diff --git a/docs/changelog-20260712-libvirt-memory-unit-rootcause.md b/docs/changelog-20260712-libvirt-memory-unit-rootcause.md
index db7ac64..ae19e8d 100644
--- a/docs/changelog-20260712-libvirt-memory-unit-rootcause.md
+++ b/docs/changelog-20260712-libvirt-memory-unit-rootcause.md
@@ -88,12 +88,27 @@
     virsh -c qemu:///system undefine office1-opnsense   # leaves volumes intact
     tofu apply
 
-**Pass criteria (do not declare success on `tofu apply` exiting 0):**
-1. `virsh dominfo office1-opnsense` -> `Max memory: 2097152 KiB` (2 GiB), and the QEMU
-   cmdline shows `-m size=2048` (not `2048k`).
+Re-run `tofu plan` AFTER the `undefine` -- the `1 to change / in-place` plan captured above
+is the *pre-undefine* plan and is NOT what will execute. Post-undefine, tofu refreshes, sees
+the domain gone, and switches to create. Confirm it then reads `1 to add, 0 to destroy`
+(disk + config_seed volumes untouched by the recreate).
+
+**Pass criteria (do NOT declare success on `tofu apply` exiting 0):**
+1. **Authoritative:** `virsh dominfo office1-opnsense` -> `Max memory: 2097152 KiB` (2 GiB).
+   Anchor on this number; it is unambiguous. Do NOT anchor on the QEMU `-m` string -- with
+   `unit='MiB'` libvirt may normalize and emit `-m size=2097152k`, which is **success**, not
+   failure. (Stated as a guess here, not a measurement, until the apply runs.)
 2. The serial log grows **past 262 bytes** into the loader/kernel.
 3. The router actually works: WAN 172.30.1.2 reachable, LAN DHCP serving `office1-local`.
 
+**Pre-staged fallbacks (so a surprise does not cost another session):**
+- If `dominfo` still shows the wrong size, the provider is not honouring `memory_unit`: fix
+  is `memory = var.memory_mib * 1024` (leaning on the KiB default), NOT more debugging.
+- If it clears 262 bytes and boots further but does not reach a working router, that is a
+  **sizing** question, not a regression of this fix -- check OPNsense 26.1's documented
+  minimum RAM (the incident report's "3 GB" is UNVERIFIED) and bump to 4096 if warranted.
+  Clearing the triple-fault and reaching a working router are two separate bars.
+
 ## Revert (per item)
 
 - Module fix: remove the `memory_unit = "MiB"` line from the three `libvirt_domain`
diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index cb1c9a0..4de33fb 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -1743,9 +1743,15 @@
   `tofu plan` says `0 add / 1 change / 0 destroy` (disk volume safe) BUT **do not trust
   "update in-place"** -- max-boot-memory is create-time to libvirt, the same trap DOCFIX-187
   logged for `machine`/`cpu`. Must be: `virsh destroy office1-opnsense; virsh undefine
-  office1-opnsense; tofu apply`. **Pass criteria (NOT "apply exited 0"):** (1) `virsh dominfo`
-  shows `Max memory: 2097152 KiB` and cmdline `-m size=2048`; (2) serial log grows past 262
-  bytes; (3) router actually works -- WAN 172.30.1.2 up, LAN DHCP serving `office1-local`.
+  office1-opnsense; tofu apply`. Re-run `plan` AFTER the undefine -- the captured in-place
+  plan is NOT what executes; post-undefine it becomes `1 to add`. **Pass criteria (NOT
+  "apply exited 0"):** (1) AUTHORITATIVE -- `virsh dominfo` shows `Max memory: 2097152 KiB`.
+  Do NOT anchor on the QEMU `-m` string: libvirt may normalize `MiB` to `-m size=2097152k`,
+  which is SUCCESS. (2) serial log grows past 262 bytes; (3) router actually works -- WAN
+  172.30.1.2 up, LAN DHCP serving `office1-local`. FALLBACKS: wrong size => provider is not
+  honouring `memory_unit`, use `memory = var.memory_mib * 1024`; boots but no working router
+  => SIZING question (verify OPNsense 26.1's real minimum -- the incident report's "3 GB" is
+  UNVERIFIED), bump to 4096; that is not a regression of this fix.
   Then: the Office1 NetBox VM (which `cloudinit-vm` now no longer breaks on).
 - **STANDING LESSON:** a bootloader dying at a FIXED byte offset, immune to every knob, is a
   RESOURCE problem, not a CPU-feature problem. Read the domain XML + QEMU cmdline (ground