diff --git a/docs/pfi/headscale-mesh-plan.md b/docs/pfi/headscale-mesh-plan.md
index 0160af7..c83147b 100644
--- a/docs/pfi/headscale-mesh-plan.md
+++ b/docs/pfi/headscale-mesh-plan.md
@@ -190,3 +190,11 @@ the app at `https://headscale.phasefinal.com`, it opens a registration page show
 `headscale nodes register --user pfi --key mkey:…` command; run that on nh3-headscale
 (`pct exec 106 -- headscale nodes register --user 1 --key <mkey>`). CLI Linux/macOS builds can
 use the vaulted client key instead.
+
+### 06:20Z — first roaming client verified
+
+Operator's MacBook enrolled via the GUI (Option-click → Debug → Custom Login Server; headscale
+0.29 registration command is `headscale auth register --auth-id hskey-authreq-… --user pfi`),
+node 5 `vhlk-mba26` (100.64.0.5), "Use Tailscale subnets" on. From ESH: `ping 100.64.0.3`
+and `ssh infra-ops@ana-docker.ana.internal` both work → colo subnet route + split DNS for
+`*.internal` proven from a client. (Path was still via the ESH LAN / old tunnels.)