sync: auto-sync from HOWARD-HOME at 2026-07-15 11:39:11

Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-15 11:39:11
2026-07-15 11:39:45 -07:00
parent aae897abfe
commit 71aa0da646
13 changed files with 3175 additions and 7 deletions
--- a/clients/cascades-tucson/docs/proposals/carf-technology-plan-intake.md
+++ b/clients/cascades-tucson/docs/proposals/carf-technology-plan-intake.md
@@ -75,9 +75,9 @@ For each area, fill the four input fields: **Responsible person**, **Estimated/a
 - Responsible person: **>> NEEDED <<** · Cost: minimal/internal · Target date: **>> NEEDED <<** · Completion: pending

 ### 5. Backup policy
- **Current:** cloud backup (MSP360) **verified running 2026-06-24** — last run succeeded, ~576 GB protected off-site, daily incrementals.
- **Unmet / projected needs:** confirm/extend to full system-image (bare-metal) backup for the server; **run and document a test restore** (CARF looks for this); set/confirm retention.
- **Possible vendor:** Az Computer Guru / MSP360.
+- **Current:** the server is backed up. The Synology NAS syncs its data to the server, and the server is backed up online (off-site) with daily incrementals — **verified running 2026-06-24**.
+- **Unmet / projected needs:** **run and document a test restore** (CARF looks for this); set/confirm retention.
+- **Possible vendor:** Az Computer Guru.
 - Responsible person: **>> NEEDED <<** (suggest ACG) · Cost: **[ACG TO PRICE]** · Target date: **>> NEEDED <<** · Completion: backup live; image + restore-test pending

 ### 6. Assistive technology (persons served) — **biggest input gap**
@@ -88,7 +88,7 @@ For each area, fill the four input fields: **Responsible person**, **Estimated/a

 ### 7. Disaster recovery preparedness
 - **Current:** documented power-outage runbook with scripted clean shutdown and **verified recovery** (June 2026); UPS protection; backup running.
- **Unmet / projected needs:** written DR/business-continuity plan with target recovery times (RTO/RPO); add server redundancy; complete the system-image backup + restore test (links to area 5).
+- **Unmet / projected needs:** written DR/business-continuity plan with target recovery times (RTO/RPO); add server redundancy; complete the restore test (links to area 5).
 - **Possible vendor:** Az Computer Guru.
 - Responsible person: **>> NEEDED <<** (suggest ACG) · Cost: **[ACG TO PRICE]** · Target date: **>> NEEDED <<** · Completion: procedure proven; written plan pending

@@ -134,7 +134,7 @@ For each area, fill the four input fields: **Responsible person**, **Estimated/a
 | Break-glass FIDO2 YubiKeys (5-series) | Confidentiality | 2 | **~$110** (already ordered per records) | Approximate |
 | Azure audit-log retention (Log Analytics 90 d + 6 yr archive) | Security | — | **~$50–120/mo** consumption (log-volume dependent) + one-time ACG build | Firm up after measuring actual audit-log volume |
 | Managed antivirus, all devices incl. server | Virus protection | — | **Included in existing ACG Bitdefender managed security** + ACG labor to enroll server / remove legacy Datto agents | **Client (Mike) is deploying AV** |
-| DR written plan + system-image confirm + restore test | DR | — | **ACG labor (prepaid block)** | Restore test **deferred** per client (revisit after AV + basic items) |
+| DR written plan + restore test | DR | — | **ACG labor (prepaid block)** | Restore test **deferred** per client (revisit after AV + basic items) |
 | Security risk assessment (dated package) + file-share audit logging | Security | — | **ACG labor (prepaid block); no license cost** | |
 | **Long-term server replacement (PowerEdge T360-class)** | Hardware / DR | 1 | **~$4,000–7,000 configured (formal quote required)** | Depends on spec + Windows Server licensing + CALs; separate project |

--- a/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.html
+++ b/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.html
@@ -0,0 +1,334 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<title>Cascades of Tucson Technology Plan</title>
+<link rel="preconnect" href="https://fonts.googleapis.com">
+<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+<link href="https://fonts.googleapis.com/css2?family=Barlow+Condensed:wght@500;600;700&family=Lexend:wght@300;400;500;600&family=JetBrains+Mono:wght@400;500;600&display=swap" rel="stylesheet">
+<style>
+  :root{
+    --paper:#F7F3EB; --surface:#EDE6D9; --surface-2:#E4DACA;
+    --ink:#2A2521; --ink-2:#5A5148; --ink-3:#6D6456;
+    --accent:#F2922E; --accent-ink:#BD5A00; --on-accent:#2A2521;
+    --good:#4F7A3F; --good-ink:#3C6230;
+    --rule:rgba(90,81,72,0.18); --rule-strong:rgba(90,81,72,0.34);
+    --f-display:"Barlow Condensed","Arial Narrow",system-ui,sans-serif;
+    --f-body:"Lexend",system-ui,-apple-system,"Segoe UI",Roboto,sans-serif;
+    --f-mono:"JetBrains Mono",ui-monospace,"Cascadia Mono",Consolas,monospace;
+  }
+  *{box-sizing:border-box;}
+  html,body{margin:0;padding:0;}
+  body{
+    font-family:var(--f-body); font-weight:400; color:var(--ink);
+    background:var(--paper); font-size:10.2px; line-height:1.5;
+    -webkit-font-smoothing:antialiased; text-rendering:optimizeLegibility;
+    -webkit-print-color-adjust:exact; print-color-adjust:exact;
+  }
+  .sheet{ max-width:760px; margin:0 auto; padding:22px 30px 26px; }
+
+  /* ---- Masthead ---- */
+  .mast{ display:flex; justify-content:space-between; align-items:flex-end;
+    padding-bottom:10px; border-bottom:2px solid var(--ink); }
+  .brand__name{ font-family:var(--f-display); font-weight:700; font-size:20px;
+    letter-spacing:.02em; line-height:1; color:var(--ink); }
+  .brand__name b{ color:var(--accent-ink); font-weight:700; }
+  .brand__tag{ font-family:var(--f-mono); font-size:7.6px; letter-spacing:.26em;
+    text-transform:uppercase; color:var(--ink-3); margin-top:6px; }
+  .mast__meta{ font-family:var(--f-mono); font-size:7.6px; letter-spacing:.06em;
+    color:var(--ink-3); text-align:right; line-height:1.7; }
+  .mast__meta b{ color:var(--ink); font-weight:600; }
+
+  /* ---- Title block ---- */
+  .titleblock{ margin:15px 0 4px; }
+  .titleblock .eyebrow{ font-family:var(--f-mono); font-size:8px; letter-spacing:.24em;
+    text-transform:uppercase; color:var(--accent-ink); }
+  h1{ font-family:var(--f-display); font-weight:600; font-size:31px; line-height:1.0;
