A fresh server gets boot-tools/blancco from the USB, which can be an older Blancco (7.15.1) than our preferences (7.20). The version guard refused to patch its config.img and the exception failed the whole share apply, so the first-boot playbook failed. refresh_live_prefs() now returns a warning for config.img and still writes the served preferences.xml (UEFI path).