diff --git a/wiki/index.md b/wiki/index.md
index 4bdbf673..581844b8 100644
--- a/wiki/index.md
+++ b/wiki/index.md
@@ -46,7 +46,7 @@ Run `/wiki-lint` to check for stale entries and broken backlinks.
 | [Western Tire](clients/western-tire.md) | Tire retail (jackfurriers.com brand); Mike Furrier owner (Syncro ID 391491); email migrated from websvr to IX 2026-04-22; 30 mailboxes; SSL cert expires 2026-05-30 | 2026-05-24 |
 | [Kittle Design & Construction LLC](clients/kittle.md) | **Canonical Kittle article.** GC Tucson AZ; Syncro 32460233; M365 kittlearizona.com (tenant 3d073ebe); **major June 2026 BEC/ACH-fraud incident** — Ken+marco+Accounting compromised, fraudulent bank-change to City of Tucson + Town of Marana ($130K+ exposure, PREVENTED, no loss), IC3 filed; root cause = April credential theft + incomplete remediation (password never reset → ~2mo persistence); CA hardened + Entra P2 added 6/9; HPE MicroServer WS2025 EVAL, no backups/firewall | 2026-06-09 |
 | [Khalsa (two-site)](clients/khalsa.md) | Khalsa Montessori School (Syncro 9456554); two-site (Camden + River); domain khalsa.local on 10.11.12.0/22. **Server inventory captured 2026-06-19** (Syncro+ScreenConnect): TROUT (Camden, 10.11.12.254) = sole live DC+DNS+file(K:)+QuickBooks on aging Dell T110 II, ~490GB used, C: only 10% free; SALMON (River, 10.11.14.76) = standalone file/QB server; KHALSADC2 = intended 2nd DC OFFLINE since 2025-08 (no AD redundancy). **TROUT can't be removed as-is** (Schoolmaster gone but it now runs DC/DNS/QB) — needs role migration first. No server backups captured; VPN to ACG broken (manage via ScreenConnect). M365/contract terms still pending | 2026-06-19 |
-| [Lone Star Electrical Systems](clients/lonestar-electrical.md) | Electrical contractor Tucson AZ; Syncro 33809612, prepaid block 13.5 hrs; Google Workspace (not M365); ManageEngine MDM (Zoho); Unraid server (7.1.4, USB migrated 2026-06-02); LS-1/LS-2 Sophos removal COMPLETE (2026-06-02); Defender active on both; field/mobile-first | 2026-07-06 |
+| [Lone Star Electrical Systems](clients/lonestar-electrical.md) | Electrical contractor Tucson AZ; Syncro 33809612, prepaid block DEPLETED (0 hrs @2026-07-06); Google Workspace (not M365); ManageEngine MDM (Zoho); Unraid "Tower" (7.1.4, live IP 192.168.120.177) + LONESTAR-VM — recurring VM-loss ROOT-CAUSED+FIXED 2026-07-06 (leftover /boot/config/go libvirt hijack); LS-1/LS-2 Sophos removal COMPLETE; field/mobile-first | 2026-07-06 |
 | [Anaise](clients/anaise.md) | Single workstation client; contact David (anaisedavid.office@gmail.com); DESKTOP-O8GF4SD; creds in vault at clients/anaise/desktop-o8gf4sd.sops.yaml; onboarding incomplete; M365 enrollment unconfirmed | 2026-05-24 |
 | [ACG Website (azcomputerguru.com)](clients/azcomputerguru.com.md) | Public website redesign (Astro); score 33/40; placeholder testimonials + no-backend form are pre-launch blockers; OKLCH token design system; see internal-infrastructure.md for ACG servers | 2026-05-24 |
 | [Quantum WMS](clients/quantumwms.md) | WMS company; quantumwms.com tenant (ddf3d2c9); GoDaddy decoupling + M365 migration; 2x Business Premium + Exchange Online Plan 1; deadline 2026-06-03; Tenant Admin consented 2026-05-26 | 2026-05-26 |