# Error Log

Brief records of preventable, pattern-worthy events across the fleet — used to improve
skills, write better CLAUDE.md rules, and clean stale/misleading memory. The aim: never
pay tokens twice for the same avoidable mistake. Append newest at the top; keep entries to
1-2 lines. **Always write via the helper, never by hand:**
`bash .claude/scripts/log-skill-error.sh "<skill/context>" "<brief>" [--correction|--friction] [--context "k=v"]`

Format: `YYYY-MM-DD | MACHINE | command/skill/context | [type] error (brief) [ctx: ...]`
A trailing ` (xN)` is the helper's repeat counter: the same entry logged N times that
day (identical machine+skill+message collapse to one line instead of N duplicates).

Categories (the `[type]` tag): _(none)_ = skill/command execution failure ·
`[correction]` = user corrected an improper assumption I made ·
`[friction]` = preventable self-inflicted token-waste (harness/env/tool misuse; cite a
`ref=` in ctx when it repeats a documented gotcha — that flags a rule/memory to strengthen).

---

<!-- Append entries below this line -->

2026-07-14 | GURU-BEAST-ROG | bash/ssh-tooling | [friction] plink.exe hangs indefinitely in headless bot bash env (both hostkey and password prompts read from console, echo y| insufficient); OpenSSH BatchMode fails fast but no password support. Fix that worked: paramiko (py) for password + keyboard-interactive SSH, incl. jump via direct-tcpip channel [ctx: host=BEAST target=dataforth-pbx/udm]

2026-07-14 | Howard-Home | packetdial/nimbus-qr | [correction] user asked a question (can I keep my extension); I treated it as authorization and sent welcome emails without confirming — questions are not action approval; outward actions need explicit per-action confirm

2026-07-14 | Howard-Home | packetdial/nimbus-qr | [correction] assumed user was Mike (ext 3003) from session userEmail; correct is Howard per identity.json — Howard has no extension on arizonacomputerguru and needs one created

2026-07-14 | Howard-Home | msp360 | Licenses Grant/Release blocked: 'Licensing API methods are not enabled for your account' (HTTP 400); also release-license cmd omits required LicenseID field [ctx: task=fix expired VWP-FILES license]

2026-07-14 | Howard-Home | msp360 | POST /api/Licenses/Release -> HTTP 400: {'Message': 'Licensing API methods are not enabled for your account'} [ctx: command=raw]

2026-07-14 | Howard-Home | msp360 | POST /api/Licenses/Grant -> HTTP 400: {'Message': 'Licensing API methods are not enabled for your account'} [ctx: command=grant-license]

2026-07-14 | Howard-Home | msp360 | POST /api/Licenses/Release -> HTTP 400: {'Message': 'The request is invalid.', 'ModelState': {'releaseLicense.LicenseID': ['The LicenseID field is required.']}} [ctx: command=release-license] (x2)

2026-07-14 | Howard-Home | ampipit-build/agents | [friction] parallel coding agent ran 'git checkout --' mid-run and wiped sibling agents' uncommitted changes; one sibling re-applied, another (pipeline.rs/collect_logs.rs) lost silently. Fix: isolate parallel coding agents via worktrees or forbid destructive git in shared-tree prompts [ctx: project=ampipit]

2026-07-14 | Howard-Home | roadmap-triage | [correction] assumed Howard would take BUG-026/next big items; correct is BUG-026 is Mike's work

2026-07-13 | Howard-Home | bash/env | [friction] local Windows Defender killed /mingw64/bin/curl (Permission denied) mid-session on HOWARD-HOME; user disabled Defender to continue - RMM dispatch loop needs curl; consider Defender exclusion for Git-for-Windows mingw64 bin

2026-07-13 | Howard-Home | mailbox/link-extraction | picked wrong INKY-wrapped link from Anthropic sign-in email - selected the url8792.mail.anthropic.com tracker (the Contact Support link, lands on support.claude.com) instead of the domain=claude.ai magic link; fix = decode ALL inky blobs and select the claude.ai/magic-link URL [ctx: email=secure-link-login mailbox=mike@azcomputerguru.com]

2026-07-13 | Howard-Home | remediation-tool/get-token | [friction] vault_path not set in ~/.claude/identity.json on Howard-Home AGAIN - needed VAULT_ROOT_ENV=/d/vault inline (same as 7/2 session); fix identity.json or make get-token.sh resolve the repo-local identity.json [ctx: ref=2026-07-02 session log Problems Encountered]

2026-07-13 | Howard-Home | mailprotector | HTTP 404 POST https://emailservice.io/api/v1/users/find_by_address: "Not found" [ctx: cmd=find-user]

2026-07-13 | Howard-Home | packetdial | HTTP 404 GET https://pbx.packetdial.com/ns-api/v2/domains/farwestdrilling: {"code":404,"message":"Not Found"} [ctx: cmd=domain]

2026-07-13 | Howard-Home | packetdial | HTTP 404 GET https://pbx.packetdial.com/ns-api/v2/domains/fw.91912.service: {"code":404,"message":"Not Found"} [ctx: cmd=domain]

2026-07-13 | Howard-Home | packetdial | HTTP 404 GET https://pbx.packetdial.com/ns-api/v2/domains/farwestwell: {"code":404,"message":"Not Found"} [ctx: cmd=domain]

2026-07-13 | Howard-Home | packetdial | HTTP 404 GET https://pbx.packetdial.com/ns-api/v2/domains/farwest.91912.service: {"code":404,"message":"Not Found"} [ctx: cmd=domain]

2026-07-13 | Howard-Home | packetdial | HTTP 404 GET https://pbx.packetdial.com/ns-api/v2/domains/farwest: {"code":404,"message":"Not Found"} [ctx: cmd=domain]

2026-07-13 | Howard-Home | syncro | GET /invoices/{id} immediately after POST /invoices returned partial line_items (10/17, 18/28h) - Syncro populates invoice lines from ticket charges asynchronously; re-GET seconds later showed all 17. Do not create a second invoice on a partial first read [ctx: ticket=32546 invoice=68040]

2026-07-13 | Howard-Home | packetdial | HTTP 404 GET https://pbx.packetdial.com/ns-api/v2/domains/rwd.91912.service: {"code":404,"message":"Not Found"} [ctx: cmd=domain]

2026-07-13 | Howard-Home | packetdial | HTTP 404 GET https://pbx.packetdial.com/ns-api/v2/domains/reliantwell: {"code":404,"message":"Not Found"} [ctx: cmd=domain]

2026-07-13 | Howard-Home | packetdial | HTTP 404 GET https://pbx.packetdial.com/ns-api/v2/domains/reliantpump: {"code":404,"message":"Not Found"} [ctx: cmd=domain]

2026-07-13 | Howard-Home | packetdial | HTTP 404 GET https://pbx.packetdial.com/ns-api/v2/domains/reliant.91912.service: {"code":404,"message":"Not Found"} [ctx: cmd=domain]

2026-07-13 | Howard-Home | packetdial | HTTP 404 GET https://pbx.packetdial.com/ns-api/v2/domains/reliant: {"code":404,"message":"Not Found"} [ctx: cmd=domain]

2026-07-10 | Howard-Home | syncro/email | [correction] assumed HTTP 200 {message:Email sent} meant the invoice/estimate actually reached the customer; correct is Syncro returns 200 even when customer.email is null (no recipient) - must verify a valid, UNIQUE customer.email before claiming delivery [ctx: customer=36118743 endpoints=POST_/invoices/{id}/email,/estimates/{id}/email]

2026-07-10 | Howard-Home | syncro/assets | [correction] assumed asset writes (POST/PUT create-update), policy_folder_id move, patches, and installed_applications were not doable via the public API; correct is the endpoints exist per the live OpenAPI spec and the prior 'policy_folder_id silently ignored' was a token missing the 'Assets - Policy Change' scope, not an API limitation [ctx: ref=reference-syncro-rmm-api-gui-only endpoint=PUT_/customer_assets/{id}]

2026-07-10 | GURU-BEAST-ROG | guruscan | detached full-chain wrapper died mid-RKill on TPM-PC (marker never written, task->Ready, rkill.log completed fine as orphan) — RKill's process sweep almost certainly killed its own hidden SYSTEM powershell parent; relaunched with -SkipScanners RKill [ctx: host=TPM-PC client=mineralogical-record chain-design-issue]

2026-07-10 | GURU-5070 | packetdial | HTTP 404 GET https://pbx.packetdial.com/ns-api/v2/domains/vwp.91912.service/users/100: {"code":404,"message":"Resource not found."} [ctx: cmd=user] (x2)

2026-07-10 | Howard-Home | unifi-wifi | [correction] hand-rolled raw curl against the Site Manager connector (reads AND a production write: disabled Teleport on Goldstein Tucson UCG) instead of using the unifi-wifi skill; correct approach = gw-sitemanager.sh for reads, and for VPN-server config the skill has no command (WIP) so flag it and use the UI / extend the skill rather than free-hand writes [ctx: skill=unifi-wifi gateway=CGU-Goldstein-Tucson]

2026-07-10 | Mikes-MacBook-Air | packetdial | HTTP 404 DELETE https://pbx.packetdial.com/ns-api/v2/domains/vwp.91912.service/users/105/devices/sip%3A105a%40vwp.91912.service: {"code":404,"message":"Device not found."} [ctx: cmd=raw]

2026-07-10 | Mikes-MacBook-Air | packetdial | HTTP 404 DELETE https://pbx.packetdial.com/ns-api/v2/domains/vwp.91912.service/users/105/devices: {"code":404,"message":"Device not found."} [ctx: cmd=raw]

2026-07-10 | Mikes-MacBook-Air | packetdial | HTTP 404 DELETE https://pbx.packetdial.com/ns-api/v2/domains/vwp.91912.service/users/105/devices/sip:105a@vwp.91912.service: {"code":404,"message":"Device not found."} [ctx: cmd=raw]

2026-07-10 | Mikes-MacBook-Air | packetdial | HTTP 404 DELETE https://pbx.packetdial.com/ns-api/v2/domains/vwp.91912.service/users/105/devices/105a: {"code":404,"message":"Device not found."} [ctx: cmd=delete-device]

2026-07-10 | Mikes-MacBook-Air | packetdial | HTTP 404 GET https://pbx.packetdial.com/ns-api/v2/device-models: {"code":404,"message":"No Route Found [92]"} [ctx: cmd=raw]

2026-07-10 | Mikes-MacBook-Air | packetdial | HTTP 404 PATCH https://pbx.packetdial.com/ns-api/v2/domains/vwp.91912.service/phones/805e0cdd71b1: {"code":404,"message":"No Route Found [92]"} [ctx: cmd=raw]

2026-07-10 | Mikes-MacBook-Air | packetdial | HTTP 404 PUT https://pbx.packetdial.com/ns-api/v2/domains/vwp.91912.service/phones/805e0cdd71b1: {"code":404,"message":"No Route Found [92]"} [ctx: cmd=raw]

2026-07-10 | Mikes-MacBook-Air | packetdial | HTTP 409 POST https://pbx.packetdial.com/ns-api/v2/domains/vwp.91912.service/phones: {"code":409,"message":"Mac already exists."} [ctx: cmd=create-phone]

2026-07-10 | Howard-Home | bash/env | [friction] [friction] now-phoenix.sh returned '20:23 PT' when real UTC was 19:43 (not a valid UTC-7 offset); did not trust it for a session-log timestamp - used UTC [ctx: ref=errorlog GURU-BEAST-ROG TZ entry same day]

2026-07-10 | Howard-Home | remediation-tool/intune | [correction] used detectedApps==0 as evidence Managed Home Screen had not installed; detectedApps is empty on ALL COSU devices incl. daily-syncing ones - only lastSyncDateTime + deviceConfigurationStates are trustworthy [ctx: client=cascades-tucson]

2026-07-10 | Howard-Home | remediation-tool/intune | [correction] read Graph freeStorageSpaceInBytes=0 + totalStorage=4.54GB as fact and told user the phone was out of storage and the wrong model; both fields are NOT collected for Android Enterprise dedicated devices (all 26 phones report 0) - verify a metric against a known-good device BEFORE reporting it as a finding [ctx: client=cascades-tucson device=CSC-R9TX70L693H]

2026-07-10 | Howard-Home | unifi-wifi/gw-sitemanager.sh | [friction] net <console> raw <path> truncates JSON at [:5000] chars, so /stat/sta output is unparseable for sites with >~10 clients; had to re-query api.ui.com directly with the vaulted key [ctx: script=gw-sitemanager.sh line=264 workaround=direct-curl]

2026-07-10 | Howard-Home | unifi-wifi/gw-sitemanager | Site Manager API call failed (HTTP 404) [ctx: path=/v1/connector/consoles/1C6A1B1BC2470000000008B8D1B50000000009302B160000000067A67E3A:1341833834/proxy/network/stat/sta]

2026-07-09 | GURU-BEAST-ROG | remediation-tool | reset-password.sh JIT cleanup failed: SP cannot remove its own PAA role assignment (Graph 400 self-removal block); required temp PRA grant to second SP to remove. Script should delegate cleanup to another SP or warn [ctx: tenant=sifoidak script=reset-password.sh]

2026-07-09 | GURU-BEAST-ROG | remediation-tool | reset-password: failed to remove JIT Privileged Auth Admin role - standing privilege left behind, REMOVE MANUALLY [ctx: tenant=568eb763-3b95-4271-8443-530c74b1c6bb assignment=ikzke6-tKk6E1qsmSeCKE7PwwTzAbMNNrIysDtlMU0E-1 http=400]

2026-07-09 | Howard-Home | bash/rmm-dispatch | [friction] UNC path SIF-SERVERprint$ collapsed to single-backslash inside a jq --arg PowerShell payload, producing a bogus 'path not found' that nearly read as a real diagnostic finding; use ps-encoded.sh for any payload containing UNC/backslashes [ctx: ref=feedback_windows_quote_stripping client=sif-oidak]

2026-07-09 | Howard-Home | bash/git | [friction] chained 'git push -q 2>&1 | tail -5 && echo [OK]' — the && tested tail's exit status, not git's, so a REJECTED push printed [OK]. Never pipe a command whose exit code you intend to test; capture output then check ${PIPESTATUS[0]} or run the command bare and test $?. [ctx: client=sif-oidak repo=vault]

2026-07-09 | Howard-Home | remediation-tool/get-token.sh | [friction] get-token.sh resolved identity.json from $HOME (/c/Users/Howard/.claude/identity.json) instead of the repo .claude/identity.json and died with 'vault_path not set'; fix is to export VAULT_ROOT_ENV=<vault_path> before calling, or make the script fall back to the repo identity [ctx: ref=vault-skill-gotchas client=sif-oidak]

2026-07-09 | Howard-Home | wiki-lint | [friction] command hardcodes 'cd D:/claudetools' but repo root is machine-specific (identity.json claudetools_root=C:/claudetools on HOWARD-HOME). Same path-drift family as remediation-tool scripts reading ~/.claude/identity.json instead of repo .claude/identity.json. Fix: resolve root from identity.json claudetools_root, never hardcode a drive letter. [ctx: ref=identity.json/claudetools_root machine=HOWARD-HOME]

2026-07-09 | Howard-Home | remediation-tool/consent-audit.sh | consent-audit graded tenant RED 'app NOT consented' for all 4 tiers, but the real cause was a local vault-path lookup failure (scripts read ~/.claude/identity.json; actual identity+vault_path live in repo .claude/identity.json -> D:/vault). Tenant was fully consented; token minted fine with VAULT_ROOT_ENV=D:/vault. Risk: would have sent a client an unnecessary admin-consent link. Fix: consent-audit should fail loud on vault-path error instead of reporting it as a consent gap. [ctx: tenant=cascadestucson.com machine=HOWARD-HOME]

2026-07-09 | GURU-BEAST-ROG | bash/env | [friction] reported wrong current time: Git Bash 'TZ=America/Phoenix date' silently ignored TZ and printed UTC mislabeled as AZ; use PowerShell Get-Date (or explicit UTC-7 math) on Windows for time reporting [ctx: thread=lens-auto-browser-hijack corrected_by=Winter]

2026-07-09 | Howard-Home | bash/env | [friction] used $UID as a variable in a Bash tool script; UID is readonly in bash so the assignment failed and the downstream Graph calls silently ran with an empty id - use a non-reserved name (OBJ/USER_ID)

2026-07-09 | Howard-Home | screenconnect/rmm-deploy | GuruRMM one-liner install did not complete on T&C Sorensen SERVER (Server 2016 Essentials) despite live SC guest; sent twice, no enrollment ~15min - needs WMI/TLS/PS-via-SC diagnosis [ctx: ref=SRV02/CP-QB legacy-server install pattern; session=08eaff71]

2026-07-09 | Howard-Home | save/sync.sh | [friction] session log written inside the guru-rmm submodule was NOT committed by /save (sync.sh only stages super-repo; git add -A does not commit files inside a submodule). Log sat untracked through two syncs. Fix: for project-scoped logs in a submodule, commit+push INSIDE the submodule, then 'sync.sh --with-submodules' to advance the pointer. [ctx: project=guru-rmm ref=save-command]

2026-07-08 | Howard-Home | screenconnect/syncro | [correction] hand-rolled raw curl against ScreenConnect + Syncro APIs to look up machines/billing instead of using the /screenconnect (sc.py), /syncro, and /rmm-search skills [ctx: ref=CLAUDE.md skill-first]

2026-07-08 | GURU-5070 | remediation-tool | onboard-tenant: failed to acquire Tenant Admin token [ctx: tenant=44705a37-b5d8-4bb1-882d-e18775612ada exit=3]

2026-07-08 | Howard-Home | screenconnect/rmm-enroll | GuruRMM install one-liner failed on 4PAWS-DOC: Get-CimInstance Win32_Processor -> 'No more threads can be created in the system' HRESULT 0x800700a4 (ERROR_MAX_THRDS_REACHED, thread/handle exhaustion). Command delivery was fine; box is in degraded state. Fix: reboot the target, then re-run enroll. [ctx: host=4PAWS-DOC client=FourPaws line=30-Win32_Processor]

