Appeal from a judgment of the United States District Court for the Eastern District of New York (DeArcy Hall, J.) sentencing defendant-appellant Xavier Oneal to 84 months’ imprisonment, to be followed by three years of supervised release, after Oneal pled guilty to conspiracy to commit Hobbs Act robbery in violation of 18 U.S.C. §1951(a). Oneal challenges the district court’s application of a three-level enhancement for possession of a dangerous weapon, U.S.S.G. §2B3.1(b)(2)(E), and a two-level enhancement for physical restraint, U.S.S.G. §2B3.1(b)(4)(B), in calculating Oneal’s Sentencing Guidelines range. For the first time on appeal, Oneal also argues that the government violated the plea agreement when it agreed with the probation department that the two enhancements were applicable. We find no plain error with respect to the plea agreement. However, we conclude that the limited facts relied upon by the district court were insufficient to support application of either enhancement. Accordingly, we VACATE the judgment of the district court and REMAND for resentencing consistent with this opinion. ROBERT KATZMANN, Ch.J. This appeal calls on us to interpret two provisions of the Federal Sentencing Guidelines, both of which increase the offense level for robbery. Defendant-appellant Xavier Oneal appeals from a May 31, 2018 judgment of the United States District Court for the Eastern District of New York (DeArcy Hall, J.) sentencing him to 84 months’ imprisonment and three years’ supervised release for his participation in several robberies of cellphone stores. Oneal argues that the district court miscalculated his Guidelines sentencing range when it applied two “enhancements” that increased his offense level. First, the Guidelines provide for a three-level increase in the robbery offense level “if a dangerous weapon was brandished or possessed.” U.S.S.G. §2B3.1(b)(2)(E). This enhancement may also be applied where the defendant possessed an “object” other than a dangerous weapon if (1) the object “closely resemble[d]” a dangerous weapon or (2) the defendant “ used the object in a manner that created the impression that the object was” a dangerous weapon. Id. §2B3.1, cmt. n.2. This appeal requires us to consider under what circumstances a defendant’s hand becomes an “object” qualifying as a “dangerous weapon” for purposes of the enhancement. Second, the Guidelines provide for a two-level increase in the offense level for robbery “if any person was physically restrained to facilitate commission of the offense.” U.S.S.G. §2B3.1(b)(4)(B). Our task on appeal is to clarify the meaning of the words “physically restrained” in the context of forced movement between rooms. We conclude that the sparse facts set forth in the presentence report (“PSR”), upon which the district court relied at sentencing, are insufficient to support application of either enhancement. Therefore, we vacate Oneal’s sentence and remand for resentencing based upon a recalculation of the sentencing range without these enhancements, unless the district court makes additional factual findings, consistent with this opinion, that would justify their application. As to Oneal’s argument, raised for the first time on appeal, that the government breached the plea agreement when it agreed that the enhancements applied, we find no plain error in the government’s conduct. BACKGROUND I. The Robberies Oneal’s conviction stems from his participation in a string of cellphone store robberies. The PSR indicates that each robbery unfolded in a similar fashion.1 The first, of a T-Mobile store, took place on May 2, 2015. Upon entering the store with his co-conspirators, Oneal acted as if he had a firearm in his waistband and told the store’s occupants not to try anything “stupid.” Oneal then pushed a store employee into an inventory room and put the merchandise he stole into a laundry bag, before fleeing on foot. On May 15, 2015, Oneal and others robbed a second T-Mobile store. Upon entering, Oneal kept one hand near his waistband as if he had a firearm, and shouted, “Get in the back; this is a robbery.” Oneal then forced the two employees into the back of the store and had them fill two laundry bags with cellular telephones and miscellaneous electronic accessories. Oneal again fled on foot. On May 19, 2015, Oneal and others robbed a third T-Mobile store. This time, both Oneal and a coconspirator pretended to possess firearms by holding their belts. The two then herded the employees and customers into a back room, where they had an employee open a safe. They stole $300 from the safe, but the majority of their haul was, again, in cellphone inventory. Finally, on June 3, 2015, Oneal and others attempted to rob a Verizon store, but fled without taking any merchandise after one customer identified himself as a police officer. The officer pursued Oneal, and Oneal was arrested. II. Plea Agreement and Presentence Report On September 9, 2016, Oneal pled guilty to one count of Hobbs Act robbery conspiracy in violation of 18 U.S.C. §1951(a). In the