diff --git a/.syncro-diag-bo2.ps1 b/.syncro-diag-bo2.ps1
new file mode 100644
index 00000000..e2f4451d
--- /dev/null
+++ b/.syncro-diag-bo2.ps1
@@ -0,0 +1,28 @@
+$ErrorActionPreference = 'Continue'
+$keys = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
+        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
+$hits = Get-ItemProperty $keys -ErrorAction SilentlyContinue |
+    Where-Object { $_.DisplayName -match 'Syncro|Kabuto|RepairTech' } |
+    Select-Object DisplayName, DisplayVersion, PSChildName, UninstallString
+if ($hits) { $hits | Format-List | Out-String | Write-Output } else { Write-Output 'NO-STALE-UNINSTALL-ENTRIES' }
+
+$reboot = (Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending') -or
+          (Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired')
+Write-Output ('PENDING-REBOOT=' + $reboot)
+
+$msi = 'C:\Windows\Temp\SyncroSetup-khalsa.msi'
+if (-not (Test-Path $msi)) {
+    [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor 3072
+    (New-Object Net.WebClient).DownloadFile('https://rmm.syncromsp.com/dl/msi/djEtOTQ1NjU1NC0xNTA3NjA4MzYxLTQ4NzUzLTM2ODUwMjI=', $msi)
+}
+$log = 'C:\Windows\Temp\syncro-install.log'
+$p = Start-Process msiexec.exe -ArgumentList '/i', $msi, '/qn', '/norestart', '/L*v', $log -Wait -PassThru
+Write-Output ('msiexec exit=' + $p.ExitCode)
+if (Test-Path $log) {
+    Write-Output '--- last 60 log lines ---'
+    Get-Content $log -Tail 60 | Write-Output
+    Write-Output '--- return-value-3 context ---'
+    $lines = Get-Content $log
+    $idx = ($lines | Select-String 'Return value 3' | Select-Object -First 1).LineNumber
+    if ($idx) { $lines[[math]::Max(0, $idx - 15)..[math]::Min($lines.Count - 1, $idx + 2)] | Write-Output }
+}
diff --git a/.syncro-diag2-bo2.ps1 b/.syncro-diag2-bo2.ps1
new file mode 100644
index 00000000..f04e78a2
--- /dev/null
+++ b/.syncro-diag2-bo2.ps1
@@ -0,0 +1,23 @@
+$ErrorActionPreference = 'Continue'
+Write-Output '=== MsiInstaller events today (install/uninstall history) ==='
+Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='MsiInstaller'; StartTime=(Get-Date).Date} -ErrorAction SilentlyContinue |
+    Where-Object { $_.Message -match 'Syncro' } |
+    Sort-Object TimeCreated |
+    ForEach-Object { Write-Output ($_.TimeCreated.ToString('HH:mm:ss') + ' id=' + $_.Id + ' :: ' + (($_.Message -replace '\s+',' ').Substring(0,[math]::Min(160,$_.Message.Length)))) }
+
+Write-Output '=== Syncro bootstrapper / agent logs ==='
+$logDirs = @('C:\Windows\Temp','C:\ProgramData\Syncro','C:\ProgramData\Syncro\logs')
+foreach ($d in $logDirs) {
+    Get-ChildItem $d -Filter '*ncro*' -ErrorAction SilentlyContinue | ForEach-Object { Write-Output ('FOUND: ' + $_.FullName + ' (' + $_.Length + 'b, ' + $_.LastWriteTime.ToString('HH:mm:ss') + ')') }
+}
+$bl = Get-ChildItem 'C:\Windows\Temp' -Filter 'Syncro*.log' -ErrorAction SilentlyContinue | Sort-Object LastWriteTime -Descending | Select-Object -First 1
+if (-not $bl) { $bl = Get-ChildItem 'C:\ProgramData\Syncro' -Filter '*.log' -Recurse -ErrorAction SilentlyContinue | Sort-Object LastWriteTime -Descending | Select-Object -First 1 }
+if ($bl) { Write-Output ('--- tail of ' + $bl.FullName + ' ---'); Get-Content $bl.FullName -Tail 40 }
+
+Write-Output '=== Defender detections (last 24h) ==='
+Get-MpThreatDetection -ErrorAction SilentlyContinue | Where-Object { $_.InitialDetectionTime -gt (Get-Date).AddDays(-1) } |
+    ForEach-Object { Write-Output ($_.InitialDetectionTime.ToString('HH:mm:ss') + ' ' + $_.ThreatID + ' res=' + ($_.Resources -join ';')) }
+
+Write-Output '=== 3rd-party AV registered ==='
+Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue |
+    ForEach-Object { Write-Output ($_.displayName + ' state=' + $_.productState) }
diff --git a/.syncro-diag3-bo2.ps1 b/.syncro-diag3-bo2.ps1
new file mode 100644
index 00000000..cc1e556c
--- /dev/null
+++ b/.syncro-diag3-bo2.ps1
@@ -0,0 +1,29 @@
+$ErrorActionPreference = 'Continue'
+foreach ($k in @(
+    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall',
+    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall',
+    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion',
+    'HKLM:\SOFTWARE\WOW6432Node\RepairTech'
+)) {
+    $exists = Test-Path $k
+    $line = "KEY $k exists=$exists"
+    if ($exists) {
+        try { $acl = Get-Acl $k; $line += ' owner=' + $acl.Owner }
+        catch { $line += ' acl-read-FAILED: ' + $_.Exception.Message }
+    }
+    Write-Output $line
+}
+Write-Output '=== subkey counts ==='
