diff --git a/.claude/skills/openstack-cloud-ops/references/environment.md b/.claude/skills/openstack-cloud-ops/references/environment.md
index 76775ee..d6d1841 100644
--- a/.claude/skills/openstack-cloud-ops/references/environment.md
+++ b/.claude/skills/openstack-cloud-ops/references/environment.md
@@ -30,9 +30,10 @@
 root CA), OVN 24.03, Ceph Squid, Octavia (amphora), Barbican,
 mysql-innodb-cluster, RabbitMQ, Magnum + magnum-capi-helm driver + azimuth
 (SUBSTRATE below the charms -- pins + traps in `references/platform-traps.md`:
-libvirt/KVM via the `dmacvicar/libvirt` OpenTofu provider `0.9.8` on OpenTofu
-`v1.12.3`; **LXD pinned to the `5.21` LTS track** -- MAAS 3.6/3.7 cannot talk
-to LXD >= 6.7, D-114; OPNsense 26.1 edges driven by REST API, D-113; the vcloud
+libvirt/KVM via the `dmacvicar/libvirt` OpenTofu provider `0.9.8` (tofu +
+component pins: `docs/CURRENT-STATE.md` section 7, the pin authority);
+**LXD pinned to the `5.21` LTS track** -- MAAS 3.6/3.7 cannot talk
+to LXD >= 6.7, D-114; OPNsense edges driven by REST API, D-113; the vcloud
 host is ITSELF a KVM guest, so nesting is a per-level requirement)
 capi-helm-charts (kubeadm engine), in-cloud single-homed CAPI mgmt VM
 (capi-mgmt-v2, k8s-snap, D-035). NetBox is the IPAM apex: never hand-edit
diff --git a/.claude/skills/openstack-cloud-ops/references/platform-traps.md b/.claude/skills/openstack-cloud-ops/references/platform-traps.md
index b8f2910..95cd868 100644
--- a/.claude/skills/openstack-cloud-ops/references/platform-traps.md
+++ b/.claude/skills/openstack-cloud-ops/references/platform-traps.md
@@ -19,7 +19,7 @@
 | OpenTofu | `v1.12.3` (as-run) | the binary that actually executed Stage 1 |
 | LXD | **`5.21` LTS track** | MAAS 3.6/3.7 is INCOMPATIBLE with LXD >= 6.7 (D-114; see below) |
 | MAAS | 3.7.2 (VR0) | the LXD ceiling above is a property of MAAS 3.6/3.7 |
-| OPNsense | 26.1 "Witty Woodpecker" | ISC-DHCP left core in 26.1 -- Kea/dnsmasq only (see below) |
+| OPNsense | live pin: CURRENT-STATE.md section 7 (26.7 as of 2026-07-18) | ISC-DHCP left core AT 26.1 -- Kea/dnsmasq only on every later release (see below) |
 | Vault charm | `1.8/stable` | 1.16 is an incompatible charm, deliberately NOT an upgrade (appendix-B, D-068) |
 
 Charm channels/revisions are appendix-B's job, not this file's. This file
@@ -319,7 +319,7 @@
 Because LXD **VMs** (not containers) are qemu/KVM guests, this pattern needs
 nested KVM at whatever depth the LXD host sits -- see 1d.
 
-## 4. OPNsense 26.1 edge
+## 4. OPNsense edge (traps entered at 26.1; they persist on the live 26.7)
 
 ### 4a. `config.xml` is GUI-owned. Do not hand-author it. (D-112, D-113)
 
@@ -350,7 +350,7 @@
 box."
 https://docs.opnsense.org/releases/CE_26.1.html
 
-So on a fresh 26.1 image: an ISC `<dhcpd>` block configures nothing (that was
+So on a fresh 26.1-or-later image: an ISC `<dhcpd>` block configures nothing (that was
 DOCFIX-193), and the GUI default backend is **dnsmasq**, not Kea. This edge
 deliberately runs **Kea** (10.10.0.0/24, pool .100-.199, first real lease
 served to `voffice1` 2026-07-13).