plea agreement, the government calculated the adjusted Guidelines offense level applicable to Oneal as 23, based on: (1) a base offense level of 20 for each robbery,2 see U.S.S.G. §2B3.1(a); (2) a one-level enhancement for a loss greater than $20,000, but less than $95,000, applicable to one of the robberies, see id. §2B3.1(b)(7)(B); (3) a five-level enhancement based on grouping analysis, see id. §3D1.4; (5) a two-level reduction for acceptance of responsibility, see id. §3E1.1(a); and (6) a one-level reduction for early acceptance of a plea disposition, see id. §3E1.1(b). See App. 89-90. The plea agreement estimated a Guidelines sentencing range of 57 to 71 months’ imprisonment, based on the offense level of 23 and “assuming that the defendant falls within Criminal History Category III.” Id. at 90. The plea agreement provided the following disclaimer regarding this estimate: The Guidelines estimate…is not binding on the [United States Attorney's] Office, the Probation Department or the Court. If the Guidelines offense level advocated by the Office, or determined by the Probation Department or the Court is, for any reason, including an error in the estimate, different from the estimate, the defendant will not be entitled to withdraw the plea and the government will not be deemed to have breached this agreement. Id. at 90-91. The probation department’s final Guidelines calculation, contained in the Fourth Addendum to the PSR dated February 28, 2018, differed in three significant respects from the plea agreement’s calculation.3 First, the PSR found that Oneal belonged in a criminal history category of VI, rather than III. Second, the PSR applied a three-level enhancement, for possessing or brandishing a dangerous weapon, to the offense level on the ground that Oneal acted as if he had a firearm in his waistband during the three T-Mobile robberies. See U.S.S.G. §2B3.1(b)(2)(E). Third, the PSR applied a two-level enhancement, for physically restraining a person, based on Oneal having pushed store employees into a backroom or inventory room, ostensibly at gunpoint, during each of the three T-Mobile robberies. See id. §2B3.1(b)(4)(B). These changes resulted in a total adjusted offense level of 27, which, combined with a criminal history category of VI, produced a sentencing range of 130 to 162 months. Oneal objected to the probation department’s application of the “dangerous weapon” and the “physical restraint” enhancements.4 The probation department initially agreed with Oneal that it had erred in applying the physical restraint enhancement, based on its reading of our decision in United States v. Anglin, 169 F.3d 154 (2d Cir. 1999), but later reincorporated the enhancement into its final calculation based on the district court’s application of it at the sentencing of one of Oneal’s codefendants. In a July 7, 2017 sentencing submission, the government “agree[d] that the Guidelines calculation set forth in the PSR,” including the dangerous weapon and physical restraint enhancements, was “correct,” characterizing the plea agreement’s differences from the PSR as a “mistake.”5 Gov’t App. 31. The government adopted the PSR’s categorization of Oneal’s criminal history, explaining that its estimate in the plea agreement had been based on an incomplete preliminary criminal history report. However, despite stating that the PSR’s Guidelines calculation was correct, the government emphasized that it “stands by the offense level calculation estimated in its plea agreement,” without the enhancements. Id. Accordingly, the government requested that the district court impose a sentence of between 92 to 115 months’ imprisonment, the Guidelines sentencing range corresponding to an offense level of 23, as calculated in the plea agreement, and a criminal history category of VI, as calculated by the probation department. The government argued that a sentence within this range would be sufficient to achieve the goals of sentencing. III. Sentencing At sentencing on May 31, 2018, the district court rejected Oneal’s objections to the dangerous weapon and physical restraint enhancements. The district court found that the dangerous weapon enhancement could be applied, relying on the Guidelines’ commentary indicating that “someone’s hand can, in fact, be the object that is being used to confuse someone into believing that they possess a gun.”6 App. 40. As to the physical restraint enhancement, the district court found it applicable referring to our decision in Anglin, reasoning that, by “pushing people into back rooms,” Oneal “did far more” than the defendant in Anglin, who told the victims to get down on the floor and not move. Id. at 41 (citing Anglin, 169 F.3d 154). Thus, the district court calculated Oneal’s total offense level as 27, which, with a criminal history category of VI, resulted in a Guidelines range of 130 to 162 months’ imprisonment. However, the court varied downwards on the ground that Oneal’s criminal history category was “overstated,” removing offenses committed when Oneal was a teenager from