diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index f471b95..8b496f0 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -2011,6 +2011,36 @@
   scp/install/reboot path against this edge. Template reduction to a minimal bootstrap (sshd +
   key + console) is the next step and is NOT yet done.
 
+## CHECKPOINT 2026-07-13 (session close; operator away, resumes in the morning)
+
+**LIVE STATE (measured, end of session):** the Office1 edge `office1-opnsense` (10.10.0.1 LAN /
+172.30.1.2 WAN) is UP: routing, NAT (automatic), egress 0.0% loss, serial console + getty,
+SSH key management, and **kea-dhcp4 serving DHCP on udp/67** (pool .100-.199). 8 LAN pass rules
+loaded in pf. Nothing is broken; nothing is mid-flight.
+
+**WHAT LANDED TODAY**
+1. DOCFIX-193 APPLIED -- DHCP live on the edge (was built-but-unapplied at last close).
+2. SEC-005 -- GitBucket credential stored; unattended `git push` now WORKS (was the 2-day
+   data-loss exposure: the branch sat 12 commits ahead of origin).
+3. SEC-006/007 -- the two known credential exposures put ON the ledger (they had been prose only).
+4. **D-113 RULED (a2)**: stay on OPNsense, move config to the REST API. Driven by two operator
+   constraints: GUI is a REQUIREMENT (kills VyOS + plain-Linux) and VyOS LTS is subscription-gated.
+5. **D-113(a2) PROVEN END TO END on the live edge** -- READ and WRITE. API -> OPNsense -> Kea ->
+   daemon. `scripts/opnsense-api.sh` + harness (21 PASS) shipped; gauntlet 53 ALL GREEN.
+
+**THE ONE TRAP -- READ THIS BEFORE TOUCHING THE EDGE**
+DHCP on Office1 is now **API-MANAGED**. A full rendered `config.xml` push WOULD CLOBBER IT.
+**DO NOT** run the old scp/install/reboot path against this edge. The template has NOT yet been
+reduced to a minimal bootstrap -- that is the next step.
+
+**NEXT STEP (the actual D-113(a2) migration, NOT started):** reduce
+`opentofu/templates/opnsense-config.xml.tmpl` to a MINIMAL bootstrap (sshd + root key + console
++ nothing else) and move DHCP/firewall/interfaces to the API. This is what makes Stage 3's two
+edges nearly free. Repo work; no live mutation required to land it.
+
+**Open, unruled:** nothing blocking. SEC-006 (burned NetBox token) is DEFERRED by operator ruling
+to deployment completion.
+
 ## State facts to remember
 
 - beta cluster left at **node_count=2** (deliberate; bonus resize acceptance coverage).