+try { Write-Output ('64-bit Uninstall subkeys: ' + (Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall' -EA Stop).Count) } catch { Write-Output ('64-bit enum FAILED: ' + $_.Exception.Message) }
+try { Write-Output ('32-bit Uninstall subkeys: ' + (Get-ChildItem 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall' -EA Stop).Count) } catch { Write-Output ('32-bit enum FAILED: ' + $_.Exception.Message) }
+Write-Output '=== write test (32-bit view, as the installer would) ==='
+try {
+    $t = 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\_acg_writetest'
+    New-Item $t -Force -EA Stop | Out-Null
+    Remove-Item $t -Force -EA Stop
+    Write-Output 'WRITE-TEST-OK'
+} catch { Write-Output ('WRITE-TEST-FAILED: ' + $_.Exception.Message) }
+Write-Output '=== C:\Program Files\RepairTech leftovers ==='
+if (Test-Path 'C:\Program Files\RepairTech') {
+    Get-ChildItem 'C:\Program Files\RepairTech' -Recurse -EA SilentlyContinue | Select-Object -First 25 | ForEach-Object { Write-Output $_.FullName }
+} else { Write-Output 'NOT-PRESENT' }
diff --git a/.syncro-diag4-bo2.ps1 b/.syncro-diag4-bo2.ps1
new file mode 100644
index 00000000..507a7c56
--- /dev/null
+++ b/.syncro-diag4-bo2.ps1
@@ -0,0 +1,22 @@
+$ErrorActionPreference = 'Continue'
+$today = (Get-Date).Date
+Write-Output '=== App log: errors/crashes today mentioning Syncro/Kabuto/Squirrel/.NET ==='
+Get-WinEvent -FilterHashtable @{LogName='Application'; StartTime=$today} -ErrorAction SilentlyContinue |
+    Where-Object { $_.LevelDisplayName -in 'Error','Warning' -and $_.Message -match 'Syncro|Kabuto|Squirrel|Update\.exe|RepairTech' } |
+    Sort-Object TimeCreated | Select-Object -Last 15 |
+    ForEach-Object { Write-Output ($_.TimeCreated.ToString('HH:mm:ss') + ' [' + $_.ProviderName + '/' + $_.Id + '] ' + (($_.Message -replace '\s+',' ').Substring(0, [math]::Min(220, $_.Message.Length)))) }
+
+Write-Output '=== Defender blocks today (ASR 1121/1122, CFA 1123/1124, 5007) ==='
+Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Windows Defender/Operational'; Id=1121,1122,1123,1124,1126,1127,5007; StartTime=$today} -ErrorAction SilentlyContinue |
+    Sort-Object TimeCreated | Select-Object -Last 15 |
+    ForEach-Object { Write-Output ($_.TimeCreated.ToString('HH:mm:ss') + ' [' + $_.Id + '] ' + (($_.Message -replace '\s+',' ').Substring(0, [math]::Min(220, $_.Message.Length)))) }
+
+Write-Output '=== ASR / CFA / policy state ==='
+$mp = Get-MpPreference -ErrorAction SilentlyContinue
+Write-Output ('ASR rule count enabled: ' + (@($mp.AttackSurfaceReductionRules_Actions | Where-Object { $_ -eq 1 }).Count))
+Write-Output ('ControlledFolderAccess: ' + $mp.EnableControlledFolderAccess)
+Write-Output ('AppLocker policy: ' + ((Get-AppLockerPolicy -Effective -ErrorAction SilentlyContinue).RuleCollections | Measure-Object).Count + ' rule collections')
+$sac = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy' -Name VerifiedAndReputablePolicyState -ErrorAction SilentlyContinue
+Write-Output ('SmartAppControl state: ' + $sac.VerifiedAndReputablePolicyState)
+Write-Output '=== free space / drives ==='
+Get-PSDrive -PSProvider FileSystem | ForEach-Object { Write-Output ($_.Name + ': used=' + [math]::Round($_.Used/1GB,1) + 'GB free=' + [math]::Round($_.Free/1GB,1) + 'GB') }
diff --git a/.syncro-install-bo2.ps1 b/.syncro-install-bo2.ps1
new file mode 100644
index 00000000..4956dca9
--- /dev/null
+++ b/.syncro-install-bo2.ps1
@@ -0,0 +1,23 @@
+$ErrorActionPreference = 'Continue'
+$svc = Get-Service -Name 'Syncro','SyncroLive','SyncroOvermind' -ErrorAction SilentlyContinue
+$path = Test-Path 'C:\Program Files\RepairTech\Syncro'
+if ($svc -or $path) {
+    $names = ($svc | ForEach-Object { $_.Name + '=' + $_.Status }) -join ','
+    Write-Output ('SYNCRO-ALREADY-INSTALLED services=[' + $names + '] repairtech-path=' + $path)
+} else {
+    Write-Output 'SYNCRO-NOT-FOUND - installing'
+    $msi = 'C:\Windows\Temp\SyncroSetup-khalsa.msi'
+    [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor 3072
+    (New-Object Net.WebClient).DownloadFile('https://rmm.syncromsp.com/dl/msi/djEtOTQ1NjU1NC0xNTA3NjA4MzYxLTQ4NzUzLTM2ODUwMjI=', $msi)
+    Write-Output ('MSI downloaded ' + [math]::Round((Get-Item $msi).Length / 1MB, 1) + ' MB')
+    $p = Start-Process msiexec.exe -ArgumentList '/i', $msi, '/qn', '/norestart' -Wait -PassThru
+    Write-Output ('msiexec exit=' + $p.ExitCode)
+    Start-Sleep -Seconds 30
+    $svc2 = Get-Service -Name 'Syncro','SyncroLive','SyncroOvermind' -ErrorAction SilentlyContinue
+    if ($svc2) {
+        Write-Output ('SYNCRO-INSTALL-VERIFIED ' + (($svc2 | ForEach-Object { $_.Name + '=' + $_.Status }) -join ','))