consideration to bring his criminal history category down from VI to IV. App. 65. This resulted in a Guidelines range of 100 to 125 months. Id. The court then imposed a below-Guidelines sentence of 84 months’ imprisonment. After the district court announced its sentence, Oneal objected that the sentence was greater than the Guidelines range of 57 to 71 months stated in his plea agreement. The district court responded that Oneal had pled guilty after being informed that the government’s Guidelines estimate could be wrong, and that the government’s estimate had, in fact, been wrong. This appeal timely followed. DISCUSSION I. Sentencing Enhancements On appeal, Oneal argues that the district court miscalculated his Guidelines range by improperly applying the dangerous weapon and physical restraint enhancements to his conduct. “A district court commits procedural error when it, inter alia, makes a mistake in its Guidelines calculation.”7 United States v. Yilmaz, 910 F.3d 686, 688 (2d Cir. 2018) (per curiam). We review the procedural and substantive reasonableness of sentencing decisions for abuse of discretion, a “standard incorporat[ing] de novo review of questions of law, including…interpretation of the Guidelines, and clear error review of questions of fact.” Id. Accordingly, “the deference due a district court’s determination [that a Guidelines enhancement applies] will depend upon the relationship of the facts to the [G]uidelines standard being applied.” Anglin, 169 F.3d at 163. Where, as here, the record underlying the application of a Guidelines enhancement is undisputed and “[t]he question is whether the…enhancement applies to those facts, an issue that turns primarily on the legal interpretation of a [G]uideline term, we [] perform a more searching review” than we do where the Guideline determination “closely resembles a finding of fact.” Id. A. Dangerous Weapon Enhancement First, Oneal challenges the district court’s application of a three-level enhancement available “if a dangerous weapon was brandished or possessed” during a robbery. U.S.S.G. §2B3.1(b)(2)(E). There is no dispute that Oneal did not actually possess (or brandish) a dangerous weapon, defined in the Guidelines as “an instrument capable of inflicting death or serious bodily injury,” during any robbery. Id. §1B1.1, cmt. n.1(E)(i). But the Guideline’s application notes, which we give controlling weight,8 provide that this enhancement also may be applied in two circumstances where the defendant does not have an actual weapon: [A]n object shall be considered to be a dangerous weapon for purposes of subsection (b)(2)(E) if (A) the object closely resembles an instrument capable of inflicting death or serious bodily injury; or (B) the defendant used the object in a manner that created the impression that the object was an instrument capable of inflicting death or serious bodily injury (e.g., a defendant wrapped a hand in a towel during a bank robbery to create the appearance of a gun). Id. §2B3.1, cmt. n.2. The parties do not dispute that the dangerous weapon enhancement, if applied, must be based on Oneal’s use of his hand — as opposed to any other object. Therefore, the question before us is whether Oneal used his hand in a manner that qualifies for application of the enhancement. On the limited facts before us, we find that he did not. “Where, as here, the language of the Guidelines provision is plain, the plain language controls.” United States v. Mingo, 340 F.3d 112, 114 (2d Cir. 2003) (per curiam); see United States v. Millar, 79 F.3d 338, 346 (2d Cir. 1996) (“As with statutory language, the plain and unambiguous language of the Sentencing Guidelines affords the best recourse for their proper interpretation.”). The Guideline and its commentary set out three alternatives for application of the enhancement: (1) possession of a dangerous weapon; (2) possession of an object that “closely resembles” a dangerous weapon; or (3) “us[ing] [an] object in a manner that created the impression that the object was an instrument capable of inflicting death or serious bodily injury.” U.S.S.G. §2B3.1(b)(2)(E); id. §2B3.1, cmt. n.2. There is no dispute that the first two do not apply, as Oneal did not possess a dangerous weapon during the robberies or an object that “closely resemble[d]” one. That leaves only the third, which requires that “ the defendant used the object in a manner that created the impression that the object was an instrument capable of inflicting death or serious bodily injury.” Id. §2B3.1, cmt. n.2(B) (emphasis added). While it is undisputed that Oneal used his hands to create the impression that he had a weapon, there is no indication in the PSR that he “used [his hand] in a manner that created the impression that [his hand] was” a dangerous weapon. See id. Rather, all that can be gleaned from the PSR is that he used his hands to gesture in a manner suggesting that he had a firearm elsewhere, specifically, in his belt. During the May 15, 2015 robbery, Oneal kept one hand near his waistband, not inside it. An