docs(meshcentral): stale CIRA tunnel reproduced on a single shutdown

servers/pfi-tacticalrmm/README.md

@@ -64,8 +64,9 @@ Monitors and manages endpoints, pushes patches, runs scripts, etc.
   **Fix:** `sudo ss -tnio state established "( sport = :4433 )"`. Find the device's public IP with a large
   `lastrcv` (ms) or a `backoff`. Healthy tunnels show `lastrcv` of seconds. Then
   `sudo ss -K -tn "dst [::ffff:<ip>]:<its port>"`. Verify with `scripts/meshcentral-amt-relay-probe.js`, using
-  another AMT as a positive control. Likely whenever a host whose AMT shares its NIC (esh-pve-2) power-cycles.
-  Seen once so far.
+  another AMT as a positive control. Seen twice on esh-pve-2. The second time, one graceful shutdown from MeshCentral (22:48:52) left the old
+  tunnel dead within seconds, and it was gone by 2252. The first one lingered 13+ min, probably because repeated
+  connect attempts kept writing to it (inferred).
 - Before 2026-10-02: `"WANonly": true` (TacticalRMM's install default). In that mode MeshCentral SILENTLY DROPS
   "Add Intel AMT computer": `meshuser.js` line 2682, `if (args.wanonly == true) return;`. No error, no
   event. LAN-mode AMT needs `WANonly` false (hybrid) + a service restart; CIRA works in WAN mode. TacticalRMM's