+    } else {
+        Write-Output 'SYNCRO-SERVICES-NOT-FOUND-AFTER-INSTALL - check manually'
+    }
+    Remove-Item $msi -Force -ErrorAction SilentlyContinue
+}
diff --git a/.syncro-install-final-bo2.ps1 b/.syncro-install-final-bo2.ps1
new file mode 100644
index 00000000..6b3a9dce
--- /dev/null
+++ b/.syncro-install-final-bo2.ps1
@@ -0,0 +1,46 @@
+$ErrorActionPreference = 'Continue'
+$svc = Get-Service -Name 'Syncro','SyncroLive','SyncroOvermind' -ErrorAction SilentlyContinue
+if ($svc) {
+    $names = ($svc | ForEach-Object { $_.Name + '=' + $_.Status }) -join ','
+    Write-Output ('SYNCRO-ALREADY-INSTALLED services=[' + $names + ']')
+    exit 0
+}
+# Clean any leftover from prior failed installs
+$repairDir = 'C:\Program Files\RepairTech'
+if (Test-Path $repairDir) {
+    Remove-Item $repairDir -Recurse -Force -ErrorAction SilentlyContinue
+    Write-Output 'CLEANED prior RepairTech directory'
+}
+foreach ($k in @('HKLM:\SOFTWARE\WOW6432Node\RepairTech\Syncro','HKLM:\SOFTWARE\WOW6432Node\RepairTech\Kabuto')) {
+    if (Test-Path $k) { Remove-Item $k -Recurse -Force -ErrorAction SilentlyContinue; Write-Output ("CLEANED registry: $k") }
+}
+$msi = 'C:\Windows\Temp\SyncroSetup-khalsa.msi'
+if (-not (Test-Path $msi)) {
+    [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor 3072
+    (New-Object Net.WebClient).DownloadFile('https://rmm.syncromsp.com/dl/msi/djEtOTQ1NjU1NC0xNTA3NjA4MzYxLTQ4NzUzLTM2ODUwMjI=', $msi)
+    Write-Output ('MSI downloaded ' + [math]::Round((Get-Item $msi).Length / 1MB, 1) + ' MB')
+} else {
+    Write-Output ('MSI already present ' + [math]::Round((Get-Item $msi).Length / 1MB, 1) + ' MB')
+}
+$log = 'C:\Windows\Temp\syncro-install-final.log'
+$p = Start-Process msiexec.exe -ArgumentList '/i', $msi, '/qn', '/norestart', '/L*v', $log -Wait -PassThru
+Write-Output ('msiexec exit=' + $p.ExitCode)
+if ($p.ExitCode -eq 0) {
+    Start-Sleep -Seconds 30
+    $svc2 = Get-Service -Name 'Syncro','SyncroLive','SyncroOvermind' -ErrorAction SilentlyContinue
+    if ($svc2) {
+        Write-Output ('SYNCRO-INSTALL-OK ' + (($svc2 | ForEach-Object { $_.Name + '=' + $_.Status }) -join ','))
+    } else {
+        Write-Output 'SYNCRO-SERVICES-NOT-YET-VISIBLE - may need a moment to register'
+    }
+} else {
+    Write-Output '--- last 30 lines of install log ---'
+    if (Test-Path $log) { Get-Content $log -Tail 30 }
+    Write-Output '--- Return value 3 context ---'
+    if (Test-Path $log) {
+        $lines = Get-Content $log
+        $idx = ($lines | Select-String 'Return value 3' | Select-Object -First 1).LineNumber
+        if ($idx) { $lines[[math]::Max(0, $idx - 10)..[math]::Min($lines.Count - 1, $idx + 2)] | Write-Output }
+    }
+}
+Remove-Item $msi -Force -ErrorAction SilentlyContinue
diff --git a/clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md b/clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md
index d3d9bc2f..a4915b0d 100644
--- a/clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md
+++ b/clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md
@@ -11,6 +11,23 @@
 > CS-SERVER EDR installed, ticket table reconciled against Syncro (0 open as of 7/10).
 > The "Live snapshot" below is still the 6/24 AD-vs-RMM diff -- domain-join states are
 > per-machine current in the wiki's "Migration phase status" table.
+>
+> **REFRESHED 2026-07-15 — FINISH-LINE PASS** (full live verification sweep: Graph/M365,
+> Datto EDR, UniFi, MSP360, DNS — all evidence in the 7/15 session log + wiki recompile):
+> - **CARF Technology Plan FINALIZED** (`docs/proposals/cascades-technology-plan-2026-07-15.md`)
+>   — this roadmap is the execution engine behind it; plan targets (30/60/90 day) map to the
+>   workstreams below.
+> - **jodi.ramstack DECOMMISSIONED 7/15** (disabled + sessions revoked + suspended-Standard
+>   license reclaimed; mailbox was already deprovisioned by the suspended sub — no data in-tenant).
+>   Suspended Standard now 29 consumed.
+> - **EDR verified 35/35** incl. CS-SERVER; email auth (SPF/DKIM/DMARC) verified; ALIS SSO
+>   verified (secret good to 2028); 77 APs confirmed; voice VLAN exactly 37 devices.
+> - **Synology -> CS-SERVER share sync IS live and working** (wiki was stale; corrected).
+> - **New workstreams added**: WS8 (SharePoint/Teams HIPAA migration), WS9 (ALIS online
+>   payments), WS3 step 3b (nurse-station phone-parity shared login).
+> - Prepaid block: **21.5 hrs** (live 7/15).
+> - Goal restated: **close every workstream out** — the sequence at the bottom is the
+>   finish order.
 