2026-07-08 | Howard-Home | rmm/ps-encoded.sh | [friction] iconv not found on HOWARD-HOME Git-Bash -> ps-encoded.sh fails 'encoding produced nothing'; fell back to jq --rawfile direct dispatch [ctx: ref=ps-encoded.sh]

2026-07-08 | Howard-Home | ps-encoded | encode produced empty output [ctx: src=C:UsersHowardAppDataLocalTempclaudeC--claudetools�88c32-7d31-4efa-b061-8d4521258192scratchpadcheck-sqlmem.ps1]

2026-07-08 | Howard-Home | bash/background-task | [friction] added shell '& ... disown' on top of run_in_background:true -> shell forks the long-running wait and exits 0 immediately, orphaning it; the blocking read never notifies. Twice this session. Fix: with run_in_background:true, run the command in the FOREGROUND of that shell (no trailing &, no disown) - the harness does the backgrounding. [ctx: ref=discord ask-forum.sh --wait]

2026-07-08 | Howard-Home | rmm/deploy-beast | [friction] cannot git-fetch Gitea submodule as SYSTEM via RMM: credential.helper=manager (GCM) fails with 'Must specify at least one OAuthAuthenticationModes' when no guru desktop session is logged on; new commit not fetchable, so remote SYSTEM deploy of the discord-bot is blocked. Restart-Service works as SYSTEM, but pull must run in guru context (interactive /sync on BEAST) first. [ctx: host=GURU-BEAST-ROG repo=acg-discord-bot]

2026-07-08 | Howard-Home | syncro/assets | [correction] assumed 'retire in Syncro' meant DELETE /customer_assets; correct is Syncro's Archive feature (UI-only, no API) and never delete — delete loses history + breaks ticket links [ctx: client=IMC ref=syncro.md#customer-assets]

2026-07-08 | Mikes-MacBook-Air | session-start-protocol | [friction] failed to read identity.json at session start despite existing rule (CLAUDE.md:10-11) and existing memory (feedback_attribution_from_identity.md) - this is a REPEAT violation of documented protocol [ctx: ref=CLAUDE.md:10-11+feedback_attribution_from_identity,pattern=recurring-despite-docs]

2026-07-08 | Mikes-MacBook-Air | session-start-protocol | [friction] failed to read identity.json at session start and greet by name (CLAUDE.md line 10-11) - led to incorrect Howard attribution when it was Mike's machine; only caught identity after user corrected the bot alert [ctx: ref=CLAUDE.md:10-11,rule=At-session-start-read-identity-and-greet]

2026-07-08 | Mikes-MacBook-Air | identity-resolution | [correction] incorrectly referred to Howard when identity.json shows user=mike/full_name=Mike Swanson on this machine - posted bot alert attributing deployment to Howard before correction [ctx: machine=Mikes-MacBook-Air,session-start-read-identity=should-have-caught]

2026-07-08 | Mikes-MacBook-Air | screenconnect/rmm-deployment | [correction] assumed /install/{code} was MSI download; correct URL is /install/{code}/download/msi - the base URL returns HTML landing page [ctx: ref=glaztech-rmm-deployment,impact=199-silent-failures]

2026-07-08 | Mikes-MacBook-Air | screenconnect | [correction] PowerShell commands sent without #!ps prefix - executed as cmd.exe and failed silently [ctx: fix=prefix all PS with #!ps newline]

2026-07-08 | Mikes-MacBook-Air | screenconnect | Cannot load API secret from vault (exit 128): Failed to get the data key required to decrypt the SOPS file. Group 0: FAILED age1qz7ct84m50u06h97artqddkj3c8se2yu4nxu59clq8rhj945jc0s5excpr: FAILED - | failed to create reader for decrypting sops data key with | age: identity did not match any of the recipients: incorrect | identity for recipient block. Did not find keys in locations | 'SOPS_AGE_SSH_PRIVATE_KEY_FILE', | 'SOPS_AGE_SSH_PRIVATE_KEY_CMD', | '/Users/azcomputerguru/.ssh/id_rsa', 'SOPS_AGE_KEY', | 'SOPS_AGE_KEY_FILE', and 'SOPS_AGE_KEY_CMD'. Recovery failed because no master key was able to decrypt the file. In order for SOPS to recover the file, at least one key has to be successful, but none were. [ctx: cmd=set-properties] (x106)

2026-07-08 | Mikes-MacBook-Air | screenconnect | Cannot load API secret from vault (exit 128): Failed to get the data key required to decrypt the SOPS file. Group 0: FAILED age1qz7ct84m50u06h97artqddkj3c8se2yu4nxu59clq8rhj945jc0s5excpr: FAILED - | failed to load age identities. Errors while loading age | identities: $HOME is not defined; user config directory | could not be determined: $HOME is not defined. Did not find | keys in locations 'SOPS_AGE_SSH_PRIVATE_KEY_FILE', | 'SOPS_AGE_SSH_PRIVATE_KEY_CMD', 'SOPS_AGE_KEY', | 'SOPS_AGE_KEY_FILE', and 'SOPS_AGE_KEY_CMD'. Recovery failed because no master key was able to decrypt the file. In order for SOPS to recover the file, at least one key has to be successful, but none were. [ctx: cmd=set-properties] (x106)

2026-07-08 | Mikes-MacBook-Air | screenconnect | Cannot load API secret from vault (exit 127): /Users/azcomputerguru/vault/scripts/vault.sh: line 115: sops: command not found [ctx: cmd=set-properties] (x106)


2026-07-07 | Howard-Home | ps-encoded | encode produced empty output [ctx: src=scratch-recon.ps1] (x2)

2026-07-07 | Howard-Home | windows/scheduled-task | [friction] EDR Isolation Watcher task launched bash.exe directly (Hidden=False, every 10min) -> console window flashed on desktop; recurring class also hit GPS-RMM-Progress today. FIX: wscript VBS wrapper (style 0) for bash, pythonw+-Hidden for python; fixed both installers [ctx: ref=feedback_scheduled_task_no_console_flash host=Howard-Home task='ClaudeTools - EDR Isolation Watcher']

2026-07-07 | Howard-Home | datto-edr | Datto EDR request failed: <urlopen error [WinError 10060] A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond> [ctx: cmd=detections]

2026-07-07 | Howard-Home | ps-encoded | encode produced empty output [ctx: src=/c/Users/Howard/AppData/Local/Temp/claude/C--claudetools/23870231-fa32-4370-8531-14f3aa498add/scratchpad/fourpaws-localadmin-blank.ps1]

2026-07-07 | GURU-BEAST-ROG | syncro | add_line_item and update_line_item both ignored user_id override - line item attributed to API key owner (1735) despite user_id 1750 in payload; needed GUI fix [ctx: ticket=32509 line=43169157]

2026-07-07 | Howard-Home | datto-edr | [friction] SuppressionRules POST forces active=true and auto-creates an EMPTY match-everything version; two-step create (rule then version) briefly went live matching all. Neutralized via DELETE. FIX: create atomically with metadata embedded, or use console. [ctx: tenant=azcomp4587 rule=7c36b89f impact=~2min-possible-oversuppression]

2026-07-07 | Howard-Home | datto-edr | Datto EDR HTTP 400: {"error":{"statusCode":400,"name":"SyntaxError","message":""undefined" is not valid JSON"}} [ctx: cmd=raw] (x2)

2026-07-07 | GURU-5070 | bash/env | [friction] appended a scratch write to /tmp/_vwpinv inside the syncro invoice block; PreToolUse block-tmp-path hook blocked the ENTIRE Bash call so no invoice ran - had to re-run. Never write scratch to /tmp on Windows; use a repo-relative path or skip it [ctx: ref=feedback_tmp_path_windows]

2026-07-07 | GURU-5070 | troubleshooting/assumption | [correction] repeatedly asserted Datto EDR was not cleanly uninstalled and pushed reinstall-to-uninstall; user had already removed it via its own uninstaller. A persistent WFP block filter can survive a clean uninstall (vendor bug) - frame it that way, don't blame the operator's removal

2026-07-07 | GURU-5070 | approach/complexity | [correction] escalated straight to plink/vault/host-key pinning to query UDM DNS; simplest solution was a single nslookup against the UDM [ctx: ref=feedback_simplest_solution_first]

2026-07-07 | GURU-BEAST-ROG | rmm/ilo-redfish | [friction] embedded double-quotes in curl.exe -d JSON body stripped by PowerShell native arg passing (MalformedJSON from iLO); fix = write body to temp file via [char]34, --data-binary @file [ctx: ref=feedback_windows_quote_stripping]

2026-07-07 | Howard-Home | rmm/ps-encoded | [friction] ps-encoded.sh fails 'iconv: command not found' on HOWARD-HOME Git Bash -> encoded dispatch unavailable; fell back to inline jq --arg dispatch (safe for quote-free payloads) [ctx: ref=reference_windows_edition_upgrade_rmm host=HOWARD-HOME]

2026-07-07 | Howard-Home | ps-encoded | encode produced empty output [ctx: src=.claude/tmp/changepk_flip.ps1]

2026-07-07 | Howard-Home | rmm/windows-edition-upgrade | [correction] hand-rolled changepk Home->Pro instead of following reference_windows_edition_upgrade_rmm; changepk does NOT auto-reboot (flips edition live + sets RebootPending) so the long offline was the flaky RMM agent, not a reboot in progress - must trigger Restart-Computer -Force explicitly [ctx: host=DALLAS ref=reference_windows_edition_upgrade_rmm]

2026-07-06 | Howard-Home | ssh/gururmm-server | [friction] vault infrastructure/gururmm-server.sops.yaml lists username/password + 'Sudo password same as SSH', but 172.16.3.30 SSH is publickey-only (password auth disabled) and no fleet key authenticates guru/root/mike/howard from workstations. Watching build logs / running promote-dashboard.sh must be done on the box. Fix: add SSH pubkey to guru@.30 or correct the vault note. [ctx: ref=infrastructure/gururmm-server.sops.yaml host=172.16.3.30]

2026-07-06 | Howard-Home | gururmm-build/webhook | [friction] linux webhook build SKIPPED after merge: change-detector excludes agent/Cargo.toml, so a Cargo.toml-only agent change (BUG-024 rustls swap) never rebuilds; had to force build-linux.sh manually as root [ctx: commit=a73dcad ref=build-linux.sh:29]

2026-07-06 | GURU-5070 | remediation-tool/sharepoint | [correction] assumed SP REST app-only was blocked ('Unsupported app only token') and to use delegated/PnP; correct is the app suite has a CERT-based sharepoint tier — get-token.sh <tenant> sharepoint mints a cert token with Sites.FullControl.All. Secret is Graph/EXO only. [ctx: client=birth-biologic ref=reference_m365_app_sharepoint_rest_vs_graph]

2026-07-06 | GURU-5070 | wiki-compile | [correction] ran --full (Sonnet rebuild) for a routine post-work capture; plain /wiki-compile client:<slug> (update mode) is the fast incremental path for 'just did work, capture it' — reserve --full for structural drift/clean rebuilds

2026-07-06 | GURU-5070 | dev-alerts/visibility | [correction] did substantial RMM/Dev + live-client-machine work (Lonestar Unraid boot-config edits, service cycling, v0.6.77 deploy, promotions) WITHOUT firing #dev-alerts; Howard+Mike lost live visibility. Fire post-bot-alert.sh at the START of such work. [ctx: ref=feedback_fire_dev_alerts_for_client_work]

2026-07-06 | GURU-BEAST-ROG | remediation-tool | onboard-tenant: failed to acquire Tenant Admin token [ctx: tenant=5c53ae9f-7071-4248-b834-8685b646450f exit=3] (x2)

2026-07-06 | Howard-Home | vault/windows-pro-mak | [correction] assumed vault key labeled 'Windows Pro MAK' was plain Pro; correct is Pro FOR WORKSTATIONS MAK - slmgr /ipk auto-upgrades edition to ProfessionalWorkstation [ctx: host=ACG-Tech03L partial=HMJ4K]

2026-07-06 | Howard-Home | rmm/reboot | [friction] shutdown /r /t 15 /c "comment" failed exit1 (usage dump) - quotes around /c comment stripped by RMM->cmd.exe layer; drop the /c comment or PS-encode [ctx: ref=feedback_windows_quote_stripping host=ACG-Tech03L]

2026-07-06 | Howard-Home | ps-encoded | encode produced empty output [ctx: src=.rmm-key-probe.ps1] (x2)

2026-07-06 | ACG-TECH03L | self-check/migrate-identity | [friction] migrate-identity.sh detected architecture=amd64 on a Windows-on-ARM (arm64) machine; had to patch identity.json manually. arch probe likely uses emulated uname [ctx: host=ACG-TECH03L arch=arm64]

2026-07-06 | ACG-Tech03L | vault | vault_path not set in identity.json; vault read failed [ctx: path=/c/claudetools/.claude/identity.json]

2026-07-06 | ACG-Tech03L | vault | identity.json not found; vault read cannot resolve vault_path [ctx: path=/c/claudetools/.claude/identity.json] (x3)

2026-07-06 | DESKTOP-2U022SU | vault | identity.json not found; vault read cannot resolve vault_path [ctx: path=/c/claudetools/.claude/identity.json] (x4)


2026-07-06 | Howard-Home | owncloud/testing | [friction] ran gated 'versions-cleanup --all-users --confirm' in a smoke test believing it would not execute; it DID (gating worked as designed) and a detached server-side occ versions:cleanup ran ~3min before I killed it. Fix: never pass --confirm to destructive all-users ops in tests; use refusal-path (no --confirm) only [ctx: skill=owncloud host=172.16.3.22 impact=partial-version-history-loss-user-mara]

2026-07-06 | Howard-Home | bash/tmp-path | [friction] wrote git commit -F message to /tmp; blocked by block-tmp-path hook; used repo-relative ./.wsloop-commit.txt [ctx: ref=feedback_tmp_path_windows repo=gururmm]

2026-07-06 | Howard-Home | msp360 | GET /api/Computers/0/1000 -> HTTP 400: {'Message': 'Remote Management API methods are not enabled for your account'} [ctx: command=computers]

2026-07-06 | Howard-Home | msp360 | unexpected: URL can't contain control characters. '/Program Files/Git/api/Companies' (found at least ' ') [ctx: command=raw]

2026-07-05 | Howard-Home | git/submodule-cwd | [friction] ran merge+push for guru-rmm from C:/claudetools (parent repo) after cd for verify.sh; harmless fail but wasted a roundtrip — cd back into the submodule before repo ops

2026-07-05 | Howard-Home | bash/tmp-path | [friction] redirected ssh output to /tmp/deployed-build-server.sh; blocked by block-tmp-path hook; used repo-relative ./.deployed-build-server.sh instead [ctx: ref=feedback_tmp_path_windows]

2026-07-05 | Howard-Home | powershell/git-commit | [friction] embedded double quotes in git commit -m here-string mangled by CommandLineToArgvW -> 'fatal: /: outside repository'; fix: git commit -F <file> [ctx: ref=feedback_windows_quote_stripping]

2026-07-05 | Howard-Home | git/concurrent-sessions | [friction] git add -A in shared gururmm working tree swept another session's uncommitted SPEC-030 edits into my commit (2nd collision today; f6c163b was the reverse). Fix: explicit-path git add in project repos; coord lock before multi-file work [ctx: ref=coord-locks repo=gururmm]

2026-07-05 | Howard-Home | rmm/msp360-backup-fix | [correction] claimed AD1/GND-SERVER backup schedule fix 2026-07-04; verification shows both still ran at old top-of-hour times - local cbb/XML edits do not move MBS-managed plan schedules reliably (GND still :00 even after service restart); AD1 service was never restarted so scheduler kept old time; proper fix is likely MSPBackups console (cloud-side) schedule change [ctx: machines=AD1,GND-SERVER ref=session-logs/2026-07/2026-07-04-howard-backup-alert-remediation.md]

2026-07-05 | Howard-Home | model-routing | [correction] ran all verification passes on Claude; correct is Ollama Tier-0 for cheap classify/prose/pre-scan passes per CLAUDE.md model routing [ctx: ref=CLAUDE.md-model-routing session=easy-bugs-batch]

2026-07-05 | Howard-Home | rmm/ps-encoded | ps-encoded.sh failed: iconv not found on Howard-Home Git-Bash; fell back to jq-inline dispatch [ctx: machine=Howard-Home]

2026-07-05 | Howard-Home | ps-encoded | encode produced empty output [ctx: src=./.msp360-recon.ps1] (x3)

2026-07-05 | Howard-Home | gururmm-build | server cargo check failed (rc=101) [ctx: os=windows]

2026-07-05 | Howard-Home | bash/env | [friction] reused $TOKEN/$RMM across Bash calls after fresh shell reset - curl HTTP:000; fix: re-auth or token file per call [ctx: ref=CLAUDE.md-windows-env-persistence]

2026-07-05 | Howard-Home | gps-rmm-audit/backup-verification | [correction] framed backup billed-qty vs machines-backing-up as 'under-covered' implying machines need backup added; correct = backup targets are a deliberate per-client choice (server/data machine), qty mismatches are BILLING questions for Mike/Winter, never guess which machine needs backup or deploy it

2026-07-05 | Howard-Home | output-formatting | [correction] used emoji checkmarks/warning symbols in verification tables despite the CLAUDE.md NO EMOJIS rule; rendered as ? in Howard's terminal. Correct = ASCII markers [OK]/[WARNING] only

2026-07-05 | Howard-Home | datto-edr | TypeError: unsupported format string passed to NoneType.__format__ [ctx: cmd=sites unexpected]

2026-07-04 | Howard-Home | gururmm/agents-move | POST /api/agents/:id/move appears to CREATE a duplicate agent record (same device_id, new id) in the target site instead of moving; old record goes stale. Also 500s under repeated/rapid calls (works once in isolation). Result: ~28 duplicate agent pairs created 2026-07-04 (24 Dataforth D2 machines now have a live D1 dup + stale D2 original, plus staging reassign dups). STOPPED all RMM writes. [ctx: endpoint=/api/agents/:id/move symptom=duplicate+500]

2026-07-04 | Howard-Home | wiki-compile/dataforth | [correction] flagged 192.168.1.1 as a VLAN2 gateway/IP collision WARNING from a stale wiki note; Howard confirmed onsite there is no VLAN2 conflict - should have checked/trusted the onsite verification instead of raising an alarm from an assumption

