Modem stuck in walled garden boot file after router change — Tier 2 re-provision unsuccessful

ARRIS SURFboard G54, customer-owned, purchased new, running in bridge mode on residential service in Northern California. No Voice on the account.

The modem was activated and working normally. I then replaced the router behind it with a UniFi Dream Router. Since that change, the connection has been broken — initially many sites failed with NET::ERR_CERT_COMMON_NAME_INVALID on every device, and external DNS resolvers were unreachable. Currently the router's WAN interface gets no IPv4 lease at all.

A phone agent read me the modem diagnostics today. Boot file is d11_m_g54_walledgarden_c01.cm. Everything else in that output is healthy: device status Online, DOCSIS 3.1, downstream SNR 43.3 dB, upstream SNR 37.1 dB, downstream power 7.1 dBmV, firmware current.

Already done:

• Multiple modem and router power cycles, in several sequences
• Comcast re-provisioned the modem twice, including an attempt by Tier 2 today — the boot file did not change
• Confirmed the physical path is good: a laptop plugged directly into the same modem port with the same cable pulled a public IP and browsed normally
• MAC cloning on the router tried and disabled
• Line health confirmed by a Comcast technician by phone

The modem is clearly registering, but it's loading the walled garden config rather than a production boot file for my service tier. Since re-provisioning hasn't corrected it, I suspect a stale or duplicate equipment record on the account rather than a modem fault.

I've been offered a truck roll, but a field visit can't change a boot file that's served from the provisioning system. Could someone check the account-side device registration and get the correct config queued? Happy to provide the HFC MAC and serial by DM.