docs+fix(telnet): label getpdo output as runtime-layer-only, not proof of persistence

Addresses recommendations 4 and 7 from #515 comment 5231931569: a
green-looking getpdo readback only confirms the sys configuration
writes were accepted, not that they'll survive a reboot (that's what
the envswitch-persisted layer decides). Labels the getpdo line in both
migrateViaTelnet and runTelnetInjection's CLI/log output accordingly,
softens migrateViaTelnet's "succeeded" wording to "accepted", and adds
the same one-line caveat to TELNET-MIGRATION-METHOD.md #2.3 (previously
only in TELNET-COMMAND-REFERENCE.md).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/content/docs/analysis/TELNET-MIGRATION-METHOD.md

@@ -123,7 +123,11 @@ in-band equivalent to the HTTP `/setMargeAccount` call, useful when the
   about.
 - Useful read-only verification command: `getpdo CurrentSystemConfiguration` —
   prints the URLs after the changes have been applied so we can verify before
-  rebooting.
+  rebooting. **It only reflects the runtime (`sys configuration`) layer, not
+  the `envswitch`-persisted layer, so a matching `getpdo` here confirms the
+  writes were accepted, not that they will survive the reboot** — see the
+  layer-visibility caveat in
+  [TELNET-COMMAND-REFERENCE.md](TELNET-COMMAND-REFERENCE.md).
 - `sys reboot` is the trigger that re-reads both layers.
 
 ### 2.4 What Telnet:17000 cannot do

pkg/service/setup/enable_ssh.go

@@ -135,7 +135,7 @@ func (m *Manager) runTelnetInjection(deviceIP string, forbidQuote, cmds []string
 	}
 
 	if verify, err := t.SendCommand("getpdo CurrentSystemConfiguration"); err == nil {
-		fmt.Fprintf(&logs, "→ getpdo CurrentSystemConfiguration\n%s\n", strings.TrimRight(verify, "\r\n"))
+		fmt.Fprintf(&logs, "→ getpdo CurrentSystemConfiguration (runtime layer only — confirms the writes were accepted, not that they'll survive a reboot)\n%s\n", strings.TrimRight(verify, "\r\n"))
 	}
 
 	return logs.String(), nil

pkg/service/setup/telnet_migration.go

@@ -130,13 +130,13 @@ func (m *Manager) migrateViaTelnet(deviceIP, targetURL string, urls telnetURLs)
 		return logs.String(), fmt.Errorf("verification command failed: %w", err)
 	}
 
-	fmt.Fprintf(&logs, "→ getpdo CurrentSystemConfiguration\n%s\n", strings.TrimRight(verify, "\r\n"))
+	fmt.Fprintf(&logs, "→ getpdo CurrentSystemConfiguration (runtime layer only — confirms the writes were accepted, not that they'll survive a reboot)\n%s\n", strings.TrimRight(verify, "\r\n"))
 
 	if !strings.Contains(verify, targetURL) {
 		return logs.String(), fmt.Errorf("verification failed: getpdo response does not contain %q (device may have rejected the new URLs)", targetURL)
 	}
 
-	logs.WriteString("Telnet migration succeeded. Reboot the device to apply.\n")
+	logs.WriteString("Telnet writes accepted (runtime layer). Reboot the device so the envswitch-persisted layer takes over.\n")
 
 	return logs.String(), nil
 }

pkg/service/setup/telnet_migration_test.go

@@ -90,7 +90,7 @@ func TestMigrateViaTelnet_HappyPath(t *testing.T) {
 		}
 	}
 
-	if !strings.Contains(logs, "succeeded") {
+	if !strings.Contains(logs, "accepted") {
 		t.Errorf("logs missing success marker:\n%s", logs)
 	}