diff --git a/REPORT-freboot-fleak-fobs.md b/REPORT-freboot-fleak-fobs.md
index 6e9918c..7f5b907 100644
--- a/REPORT-freboot-fleak-fobs.md
+++ b/REPORT-freboot-fleak-fobs.md
@@ -4,7 +4,15 @@ Scope in this repo: **`scripts/felhom-host-install.sh` v1.20.0 → v1.21.0** (wh
 *actual* fix lives), plus the Campaign 8 audit doc and `OPEN-ITEMS.md`. Written as
 `REPORT-freboot-fleak-fobs.md` so the shared `REPORT.md` is not clobbered.
 
-Code companions: `felhom-agent` v0.106.0 → **v0.109.0**, `felhom-controller` v0.179.0 → **v0.180.0**.
+Code companions: `felhom-agent` v0.106.0 → **v0.110.0**, `felhom-controller` v0.179.0 → **v0.180.0**.
+
+**Correction to this repo's part of the story:** v1.21.0's band-scoped ACL is *not* the final F-LEAK
+fix. It works, but only **once per slot** — PVE's destroy path calls
+`AccessControl::remove_vm_access($vmid)` (`API2/LXC.pm:906`), which deletes every ACL at `/vms/<vmid>`
+(`AccessControl.pm:1898`), so **the grant is consumed by the operation it authorises**. Found by counting
+ACL rows after the first successful teardown (`/vms/990000` → 0 grants), not by reasoning about it. The
+durable fix is agent **v0.110.0**'s band-scoped fenced destroy; v1.21.0 remains valuable because it makes
+the common case need no privileged call, and it is now the *first* of two layers rather than the only one.
 
 ## Baselines (reconfirmed, not copied)
 `felhom.eu d0cec9d`, `felhom-agent af1c21a`, `felhom-controller fb91c8d`, all clean. Agent `0.106.0`
@@ -47,7 +55,7 @@ Two supporting changes, both load-bearing rather than tidy-up:
 - **`step_verify` asserts the band grants.** A missing one is otherwise invisible until a restore-test
   *fails*, which is precisely the case that leaked a guest in the first place.
 
-### Why this is not a widening — proven live, at the seam the defect lives in
+### Why the grant is still not a widening — proven live, at the seam the defect lives in
 
 A real PBS restore to `990000` **without `--pool`** reproduced the exact stranded state
 (`990000 stopped`; `felhom pool members: [9201]`; `990000 in pool: False`). Then, with the agent's own