diff --git a/PULSE_DATABASE_SKILL.md b/PULSE_DATABASE_SKILL.md
index cbad2a9..5bd9482 100644
--- a/PULSE_DATABASE_SKILL.md
+++ b/PULSE_DATABASE_SKILL.md
@@ -15,20 +15,23 @@
 
 | Domain | Key Tables | Approx Rows | Description |
 |---|---|---|---|
-| **Autotask PSA** | tickets, time_entries, companies, contacts, resources, configuration_items, contracts, projects, tasks, ticket_notes | 109K tickets, 154K time entries, 7K CIs | Service desk, billing, contracts, clients |
-| **Datto RMM** | datto_rmm_alerts, datto_rmm_devices, datto_rmm_sites | 4.3K alerts, 3.6K devices | Remote monitoring & management |
+| **Autotask PSA** | tickets, time_entries, companies, contacts, resources, configuration_items, contracts, projects, tasks, ticket_notes | 152K tickets, 155K time entries, 7K CIs | Service desk, billing, contracts, clients |
+| **Datto RMM** | datto_rmm_alerts, datto_rmm_devices, datto_rmm_sites | 20.7K alerts, 3.6K devices | Remote monitoring & management |
 | **SentinelOne** | s1_agents, s1_threats, s1_sites | 2.8K agents, 4.1K threats | Endpoint security |
 | **Veeam** | veeam_organizations, veeam_backup_jobs, veeam_backup_agents, veeam_alarms, veeam_protected_workloads, veeam_repositories, veeam_backup_servers | ~2.5K total | Backup & disaster recovery |
 | **IT Glue** | itg_organizations, itg_configurations, itg_passwords, itg_flexible_assets, itg_contacts, itg_documents, itg_expirations, itg_domains, itg_locations | 14.7K configs, 7.1K contacts | IT documentation |
-| **Microsoft 365** | graph_users, teams_meetings, teams_meeting_attendees, engagement_snapshots | 14.3K meetings | Teams meetings, activity reports |
+| **Microsoft 365** | graph_users, teams_meetings, teams_meeting_attendees, engagement_snapshots | 14.4K meetings | Teams meetings, activity reports |
 | **Zoom** | zoom_users, zoom_meetings, zoom_meeting_participants, zoom_calls | 2.8K calls, meetings | Zoom calls and meetings |
-| **Billing** | billing_items | 95K items | Invoice line items tied to tickets/projects/tasks |
+| **QuickBooks Online** | qbo_invoices, qbo_payments, qbo_deposits, qbo_transactions, qbo_reports | 6.9K invoices, 12.1K txns | Accounting — invoices, payments, deposits, financial reports |
+| **Zabbix NMS** | zabbix_events, zabbix_wan_hosts | 228 events, 75 hosts | Network monitoring — WAN hosts, alert events |
+| **Billing** | billing_items | 96K items | Invoice line items tied to tickets/projects/tasks |
+| **Authentication** | "user", session, account, verification, two_factor | 3 users | Better Auth — Entra ID SSO, RBAC, sessions |
 
 ---
 
 ## 1. Autotask PSA — Core Service Desk
 
-### tickets (~109K rows, 68 columns)
+### tickets (~152K rows, 68 columns)
 
 The central table. Each row is a service ticket.
 
@@ -79,7 +82,7 @@ The central table. Each row is a service ticket.
 | 5 | Alert | 29,885 |
 | NULL | Unclassified | 67,737 |
 
-### companies (~4K rows, 41 columns)
+### companies (~241 rows, 41 columns)
 
 Client/customer organizations.
 
@@ -141,7 +144,7 @@ Work logged against tickets, tasks, or projects.
 - `role_id` (bigint)
 - `is_deleted` (boolean)
 
-### ticket_notes (~30K rows, 14 columns)
+### ticket_notes (~41K rows, 14 columns)
 
 Notes/comments on tickets.
 
