diff --git a/docs/changelog-20260714-office1-lan-ipv6-executed.md b/docs/changelog-20260714-office1-lan-ipv6-executed.md
index da66182..02fab54 100644
--- a/docs/changelog-20260714-office1-lan-ipv6-executed.md
+++ b/docs/changelog-20260714-office1-lan-ipv6-executed.md
@@ -61,6 +61,22 @@
     edge -> voffice1 GUA    -> 3 packets, 0.0% loss, 0.838ms avg          [TRAFFIC PASSES]
     edge ndp -an            -> neighbour 52:54:00:6a:87:e5                [matches voffice1's Kea
                                                                           lease hwaddr -- it IS voffice1]
+    voffice1 dig @2602:f3e2:f01:100::1 example.com -> ANSWERS             [a v6-BOUND SERVICE really
+                                                                          serves: "services binding
+                                                                          v6" is now EVIDENCE]
+
+## The RDNSS we did not set, and why it is nonetheless correct
+
+The generated `radvd.conf` advertises `RDNSS 2602:f3e2:f01:100::1` -- **we never set that field.**
+OPNsense auto-defaulted it to the edge's own LAN v6 address. That is the SAME failure class we
+deliberately avoided with `mode=unmanaged` (advertising a service that may not exist), one field
+over, and it slipped in precisely BECAUSE the field was left unset.
+
+**Checked, not assumed:** the edge's Unbound DOES answer DNS on that v6 address (`dig` from
+`voffice1` resolves). It works despite there being no v6 egress because Unbound queries upstream
+over **v4**. So the default is correct here -- but it was luck, not design. **Set RDNSS explicitly
+when this RA config is reused on the DC0/DC1 edges at Stage 3,** and re-check that whatever address
+it names actually answers.
 
 **No collateral damage** (`configctl interface reconfigure lan` re-applies the LAN that all of
 Office1 sits behind): v4 `10.10.0.1` intact, Kea DHCPv4 still running and listening on udp/67,
@@ -90,8 +106,11 @@
     # RA
     bash scripts/opnsense-api.sh POST /api/radvd/settings/delEntry/627e3f12-8150-4909-9910-a275f2a0a6fc
     bash scripts/opnsense-api.sh POST /api/radvd/service/reconfigure
-    # address (clear the two leaves, then reconfigure)
-    bash scripts/opnsense-set-interface-v6.sh --commit 10.10.0.1 lan :: 64   # or clear via the GUI
+    # address: clear ipaddrv6/subnetv6 on Interfaces > [LAN], then Save+Apply.
+    # NOTE: `opnsense-set-interface-v6.sh` CANNOT express a clear -- it requires a 4-arg
+    # address+prefixlen and validates the address. Passing `:: 64` would SET the unspecified
+    # address, not clear the field. Do not use it as a revert. (An explicit --clear flag would
+    # be the honest fix; not built, since nothing needs it yet.)
 
 (`OPNSENSE_API_HOST=10.10.0.1` for the API calls.) Reverting is not expected to be needed: nothing
 depends on the v6 leg yet, and the v4 LAN is untouched by it.