diff --git a/docs/pfi/headscale-mesh-plan.md b/docs/pfi/headscale-mesh-plan.md
index be2b8ac..cd061b5 100644
--- a/docs/pfi/headscale-mesh-plan.md
+++ b/docs/pfi/headscale-mesh-plan.md
@@ -313,3 +313,13 @@ Verified: nh3-docker→ana-docker seen at colo as **10.100.50.40** (real host, p
 nh3-dev via ana-scale exit → egress **38.120.12.42** (colo), via nh3-scale → 70.230.226.88
 (NH3). Persistent across CT reboot via the systemd unit. `tailscale set --operator` NOT set;
 drive nh3-dev's tailscale via `ssh infra-ops@10.100.10.50 sudo tailscale ...`.
+
+## 2026-09-06 — throughput baseline (mesh vs the old IPsec)
+
+NH3↔colo over the direct WireGuard path (5ms), iperf3 between the 1-vCPU router CTs, medians
+of 3: **download colo→NH3 761 Mb/s (688–761), upload NH3→colo 464 Mb/s (391–507)**, parallel-8
+up ~530. Old IPsec ceiling was ~250 both ways (poor AES offload) — so ~3x down, ~1.8x up. CPU
+during upload sampled ~32% (single reading) → not clearly the cap; upload likely limited by
+userspace-WireGuard single-flow, the CT vNIC, or the WAN. Operator: the ANA AT&T line is
+SHARED fiber, so the upload figure may be the line, not the routers — left as-is (no CT core
+bump). Baseline for future comparison, not a hardware limit.