2026-07-04 | Howard-Home | bash/quoting | [friction] inline PS-in-bash heredoc with nested quotes mangled by CommandLineToArgvW on dispatch to RMM; fixed by file+EncodedCommand path [ctx: ref=feedback_windows_quote_stripping]

2026-07-04 | GURU-5070 | dataforth/mydata-tpsys | [correction] root was intentionally PASSWORDLESS on the MYDATA TPSys controller because the app launcher bin/go escalates via 'su -c' with no tty; setting a root password broke all escalation and left X empty (no TPSys UI). Correct fix: keep root pw but add tpsys to wheel + uncomment pam_wheel 'trust' in /etc/pam.d/su. Never blank root or remove wheel-trust or the SMT line goes down. [ctx: machine=myserver ip=192.168.1.1 os=FC3 ref=wiki/clients/dataforth.md]

2026-07-04 | Howard-Home | rmm/claude-reinstall | fresh claude-code 2.1.201 npm install on ACG-Tech03L crashed 0xC0000005 on first --version run, succeeded on retry; suspected Datto EDR first-touch scan of new binaries [ctx: machine=ACG-Tech03L cmd=9770a7af]

2026-07-04 | Howard-Home | rmm/ps-encoded | ps-encoded.sh failed on Howard-Home: iconv not found in Git Bash; fell back to powershell.exe base64 encoding [ctx: machine=Howard-Home script=.claude/scripts/ps-encoded.sh]

2026-07-04 | Howard-Home | ps-encoded | encode produced empty output [ctx: src=C:UsersHowardAppDataLocal/Temp/claude/C--claudetools/2ab704e1-28dd-48fa-81dd-7c4d52d0cf3d/scratchpad/tech03-recon.ps1]

2026-07-04 | Howard-Home | context-loading/dataforth | [correction] grepped for 'datforth' (user misspelling), found nothing, then found wiki hits on second grep but didn't read wiki/clients/dataforth.md or projects/dataforth-dos.md; user had to say 'use the wiki'. Correct: on any client-name trigger, fuzzy-match spelling and READ the wiki article before asking the user for infra facts

2026-07-04 | Howard-Home | screenconnect/sc-cleanup | [friction] burned many tokens iterating the SERVER/Accounting remap because each WAN-map rebuild re-queried SERVER-named machines (returning all fleet SERVER sessions), re-contaminating; fix = build WAN map ONLY from unique-named (len==1) machines, never from shared names

2026-07-04 | Howard-Home | screenconnect/sc-cleanup | [correction] assumed GetSessionsByName is client-scoped; it matches by NAME across ALL clients, so writing to shared/generic names (SERVER x11, Accounting x3) cross-contaminated other clients' sessions with the last-processed client's Company. Fixed tool to skip when >1 session returned; remapped contaminated sessions to correct client via WAN IP; 5 unidentifiable sessions left blank for manual console tagging (originals were overwritten, unrecoverable).

2026-07-04 | Howard-Home | unifi-wifi/gw-sitemanager | Site Manager API call failed (HTTP 404) [ctx: path=/v1/connector/consoles/D021F96C10F9000000000646421B000000000690DCFE0000000061F0BB7D:1721816512/proxy/network/stat/sta]

2026-07-04 | Howard-Home | unifi-wifi/gw-sitemanager | Site Manager API call failed (HTTP 404) [ctx: path=/v1/connector/consoles/D021F96C10F9000000000646421B000000000690DCFE0000000061F0BB7D:1721816512/proxy/network/stat/device]

2026-07-04 | Howard-Home | rmm/bot-alerts | [correction] did ~74 agent deploys + 16 client onboards this session but only posted 1 bot-alert (Russo rename); /rmm mandates a #dev-alerts post after every write. Correct: alert per workflow (or a consolidated summary for a batch), not silence.

2026-07-04 | Howard-Home | python/windows | [friction] open(path,'w') defaults to cp1252 on Windows so em-dash/smart-quotes wrote as invalid UTF-8 (0x97), later decode failed; fix: open(...,encoding='utf-8')

2026-07-04 | Howard-Home | bash/env | [friction] curl inside a while-read loop steals the loop's stdin -> returns empty/partial; fix: add </dev/null to the curl (or read from a file, or use python)

2026-07-04 | Howard-Home | screenconnect | ScreenConnect API error [SendCommandToSession]: HTTP 500: {"errorType":"","message":"An session manager fault error occurred while processing your request. Please contact support if the problem persists."} [ctx: cmd=send-command]

2026-07-04 | GURU-5070 | dataforth/ctonw-v5.1 | CONFIG.SYS collection used 'IF NOT EXIST T:STATUS%MACHINE%NUL MD ...' (the NUL dir-exists test is unreliable on a network/SMB drive) and COPY targets had NO trailing backslash -> MD skipped, COPY created FILES named after each machine instead of per-machine folders, and 'MEM /C > T:STATUS%MACHINE%MEM.TXT' wrote to a nonexistent path -> DOS 'T: write fault Abort/Retry/Fail?' HUNG unattended boot on production DOS test stations. Reverted CTONW to v5.0. Fix: pre-create per-machine dirs server-side on the NAS, use trailing backslash on COPY dir targets, never let a network write error reach the critical-error handler at boot; test on ONE isolated station before any fleet exposure. [ctx: ref=dos-network-drive-copy sev=production-boot-hang]

2026-07-04 | GURU-5070 | deploy/dos-batch | [friction] reported CRLF via grep -c $'
$' which misfired on an LF-only file the Write tool produced; staged an LF-only .BAT to the Dataforth NAS (DOS needs CRLF). Caught by Mike at the station. Fix: verify line endings with 'tr -cd 
 | wc -c' (must equal LF count) and CRLF-convert Write-tool batch files with 'sed s/$/
/' before deploy. [ctx: ref=projects/dataforth-dos/.gitattributes file=NWTOC.v5.1]

2026-07-04 | GURU-5070 | ps-encoded | encode produced empty output [ctx: src=/dev/fd/63]

2026-07-03 | GURU-5070 | agy/gemini-cli | old gemini npm CLI dead on this account: throwIneligibleOrProjectIdError (needs GOOGLE_CLOUD_PROJECT); replaced by Antigravity 'agy' binary [ctx: fix=rewired-to-agy]

2026-07-03 | GURU-5070 | grok | grok returned no text [ctx: mode=text stopReason=Cancelled]

2026-07-03 | GURU-5070 | agy | gemini returned no response (empty after 3 attempts) [ctx: mode=search err=}]

2026-07-03 | GURU-5070 | grok | grok xsearch incomplete (rc=124); auto-fell back to gemini [ctx: mode=xsearch]

2026-07-03 | GURU-5070 | agy | gemini returned no response (empty after 3 attempts) [ctx: mode=review err=    at process.processTicksAndRejections (node:internal/process/task_queues:104:] (x2)

2026-07-03 | Howard-Home | rmm-search/gps-audit | [correction] RMM org 'Russo, Steve' was mis-named at setup — it IS Russo Law Firm (Steve Russo = owner, Shannon Trionfo = main contact), not a separate resident. Renamed org to 'Russo Law Firm' via PUT /api/clients/:id. Lesson: an RMM org named after a person may be a mislabeled business; verify owner/contact against Syncro before treating as residential. Root cause: client created without a skill/standard naming step.

2026-07-03 | Howard-Home | rmm/av-removal | [friction] step1 PS timed out at 180s (avastclear download + mb5uns -Wait); split into async download + separate MB uninstall [ctx: host=DESKTOP-5JK4EGI]

2026-07-03 | Howard-Home | ps-encoded | encode produced empty output [ctx: src=.claude/skills/_tmp_win_recon.ps1]

2026-07-03 | Howard-Home | rmm/onboarding-diagnostic | probe timed out (240s, exit -1) on slow VM endpoint DESKTOP-5JK4EGI; fell back to lean targeted recon [ctx: host=DESKTOP-5JK4EGI kind=VM]

2026-07-03 | Howard-Home | rmm-diagnose | could not extract valid diagnostic JSON from probe output [ctx: host=DESKTOP-5JK4EGI status=failed exit=-1]
2026-07-04 | GURU-BEAST-ROG | agy/ask-gemini | gemini review returned empty: throwIneligibleOrProjectIdError in _doSetupUser (OAuth eligibility/project not set) after 3 attempts [ctx: task=syncro-recon-multiai model=gemini-cli-0.45.2]

2026-07-04 | GURU-BEAST-ROG | agy | gemini returned no response (empty after 3 attempts) [ctx: mode=review err=    at process.processTicksAndRejections (node:internal/process/task_queues:104:]

2026-07-03 | Howard-Home | remediation-tool/graph | [friction] auditLogs/signIns $filter (userId/UPN) hangs HTTP000 on Cascades tenant; large $top also hangs. Fix: small unfiltered $top=50, filter client-side

2026-07-03 | Howard-Home | rmm/ps-encoded | [friction] iconv missing in Git Bash so ps-encoded.sh cannot build UTF-16LE -EncodedCommand. Fix: py -c base64.b64encode(text.encode('utf-16-le'))

2026-07-03 | Howard-Home | remediation-tool/get-token | [friction] get-token.sh reads ~/.claude/identity.json (absent here); repo identity.json has vault_path=D:/vault. Fix: prefix VAULT_ROOT_ENV=/d/vault [ctx: ref=vault-skill-gotchas]

2026-07-03 | GURU-5070 | rmm/dispatch | [friction] embedded backslash PS in jq literal program twice this session; jq treats S etc as invalid escapes - ALWAYS use ps-encoded.sh or jq --arg for any command containing backslashes [ctx: ref=feedback_windows_quote_stripping + rmm skill quote-safe dispatch rule]

2026-07-03 | GURU-5070 | rmm/pst-context | [correction] assumed PST-SERVER2 might still be a live DC needing demote at cutover; correct is it died permanently (~mid-June, per Mike, stated previously) and PST-DC-NW is its replacement

2026-07-02 | Howard-Home | discord-dm/bash-curl | [friction] Discord file attachment (multipart -F) failed on Git-bash Windows: HTTP 000 from MSYS path-converting -F args (esp. type=text/html and @/c/.. paths), then 50035 from inline payload_json quoting. Fix: MSYS_NO_PATHCONV=1 MSYS2_ARG_CONV_EXCL='*', cd to file dir + use relative @name, and read payload_json from a file via -F 'payload_json=<file.json'. discord-dm.sh is text-only so file sends need this direct curl path. [ctx: ref=feedback_windows_quote_stripping]

2026-07-02 | Howard-Home | ps-encoded | encode produced empty output [ctx: src=C:/Users/Howard/AppData/Local/Temp/claude/C--claudetools/48ddc9ec-86ca-4dc1-93b2-529186a2623f/scratchpad/clear-caregiver-mustchange.ps1]

2026-07-02 | Howard-Home | ps-encoded | encode produced empty output [ctx: src=.claude/scratch-iso-verify.ps1]

2026-07-02 | Howard-Home | unifi/site-manager-api | [friction] vault infrastructure/unifi-site-manager-api key returns 401 (stale/rotated); the WORKING cloud key is services/unifi-site-manager (X-API-KEY vs api.ui.com) [ctx: ref=uos-server wiki; use services/unifi-site-manager]

2026-07-02 | GURU-5070 | remediation-tool/consent-drift | [correction] assumed VWP had SharePoint access because the suite 'has' it; VWP had the Tenant Admin app but only PARTIAL consent (Graph Sites but not the SharePoint app-only role) -> SP calls 401 with empty roles. Fix: audit per-tenant token roles, grant missing app role via appRoleAssignment (Method B). Per-tenant consent is NOT uniform. [ctx: ref=app-suite.md tenant=VWP]

2026-07-02 | GURU-5070 | rmm/long-install-reaper | [friction] long download+install (131MB Falcon) exceeds the RMM command timeout on a slow-egress box -> command shows failed/'Command timeout'/'Access is denied' but the install COMPLETES in background (service came up Running). Verify service state after, don't trust the failed status for fire-and-forget installs. [ctx: ref=reference_gururmm_command_timeout_seconds host=ACG-DC16]

2026-07-02 | GURU-5070 | ps-encoded/server2016 | [friction] ps-encoded.sh rmm (shell->cmd.exe->powershell -EncodedCommand) returns 'Access is denied' with no stdout on Windows Server 2016 (DC16); plain command_type=powershell works. Fall back to direct powershell dispatch on Server 2016. [ctx: ref=ps-encoded.sh host=ACG-DC16 os=server2016]

2026-07-02 | GURU-BEAST-ROG | self-check/registry-trim | [friction] trimmed skill registry locally while GURU-5070 shipped the same trim upstream; auto-sync merge raced my uncommitted edits (transient UU state, stale 15777 reading mid-merge); fix: check coord / claim a lock before fleet-wide harness edits [ctx: ref=coord-locks]

2026-07-02 | Howard-Home | rmm/user-manager | [correction] reset Shelby.Trozzi domain password with raw Set-ADAccountPassword via /rmm; memory reference_gururmm_user_manager says use the built-in GuruRMM User Manager (reset_password action, is_dc) instead. [ctx: ref=reference_gururmm_user_manager]

2026-07-02 | Howard-Home | rmm/powershell | [friction] PowerShell parse errors from backslash-before-closing-quote ("W:" and "W:\") in RMM payloads; wasted 2 dispatches. Fix: use bare path tokens (Test-Path W:) or single-quotes, never a quoted string ending in a backslash.

2026-07-02 | Howard-Home | rmm/powershell | [friction] net use via RMM user_session to remote CS-SERVER failed err67/1702 (impersonated token has no network credential = double-hop); documented as 'SMB error 67 RMM artifact'. Fix: plant HKCU:Network<drv> keys + cmdkey; drive mounts at next interactive logon. [ctx: ref=wiki/clients/cascades-tucson SMB-error-67]

2026-07-02 | Howard-Home | rmm/bash | [friction] hand-escaped nested JSON payload for /api/agents/command; server rejected + jq parse-errored the response. Fix: build payload with jq -n --arg (skill already mandates this for multi-line scripts). [ctx: ref=rmm.md-multiline-heredoc]

2026-07-02 | Howard-Home | rmm/inventory | [friction] censused ARP as SYSTEM reading HKCU (=SYSTEM profile), missed per-user installs + falsely concluded no programs removed; must enumerate all HKU* user hives

2026-07-02 | GURU-5070 | bash/env | [friction] referenced $RMM/$TOKEN from prior Bash call; env does not persist between calls - re-auth inline [ctx: ref=CLAUDE.md shell-env rule]

2026-07-02 | GURU-5070 | cargo/windows-msvc-linker | [friction] cargo check on GURU-5070 fails 'linker link.exe not found' (MSVC linker not on PATH / vcvars64.bat not found under VS roots) - blocks local server typecheck; memory reference_guru5070_rust_toolchain claims MSVC present. Build on the pipeline/Linux host instead. [ctx: ref=reference_guru5070_rust_toolchain host=GURU-5070]

2026-07-01 | Howard-Home | rmm/powershell | [friction] interpolated string "$i:..." parsed as drive-qualified variable (InvalidVariableReferenceWithDrive) -> use ${i}; cost one round-trip dispatch

2026-07-01 | GURU-5070 | bash/msys-pathconv | [friction] cmd.exe /c from Git-bash: MSYS converted /c to C: and opened an interactive cmd (2min timeout); use powershell.exe directly or MSYS_NO_PATHCONV=1 [ctx: ref=msys-path-conversion-family]

2026-07-01 | GURU-5070 | bash/jq-windows | [friction] jq --rawfile with /dev/stdin fails on Windows jq (no /proc); build JSON from a shell var with jq -n --arg instead

2026-07-01 | GURU-5070 | agy/gemini-verify | gemini verify failed: gemini-3.1-pro-preview quota exhausted, default-model fallback errored on OAuth _doSetupUser. Gemini unavailable for cross-vendor verification this session. [ctx: skill=agy]

2026-07-01 | GURU-5070 | agy | gemini returned no response (empty after 3 attempts) [ctx: mode=verify err=    at async _doSetupUser (file:///C:/Users/guru/AppData/Roaming/npm/node_module]

2026-07-01 | GURU-5070 | agy | gemini returned no response (empty after 3 attempts) [ctx: mode=verify err=    at process.processTicksAndRejections (node:internal/process/task_queues:104:]

2026-07-01 | Howard-Home | rmm-search | RMM auth failed via rmm-auth.sh (no TOKEN/RMM)

2026-07-01 | Howard-Home | coord | coord API call failed (HTTP 0) [ctx: http=0 cmd=lock claim resp={"error": "<urlopen error [WinError 10060] A connection attempt failed because t]

2026-07-01 | Howard-Home | rmm/mac-mount-check | [friction] grep '/Volumes/Data' false-matched '/System/Volumes/Data' and reported MOUNTED when share was absent; use precise 'on /Volumes/Data ' (with trailing space) as the LaunchAgent does

2026-07-01 | GURU-5070 | remediation-tool | [friction] declared 'no SharePoint access' on a Graph accessDenied; actually the Tenant Admin app holds SharePoint Sites.FullControl.All - the blocks were (a) SharePoint app-only needs CERT not client_secret ('Unsupported app only token') and (b) get-token.sh had no SharePoint resource tier. Fixed: added sharepoint/sharepoint-admin tiers + reference doc. [ctx: ref=.claude/skills/remediation-tool/references/app-permissions-and-sharepoint.md]

2026-07-01 | GURU-5070 | context/session-resume | [correction] assumed 'PST-SERVER investigation' = Peaceful Spirit DFS rebuild; correct is the deleted-PST-files scope investigation (Dataforth/NWTOC)

2026-07-01 | GURU-5070 | sync/vault | vault sync failed: cannot connect to git.azcomputerguru.com:443 (timeout). No local vault changes pending. Internal 172.16.3.20:3000 preferred per reference_gitea_internal. [ctx: ref=reference_gitea_internal machine=GURU-5070]

2026-07-01 | GURU-5070 | birth-biologic/quality-upload | [correction] prior upload script silently skipped every file >=4MB; Datto had 301 such files (~29.7GB) so it could never reach target count. Fix: Graph chunked upload sessions for >=4MB.

