diff --git a/wiki/clients/goldstein.md b/wiki/clients/goldstein.md
index a2c1072f..fee2e404 100644
--- a/wiki/clients/goldstein.md
+++ b/wiki/clients/goldstein.md
@@ -8,6 +8,7 @@ sources:
   - clients/goldstein/session-logs/2026-07/2026-07-06-howard-dallas-rmm-onboard.md
   - clients/goldstein/session-logs/2026-07/2026-07-07-howard-dallas-rdp-pro-upgrade.md
   - clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.md
+  - clients/goldstein/session-logs/2026-07/2026-07-10-howard-openvpn-remote-access-sitemagic.md
   - Live UniFi Site Manager + GuruRMM investigation 2026-07-10 (tickets #32490, #32384)
 backlinks: []
 ---
@@ -132,12 +133,18 @@ part of the move to OpenVPN.
   or after a reboot until the service is started.
 - **No backup agent** detected on DALLAS (2026-07-06) — confirm cloud/local backup need.
 
-## Active Work (2026-07-10, ticket #32384 "Remote - Issues with remote access")
+## Active Work
+*No open tickets in Syncro as of 2026-07-10 (#32384 "Remote - Issues with remote access" is
+Resolved/invoiced). Break-fix, no prepaid block. Follow-ups below are open work, not Syncro tickets.*
+
 - **DALLAS offsite RDP via OpenVPN: DONE** — ASUS-2024 → Dallas profile → RDP DALLAS works.
-- **DalRes10:** knocked **offline** by its machine-level WireGuard tunnel; recovery needs someone
-  to **Deactivate WireGuard at its console** (onsite ~4pm 2026-07-10). Then: disable that tunnel
-  service, import the **Tucson** OpenVPN profile on ASUS, test RDP.
-- OpenVPN 2.6.14 installed on ASUS-2024; Teleport disabled on Tucson UCG.
+- **DalRes10: back online** (WireGuard deactivated onsite 2026-07-10). Howard removing WireGuard;
+  then set its **TermService → Automatic** (RDP survives reboot).
+- **Import the Tucson OpenVPN profile on ASUS-2024** (`98.225.73.165`, split-tunnel) so Michelle can
+  RDP DalRes10 offsite — Dallas profile → DALLAS, Tucson profile → DalRes10.
+- OpenVPN 2.6.14 installed on ASUS-2024; Defender re-enabled with OpenVPN-folder exclusions;
+  Teleport disabled on Tucson UCG.
+- **Billing:** OpenVPN remote-access work (2026-07-10) not yet billed — confirm with Mike.
 
 ## History Highlights
 - **2026-07-10** — Stood up OpenVPN remote access (both UCGs, RADIUS, users Michelle/Sheldon);
diff --git a/wiki/index.md b/wiki/index.md
index df0eb424..0050fe17 100644
--- a/wiki/index.md
+++ b/wiki/index.md
@@ -30,7 +30,7 @@ Run `/wiki-lint` to check for stale entries and broken backlinks.
 | [CryoWeave](clients/cryoweave.md) | Custom cryogenic cable assemblies; cPanel on IX; website redesign + SEO project in progress; Syncro ID not documented | 2026-05-24 |
 | [Darrell Delphen](clients/darrell-delphen.md) | Break-fix residential (Yantis, TX); single Windows workstation DDDOffice072023 (GuruRMM); 2026-06-18 Outlook email links failing = ISP-managed Extreme EXOS gateway "NetIQ" SNI-filtering of Intermedia's url.emailprotection.link rewriter (WARP interim bypass, ISP disabled the feature for permanent fix); Syncro #35996725 | 2026-06-18 |
 | [Glaz-Tech Industries](clients/glaztech.md) | ~200 users, 9 locations; prepaid ~22.25 hrs; web server WWW (192.168.8.72 / 65.113.52.88) — IIS 10/VB.NET e-commerce; CRITICAL security posture: website connects to GTI-INV-SQL as sysadmin (login `tom`, named SQL login, C0 top finding) + plaintext PANs+CVV (stored by GTIware PSA, not website) + plaintext passwords + SQLi via `quo()` + XSS; apex 404 fixed + payment TLS fixed 2026-06-03; intrusion/brute-force log review 2026-06-04 (no attacker found; H5 detection blind spot confirmed — HTTP 200 on both success/failure + no failed-login logging); #32378 Waiting on Customer (assessment + reports + Appendix A delivered); M365 no MFA; SCL bypass rules for vendor DMARC + MailProtector digests | 2026-06-04 |
-| [Goldstein (Sheldon Goldstein)](clients/goldstein.md) | Law firm (lawyersdallas.com), break-fix/T&M; two locations — Dallas TX (Michelle) + Tucson/Armory Park (Sheldon); GuruRMM client with Dallas (SILVER-PEAK-3739) + Tucson (RED-LION-9255) sites; **DALLAS upgraded Home→Win11 Pro for Workstations + RDP enabled for Tucson over the S2S VPN (2026-07-07, #32490 invoiced $150)**; onboarded 2026-07-06 (ScreenConnect + GuruRMM, diag AMBER, no backup agent); cust 25307933 | 2026-07-07 |
+| [Goldstein (Sheldon Goldstein)](clients/goldstein.md) | Law firm (lawyersdallas.com), break-fix/T&M; two locations — Dallas TX (Michelle) + Tucson/Armory Park (Sheldon); GuruRMM client with Dallas (SILVER-PEAK-3739) + Tucson (RED-LION-9255) sites; **DALLAS upgraded Home→Win11 Pro for Workstations + RDP enabled for Tucson over the S2S VPN (2026-07-07, #32490 invoiced $150)**; onboarded 2026-07-06 (ScreenConnect + GuruRMM, diag AMBER, no backup agent); cust 25307933 | 2026-07-10 |
 | [Grabb & Durando Law Office](clients/grabb-durando.md) | Personal injury law firm; GND-SERVER GuruRMM enrolled; AI demand review app scoped ($4K–$7K); website migration pending; plaintext DB password in README needs vaulting | 2026-05-24 |
 | [Pavon](clients/pavon.md) | Former/archive client; GeoVision NVR surveillance; OwnCloud at 172.16.3.22 backed by Uranus; cron stacking fixed; Nextcloud migration deferred 3–6 months | 2026-05-24 |
 | [Rieusset Corp (Tom Sorensen)](clients/rieusset-corp.md) | Small business; email hosted on Neptune Exchange (4 mailboxes: tsorensen, tomrc, ojodeagua, csorensen @rieussetcorp.com); Mailprotector domain ID 57833; outbound via SBR Outbound.Sorensen connector; clipto.com allow rule added 2026-06-08 | 2026-06-08 |