diff --git a/briefings/mongodb-cluster.md b/briefings/mongodb-cluster.md
index f5a10a15..da63f97f 100644
--- a/briefings/mongodb-cluster.md
+++ b/briefings/mongodb-cluster.md
@@ -3,7 +3,7 @@
 ## What it is
 - A MongoDB replica set (Percona Server for MongoDB, `percona/percona-server-mongodb:8.0`) with automatic failover, deployable in **one location or stretched across several**.
 - **2.0.0 deploys into an existing GVC** (`createsGvc: false`). 1.x created its own; that path is now refused at render time.
-- Optional HAProxy in front so clients hit one endpoint instead of tracking the primary, and optional logical (mongodump) or physical (PBM) backups.
+- Optional HAProxy in front so clients hit one endpoint instead of tracking the primary, and optional logical (mongodump) backups. Physical (PBM) was removed in 2.0.0 — see the traps.
 
 ## Common use cases
 - Application datastore needing automatic failover rather than a single instance.
@@ -15,7 +15,7 @@
 |---|---|
 | workload `{release}-mongo` (stateful, `replicaDirect`) | mongod members; per-replica DNS for peer discovery |
 | workload `{release}-mongo-proxy` (HAProxy, standard, optional) | Single endpoint routing to the current primary |
-| workload `{release}-mongo-backup` / `-physical-backup` (cron, optional) | Logical dump or PBM physical backup trigger |
+| workload `{release}-mongo-backup` (cron, optional) | Logical `mongodump` to object storage |
 | volumeset per replica | `/data/db`, ext4, snapshots retained 7d |
 | identity | Cloud-account binding when backups are enabled |
 | policy `{release}-mongo-policy` | `reveal` on the two user secrets plus the chart's scripts |
@@ -40,7 +40,7 @@ Three-layer defence, per the standing ruling:
 - **1.x sent a PARTIAL `localOptions` entry on the backup cron** (`location` + `suspend` only). The API completes a partial entry from **platform** defaults, not from the workload's `defaultOptions` — measured elsewhere as `capacityAI: true` and `autoscaling {metric: concurrency, maxScale: 5}`, i.e. five concurrent backup pods. 2.0.0 sends the whole block on every entry, everywhere.
 - **`backup.location` is now explicit.** 1.x derived it from `backup.aws.region` (and silently used the first GVC location for GCP), tying where the job runs to where the bucket lives. It is validated against `locations`, because the platform accepts a `localOptions` location that does not exist, stores it, and the cron then never runs anywhere with nothing to observe.
 - **HAProxy backends were wrong for a mixed roster in 1.x.** It emitted the LARGEST location's replica count for every location, so a 3 + 1 roster produced backends for members that never existed. 2.0.0 emits exactly each location's own `replicas`.
-- **THE PHYSICAL RESTORE IS UNVERIFIED AND MAY BE ARCHITECTURALLY BLOCKED.** PBM's physical restore has `pbm-agent` stop mongod on every node and leave the database down until an operator restarts it, and requires that nothing restart mongod on its own meanwhile. Here mongod is PID 1 of the container, so the platform restarts the container the moment PBM stops it. The README says this plainly and points users at logical mode rather than documenting a restore that may not work. **This needs a maintainer decision:** prove it in a test round, or drop `backup.mode: physical`.
+- **PHYSICAL (PBM) BACKUPS WERE REMOVED IN 2.0.0, and `backup.mode: physical` now fails at render** (including when `backup.enabled` is false, so a 1.x values file gets the signal immediately rather than on the day someone enables backups). Its restore could never work: PBM's physical restore must execute `mongod`, and the `pbm-agent` image does not contain it — `check mongod binary: run: exec: "mongod": executable file not found in $PATH`. It failed **silently**, with `pbm status` reporting nothing running while the agent heartbeated into the bucket indefinitely, so it wrote real 300 KB WiredTiger snapshots that could never be restored. An earlier hypothesis blamed the platform restarting mongod as PID 1; that was wrong. Use `backup.mode: logical`, whose restore is verified end to end.
 - **The logical restore in 1.x could not work as written.** It told users to run `mongorestore` from "a machine with network access to the cluster" against a `*.cpln.local` address, which no external machine can resolve. 2.0.0 routes it through `cpln port-forward`.
 
 ## Status