unconcealed hand would not appear to be itself a weapon. During the May 19 robbery, Oneal pretended to possess firearms by holding his belt. While someone could conceal a hand within his or her pants to make the hand appear to be a weapon, using a hand to hold a belt is not using one’s hand to make the hand appear to be a weapon. The PSR’s description of the May 2 robbery is less specific; it states merely that Oneal acted as if he had a firearm in his waistband without offering any indication of how Oneal conveyed this impression. While this statement leaves open the possibility that Oneal could have concealed his hand such that it appeared to be a weapon, the statement alone is far too general to support application of the enhancement. Cf. United States v. Ware, 577 F.3d 442, 452 (2d Cir. 2009) (“[A]lthough a sentencing court may sometimes satisfy its obligation to make findings by adopting the factual statements in the defendant’s [PSR], adoption of the PSR does not suffice if the PSR itself does not state enough facts to permit meaningful appellate review.”). Other circuits to address when a hand becomes a qualifying object for the purposes of the enhancement have affirmed application of the enhancement, consistent with the plain language of the Guideline, where the defendant’s hand was concealed such that the hand itself appeared to be a dangerous weapon. See United States v. Hoffa, 587 F.3d 610, 616 (3d Cir. 2009) (“[D]efendant did not merely have his hand in his pocket, but [] used it to create the appearance that he was carrying a firearm” and “used his finger to suggest that he had a firearm.”); United States v. Stitman, 472 F.3d 983, 985 (7th Cir. 2007) (defendant concealed hand in pocket and told victim that he had a gun, gesturing with one hand towards the bulge in his pocket created by his concealed hand); United States v. Souther, 221 F.3d 626, 629-30 (4th Cir. 2000) (holding that “a concealed hand may serve as an object that appears to be a dangerous weapon” where defendant’s hand was concealed in coat pocket). None of these cases stands for the principle that using one’s hand to suggest possession of a separate dangerous weapon is sufficient for application of the enhancement. To the contrary, many circuits have stressed, consistent with our view, that the Guideline requires use of some object as a direct stand-in for a weapon. See, e.g., United States v. Davis, 635 F.3d 1222, 1225 (D.C. Cir. 2011) (“[A] defendant’s hand may count as such an ‘object’ when concealed in a manner that creates the appearance of a dangerous weapon.”); Stitman, 472 F.3d at 987 (“[T]he type of object that the perpetrator uses to create the appearance of a dangerous weapon is irrelevant; what is important is whether the object creates an objectively reasonable belief that the perpetrator is armed.” (emphasis added)); United States v. Farrow, 277 F.3d 1260, 1266 (10th Cir. 2002) (“[T]he plain language of the commentary to USSG §§2B3.1 and 1B1.1 necessarily requires some ‘object’ to support a finding of possession of a dangerous weapon.”). In arguing that the enhancement should nonetheless apply because Oneal used his hands to convey the general impression that he possessed a weapon, the government relies heavily on the Eleventh Circuit’s decision in United States v. Bates, 213 F.3d 1336 (11th Cir. 2000). This decision predated the Guidelines’ current definition of “dangerous weapon,” which was amended to its present version specifically “to clarify under what circumstances an object that is not an actual, dangerous weapon should be treated as one for purposes of guideline application.” Amendments to the Sentencing Guidelines, Policy Statements, and Official Commentary, 65 Fed. Reg. 26,898 (May 9, 2000). The Eleventh Circuit panel majority affirmed application of the enhancement where the defendant “simulated possession of what appeared to be a dangerous weapon” by “reach[ing] into his pants waist band,” reasoning that “the critical factor for the application of [the enhancement] is whether the defendant intended the appearance of a dangerous weapon.” Bates, 213 F.3d at 1338. Regardless of whether this holding was correct under the prior version of the Guideline, the subsequent amendment to the definition makes clear that, as the dissent reasoned in Bates, “[t]he legislature drew the line for the imposition of the enhancement under U.S.S.G. §2B3.1(b)(2)(E) at the point where the evidence demonstrated that the perpetrator possessed a weapon or an object.” Id. at 1341 (Bechtle, J., dissenting). Distinguishing between use of an object as a stand-in for a dangerous weapon and of a gesture to imply possession of a weapon is not only required by the plain language of the Guideline, it is consistent with the tiered structure of enhancements in section 2B3.1(b)(2), in which the dangerous weapon enhancement is found.9 U.S.S.G. §2B3.1(b)(2). This section sets out different levels of enhancements applicable where the defendant uses a weapon or “threat” during a robbery, reserving the highest enhancement, of