End state, measured over SSH: office1-opnsense, OPNsense 26.1, WAN 172.30.1.2/24 static,
LAN 10.10.0.1/24, default route via 172.30.1.1, NAT active, and egress to the internet
WORKS through the simulated ISP (ping 1.1.1.1, 0% loss). Serial console restored
(kern.console=ttyu0, getty running). Managed over SSH with the service key.

Bootstrap: console (pexpect + virsh console) -> factory login -> config streamed as
base64, SHA-256 verified byte-exact, factory config backed up -> reboot. The DOCFIX-192
fix was then pushed OVER SSH -- the D-112(c) steady-state path proving itself.

Gotchas recorded in the ledger because each cost real time:
  - Console settings need TWO reboots. OPNsense regenerates /boot.config and
    /boot/loader.conf FROM config.xml *during* boot, so they only take effect on the NEXT
    boot. After reboot #1 the loader files were already correct while the running kernel
    was still on video. Do not conclude "the fix failed" after one reboot.
  - /etc/ttys uses `onifconsole`: getty starts on ttyu0 only if ttyu0 IS the kernel
    console. `sysctl kern.console` is ground truth.
  - The guest's root shell is CSH (both via console and ssh). It rejects $(...) with
    "Illegal variable name." Pipe POSIX scripts to `sh -s`.
  - `virsh console` REFUSES a unix-socket chardev. The serial must be a pty + log file.

LEDGER CORRECTION: the 2026-07-12 entry claimed the rendered config provided
"DHCP .100-.199". That is FALSE -- there is NO DHCP configuration in the template at all
(no <dhcpd>, no <Kea>), and nothing serves DHCP on office1-local (measured: no
kea/dhcpd/dnsmasq process, nothing on udp/67). Another optimistic claim from the
max-context session. The operator's goal was "router + DHCP": the ROUTER half is DONE,
the DHCP half was never built. OPNsense 26.1 uses Kea (ISC dhcpd is gone), so this needs
the Kea schema verified upstream -- do not invent it.

repo-lint 0 fail.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y117t1F525ba9r1vXSBETk