diff --git a/access-matrix.sh b/access-matrix.sh
index b780552..a36f40b 100644
--- a/access-matrix.sh
+++ b/access-matrix.sh
@@ -19,6 +19,7 @@ users_for() {
     *-proxmox-pbs)                   echo "root:no" ;;
     *-proxmox-mailgw*)               echo "root:no" ;;
     *-proxmox-backup*)               echo "root:no" ;;
+    tsys-ucs-*)                      echo "root:no" ;;
     ultix-streaming)                 echo "root:no" ;;
     stlpc-*)                         echo "root:labuser:no" ;;
     subopi*)                         echo "subodev:yes" ;;
diff --git a/bootstrap-all.sh b/bootstrap-all.sh
index 84d072b..ef54fd7 100644
--- a/bootstrap-all.sh
+++ b/bootstrap-all.sh
@@ -69,10 +69,11 @@ echo "========================================"
 echo "Summary: $ok done, $fail failed"
 [ -n "$faillist" ] && echo "Failed:$faillist"
 echo "========================================"
-echo "Still 2FA-blocked (need policy decision):"
-echo "  sectestbed-sandbox, tsys-ucs-01, tsys-ucs-02"
+echo "Blocked — need console work (separate tickets):"
+echo "  tsys-ucs-01, tsys-ucs-02 — remove 2FA first [#418]"
+echo "  stlpc-3dscanner — bring online + rename [#417]"
 echo "========================================"
-echo "Unknown user (not in bootstrap):"
-echo "  stlp-3dscanner (100.125.14.37) — need user clarification"
+echo "2FA by design (leave alone):"
+echo "  sectestbed-sandbox"
 echo "========================================"
 echo "Tell the agent to re-run access-matrix.sh to verify."