seven levels, for discharging a firearm during a robbery, id. §2B3.1(b)(2)(A), and the lowest enhancement, of two levels, for making a “threat of death” during a robbery, id. §2B3.1(b)(2)(F). Each enhancement in this series is distinguished from the next according to (1) what, if any, object the defendant possessed (a firearm, a dangerous weapon, or no object — a threat); and (2) how the defendant used the object (discharging or otherwise using a weapon, as compared with merely possessing or brandishing it). Differentiating between using a hand as an object standing-in for a weapon and using one’s hand merely to gesture suggesting possession of a weapon elsewhere is consistent with this scheme. Moreover, permitting application of the dangerous weapon enhancement based on a suggestive gesture alone would seem to erase the distinction between that enhancement and the next enhancement in the sequence, for making a “threat of death,” U.S.S.G. §2B3.1(b)(2)(F), which specifically provides that a qualifying threat “may be in the form of an oral or written statement, act, gesture, or combination thereof,” id. §2B3.1, cmt. n.6 (emphasis added). Hence, we find that the district court erred in applying the dangerous weapon enhancement based on the limited facts before us and remand for resentencing without the enhancement, unless the district court makes a factual finding that Oneal concealed his hand such that his hand appeared to be a dangerous weapon. B. Physical Restraint Enhancement Oneal also challenges the district court’s application of a two-level enhancement available “if any person was physically restrained to facilitate commission of the offense or to facilitate escape.” U.S.S.G. §2B3.1(b)(4)(B). The Guidelines define “physically restrained” as “the forcible restraint of the victim such as by being tied, bound, or locked up.” Id. §1B1.1, cmt. n.1(L). We have had several prior occasions to address the meaning of the words “physically restrained.” As we have previously emphasized, the enhancement, as “a provision drafted to deal with a special circumstance,” must be interpreted narrowly lest it instead “increase the Guidelines’ base level, in what one would expect to be the considerable majority of robbery cases, from 20 to 22.” Anglin, 169 F.3d at 165. We have cautioned against interpreting the words “physically restrained” in such a way that “virtually every robbery would be subject to the 2-level enhancement for physical restraint unless it took place in unoccupied premises” or involved a “quixotic” robber who explicitly instructed the victims that they should “feel free to move about” or leave during the robbery’s commission. Id. Other circuits have adopted varying approaches to cabining the physical restraint enhancement to avoid excessive application. See, e.g., United States v. Bell, 947 F.3d 49, 56 (3d Cir. 2020) (identifying five relevant factors); United States v. Herman, 930 F.3d 872, 876 (7th Cir. 2019) (instructing focus on the defendant’s action rather than the victim’s reaction); United States v. Parker, 241 F.3d 1114, 1118 (9th Cir. 2001) (requiring “sustained focus” on a victim over a period of time). Our established precedents, drawing on the plain language of section 2B3.1(b)(4)(B), have identified three factors that guide whether the “physical restraint” enhancement may be applied. See United States v. Rosario, 7 F.3d 319, 321 (2d Cir. 1993) (per curiam); Anglin, 169 F.3d 154; United States v. Paul, 904 F.3d 200, 204 (2d Cir. 2018). First, any restraint must be “physical.” While “‘restraint’ is a condition capable of being brought about by a number of forces,” the Sentencing Commission expressed “a more precise concept” by including the word “physical” — “an adjective which modifies (and hence limits) the noun ‘restraint.’” Anglin, 169 F.3d at 164. “The most pertinent definition of ‘physical’ is ‘of the body as opposed to the mind, as, physical exercise.’” Id. For instance, the examples in the Guidelines all “involve[] a restraint of movement by the use of some artifact by which the victim is ‘tied’ or ‘bound’…or by the use of a space where the victim is ‘locked up’….” Id. (referencing U.S.S.G. §1B1.1, cmt. n.1(L)). Accordingly, we have held that “displaying a gun and telling people to get down and not move, without more, is insufficient to trigger the ‘physical restraint’ enhancement,” because, while brandishing a firearm may cause victims to feel restraint, it does not physically restrain or immobilize them. Id. at 164-65. Other circuits have differed in their analyses of similar scenarios, splitting as to whether the psychological coercion of a gun is enough on its own to constitute physical restraint. Compare Herman, 930 F.3d at 877 (not enough), United States v. Garcia, 857 F.3d 708, 713 (5th Cir. 2017) (not enough), Parker, 241 F.3d at 1118-19 (not enough), and United States v. Drew, 200 F.3d 871, 880 (D.C. Cir. 2000) (not enough), with United States v. Dimache, 665 F.3d 603, 607 (4th Cir. 2011) (enough), United States v. Miera, 539 F.3d 1232, 1235-36 (10th Cir. 2008) (enough), and United States v. Wallace, 461 F.3d 15, 34 (1st Cir. 2006) (enough). Second, we have distinguished between qualifying physical “restraint” and nonqualifying physical “force.” “[M]ere physical contact with the victim does not inevitably amount to physical restraint….” Rosario, 7 F.3d at 321. Notably, inflicting bodily injuries during a robbery is dealt with as a separate enhancement. See U.S.S.G. §2B3.1(b)(3). “Restraint” is principally defined as “to hold back; to check; to hold from action, proceeding, or advancing.” Anglin, 169 F.3d at 164 (quoting Webster’s Deluxe Unabridged Dictionary (1979) at 1544). In other words, “restraint” is force that “facilitate[s], as opposed to constitute[s], the commission of the offense.” Rosario, 7 F.3d at 321; see Herman, 930 F.3d at 875 (holding that “the essential character of conduct that is subject to the physical-restraint [G]uideline is depriving a person of his freedom of physical movement” in order to complete the offense). For example, we affirmed application of the enhancement where the defendant, after hitting a mail carrier on the head and knocking him to the ground, “then immobilized the carrier by stepping on his throat while he stole the carrier’s wallet and keys.” Rosario, 7 F.3d at 320. While the defendant used multiple forms of physical force, it was standing on the mail carrier’s neck that constituted the qualifying physical restraint, as that was the action that “facilitated the commission of the offense in that the victim could do nothing about his situation because of the physical restraint.” Id. at 321. Third, given that the restraint must facilitate rather than constitute the offense, it must be more than a “direction to move [that] is typical of most robberies.” Paul, 904 F.3d at 204. We recently held that the enhancement was not properly applied where the defendants, while robbing a store, had pulled out a gun, threatened to shoot, and directed a store clerk “behind the [check-out] counter to the cash register, which the clerk opened.” Id. at 201. We emphasized that, The most significant aspect of the employee’s movement is not that it was merely to a different spot within a room where the robbery occurred. Rather, what weighs against the physical restraint enhancement is that the employee was ordered to go to the spot where an employee is often directed to go in many store robberies — to the cash register. Id. at 204. We reasoned that, “in the absence of physical restraint similar to being bound or moved into a locked or at least a confining space, the enhancement is not to be added where the direction to move is typical of most robberies.” Id. Such a broad application would not only ignore the plain language of the Guideline requiring actual physical restraint, it would risk overapplication of the enhancement to become an effective increase in the base offense level for robberies. See Anglin, 169 F.3d at 165. While we have not previously ruled on the question of whether movement from one room into another qualifies as physical restraint, this issue turns on these same factors already established by our precedent: (1) whether the restraint was physical, (2) whether there was restraint rather than just use of force, and (3) whether the action in question was constitutive of the robbery or whether it was an additional physical restraint that facilitated the robbery. On the limited record before us, we are unable to conclude that the evidence cited by the district court supported its finding that Oneal’s conduct qualified for the physical restraint enhancement. During each of the three robberies, Oneal directed employees into an inventory room or back room in order to steal the merchandise found there. An attempt to rob a store for its merchandise will often involve a direction to move into the store’s inventory room, particularly in businesses where little merchandise is kept out on the shop floor. Therefore, like the direction to the cash register in Paul, the direction to move to the inventory or back room was “typical of most robberies.” 904 F.3d at 204. The May 19 robbery presents a different scenario however, as the PSR there describes Oneal herding customers, as well as employees, into a back room. As the presence of customers was not necessary to collect the merchandise, the May 19 robbery may come closer to involving physical restraint used to “facilitate, as opposed to constitute, the commission of the offense.” Rosario, 7 F.3d at 321 (emphasis added). However, movement into another room during a robbery only qualifies for the enhancement if the defendant then physically restrained victims in that room. The fact that the direction to move was into another room, rather than within the same room, is, in and of itself, insufficient to establish qualifying physical restraint under our reading of the Guidelines. We have previously emphasized that the specific direction of the movement is not necessarily decisive as to whether the movement constituted physical restraint. See Paul, 904 