Network Manager refactor

docs/design-v2-errata.md

@@ -61,11 +61,16 @@ CLAUDE.md invariant #9.
 
 These don't contradict the PDF (it doesn't specify them) but are worth recording.
 
-- **Network backend.** The dracut hook uses `network-legacy`/`ifup`, which needs
-  `dhclient`; RHEL 9 deprecated it and the minimal ISO omits it, so the
-  provisioner installs `dhcp-client` explicitly. dhclient is on its way out — the
-  durable fix is porting the hook to the `network-manager` dracut module
-  (tracked; see project todo).
+- **Network backend.** The dracut hook uses the `network-manager` dracut module
+  (ported 2026-06-17 from `network-legacy`/`ifup`/`dhclient`). NM hands its
+  initramfs connections to the real-root NetworkManager, which **renews the DHCP
+  lease** in the running system — network-legacy's one-shot lease was never
+  renewed, so the address dropped at lease expiry and the NVMe/TCP root died.
+  Managed/unmanaged is mode-aware: secure path → `macsec0` managed (NM DHCPs +
+  renews it), physical `en*` unmanaged (wpa_supplicant owns EAPOL/MKA), enforced
+  by the `nm-unmanaged.sh` cmdline hook writing a `/run/NetworkManager/conf.d`
+  drop-in before NM starts; test path → boot NIC managed, hook is a no-op. No
+  static unmanaged file (it couldn't be mode-aware). Awaiting boot-bench verify.
 - **Build ISO.** Defaults to a version-pinned Rocky 9.x **minimal** ISO on the
   internal mirror (`iso_url` + `sha256` `iso_checksum`). `http/ks.cfg` installs
   only core+sshd+chrony from the ISO; the diskless tooling is pulled online by