2026-07-01 | GURU-5070 | rmm/command-dispatch | [friction] RMM agent ignores 'timeout' field (capped ~300s -> zombie 'running' commands); long-running commands MUST use 'timeout_seconds'. Cost a full day of failed Birth Biologic uploads. [ctx: agent=ACG-DWP-X-BB ref=gururmm-command-timeout-seconds]

2026-06-30 | Howard-Home | remediation-tool/exchange-op | [friction] Add-MailboxPermission -AutoMapping $true silently rolled back the FullAccess grant for 2 of 4 delegates (cmdlet echoed [FullAccess] success but Get-MailboxPermission showed NONE); a failed msExchDelegateListLink write aborts the whole Add transaction. Fix: re-add with -AutoMapping $false (FullAccess then persists); set automapping separately/interactively if auto-attach is required. [ctx: tenant=cascadestucson.com mailbox=tamra.matthews app=ComputerGuru-Exchange-Operator]

2026-06-30 | Howard-Home | /syncro | [correction] invoiced 'Windows Pro Upgrade' line items (Cascades 67887/67890) with blank CATEGORY; product_category was null and I billed it anyway — correct is to pre-flight GET /products/<id>, never invoice a null/blank category, and never invent one (use existing set e.g. Software) [ctx: ref=feedback_syncro_line_item_category invoices=67887,67890 product=23571919]

2026-06-30 | Howard-Home | rmm/printer-map | [friction] Add-Printer -ConnectionName in user_session = HRESULT 0x800702e4 ELEVATION_REQUIRED (Point-and-Print); agent watchdog times out on the interactive UAC prompt. Use WScript.Network.AddWindowsPrinterConnection + have a user at console approve, or pre-stage driver/connection as SYSTEM

2026-06-30 | Howard-Home | rmm/powershell | [friction] literal UNC backslashes (hostshare) in a jq-built PS payload got mangled to a single backslash -> Add-Printer 'invalid name'; fix: build UNC with [char]92 instead of literal backslashes [ctx: ref=feedback_windows_quote_stripping host=RECEPTIONIST-PC]

2026-06-30 | Howard-Home | unifi-wifi/pfsense-ssh | SSH connect/auth failed (rc=255) [ctx: host=192.168.0.1:22 slug=cascades-tucson act=fw-list]

2026-06-30 | Howard-Home | unifi-wifi/pfsense-ssh | SSH connect/auth failed (rc=255) [ctx: host=192.168.0.1:22 slug=cascades-tucson act=fw-list]

2026-06-30 | Howard-Home | unifi-wifi/pfsense-ssh | SSH connect/auth failed (rc=255) [ctx: host=192.168.0.1:22 slug=cascades-tucson act=audit]

2026-06-30 | Howard-Home | unifi-wifi/pfsense-ssh | SSH connect/auth failed (rc=255) [ctx: host=192.168.0.1:22 slug=cascades-tucson act=run]

2026-06-30 | Howard-Home | unifi-wifi/pfsense-ssh | SSH connect/auth failed (rc=255) [ctx: host=192.168.0.1:22 slug=cascades-tucson act=run]

2026-06-30 | Howard-Home | unifi-wifi/pfsense-ssh | SSH connect/auth failed (rc=255) [ctx: host=192.168.0.1:22 slug=cascades-tucson act=run]

2026-06-30 | GURU-5070 | post-bot-alert | Discord POST failed (non-200/unreachable) [ctx: channel=#dev-alerts http=400 resp={"message": "The request body contains invalid JSON.", "code": 50109}]

2026-06-30 | Howard-Home | bash/env | [friction] Bash tool default timeout 120000ms cut off long RMM watch loops twice; set timeout param to 600000 for multi-minute monitoring.

2026-06-30 | Howard-Home | powershell/env | [friction] "C:.~BT" in a double-quoted PS string expands $WINDOWS to empty -> C:.~BT; Test-Path falsely reports folder missing. Fix: backtick-escape (`$) or single-quote the path.

2026-06-29 | GURU-5070 | remediation-tool/graph | [friction] Tenant Admin app 403s on group DELETE (has GroupMember write, not Group.ReadWrite.All); use User Manager app for M365 group deletion [ctx: tenant=birthbiologic op=group-delete]

2026-06-29 | GURU-5070 | rmm/rsync-cygwin | [friction] cwRsync (cygwin) on AD2 misreads a Windows 'C:path' DESTINATION as a remote host; pulls silently fail. Use /cygdrive/c/... for local src AND dst [ctx: host=AD2 ref=dataforth-dos-sync]

2026-06-29 | GURU-5070 | graph/sharepoint-upload | BirthBio media upload: all 10 large files failed at chunk 0 (connection closed on send + 503) with 60MB chunks; docs OK [ctx: site=birthbiologic chunk=60MB fix=reduce-to-10MiB+retry]

2026-06-29 | GURU-5070 | rmm/user-management | [correction] Claimed GuruRMM has no built-in user-password action; it DOES - the per-agent User Manager tab (Users/Groups) manages local + domain (on a DC) + AAD users: reset_password, set_enabled, set_password_never_expires, add/remove_from_group. Used raw Set-ADAccountPassword PowerShell instead (which also leaked the pw into command history). [ctx: endpoint=/api/agents/{id}/users + /users/action component=UserManagerTab.tsx]

2026-06-29 | GURU-5070 | remediation-tool | [correction] assumed 'AD account' meant Entra/M365 account; user meant ON-PREM AD. 365/email stays disabled; on-prem handled separately (no ADsync - cloud-only user). [ctx: client=VWP user=teresa@valleywideplastering.com]

2026-06-29 | Howard-Home | discord-dm | Discord send to howard (DM) failed [ctx: http=400 resp={"message": "Invalid Form Body", "code": 50035, "errors": {"content": {"_errors"]

2026-06-29 | GURU-5070 | remediation-tool/reset-password.sh | [friction] JIT de-elevation can never succeed: an app-only SP cannot remove its OWN Privileged Authentication Administrator assignment ('no privilege to remove self'). Every admin-account reset leaves standing PAA on the ComputerGuru Tenant Admin SP; requires a human Global Admin to remove. Likely also left PAA on birthbiologic.com (2026-06-08). [ctx: tenant=5c53ae9f-7071-4248-b834-8685b646450f sp=fccda86c-77ca-4248-b876-b0cdba8605d4 role=PrivilegedAuthAdmin fix=PIM-or-second-principal-or-human-GA]

2026-06-29 | GURU-5070 | remediation-tool | reset-password: failed to remove JIT Privileged Auth Admin role - standing privilege left behind, REMOVE MANUALLY [ctx: tenant=5c53ae9f-7071-4248-b834-8685b646450f assignment=ikzke6-tKk6E1qsmSeCKE2yozfzKd0hCuHawzbqGBdQ-1 http=400]

2026-06-29 | GURU-5070 | syncro/billing | [friction] created invoice on ticket with pre-existing unbilled line item without checking first; invoice swept a prior 5.0h migration charge + my 1.0h, deducting 6.0h from prepaid block (10->3 total, intended 2). ALWAYS GET /tickets/{id} .line_items before POST /invoices on a prepaid customer [ctx: client=birth-biologic ticket=32187 invoice=1650837688]

2026-06-29 | GURU-5070 | remediation-tool/birthbiologic | [correction] assumed MX still on Google (per 06-26 docs); actual: MX cut to M365 (birthbiologic-com.mail.protection.outlook.com) on Sat 2026-06-27 — verify MX live, don't trust stale migration-scope docs [ctx: client=birth-biologic]

2026-06-29 | GURU-5070 | rmm/windows-fileaudit | [friction] OneDrive cloud-only files at >=260-char paths can't be header-read: Graph driveItem-by-path 404s them and local [IO.File]::Open fails (MAX_PATH) even with ? prefix and AppContext UseLegacyPathHandling/BlockLongPaths switches; need robocopy/SPMT (long-path native) for those [ctx: host=ACG-DWP-X-BB count=89 client=birth-biologic]

2026-06-29 | GURU-5070 | rmm/bash | [friction] passed ~20KB base64 inline via jq --arg in command line -> 'Argument list too long'; should stage data on the endpoint (it already had the CSV) or chunk-upload, never inline-pass large blobs [ctx: ref=CLAUDE.md windows-rules; host=ACG-DWP-X-BB]

2026-06-29 | GURU-5070 | migration/datto-to-sharepoint | 2026-06-26 SharePoint push corrupted files: byte array stringified ('$bytes') so each file written as space-separated DECIMAL TEXT instead of binary (xlsx '80 75 3 4...', pdf '37 80 68 70...'); format-agnostic, ~15 local + up to ~3298 cloud-only files modified 06-26; Datto source intact [ctx: client=birth-biologic host=ACG-DWP-X-BB vector=base64/stdout-capture-upload fix=use OneDrive-sync/SPMT or [IO.File]::WriteAllBytes]

2026-06-29 | Howard-Home | cascades/SG-Caregivers | [correction] assumed adding Feller + Nyanzunda to SG-Caregivers per 6/4 worklist; correct is group = frontline caregivers ONLY, exclude admins/managers/admin-adjacent (Feller PA-remote, Nyanzunda MC admin asst) do NOT go in

2026-06-29 | Howard-Home | rmm/coord | [friction] 172.16.3.30 unreachable from Howard-Home (RMM :3001 + coord :8001 dead; Cascades VPN up) — ACG-internal route down [ctx: ref=cascades-caregiver-group-task]

2026-06-29 | Howard-Home | rmm/powershell | [friction] used $pid as a variable in remote PS script; $PID is a reserved automatic variable (current process id) so the .zip ProgID read was clobbered (showed 16044). Use a non-reserved name e.g. $zipProg [ctx: ref=feedback_windows_quote_stripping-style-PS-gotchas]

2026-06-29 | Howard-Home | rmm/rednour-legalasst | [correction] assumed LEGALASST was the cloned machine; correct is that CARRIE'S machine was cloned (to host rednourcarrievirt) and LEGALASST is EMMA'S machine (not cloned). Emma's drives X/Y/Z were remapped today to 
ednourcarrievirt [ctx: client=rednour host=LEGALASST]

2026-06-29 | Howard-Home | rmm-auth/tailscale | [friction] RMM+coord unreachable (http=000); tailscaled service RUNNING but backend stuck in NoState after restart -> 172.16.3.30 unping-able from HOWARD-HOME [ctx: ref=remote-diag fix=tailscale-relogin]

2026-06-29 | Howard-Home | rmm-auth | RMM login failed (no token returned from /api/auth/login) [ctx: url=http://172.16.3.30:3001 resp=]

2026-06-29 | Howard-Home | rmm-search | RMM auth failed via rmm-auth.sh (no TOKEN/RMM)

2026-06-29 | Howard-Home | rmm-search | RMM auth failed via rmm-auth.sh (no TOKEN/RMM)

2026-06-29 | Howard-Home | save/rmm-scratch | [friction] wrote RMM command-id scratch files (.netprobe_id, .stage_id, etc.) to repo root C:/claudetools; .netprobe_id got swept into a sync commit by git add -A and needed git rm. Use the session scratchpad dir for transient IDs, not the repo root. [ctx: ref=feedback_tmp_path_windows]

2026-06-28 | Howard-Home | rmm/spec-015-safeboot | [friction] safe-mode survival test stranded DESKTOP-MS42HNC: (a) registering only GuruRMMAgent/Watchdog in SafeBootNetwork is insufficient for the agent to connect in Safe Mode (needs network-stack deps e.g. BFE/Dnscache/CryptSvc); (b) Task-Scheduler dead-man does NOT fire in Safe Mode so auto-revert failed -> required manual console recovery [ctx: host=DESKTOP-MS42HNC spec=SPEC-015 fix=use-a-service-not-schtasks-for-revert test-only-on-disposable-VM]

2026-06-28 | Howard-Home | rmm/powershell-discovery | [friction] broad '*.log' Get-ChildItem on C:WindowsTemp pulled a 157KB Office C2R telemetry log into command output, wasting tokens; scope log searches to the specific filename (mccleanup.log) or a tight -Filter, not *.log

2026-06-27 | GURU-5070 | sync/bash-timeout | [friction] sync.sh SIGTERM'd at 2min: Bash tool default 120s timeout collides with sync.sh's ~120s lock-wait window (exit 143). Fix: invoke sync.sh with Bash timeout >=180000ms so it can acquire the lock or cleanly exit 75

2026-06-27 | GURU-5070 | syncro/bot-alert | [friction] posted bot-alert without the mandated '-> <link>' tail; format is [SYNCRO] <tech> <verb> #num (cust) - summary -> https://computerguru.syncromsp.com/tickets/<id> [ctx: ref=syncro.md#post-to-bot-alerts]

2026-06-27 | GURU-5070 | birthbio/datto-sharepoint | [correction] assumed 'reappearing' files were a Datto two-way-sync resurrection from the transfer VM; correct: they were stale copies left in SharePoint since the April additive push (deleted from Datto later, never removed from SP). Mirror cleanup removed them.

2026-06-27 | GURU-5070 | bash/background-poller | [friction] background poll script used $0-relative temp files ($0.l.json etc.) for curl --data-binary @file; under run_in_background $0 didn't resolve to a writable path so every poll errored + it never detected completion. Fix: use absolute scratchpad paths in background scripts, not $0-relative

2026-06-26 | Howard-Home | syncro/billing | [correction] hand-rolled add_line_item API calls from memory instead of using the /syncro skill; malformed tickets reached Winter for cleanup. Correct: route ALL Syncro billing/invoicing through the skill. Generalized to a CORE skill-first rule. [ctx: rule=skill-first memory=feedback_skill_first_routing tickets=#32193,#32194]

2026-06-26 | Howard-Home | bash/env | [friction] used relative .claude/scripts/rmm-auth.sh after an earlier cd into a skill scripts dir (cwd persists across Bash calls) -> 'No such file or directory'; fix: cd /c/claudetools first or use absolute paths [ctx: ref=2026-06-25-edr-rollout cwd-drift note]

2026-06-26 | Howard-Home | rmm/bash-quoting | [friction] REPEAT (same session, day after logging it): used doubled single-quotes ('') around a PowerShell registry path inside a single-quoted bash $SCRIPT again -> 'Windows NT' path space broke the read. Fix is known (double-quotes inside). Rule from feedback_windows_quote_stripping not sticking under flow - consider always building PS scripts via a heredoc to a var, never inline single-quoted with embedded quotes. [ctx: ref=feedback_windows_quote_stripping repeat=2]

2026-06-26 | Howard-Home | discord-dm | Discord send to howard (DM) failed [ctx: http=400 resp={"message": "Invalid Form Body", "code": 50035, "errors": {"content": {"_errors"]

2026-06-26 | GURU-5070 | output/style | [correction] used emoji in responses despite CLAUDE.md NO-EMOJIS rule; Mike corrected. Use ASCII markers only [ctx: ref=CLAUDE.md-key-rules]

2026-06-26 | GURU-5070 | rmm | [correction] bypassed /rmm skill (raw API via Windows curl due to broken git-bash curl) and skipped the mandatory [RMM] #dev-alerts post on write ops; alert is required regardless of dispatch method

2026-06-26 | GURU-5070 | post-bot-alert | Discord POST failed (non-200/unreachable) [ctx: channel=#dev-alerts http=400 resp={"message": "The request body contains invalid JSON.", "code": 50109}]

2026-06-26 | GURU-5070 | bash/env | [friction] git-bash /mingw64/bin/curl quarantined by Windows Defender -> RMM helpers (rmm-ps.sh/rmm-auth.sh) fail 'Permission denied'; workaround use C:/Windows/System32/curl.exe [ctx: machine=GURU-5070 fix=defender-exclusion-on-git-mingw64-bin]

2026-06-26 | Howard-Home | rmm/smb-testing | [friction] RMM-dispatched net use/net view/Test-Path/Get-SmbConnection are UNRELIABLE for SMB client testing - they fail with error 67 / RPC 1702 / 'none' even for KNOWN-GOOD targets (Karen's NAS she uses daily; Crystal had a live 5-open-file server session but Get-SmbConnection via RMM showed none). The agent-injected process lacks the user's real network-logon session. Wasted a long investigation treating these artifacts as a CS-SERVER SMB outage; server truth (Get-SmbSession) showed 7 live users + 30 open files + new sessions. VALIDATE SMB with Get-SmbSession server-side or a REAL interactive test, never RMM-dispatched client cmds. [ctx: host=CS-SERVER client=cascades ref=drive-map-verify]

2026-06-26 | GURU-5070 | agy/gemini | gemini CLI headless failed: throwIneligibleOrProjectIdError / _doSetupUser (auth-eligibility, needs interactive re-login) [ctx: task=verify-gws-migration-scopes]

2026-06-26 | GURU-5070 | agy | gemini returned no response (empty after 3 attempts) [ctx: mode=search err=    at process.processTicksAndRejections (node:internal/process/task_queues:104:]

2026-06-26 | GURU-5070 | remediation-tool | onboard-tenant: grant_app_role appRoleAssignment failed [ctx: role=bf394140-e372-4bf9-a898-299cfc7564e5 msg=Resource '161b8f61-5c16-4e1a-9a23-4bb7076b0946' does not exist or one of its que]

2026-06-26 | GURU-5070 | remediation-tool | onboard-tenant: grant_app_role appRoleAssignment failed [ctx: role=6931bccd-447a-43d1-b442-00a195474933 msg=Resource 'bab4699b-32a3-4434-9cad-7a4a08cc4d9e' does not exist or one of its que]

2026-06-26 | GURU-5070 | remediation-tool | onboard-tenant: grant_app_role appRoleAssignment failed [ctx: role=df021288-bdef-4463-88db-98f22de89214 msg=Resource 'bab4699b-32a3-4434-9cad-7a4a08cc4d9e' does not exist or one of its que]

2026-06-26 | GURU-5070 | remediation-tool | onboard-tenant: failed to acquire Tenant Admin token [ctx: tenant=19a568e8-9e88-413b-9341-cbc224b39145 exit=3]

