diff --git a/clients/peaceful-spirit/session-logs/2026-07/2026-07-21-mike-corrupt-file-batch-recovery-staging.md b/clients/peaceful-spirit/session-logs/2026-07/2026-07-21-mike-corrupt-file-batch-recovery-staging.md
index cc774d8f..f1153277 100644
--- a/clients/peaceful-spirit/session-logs/2026-07/2026-07-21-mike-corrupt-file-batch-recovery-staging.md
+++ b/clients/peaceful-spirit/session-logs/2026-07/2026-07-21-mike-corrupt-file-batch-recovery-staging.md
@@ -97,9 +97,19 @@ None new. PST-SERVER access via GuruRMM agent 87293069-33b6-45e8-a68f-6811216cdb
   partial manual rebuild).
 - After go-live: clean `C:\PST-Recovery` staging (~1 GB) and confirm DFS-R absorbed the review-folder replication.
 
+## Update: ACL lockdown (post-save)
+
+Per Mike, secured `G:\Shares\Private\_RECOVERED-for-review\` to the **Admin2** group only:
+`icacls <folder> /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" "BUILTIN\Administrators:(OI)(CI)F"
+"PEACEFULSPIRIT\Domain Admins:(OI)(CI)F" "PEACEFULSPIRIT\Admin2:(OI)(CI)M"` then `icacls "<folder>\*" /reset /T`.
+Result verified: folder + children carry only Admin2 (Modify) + SYSTEM/Administrators/Domain Admins (Full);
+inheritance removed; 0 of first-200 children still open (no Users/Everyone/Admin1). Dev-alert posted
+(#dev-alerts msg 1529306554325663918). Also logged a `--friction` for initially missing the mandatory RMM
+#dev-alerts post on the staging write ops.
+
 ## Reference Information
 
-- Review folder (Mara): `G:\Shares\Private\_RECOVERED-for-review\` (or via `\\PEACEFULSPIRIT.local\PST-Files\Private\_RECOVERED-for-review`).
+- Review folder (Mara): `G:\Shares\Private\_RECOVERED-for-review\` (Admin2-only) (or via `\\PEACEFULSPIRIT.local\PST-Files\Private\_RECOVERED-for-review`).
 - Manifest: `RECOVERY-MANIFEST.csv`; lost list: `NOT-RECOVERABLE-LIST.csv`; guide: `_READ-ME-FIRST.txt`.
 - Wiki: `wiki/clients/peaceful-spirit.md` (2025 Crash & File Corruption section). RMM agent 87293069-...
 - Dev-alert posted to #dev-alerts (msg 1529304774002868347).