diff --git a/abiba-zulip-restore.prose.md b/abiba-zulip-restore.prose.md
index dd0f8ac..e48a24d 100644
--- a/abiba-zulip-restore.prose.md
+++ b/abiba-zulip-restore.prose.md
@@ -34,7 +34,7 @@ verification, and DM loopback testing.
 | @all-bots user ID | 20 | ✅ (config, verified by API at runtime) |
 | PM2 process name | abiba-zulip | ✅ |
 | Provider | syslog-harness (http://192.168.68.116/v1) | ✅ |
-| Default model | deepseek-v4-pro | ✅ (settings.json) |
+| Default model | syslog-auto | ✅ (settings.json) |
 
 ## Architecture
 
diff --git a/disk-gc-threat-response.prose.md b/disk-gc-threat-response.prose.md
index 4824a2f..b374e59 100644
--- a/disk-gc-threat-response.prose.md
+++ b/disk-gc-threat-response.prose.md
@@ -357,3 +357,4 @@ one-off GPU builds. No automated post-migration cleanup was in place.
 > container has no `pct` binary.
 >
 > **KVM VM:** CT 109 (docker-vm) is a QEMU VM, not LXC — access via SSH .7.
+> **NOTE:** For kagentz (CT 105), use `ssh root@kagentz` (hostname), NOT `pct exec 105` — `pct exec 105` shows loop0 (59G) while `ssh root@kagentz` shows the real filesystem (99G). For docker-vm (CT 109), use `ssh root@192.168.68.7`, not `pct exec`.