diff --git a/docs/changelog-20260713-config-xml-path-deleted.md b/docs/changelog-20260713-config-xml-path-deleted.md
index c843909..f517f26 100644
--- a/docs/changelog-20260713-config-xml-path-deleted.md
+++ b/docs/changelog-20260713-config-xml-path-deleted.md
@@ -48,6 +48,25 @@
 destroyed the live edge). Only the cdrom entry is removed from the disk list and the inert ISO
 volume is dropped.
 
+### CORRECTION -- "updated in-place" DOES NOT MEAN "no restart" (measured, 2026-07-13)
+
+**The apply RESTARTED the guest.** This was predicted NOT to happen, and that prediction was
+WRONG. Measured: uptime went from `8:36` to `6 secs` across the apply. The dmacvicar/libvirt
+provider redefines the domain to apply a disk-list change and **bounces it** -- there was a brief
+outage (~30s) during which the edge was not routing and not serving DHCP.
+
+**`libvirt_domain ... will be updated in-place` means the RESOURCE is not replaced. It says
+NOTHING about whether the GUEST keeps running.** Do not read it as "no interruption".
+
+**This matters for Stage 3.** Any future `tofu apply` that touches a `libvirt_domain`'s devices --
+on a DC edge, or on a node VM -- should be assumed to BOUNCE THE GUEST, and must be scheduled and
+gated as an outage, not as a no-op config tidy-up.
+
+Recovery was clean and needed no intervention: post-boot, `kea-dhcp4` is running and bound to
+`10.10.0.1:67` with the subnet/pool intact, WAN/LAN/default-route up, egress 0.0% loss, 8 LAN pass
+rules in pf, serial console + getty alive. `tofu plan` reports "No changes" -- repo and state are
+back in sync.
+
 **Applying it now was the SAFE choice, not the risky one.** Leaving the repo/state divergence in
 place would mean the next `tofu apply` -- e.g. while building DC1's substrate in Stage 3 --
 sweeps up this pending change as a **surprise side effect on the running Office1 edge, mid-stage**.
diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index 5346e2e..4b944b4 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -2031,6 +2031,16 @@
 - **A guard did its job:** repo-lint's L3 (runbooks must not reference missing scripts) went RED on
   the tombstone notes. It was RIGHT and has no opt-out. Rather than weaken it, the tombstones were
   reworded to name the bare filename instead of the `scripts/` path. Guard intact.
+- **APPLIED 2026-07-13. AS-BUILT FACT, LEARNED THE HARD WAY -- "updated in-place" DOES NOT MEAN
+  "no restart".** The apply **RESTARTED the guest** (uptime 8:36 -> 6 secs); it was predicted not
+  to, and that prediction was WRONG. The libvirt provider redefines the domain to apply a disk-list
+  change and BOUNCES it: a ~30s outage with no routing and no DHCP.
+  `libvirt_domain ... will be updated in-place` means the RESOURCE is not replaced -- it says
+  NOTHING about the guest staying up. **STAGE 3 CONSEQUENCE:** assume ANY `tofu apply` touching a
+  `libvirt_domain`'s devices (DC edges, node VMs) BOUNCES THE GUEST. Schedule/gate it as an outage,
+  never as a no-op tidy-up.
+  Recovery was clean, no intervention: kea-dhcp4 back on udp/67 with subnet/pool intact, routing +
+  egress 0.0% loss, 8 pass rules, console + getty. `tofu plan` -> "No changes" (state in sync).
 - `docs/changelog-20260713-config-xml-path-deleted.md`. D-113 AMENDED in design-decisions.
 
 ## D-113(a2): API-KEY BOOTSTRAP SOLVED 2026-07-13 (no GUI click, no re-implemented crypto)