+    margin:6px 0 0; letter-spacing:.005em; }
+  .lede{ max-width:64ch; color:var(--ink-2); font-size:10.2px; margin:8px 0 0; }
+
+  /* ---- Governance ---- */
+  .gov{ display:grid; grid-template-columns:repeat(5,1fr); gap:0 18px; margin-top:12px;
+    padding:9px 12px; background:var(--surface); border-radius:2px; }
+  .gov div{ min-width:0; }
+  .gov .k{ font-family:var(--f-mono); font-size:7px; letter-spacing:.16em;
+    text-transform:uppercase; color:var(--ink-3); display:block; margin-bottom:2px; }
+  .gov .v{ font-size:9.2px; color:var(--ink); font-weight:500; line-height:1.35; }
+  .gov .v i{ color:var(--ink-3); font-style:italic; font-weight:400; }
+
+  /* ---- Areas ---- */
+  .band-label{ font-family:var(--f-mono); font-size:8px; letter-spacing:.22em;
+    text-transform:uppercase; color:var(--ink-3); margin:16px 0 6px;
+    padding-bottom:5px; border-bottom:1px solid var(--rule-strong); }
+  .area{ padding:11px 0 10px; border-top:1px solid var(--rule);
+    break-inside:avoid; page-break-inside:avoid; }
+  .area:first-of-type{ border-top:0; }
+  .area__head{ display:flex; align-items:baseline; gap:11px; margin-bottom:6px; }
+  .area__no{ font-family:var(--f-mono); font-weight:600; font-size:9.5px;
+    color:var(--ink-3); width:18px; flex:none; }
+  .area__title{ font-family:var(--f-display); font-weight:600; font-size:17px;
+    line-height:1; letter-spacing:.01em; margin:0; flex:1 1 auto; }
+
+  .lbl{ font-family:var(--f-mono); font-size:7.2px; font-weight:600; letter-spacing:.16em;
+    text-transform:uppercase; display:block; margin:6px 0 3px 29px; }
+  .lbl--done{ color:var(--good-ink); }
+  .lbl--todo{ color:var(--accent-ink); }
+  ul.done{ margin:0 0 0 29px; padding:0 0 0 14px; color:var(--ink-2); }
+  ul.done li{ margin:1.5px 0; font-size:9.6px; line-height:1.45; }
+  ul.done b{ color:var(--ink); font-weight:600; }
+
+  table.todo{ border-collapse:collapse; width:calc(100% - 29px); margin:2px 0 0 29px; }
+  table.todo th{ font-family:var(--f-mono); font-size:6.8px; font-weight:500;
+    letter-spacing:.14em; text-transform:uppercase; color:var(--ink-3);
+    text-align:left; padding:2px 8px 3px 0; border-bottom:1px solid var(--rule-strong); }
+  table.todo td{ font-size:9.3px; color:var(--ink-2); padding:3.5px 8px 3.5px 0;
+    border-bottom:1px solid var(--rule); vertical-align:top; line-height:1.4; }
+  table.todo tr:last-child td{ border-bottom:0; }
+  table.todo td.own{ font-family:var(--f-mono); font-size:8px; color:var(--ink);
+    white-space:nowrap; }
+  table.todo td.tgt{ font-family:var(--f-mono); font-size:8px; color:var(--accent-ink);
+    font-weight:500; white-space:nowrap; }
+  table.todo td.cost{ font-family:var(--f-mono); font-size:8px; color:var(--ink-2); white-space:nowrap; }
+
+  table.mach{ border-collapse:collapse; width:calc(100% - 29px); margin:3px 0 0 29px; }
+  table.mach th{ font-family:var(--f-mono); font-size:6.8px; font-weight:500;
+    letter-spacing:.14em; text-transform:uppercase; color:var(--ink-3);
+    text-align:left; padding:2px 8px 3px 0; border-bottom:1px solid var(--rule-strong); }
+  table.mach td{ font-size:9.3px; color:var(--ink-2); padding:3.5px 8px 3.5px 0;
+    border-bottom:1px solid var(--rule); }
+  table.mach tr:last-child td{ border-bottom:0; }
+  table.mach td b{ color:var(--accent-ink); font-weight:600; }
+  table.mach td.m{ font-family:var(--f-mono); font-size:8.4px; color:var(--ink); }
+
+  .supp p{ margin:2px 0 0 29px; font-size:9.6px; color:var(--ink-2); line-height:1.5; max-width:72ch; }
+  .supp p b{ color:var(--ink); font-weight:600; }
+
+  /* ---- Footer ---- */
+  .foot{ margin-top:15px; padding-top:10px; border-top:2px solid var(--ink);
+    display:flex; justify-content:space-between; align-items:flex-end; gap:20px; }
+  .foot__note{ font-size:8.6px; color:var(--ink-3); max-width:54ch; line-height:1.5; }
+  .foot__balance{ text-align:right; font-family:var(--f-mono); flex:none; }
+  .foot__balance .k{ font-size:7.4px; letter-spacing:.18em; text-transform:uppercase; color:var(--ink-3); }
+  .foot__balance .v{ font-size:15px; font-weight:600; color:var(--accent-ink);
+    font-variant-numeric:tabular-nums; margin-top:2px; }
+
+  @page{ size:Letter; margin:13mm 14mm; }
+  @media print{ .sheet{ padding:0; max-width:none; } body{ font-size:10px; } }
+</style>
+</head>
+<body>
+<div class="sheet">
+
+  <header class="mast">
+    <div>
+      <div class="brand__name">Az Computer <b>Guru</b></div>
+      <div class="brand__tag">Managed IT &amp; Security · Tucson · Since 2001</div>
+    </div>
+    <div class="mast__meta">
+      Prepared for &nbsp;<b>Cascades of Tucson</b><br>
+      Attn: Business Office<br>
+      Drafted &nbsp;<b>July 15, 2026</b>
+    </div>
+  </header>
+
+  <div class="titleblock">
+    <div class="eyebrow">Technology Plan · FY 2026–2027</div>
+    <h1>Cascades of Tucson Technology Plan</h1>
+    <p class="lede">A living action document: for each area of the facility's technology, what has
+      been done and what is planned, with an owner, cost, and target for every action. Prepared with
+      Az Computer Guru. Reviewed and updated at least annually.</p>
+  </div>
+
+  <div class="gov">
+    <div><span class="k">Plan owner</span><span class="v">Cascades of Tucson</span></div>
+    <div><span class="k">Prepared with</span><span class="v">Az Computer Guru</span></div>
+    <div><span class="k">Plan period</span><span class="v">FY 2026–2027</span></div>
+    <div><span class="k">Adopted by / date</span><span class="v"><i>at adoption</i></span></div>
+    <div><span class="k">Next annual review</span><span class="v"><i>adoption + 12 months</i></span></div>
+  </div>
+
+  <div class="band-label">The eight areas</div>
+
+  <section class="area">
+    <div class="area__head"><span class="area__no">01</span><h2 class="area__title">Hardware</h2></div>
+    <span class="lbl lbl--done">Done</span>
+    <ul class="done">
+      <li>Full managed network deployed: UniFi with <b>77 access points and 12 managed switches</b>; business firewall with dual internet connections and automatic failover.</li>
+      <li>Server storage verified healthy; enterprise SSDs purchased for a planned upgrade.</li>
+      <li>Windows Pro upgrades completed on nearly all workstations for domain readiness.</li>
+    </ul>
+    <span class="lbl lbl--todo">To do</span>
+    <table class="todo">
