diff --git a/.claude/memory/MEMORY.md b/.claude/memory/MEMORY.md
index 48a25059..d50751c5 100644
--- a/.claude/memory/MEMORY.md
+++ b/.claude/memory/MEMORY.md
@@ -213,3 +213,4 @@
 - [ScreenConnect cleanup uses wiki as source](feedback_screenconnect_cleanup_wiki_source.md) — per-client SC/RMM metadata cleanup pulls machine->dept/location from the client wiki; enrich the wiki when missing
 - [TECH03L systemprofile shortcut corruption](project_tech03l_systemprofile_shortcut_corruption.md) — Auto-Claude "opens then closes" = .lnk pointing at nonexistent systemprofile path; repoint, do not debug the app
 - [Claude tui fullscreen crash](feedback_claude_tui_fullscreen_crash.md) — "flicker-free" prompt writes tui=fullscreen; instant-exit crash loop on some Windows terminals; set tui=default (reinstall does NOT fix)
+- [Backup targets never guessed](feedback_backup_targets_never_guessed.md) — billed-vs-running mismatches are billing questions for Mike/Winter; never infer/deploy backup targets
diff --git a/.claude/memory/feedback_backup_targets_never_guessed.md b/.claude/memory/feedback_backup_targets_never_guessed.md
new file mode 100644
index 00000000..fa143fbe
--- /dev/null
+++ b/.claude/memory/feedback_backup_targets_never_guessed.md
@@ -0,0 +1,21 @@
+---
+name: feedback_backup_targets_never_guessed
+description: Backup targets are a deliberate per-client decision - never infer which machine needs backup or deploy backup jobs from billing counts
+metadata:
+  type: feedback
+---
+
+When reconciling billed backup lines (e.g. Syncro "Service - Data Backup" qty) against
+machines actually backing up (MSP360/B2), a mismatch is a BILLING question for Mike/Winter,
+never a deployment instruction. (Howard, 2026-07-05, GPS->RMM audit backup verification.)
+
+**Why:** which machine gets backed up is a deliberate choice made per client (usually the
+server or a specific data machine) — billed qty does not mean "N machines each need a
+backup job." Guessing targets and adding backup jobs would burn storage and misrepresent
+what the client agreed to.
+
+**How to apply:** report mismatches (billed > running, running > billed, dead buckets) as
+findings with evidence; route the decision to Mike/Winter/client. Only configure a backup
+job when the target machine is explicitly named by the user/client. Related:
+[[project_av_migration_bitdefender_to_edr]] (the AV migration IS deploy-everywhere, unlike
+backup — don't conflate the two postures).