diff --git a/services/grok-token-broker/README.md b/services/grok-token-broker/README.md
index 55e91cd..6439191 100644
--- a/services/grok-token-broker/README.md
+++ b/services/grok-token-broker/README.md
@@ -38,9 +38,16 @@ until a verdict exists and says safe.
 
 ⚠ **The probe spends one refresh, and there is no way to ask the question without spending
 it.** If the answer is the bad one, the CLI is broken at that moment and needs an interactive
-`grok` re-login — the same remedy heid's exit-3 path already names. **Run it when a broken CLI
-login is a two-minute annoyance, not mid-panel.** Hence the required
-`--i-accept-this-may-end-the-cli-session` flag.
+`grok` re-login. Hence the required `--i-accept-this-may-end-the-cli-session` flag.
+
+⚠⚠ **AND THE BLAST RADIUS IS BOTH GRÓA TRANSPORTS, NOT ONE — verified, 2026-09-16.** An earlier
+draft of this file implied only the HTTP path was exposed. Wrong: `heid/scripts/groa_dispatch.py`
+invokes the `grok` CLI directly (`argv = ["grok", "-p", prompt, ...]`), and the CLI authenticates
+from the same `~/.grok/auth.json`. The bwrap in the process table is the CLI's own Landlock
+sandbox, not something Heid wraps around it. So the read-jail transport and the direct-endpoint
+transport **share one session**: one reaches it through the CLI, the other reads the file the CLI
+wrote. An invalidating probe takes **Gróa down on every transport** until a human re-logs in — not
+"the HTTP path degrades". Caught by `heid`, confirmed here against their source.
 
 ## Current state