+      <tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr>
+      <tr><td>Install the purchased enterprise SSDs (scheduled window)</td><td class="own">ACG</td><td class="cost">purchased</td><td class="tgt">30–60 days</td></tr>
+      <tr><td>Replace workstations marked for replacement (list below, 5 + spare)</td><td class="own">ACG</td><td class="cost">~$700–950 ea</td><td class="tgt">60–90 days</td></tr>
+      <tr><td>Scope and quote a server refresh project</td><td class="own">ACG + Cascades</td><td class="cost">formal quote</td><td class="tgt">90 days</td></tr>
+      <tr><td>Bring remaining switch ports up to full gigabit speed</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">90 days</td></tr>
+    </table>
+    <span class="lbl lbl--todo">Workstations marked for replacement</span>
+    <table class="mach">
+      <tr><th style="width:30%">Machine</th><th style="width:26%">User / role</th><th>Plan</th></tr>
+      <tr><td class="m">DESKTOP-TRCIEJA</td><td>Lupe Sanchez</td><td><b>Replace</b> (end of life)</td></tr>
+      <tr><td class="m">ASSISTMAN-PC</td><td>Meredith Kuhn</td><td><b>Replace</b> (2015-era processor, cannot run Windows 11)</td></tr>
+      <tr><td class="m">MDIRECTOR-PC</td><td>Shelby Trozzi (MC Director)</td><td><b>Replace</b> (insufficient memory)</td></tr>
+      <tr><td class="m">MEMRECEPT-PC</td><td>Memory Care front desk</td><td><b>Replace</b> (oldest machine in the fleet)</td></tr>
+      <tr><td class="m">Spare unit</td><td>New hire</td><td><b>Deploy spare</b></td></tr>
+      <tr><td class="m">CHEF-PC</td><td>Culinary</td><td><b>Replace</b></td></tr>
+    </table>
+  </section>
+
+  <section class="area">
+    <div class="area__head"><span class="area__no">02</span><h2 class="area__title">Software</h2></div>
+    <span class="lbl lbl--done">Done</span>
+    <ul class="done">
+      <li>Microsoft 365 Business Premium across the organization (45 seats enabled).</li>
+      <li>ALIS clinical record connected to company sign-in (<b>single sign-on live</b>).</li>
+      <li>Domain migration underway: about half of staff PCs on the company domain with department structure and drive mapping built.</li>
+    </ul>
+    <span class="lbl lbl--todo">To do</span>
+    <table class="todo">
+      <tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr>
+      <tr><td>Right-size Microsoft 365 licensing: move users off the legacy license; full Office licenses only where needed, lighter licenses for everyone else</td><td class="own">ACG</td><td class="cost">reduces monthly cost</td><td class="tgt">30 days</td></tr>
+      <tr><td>Complete staff domain migration + department drives</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60–90 days</td></tr>
+      <tr><td>Final Windows Pro upgrade (1 deferred device)</td><td class="own">ACG</td><td class="cost">~$99</td><td class="tgt">next window</td></tr>
+      <tr><td>Retire the per-PC Synology sync client as machines migrate</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">with migration</td></tr>
+    </table>
+  </section>
+
+  <section class="area">
+    <div class="area__head"><span class="area__no">03</span><h2 class="area__title">Security (sensitive data / HIPAA)</h2></div>
+    <span class="lbl lbl--done">Done</span>
+    <ul class="done">
+      <li>Multi-factor sign-in for all staff; identity-based conditional access live.</li>
+      <li>Caregiver accounts restricted to the building network (<b>credentials unusable off-site</b>), live since July 1, 2026.</li>
+      <li>Auto-lock and auto-sign-out policy on shared care devices.</li>
+      <li>Segmented network: voice isolated, per-room isolation, resident devices separated.</li>
+      <li>Email authentication (SPF, DKIM, DMARC) enforced.</li>
+    </ul>
+    <span class="lbl lbl--todo">To do</span>
+    <table class="todo">
+      <tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr>
+      <tr><td>Create emergency break-glass admin accounts with hardware security keys</td><td class="own">ACG</td><td class="cost">~$110 keys</td><td class="tgt">30 days</td></tr>
+      <tr><td>Enforce the caregiver device allow-list (final enforcement phase)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">30–60 days</td></tr>
+      <tr><td>Limit trusted-network sign-in to approved devices (next enforcement phase)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">30–60 days</td></tr>
+      <tr><td>Enable file-access audit logging with 90-day / 6-year retention</td><td class="own">ACG</td><td class="cost">~$50–120/mo</td><td class="tgt">60–90 days</td></tr>
+      <tr><td>Formalize a same-day offboarding checklist</td><td class="own">Cascades HR + ACG</td><td class="cost">none</td><td class="tgt">30 days, standing</td></tr>
+      <tr><td>Package the dated security risk assessment</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60 days</td></tr>
+    </table>
+  </section>
+
+  <section class="area">
+    <div class="area__head"><span class="area__no">04</span><h2 class="area__title">Confidentiality</h2></div>
+    <span class="lbl lbl--done">Done</span>
+    <ul class="done">
+      <li>PHI access limited by role and security group; single sign-on to the clinical record.</li>
+      <li>Shared care devices auto-lock; resident and voice traffic isolated on the network.</li>
+    </ul>
+    <span class="lbl lbl--todo">To do</span>
+    <table class="todo">
+      <tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr>
+      <tr><td>Complete the Business Associate Agreement inventory (every vendor touching PHI)</td><td class="own">Cascades + ACG</td><td class="cost">none</td><td class="tgt">60 days</td></tr>
+      <tr><td>Move ALIS fully to single sign-on (retire the separate native login)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60 days</td></tr>
+      <tr><td>Enable encryption on the resident-data file share</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60–90 days</td></tr>
+      <tr><td>Maintain a one-page contract / renewal / BAA tracker</td><td class="own">Cascades + ACG</td><td class="cost">none</td><td class="tgt">90 days, standing</td></tr>
+    </table>
+  </section>
+
+  <section class="area">
+    <div class="area__head"><span class="area__no">05</span><h2 class="area__title">Backup</h2></div>
+    <span class="lbl lbl--done">Done</span>
+    <ul class="done">
