diff --git a/servers/pfi-tacticalrmm/README.md b/servers/pfi-tacticalrmm/README.md
index 2d0e12a..4e812bc 100644
--- a/servers/pfi-tacticalrmm/README.md
+++ b/servers/pfi-tacticalrmm/README.md
@@ -66,7 +66,8 @@ Monitors and manages endpoints, pushes patches, runs scripts, etc.
   `sudo ss -K -tn "dst [::ffff:<ip>]:<its port>"`. Verify with `scripts/meshcentral-amt-relay-probe.js`, using
   another AMT as a positive control. Seen twice on esh-pve-2. The second time, one graceful shutdown from MeshCentral (22:48:52) left the old
   tunnel dead within seconds, and it was gone by 2252. The first one lingered 13+ min, probably because repeated
-  connect attempts kept writing to it (inferred).
+  connect attempts kept writing to it (inferred). **Third time 2026-10-03 1218, on nh3-pve-2** (NH3, Prime power-cycling it
+  on site), so it is not ESH- or NAT-specific: 3 of 3 power-event episodes, at two sites.
 - Before 2026-10-02: `"WANonly": true` (TacticalRMM's install default). In that mode MeshCentral SILENTLY DROPS
   "Add Intel AMT computer": `meshuser.js` line 2682, `if (args.wanonly == true) return;`. No error, no
   event. LAN-mode AMT needs `WANonly` false (hybrid) + a service restart; CIRA works in WAN mode. TacticalRMM's