edge-2.iot.renner.uno joins [edge_host] (base roles only, no peripherals) and [ssh_ca], and the NTP VRRP group as BACKUP with priority 60, below edge-1. The MQTT bridge account follows the host's short name instead of a fixed edge-1, and the bridge client id is derived from it (edge-1 keeps edge1-bridge). The register gets the account edge-2, and the controller's egress policy allows edge-2's credential endpoint on 8443. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>