+      <li><b>The server is backed up.</b> The Synology NAS syncs its data to the server, and the server is backed up online (off-site) with daily incrementals, verified running.</li>
+      <li>Firewall and network configuration backed up.</li>
+    </ul>
+    <span class="lbl lbl--todo">To do</span>
+    <table class="todo">
+      <tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr>
+      <tr><td>Repurpose the Synology NAS as the onsite backup for the server (with off-site backup continuing)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">60–90 days</td></tr>
+      <tr><td>Run and document a test restore</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">90 days</td></tr>
+      <tr><td>Confirm and document the retention policy</td><td class="own">ACG</td><td class="cost">none</td><td class="tgt">60 days</td></tr>
+    </table>
+  </section>
+
+  <section class="area">
+    <div class="area__head"><span class="area__no">06</span><h2 class="area__title">Assistive technology (persons served)</h2></div>
+    <span class="lbl lbl--done">Done</span>
+    <ul class="done">
+      <li>Helpany "Paul" resident-safety sensors: ceiling radar fall and motion detection with <b>no camera and no microphone</b>, rolling out floor by floor.</li>
+      <li>Building-wide WiFi supporting resident and family connectivity.</li>
+    </ul>
+    <span class="lbl lbl--todo">To do</span>
+    <table class="todo">
+      <tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr>
+      <tr><td>Complete the Helpany rollout; move sensors to their own protected network segment</td><td class="own">Helpany + ACG</td><td class="cost">vendor + labor</td><td class="tgt">90 days</td></tr>
+      <tr><td>Inventory all resident-facing technology (nurse-call / pendants, assistive listening, resident WiFi for telehealth) into this plan</td><td class="own">Cascades + ACG</td><td class="cost">none</td><td class="tgt">next review</td></tr>
+    </table>
+  </section>
+
+  <section class="area">
+    <div class="area__head"><span class="area__no">07</span><h2 class="area__title">Disaster recovery &amp; continuity</h2></div>
+    <span class="lbl lbl--done">Done</span>
+    <ul class="done">
+      <li>Documented, proven power-outage procedure: scripted clean shutdown of core systems and <b>verified clean recovery</b> (exercised June 2026).</li>
+      <li>UPS battery backup installed on core equipment and all network switches; off-site backup running.</li>
+    </ul>
+    <span class="lbl lbl--todo">To do</span>
+    <table class="todo">
+      <tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr>
+      <tr><td>Write the formal disaster-recovery / business-continuity plan with recovery-time targets</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">90 days</td></tr>
+      <tr><td>Documented restore test (with area 5)</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">90 days</td></tr>
+      <tr><td>Server redundancy (pairs with the server refresh project)</td><td class="own">ACG + Cascades</td><td class="cost">project quote</td><td class="tgt">FY project</td></tr>
+    </table>
+  </section>
+
+  <section class="area">
+    <div class="area__head"><span class="area__no">08</span><h2 class="area__title">Virus &amp; threat protection</h2></div>
+    <span class="lbl lbl--done">Done</span>
+    <ul class="done">
+      <li>Managed endpoint detection &amp; response (EDR) on every managed device (about 35), <b>including the main server</b> (completed July 2026).</li>
+      <li>Microsoft Defender and Exchange Online Protection on email; managed monitoring and patching on all devices.</li>
+      <li>Legacy agents from the previous IT provider removed from the server.</li>
+    </ul>
+    <span class="lbl lbl--todo">To do</span>
+    <table class="todo">
+      <tr><th style="width:52%">Action</th><th>Owner</th><th>Cost</th><th>Target</th></tr>
+      <tr><td>Remove remaining legacy agents: DESKTOP-TRCIEJA (retires with its replacement) and DESKTOP-F94M8UT (powered off; completes on power-on); finish console cleanup</td><td class="own">ACG</td><td class="cost">labor</td><td class="tgt">30–60 days</td></tr>
+      <tr><td>Standing coverage audit: every device reporting into managed security</td><td class="own">ACG</td><td class="cost">none</td><td class="tgt">quarterly</td></tr>
+    </table>
+  </section>
+
+  <div class="band-label">Supplementary areas</div>
+
+  <section class="area supp">
+    <div class="area__head"><span class="area__no">+</span><h2 class="area__title">Communication technology</h2></div>
+    <p><b>Done:</b> voice system consolidated onto an isolated voice network (37 devices); WiFi optimized building-wide; email authentication enforced.</p>
+    <p><b>To do:</b> dedicated 5&nbsp;GHz network for phones and Helpany sensors (improves call reliability); replace the Bistro phone; voice quality-of-service; then the supervised move to next-generation WiFi (WPA3 / 6&nbsp;GHz). Owner: ACG + Vertical + Helpany; 90 days.</p>
+  </section>
+
+  <section class="area supp">
+    <div class="area__head"><span class="area__no">+</span><h2 class="area__title">Services purchased / contracted</h2></div>
+    <p>Managed IT (ACG, prepaid block), Microsoft 365, ALIS (Medtelligent), hosted voice (Vertical), dual-WAN internet (Cox), online backup, firewall &amp; network (Netgate / UniFi), managed security, resident safety sensors (Helpany), plus line-of-business software.</p>
+    <p><b>To do:</b> the renewal / BAA tracker (area 4) becomes the single register for all vendors.</p>
+  </section>
+
+  <section class="area supp">
+    <div class="area__head"><span class="area__no">+</span><h2 class="area__title">Use of AI</h2></div>
+    <p><b>To do:</b> adopt an AI acceptable-use policy for staff (30 days); evaluate Microsoft 365 Copilot under HIPAA guardrails; build the cross-system KPI dashboard (ALIS, QuickBooks, Bill.com, Relias, CRM, TELS, Focus HR) as the sanctioned analytics path: Phase 1 scheduled exports to SharePoint and Power BI, Phase 2 automated data feeds.</p>
+  </section>
+
+  <footer class="foot">
+    <div class="foot__note">
+      Cascades of Tucson's technology plan, prepared with Az Computer Guru. Reviewed at least
+      annually by Cascades leadership; updated as projects complete. Confidential to Cascades of Tucson.
