diff --git a/scripts/decommission-windows-recovery-host/finish-elevated.ps1 b/scripts/decommission-windows-recovery-host/finish-elevated.ps1
index f9fd608..08fc1a4 100644
--- a/scripts/decommission-windows-recovery-host/finish-elevated.ps1
+++ b/scripts/decommission-windows-recovery-host/finish-elevated.ps1
@@ -18,28 +18,11 @@ if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdenti
 Import-Module WebAdministration
 
 # ---------- F1: orphan fix on VDS ----------
-Write-Host "`n=== F1. orphan-fix snolla@stostayer on VDS ===" -ForegroundColor Cyan
-# Get the VDS sa password from your normal terminal first:  pass show mssql-vds/sa-password
-# then paste it at the prompt (input hidden, not echoed).
-$saSecure = Read-Host "Paste VDS sa password" -AsSecureString
-$sa = [System.Net.NetworkCredential]::new('', $saSecure).Password
-if (-not $sa) { Write-Error "No sa password provided."; return }
-$saConn = "Data Source=mssql.kzntsv.site,1433;Initial Catalog=master;User ID=sa;Password=$sa;TrustServerCertificate=True;Encrypt=True"
-$cn = New-Object System.Data.SqlClient.SqlConnection $saConn; $cn.Open()
-$c = $cn.CreateCommand()
-$c.CommandText = @"
-USE stostayer;
-IF EXISTS (SELECT 1 FROM sys.database_principals WHERE name='snolla')
-  ALTER USER snolla WITH LOGIN = snolla;
-ELSE BEGIN
-  CREATE USER snolla FOR LOGIN snolla;
-  ALTER ROLE db_owner ADD MEMBER snolla;
-END
-"@
-[void]$c.ExecuteNonQuery(); $cn.Close()
-Write-Host "  orphan-fix applied" -ForegroundColor Green
+# ALREADY DONE 2026-06-08 (agent fixed snolla@stostayer orphan via sa; verified mapped).
+# This script only needs the elevated IIS/web.config/docker steps. No password needed.
 
-# verify snolla can open stostayer
+# pre-gate: verify snolla can open VDS stostayer before we touch anything
+Write-Host "`n=== pre-check: snolla -> VDS stostayer ===" -ForegroundColor Cyan
 $wcPath = "C:\sites\stostayer.old\web.config"
 $src = ([xml](Get-Content $wcPath)).configuration.connectionStrings.add.connectionString
 $verify = ($src -replace '(?i)Data Source=localhost(,1433)?','Data Source=mssql.kzntsv.site,1433')