diff --git a/CHANGELOG.md b/CHANGELOG.md
index 66a718e..e64db75 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,7 +11,64 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
 
 ---
 
-## Unreleased
+## v1.12.1 — 2026-10-19
+
+Patch release. Headline: **`ssh-lan.conf` is Included even if it is created
+after the container started** (*Fixed*, below). Also **pi-studio `v0.10.2`**,
+pi-toolkit `7c05901` (new Bedrock defaults for fresh volumes) and gitea-mcp
+`v1.10.0`. Surveyed 2026-10-19; no other upstream moved. Unchanged since v1.12.0:
+pi `1.3.0` (npm `latest`), mempalace `3.11.0` (PyPI `latest`), pi-atelier `v0.16.0`
+(`3b42825`, newest tag), pi-observational-memory `022da5e` (= `master`),
+pi-extensions `4c1d28d`, pi-fork `e69725c`, mempalace-toolkit `d5a03f4`. The
+skillset snapshot needs no refresh (`vendor-mempalace-skill.sh --check`: OK,
+still `96b840e`). The base image is rebuilt because `rootfs/` changed, so apt
+and the base tools pinned to `latest` re-resolve. Of those, only gitea-mcp moved
+upstream: `v1.9.0` → `v1.10.0`. uv `0.13.1`, Node `v24.22.0`, nvim `0.12.6`,
+fzf `0.74.5`, gitleaks `8.30.1`, bat `0.26.1`, eza `0.23.5`, zoxide `0.10.0`,
+git-lfs `3.8.0`, gosu `1.19`, micro `2.0.15`, tealdeer `1.9.0`, typst `0.15.1`,
+yq `4.54.1`, agent-browser `0.39.1` and playwright `1.64.1` match their newest
+releases. Each was compared against the v1.12.0 image on tor-ms22.
+
+### Components that move with this release
+
+| Component | Baked in v1.12.0 | v1.12.1 | Why |
+|---|---|---|---|
+| **pi-studio** (`-studio` tags) | `v0.10.1` (`76db01f`) | **`v0.10.2`** (`4b4abd1`) | newest tag, see *Changed* below |
+| pi-toolkit | `3760d90` | **`7c05901`** (or later: CI resolves `main` at build time) | `settings.example.json` defaults move to Claude 5.5 on Bedrock, see *Changed* below |
+| gitea-mcp (base) | `v1.9.0` | **`v1.10.0`** (or later: `latest` at build time) | additive, see *Changed* below |
+
+### Changed
+
+- **pi-studio `v0.10.1` → `v0.10.2`** (`-studio` tags only). Windows fixes. The
+  REPL waits for the runtime's prompt before saying it started. Stopping a
+  session ends its processes. Code goes only to the exactly named session. The
+  selected session follows what you choose. One behaviour change for agents: a
+  `studio_repl_send` that names no session now fails when Studio shows none
+  selected ("No REPL session is selected in Studio …"). Before, it picked a
+  session. Audited 2026-10-19 on tor-ms22. Dependencies are unchanged:
+  `package-lock.json` packages are identical to 0.10.1's, `ws` is the only
+  runtime dependency, and pi peers are `*`. Loaded into this image's pi `1.3.0`
+  with `pi --no-extensions -e <clone>/index.ts -p`, it registers the same four
+  tools as 0.10.1 (`studio_repl_status`, `studio_repl_send`, `studio_export_pdf`,
+  `studio_export_html`), with no extension error and rc 0. Control: the same
+  run against the baked 0.10.1.
+- **pi-toolkit `3760d90` → `7c05901`:** `settings.example.json` now defaults to
+  `eu.anthropic.claude-opus-5-5`. `enabledModels` becomes opus/sonnet/haiku `-5-5`,
+  and the observational-memory and pi-fork `fast`/`balanced`/`deep` models move
+  to the same family. Also a `*.bak-*` gitignore. **Only a fresh
+  `devbox-pi-config` volume gets these defaults.** On an existing volume, the
+  entrypoint's settings merge fills in only *missing* keys and keeps arrays
+  verbatim, so a model you already set stays. All three IDs are in pi
+  `1.3.0`'s built-in `amazon-bedrock` registry, and `eu.anthropic.claude-opus-5-5`
+  is this session's default model on tor-ms22.
+- **gitea-mcp `v1.9.0` → `v1.10.0`** (base, `latest` at build time). Additive: three
+  new tools (`compare_commits`, `get_commit_status`, `create_commit_status`) and
+  new methods on existing ones. The fix that matters for stdio clients: logs go
+  to stderr, and `-d` no longer writes to stdout, where it corrupted the protocol.
+  Measured 2026-10-19 with a stdio `initialize` + `tools/list` against
+  gitea.jordbo.se: 1.9.0 lists 58 tools, 1.10.0 lists 61. None were removed,
+  and stdout carried JSON only. The image only bakes the binary; nothing in it
+  configures it.
 
