diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index 19b77b7..35013dc 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -1676,7 +1676,7 @@
   OPNsense root password + bcrypt hash.
 - **Build DONE except boot:** `office1-wan` NAT net `172.30.1.0/24`->enp1s0 (virsh; D-103
   debt); OPNsense 26.1 nano image prepped (DOCFIX-184: bz2 -> python3 fallback, bzip2 absent);
-  config rendered (office1-opnsense, LAN 10.10.0.1/24 + DHCP .100-.199, WAN static 172.30.1.2
+  config rendered (office1-opnsense, LAN 10.10.0.1/24, WAN static 172.30.1.2 -- NOTE: the "DHCP .100-.199" this line originally claimed was FALSE; no DHCP was ever in the template, see the 2026-07-12 D-112(c) entry
   gw .1) + ISO built; `module "office1_opnsense"` instantiated in main.tf + validated/planned
   (first real validation of modules/opnsense-edge); disk + config_seed volumes created.
 - **TWO first-boot findings (DOCFIX-186):** (1) `config_iso_path` must be OUTSIDE the pool
@@ -1855,7 +1855,55 @@
     importer's 7s timeout; a login shell has no timing race. Do not conflate them.
   - Impacts if not (b): `opnsense-build-config-iso.sh` + harness, the module's config_seed/cdrom,
     the README research section. ALSO GATES STAGE 3 (per-DC edges use this same module).
-- **Numbers:** D next-free 113, DOCFIX next-free 191.
+## Jumphost stream -- 2026-07-12 (cont.): D-112(c) EXECUTED. THE OFFICE1 EDGE IS UP AND ROUTING.
+
+- **END STATE (measured over SSH):** `office1-opnsense.office1.vr1.cloud.neumatrix.local`,
+  OPNsense 26.1. WAN `172.30.1.2/24` static, LAN `10.10.0.1/24`, default route via
+  `172.30.1.1`, NAT active, **egress to the internet WORKS** (`ping 1.1.1.1` 0% loss through
+  the simulated ISP). Serial console restored (`kern.console=ttyu0`, getty running). sshd up
+  with the service key (we manage it over SSH now).
+  (NOTE: the `sshd: DOWN` line in the verify sweep was MY CHECK BEING WRONG -- it ran over an
+  SSH session, so sshd was obviously up; the pgrep pattern just did not match. Not a fault.)
+- **Bootstrap executed:** console (pexpect + `virsh console`) -> factory login -> config
+  streamed as base64, SHA-256 verified byte-exact, factory config backed up -> reboot. Then
+  the DOCFIX-192 fix was pushed **over SSH** -- i.e. the D-112(c) steady-state path proving
+  itself. B1 host leg `10.10.0.10/24` on virbr2 is IN PLACE (non-persistent; re-add after a
+  host reboot: `sudo ip addr add 10.10.0.10/24 dev virbr2`).
+- **DOCFIX-191: the config would have LOCKED MANAGEMENT OUT.** Template had
+  `<ssh><group>admins</group></ssh>` = OPNsense's DISABLED-sshd shape, and NO authorized key.
+  Applying it would have left the edge with sshd off and no key. Fixed (`<enabled>enabled</enabled>`
+  + `<permitrootlogin>` + `<authorizedkeys>` base64). Names VERIFIED upstream, not guessed.
+- **DOCFIX-192: the config SILENCED ITS OWN ONLY CONSOLE.** No `<primaryconsole>`/`<serialspeed>`,
+  and the edge VM has **NO VIDEO DEVICE**, so serial is the only console. After the first reboot
+  the console went permanently silent. **The box survived ONLY because DOCFIX-191 had just turned
+  SSH on -- one lockout bug saved us from the other.** Fixed; console restored.
+  - **KEY GOTCHA (cost a confused cycle):** console settings take TWO reboots. OPNsense
+    regenerates `/boot.config` + `/boot/loader.conf` FROM config.xml *during* boot, so they only
+    take effect on the NEXT boot. After reboot #1 the loader files were already correct while the
+    running kernel was still on video. Do not conclude "the fix failed" after one reboot.
+  - `/etc/ttys` uses `onifconsole`, so getty starts on ttyu0 ONLY if ttyu0 is the kernel console.
+    `sysctl kern.console` is the ground truth.
+- **GUEST SHELL IS CSH.** Both `virsh console` and `ssh root@` land in csh, which rejects
+  `$(...)` ("Illegal variable name."). Pipe POSIX scripts to `sh -s`. This silently broke two
+  scripts before it was spotted.
+- **PROVIDER GOTCHA:** `virsh console` REFUSES a unix-socket chardev ("character device serial0
+  is not using a PTY"). The module's serial must be a **pty** + a `log` file. A unix socket is
+  also unreachable in practice (libvirt-qemu:kvm, and the staging default ACL stamps a named-user
+  entry that outranks group perms -> r-- only). `virsh console` via libvirtd needs no extra privs.
+  The provider's `source.pty` requires a `path`, which libvirt allocates at start -- so OMIT
+  `source` entirely to get libvirt's default `<serial type='pty'>`.
+- **OPEN GAP -- DHCP WAS NEVER IMPLEMENTED (the ledger claim below was FALSE).** The 2026-07-12
+  entry says "LAN 10.10.0.1/24 + DHCP .100-.199". **There is NO DHCP configuration in the template
+  at all** -- no `<dhcpd>`, no `<Kea>` (measured: template top-level sections are filter, gateways,
+  interfaces, nat, ntpd, OPNsense, rrd, staticroutes, system, theme, unbound). Nothing serves DHCP
+  on `office1-local` (measured: no kea/dhcpd/dnsmasq process, nothing on udp/67). Another optimistic
+  claim from the max-context session. **The operator's original goal was "router + DHCP" -- the
+  ROUTER half is done, the DHCP half is NOT.** OPNsense 26.1 uses **Kea** (ISC dhcpd is gone), so
+  this needs the Kea schema verified upstream (do NOT invent it) + a harness assertion.
+- **~/vr1-office1.env created (0600, jumphost-only, NEVER COMMIT).** Contains NO secrets: it READS
+  `~/vr1-office1-creds/*` at source time, so there is exactly one copy of key material on disk.
+  Carries the as-built values + `$OPNSENSE_SSH_KEY` / `$OPNSENSE_CONFIG_OUT` handles.
+- **Numbers:** D next-free 113, DOCFIX next-free 193.
 
 <!-- END: jumphost -->