+      Revision: initial draft, July 15, 2026.
+    </div>
+    <div class="foot__balance">
+      <div class="k">Prepaid support balance</div>
+      <div class="v">37.5 hrs</div>
+      <div class="k" style="margin-top:4px;letter-spacing:.1em;">as of Jul 10, 2026</div>
+    </div>
+  </footer>
+
+</div>
+</body>
+</html>
--- a/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.md
+++ b/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.md
@@ -0,0 +1,179 @@
+# Cascades of Tucson Technology Plan
+
+> A living action document: for each area, what has been done and what is planned.
+> Prepared with Az Computer Guru. Reviewed and updated at least annually.
+
+| Governance | |
+|---|---|
+| Plan owner | Cascades of Tucson |
+| Prepared with | Az Computer Guru (Mike Swanson, Howard Enos) |
+| Plan period | FY 2026–2027 |
+| Adopted by / date | *[at adoption]* |
+| Next annual review | *[adoption + 12 months]* |
+
+---
+
+## 1. Hardware
+
+**Done**
+- Full managed network deployed: UniFi with 77 access points and 12 managed switches;
+  business firewall with dual internet connections and automatic failover.
+- Server storage verified healthy; enterprise SSDs purchased for a planned upgrade.
+- Windows Pro upgrades completed on nearly all workstations for domain readiness.
+
+**To do**
+| Action | Owner | Cost | Target |
+|---|---|---|---|
+| Install the purchased enterprise SSDs (scheduled window) | ACG | already purchased | 30–60 days |
+| Replace workstations marked for replacement (list below, 5 + spare) | ACG | ~$700–950 ea | 60–90 days |
+| Scope and quote a server refresh project | ACG + Cascades | formal quote | 90 days |
+| Bring remaining switch ports up to full gigabit speed | ACG | labor | 90 days |
+
+**Workstations marked for replacement**
+| Machine | User / role | Plan |
+|---|---|---|
+| DESKTOP-TRCIEJA | Lupe Sanchez | **Replace** (end of life) |
+| ASSISTMAN-PC | Meredith Kuhn | **Replace** (2015-era processor, cannot run Windows 11) |
+| MDIRECTOR-PC | Shelby Trozzi (MC Director) | **Replace** (insufficient memory) |
+| MEMRECEPT-PC | Memory Care front desk | **Replace** (oldest machine in the fleet) |
+| Spare unit | New hire | **Deploy spare** |
+| CHEF-PC | Culinary | **Replace** |
+
+## 2. Software
+
+**Done**
+- Microsoft 365 Business Premium across the organization (45 seats enabled).
+- ALIS clinical record connected to company sign-in (single sign-on live).
+- Domain migration underway: about half of staff PCs on the company domain with
+  department structure and drive mapping built.
+
+**To do**
+| Action | Owner | Cost | Target |
+|---|---|---|---|
+| Right-size Microsoft 365 licensing: move users off the legacy license; full Office licenses only where needed, lighter licenses for everyone else | ACG | reduces monthly cost | 30 days |
+| Complete staff domain migration + department drives | ACG | labor | 60–90 days |
+| Final Windows Pro upgrade (1 deferred device) | ACG | ~$99 | next window |
+| Retire the per-PC Synology sync client as machines migrate | ACG | labor | with migration |
+
+## 3. Security (sensitive data / HIPAA)
+
+**Done**
+- MFA for all staff; identity-based conditional access live.
+- Caregiver accounts restricted to the building network (credentials unusable off-site),
+  live since 2026-07-01.
+- Auto-lock and auto-sign-out policy on shared care devices.
+- Segmented network: voice isolated, per-room isolation, resident devices separated.
+- Email authentication (SPF, DKIM, DMARC) enforced.
+
+**To do**
+| Action | Owner | Cost | Target |
+|---|---|---|---|
+| Create emergency break-glass admin accounts with hardware security keys | ACG | ~$110 keys | 30 days |
+| Enforce the caregiver device allow-list (final enforcement phase) | ACG | labor | 30–60 days, after break-glass |
+| Limit trusted-network sign-in to approved devices (next enforcement phase) | ACG | labor | 30–60 days |
+| Enable file-access audit logging with 90-day/6-year retention | ACG | ~$50–120/mo + build | 60–90 days |
+| Formalize a same-day offboarding checklist | Cascades HR + ACG | none | 30 days, then standing |
+| Package the dated security risk assessment | ACG | labor | 60 days |
+
+## 4. Confidentiality
+
+**Done**
+- PHI access limited by role and security group; single sign-on to the clinical record.
+- Shared care devices auto-lock; resident and voice traffic isolated on the network.
+
+**To do**
+| Action | Owner | Cost | Target |
+|---|---|---|---|
+| Complete the Business Associate Agreement inventory (every vendor touching PHI) | Cascades + ACG | none | 60 days |
+| Move ALIS fully to single sign-on (retire the separate native login) | ACG | labor | 60 days |
+| Enable encryption on the resident-data file share | ACG | labor | 60–90 days |
+| Maintain a one-page contract / renewal / BAA tracker | Cascades + ACG | none | 90 days, then standing |
+
+## 5. Backup
+
+**Done**
+- **The server is backed up.** The Synology NAS syncs its data to the server, and the
+  server is backed up online (off-site) with daily incrementals, verified running.
+- Firewall and network configuration backed up.