 ### Fixed
 
diff --git a/Dockerfile.base b/Dockerfile.base
index 2638845..ebc12b4 100644
--- a/Dockerfile.base
+++ b/Dockerfile.base
@@ -14,7 +14,7 @@
 # content-addressed over this file, so any byte change invalidates the
 # cache. Recommended cadence: once per release for security updates.
 #
-# BASE_REBUILD_DATE: 2026-10-18 (v1.12.0 — mempalace 3.11.0, link-pi-extensions.sh, studio-expose and skill doc fixes; apt and base tools re-resolve (upstream on 2026-10-18: uv 0.13.1, gitea-mcp 1.9.0, Node v24.22.0; nvim 0.12.6, fzf 0.74.5 unchanged); previous marker 2026-10-14 / v1.11.1)
+# BASE_REBUILD_DATE: 2026-10-19 (v1.12.1 — setup-lan-access.sh always Includes ssh-lan.conf; apt and base tools re-resolve (upstream on 2026-10-19: gitea-mcp 1.10.0; uv 0.13.1, Node v24.22.0, nvim 0.12.6, fzf 0.74.5 unchanged); previous marker 2026-10-18 / v1.12.0)
 #
 # ── Lineage note ─────────────────────────────────────────────────────
 # Adapted from opencode-devbox/Dockerfile.base (commit before v1.16.2).
diff --git a/README.md b/README.md
index 98e31d6..2f2ae91 100644
--- a/README.md
+++ b/README.md
@@ -1175,12 +1175,13 @@ set `DEVBOX_LAN_AUTOJUMP_PRIVATE=1` to ProxyJump *any* RFC1918 address through
 the host without naming peers (see `.env.example`).
 
 ssh reads the file on every connection, so creating it and editing it both take
-effect immediately — no container or session restart. `setup-lan-access.sh`
-writes the `Include ~/.config/devbox-shell/ssh-lan.conf` line whether or not the
-file exists yet (ssh skips an `Include` whose file is missing). Images up to and
-including v1.12.0 wrote that line only if the file was readable at container
-start. There, a file created afterwards is ignored until a restart, or until you
-run `bash /usr/local/lib/pi-devbox/setup-lan-access.sh` in the container.
+effect immediately — no container or session restart. Since v1.12.1,
+`setup-lan-access.sh` writes the `Include ~/.config/devbox-shell/ssh-lan.conf`
+line whether or not the file exists yet (ssh skips an `Include` whose file is
+missing). Images up to and including v1.12.0 wrote that line only if the file
+was readable at container start. There, a file created afterwards is ignored
+until a restart, or until you run `bash /usr/local/lib/pi-devbox/setup-lan-access.sh`
+in the container.
 That looks exactly like "my override is being ignored". One case still needs
 action: a file that exists but the container cannot read is left out, because
 ssh would otherwise refuse every connection. The script then prints a warning at