diff --git a/.claude/memory/MEMORY.md b/.claude/memory/MEMORY.md
index 78995cb..3fac9d9 100644
--- a/.claude/memory/MEMORY.md
+++ b/.claude/memory/MEMORY.md
@@ -73,6 +73,7 @@
 - [Mac gururmm setup pending](project_mac_gururmm_setup_pending.md) — ACTION REQUIRED: run `bash scripts/install-hooks.sh` in gururmm repo on Mikes-MacBook-Air before any RMM work
 
 ## Project
+- [GuruConnect v2 direction](project_guruconnect_v2_direction.md) — v2 re-architecture (SPEC-002, 2026-05-29): greenfield-salvage-cores, NATIVE-first (full key fidelity Win+R/Ctrl+Alt+Del + bidirectional file cut/paste/drag are Mike's headline must-haves; WebRTC fallback only), standalone-first + RMM contract, hardened single-tenant but tenancy-ready schema. Willing to scrap v1 entirely.
 - [Apple MDM + Developer certs (GuruRMM mobile)](project_apple_mdm_certs.md) — ACG holds both Apple Developer+signing and Apple MDM Push certs (acquired 2026-05-29) for SPEC-017 mobile support. MDM push cert RENEWS ANNUALLY on the same Apple ID or all enrolled iOS devices break. Capture Apple ID + expiry.
 - [Only RMM & GC are versionable products](project_versionable_products.md) — GuruRMM + GuruConnect are the only products with own repos/submodules; everything else stays in the claudetools monorepo. Split only for independent pipeline OR versioned external consumer.
 - [Quantum GoDaddy M365 tenant](project_quantum_godaddy_m365_tenant.md) — quantumwms.com parked in a GoDaddy-provisioned M365 tenant (id ddf3d2c9-b76c-40d9-a216-9f11a1a26f97, netorg18235235.onmicrosoft.com); blocks Pax8 migration until GoDaddy removed. Managed = no DNS takeover; need GoDaddy/GA access.
diff --git a/.claude/memory/project_guruconnect_v2_direction.md b/.claude/memory/project_guruconnect_v2_direction.md
new file mode 100644
index 0000000..f61f06d
--- /dev/null
+++ b/.claude/memory/project_guruconnect_v2_direction.md
@@ -0,0 +1,32 @@
+---
+name: project_guruconnect_v2_direction
+description: GuruConnect v2 modernization direction (Mike, 2026-05-29) — native-first full key fidelity + bidirectional file cut/paste/drag are the headline must-haves; WebRTC is fallback only
+metadata:
+  type: project
+---
+
+GuruConnect is being re-architected (v2) after the 2026-05-29 audit found 3 CRITICAL relay-plane
+auth holes. Direction set by Mike (product owner), captured in
+`projects/msp-tools/guru-connect/docs/specs/SPEC-002-v2-modernization-architecture.md`:
+
+- **Greenfield, salvage cores:** keep the proven Rust (DXGI/GDI capture, input injection, SAS
+  helper, prost codec, proto, Gitea-Actions CI) — rebuild relay/auth, session, viewer, dashboard,
+  deploy. Clean reset in-place (keep repo/history/issues), not a new repo.
+- **Native-first, NOT WebRTC.** Mike's favorite ScreenConnect features and explicit priorities:
+  (1) **keyboard hooks / full key fidelity** — Win+R, Ctrl+C/V, **Ctrl+Alt+Del** must work (browsers
+  structurally can't do these, which is why WebRTC is fallback/secondary only); (2) **bidirectional
+  file transfer via clipboard cut/paste AND drag-and-drop** from/to either guest or host. Both are
+  core differentiators, not deferred. Transport stays custom protobuf-over-WSS.
+- **Standalone-first + versioned `/api/integration/v1/` contract** with GuruRMM (ADR-001; the
+  `specs/native-remote-control/` work is the integration prior art).
+- **Hardened single-tenant now, multi-tenancy-READY schema** (nullable `tenant_id` everywhere) so
+  the RMM partner/client model switches on later with no migration rewrite.
+- Adopt GuruRMM principles: per-agent keys (Option 3, kill shared AGENT_API_KEY), no-TOML-for-
+  endpoints, living-roadmap = definition-of-done, full-stack features, true-integration/anti-Datto.
+
+**Why:** initial GC was built with a much older model; lots of debt. Mike is willing to scrap v1
+entirely for a considerably better product. **How to apply:** when building GC features, default to
+native full-fidelity behavior and ship each capability full-stack (proto+agent+server+viewer+
+dashboard+docs). File transfer needs delayed-render clipboard + a chunked engine; drag-out
+(remote→local) is the hard case, ships after drag-in. Re-spec keystone: [[project_versionable_products]].
+Open questions still pending Mike's answer: repo reset, H.264-vs-HEVC default, web transport, support-code format, v1 cutover.