+
+**To do**
+| Action | Owner | Cost | Target |
+|---|---|---|---|
+| Repurpose the Synology NAS as the onsite backup for the server (with off-site backup continuing) | ACG | labor | 60–90 days |
+| Run and document a test restore | ACG | labor | 90 days |
+| Confirm and document the retention policy | ACG | none | 60 days |
+
+## 6. Assistive technology (persons served)
+
+**Done**
+- Helpany "Paul" resident-safety sensors: ceiling radar fall and motion detection with
+  **no camera and no microphone**, rolling out floor by floor.
+- Building-wide WiFi supporting resident and family connectivity.
+
+**To do**
+| Action | Owner | Cost | Target |
+|---|---|---|---|
+| Complete the Helpany rollout; move sensors to their own protected network segment | Helpany + ACG | vendor-billed + labor | 90 days |
+| Inventory all resident-facing technology (nurse-call/pendants, assistive listening, resident WiFi for telehealth) into this plan | Cascades + ACG | none | next review |
+
+## 7. Disaster recovery & continuity
+
+**Done**
+- Documented, proven power-outage procedure: scripted clean shutdown of core systems and
+  verified clean recovery (exercised June 2026).
+- UPS battery backup installed on core equipment and all network switches; off-site backup running.
+
+**To do**
+| Action | Owner | Cost | Target |
+|---|---|---|---|
+| Write the formal disaster-recovery / business-continuity plan with recovery-time targets | ACG | labor | 90 days |
+| Documented restore test (with area 5) | ACG | labor | 90 days |
+| Server redundancy (pairs with the server refresh project) | ACG + Cascades | project quote | FY project |
+
+## 8. Virus & threat protection
+
+**Done**
+- Managed endpoint detection & response (EDR) on every managed device (about 35),
+  **including the main server** (completed July 2026).
+- Microsoft Defender and Exchange Online Protection on email; managed monitoring and
+  patching on all devices.
+- Legacy agents from the previous IT provider removed from the server.
+
+**To do**
+| Action | Owner | Cost | Target |
+|---|---|---|---|
+| Remove remaining legacy agents: DESKTOP-TRCIEJA (retires with its replacement) and DESKTOP-F94M8UT (powered off; completes on power-on); finish console cleanup | ACG | labor | 30–60 days |
+| Standing coverage audit: every device reporting into managed security | ACG | none | quarterly |
+
+---
+
+## Supplementary areas
+
+### Communication technology
+**Done:** voice system consolidated onto an isolated voice network (37 devices); WiFi
+optimized building-wide; email authentication enforced.
+**To do:** dedicated 5 GHz network for phones and Helpany sensors (improves call
+reliability); replace the Bistro phone; voice quality-of-service; then the supervised
+move to next-generation WiFi (WPA3 / 6 GHz). Owner: ACG + Vertical + Helpany; 90 days.
+
+### Services purchased / contracted
+Managed IT (ACG, prepaid block), Microsoft 365, ALIS (Medtelligent), hosted voice
+(Vertical), dual-WAN internet (Cox), online backup, firewall & network (Netgate/UniFi),
+managed security/EDR, resident safety sensors (Helpany), plus line-of-business software.
+**To do:** the renewal/BAA tracker (area 4) becomes the single register for all vendors.
+
+### Use of AI
+**To do:** adopt an AI acceptable-use policy for staff (30 days); evaluate Microsoft 365
+Copilot under HIPAA guardrails; build the cross-system KPI dashboard (ALIS, QuickBooks,
+Bill.com, Relias, CRM, TELS, Focus HR) as the sanctioned analytics path: Phase 1
+scheduled exports to SharePoint and Power BI, Phase 2 automated data feeds.
+
+---
+
+## Review & maintenance
+
+Reviewed at least annually by Cascades leadership with ACG; updated as projects complete.
+
+| Revision | Date | By |
+|---|---|---|
+| Initial draft | 2026-07-15 | ACG (prepared for Cascades adoption) |
--- a/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.pdf
+++ b/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.pdf
--- a/clients/cascades-tucson/reports/2026-07-15-phish-investigation-amu54618.md
+++ b/clients/cascades-tucson/reports/2026-07-15-phish-investigation-amu54618.md
@@ -0,0 +1,70 @@
+# Phishing Investigation — "Past Due - AMU54618 - AMYSH Solutions"
+
+- **Date (UTC):** 2026-07-15
+- **Tenant:** cascadestucson.com (`207fa277-e9d8-4eb7-ada1-1064d2221498`)
+- **Reported by:** Chris Knight (via Mike/Howard)
+- **Investigated with:** ComputerGuru Security Investigator (Graph read + EXO read), read-only
+
+## The message
+
+| Field | Value |
+|---|---|
+| From | Dax Howard `<info@syufway.com>` |
+| Reply-To | `dax.howard@steqm.com` (mismatch — classic BEC indicator) |
+| To | `accounting@cascadestucson.com` (only recipient in tenant) |
+| Subject | Past Due - AMU54618 - AMYSH Solutions |
+| Delivered | 2026-07-14 17:32 UTC (10:32 AM AZ) |
+| Internet-Message-Id | `<NSCCVAyTgUFD3cMIwaf4nl5G1cSc5xC4W4Cr1Rrk0c@localhost>` |
+| Attachment | `W9_AMYSH_Solutions54618.pdf` (84 KB) |
+
+Two delivery attempts ~10s apart:
+1. **17:30:23 UTC — Quarantined** as **High Confidence Phish** (never released).
+2. **17:30:34 UTC — Delivered** to the Inbox (second copy evaded the filter).
+
+## Attachment analysis
+
+The PDF is a filled **IRS W-9** for "AMYSH Solutions", EIN 92-4058031, 75 E Santa
+Clara St, San Jose CA 95113, signed 04/11/2026. **No URLs, no QR code, no active
+content.** This is a vendor-impersonation / BEC setup: get the target to onboard
+a fake vendor and pay a fraudulent invoice. The email body claims to forward an
+invoice from "Skylar Green, Billing Coordinator, AMYSH Solutions".
+
+## Who opened it (MailItemsAccessed audit, delivered copy)
+
+Mailbox delegates with FullAccess: ashley.jensen, lauren.hasselman,
+zachary.nelson, Chris.Knight.
