diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index c80efcc..661d38f 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -99,7 +99,12 @@
    fiber is East-West/replication ONLY, never an internet path).
 8. `docs/dc-dc-deployment-workflow.md`'s status table was corrected 2026-07-13, but re-read it
    against reality before trusting any row -- it has drifted twice.
-9. **Doc-accuracy finding (measured 2026-07-13, logged not actioned):** `docs/security-ledger.md`
+9. **DHCP HAS NEVER SERVED A REAL LEASE.** `kea-dhcp4` is running and bound to udp/67 with the
+   subnet and pool intact -- but `office1-local` has no client host yet, so no client has ever
+   taken a lease. The daemon is proven; the SERVICE is not proven end-to-end. The first VM on
+   `office1-local` (i.e. the Stage 2 headend VMs, item 1) is the real test -- treat a successful
+   lease as that stage's gate, not an assumption.
+10. **Doc-accuracy finding (measured 2026-07-13, logged not actioned):** `docs/security-ledger.md`
    SEC-007 says "D-112(c) makes SSH the only management path". MEASURED on the live edge: the web
    GUI IS listening on the LAN side (10.10.0.1:443 HTTPS 200; :80 301-redirects to it), and is
    correctly firewalled OFF on the WAN side (172.30.1.2:443/:80 closed). This is OPNsense-default
@@ -187,13 +192,19 @@
    byte-compatible forever, and a mismatch FAILS SILENTLY (keys that never authenticate).
 4. **A config ISO can NEVER be read on an OPNsense nano image** (D-112). Any instruction to build
    one is a trap; the dc-dc-phase2 runbook directed people into it for days.
-5. **Guide changes must sweep the tenant AI skill in the SAME change.** Skill-lag was caught twice
+5. **root's shell on the OPNsense edge is `tcsh`, not `sh`.** A `$(...)` inside a quoted remote
+   command dies with "Illegal variable name" -- and it dies QUIETLY. This already cost one defect:
+   a pre-install snapshot silently no-op'd and the install then ran with no snapshot behind it.
+   **Always feed remote commands to `sh -s`.** (The `scripts/opnsense-apply-config.sh` that was
+   once wanted here is SUPERSEDED -- that snapshot/scp/install/reboot path is the very config.xml
+   path D-113(a2) deleted. Do not build it. The tcsh trap still applies to any SSH to the edge.)
+6. **Guide changes must sweep the tenant AI skill in the SAME change.** Skill-lag was caught twice
    (DOCFIX-135/136) and is now ENFORCED by repo-lint L8 (guide<->skill coupling; the guide's sha256
    is pinned, and any guide edit FAILS lint until re-recorded).
-6. **The controller model is `admin/controller`,** not `<user>/controller`.
-7. **`juju status --format=line` omits workload messages on 3.6** -- this caused a cloud-assert
+7. **The controller model is `admin/controller`,** not `<user>/controller`.
+8. **`juju status --format=line` omits workload messages on 3.6** -- this caused a cloud-assert
    false negative (fixed by DOCFIX-087). Don't rely on it.
-8. **repo-lint's guards are load-bearing; reword rather than weaken.** L3 (docs must not reference
+9. **repo-lint's guards are load-bearing; reword rather than weaken.** L3 (docs must not reference
    missing scripts) correctly went RED on the config.xml tombstones -- the tombstones were reworded,
    the guard kept.