Session-ledger checkpoint so a fresh session can resume cold.

LIVE STATE (measured): office1-opnsense is UP -- routing, NAT, egress 0.0% loss, serial console,
SSH key management, and kea-dhcp4 serving DHCP on udp/67 (pool .100-.199). 8 LAN pass rules in
pf. Nothing broken, nothing mid-flight.

LANDED TODAY:
  1. DOCFIX-193 APPLIED -- DHCP live (was built-but-unapplied at last close)
  2. SEC-005 -- GitBucket credential stored; unattended git push now WORKS (the branch had sat
     12 commits ahead of origin for two days -- a real data-loss exposure, now closed)
  3. SEC-006/007 -- the two known credential exposures put ON the ledger (prose only before)
  4. D-113 RULED (a2): stay on OPNsense, move config to the REST API
  5. D-113(a2) PROVEN END TO END, read AND write: API -> OPNsense -> Kea -> daemon.
     scripts/opnsense-api.sh + harness (21 PASS); gauntlet 53 ALL GREEN.

THE ONE TRAP: DHCP on Office1 is now API-MANAGED. A full rendered config.xml push WOULD CLOBBER
IT. Do NOT run the old scp/install/reboot path against this edge until the template is reduced.

NEXT: reduce opnsense-config.xml.tmpl to a minimal bootstrap (sshd + root key + console) and move
DHCP/firewall/interfaces to the API. Repo work; no live mutation needed to land it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B6Fzre1CxCY8tzwFCudu57