+
+| Time (UTC) | User | Client |
+|---|---|---|
+| 2026-07-14 17:32:06 | ashley.jensen@cascadestucson.com | Outlook Android |
+| 2026-07-14 17:33:30 | Chris.Knight@cascadestucson.com | Outlook desktop |
+| 2026-07-14 18:16:43 | ashley.jensen@cascadestucson.com | Outlook Android |
+| 2026-07-14 18:54:59 | Chris.Knight@cascadestucson.com | Outlook desktop |
+
+## Did anyone respond / act on it?
+
+- **No outbound mail** from the tenant to `info@syufway.com` or the reply-to
+  `dax.howard@steqm.com` (message trace 07-13 → 07-15). Nobody replied.
+- No link/click risk — the PDF contains no links.
+- Risk is limited to *future action*: paying the fake invoice or emailing the
+  reply-to address.
+
+## Verdict
+
+Confirmed phishing (vendor-fraud/BEC lure). Defender already classified the
+first copy as High Confidence Phish. Opened by Ashley Jensen and Chris Knight;
+no reply, no click, no payment action observed. **No compromise indicated.**
+
+## Remediation performed (2026-07-15, approved by Howard)
+
+1. [OK] Delivered copy moved to Deleted Items in the accounting mailbox
+   (recoverable if ever needed for evidence).
+2. [OK] `syufway.com` and `steqm.com` added to the Tenant Allow/Block List
+   (Sender block, no expiration) — future mail from either domain is blocked.
+3. Quarantined copy left in quarantine (High Confidence Phish, not released).
+
+## Remaining advice for client
+
+- Do not pay invoice AMU54618 or contact the sender.
+- Any real vendor banking/W-9 changes get phone verification on a known-good
+  number.
--- a/clients/cascades-tucson/session-logs/2026-07/2026-07-15-howard-technology-plan-final.md
+++ b/clients/cascades-tucson/session-logs/2026-07/2026-07-15-howard-technology-plan-final.md
@@ -0,0 +1,135 @@
+# Cascades of Tucson Technology Plan — built and finalized (client deliverable)
+
+## User
+- **User:** Howard Enos (howard)
+- **Machine:** Howard-Home
+- **Role:** tech
+
+## Session Summary
+
+Built the client-facing Technology Plan for Cascades of Tucson (FY 2026–2027), starting from
+the June 2026 CARF-oriented drafts and reconciling them against the wiki (current truth) via a
+delegated fact-check. Howard directed a plain, Done / To-do structure per area with an
+Action/Owner/Cost/Target table — no fluff, no negative framing of ACG, no CARF-intake blockers
+(governance fields left as *[at adoption]* placeholders).
+
+The plan covers the 8 core areas (Hardware, Software, Security/HIPAA, Confidentiality, Backup,
+Assistive technology, Disaster recovery, Virus & threat protection) plus supplementary areas
+(Communication technology, Services purchased, Use of AI) and a review/revision block. Rendered
+as a branded 3-page PDF via headless Chrome from a hand-built HTML using the ACG design tokens
+(paper/ink/orange palette, Barlow Condensed / Lexend / JetBrains Mono).
+
+Iterated to final on Howard's live corrections: backup section reworded to plain
+Synology-syncs-to-server + online off-site backup (no MSP360/license talk); all "outdated
+server" age references removed; offline switches recognized as by-design (wiki updated + errorlog
+correction); workstation replacement list expanded from hardware evidence in the March 2026
+fleet audit (workstations.md); server power-supply row dropped (unit just not connected);
+M365 licensing changed to a right-sizing item (not everyone needs full Office); Synology NAS
+repurpose-as-onsite-backup added to area 5; the two remaining legacy-agent machines named
+(DESKTOP-TRCIEJA, DESKTOP-F94M8UT); Ashley Jensen's name removed from the document entirely;
+CHEF-PC changed from rebuild to full replace (list now 5 + spare); UPS coverage moved to Done
+(installed on all switches) and the verify to-do removed. Howard confirmed the "scope and quote
+a server refresh project" row stays as written.
+
+Final deliverable: 3-page PDF, no Chrome header/footer, verified visually page-by-page. The
+.md (master content), .html (render source), and .pdf are in sync.
+
+## Key Decisions
+
+- Done / To-do per-area structure at Howard's request; positive professional tone, no
+  self-criticism of ACG, minimal prose.
+- Governance fields (adopted by/date, next review) intentionally left as *[at adoption]*
+  placeholders rather than blocking on CARF intake answers.
+- Workstation replacement list built strictly from the March 2026 hardware audit evidence
+  (Win11 CPU support, RAM, machine age) — no guessed machines.
+- Final replacement list (5 + spare): DESKTOP-TRCIEJA (Lupe Sanchez, EOL), ASSISTMAN-PC
+  (Meredith Kuhn, i5-6200U cannot run Win11), MDIRECTOR-PC (Shelby Trozzi, 3.9 GB RAM),
+  MEMRECEPT-PC (Pentium E5500, oldest in fleet), CHEF-PC (Culinary — Howard upgraded it from
+  rebuild to replace), plus spare deployed to a new hire.
+- M365: right-size licensing instead of consolidate-everyone-onto-Business-Premium — Howard:
+  not everyone needs the full Office license; framed as "reduces monthly cost".
+- Synology NAS will be repurposed as the server's ONSITE backup target (off-site online backup
+  continues) — added as a 60–90 day Backup to-do.
+- Server power supply is NOT a work item (likely just not connected) — removed.
+- UPS: installed on all switches — moved to Done in area 7; verify-coverage to-do removed.
+- No client staff names in the deliverable (Ashley Jensen removed; masthead now "Attn: Business
+  Office"). Note: replacement-list user names (Lupe/Meredith/Shelby) were kept — only Ashley's
+  was requested removed.
+- "Scope and quote a server refresh project" kept as-is after explaining it to Howard (it means
+  produce a formal quote within 90 days, not committed spend; pairs with area 7 server
+  redundancy).
+
+## Problems Encountered
+
+- Headless Chrome render intermittently no-ops on first invocation after taskkill (exit path
+  produces no PDF, or leaves the stale file untouched — caught once by identical byte size +
+  old timestamp). Fix: retry the same command; verify freshness by timestamp/byte-size change
+  before trusting the output.
+- First render in the earlier segment had Chrome's default header/footer — fixed with
+  `--no-pdf-header-footer` (kept in all subsequent renders).
+- PDF text-extraction check (zlib streams) found nothing — text is drawn with subset-encoded
+  glyphs; verification must be visual (Read the PDF) not grep-based.
+- `pdftoppm` not available on this machine — Read the PDF without the pages param instead.
