diff --git a/.altschuler_sc_code b/.altschuler_sc_code
new file mode 100644
index 00000000..878b376a
--- /dev/null
+++ b/.altschuler_sc_code
@@ -0,0 +1 @@
+GOLD-LION-1382
diff --git a/projects/gps-rmm-audit/backup-map.md b/projects/gps-rmm-audit/backup-map.md
index f9297e03..63c49e33 100644
--- a/projects/gps-rmm-audit/backup-map.md
+++ b/projects/gps-rmm-audit/backup-map.md
@@ -36,18 +36,21 @@ audit. See `wiki/projects/gps-rmm-audit.md`.
 | Grabb & Durando Law | 1 | 49 | GND-SERVER cloud plan **failing / 0 bytes (flapping)** | **NOT BACKING UP** |
 | Bill Tedards | 1 | 45 | DESKTOP-SUFJR0J **last good 359d ago** | **NOT BACKING UP** (stale ~12 mo) |
 | Arizona Medical Transit | 1 | 0 | MSP360 company exists, **0 plans** | **NOT BACKING UP** |
-| Reliant Well Drilling | 1 | 40 | none found (no MSP360/B2/Seafile/ownCloud) | **HELD — unconfirmed** (Datto key) |
-| The Prairie Schooner | 1 | 10 | none found | **HELD — unconfirmed** (Datto key) |
-| Janet Altschuler | 2 | 0 | none found | **HELD — unconfirmed** (Datto key) |
-| Design and Brand Envoys | 1 | 0 | none found | **HELD — unconfirmed** (Datto key) |
+| Reliant Well Drilling | 1 | 40 | none — RMM machines online, run Datto **EDR+RMM only, no backup client** | **UNCONFIRMED** (agentless SIRIS not ruled out) |
+| The Prairie Schooner | 1 | 10 | none — 2 servers online, Datto **EDR only, no backup client** | **UNCONFIRMED** (SIRIS could image servers agentlessly) |
+| Janet Altschuler | 2 | 0 | none — **no RMM machines at all** | **UNCONFIRMED** |
+| Design and Brand Envoys | 1 | 0 | none — machines online, Datto **EDR+RMM only, no backup client** | **UNCONFIRMED** |
 
 **Rollup (16 billed):** 7 OK · 2 REVIEW (seat>machine) · 3 NOT BACKING UP (Grabb, Tedards,
 AMT) · 4 HELD-unconfirmed pending Datto Workplace enumeration.
 
-The 4 HELD are billed for backup but have no destination in any backend we can currently
-read. They are **not** flagged as failing — they may be Datto Workplace users. Re-check the
-moment Mike enables the super-admin API key:
-`py .claude/skills/datto-workplace/scripts/datto_workplace.py projects --json`.
+The 4 UNCONFIRMED are billed for backup but have **no destination in any backend we can read**
+(MSP360/B2/Seafile/ownCloud/Datto Workplace). 2026-07-06 RMM endpoint scan: their online
+machines run **Datto EDR + Datto RMM only — NO Datto backup client** (no Workplace, no SIRIS
+Windows Agent). The one thing endpoint detection CANNOT see is an **agentless Datto SIRIS/BCDR
+appliance** (hypervisor-snapshot backup, no on-box agent) — only the Datto BCDR partner portal
+(no ACG skill/creds) would confirm that. Sent to Mike+Winter 2026-07-06 asking where these
+back up; also re-requested the Datto Workplace super-admin API key (current key = 0 projects).
 
 ---