2026-06-26 | Howard-Home | rmm/cascades-cs-server | [correction] assumed CS-SERVER AV was GravityZone Bitdefender (used bitdefender skill, chased tamper password); actually DattoAV / Endpoint Protection SDK at C:Program Filesinfocytegentdattoav, managed by Datto RMM (CagService) + HUNTAgent. GravityZone removal did nothing; rtp1/rtp2 minifilters re-arm on boot (reverted Start=4->1). rtp1 attached to DeviceNamedPipe = breaks SMB IPC$/RPC 1702. [ctx: host=CS-SERVER client=cascades]

2026-06-26 | Howard-Home | post-bot-alert | Discord POST failed (non-200/unreachable) [ctx: channel=#dev-alerts http=400 resp={"message": "The request body contains invalid JSON.", "code": 50109}]

2026-06-26 | Howard-Home | post-bot-alert | Discord POST failed (non-200/unreachable) [ctx: channel=#dev-alerts http=400 resp={"message": "The request body contains invalid JSON.", "code": 50109}]

2026-06-26 | Howard-Home | drive-map | drive-map verify failed on DESKTOP-LPOPV30 [ctx: cmd=e932bc94-0557-4913-a0b1-c97c1aa5da26]

2026-06-26 | Howard-Home | drive-map | drive-map verify failed on DESKTOP-LPOPV30 [ctx: cmd=18fec38b-8fae-4a1b-a3d8-5b90b124dbc2]

2026-06-26 | Howard-Home | drive-map | drive-map verify failed on DESKTOP-LPOPV30 [ctx: cmd=82aa3177-558e-464e-ab75-81f8f7d7f3cc]

2026-06-26 | GURU-5070 | remediation-tool | [correction] claimed no tier has mail read/write and reached for an EWS workaround; correct: exchange-op (Exchange Operator app) = Exchange Administrator role + full_access_as_app + Exchange.ManageAsApp = full all-access for ANY mailbox/Exchange op including moving mail [ctx: tenant=tedards.net recurring=true ref=feedback_exchange_op_all_access]

2026-06-26 | Howard-Home | synology/ssh | syno-ssh recipe 'run' failed (rc=255) [ctx: host=192.168.0.120]

2026-06-26 | Howard-Home | synology/ssh | syno SSH connect/auth failed (rc=255) [ctx: host=192.168.0.120 vp=clients/cascades-tucson/synology-cascadesds.sops.yaml]

2026-06-26 | Howard-Home | rmm/bash-quoting | [friction] doubled single-quotes ('') inside a single-quoted bash $SCRIPT collapse the string, leaving a PowerShell registry path with a space unquoted (Windows NT) -> read fails, ErrorActionPreference=Stop aborts before changepk. Fix: use double-quotes for paths inside the single-quoted bash heredoc, never doubled single-quotes. [ctx: ref=feedback_windows_quote_stripping]

2026-06-25 | GURU-5070 | vault/display | [friction] echoing a vault entry, sed line-redaction missed the multi-line JSON private_key (matched 'key:' not 'private_key": "') and printed the full SA private key; when displaying vault entries use vault.sh get-field for named fields or drop the entire credentials: block, never a line-regex over JSON credential blobs
2026-06-29 | GURU-BEAST-ROG | mailprotector | HTTP 404 POST https://emailservice.io/api/v1/users/find_by_address: "Not found" [ctx: cmd=find-user]

2026-06-26 | GURU-BEAST-ROG | email-investigation | [correction] assumed tedards.net also uses GuruProtect/Inky; correct: only ACG uses Inky for inbound. Tedards routes directly to Exchange Online.

2026-06-26 | Howard-Home | rmm/acl | [friction] Set-Acl/icacls ACL propagation on a large folder tree (Carrie Documents) exceeded the RMM command timeout twice; because stdout is dropped on timeout, a randomly-generated password printed in the same script was lost each time. Fix: generate the password LOCALLY (retain it) and inject via placeholder, and run ACL propagation as a separate long-timeout (>=600s) command isolated from any value you need back. [ctx: host=REDNOURCARRIEVI skill=rmm op=Set-Acl]

2026-06-25 | Howard-Home | wiki-compile | [friction] Sonnet subagent hit 32k output-token cap regenerating full ~600-line article via Write; wrote nothing [ctx: fix=targeted staged edits of deltas for large existing articles, not full regen]

2026-06-25 | Howard-Home | datto-edr | Datto EDR HTTP 500: {"error":{"statusCode":500,"message":"Internal Server Error"}} [ctx: cmd=raw]

2026-06-25 | Howard-Home | datto-edr | Datto EDR HTTP 500: {"error":{"statusCode":500,"message":"Internal Server Error"}} [ctx: cmd=agent]

2026-06-25 | Howard-Home | datto-edr | Datto EDR HTTP 500: {"error":{"statusCode":500,"message":"Internal Server Error"}} [ctx: cmd=agent]

2026-06-25 | Howard-Home | datto-edr | Datto EDR HTTP 412: {"error":{"statusCode":412,"message":"column reference "id" is ambiguous"}} [ctx: cmd=scan]

2026-06-25 | Howard-Home | synology/ssh | syno-ssh recipe 'run' failed (rc=255) [ctx: host=192.168.0.120]

2026-06-25 | Howard-Home | synology/ssh | syno SSH connect/auth failed (rc=255) [ctx: host=192.168.0.120 vp=clients/cascades-tucson/synology-cascadesds.sops.yaml]

2026-06-25 | Howard-Home | synology/ssh | syno-ssh recipe 'run' failed (rc=255) [ctx: host=192.168.0.120]

2026-06-25 | Howard-Home | synology/ssh | syno SSH connect/auth failed (rc=255) [ctx: host=192.168.0.120 vp=clients/cascades-tucson/synology-cascadesds.sops.yaml]

2026-06-25 | Howard-Home | datto-edr | [friction] EDR scan endpoints from Infocyte module (targets/{id}/scan, targets/scan, scans) all 404 on Datto EDR tenant; working trigger is POST /Agents/scan {ids:[...]} but 'Scan - EDR' is TENANT-WIDE (empty/ids body scanned 156 hosts); cancel via POST /userTasks/{id}/cancel (204) [ctx: skill=datto-edr tenant=azcomp4587]

2026-06-25 | Howard-Home | synology/ssh | syno-ssh recipe 'acl' failed (rc=255) [ctx: host=192.168.0.120]

2026-06-25 | Howard-Home | synology/ssh | syno SSH connect/auth failed (rc=255) [ctx: host=192.168.0.120 vp=clients/cascades-tucson/synology-cascadesds.sops.yaml]

2026-06-25 | Howard-Home | synology/ssh | syno-ssh recipe 'acl' failed (rc=255) [ctx: host=192.168.0.120]

2026-06-25 | Howard-Home | synology/ssh | syno SSH connect/auth failed (rc=255) [ctx: host=192.168.0.120 vp=clients/cascades-tucson/synology-cascadesds.sops.yaml]

2026-06-25 | Howard-Home | synology/ssh | syno-ssh recipe 'groups' failed (rc=127) [ctx: host=192.168.0.120]

2026-06-25 | Howard-Home | synology/ssh | syno-ssh recipe 'users' failed (rc=127) [ctx: host=192.168.0.120]

2026-06-25 | Howard-Home | synology/ssh | syno-ssh recipe 'run' failed (rc=255) [ctx: host=192.168.0.120]

2026-06-25 | Howard-Home | synology/ssh | syno SSH connect/auth failed (rc=255) [ctx: host=192.168.0.120 vp=clients/cascades-tucson/synology-cascadesds.sops.yaml]

2026-06-25 | Howard-Home | synology/ssh | syno-ssh recipe 'acl' failed (rc=1) [ctx: host=192.168.0.120]

2026-06-25 | Howard-Home | synology/ssh | syno-ssh recipe 'users' failed (rc=127) [ctx: host=192.168.0.120]

2026-06-25 | Howard-Home | synology/ssh | syno-ssh recipe 'shares' failed (rc=1) [ctx: host=192.168.0.120]

2026-06-25 | Howard-Home | synology/ssh | syno-ssh recipe 'acl' failed (rc=1) [ctx: host=192.168.0.120]

2026-06-25 | Howard-Home | synology/ssh | syno-ssh recipe 'acl' failed (rc=1) [ctx: host=192.168.0.120]

2026-06-25 | Howard-Home | synology/ssh | syno-ssh recipe 'groups' failed (rc=127) [ctx: host=192.168.0.120]

2026-06-25 | Howard-Home | synology/ssh | syno-ssh recipe 'users' failed (rc=127) [ctx: host=192.168.0.120]

2026-06-25 | Howard-Home | synology/ssh | syno-ssh recipe 'shares' failed (rc=1) [ctx: host=192.168.0.120]

2026-06-25 | Howard-Home | memory-dream | orphan detector mis-parses index lines containing [[wikilink]] text: flags feedback_broken_backlinks_are_writeme_markers.md as orphan despite being indexed (L174), so --apply-safe appends duplicate index lines every run. Fix: match orphan on the ](<filename>.md) link target, not the rendered link text. [ctx: skill=memory-dream file=scripts/memory_dream.py recurring=yes]

2026-06-25 | GURU-5070 | remediation-tool/EOP | [friction] checking ACG own-tenant EOP quarantine: reached for investigator-exo (401 - Exchange Admin role only on Exchange OPERATOR SP, not Investigator), then RecipientAddress needs JSON array not string (400); skill has no EOP/quarantine section at all [ctx: ref=feedback_exchange_role_recurring_gap]

2026-06-25 | GURU-5070 | sync/tailscale | [correction] diagnosed 172.16.3.x unreachable as transient blip; real cause was Tailscale node KEY EXPIRY on the subnet-router node (pfSense advertising 172.16.0.0/22) dropping it off the tailnet [ctx: fix=disabled key expiration on the node; symptom=internet OK but whole 172.16.3.x dead]

2026-06-25 | GURU-5070 | sync/gitea | fetch failed: could not connect to 172.16.3.20:3000 (Gitea unreachable, exit 128) [ctx: host=172.16.3.20:3000 machine=GURU-5070]

2026-06-25 | Howard-Home | remediation-tool/reset-password.sh | JIT cleanup cannot self-remove: after elevating the Tenant Admin SP to Privileged Authentication Administrator to reset a password, the DELETE of that role assignment is performed BY the same SP and Graph blocks it (HTTP 400 'Removing self from built-in role is not allowed'), leaving a STANDING PAA role on the SP - needs a Global Admin/portal removal; script should detect this and surface portal steps instead of a bare WARNING [ctx: tenant=cascadestucson SP=ComputerGuru-Tenant-Admin role=PrivilegedAuthAdmin]

2026-06-25 | Howard-Home | rmm/dispatch | [friction] embedded escaped quotes " , " in a PowerShell -join inside the jq/heredoc dispatch chain caused a parse error (script failed pre-exec, wasted one dispatch); fix: build strings with + concatenation or [char]44, never escaped quotes in RMM PowerShell payloads [ctx: ref=feedback_windows_quote_stripping]

2026-06-25 | Howard-Home | wiki-compile/gururmm | [correction] characterized SPEC-030 software uninstall as SHIPPED/working capability; correct is BETA, merged+deployed but NOT guaranteed to work (many uninstallers fail: AV, Launchy/AIMP, drivers)

2026-06-25 | Howard-Home | remediation-tool | reset-password: failed to remove JIT Privileged Auth Admin role - standing privilege left behind, REMOVE MANUALLY [ctx: tenant=207fa277-e9d8-4eb7-ada1-1064d2221498 assignment=ikzke6-tKk6E1qsmSeCKE6mJ-qU1txBOtmTwQuJl0Tc-1 http=400]

2026-06-25 | Howard-Home | synology/ls | [friction] ls <path> arg mangled by MSYS path-conversion (/Public -> C:/Program Files/Git/Public) before Python sees it; FileStation list also 407-denied for admin anyway. Fix: use call folder_path=/x (= form not converted) or MSYS_NO_PATHCONV=1; real file browsing via SSH backend. [ctx: ref=feedback_tmp_path_windows os=windows]

2026-06-25 | Howard-Home | synology | SYNO.FileStation.List.list failed (code 400) [ctx: err={"code": 400}]

2026-06-25 | Howard-Home | synology | SYNO.FileStation.List.list failed (code 400) [ctx: err={"code": 400}]

2026-06-25 | Howard-Home | synology | SYNO.FileStation.List.list failed (code 400) [ctx: err={"code": 400}]

2026-06-25 | Howard-Home | synology/ssh | syno-ssh recipe 'run' failed (rc=2) [ctx: host=192.168.0.120]

2026-06-25 | Howard-Home | synology | SYNO.FileStation.List.list failed (code 401) [ctx: err={"code": 401}]

2026-06-25 | Howard-Home | synology | SYNO.FileStation.CheckExist.check failed (code 400) [ctx: err={"code": 400}]

2026-06-25 | Howard-Home | synology | SYNO.FileStation.List.list failed (code 400) [ctx: err={"code": 400}]

2026-06-25 | Howard-Home | synology | SYNO.FileStation.List.list failed (code 400) [ctx: err={"code": 400}]

2026-06-25 | Howard-Home | synology | SYNO.FileStation.CheckExist.check failed (code 400) [ctx: err={"code": 400}]

2026-06-25 | Howard-Home | synology | SYNO.FileStation.List.list failed (code 400) [ctx: err={"code": 400}]

2026-06-25 | Howard-Home | synology | SYNO.FileStation.List.list failed (code 400) [ctx: err={"code": 400}]

2026-06-25 | Howard-Home | synology | SYNO.FileStation.List.list failed (code 400) [ctx: err={"code": 400}]

2026-06-25 | Howard-Home | synology | SYNO.FileStation.List.list failed (code 400) [ctx: err={"code": 400}]

2026-06-25 | Howard-Home | synology | SYNO.FileStation.List.list failed (code 400) [ctx: err={"code": 400}]

2026-06-25 | Howard-Home | synology | SYNO.FileStation.List.list failed (code 400) [ctx: err={"code": 400}]

2026-06-25 | Howard-Home | synology | SYNO.Core.Service.list failed (code 103) [ctx: err={"code": 103}]

2026-06-25 | Howard-Home | synology | SYNO.Core.Service.query failed (code 103) [ctx: err={"code": 103}]

2026-06-25 | Howard-Home | synology | SYNO.Core.Service.get_service failed (code 103) [ctx: err={"code": 103}]

2026-06-25 | Howard-Home | synology | SYNO.Core.Service.list_service failed (code 103) [ctx: err={"code": 103}]

2026-06-25 | Howard-Home | synology | SYNO.Core.Service.enum failed (code 103) [ctx: err={"code": 103}]

2026-06-25 | Howard-Home | synology | SYNO.Core.Service.list failed (code 103) [ctx: err={"code": 103}]

2026-06-25 | Howard-Home | bash/reachability-probe | [friction] /dev/tcp TCP probe falsely reported host DOWN on Windows MSYS while device was UP; wasted a cycle. Fix: don't trust /dev/tcp on Git-bash Windows for reachability — use the actual client (python urllib) or curl --max-time.

2026-06-25 | Howard-Home | synology | SYNO.Core.QuickConnect.get failed (code 103) [ctx: err={"code": 103}]

2026-06-25 | Howard-Home | bash/background | [friction] run_in_background shell does not inherit $TMPDIR -> empty path, exit 127; use absolute paths in detached scripts [ctx: ref=feedback_tmp_path_windows]

2026-06-24 | Howard-Home | unifi-wifi/live-stats | [friction] rapid successive controller logins -> HTTP 403 lockout; reuse one session/save JSON instead of re-auth per query [ctx: host=172.16.3.29:11443 site=va6iba3v]

2026-06-24 | Howard-Home | rmm/cascades-cs-server | [correction] led with a 9-day-stale wiki '[CRITICAL] degraded RAID / failing drive' flag and recommended drive replacement (SSDs were purchased, tech went onsite to hot-swap); a LIVE Dell OMSA omreport query then showed the OS mirror had self-recovered and is healthy (all 5 disks Online, all LEDs green), and the '5th unused drive' was actually the global hot spare. Always pull live OMSA/iDRAC before acting on a stale hardware flag; Windows Get-PhysicalDisk cannot see RAID member health. [ctx: ref=feedback_verify_live_before_acting host=CS-SERVER tag=9MQFTK1]

2026-06-24 | Howard-Home | process/client-deliverables | [correction] did not gate outbound client/vendor deliverables through the impeccable skill; rule: run impeccable on anything sent externally

2026-06-24 | Howard-Home | syncro/ticket-create | [correction] created #32193/#32194 with priority 'Normal' instead of Syncro's canonical number-prefixed '2 Normal'; the value did not match the priority dropdown so it displayed blank (Winter flagged it). Always set priority as 'N Name' (e.g. '2 Normal','4 Urgent') AND a valid problem_type (Onsite/Remote/etc.) on every ticket create via the syncro skill. [ctx: ref=syncro-skill priority-format]

2026-06-24 | Howard-Home | rmm/dispatch | [friction] UNC double-backslash in heredoc+jq RMM command got mangled to single backslash (cs-server -> cs-server), causing net use error 67 and net-use hangs that looked like a missing/broken share; single-backslash local paths (D:Shares) were unaffected. Fix: build UNC from [char]92 at runtime ($bs=[char]92; $unc="{0}{0}server{0}share" -f $bs) so no literal backslash traverses the dispatch chain. [ctx: ref=feedback_windows_quote_stripping]

2026-06-24 | GURU-5070 | syncro/billing-prepay | [friction] customer SEARCH endpoint returned prepay_hours=null so preview wrongly said 'no block / $300'; the customer actually had a 20.5h block. ALWAYS read prepay via GET /customers/{id} (full record), never the search-list field [ctx: cust=14232794 ticket=32455]

2026-06-24 | GURU-5070 | unifi-wifi/controller-rest | [friction] CSRF token missed because read via dict(resp.headers) (case-sensitive); UniFi returns X-Csrf-Token mixed-case -> PUT got 403. Use resp.headers.get() (case-insensitive) to capture X-CSRF-Token/X-Updated-Csrf-Token

