diff --git a/docs/runbooks/fv-to-ana-nat.md b/docs/runbooks/fv-to-ana-nat.md
index e52b37d..6340cde 100644
--- a/docs/runbooks/fv-to-ana-nat.md
+++ b/docs/runbooks/fv-to-ana-nat.md
@@ -37,9 +37,33 @@ pre-change `core/backup/download/this` taken first. After: fv-ml1 reaches all
 four sites, the mesh and the internet; nh3-dev, nh3-docker and esh-docker-vm
 regression-swept clean.
 
-⚠ **The source is still `10.251.50.54/32` — fv-ml1 only.** A second host at FV
-will have exactly this problem and no symptom that points at NAT. Broaden to
-`10.251.50.0/24`, or add a rule per host, when FV grows.
+### Broadened to the whole FV LAN, same session
+
+All four rules now carry source **`10.251.50.0/24`** rather than fv-ml1's `/32`,
+so a second host at FV works on arrival instead of reproducing this failure with
+no symptom that points at NAT. Anaheim got a `/24` rule of its own through the
+API for the same reason — the 2026-09-13 rule was written with `write_config`
+and is invisible to `source_nat/search_rule`, so leaving it as the only ANA
+coverage would have kept one destination on a different code path from the
+other three.
+
+    src=10.251.50.0/24  dst=10.100.0.0/16   FV LAN 10.251.50.0/24 to NH3 via Tailscale SNAT
+    src=10.251.50.0/24  dst=10.0.0.0/16     FV LAN 10.251.50.0/24 to ESH via Tailscale SNAT
+    src=10.251.50.0/24  dst=10.6.110.0/24   FV LAN 10.251.50.0/24 to IRV via Tailscale SNAT
+    src=10.251.50.0/24  dst=10.250.0.0/16   FV LAN 10.251.50.0/24 to ANA via Tailscale SNAT
+
+Descriptions were rewritten to name the actual scope. A description that
+understates a rule's reach is the same trap as the Anaheim-only rule itself.
+
+⚠ **The legacy `/32` ANA rule still exists** in `config.xml` and is now
+redundant. Harmless — it NATs identically and first-match wins — but it is the
+one rule the API cannot see, so delete it from the UI when convenient rather
+than wondering later why the counts disagree.
+
+⚠ **`10.251.250.0/24` (BMC / management) is NOT covered.** The rules are scoped
+to the server VLAN only. The BMC is reachable inbound from the fleet, which is
+what matters for out-of-band recovery, but a management-VLAN host originating
+traffic to another site would hit this same wall.
 
 ### What this looks like when it breaks, so the next person skips the evening