F.3d at 204 (“The most significant aspect of the employee’s movement is not that it was merely to a different spot within a room where the robbery occurred.” (emphasis added)). Similarly, our precedent establishes that the use of a gun, or an object appearing to be a gun, alone is insufficient to establish physical restraint. See Anglin, 169 F.3d at 164-65. The Guidelines offer the example of “lock[ing] up” victims as a type of physical restraint. See U.S.S.G. §1B1.1, cmt. n.1(L). Other circuits have approved application of the enhancement where victims were physically secured in an area, either by locking or closing a door or imposing some other physical barrier, in order to facilitate completion of the robbery. See United States v. Stevens, 580 F.3d 718, 719 (8th Cir. 2009) (defendant marched employees to vault, cut phone lines to vault, closed employees inside, and left employees there); United States v. Copenhaver, 185 F.3d 178, 182 (3d Cir. 1999) (defendant forced victim into fireplace and put screen in front of fireplace as a barrier to exit); United States v. Jones, 32 F.3d 1512, 1519 (11th Cir. 1994) (per curiam) (victims were “forced at gunpoint into the safe room” and “[t]he robbers then closed the door to the room and left”); United States v. Schau, 1 F.3d 729, 730 (8th Cir. 1993) (per curiam) (“While carrying firearms, the defendants ordered the victims into the bank vault, attempted to lock the vault door, and wedged a chair against the vault door when it would not lock.”); United States v. Doubet, 969 F.2d 341, 347 (7th Cir. 1992) (individuals moved into restroom at gunpoint and closed in with “admonition by [defendant] that an armed accomplice stood guard outside the door”), abrogated on other grounds by United States v. Dunnigan, 507 U.S. 87 (1993). We join those circuits that have held that “herding victims into a defined area,” without then physically restraining them in that area, does not, in and of itself, constitute physical restraint.10 Herman, 930 F.3d at 875; see also Drew, 200 F.3d at 880 (declining to find “physical restraint without some type of confinement accompanying the forced movement at gunpoint”). However, the sparse facts in the PSR are insufficient for us to conclude that Oneal did any more than herd individuals into a room. The PSR does not indicate whether the customers present on May 19, or the employees present during any of the three robberies, were closed or locked into the rooms in question, or otherwise physically prevented from leaving for any period of time — in other words, whether anyone was physically restrained. Accordingly, we vacate the district court’s application of the physical restraint enhancement on the facts before us, and remand for resentencing without the enhancement, absent a finding, consistent with this opinion, that Oneal physically restrained victims in a back room or inventory room during any of the robberies. II. Alleged Breach of the Plea Agreement Finally, for the first time on appeal, Oneal argues that the government breached the plea agreement by advocating for application of the physical restraint and dangerous weapon enhancements.11 In determining whether the government breached a plea agreement, we review it “in accordance with principles of contract law,” looking “to what the parties reasonably understood to be the terms of the agreement.” United States v. Vaval, 404 F.3d 144, 152 (2d Cir. 2005); see also United States v. Wilson, 920 F.3d 155, 158 (2d Cir. 2019) (Assessments of “allegations of breached plea agreements depend on what the reasonable understanding and expectations of the defendant were as to the sentence for which he had bargained.”). “We construe plea agreements strictly against the government and do not hesitate to scrutinize the government’s conduct to ensure that it comports with the highest standard of fairness.” Wilson, 920 F.3d at 162. However, as Oneal did not raise this argument before the district court, we review for plain error.12 See United States v. MacPherson, 590 F.3d 215, 218 (2d Cir. 2009) (per curiam). “To establish plain error, a defendant must demonstrate: (1) error, (2) that is plain, and (3) that affects substantial rights.” United States v. Bleau, 930 F.3d 35, 39 (2d Cir. 2019) (per curiam). “If all three conditions are met, we will then exercise our discretion to rectify this forfeited error only if (4) the error seriously affects the fairness, integrity, or public reputation of judicial proceedings.” Id. Oneal does not challenge the government’s decision to argue for a higher sentence on the basis of information about Oneal’s criminal history obtained after the plea agreement was signed. Instead, Oneal argues that the government violated the plea agreement by stating, in its July 7, 2017 sentencing submission, that the PSR was “correct” to apply the dangerous weapon and physical restraint enhancements. Gov’t App. 31. However, while characterizing its own omission of these enhancements from the plea agreement estimate as a “mistake,” the government also stated that it “st[ood] by the offense level calculation estimated in its plea agreement” and “request[ed] that the Court impose a sentence” within the Guidelines range “correspond[ing] to the offense level set forth in the plea agreement except for the criminal history category,” without applying the enhancements. Id. Recognizing that a Guidelines estimate in a plea agreement, sometimes called a Pimentel estimate, is an estimate subject to “mistakes, oversights, or new information,” we have held that “the Government does not violate a defendant’s reasonable expectations simply because it deviates from the [Pimentel] estimate.” Wilson, 920 F.3d at 163. “A defendant’s reasonable expectations may be breached, however, where the Government’s deviation produces serious unfairness for the defendant.” Id. Serious unfairness may be found, even if the government did not act in bad faith, if “the Government’s change of position (without new justifying facts) changed the defendant’s exposure so dramatically as to raise doubts whether the defendant could reasonably be seen to have understood the risks of the agreement.” Id. The dangerous weapon and physical restraint enhancements, in combination with the change in criminal history category, more than doubled the minimum Guidelines range sentence applicable to Oneal — a non-negligible increase in Oneal’s exposure. But the threshold question here is whether the government’s actions qualified as advocating for this changed exposure. We have not established “a bright-line rule as to the leeway the government has with respect to what it tells the court while operating under [a plea] agreement.” United States v. Griffin, 510 F.3d 354, 361 (2d Cir. 2007), abrogated on other grounds by Puckett v. United States, 556 U.S. 129 (2009). “[S]tatements by the government asserting that it did not intend to violate the plea agreement do not insulate the government against a finding of breach if in fact what was said constituted an argument that violated the plea agreement.” Id. at 365. In some circumstances, we have concluded that the government breached a plea agreement where it “concur[ed] with the Presentence Report’s application” of a Guidelines provision without “explicitly argu[ing] to the District Court” that the provision should be applied, reasoning that there was “no principled difference between supporting the applicability of [the provision] generally on the one hand…and arguing in favor of the applicability of [the provision] on the other.” United States v. Lawlor, 168 F.3d 633, 637 (2d Cir. 1999). Here, however, the government made clear in its sentencing submission that it was not advocating for adoption of the enhancements. It said that it recommended adoption of a Guidelines range that did not include the enhancements, and that it considered a sentence within such a range sufficient. Its discussion of the enhancements — in only one sentence of the sentencing submission — offered no legal or factual analysis supporting their application and did not rebut Oneal’s arguments against their application. See Griffin, 510 F.3d at 364-65 (distinguishing between the government merely “correct[ing] inconsistencies” or using “a few ill-advised descriptive words” and “offer[ing] a thorough legal analysis” as to a Guidelines adjustment); United States v. Riera, 298 F.3d 128, 134 (2d Cir. 2002) (holding that the government’s letter in response to the district court’s inquiry regarding a Guidelines adjustment did not breach the plea agreement in part because “the government [] repeatedly emphasized that it was not advocating an upward departure”); United States v. Dykes, 724 F. App’x 39, 42-43 (2d Cir. 2018) (finding the government’s statement that it did not “dispute the properness” of the PSR’s Guidelines calculation permissible where the government “explicitly disavowed” adoption of the PSR’s calculation and otherwise “highlighted its nonalignment with the PSR’s [sentencing] recommendation”). The government was under no obligation to take a position on the applicability of the enhancements absent a request to do so by the district court. See Lawlor, 168 F.3d at 637; Riera, 298 F.3d at 134 (stressing that the government’s statement was in response to a direct inquiry by the district court). In addition, if the government was concerned about queries from the district court regarding the PSR’s application of the enhancements, the government also could have included a provision in the plea agreement specifically reserving its right to answer any inquiries from the district court about the Guidelines. See Riera, 298 F.3d at 134.13 However, in stating summarily in one sentence that the enhancements were correctly applied, while clearly declining to advocate for their application, the government did not commit any error that was “clear or obvious” under our precedent. United States v. Marcus, 560 U.S. 258, 262 (2010). Accordingly, there was no plain error. CONCLUSION For the reasons stated, we vacate Oneal’s sentence and remand for resentencing consistent with this opinion.
