set_ethergold_role.sh topbox

Config: /etc/ethergold/edge.env (legacy /etc/fixture/edge.env migrated once)
        /etc/ethergold/role.env  → ETHERGOLD_ROLE=edge
Service: ethergold.service (legacy fixture-prod.service alias during cutover)

WireGuard keys: pog-edge/keys/ or bake /etc/wireguard/wg0.conf into SD image.
Generate bench pair on PC: pog-edge/gen_bench_wg_bundle.sh

Uplink DHCP
-----------

  EDGE_DHCP_ONCE=1 (default): one DHCP on EDGE_UPLINK (eth0 or wlan0), then stop
  dhclient renewals. Game ports never DHCP. NM can stay unmanaged on game ports.

NetworkManager (persistent)
---------------------------

  Default (EDGE_MODE=0 / SD image / commission):
    /etc/NetworkManager/conf.d/10-ethergold-unmanaged.conf
      unmanaged-devices=interface-name:eth0;interface-name:eth1
    wlan0 stays managed (SSH).

  enable_edge.sh --uplink eth0 writes:
    /etc/NetworkManager/conf.d/20-ethergold-edge.conf
      unmanaged-devices=interface-name:eth1
    (eth0 re-managed for LAN/WG; eth1 stays game/AF_PACKET)

  enable_edge.sh --uplink wlan0: removes 20- (both eth unmanaged; WiFi is transport).

  disable_edge.sh: removes 20- (back to both-unmanaged copper).

  Installer: install_nm_eth_unmanaged.sh (also run by commission_prod_boot + update.sh).

Do not enable edge on middle-of-chain adapters — both SEEED ports must remain
copper for multi-hop soaks.