 ---
 
@@ -143,9 +160,11 @@ access matrix; Synology retired as primary.
 
 ## Workstream 3 — HIPAA caregiver lockdown — GO-LIVE (highest value, mostly built)
 
-**[UPDATED 2026-07-13]** The 7/1 CA cutover put caregivers in an **interim posture**: all 35
+**[UPDATED 2026-07-15]** The 7/1 cutover put caregivers in an **interim posture**: all 35
 `SG-Caregivers` may sign in on desktops AND phones, **on-network only** (`e35614e1` off-network
-block + `7d491c7a` 8h sign-in frequency enforced; `SG-Caregivers` excluded from MFA-for-all).
+block — policy itself enabled since 2026-04-29 per live CA read 7/15, trusted IPs
+72.211.21.217/32 + 184.191.143.62/32 — + `7d491c7a` 8h sign-in frequency enforced;
+`SG-Caregivers` excluded from MFA-for-all).
 The compliance-block policy `ede985e2` was **DISABLED 2026-07-01 — do not re-enable** (superseded
 by the allow-list). Temp passwords are live for phone sign-in (must-change cleared fleet-wide 7/2;
 `PSO-Caregivers` never-expire FGPP in place). Roster = **35** after the 7/1 reconcile.
@@ -164,6 +183,16 @@ Final lockdown = flip from test scope to real caregivers, one device at a time
    after Win11 reinstall), NURSESTATION-PC (+ verify NurseAssist/Laptop4). NOTE: the device-lockdown
    (auto-logoff) GPO only applies once machines are in `OU=Caregiver Devices` — until then desktops
    caregivers use under the interim posture have NO auto-logoff enforcement.
+3b. **[ADDED 2026-07-15, Howard] Nurse-station desktops = phone-parity shared login.** The TWO
+   nurse-station desktops — **NURSESTATION-PC + ASSISTNURSE-PC** (explicitly NOT the medtech
+   laptops) — get the same model as the caregiver phones: ANY caregiver signs in with their own
+   `cascades\` username, lands on ALIS via SSO, and sees the SAME standardized desktop shortcuts
+   to the SAME sites as the phones. Implementation: allow `SG-Caregivers` interactive logon on
+   those two machines; deploy the shortcut set via the `CSC - Caregiver Workstation` GPO
+   (per-machine, all-users desktop) so every profile is identical; no per-user profile
+   customization; auto-lock/sign-out from the device-lockdown GPO applies (step 6). Define the
+   canonical shortcut list from the phone home-screen set (ALIS + the same sites — capture the
+   list from a phone before building).
 4. ALIS email-match the 35 caregivers + medtechs (ALIS staff Email = Entra UPN); ALIS records still
    to create for Munezero/Cota/Robinson; Vallejo email-match; 7 discharged-record decisions;
    turn off ALIS-native 2FA per user, then move to SSO-only (native login is a CA bypass path).
@@ -178,8 +207,12 @@ Final lockdown = flip from test scope to real caregivers, one device at a time
 ## Workstream 4 — M365
 
 - **Relicense remaining suspended Business Standard users -> Business Premium** (Standard SKU is
-  SUSPENDED — time-sensitive). SPB now 45 seats enabled (Howard bought 11 on 6/30); 41 consumed as
-  of 7/1 — count seats before relicensing.
+  SUSPENDED — time-sensitive). Live 7/15: SPB 45 enabled / 41 consumed (4 free); suspended
+  Standard **29 consumed** after the jodi.ramstack reclaim — 29 users to move needs ~25 more SPB
+  seats OR a per-user needs pass (lighter licenses where full Office isn't needed — the CARF plan
+  Area 2 budgets ~$375–575/mo for the mix). Count seats + decide mix before touching licenses.
+- ~~Decommission jodi.ramstack~~ — **DONE 2026-07-15** (disabled, sessions revoked, license
+  reclaimed; mailbox already gone via the suspended sub — nothing recoverable in-tenant).
 - **Create break-glass accounts (`breakglass1/2-csc@`) + enroll FIDO2 YubiKeys** — still not created
   (confirmed 5/27); now a **prerequisite for the WS3 allow-list enforcement flip**.
 - **Remove the standing Privileged Authentication Administrator role from the
@@ -194,15 +227,22 @@ Final lockdown = flip from test scope to real caregivers, one device at a time
 
 ## Workstream 5 — Server / infrastructure
 
-- **Cloud backup (MSP360 -> ACG-backup): VERIFIED running 2026-06-24** (last run Success, 0 failed, 575 GB baseline in cloud, incrementals working). Still confirm it is image/bare-metal/system-state (looks file-level) + set retention. [GATE for any drive work]
+- **Cloud backup (MSP360 -> ACG-backup): re-verified 2026-07-15** — daily file-level backup
+  running clean (incrementals current). **[WARN] The image/system-state side was ~10 days stale
+  at the 7/15 check** — confirm/repair the image plan + set retention BEFORE the SSD swap.
+  [GATE for any drive work]
 - **CS-SERVER RAID -- CORRECTED 2026-06-24: HEALTHY, not degraded** (live OMSA: both mirrors Ok, all 5 disks Online, all LEDs green; the 6/15 degraded self-recovered). **NO emergency drive swap.** 1:0:4 = global hot spare (do not remove). **Planned** reliability upgrade: replace the 2 consumer 320 GB drives (esp. flaky WD 0:0:3) with the 2x enterprise SSD **already purchased**, on a scheduled window w/ confirmed image/system-state backup. **[WARN] PSU redundancy lost** -- one PSU not delivering, check onsite. Service Tag 9MQFTK1. Real fix = DC migration off the 16-yr-old R610.
 - ~~Clean up old-MSP agent sprawl (Datto RMM/CentraStage + Datto EDR/Infocyte) thrashing the spindle~~
   — **DONE on CS-SERVER 2026-06-26** (full legacy Datto stack removed). **Current Datto EDR installed
   on CS-SERVER 2026-07-13** (HUNTAgent=Running, cmd `0a60cac7`) — the DC is back under managed
   endpoint protection. Fleet stragglers tracked in the wiki (DESKTOP-TRCIEJA BD_ACTIVE, laptop3/laptop1/
   cascades-laptop reconcile, Syncro BD-deployment removal, GravityZone portal cleanup).
-- Synology -> backup-only (Team Folder migration of the real shares; close the workgroup/Kerberos quirk).
+- Synology -> backup-only: **the share syncs Synology -> CS-SERVER ARE set up and working**
+  (confirmed by Howard 7/15; wiki corrected). Remaining: finish the role flip (server is primary,
+  Synology becomes the onsite backup target per CARF plan Area 5) + close the workgroup/Kerberos quirk.
 - Rotate the Synology signin-portal credential (was committed plaintext historically).
+- pfSense: **AutoConfigBackup not enabled** (found 7/15) — enable it (config IS backed up via
+  our repo copy, but ACB gives point-in-time restore).
 