2026-06-24 | GURU-5070 | unifi-wifi/gw-control block-ips | [friction] block-ips clones an existing WAN_IN rule's schema; if it clones the PPTP GRE rule it creates a DROP rule with proto=gre -> ineffective against TCP/UDP brute-force. Had to PUT protocol=all. Fix: block-ips should force protocol=all on the new rule

2026-06-24 | GURU-5070 | vault/get-field | [friction] get-field <path> password returned a wrong 4-char value (not credentials.password) -> caused 401 login; always use the FULL dotted path credentials.password, don't rely on bare key [ctx: ref=errorlog 2026-06-22 gitea same class; entry=uos-server-network-api-rw]

2026-06-24 | GURU-5070 | agy/ask-gemini | gemini CLI auth/setup failure (throwIneligibleOrProjectIdError, _doSetupUser) - empty response after 3 attempts; needs interactive 'gemini' re-login [ctx: task=factorio-research]

2026-06-24 | GURU-5070 | agy | gemini returned no response (empty after 3 attempts) [ctx: mode=search err=    at process.processTicksAndRejections (node:internal/process/task_queues:104:]

2026-06-23 | Howard-Home | unifi-wifi/gw-sitemanager | Site Manager API call failed (HTTP 403) [ctx: path=/v1/connector/consoles/1C6A1B1BC2470000000008B8D1B50000000009302B160000000067A67E3A:1341833834/proxy/network/integration/v1/sites]

2026-06-23 | Howard-Home | unifi-wifi/gw-sitemanager | Site Manager API call failed (HTTP 403) [ctx: path=/v1/connector/consoles/1C6A1B1BC2470000000008B8D1B50000000009302B160000000067A67E3A:1341833834/proxy/network/self/sites]

2026-06-23 | Howard-Home | unifi-wifi/gw-sitemanager | Site Manager API call failed (HTTP 403) [ctx: path=/v1/connector/consoles/1C6A1B1BC2470000000008B8D1B50000000009302B160000000067A67E3A:1341833834/proxy/network/api/s/default/stat/device]

2026-06-23 | GURU-BEAST-ROG | syncro-emergency-billing | [correction] used onsite emergency rate (62.50) instead of in-shop emergency rate (25.00); correct rates: in-shop=25.00/hr, onsite=62.50/hr

2026-06-23 | GURU-BEAST-ROG | syncro/billing | Syncro API has no delete or update endpoint for line items — add_line_item is the only confirmed write method. Cannot correct a line item price via API; requires manual UI deletion. [ctx: ticket=32447 line_item_id=42988553]

2026-06-23 | GURU-5070 | rmm/vwp-qbs-firewall | [correction] treated VWP-QBS firewall-disabled as an oversight to re-enable promptly; correct: it's intentionally OFF until VWP testing completes - leave it, do not re-flag [ctx: client=valleywide host=VWP-QBS]

2026-06-23 | Howard-Home | unifi-wifi/pfsense-ssh | SSH connect/auth failed (rc=255) [ctx: host=192.168.0.1:22 slug=cascades-tucson act=run]

2026-06-23 | Howard-Home | bash/json-test-data | [friction] Git-Bash heredoc (even quoted <<'EOF') wrote C: as single backslash -> invalid JSON -> PS engine threw 'Unrecognized escape sequence' exit 3; fix: build JSON test files via PowerShell ConvertTo-Json, not bash heredocs [ctx: ref=feedback_tmp_path_windows]

2026-06-23 | GURU-5070 | vault/sops | [friction] sops -e -i run from repo dir not vault dir -> 'no creation rules', wrote SECRET in PLAINTEXT to vault file; fix: cd into vault root (or use --config) before sops -e so .sops.yaml path_regex matches [ctx: ref=vault skill]

2026-06-23 | GURU-5070 | mailbox/graph | POST messageRules 403 ErrorAccessDenied - ComputerGuru Mailbox app (1873b1b0) has Mail.ReadWrite but not MailboxSettings.ReadWrite; inbox-rule creation needs MailboxSettings.ReadWrite [ctx: mbx=rua@azcomputerguru.com]

2026-06-23 | GURU-5070 | discord-dm/screenconnect-ps | [friction] handed Mike a PowerShell one-liner with embedded double-quotes to paste into ScreenConnect's command runner; SC strips the quotes (same CommandLineToArgvW class as curl.exe/plink) so 'native' parsed as a cmdlet and the quoted exe path broke. Fix: for any PS command delivered through a quote-mangling layer (ScreenConnect cmd box, curl.exe, plink), use -EncodedCommand (UTF-16LE base64) — no quotes to strip. [ctx: ref=feedback_windows_quote_stripping]

2026-06-23 | Howard-Home | gururmm/uninstall-engine | [friction] live-tested with -List-shaped targets (which include install_location) -> masked a StrictMode crash that only occurs with the server's UninstallTarget shape (no install_location); always re-test the destructive path with the ACTUAL caller/serialized shape

2026-06-22 | Howard-Home | gururmm/uninstall-engine | [correction] assumed AnyDesk needs remote removal; it has UninstallString '...AnyDesk.exe --uninstall' and supports --silent, so it is silently removable -- added vendor rule

2026-06-22 | Howard-Home | bash/json | [friction] hand-built JSON literal with C: backslashes collapsed to single backslash in Git-Bash (invalid JSON, ConvertFrom-Json failed); fix: build JSON with jq --arg / extract from existing valid json

2026-06-22 | Howard-Home | gitea/pr-api | PR create returned 'invalid token'; vault.sh get-field services/gitea credentials.api-token returned 4 chars (wrong field resolution) [ctx: repo=gururmm endpoint=172.16.3.20:3000]

2026-06-22 | Howard-Home | sync/submodules | [friction] Phase-3 'git submodule update --init --recursive' reset guru-rmm submodule to pinned commit, discarding feature branch + commits mid-build; fix: submodule_update_safe() skips branch/dirty submodules [ctx: ref=sync.sh:525 fixed]

2026-06-22 | Howard-Home | save/wiki-compile | [friction] /save Phase 3 emits 'project:guru-rmm' (from submodule dir name) but canonical wiki article is 'gururmm'; guru-rmm.md is a tombstone redirect. Map guru-rmm -> gururmm in the slug derivation. [ctx: ref=wiki-slug-tombstone proj=guru-rmm]

2026-06-22 | Howard-Home | gururmm/product-direction | [correction] assumed RMM should build native virus/malware removal; correct is: AV products do removal, RMM only monitors AV reports + sends commands to AV products, and RMM's own built-in value is helping techs find issues

2026-06-22 | Mikes-MacBook-Air.local | discord-dm/bot-alerts | [correction] used discord-dm for non-sensitive notification; correct approach: tag users in bot-alerts message (<@userid>) for team notifications, reserve DMs for sensitive info only

2026-06-22 | GURU-5070 | packetdial/vendor-model | [correction] conflated PacketDial/NetSapiens/OIT; correct: PacketDial = ACG's VoIP-dept brand, NetSapiens = the PBX platform, OIT/OITVOIP = white-label wholesaler running NetSapiens (api.ucaasnetwork.com)

2026-06-22 | GURU-5070 | packetdial | HTTP 400 DELETE https://pbx.packetdial.com/ns-api/v2/domains/arizonacomputerguru/number-filters: {"code":400,"message":"The default answering rule cannot be deleted."} [ctx: cmd=unblock-numbers]

2026-06-22 | GURU-5070 | packetdial | HTTP 400 DELETE https://pbx.packetdial.com/ns-api/v2/domains/arizonacomputerguru/number-filters: {"code":400,"message":"The default answering rule cannot be deleted."} [ctx: cmd=unblock-numbers]

2026-06-22 | GURU-5070 | packetdial | HTTP 400 GET https://pbx.packetdial.com/ns-api/v2/domains/arizonacomputerguru/smsnumbers: {"code":400,"message":"Please include "domain" and "dest" or "number" fields"} [ctx: cmd=smsnumbers]

2026-06-22 | GURU-5070 | packetdial | HTTP 400 GET https://pbx.packetdial.com/ns-api/v2/domains/arizonacomputerguru/smsnumbers: {"code":400,"message":"Please include "domain" and "dest" or "number" fields"} [ctx: cmd=smsnumbers]

2026-06-22 | GURU-5070 | packetdial | HTTP 400 POST https://pbx.packetdial.com/ns-api/v2/domains/arizonacomputerguru/timeframes: {"code":400,"message":"All Days of Week timeframes should have at most 1 days of week entry."} [ctx: cmd=create-timeframe]

2026-06-22 | GURU-5070 | packetdial | HTTP 404 GET https://pbx.packetdial.com/ns-api/v2/domains/arizonacomputerguru/devices: {"code":404,"message":"No Route Found [92]"} [ctx: cmd=raw]
2026-06-22 | Howard-Home | guruscan-test | upload failed [ctx: file=GuruScan.psm1 host=DESKTOP-MS42HNC]

2026-06-22 | Howard-Home | guruscan/GuruScan.psm1 | reboot-cleanup task registration fails: -DeleteExpiredTaskAfter on an AtLogOn trigger (no EndBoundary) => task XML invalid HRESULT 0x80041319; also non-terminating CIM error fell through to a false '[OK] task registered'. Fixed: removed DeleteExpiredTaskAfter, added -ErrorAction Stop + post-register verification [ctx: host=DESKTOP-MS42HNC fn=Register-ScannerCleanupTask]

2026-06-22 | Howard-Home | build/pipeline-status | [friction] reported BUG-021 Windows build as still-failing from a build-log snapshot; it had already been fixed (1dce66d) + gone green (v0.6.67) by report time. Re-check the LIVE last-built-commit marker vs origin/main (and the most recent build SUCCESS line, not just the last FAILED line) before asserting build status or escalating a build bug. [ctx: ref=stale-audit-base-friction proj=guru-rmm]

2026-06-22 | Howard-Home | guruscan/GuruScan.psm1 | HitmanPro exit-code misparse: real HitmanPro returns bitmask (exit 5 = 36 threats quarantined + reboot required) but code mapped only {1,2}; reported total_threats=0 reboot_required=False on a real 36-threat removal, so reboot-cleanup lifecycle never fired. Fixed: bit0=threats, bit4=reboot [ctx: host=DESKTOP-MS42HNC engine=HitmanPro-3.8.50]

2026-06-22 | Howard-Home | screenconnect/browser-automation | [friction] HOWARD-HOME: ff.py Firefox daemon won't launch (port 9333 dead, silent 60s timeout) AND cdp.py ModuleNotFoundError 'websocket' (websocket-client not installed) -> can't drive the SC website to build the access installer. Fix: pip install websocket-client; verify playwright firefox installed for ff.py. [ctx: machine=HOWARD-HOME tool=ff.py,cdp.py]

2026-06-22 | Howard-Home | deploy/cpanel | [friction] cPanel deploy served STALE files post-upload (opcache) - page showed only top buttons + api.php 403; fix: opcache_reset via one-off _oc.php hit through external-IP origin path (127.0.0.1 vhost 404s) then browser hard-reload
2026-06-22 | GURU-5070 | bash/cargo-windows | [friction] cargo check on Windows from Git-bash fails to LINK: GNU coreutils link.exe (MSYS) shadows MSVC link.exe on PATH -> 'link: extra operand' on build scripts. Not a code/dep issue. Prepend MSVC bin to PATH or build on the build host. [ctx: ref=windows-msys-path host=GURU-5070]

2026-06-22 | Howard-Home | ssh/windows | [friction] native Windows OpenSSH (System32 ssh.exe) SSH_ASKPASS fails 'CreateProcessW error:193' on a .sh askpass; for non-interactive password auth use MSYS bare 'ssh' (Git-for-Windows) which execs the shell askpass (as pfsense-ssh.sh does)

2026-06-22 | Howard-Home | ssh/php-cli | [friction] inline 'ssh root@host "php -r ..."' mangled (printed PHP usage) — nested bash->ssh->single-quote escaping strips the -r script; ship a base64'd .php file and run 'php file.php' instead [ctx: ref=feedback_windows_quote_stripping]

2026-06-22 | GURU-5070 | coord/purge-bash | [friction] jq-on-Windows emits CRLF: message IDs fed to a curl DELETE loop had trailing CR -> all 208 DELETEs returned HTTP 000 (broken URL). Fixed with tr -d CR + read trim. Repeat of documented gotcha. [ctx: ref=feedback_jq_crlf_windows]

2026-06-22 | GURU-5070 | coord/gururmm-merge-authority | [correction] assumed GuruRMM merges/deploys are Mike-only (held BUG-018 for Mike's go); correct is Howard can handle merges himself

2026-06-22 | Mikes-MacBook-Air.local | coord/check-messages.sh | [correction] broadcasts never marked read on server, only in local seen-file -> repeat on every session [ctx: fix: mark broadcasts read on server like personal messages]

2026-06-21 | Howard-Home | git/submodule | [friction] Did feature work directly in the SHARED guru-rmm submodule working tree while a CONCURRENT Claude session was active in it. The other session switched branches (fix/audit-cleanup -> bugfix/bug-019 -> detached) and repointed my branch ref mid-work, and the working tree ended up with BOTH sessions' uncommitted changes mixed together. Wasted a recovery cycle. FIX: when doing submodule feature work and other sessions may be live (the /save note warns 3-4 sessions share one tree), create an isolated 'git worktree add <path> origin/main' FIRST, do all edits + commit + push-by-SHA there, then 'worktree remove' — never rely on the shared checkout's branch/HEAD surviving. Do NOT 'git checkout --' shared files to clean up (clobbers the other session's uncommitted work). [ctx: ref=git/submodule detached-HEAD + stale-audit friction]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [policies.getPolicyDetails]: Invalid value for 'policyId' parameter. [ctx: cmd=policy]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getManagedEndpointDetails]: Invalid value for 'endpointId' parameter. Expected format: 24-char hex ID [ctx: cmd=endpoint]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getEndpointsList]: Invalid value for 'parentId' parameter. [ctx: cmd=endpoints]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [packages.deletePackage]: The required parameter is missing : packageId [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [packages.deletePackage]: One or more parameters are not expected: packageName, companyId [ctx: cmd=delete-package]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [reports.createReport]: Missing name 'reportingInterval' in 'options' object [ctx: cmd=report-create]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [incidents.createCustomRule]: Invalid value provided for "settings.target" field [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [reports.createReport]: The required parameter is missing : targetIds [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [reports.createReport]: The required parameter is missing : type [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone HTTP 429: <html> <head><title>429 Too Many Requests</title></head> <body> <center><h1>429 Too Many Requests</h1></center> <hr><center>nginx</center> </body> </html> [ctx: cmd=blocklist-remove]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [policies.getPolicyDetails]: Invalid value for 'policyId' parameter. [ctx: cmd=policy]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getManagedEndpointDetails]: Invalid value for 'endpointId' parameter. Expected format: 24-char hex ID [ctx: cmd=endpoint]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getEndpointsList]: Invalid value for 'parentId' parameter. [ctx: cmd=endpoints]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [policies.getPolicyDetails]: Invalid value for 'policyId' parameter. [ctx: cmd=policy]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getManagedEndpointDetails]: Invalid value for 'endpointId' parameter. Expected format: 24-char hex ID [ctx: cmd=endpoint]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getEndpointsList]: Invalid value for 'parentId' parameter. [ctx: cmd=endpoints]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [incidents.createRestoreEndpointFromIsolationTask]: This endpoint cannot be restored from isolation. It is either not isolated, cannot be isolated or a isolation task is already in progress. [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [incidents.createRestoreEndpointFromIsolationTask]: The required parameter is missing : endpointId [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [incidents.createIsolateEndpointTask]: The required parameter is missing : endpointId [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [incidents.createRestoreEndpointFromIsolationTask]: One or more parameters are not expected: endpointIds [ctx: cmd=unisolate]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [incidents.createIsolateEndpointTask]: One or more parameters are not expected: endpointIds [ctx: cmd=isolate]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.assignPolicy]: The 'inheritFromAbove' parameter should not be used with 'policyId' or 'forcePolicyInheritance' parameter. [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.assignPolicy]: You must specify a value for 'policyId' parameter. [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.assignPolicy]: The 'inheritFromAbove' parameter should not be used with 'policyId' or 'forcePolicyInheritance' parameter. [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.assignPolicy]: The 'inheritFromAbove' parameter should not be used with 'policyId' or 'forcePolicyInheritance' parameter. [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.assignPolicy]: The 'inheritFromAbove' parameter should not be used with 'policyId' or 'forcePolicyInheritance' parameter. [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.assignPolicy]: The 'inheritFromAbove' parameter should not be used with 'policyId' or 'forcePolicyInheritance' parameter. [ctx: cmd=assign-policy]

2026-06-21 | Howard-Home | rmm-audit/submodule | [friction] Audit agents read the guru-rmm WORKING TREE which the background auto-sync had pinned at a stale gitlink (2e469f1, 5 commits behind origin/main). One MEDIUM finding (500-body info-disclosure, 17 sites) was ALREADY FIXED in main (commit 58c1a96) — wasted a fix attempt on already-fixed code. FIX: before any audit/analysis that reads the working tree, assert the submodule HEAD == origin/main (git rev-parse HEAD vs origin/main); if behind, checkout origin/main first OR have agents read 'git show origin/main:<file>'. Always re-verify a finding against the real target ref before fixing. Root cause shared with the detached-HEAD friction: submodule pinned behind main + auto-sync resets the working tree to the stale gitlink. [ctx: ref=git/submodule detached-HEAD friction]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.createUninstallSecurityAgentTask]: The requested API method not found. [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getTasksList]: The requested API method not found. [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [packages.createUninstallTask]: The requested API method not found. [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.createRemoveTask]: The requested API method not found. [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.removeClient]: The requested API method not found. [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.uninstallEndpoint]: The requested API method not found. [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.createAgentUninstallTask]: The requested API method not found. [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.createUninstallClientTask]: The requested API method not found. [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.createUninstallTask]: The requested API method not found. [ctx: cmd=raw]

2026-06-21 | Howard-Home | git/submodule | [friction] Commits in the guru-rmm submodule landed on a DETACHED HEAD: a feature branch created via 'git switch -c' kept getting reset to the recorded gitlink commit (likely background auto-sync running submodule checkout in the superproject), so the branch never advanced and 'git push -u origin <branch>' pushed the stale ref. Wasted a full re-diagnose+rebuild cycle. FIX: in submodules under auto-sync, don't trust local branch refs survive across tool calls. Commit, capture sha=$(git rev-parse HEAD), cherry-pick onto the known base if detached, and push by EXPLICIT sha: 'git push origin <sha>:refs/heads/<branch>'; then VERIFY with 'git ls-remote origin <branch>' and a server-side worktree build.

