diff --git a/WORKING.md b/WORKING.md
index af35be1..a6639a3 100644
--- a/WORKING.md
+++ b/WORKING.md
@@ -7,6 +7,5 @@ A commit is blocked while any task below remains unchecked.
 
 (all done — session complete)
 
-- [x] Add NON-NEGOTIABLE session-start check-for-understanding gate to AGENTS.md
-- [x] Run full end-to-end access validation (68/70 non-excluded at intended state)
-- [x] Update bootstrap-all.sh to target only remaining system (tsys-siem) [#403]
+- [x] Validate tsys-siem access (SSHOK + SUDOOK confirmed)
+- [x] Update bootstrap-all.sh: no remaining password-auth targets [#403]
diff --git a/bootstrap-all.sh b/bootstrap-all.sh
index ef0a277..ab9bdf0 100644
--- a/bootstrap-all.sh
+++ b/bootstrap-all.sh
@@ -45,28 +45,14 @@ run_with_su() {
   echo
 }
 
-# === REMAINING: localuser + sudo (password auth on, key not yet pushed) ===
-echo "### Remaining system: tsys-siem ###"
-echo
-run_with_sudo tsys-siem  100.72.35.113  localuser
-
-echo "========================================"
-echo "Done. Re-run access-matrix.sh to verify."
-echo "========================================"
-echo
-echo "CONSOLE-ONLY fallback — if tsys-siem rejects password auth"
-echo "(publickey-only sshd), log in at the physical console (as root,"
-echo "or localuser then sudo) and paste this ONE line:"
-echo
-cat <<'ONELINER'
-KEY='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIWms/uCXnjjo4KyxHBcYI2TDHe8OZ2wle6W/0hSRQLu reachableceo@ultix-streaming'; for u in root localuser subodev ultixfield; do getent passwd "$u">/dev/null||continue; H=$(getent passwd "$u"|cut -d: -f6); mkdir -p "$H/.ssh"; chmod 700 "$H/.ssh"; AK="$H/.ssh/authorized_keys"; touch "$AK"; chmod 600 "$AK"; grep -qF "$KEY" "$AK"||echo "$KEY">>"$AK"; chown -R "$u": "$H/.ssh"; done; for u in localuser subodev ultixfield; do getent passwd "$u">/dev/null&&[ -d /etc/sudoers.d ]&&{ echo "$u ALL=(ALL) NOPASSWD:ALL">/etc/sudoers.d/010-agent; chmod 440 /etc/sudoers.d/010-agent; }; done; echo DONE
-ONELINER
-echo
-echo "========================================"
-echo "Already bootstrapped (verified SUDOOK/root-ok via access-matrix):"
-echo "  devbox-cloudron, sectestbed-cloudron, subopi3, subopi-dev-3,"
-echo "  subopi-dev-4, ultix-field, pfvsvrpi (+ 60 others)"
-echo "========================================"
+# All password-auth-reachable systems have been bootstrapped.
+# Verified state (access-matrix.sh, 2026-08-10): 69/70 non-excluded systems
+# at intended access state. The only remaining NOKEY (stlp-3dscanner) is
+# deferred to [#417] and requires a rename + bring-online first — out of
+# scope here. Run `access-matrix.sh` to re-verify at any time.
+echo "All password-auth-reachable systems are bootstrapped."
+echo "Remaining gap: stlp-3dscanner (deferred to [#417])."
+echo "Run access-matrix.sh to re-verify."
 echo "Deferred (separate ticket):"
 echo "  stlp-3dscanner — rename + bring online first [#417]"
 echo "========================================"