 ---
 
@@ -231,7 +271,9 @@ Final lockdown = flip from test scope to real caregivers, one device at a time
     for offline resident TVs; identify the 17 unknowns + generic phones with John Trozzi.
 - **#32319** WiFi Room 343 — relocate a floor-2/4 AP for coverage (unifi-wifi skill, site `va6iba3v`).
 - **#32342** Copy Room switch — install + adopt into UniFi.
-- ~25 switch ports linked at 100 Mbps but gig-capable (cabling/NIC sweep).
+- Sub-gigabit sweep (live 7/15): **34 switch ports at 100 Mbps + 5 AP uplinks below gig** —
+  cabling/NIC sweep, prioritize the AP uplinks. (Live UniFi count 7/15: **11 switches**, 77 APs,
+  voice VLAN exactly 37 devices.)
 - *(Superseded)* Voice 5 GHz lock — now folded into the CSC ENT consolidation above (single
   dedicated 5 GHz network for phones + sensors, not just a phone-side band lock).
 
@@ -243,19 +285,81 @@ Final lockdown = flip from test scope to real caregivers, one device at a time
 
 ---
 
-## Suggested sequence (fastest path) — re-cut 2026-07-13
+## Workstream 8 — M365 collaboration migration (SharePoint / Teams) — HIPAA lockdown
+
+> Added 2026-07-15 (Howard): move Cascades onto SharePoint, Teams, and the wider Microsoft 365
+> platform to lock down data access and advance HIPAA compliance. Pairs with the network upgrade
+> work (WS6) and the domain migration (WS1/2) — the dept OU/group structure built there becomes
+> the SharePoint/Teams permission model.
+
+- **Scope/plan the migration**: department file shares (CS-SERVER `D:\Shares` + Synology) ->
+  SharePoint document libraries with role-based permissions mapped from the existing AD dept
+  groups; Teams for internal comms/collab (replaces ad-hoc channels); OneDrive for per-user files.
+- **HIPAA guardrails first-class**: role-scoped access (same SG model as caregiver lockdown),
+  audit logging (ties into the WS4 audit-retention build), retention policies, DLP evaluation,
+  sensitivity labels for PHI, external-sharing OFF by default.
+- **Licensing already supports it** — Business Premium (45 seats) includes SharePoint/Teams/
+  OneDrive/Intune/Purview basics; the WS4 relicensing moves the office staff onto it.
+- Sequencing: after (or alongside tail of) the domain migration — don't build SharePoint
+  permissions on the pre-migration flat-share model. Candidate first movers: the newer
+  role-based shares (Executive restricted, Company Web Docs, ALDOCS).
+- Synology then finishes its transition to backup-only (WS5) once shares live in SharePoint.
+- Also on the plan doc: Copilot evaluation under HIPAA guardrails + the KPI dashboard's
+  SharePoint/Power BI Phase 1 (scheduled exports) land on this same platform.
+
+---
+
+## Workstream 9 — ALIS online payment system
+
+> Added 2026-07-15 (Howard): get Cascades onto ALIS's online payment system (resident/family
+> billing payments through the clinical-record platform, Medtelligent).
+
+- **Scope with Medtelligent** — **scoping questions DRAFTED 2026-07-15**
+  (`docs/proposals/alis-online-payments-scoping-2026-07-15.md`, 18 questions: availability/
+  pricing/processor/PCI/BAA/ledger-posting/API/rollout). Next action: send to the Medtelligent
+  rep, loop in Jeff Bristol (accounting@) on replies. Q9 doubles as the BAA chase (Medtelligent
+  BAA unverified — feeds the area-4 BAA inventory regardless).
+- Coordinate with the business office (Jeff Bristol / accounting@) on the AR workflow change
+  and family communication.
+- IT-side items: SSO already live for ALIS (staff side); verify family-facing payment portal
+  access needs nothing on our network/identity side; add Medtelligent's payment processing to
+  the BAA/vendor tracker (plan area 4).
+- Ties into the KPI dashboard (ALIS billing data is a Phase 1 export source).
+
+---
+
+## Finish sequence — re-cut 2026-07-15 (order of completion)
+
+Everything below is scoped, built, or blocked on exactly one prerequisite — this is the
+close-out order, not a wish list.
 