@@ -273,7 +276,7 @@ Major queues include:
 
 ## 3. Datto RMM
 
-### datto_rmm_alerts (~4.3K rows, 61 columns)
+### datto_rmm_alerts (~20.7K rows, 61 columns)
 
 - `id` (int PK), `uid` (text) — alert identifiers
 - `alert_category`, `alert_type`, `alert_message_en` — what triggered
@@ -454,7 +457,121 @@ Weekly/monthly aggregates of M365 activity per user.
 
 ---
 
-## 8. Common Join Patterns
+## 8. QuickBooks Online (Accounting)
+
+### qbo_invoices (~6.9K rows)
+
+- `id` (text PK) — QBO invoice ID
+- `doc_number` (text) — invoice number (e.g. "1042")
+- `txn_date` (date), `due_date` (date)
+- `customer_ref_id`, `customer_ref_name` — QBO customer
+- `total_amt` (numeric), `balance` (numeric) — amounts
+- `status` (text) — Paid, Overdue, etc.
+- `line_items` (jsonb) — invoice line detail
+- `linked_txns` (jsonb) — linked payments
+
+### qbo_payments (~4.5K rows)
+
+- `id` (text PK)
+- `txn_date` (date), `total_amt` (numeric)
+- `customer_ref_id`, `customer_ref_name`
+- `payment_method_ref` (text), `deposit_account_ref` (text)
+- `unapplied_amt` (numeric)
+- `linked_txns` (jsonb) — linked invoices
+
+### qbo_deposits (~1.8K rows)
+
+- `id` (text PK)
+- `txn_date` (date), `total_amt` (numeric)
+- `deposit_to_account_ref_id`, `deposit_to_account_ref_name`
+- `line_items` (jsonb)
+
+### qbo_transactions (~12.1K rows)
+
+General ledger transactions (expenses, bills, journal entries, etc.).
+
+- `id` (text), `txn_type` (text) — composite PK
+- `txn_date` (date), `doc_number` (text)
+- `entity_ref_id`, `entity_ref_name`, `entity_type` — vendor/customer
+- `account_ref_id`, `account_ref_name` — GL account
+- `total_amt` (numeric)
+- `line_items` (jsonb)
+
+**Transaction types:** Bill, BillPayment, Expense, JournalEntry, Transfer, VendorCredit, CreditMemo, SalesReceipt, Estimate, PurchaseOrder, etc.
+
+### qbo_reports (~36 rows)
+
+Periodic financial reports stored as JSON.
+
+- `id` (serial PK)
+- `report_type` (text) — ProfitAndLoss, BalanceSheet, CashFlow
+- `period_start` (date), `period_end` (date)
+- `report_data` (jsonb) — full QBO report payload
+- Unique on `(realm_id, report_type, period_start, period_end)`
+
+---
+
+## 9. Zabbix NMS
+
+### zabbix_wan_hosts (~75 rows)
+
+WAN monitoring hosts auto-synced from RMM site public IPs.
+
+- `host_id` (text) — Zabbix host ID
+- `host` (text) — hostname in Zabbix
+- `name` (text) — display name
+- `ip` (text) — WAN IP address
+- `status` (int) — 0=enabled, 1=disabled
+- `company_id` (bigint) — FK to `companies.id`
+- `rmm_site_id` (int) — FK to `datto_rmm_sites.id`
+
+### zabbix_events (~228 rows)
+
+Zabbix alert events.
+
+- `event_id` (text PK)
+- `host_id` (text), `host_name` (text)
+- `trigger_id` (text), `trigger_name` (text)
+- `severity` (int) — 0=Not classified, 1=Info, 2=Warning, 3=Average, 4=High, 5=Disaster
+- `value` (int) — 0=OK, 1=Problem
+- `clock` (timestamptz) — event time
+
+---
+
+## 10. Authentication (Better Auth + Entra ID)
+
+### "user" table (~3 rows)
+
+**Note:** Table name is `"user"` (quoted) — must be quoted in SQL.
+
+- `id` (text PK)
+- `name` (text), `email` (text UNIQUE)
+- `"emailVerified"` (boolean), `image` (text)
+- `role` (text) — `super-admin`, `admin`, `user`
+- `banned` (boolean), `"bannedReason"` (text), `"banExpires"` (timestamp)
+- `requires_setup` (boolean), `"twoFactorEnabled"` (boolean)
+- `"createdAt"`, `"updatedAt"` (timestamp)
+
+**Note:** Better Auth uses **camelCase** column names — must be double-quoted in raw SQL.
+
+### session
+
+- `id` (text PK), `"userId"` → `"user".id`
+- `token` (text UNIQUE), `"expiresAt"` (timestamp)
+- `"ipAddress"`, `"userAgent"` (text)
+
+### account
+
+OAuth provider links (Microsoft Entra ID).
+
+- `id` (text PK), `"userId"` → `"user".id`
+- `"providerId"` (text) — e.g. `microsoft`
+- `"accountId"` (text) — provider-specific user ID
+- `"accessToken"`, `"refreshToken"`, `"idToken"` (text)
+
+---
+
+## 11. Common Join Patterns
 
 ```sql
 -- Ticket with company, resource, and status label
@@ -499,11 +616,30 @@ FROM teams_meetings tm
 JOIN teams_meeting_attendees tma ON tma.meeting_id = tm.id
 LEFT JOIN companies c ON c.id = tma.matched_company_id
 WHERE tm.has_client_attendees = true;
+
+-- QBO: Revenue by month (from invoices)
+SELECT DATE_TRUNC('month', txn_date) AS month, 
+       SUM(total_amt) AS total_invoiced, COUNT(*) AS invoice_count
+FROM qbo_invoices
+GROUP BY 1 ORDER BY 1 DESC;
+
+-- QBO: Outstanding balances by customer
+SELECT customer_ref_name, SUM(balance) AS outstanding
+FROM qbo_invoices WHERE balance > 0
+GROUP BY 1 ORDER BY 2 DESC;
+
+-- Zabbix: Active WAN problems with company
+SELECT ze.host_name, ze.trigger_name, ze.severity, ze.clock,
+       c.company_name
+FROM zabbix_events ze
+JOIN zabbix_wan_hosts zwh ON zwh.host_id = ze.host_id
+LEFT JOIN companies c ON c.id = zwh.company_id
+WHERE ze.value = 1 ORDER BY ze.clock DESC;
 ```
 