2026-06-21 | Howard-Home | unifi-wifi/pfsense-ssh | SSH connect/auth failed (rc=255) [ctx: host=192.168.0.1:22 slug=clients/cascades-tucson/pfsense-firewall act=showblock]

2026-06-21 | Howard-Home | unifi-wifi/pfsense-ssh | SSH connect/auth failed (rc=255) [ctx: host=192.168.0.1:9999 slug=cascades-tucson act=showblock]

2026-06-21 | Howard-Home | unifi-wifi/pfsense-ssh | SSH connect/auth failed (rc=255) [ctx: host=192.168.0.1:22 slug=cascades-tucson act=showblock]

2026-06-21 | Howard-Home | guruscan/whitelist-design | [correction] over-engineered whitelist as dynamic service-discovery; correct approach is a simple static hard list of install folders (scanners that support exclude-lists ignore listed folders; RKill won't, accepted)

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [policies.getPolicyDetails]: Invalid value for 'policyId' parameter. [ctx: cmd=policy]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getManagedEndpointDetails]: Invalid value for 'endpointId' parameter. Expected format: 24-char hex ID [ctx: cmd=endpoint]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getEndpointsList]: Invalid value for 'parentId' parameter. [ctx: cmd=endpoints]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.createCustomGroup]: The required parameter is missing : groupName [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.createCustomGroup]: One or more parameters are not expected: name [ctx: cmd=make-group]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [policies.getPolicyDetails]: Invalid value for 'policyId' parameter. [ctx: cmd=policy]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getManagedEndpointDetails]: Invalid value for 'endpointId' parameter. Expected format: 24-char hex ID [ctx: cmd=endpoint]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getEndpointsList]: Invalid value for 'parentId' parameter. [ctx: cmd=endpoints]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [policies.getPolicyDetails]: Invalid value for 'policyId' parameter. [ctx: cmd=policy]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getManagedEndpointDetails]: Invalid value for 'endpointId' parameter. Expected format: 24-char hex ID [ctx: cmd=endpoint]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getEndpointsList]: Invalid value for 'parentId' parameter. [ctx: cmd=endpoints]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [push.sendTestPushEvent]: The required parameter is missing : eventType [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [incidents.updateIncidentNote]: The required parameter is missing : type [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [incidents.changeIncidentStatus]: The required parameter is missing : type [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [incidents.deleteCustomRule]: The required parameter is missing : ruleId [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [incidents.createCustomRule]: The required parameter is missing : name [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [quarantine/computers.createRestoreQuarantineItemTask]: The required parameter is missing : quarantineItemsIds [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [quarantine/computers.createRemoveQuarantineItemTask]: The required parameter is missing : quarantineItemsIds [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [packages.getPackageDetails]: The required parameter is missing : packageId [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [integrations.getIntegrationsList]: The requested API method not found. [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [licensing.getMonthlyUsagePerCompany]: The requested API method not found. [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [push.sendTestPushEvent]: The required parameter is missing : eventType [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [incidents.updateIncidentNote]: The required parameter is missing : type [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [incidents.changeIncidentStatus]: The required parameter is missing : type [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [incidents.createCustomRule]: The required parameter is missing : name [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [quarantine/computers.createRestoreQuarantineItemTask]: The required parameter is missing : quarantineItemsIds [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [quarantine/computers.createRemoveQuarantineItemTask]: The required parameter is missing : quarantineItemsIds [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [reports.getReportConfiguration]: The requested API method not found. [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [reports.deleteReport]: The required parameter is missing : reportId [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [reports.getDownloadLinks]: The required parameter is missing : reportId [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [reports.createReport]: The required parameter is missing : name [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [packages.getPackageDetails]: The required parameter is missing : packageId [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [policies.getPolicyDetails]: Invalid value for 'policyId' parameter. [ctx: cmd=policy]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getManagedEndpointDetails]: Invalid value for 'endpointId' parameter. Expected format: 24-char hex ID [ctx: cmd=endpoint]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getEndpointsList]: Invalid value for 'parentId' parameter. [ctx: cmd=endpoints]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [policies.getPolicyDetails]: Invalid value for 'policyId' parameter. [ctx: cmd=policy]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getManagedEndpointDetails]: Invalid value for 'endpointId' parameter. Expected format: 24-char hex ID [ctx: cmd=endpoint]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getEndpointsList]: Invalid value for 'parentId' parameter. [ctx: cmd=endpoints]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [policies.getPolicyDetails]: Invalid value for 'policyId' parameter. [ctx: cmd=policy]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getManagedEndpointDetails]: Invalid value for 'endpointId' parameter. Expected format: 24-char hex ID [ctx: cmd=endpoint]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getEndpointsList]: Invalid value for 'parentId' parameter. [ctx: cmd=endpoints]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.setEndpointLabel]: The required parameter is missing : label [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.uninstallClientTask]: The requested API method not found. [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.createUninstallRoleTask]: The requested API method not found. [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.createUninstallClientTask]: The requested API method not found. [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.createReconfigureClientTask]: The required parameter is missing : targetIds [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.createUninstallTask]: The requested API method not found. [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.createScanTaskByMailboxes]: The requested API method not found. [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getManagedEndpointDetailsByIp]: The requested API method not found. [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getEndpointsByPolicy]: The requested API method not found. [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.setEndpointLabel]: The required parameter is missing : endpointId [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [policies.getPolicyDetails]: Invalid value for 'policyId' parameter. [ctx: cmd=policy]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getManagedEndpointDetails]: Invalid value for 'endpointId' parameter. Expected format: 24-char hex ID [ctx: cmd=endpoint]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getEndpointsList]: Invalid value for 'parentId' parameter. [ctx: cmd=endpoints]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [companies.createCompany]: The required parameter is missing : name [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [companies.activateCompany]: The required parameter is missing : companyId [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [companies.deleteCompany]: The required parameter is missing : companyId [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [companies.getCompaniesList]: The requested API method not found. [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [companies.getCompanyDetailsByUser]: The required parameter is missing : username [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [companies.suspendCompany]: The required parameter is missing : companyId [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [companies.updateCompany]: The requested API method not found. [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [companies.createCompany]: The required parameter is missing : type [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [policies.getPolicyDetails]: Invalid value for 'policyId' parameter. [ctx: cmd=policy]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getManagedEndpointDetails]: Invalid value for 'endpointId' parameter. Expected format: 24-char hex ID [ctx: cmd=endpoint]

2026-06-21 | Howard-Home | guruscan/Download-Scanners.ps1 | exit 1: 'The property Count cannot be found' under Set-StrictMode when $manual/$failed summary has a single row (.Count on scalar) [ctx: host=DESKTOP-MS42HNC stage=download-summary]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getEndpointsList]: Invalid value for 'parentId' parameter. [ctx: cmd=endpoints]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [accounts.deleteAccount]: The required parameter is missing : accountId [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [accounts.updateAccount]: The required parameter is missing : accountId [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [accounts.createAccount]: The required parameter is missing : email [ctx: cmd=raw]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [policies.getPolicyDetails]: Invalid value for 'policyId' parameter. [ctx: cmd=policy]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getManagedEndpointDetails]: Invalid value for 'endpointId' parameter. Expected format: 24-char hex ID [ctx: cmd=endpoint]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getEndpointsList]: Invalid value for 'parentId' parameter. [ctx: cmd=endpoints]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [policies.getPolicyDetails]: Invalid value for 'policyId' parameter. [ctx: cmd=policy]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getManagedEndpointDetails]: Invalid value for 'endpointId' parameter. Expected format: 24-char hex ID [ctx: cmd=endpoint]

2026-06-21 | Howard-Home | bitdefender | GravityZone API error [network.getEndpointsList]: Invalid value for 'parentId' parameter. [ctx: cmd=endpoints]

2026-06-21 | GURU-KALI | remediation-tool/docs-drift | [friction] Mail.Send-already-in-suite kept resurfacing as 'broken/decision-needed' for 4 asks — root cause was gotchas.md saying 'suite has no mail scopes / mailbox BLOCKED' + a 'Decision 2026-06-15 NOT yet executed' block, contradicting feedback-memory line that the suite (exchange-op b43e7342) already holds Mail.Send. Fix: single authoritative truth across all live docs + headline in the feedback memory [ctx: ref=feedback_365_remediation_tool.md commit=f55b8d2]

2026-06-21 | GURU-KALI | mailbox/remediation-tool | [correction] assumed Mail.Send needs a separate app (fabb3421/Claude-MSP-Access); correct is Mail.Send ALREADY EXISTS in the 365 remediation app suite — docs hardwiring the deleted fabb3421 must be purged everywhere [ctx: ref=4th-time-asked]

2026-06-21 | HOWARD-HOME | bitdefender/selftest | [friction] gz.py main() logs EVERY GravityZoneError to errorlog, so selftest bad-id cases + discovery validation-probes (empty/invalid params) auto-spam ~20 expected "errors" per run. Fix: skip _log_skill_error for expected validation/not-found responses, or have selftest/raw set an env flag to suppress logging. [ctx: ref=do-not-log-expected-conditions]

2026-06-20 | Howard-Home | discord-dm/file-upload | [friction] Discord multipart attachment upload: (1) inline -F payload_json={json} -> 400 PAYLOAD_JSON_INVALID; (2) payload_json written to mktemp /tmp file -> Windows curl can't open MSYS /tmp path -> HTTP 000. Fix: write payload_json to a RELATIVE ./file and use -F 'payload_json=<./file;type=application/json' + -F 'files[N]=@path'. discord-dm.sh is text-only; consider adding an --attach flag. [ctx: ref=msys-tmp-path-mismatch tool=curl machine=HOWARD-HOME]

2026-06-20 | Mikes-MacBook-Air.local | harness-guard | [friction] mapfile not available on macOS bash 3.2; guard silently skips all checks [ctx: ref=.claude/scripts/harness-guard.sh line 28; bash 3.2 predates mapfile (bash 4.0); replace with bash 3.2-compatible while-read loop]

2026-06-19 | GURU-5070 | rmm/mspbackups cbb delete | cbb delete -g (generation purge) on Blaster2 Local destination is blocked: 'File deletion on backup storage is restricted due to your service provider policy'. Agent-side deletion of MSP360 backup data is disabled by the provider policy; MBS REST API (api.mspbackups.com) is monitoring-only (no plan/storage delete endpoints, probed 404). Reclaiming local backup space must be done in the MSP360 management console (lift the restrict-deletion policy and let 90-day retention purge, or delete old generations/legacy bunches there). 90-day retention WAS set successfully via cbb editBackupPlan/editBackupIBBPlan. [ctx: machine=GURU-5070 client=jimmy host=Blaster2]

2026-06-19 | GURU-5070 | rmm/onboard vault | [friction] stashed onboard vars in a scratch .env and sourced it; NAME=Jimmy Company (unquoted space) made 'source' exec the 2nd word as a command and left NAME unset -> vault file written with client: null. Fix: quote values when writing the env (printf '%s=%q'), or read back with grep|cut not source. [ctx: machine=GURU-5070 client=jimmy]

2026-06-19 | Howard-Home | ix/whm-api | [friction] WHM /json-api/cpanel UAPI Fileman get_file_content returned empty 'file' param (error: file does not exist); wasted calls. Fix: for IX cPanel file reads/edits use paramiko SFTP with root creds from vault infrastructure/ix-server, not the WHM UAPI file wrapper

2026-06-19 | GURU-5070 | coord/self-check publish | [friction] coord-queue.jsonl queued a census with an MSYS-mangled URL path (/api/coord/... -> C:/Program Files/Git/api/coord/...) AND was git-tracked (not gitignored), so a stale RED census propagated to the repo and could clobber a published GREEN if drained. Fix: gitignore .claude/coord-queue.jsonl; the queue writer must prefix the curl path with the full coord_api base or set MSYS2_ARG_CONV_EXCL/MSYS_NO_PATHCONV to stop path conversion. [ctx: machine=GURU-5070 ref=CLAUDE.md-softfail-queue]
2026-06-19 | Howard-Home | unifi-wifi/gw-sitemanager | find subcommand crashed: GET /v1/hosts -> HTTP 500, then JSON decode traceback (no graceful handling of non-JSON error body) [ctx: client=khalsa cmd=find]

2026-06-19 | Howard-Home | discord-dm | Discord send to howard (DM) failed [ctx: http=400 resp={"message": "Invalid Form Body", "code": 50035, "errors": {"content": {"_errors"]

2026-06-19 | GURU-BEAST-ROG | rmm-search | [friction] rmm-search.sh invoked bare python3 -> MS Store stub on Windows; fixed to use py.sh resolver [ctx: ref=py.sh-broadcast-9b1c5c39]

2026-06-19 | GURU-KALI | git/submodules | [friction] fresh claudetools re-clone: 'git submodule update --init --recursive' failed with 'could not read Username / terminal prompts disabled' for all https://git.azcomputerguru.com submodules; fix = set credential.helper=store GLOBALLY (local-on-superproject does NOT propagate to per-submodule child clone processes). ~/.git-credentials already had the cred. [ctx: ref=reclone-submodule-creds event=2026-06-18-restructure]

2026-06-18 | GURU-5070 | agy/search | gemini CLI threw ineligible/projectId setup error (throwIneligibleOrProjectIdError), empty response after 3 attempts [ctx: mode=search host=GURU-5070]

2026-06-18 | GURU-5070 | agy | gemini returned no response (empty after 3 attempts) [ctx: mode=search err=    at process.processTicksAndRejections (node:internal/process/task_queues:104:]

2026-06-18 | Howard-Home | git/sync-temp-files | [friction] controller-query scratch (.sta.json/.dev.json/.q*) written to repo CWD got swept into the commit by sync.sh 'git add -A', then a stray locked .sta.json blocked the rebase. Fix: write API scratch OUTSIDE the repo (or use the already-ignored .tmp- prefix); gitignored the patterns [ctx: ref=howard-home /tmp friction family]

2026-06-18 | Howard-Home | rmm | [friction] agent returns exit -1 'Failed to execute command' on a ~7KB multi-line powershell body sent as one command; split into <2KB section scripts and each ran fine [ctx: host=DESKTOP-TRCIEJA agent=0.6.66]

2026-06-18 | GURU-5070 | coord/ad2-comms | [correction] tried to coordinate with the AD2 session via coord API msg+lock; AD2 is network-isolated (Gitea only, no coord API) so those were no-ops. ALL inter-session comms with AD2 must go via git /sync (committed notes/docs).

2026-06-18 | GURU-5070 | syncro | comment POST piped straight to jq failed with 'jq: parse error: Invalid numeric literal at line 1 col 10' and left it AMBIGUOUS whether the note posted (GET-verify showed it had NOT); per no-retry rule had to GET first, then re-post. Robust pattern that worked: jq -n payload to a file, POST with --data-binary @file, capture response to a file, then GET-verify by subject. Skill's curl|jq comment pattern should adopt this. [ctx: ticket=32441 skill=syncro pattern=curl-pipe-jq]

2026-06-18 | GURU-5070 | post-bot-alert | Discord POST failed (non-200/unreachable) [ctx: channel=#bot-alerts http=400 resp={"message": "The request body contains invalid JSON.", "code": 50109}]

2026-06-18 | GURU-5070 | ssh/ad2 | [correction] attributed AD2 SSH timeouts to a flaky VPN tunnel + my rapid scp/ssh bursts; real cause = OpenVPN adapter MTU 1500 vs tunnel PMTU ~1424 -> TCP MSS blackhole that drops bulk/scp segments (DF set) while small cmds pass. Fix: tunnel adapter MTU 1400 [ctx: ref=feedback_prefer_ssh_over_rmm]

2026-06-18 | GURU-5070 | bash/env | [friction] /tmp curl-write then Windows-python read mismatch; wrote .claude/tmp + absolute path fixed it [ctx: ref=feedback_tmp_path_windows]

2026-06-18 | Howard-Home | pfsense-ssh/logs | [friction] used clog on pfSense 25.07 logs (now plain-text ASCII) -> empty output -> wrongly concluded DHCP log was empty / dhcpd not serving; cost a hypothesis. Read pfSense 25.07 logs with tail/grep/cat directly, NOT clog [ctx: ref=reference_pfsense_25_07_ops client=cascades-tucson]

2026-06-18 | AD2 | vault | real vault.sh not found at resolved vault_path; vault read failed [ctx: path=D:/vault/scripts/vault.sh]

2026-06-18 | AD2 | vault | real vault.sh not found at resolved vault_path; vault read failed [ctx: path=D:/vault/scripts/vault.sh]

2026-06-17 | GURU-5070 | mailbox/365-mail | [correction] claimed in a prior session that /mailbox skill + memories were repointed off the deleted fabb3421 to the 365-mail suite, but mailbox.md still hardwired fabb3421 (token 401 AADSTS700016). Correct app is the dedicated ComputerGuru Mailbox app 1873b1b0 via get-token.sh 'mailbox' tier (cert auth); repointed mailbox.md + feedback_365_remediation_tool.md 2026-06-17. Lesson: verify the edit actually landed before reporting it done.