 1. **2026-07-16 afternoon: offboard Juan Andrade** (disable + SG-Caregivers removal + license
    reclaim) — coord todo `80716a98`. Do NOT disable before then.
-2. **Break-glass accounts + strip the stranded PAA role** (Workstream 4) — prerequisite for the
-   allow-list enforcement flip; the tenant currently has live block policies and no break-glass.
-3. **Caregiver lockdown go-live** (Workstream 3) — highest HIPAA value; the interim posture's real
-   control (device allow-list) is still report-only/test-scoped.
-4. **M365 relicense remaining suspended-Standard users** (Workstream 4) — time-sensitive.
-5. **Backup image/system-state confirm -> planned SSD swap** (Workstream 5) — single-DC risk.
-6. **Remaining staff domain joins + dept drives** (Workstreams 1+2) + printer-share repoints /
-   Point-and-Print GPO fleet-wide (see wiki VLAN 20 section).
-7. Network tail (CSC ENT device island, 100 Mbps ports) + audit-retention build.
+2. **Break-glass accounts (`breakglass1/2-csc@`) + FIDO2 keys + strip the stranded PAA role**
+   (WS4) — THE blocking prerequisite for the allow-list enforcement flip; the tenant runs live
+   block policies with no break-glass today. Also the CARF plan's 30-day security item.
+3. **Caregiver lockdown go-live** (WS3 steps 1–8, incl. 3b nurse-station phone-parity build) —
+   highest HIPAA value; the real control (`1b7fd025` allow-list) is still report-only/test-scoped.
+   Capture the phone shortcut list for 3b while onsite for the OU moves.
+4. **M365 relicense the 29 suspended-Standard users** (WS4) — time-sensitive; decide seat mix
+   first (4 SPB free vs 29 to move).
+5. **Repair/confirm the image/system-state backup -> scheduled SSD swap** (WS5) — image side was
+   ~10 days stale on 7/15; single-DC risk until done.
+6. **Remaining staff domain joins + dept drives** (WS1+2: ~10 machines left after readiness
+   blockers cleared) + printer-share repoints / Point-and-Print GPO fleet-wide (wiki VLAN 20).
+   Onsite batch: reboots, KFM unlinks, LAPTOP-DRQ5L558 on-LAN.
+7. **Network tail** (WS6: CSC ENT device island incl. the ~79-client evacuation, 34-port +
+   5-AP-uplink gig sweep) + **audit-retention build** (WS4 — HIPAA 164.312(b) gap, approved
+   since 4/29).
+8. **M365 collaboration migration (WS8)** — SharePoint/Teams scoping once the domain-migration
+   tail is done; permission model rides the dept OU/SG structure from WS1/2. Synology finishes
+   its backup-only role flip (WS5) behind it.
+9. **ALIS online payments (WS9)** — vendor-driven, runs in parallel with everything above:
+   scoping questions are DRAFTED (`docs/proposals/alis-online-payments-scoping-2026-07-15.md`)
+   — send to Medtelligent when ready; business-office coordination (Jeff Bristol) is the long pole.
+10. **Ticket-verify pass with Howard** (table below) — confirm the 6 closed-in-Syncro tickets
+    were actually completed; any that weren't fold back into WS1/2/6/7 and get done in step 6–7
+    onsite trips.
 
 ---
 
diff --git a/clients/cascades-tucson/docs/proposals/alis-online-payments-scoping-2026-07-15.md b/clients/cascades-tucson/docs/proposals/alis-online-payments-scoping-2026-07-15.md
new file mode 100644
index 00000000..fb664a89
--- /dev/null
+++ b/clients/cascades-tucson/docs/proposals/alis-online-payments-scoping-2026-07-15.md
@@ -0,0 +1,61 @@
+# ALIS Online Payments — Scoping Questions for Medtelligent
+
+> Drafted 2026-07-15 (Howard / ACG) for the WS9 roadmap item: getting Cascades of Tucson
+> onto ALIS's online payment system (resident/family billing payments).
+> Community: cascadestucson.alisonline.com, communityId 622.
+> Send to Medtelligent support/account rep; loop in Jeff Bristol (accounting@) on replies.
+
+## Product & availability
+
+1. Is the online payments module available on Cascades of Tucson's current ALIS plan, or is
+   it a separate subscription/add-on? What is it officially called on your side?
+2. Does it cover both one-time payments and recurring/autopay (ACH and credit/debit card)?
+3. Can family members / responsible parties pay without an ALIS login, or does each payer
+   need a portal account? How are payer accounts invited and managed?
+4. Does it support partial payments, split billing between multiple responsible parties, and
+   payment plans?
+
+## Pricing & processing
+
+5. What are the costs: monthly/module fee, per-transaction fees (card vs ACH), and any
+   setup fee? Who is the payment processor?
+6. Can transaction fees be passed to the payer (surcharge/convenience fee), and is that
+   configurable per payment method?
+7. What is the settlement flow — how and when do funds land in Cascades' bank account,
+   and what does the remittance/reconciliation report look like?
+
+## Compliance & security
+
+8. Is the payment flow fully hosted/tokenized by the processor (i.e., Cascades never touches
+   card data)? What PCI DSS responsibility, if any, remains on the community?
+9. Does the existing Medtelligent BAA cover the payments module, or is an updated
+   agreement needed? (Note: we are completing a BAA inventory — please send the current
+   executed BAA on file for Cascades.)
+10. Where is payment/payer data stored, and what is the data-retention policy?
+
+## Billing integration & reconciliation
+
+11. Do online payments post automatically against ALIS resident ledgers/invoices, or does
+    the business office apply them manually?
+12. How do refunds, chargebacks, and failed ACH payments flow back into the ledger?
+13. Is payment data available through the ALIS API/exports (we pull staff data via API today
+    and are building a leadership KPI dashboard — billing/AR aging would be a Phase 1 source)?
+14. Does it interoperate with QuickBooks or Bill.com workflows, or is export/import the path?
+
+## Rollout & support
+
+15. What does implementation look like: timeline, setup steps on the community side, bank
+    verification, and any business-office training you provide?
+16. What family-facing materials exist (announcement templates, how-to guides) for the
+    payer rollout?
+17. Is there a sandbox/test mode so accounting can validate posting before go-live?
+18. Who is our implementation contact, and what does ongoing support look like for payment
+    disputes or processor issues?
+
+## Internal notes (not for the vendor email)
+
+- IT side is expected to be near-zero: staff SSO is live; the payer portal is vendor-hosted.
+  Confirm nothing is needed on our identity/network side (Q3, Q8).
+- Q9 doubles as the BAA chase — the Medtelligent BAA is unverified (wiki: "BAA required
+  before PHI leaves"), and the plan's area 4 BAA inventory needs it regardless.
+- Answers feed: WS9 rollout decision, area 4 BAA tracker, KPI dashboard Phase 1 source list.
diff --git a/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.html b/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.html
index d7181f52..b06696e6 100644
--- a/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.html
+++ b/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.html
@@ -204,6 +204,7 @@
       <tr><td>Complete staff domain migration + department drives</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60–90 days</td><td class="comp"></td></tr>
       <tr><td>Final Windows Pro upgrade (1 deferred device)</td><td class="own">ACG</td><td class="cost">~$99</td><td class="tgt">next window</td><td class="comp"></td></tr>
       <tr><td>Retire the per-PC Synology sync client as machines migrate</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">with migration</td><td class="comp"></td></tr>
+      <tr><td>Plan the move of department files and team collaboration to SharePoint and Teams (Microsoft 365) &mdash; role-based access, audit logging, and retention that strengthen HIPAA compliance</td><td class="own">ACG + Cascades</td><td class="cost">included in Microsoft 365 licensing</td><td class="tgt">90 days, then phased</td><td class="comp"></td></tr>
     </table>
   </section>
 
