diff --git a/docs/design-decisions.md b/docs/design-decisions.md
index fe0b762..653b2d7 100644
--- a/docs/design-decisions.md
+++ b/docs/design-decisions.md
@@ -2312,9 +2312,37 @@
 
 ## D-113: is OPNsense the right edge platform, or should the simulated edges be VyOS/Linux?
 
-**Status:** PROPOSED 2026-07-13 -- operator asked, after a five-bug day building the Office1
-edge, whether something is better suited. Options and evidence below; NOT ruled. Do not
-migrate, and do not build edges 2/3, until this is ruled.
+**Status:** **ADOPTED 2026-07-13 -- option (a2): STAY ON OPNSENSE, MOVE CONFIG TO THE REST API.**
+Operator ruling ("go ahead and continue with your rest API recommendation"), after two
+constraints were surfaced during the discussion that narrowed the field decisively:
+
+1. **GUI access is a REQUIREMENT** (operator, 2026-07-13). This ELIMINATES option (b) VyOS and
+   option (c) plain-Linux outright -- neither has a GUI. Both had been the leading candidates
+   until this was stated; recording it so the reasoning is not re-run from the wrong premise.
+2. **VyOS LTS binaries are subscription-gated** (verified 2026-07-13, vyos.net/get + the
+   Software Access Subscription page). Free VyOS means the ROLLING release -- a moving target
+   that fights this repo's appendix-B version-pinning discipline -- or building from source.
+   Independent of the GUI point, this was real friction.
+
+Remaining open-source field was OPNsense / pfSense CE / OpenWrt / IPFire. pfSense REJECTED
+(same GUI-owned XML lineage -- a migration that buys nothing). IPFire: weakest automation
+story. **OpenWrt was the credible alternative** -- its UCI config is text-first BY DESIGN
+(LuCI and the CLI read/write the same `/etc/config/*` files, so editing config as text is a
+supported path, structurally unlike OPNsense's GUI-owned `config.xml`) -- but it costs a new
+image pipeline, a fresh bootstrap problem (it also defaults to LAN `192.168.1.1`), and dnsmasq
+instead of Kea, all to escape a problem fixable in place.
+
+**The ruling rests on this:** the bug class was never "OPNsense". It was hand-authoring
+`config.xml`, a GUI-owned format, when OPNsense ships a documented REST API with mature Ansible
+collections modelling exactly what we got wrong (`dhcp_subnet`, firewall rules, system settings
+as typed first-class resources). **None of DOCFIX-191/192/193 is expressible through the API** --
+you cannot forget to enable sshd in a format where sshd is a typed field with a default. (a2)
+keeps the GUI, keeps a WORKING routing+DHCP edge, keeps the two libvirt fixes, and removes the
+defect source -- and it is the smallest change of anything considered.
+
+**Superseded by this ruling:** the "stay on (a1)" lean in the original recommendation below.
+(a1) is now explicitly REJECTED: its cost compounds per feature and it depends on an
+undocumented self-heal of an internal format (see the 667-element finding).
 
 **Scope.** The VR1 edges are SIMULATED customer-site / ISP routers (Office1 today; Stage 3 adds
 one per DC). They are lab infrastructure, not a product surface. Nothing a tenant touches
diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index af2ba8b..5baa343 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -1954,6 +1954,20 @@
   (a2). NOT RULED -- operator decides. Rule BEFORE Stage 3 (it builds 2 more edges from this
   same module; ruling after means migrating 3 edges instead of 1).
 
+- **D-113 RULED 2026-07-13: option (a2) -- stay on OPNsense, MOVE CONFIG TO THE REST API.**
+  Two operator constraints narrowed the field decisively: (1) **GUI access is a REQUIREMENT**
+  -- this eliminates VyOS and plain-Linux, which had been the leading candidates; (2) VyOS LTS
+  binaries are subscription-gated (verified), so free VyOS = rolling, fighting appendix-B
+  version pinning. OpenWrt was the credible alternative (UCI is text-first by design) but costs
+  a new pipeline + bootstrap + dnsmasq to escape a problem fixable in place. (a1) config.xml
+  templating is now explicitly REJECTED.
+  **Next: retire hand-authored config.xml.** Bootstrap config keeps ONLY what the API cannot
+  set on a factory box (sshd + root key + console + the API key); everything else -- DHCP,
+  firewall, interfaces -- moves to the API/Ansible collection. Live edge recon (2026-07-13):
+  lighttpd IS listening on 443/80, the API answers 401 (alive), root has 0 API keys -> minting
+  one via the GUI is the bootstrap step (the supported path; hand-editing apikeys into
+  config.xml would be the very anti-pattern being retired).
+
 ## State facts to remember
 
 - beta cluster left at **node_count=2** (deliberate; bonus resize acceptance coverage).