+- Wiki article too large to Read directly (~70k tokens) — fact-check delegated to an Explore
+  agent with an itemized claim checklist.
+
+## Configuration Changes
+
+- [created/edited] `clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.md`
+  — master plan content (final).
+- [created/edited] `clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.html`
+  — branded render source (final, in sync with .md).
+- [created/rendered] `clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.pdf`
+  — 3-page deliverable, 400,341 bytes, rendered 2026-07-15 11:14.
+- [edited] `clients/cascades-tucson/docs/proposals/carf-technology-plan-intake.md` — backup
+  wording plain (Synology syncs to server, server backed up online); MSP360 removed.
+- [edited] `wiki/clients/cascades-tucson.md` — offline switches (Switch 4th Floor #2, USW Pro
+  Max 16) marked "offline by design — not an issue (Howard, 2026-07-15). Do not flag or
+  investigate."
+- [appended] `errorlog.md` — `--correction`: assumed offline UniFi switches were an issue;
+  correct is offline by design.
+
+## Credentials & Secrets
+
+None touched this session.
+
+## Infrastructure & Servers
+
+- CS-SERVER: EDR covered since 2026-07-13; Datto EDR is the endpoint standard (~35 agents).
+- Legacy-agent stragglers: DESKTOP-TRCIEJA (Bitdefender BD_ACTIVE; GravityZone console-only
+  uninstall; retires with its hardware replacement) and DESKTOP-F94M8UT (Alma Montt's old
+  machine, powered off; BD-aware EDR install queued, fires on power-on).
+- Network: UniFi 77 APs / 12 managed switches; pfSense dual-WAN (Cox); UPS now on all switches.
+- M365 tenant cascadestucson.com — Business Premium 45 seats enabled; licensing right-size
+  planned.
+
+## Commands & Outputs
+
+- PDF render (proven, flaky on first run — retry if no fresh file):
+  `"/c/Program Files/Google/Chrome/Application/chrome.exe" --headless --disable-gpu --no-sandbox
+  --no-pdf-header-footer --virtual-time-budget=8000 --print-to-pdf="<abs path>.pdf"
+  "file:///C:/claudetools/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.html"`
+- Page count: `py -c "import re;d=open('<pdf>','rb').read();print(max(int(m) for m in
+  re.findall(rb'/Count\s+(\d+)',d)))"` → 3.
+- Freshness check: compare byte size + mtime after render; identical size/old mtime = stale,
+  re-run.
+
+## Pending / Incomplete Tasks
+
+- Deliver the PDF to Cascades (Business Office) — Howard to send.
+- Borderline replacement candidates NOT added (offered, not confirmed): ACCT2-PC (i3-1005G1,
+  118 GB disk), LAPTOP-DRQ5L558 + LAPTOP-E0STJJE8 (Ryzen 3500U, 6 GB).
+- Governance placeholders (*[at adoption]*, adopted-by date, next annual review) to be filled
+  when Cascades formally adopts the plan.
+- Synology onsite-backup repurpose is now a committed plan item (60–90 days) — actual
+  implementation work not started.
+- Standing items from 7/14 session remain: Juan Andrade offboarding (7/16 PM), break-glass
+  accounts, audit logging build, BAA inventory.
+
+## Reference Information
+
+- Deliverable dir: `clients/cascades-tucson/docs/proposals/`
+- Fleet audit source: `clients/cascades-tucson/docs/workstations.md` (March 2026)
+- Remaining-work plan: `clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md`
+- Straggler pass log: `clients/cascades-tucson/session-logs/2026-06/2026-06-26-howard-edr-bd-straggler-9am-pass.md`
+- Prepaid balance shown in footer: 37.5 hrs as of 2026-07-10
--- a/clients/prairie-schooner/cutover-runbook.md
+++ b/clients/prairie-schooner/cutover-runbook.md
@@ -1,5 +1,23 @@
 # The Prairie Schooner — Cutover Runbook

+## AS-BUILT 2026-07-15 — NETWORK SWAP DONE [OK]
+
+Howard onsite 2026-07-15: SonicWall pulled, UDM Pro in as gateway (.1).
+Everything verified working onsite: workstations renewed onto same IPs, internet up,
+phones have dial tone/registration, QB opened against \\tps-server (old server) — the
+network move broke nothing.
+
+MYSTERY SOLVED onsite: the device previously inventoried as a "USG gateway" (.136,
+role unconfirmed) is actually a **UniFi USW-Lite-16-PoE switch** — there was never a
+separate USG. The switch was KEPT: adopted into the UDM Pro's console, uplinked to the
+Pro's LAN port; it PoE-powers the 3x Yealink phones. Chain:
+Cox modem -> UDM Pro (gw .1) -> USW-Lite-16-PoE -> endpoints/phones/NVR/servers.
+Workstation fixed IPs set in UniFi; Ad Block / DNS Shield / IDS-IPS confirmed OFF.
+
+Rollback window closed — SonicWall out of service.
+
+---
+
 REVISED 2026-07-14 evening (Howard's call): **decouple the two migrations.**
 Tomorrow morning = NETWORK SWAP ONLY (SonicWall/USG out, UDM Pro in). Nothing else
 changes — Q: keeps pointing at \\tps-server, QB keeps running off the OLD server.
--- a/clients/prairie-schooner/udm-dhcp-plan.md
+++ b/clients/prairie-schooner/udm-dhcp-plan.md
@@ -49,6 +49,15 @@ simplest is pool .140–.199 plus the reservations above; any layout is fine as
   adoption) — acceptable, no inbound services.
 6. Then resume the paused AD migration (FSMO, CA, QB DBSM, demote old DC).

+## As-built 2026-07-15
+
+- Swap completed and verified onsite (see cutover-runbook.md AS-BUILT section).
+- The device previously listed as the "USG" (.136) is actually a **UniFi USW-Lite-16-PoE**
+  switch — no separate USG ever existed. Kept in service: adopted into the Pro's console,
+  uplinked to the Pro's LAN port; PoE-powers the 3x Yealink phones. Give it a fixed IP
+  (Devices -> switch -> Settings -> Network) once its DHCP address is noted.
+- Workstation fixed IPs set in UniFi 2026-07-15; security toggles confirmed OFF.
+
 ## Open items

 - ~~Identify the 4 unknown LAN devices~~ DONE 2026-07-14: 3x Yealink desk phones