diff --git a/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.md b/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.md
index fd9e4acb..551660cd 100644
--- a/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.md
+++ b/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.md
@@ -70,6 +70,7 @@ sign-on, and a sanctioned analytics path for leadership).
 | Complete staff domain migration + department drives | ACG | labor | 60–90 days |
 | Final Windows Pro upgrade (1 deferred device) | ACG | ~$99 | next window |
 | Retire the per-PC Synology sync client as machines migrate | ACG | labor | with migration |
+| Plan the move of department files and team collaboration to SharePoint and Teams (Microsoft 365) — role-based access, audit logging, and retention that strengthen HIPAA compliance | ACG + Cascades | included in Microsoft 365 licensing | 90 days, then phased |
 
 ## 3. Security (sensitive data / HIPAA)
 
diff --git a/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.pdf b/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.pdf
index 803d9be7..cdb06b37 100644
Binary files a/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.pdf and b/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.pdf differ
diff --git a/clients/cascades-tucson/session-logs/2026-07/2026-07-17-howard-roadmap-finish-line-refresh.md b/clients/cascades-tucson/session-logs/2026-07/2026-07-17-howard-roadmap-finish-line-refresh.md
new file mode 100644
index 00000000..fac29f13
--- /dev/null
+++ b/clients/cascades-tucson/session-logs/2026-07/2026-07-17-howard-roadmap-finish-line-refresh.md
@@ -0,0 +1,117 @@
+# Cascades of Tucson — Roadmap additions + finish-line refresh
+
+## User
+- **User:** Howard Enos (howard)
+- **Machine:** Howard-Home
+- **Role:** tech
+
+## Session Summary
+
+Continued from the 7/15 technology-plan-final session (see that log's Update sections for
+the live verification sweep and jodi.ramstack decommission). This session extended and then
+fully refreshed the Cascades execution roadmap (`docs/REMAINING-WORK-PLAN.md`).
+
+First, per Howard's strategic direction, two new workstreams were added: **WS8 — M365
+collaboration migration (SharePoint / Teams) — HIPAA lockdown** (dept shares on CS-SERVER +
+Synology move to SharePoint libraries with role-based permissions from the AD dept groups;
+Teams/OneDrive; audit logging, retention, DLP, sensitivity labels, external sharing off;
+covered by existing Business Premium licensing; sequenced after the domain-migration tail),
+and **WS9 — ALIS online payment system** (Medtelligent vendor conversation, business-office
+coordination with Jeff Bristol, BAA tracker tie-in, KPI dashboard tie-in). A matching row
+was added to the CARF tech plan Area 2 (SharePoint/Teams move) and the plan PDF re-rendered.
+An 18-question Medtelligent scoping doc was drafted at
+`docs/proposals/alis-online-payments-scoping-2026-07-15.md`.
+
+Second, WS3 gained **step 3b**: nurse-station desktops NURSESTATION-PC + ASSISTNURSE-PC
+(explicitly NOT the medtech laptops) get phone-parity shared login — any caregiver signs in
+with their own `cascades\` username, gets ALIS via SSO and the same standardized desktop
+shortcuts as the phones, delivered per-machine/all-users via the `CSC - Caregiver Workstation`
+GPO. The canonical shortcut list must be captured from a phone home screen before building.
+
+Third, on Howard's directive ("update the plan/roadmap … getting them finished"), the whole
+REMAINING-WORK-PLAN got a **FINISH-LINE PASS**: a refreshed header block folding in the 7/15
+live-verification results, jodi decommission, CARF plan finalization, Synology-sync correction,
+and 21.5-hr block; per-workstream reconciliation (WS3 CA posture dates, WS4 relicensing math,
+WS5 backup/image-staleness gate + pfSense ACB, WS6 live port/switch counts, WS9 drafted
+status); and the sequence re-cut as a 10-step close-out order ending with a ticket-verify
+pass with Howard.
+
+## Key Decisions
+
+- Verification discrepancies were folded into the internal ROADMAP but deliberately NOT into
+  the client-facing tech plan (Howard: "leave the rest alone and do not add").
+- Nurse-station scope limited to the two desktops; medtech laptops explicitly excluded.
+- WS8 sequenced AFTER the domain-migration tail — don't build SharePoint permissions on the
+  pre-migration flat-share model; Synology backup-only flip follows the SharePoint move.
+- WS9 marked parallelizable (vendor-driven); scoping questions drafted but NOT sent — Howard
+  declined an email-ready version for now.
+- Relicensing recalculated: 29 suspended-Standard users remain vs only 4 free SPB seats —
+  seat-mix decision (full vs lighter licenses, ~$375–575/mo per CARF plan) required before
+  any license moves.