 ---
 
-## 9. Important Notes
+## 12. Important Notes
 
 1. **Soft deletes:** Most Autotask tables have `is_deleted` (boolean) and `deleted_at`. Always add `WHERE is_deleted IS NOT TRUE` unless you want deleted records.
 
@@ -522,4 +658,4 @@ WHERE tm.has_client_attendees = true;
    - Zoom/Teams → Contacts: `matched_contact_id` / `matched_company_id` columns
    - Config Items → RMM: `configuration_items.reference_number` sometimes matches RMM device UIDs
 
-7. **Row counts** (as of March 2026): tickets 109K, time_entries 154K, billing_items 96K, ticket_notes 30K, teams_meetings 14K, itg_configurations 15K, configuration_items 7K, companies 4K, contacts 4.2K, datto_rmm_devices 3.6K, datto_rmm_alerts 4.3K, s1_agents 2.8K, s1_threats 4.1K, zoom_calls 2.8K.
+7. **Row counts** (as of March 2026): tickets 152K, time_entries 155K, billing_items 96K, ticket_notes 41K, teams_meetings 14.4K, itg_configurations 14.7K, configuration_items 7K, companies 241, contacts 4.2K, datto_rmm_devices 3.6K, datto_rmm_alerts 20.7K, s1_agents 2.8K, s1_threats 4.1K, zoom_calls 2.8K, qbo_invoices 6.9K, qbo_transactions 12.1K, qbo_payments 4.5K, qbo_deposits 1.8K, qbo_reports 36, zabbix_wan_hosts 75, zabbix_events 228.