2026-06-17 | Howard-Home | wiki-compile/coord | [friction] skill doc Phase 6 shows 'lock release claudetools wiki/<type>/<slug>' but coord.py takes 'lock release <id>'; wasted a round-trip. Capture the lock id from claim output and release by id. [ctx: ref=wiki-compile-skill]

2026-06-17 | Howard-Home | unifi/controller-write | [friction] UniFi OS controller PUT (rest/device port_overrides) returned 403 without CSRF. Fix: login with -D headers, read 'x-updated-csrf-token' (or decode csrfToken from TOKEN cookie JWT), send as X-CSRF-Token on PUT/POST/DELETE

2026-06-17 | Howard-Home | bash/env | [friction] Git-Bash /tmp path mismatch again: msys curl -o /tmp/x.json wrote where Windows python could not read it (FileNotFoundError). Fix: write API JSON to CWD-relative ./.x.json so curl+python share the path [ctx: ref=howard-home known /tmp friction]

2026-06-17 | Howard-Home | pfsense/cascades-voice-vlan | [correction] assumed new RFC1918 alias + DNS-to-firewall:53/123 rules + clone VLAN20 for VOICE isolation; correct is clone the GUEST VLAN (VLAN50/igc1.50, the only actually-isolated net: 3x literal-CIDR quick blocks + pass any) and hand out PUBLIC DNS 8.8.8.8/1.1.1.1 via DHCP. VLAN20 is NOT isolated; config.xml rules were mismapped/not matching live pfctl -sr [ctx: ref=voice-vlan-cutover.md; lesson=read pfctl -sr not just config.xml]

2026-06-17 | GURU-5070 | ssh/plink-windows | [friction] plink -pw with a special-char password through Git-bash -> native plink.exe got MANGLED (CommandLineToArgvW) -> 'Access denied', led to a wrong 'stale cred' conclusion + wasted DMs. The pw was correct. Use system OpenSSH KEY auth (or pass pw via stdin/file), never plink -pw, for special-char passwords on Windows [ctx: ref=feedback_windows_quote_stripping;host=192.168.0.9]

2026-06-17 | GURU-5070 | vault/d2testnas-cred | [correction] CORRECTION: the d2testnas password is NOT stale - it worked for Mike. My plink '-pw' failure was special-char mangling through Git-bash -> native plink.exe (Windows CommandLineToArgvW). Use KEY auth (system OpenSSH) for password-special-char hosts [ctx: ref=feedback_windows_quote_stripping;host=192.168.0.9]

2026-06-17 | GURU-5070 | vault/d2testnas-cred | vaulted clients/dataforth/d2testnas credentials.password REJECTED by 192.168.0.9 (Access denied) - stale/wrong; needs update. Key auth is the reliable path [ctx: host=192.168.0.9]

2026-06-17 | GURU-5070 | agy | gemini returned no response (empty after 3 attempts) [ctx: mode=search err=Attempt 1 failed: You have exhausted your capacity on this model. Your quota wil]

2026-06-17 | GURU-5070 | agy | gemini auth/login failure [ctx: mode=search]

2026-06-17 | Howard-Home | wiki-compile | [friction] Phase 6 release cmd documented as 'coord.py lock release claudetools <resource-path>' but coord.py 'lock release' takes the LOCK ID, not the resource path -> inline release no-ops and strands the lock until TTL. Fix: capture lock id from claim and release by id. [ctx: skill=wiki-compile phase=6]

2026-06-17 | GURU-5070 | grok | grok xsearch incomplete (rc=124); auto-fell back to gemini [ctx: mode=xsearch]

2026-06-17 | GURU-5070 | grok | grok xsearch returned no result [ctx: mode=xsearch stopReason=]

2026-06-17 | GURU-5070 | research-method | [correction] treated blind endpoint-probing as 'authoritative' over web search; Mike: web searches (grok/gemini) have been MORE valuable - they gave the real leads (connector proxy, teleport setting path), probing only confirmed and mostly 404s. Lead with web search; probe only to CONFIRM a search/doc-derived hypothesis [ctx: ref=feedback_interview_ai_read_docs]

2026-06-17 | GURU-5070 | bash/background-ai | [friction] mixing a backgrounded ask-grok/ask-gemini ('&' + wait) with foreground curl probes in ONE Bash command repeatedly yields an EMPTY output capture; run AI calls as separate run_in_background Bash tool calls, never '&'+wait inline with work to capture [ctx: ref=grok/gemini wrappers]

2026-06-17 | GURU-5070 | agy | gemini returned no response (empty after retry) [ctx: mode=search err=Ripgrep is not available. Falling back to GrepTool.]

2026-06-17 | GURU-5070 | grok | grok xsearch returned no result [ctx: mode=xsearch stopReason=]

2026-06-17 | GURU-5070 | grok | grok xsearch returned no result [ctx: mode=xsearch stopReason=]

2026-06-17 | GURU-5070 | grok | grok xsearch returned no result [ctx: mode=xsearch stopReason=]

2026-06-17 | Howard-Home | unifi-wifi/apply-radio | [friction] per-AP --apply loop: each call re-logs-in to the controller; rapid succession throttles -> write silently skips (no [ok]). Fix: space calls (sleep 3-4) or add multi-AP/one-login support

2026-06-17 | Howard-Home | wiki-compile | [friction] full recompile Sonnet subagent ran ~54min then crashed on 32k output cap (tried to emit the ~490-line article despite being told to write-to-file and return only a summary); recovered via direct surgical Edits to the existing article. Fix: for --full on large existing articles, prefer targeted Edit integration over a subagent rewrite, or hard-cap/forbid article body in the subagent reply. [ctx: skill=wiki-compile target=client:cascades-tucson]

2026-06-17 | GURU-5070 | grok/ask-grok.sh | [correction] blindly probed grok with slow timed runs to find the xsearch syntax instead of reading its bundled docs (~/.grok/docs/user-guide/ + README.md) / interviewing the model first; the docs gave the root cause directly (web_search=grok-4.20-multi-agent multi-agent model, killed by --no-subagents) [ctx: ref=feedback_interview_ai_read_docs]

2026-06-17 | GURU-5070 | grok | grok xsearch returned no result [ctx: mode=xsearch stopReason=]

2026-06-17 | GURU-5070 | grok | grok xsearch returned no result [ctx: mode=xsearch stopReason=]

2026-06-17 | GURU-5070 | grok/xsearch | xsearch returned empty (stopReason finalization quirk) on Grok-co-work research; fell back to text-mode design + Claude synthesis [ctx: topic=grok-as-claude-cowork]

2026-06-17 | GURU-5070 | grok | grok xsearch returned no result [ctx: mode=xsearch stopReason=]

2026-06-17 | GURU-5070 | syncro/customer-comment | [friction] posted a customer-facing emailed comment to #32333 WITHOUT previewing for human review first; preview-before-send is mandatory for ALL outgoing comms [ctx: ref=CLAUDE.md syncro 'Before any POST: Always show the full payload and wait for confirmation']

2026-06-17 | GURU-5070 | syncro/customer-comment | [correction] conflated Arizona Medical Transit (AMT-PC, Windows: Dell bloatware + misbehaving Syncro agent) cleanup into the Scileppi Mac (#32333) customer comment; Scileppi was a full-disk/Trash + Mail + Downloads-redesign job, no Dell/agent work [ctx: ticket=32333 mac=scileppi]

2026-06-16 | GURU-5070 | grok | grok xsearch returned no result [ctx: mode=xsearch stopReason=]

2026-06-16 | GURU-5070 | rmm/shell-quoting | [friction] shutdown /r /t 60 /c "comment" FAILED via command_type=shell: embedded double-quotes in the command got mangled through the agent cmd layer, shutdown rejected the args and dumped usage. Fix: avoid embedded double-quotes in RMM shell commands (drop /c, or build the quoted arg another way) [ctx: ref=bash/curl.exe-on-windows quote-stripping; agent=AMT-PC; cmd=shutdown]

2026-06-16 | GURU-5070 | syncro/billing | [friction] billed AMT as non-prepaid off the customer-SEARCH endpoint prepay=null; real prepay (detail endpoint) was 7.0 -> invoice correctly netted $0 via block, but I set the wrong (upsell) invoice note. Always read prepay from /customers/{id} detail, not the list/search [ctx: ref=syncro_invoice_verification_pattern;cust=7088349]

2026-06-16 | GURU-5070 | rmm/onboarding-diagnostic | onboarding-diagnostic.ps1 fails on Win7/PowerShell 2.0: uses [ordered] hashtables (PS3+) -> 'Unable to find type [ordered]', empty DIAG-JSON, no grade. Probe not PS2/legacy-compatible -> can't diagnose Win7/2008R2 legacy agents (first hit: AMT-PC)

2026-06-16 | GURU-5070 | rmm-diagnose | could not extract valid diagnostic JSON from probe output [ctx: host=AMT-PC status=completed exit=0]

2026-06-16 | GURU-5070 | mailprotector/starrpass | [correction] assumed starrpass.com was on Mailprotector; correct: starrpass.com is direct-to-MS (EOP/Defender) - Starr Pass MP account 16170 covers ONLY devconllc.com. Check @starrpass.com mail via remediation-tool/EOP

2026-06-16 | GURU-5070 | mailprotector | HTTP 404 POST https://emailservice.io/api/v1/users/find_by_address: "Not found" [ctx: cmd=find-user]

2026-06-16 | Howard-Home | bash/curl.exe-on-windows | [friction] PowerShell-invoked curl.exe strips embedded double-quotes from --data-urlencode args (CommandLineToArgvW), silently mangling POST bodies; pfSense PHP became 'echo PHPRUNS-OK' -> 'Undefined constant'. Fix: write payloads with single-quotes only, build $ via [char]36, keep one line. [ctx: ref=pfsense diag_command.php php-exec; cost=4 wasted RMM round-trips]

2026-06-16 | GURU-5070 | remediation-tool/get-token | [friction] get-token.sh reads vault_path from ~/.claude/identity.json (home), which lacks the field on this machine; repo identity.json (.claude/identity.json) has it. Fix: export VAULT_ROOT_ENV=$(jq -r .vault_path .claude/identity.json) before calling get-token [ctx: ref=remediation-tool;machine=GURU-5070]

2026-06-15 | GURU-5070 | rmm/quickbooks-folderbrowser | [correction] assumed F:FolderRedirection was a dead/missing drive (Test-Path F: = False under SYSTEM); correct: F: is a per-user NETWORK-mapped redirected folder, invisible to the SYSTEM context RMM runs in - must diagnose mapped-drive/redirect issues in user_session

2026-06-15 | GURU-5070 | rmm | ProfWiz Pro silent-install command returned 'Execution error: Failed to execute command' (status failed, no stdout) on SP-SharonW11 [ctx: agent=86de13d7 host=SP-SharonW11 task=upw-install]

2026-06-15 | GURU-5070 | remediation-tool (Starr Pass licensing) | [correction] reported Brian Shinn's account as DELETED (tied it to the recycle-bin bshinn@ from 6/10 onboarding); actually Mike UNLICENSED Brian in M365 - account not deleted. Don't conflate a soft-deleted recycle-bin entry with the user's recent action; check the ACTIVE account's assignedLicenses for an unlicense

2026-06-15 | GURU-5070 | grok | grok xsearch returned no result [ctx: mode=xsearch stopReason=]

2026-06-15 | GURU-5070 | grok | grok xsearch returned no result [ctx: mode=xsearch stopReason=Cancelled]

2026-06-15 | GURU-5070 | graduation-pipeline (BEAST Ollama) | [friction] BEAST Ollama ran inference on CPU (api/ps showed qwen3:32b AND qwen3:14b with vram=0); 32b timed out at 240s, 14b at 175s. GPU not engaged - the 'use BEAST GPU' premise needs a BEAST-side Ollama GPU config/driver fix before large-model triage is practical

2026-06-15 | GURU-5070 | graduation-pipeline (BEAST env) | [friction] assumed BEAST uses WSL because 'bash' there resolved to the WindowsApps WSL stub (uname said WSL2). BEAST runs the harness under Git-for-Windows MSYS bash like other Windows boxes; reach its Ollama via localhost (Git-bash) or the Tailscale IP. REPEAT of the documented WSL-stub-vs-Git-bash gotcha [ctx: ref=feedback_windows_bash_mapping]

2026-06-15 | GURU-5070 | tmp-promotion-check (/save,/scc) | [friction] hung for minutes: line 51 ran 'grep -rqlF <f> projects/' per scratch file, recursing Rust target/, node_modules/, .git in the guru-rmm/guru-connect submodules. Fixed: --include='*.md' + --exclude-dir for heavy trees. Stalled the /save sync behind it

2026-06-15 | GURU-5070 | memory-dream (--apply-safe) | flagged feedback_broken_backlinks_are_writeme_markers.md as an orphan and appended a DUPLICATE index line though it already had one — orphan detector likely keys on the frontmatter name: slug, not the (file.md) link target. Fix the index-line matching to compare by filename [ctx: mode=apply-safe]

2026-06-15 | GURU-5070 | powershell/var-case | [friction] PowerShell vars are case-INSENSITIVE: $gUid silently overwrote $guid (GPO id), Set-ADObject hit a bad DN and left GPT.ini/AD versionNumber inconsistent until fixed. Never rely on case to distinguish PS variables

2026-06-15 | GURU-5070 | python/argv-limit | [friction] passed full /api/agents JSON (248 agents) as a python CLI arg -> 'Argument list too long' on Windows. Pipe large payloads via stdin, not argv

2026-06-15 | GURU-5070 | bash/env-persist | [friction] re-derived RMM token every call after $TOKEN/$RMM vanished between Bash tool calls - shell env does NOT persist across calls; must re-eval auth (or chain) in the same command

2026-06-15 | GURU-5070 | bash/tmp-path | [friction] wrote curl -o /tmp/x.json then jq read it back and failed (No such file) - Git-Bash vs Write/tool /tmp resolve differently. Pipe directly or use repo-relative paths. REPEAT of documented gotcha [ctx: ref=feedback_tmp_path_windows]

2026-06-15 | GURU-5070 | DMARC / DNS | [correction] assumed ACG's own INKY rua convention (reports-sg.inkydmarc.com) applied to a client domain; only use the INKY rua if THAT client is onboarded to INKY - otherwise plain p=none or a real mailbox

2026-06-15 | GURU-5070 | remediation-tool (sendMail) | [correction] assumed none of the consented apps could send mail and started granting Graph Mail.Send; the Exchange Operator app ALREADY had Graph Mail.Send - I was decoding the EXO-audience token, not a Graph-audience token. Mint a Graph token for the app before concluding a permission is missing

2026-06-15 | GURU-5070 | rmm-search | [correction] assumed the CLI search must replicate the UI Omnibox scoreMatch exactly; user wants a FLEXIBLE forgiving multi-field search optimized for first-try correctness, not UI parity


2026-06-15 | GURU-BEAST-ROG | /syncro (comment edit) | Syncro API does not expose a comment-edit or comment-delete endpoint — once posted, comments can only be modified via the GUI. Bot posted an internal resolution note with an unwanted "Performed by: ClaudeTools Discord Bot" line and could not remove it programmatically. Remediation needed: either suppress bot-attribution lines from internal notes by default, or add a GUI-edit step to the workflow when the note needs correction.

2026-06-14 | GURU-5070 | mailbox skill (Graph token) | FABB app `fabb3421` (Claude-MSP-Access / "Cloud MSP Access") token request returned AADSTS700016 — app/SP no longer present in azcomputerguru.com tenant (deleted; gotchas.md already marked it deprecated). Blocks /mailbox + the M365 contacts task. Verified the remediation suite (live, ACG tenant) carries NO Mail.Send/Mail.ReadWrite/Contacts scopes (investigator has Mail.Read only) — so a straight repoint can't restore mailbox-send/contacts. Pending Mike decision: stand up a single-tenant ACG-internal mailbox app vs. add scopes to a suite tier. [2026-06-15] Docs hardened — gotchas.md now marks fabb3421 DELETED with the Mail/Contacts-scope blast radius + flags the 3 legacy "old app only" tenants (Valleywide/Dataforth/Cascades) as now having NO working remediation app (migration URGENT); mailbox.md carries a BLOCKED/AADSTS700016 banner. DECISION 2026-06-15 (Mike): Mail.Send goes into the suite (Exchange Operator tier) since its real use is IR victim-notification during mailbox takeovers; add Mail.Send to the exchange-op manifest + consent, repoint mailbox.md to exchange-op. Implementation not yet executed (production app change, needs go).

2026-06-14 | GURU-KALI | coord skill (coord.py) | Documented invocation `py .claude/skills/coord/scripts/coord.py ...` failed exit 127 — `py` (the Windows py-launcher) does not exist on Linux. Worked around with `python3`. [RESOLVED 2026-06-14] Added `.claude/scripts/py.sh` (resolves the working interpreter: identity.json `python.command` -> py -> python3 -> python, skipping the MS Store shim) and repointed all skill/command DOC invocations from bare `py` to `bash "$CLAUDETOOLS_ROOT/.claude/scripts/py.sh"`. The `.sh` skill scripts already resolved internally — left untouched. Broadcast to fleet.

2026-06-14 | GURU-BEAST-ROG | coord skill (coord.py msg send) | `py "$CLAUDETOOLS_ROOT/.claude/skills/coord/scripts/coord.py"` failed — `$CLAUDETOOLS_ROOT` is not exported in fresh Git-bash shells here, so the path resolved under `C:\Program Files\Git\`. [RESOLVED 2026-06-14] Added `.claude/scripts/ensure-settings-env.py` (seeds `env.CLAUDETOOLS_ROOT` in per-machine `settings.local.json` from `identity.json`); Claude Code injects it into every Bash call. Wired into ONBOARDING.md + broadcast to fleet. Effective next session start.

2026-06-14 | GURU-BEAST-ROG | /sync (sync.sh Phase 3, submodule update) | submodule `projects/msp-tools/guru-rmm` checkout of f38da05 aborted: untracked `docs/RMM_THOUGHTS.md` would be overwritten. Parent repo synced fine; submodule pointer left lagging. Recurring transient. [RESOLVED 2026-06-15] sync.sh now has `resolve_submodule_collisions()` — on the abort it moves only the untracked files the incoming commit tracks aside to `<file>.synced-aside-<UTCstamp>` (content preserved, NOT --force) then retries once. Verified live: guru-rmm advanced ed92097->f38da05; the aside copy held 94 lines of un-committed 2026-06-08 thoughts (rescued, not lost — needs manual merge into canonical RMM_THOUGHTS.md).
2026-06-16 | HOWARD-HOME | unifi-wifi/device-control.sh provision | cmd/devmgr force-provision returned HTTP 400 (mac 0c:ea:14:3f:40:6d / AP 445); verb needs fix — likely wrong cmd name or requires device _id not mac. block/kick/locate via stamgr work; adopt/restart/upgrade unverified.