+- Image/system-state backup (~10 days stale on 7/15) made an explicit GATE before the SSD swap.
+- Tech plan PDF footer still shows stale 37.5 hrs (live 21.5) — left as-is per Howard
+  ("dont send this as a PDF").
+
+## Problems Encountered
+
+- 3b was initially stamped "ADDED 2026-07-16" (date confusion mid-session); corrected to
+  2026-07-15 during the refresh pass.
+- (Carried from 7/15 log: `UID` readonly in Git-Bash, jodi mailbox already deprovisioned by
+  the suspended sub, rebase/push race with Mike's MacBook sync — all resolved there.)
+
+## Configuration Changes
+
+- `clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md` — WS8 + WS9 added; WS3 step 3b added;
+  FINISH-LINE refresh header; WS3/WS4/WS5/WS6/WS9 reconciled to live 7/15 state; sequence
+  re-cut to 10 steps.
+- `clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.md` + `.html` +
+  `.pdf` — Area 2 row added (SharePoint/Teams move); PDF re-rendered 436,003 bytes / 4 pages.
+- `clients/cascades-tucson/docs/proposals/alis-online-payments-scoping-2026-07-15.md` — NEW:
+  18 Medtelligent scoping questions in 5 groups + internal notes.
+
+## Credentials & Secrets
+
+- None new this session.
+
+## Infrastructure & Servers
+
+- Cascades M365 tenant `207fa277-e9d8-4eb7-ada1-1064d2221498`; SPB 45 enabled / 41 consumed;
+  suspended Business Standard 29 consumed (post-jodi).
+- CA policies: off-network block `e35614e1` (enabled 2026-04-29; trusted IPs 72.211.21.217/32,
+  184.191.143.62/32), sign-in frequency `7d491c7a`, allow-list `1b7fd025` (report-only,
+  test-scoped), compliance-block `ede985e2` DISABLED (do not re-enable).
+- ALIS: cascadestucson.alisonline.com, communityId 622, SSO appId
+  `d5108493-cba8-4f08-90b6-1bb0bc09eb2a` (secret to 2028-05-06).
+- UniFi live 7/15: 11 switches, 77 APs, voice VLAN 37 devices, 34 ports @100Mb + 5 AP uplinks
+  sub-gig. Controller 172.16.3.29:11443 site `va6iba3v`.
+- MSP360: daily file backup current; image/system-state ~10 days stale (gate for SSD swap).
+- pfSense AutoConfigBackup not enabled.
+
+## Commands & Outputs
+
+- Roadmap edits via Edit tool only this session; no external commands of note.
+
+## Pending / Incomplete Tasks
+
+1. **Juan Andrade offboarding — was due 2026-07-16 afternoon** (coord todo `80716a98`) —
+   VERIFY it happened; if not, do it now.
+2. Break-glass accounts + FIDO2 + strip stranded PAA role (blocks the allow-list flip).
+3. Caregiver lockdown go-live (WS3 1–8 incl. 3b; capture phone shortcut list onsite).
+4. Relicense 29 suspended-Standard users (seat-mix decision first).
+5. Image backup repair/confirm -> SSD swap window.
+6. Domain-join tail (~10 machines) + dept drives + printer GPO.
+7. Network tail (CSC ENT island, gig sweep) + audit-retention build.
+8. WS8 SharePoint/Teams scoping (after WS1/2 tail).
+9. WS9: send scoping questions to Medtelligent (drafted, not sent), cc Jeff Bristol.
+10. Ticket-verify pass with Howard (#32194/#32230/#32254/#32319/#32342/#32370).
+- Tech plan: "we will come back to the tech plan" (Howard); PDF footer hours stale by choice.
+
+## Reference Information
+
+- Roadmap: `clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md`
+- Tech plan: `clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.{md,html,pdf}`
+- ALIS scoping: `clients/cascades-tucson/docs/proposals/alis-online-payments-scoping-2026-07-15.md`
+- Prior log (verification + jodi decommission evidence):
+  `clients/cascades-tucson/session-logs/2026-07/2026-07-15-howard-technology-plan-final.md`
+- Wiki commit from 7/15 recompile: `7e15257`; coord todo Juan Andrade: `80716a98`
+- Syncro customer 20149445; prepaid block 21.5 hrs (live 7/15)
diff --git a/errorlog.md b/errorlog.md
index 4fa85f14..19a3505c 100644
--- a/errorlog.md
+++ b/errorlog.md
@@ -25,6 +25,8 @@ Categories (the `[type]` tag): _(none)_ = skill/command execution failure ·
 
 2026-07-16 | GURU-BEAST-ROG | syncro/comment | [friction] POST /tickets/{id}/comment response failed jq parse even after tr control-char strip; comment DID post (verified via GET) - check-first rule prevented duplicate [ctx: ticket=32557]
 
+2026-07-16 | Howard-Home | rmm/bash-env | [friction] reused $TOKEN/$RMM from prior Bash call; env does not persist between Bash calls - must re-auth in same command [ctx: ref=CLAUDE.md shell-state rule]
+
 2026-07-15 | Howard-Home | msp360/backups | [correction] assumed LAB-SVR (Len's Auto) is a live machine needing attention; correct is LAB-SVR was RETIRED and replaced by LAB-SERVER — repeated correction from Howard
 
 2026-07-15 | Howard-Home | cascades-verification | [correction] reported Synology-to-server sync as 'overstated/partial' from stale wiki (6/18 note); correct is: shared-folder syncs to the server ARE set up — Howard confirmed. Wiki Team Folder [PENDING] lines are stale