Real config.xml root is the lowercase <opnsense> element (the whole firewall config); plugin/core model data like WireGuard lives nested inside a separate, capitalized <OPNsense> child element. The parser was matching the capitalized name as the document root, so every real export failed with "expected element type but have ...". Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019VjwLYRA87o8m9a9zztgs3