diff --git a/.claude/memory/MEMORY.md b/.claude/memory/MEMORY.md
index 61d8462..fdb130e 100644
--- a/.claude/memory/MEMORY.md
+++ b/.claude/memory/MEMORY.md
@@ -128,5 +128,5 @@
 - [Autonomy scope](feedback_autonomy_scope.md) — confirm only for client-affecting actions; internal docs/wiki/ClaudeTools = act autonomously
 - [Check for client-slug fragmentation](feedback_client_slug_fragmentation.md) — Before concluding a client has no records, grep broadly (company/owner/initials/hostname/"Last, First") across clients/, wiki/, session-logs/, vault — one client gets split across slug variants (Wolkin was 4: wolkin/wolkin-law/rswolkin/robert-wolkin). Consolidate to one canonical slug; action prior logs' Pending items.
 - [RMM user_session = false SMB failures](feedback_rmm_user_session_smb_false_negative.md) — GuruRMM net use/net view/Add-Printer to a remote \HOST fail with error 67 / RPC 1702 (even with valid creds) because user_session is a WTS-impersonated non-interactive token that can't do authenticated SMB. The share/printer may work fine interactively. Treat RMM SMB results as "can't tell"; verify via ScreenConnect.
-- [Broken [[backlinks]] = write-me-later markers](feedback_broken_backlinks_are_writeme_markers.md) — A [[name]] with no matching file is an intentional "worth writing" marker, not breakage. Flesh the missing memory out from session history/logs and index it; never strip the link to silence the warning. memory-dream reports these as INFO candidates, not errors.
-- [gururmm session-logs are in a submodule](gururmm-session-logs-submodule-save.md) — save via the new box (.30); GURU-5070 cant push to gururmm Gitea
+- [Broken [[backlinks]] = write-me-later markers](feedback_broken_backlinks_are_writeme_markers.md) — A [[name]] with no matching file is an intentional "worth writing" marker, not breakage. Flesh the missing memory out from session history/logs and index it; never strip the link to silence the warning. memory-dream reports these as INFO candidates, not errors.
+- [gururmm session-logs are in a submodule](gururmm-session-logs-submodule-save.md) — commit in the submodule + `git push origin HEAD:main` (GURU-5070 CAN push over HTTP now); then advance the parent gitlink
diff --git a/.claude/memory/gururmm-session-logs-submodule-save.md b/.claude/memory/gururmm-session-logs-submodule-save.md
index 30ece0b..e68ecec 100644
--- a/.claude/memory/gururmm-session-logs-submodule-save.md
+++ b/.claude/memory/gururmm-session-logs-submodule-save.md
@@ -1,27 +1,37 @@
 ---
 name: gururmm-session-logs-submodule-save
-description: Saving gururmm session-logs/docs requires committing inside the guru-rmm git submodule and pushing from the new box (.30) — sync.sh doesn't commit submodule contents and GURU-5070 can't push to gururmm Gitea
+description: gururmm session-logs/docs live in the guru-rmm git submodule (not parent ClaudeTools); sync.sh won't commit submodule contents. GURU-5070 CAN push them directly over HTTP (Git Credential Manager) — `git push origin HEAD:main`; only the SSH path (git@…:2222) is blocked
 metadata:
   type: reference
 ---
 
-`projects/msp-tools/guru-rmm` is a **git submodule** (gururmm repo,
-`git@172.16.3.20:azcomputerguru/gururmm.git`, branch main). So gururmm session logs
-(`projects/msp-tools/guru-rmm/session-logs/...`) and docs (`docs/HOST_MIGRATION_RUNBOOK.md`,
-etc.) are tracked in the **submodule**, not the parent ClaudeTools repo.
+`projects/msp-tools/guru-rmm` is a **git submodule** (gururmm repo, branch main). So gururmm
+session logs (`projects/msp-tools/guru-rmm/session-logs/...`) and docs are tracked in the
+**submodule**, not the parent ClaudeTools repo.
 
 `/save` -> `sync.sh` commits/pushes the **parent** ClaudeTools repo only; it leaves submodule
-**gitlinks unstaged** (unless `--with-submodules`) and NEVER commits submodule *contents*. So a
-session log written under the submodule is left **uncommitted/untracked** by a normal `/save`.
+**gitlinks unstaged** and NEVER commits submodule *contents*. So a session log written under the
+submodule is left **uncommitted** by a normal `/save` — commit it inside the submodule yourself.
 
-**GURU-5070 cannot push to gururmm Gitea** (`ssh -p 2222 git@172.16.3.20` -> Permission denied;
-its key isn't authorized there). The **new box (.30 / .47)** CAN push (its `~/.ssh/id_ed25519` is
-authorized as `gururmm-build-server`).
+**GURU-5070 CAN push to gururmm directly (verified 2026-06-11).** The submodule's `origin` is the
+**HTTP** remote `http://172.16.3.20:3000/azcomputerguru/gururmm.git`, and **Git Credential Manager**
+has stored creds for that host (`git config credential.http://172.16.3.20:3000.provider generic`).
+So from GURU-5070, in the submodule: `git add ...`, `git commit`, then
+`GIT_TERMINAL_PROMPT=0 git push origin HEAD:refs/heads/main` (HEAD is usually **detached** on a
+submodule — push `HEAD:main`, not bare `main`). `git fetch origin` first to confirm a clean
+fast-forward (`git log --oneline origin/main..HEAD`). The old scp-to-new-box workaround is NO
+LONGER NEEDED.
 
-**To persist gururmm session logs/docs from GURU-5070:** scp the file(s) to the new box's
-checkout `/home/guru/gururmm/...` (it's on main with push access), `git add` them explicitly
-(avoid the build-artifact changelog cruft), commit + `git push origin main` from the new box.
-Then on GURU-5070 advance the submodule (`git -C <sub> fetch origin && stash -u && reset --hard
-origin/main && stash drop`), `git add` the gitlink in the parent, commit, and `sync.sh`. The
-GURU-5070 submodule checkout tends to sit **detached at a stale commit** (it lags the build
-host's auto-bump commits) — fetch first. See [[gururmm-physical-server-storage]].
+Only the **SSH** push path is blocked: `ssh -p 2222 git@172.16.3.20` -> Permission denied
+(GURU-5070's key isn't authorized; the new box .30/.47 uses `gururmm-build-server`). Use HTTP.
+
+**WARNING — pushing to gururmm main triggers the build webhook** (Pluto), which builds AGENTS and
+publishes a new `-latest`. The fleet auto-updates. Server changes are NOT auto-deployed (deliberate
+deploy). Order accordingly (agent-safe changes can ride the webhook; server/reaper/migration
+changes deploy separately).
+
+**After pushing:** advance the parent gitlink — `git -C <ClaudeTools> add projects/msp-tools/guru-rmm`,
+commit, push ClaudeTools. (Do this AFTER the submodule push so the gitlink references a commit that
+exists on the remote.) Also: a `sync.sh` run can `git checkout` the submodule back to the
+gitlink-pinned commit, detaching from fresh local commits — advance the gitlink promptly so they're
+pinned. See [[gururmm-physical-server-storage]].