diff --git a/docs/rfc-001-global-palace.md b/docs/rfc-001-global-palace.md
index 494ade2..53d894c 100644
--- a/docs/rfc-001-global-palace.md
+++ b/docs/rfc-001-global-palace.md
@@ -572,6 +572,27 @@ data-dependent rather than obvious. From a laptop that lacks the repos, it is a
 **Action:** edge blocks `mempalace_sync` from ever reaching the primary; document it; consider an
 upstream `--refuse-shared` guard.
 
+> **Measured on the live primary, 2026-08-15 — the threat model is not where this section puts it.**
+> An unscoped `mempalace_sync` dry-run against central (14,829 drawers) reports
+> `out_of_scope: 14391`, `no_source: 438`, **`missing: 0`, `kept: 0` — so zero drawers are currently
+> deletable.** The mechanism matters: a source root that is *entirely* absent yields **`out_of_scope`,
+> not `missing`**, and only `missing`/`gitignored` drawers are removed. A wipe therefore needs the root to
+> **exist** while the files under it do not — not a host that simply lacks the repos.
+>
+> Two corrections follow. **(a) The "laptop" scenario is currently blocked twice over**, and neither
+> guard was designed for this: the CLI has no remote support at all, so `mempalace sync` on a client
+> physically cannot reach central; and the MCP `mempalace_sync` tool executes **server-side on synlig**,
+> where clients' `/workspace/...` roots do not exist — hence `out_of_scope`. Do not mistake this for
+> safety by design; it is safety by coincidence of layout, and it decays.
+> **(b) The real hazard arrives with the transcript feeder's remote mode.** That mode rsyncs staged
+> transcripts into per-device inboxes **on synlig**, so those source files *will* exist on the palace
+> host — making them in-scope for the first time. Any later stage rotation, cleanup, or per-device inbox
+> removal then reclassifies that device's conversation drawers as `missing`, i.e. **prunable, and
+> prunable by a sync triggered from a different device.** `bin/mempalace-pi-session` already documents the
+> local form of this ("do NOT run `mempalace sync` while the stage is missing, or the drawers mined from
+> it get pruned"); shared-palace multi-device turns it cross-device. **Settle stage retention on synlig,
+> and the sync guard, as part of enabling the feeder fleet-wide — not after.**
+
 ### 7.3 Provenance belongs to the sync boundary — not to the agent, and not to a solitary container
 
 Today every drawer carries exactly `{wing, room, source_file, added_by, filed_at, id_recipe}`