## User
- **User:** Howard Enos (howard)
- **Machine:** Howard-Home
- **Role:** tech

## Session Summary

Reviewed a batch of 31 Syncro tickets one-by-one, cross-referencing each against the repo's
wiki/session-log history to determine status and surface anything unresolved. Produced a grouped
findings report: (A) done & invoiced, (B) work-done-but-status-stale, (C) genuinely open needing
diagnosis, (D) open task tickets with clear scope, (E) flags needing attention. Standout flags:
ticket #32211 (Jesse Trapp — "opened malicious email, now sending malicious email") was invoiced
with ZERO documented remediation (likely-compromise, no pw reset / inbox-rule / forwarding audit
recorded); #31947 Dataforth customer-reply announcing Joel Lohr retirement 3/31 → new contact Dan
Center; a recurring electrical/UPS theme across unrelated clients (Horseshoe #32256, Rincon Vista
#32398, High Tech #32179).

Billed ticket #31953 (AT Trebesch — EarthLink address-book / PST contact consolidation). Added 1.0
hr Remote Business labor ($150, no prepaid block), posted a customer-visible Resolution comment
describing the multi-day export → consolidate → de-dupe → recover notes/phone/address → re-import
work, generated invoice #1650785061 ($150.00) with the no-block upsell note, and marked the ticket
Invoiced. The Syncro record now matches the work; the AT Trebesch wiki still lists #31953 as
"in progress — awaiting Howard" and should be reconciled on next wiki-compile.

Folded the 7 open Cascades tickets (#32193, #32194, #32230, #32254, #32319, #32342, #32370) into the
existing Cascades engagement rather than treating them as standalone one-offs — they map onto the
established workstreams (machine/user deployment into cascades.local + network/HIPAA lockdown).
Created tracked todos #1–#7 and added an "Open Syncro Tickets" table to the Cascades
`PROJECT_STATE.md` Pending/Next-Up section, with a note that the rich current-state truth lives in
the 2026-06-23 wiki compile (PROJECT_STATE's lower sections predate the Entra/RF/voice work).

## Key Decisions

- Reported findings on all 31 tickets first (per Howard) and posted nothing un-asked; visibility of
  any future "Diagnosis" comments decided per-ticket rather than blanket.
- #31953 comment posted customer-visible WITH email (it's a resolution the client should see);
  billed only 1.0 hr despite multi-day effort (Howard's call).
- The 7 Cascades tickets were wrapped into the master plan (PROJECT_STATE + todos) instead of
  diagnosed individually, because Howard wants to finish them as part of the broader Cascades
  build-out (domain machine/user setup + security/HIPAA network lockdown).
- Treated `wiki/clients/cascades-tucson.md` (2026-06-23) as the authoritative current state;
  PROJECT_STATE.md (was 2026-04-28) is stale below the new Open-Tickets section.

## Problems Encountered

- None functional. Noted a data-integrity flag (not an error): #32211 invoiced with no remediation
  documentation — open security exposure to confirm/close separately.

## Configuration Changes

- Created: `clients/cascades-tucson/session-logs/2026-06/2026-06-24-howard-ticket-review-and-cascades-consolidation.md` (this log)
- Modified: `clients/cascades-tucson/PROJECT_STATE.md` — added "Open Syncro Tickets" table to Pending/Next-Up; updated Last-updated header to point at the 2026-06-23 wiki as current truth.
- Syncro #31953 (id 105636717): added Resolution comment (420528175), labor line item (42997785), invoice 1650785061, status → Invoiced.
- Created 7 session todos (#1–#7) for the open Cascades tickets.

## Credentials & Secrets

None discovered or created this session.

## Infrastructure & Servers

- AT Trebesch — Syncro customer 238740; no prepaid block (prepay_hours 0.0); remote rate $150/hr (product 1190473).
- Cascades — Syncro customer 20149445; CS-SERVER 192.168.2.254 (cascades.local DC/file server); cascadesds Synology 192.168.0.120 (ALDOCS share); UOS site `va6iba3v`.

## Commands & Outputs

- Ticket pull: `GET /tickets?number=<n>` → id, then `GET /tickets/<id>` (strip control chars with `tr -d '\000-\037'`).
- #31953 billing executed via heredoc `--data-binary @-` per syncro skill: comment → add_line_item (1.0 @ 150) → invoices → PUT note → PUT status Invoiced → post-bot-alert (message_id 1519365754842124439).

## Pending / Incomplete Tasks

- **Cascades open tickets (todos #1–#7)** — execute as part of the engagement:
  - #32194 deploy spare machine for new hire (target user TBD)
  - #32193 restricted shared drive Ashley + Meredith (confirm Ashley's last name)
  - #32230 Karen Rossini ALDOCS access on Synology
  - #32254 Chef-PC Windows reinstall
  - #32370 eFax + scanner for Karen & Christin
  - #32319 WiFi Room 343 (relocate floor-2/4 AP)
  - #32342 switch in Copy Room
- **#32211 Jesse Trapp** — confirm whether the malicious-email compromise was actually remediated; if not, run remediation-tool (mailbox rules/forwarding/sign-in audit) + password reset. Open security exposure.
- **B-group status cleanups:** #31953 wiki reconcile (mark closed); #32380 Sif-oidak (work done by Mike — bill/close); #32229 Mineralogical (close); #31947 Dataforth contact update (Dan Center).
- **C-group still to diagnose:** #32138 Bruce Thompson (possible infection), #32160 AT Trebesch (assess for threats — pairs with /rmm diagnose on agent ba173f0c), #32202 Arizona Medical Transit (can't access email — verify AMT still active per 2026-06-02 cancellation log).
- **Broader Cascades plan finish items** (from wiki 2026-06-23): caregiver lockdown Monday go-live (GPO filter swap + CA allow-list to SG-Caregivers), M365 31-user Business Standard→Premium relicense, CS-SERVER degraded RAID-1 replacement, voice 5GHz-lock awaiting Vertical, KPI dashboard scoping.

## Reference Information

- Tickets reviewed: 31767, 31771, 31794, 31849, 31889, 31947, 31953, 32021, 32023, 32030, 32138, 32160, 32179, 32193, 32194, 32202, 32203, 32211, 32229, 32230, 32254, 32256, 32319, 32342, 32370, 32380, 32397, 32398, 32443.
- #31953 invoice: https://computerguru.syncromsp.com/tickets/105636717 — invoice 1650785061 ($150.00).
- Cascades plan: `clients/cascades-tucson/PROJECT_STATE.md`; current truth: `wiki/clients/cascades-tucson.md` (compiled 2026-06-23).

---

## Update: 10:20 PT — #32193 built/billed, drive-map troubleshooting, Syncro priority sweep

### Session Summary (continued)

Built and billed Cascades #32193 (restricted Ashley + Meredith share), fixed a Syncro
priority-format issue Winter flagged, swept recent tickets, and resolved a drive-map visibility
problem on Ashley's machine — then verified Meredith's.

**#32193 — restricted Executive share (DONE + billed).** Recon on CS-SERVER confirmed AD accounts
`CASCADES\Ashley.Jensen` + `CASCADES\Meredith.Kuhn` (both Enabled, OU=Administrative) and the
share convention (`D:\Shares\<name>`, CS-SERVER-local). Created `D:\Shares\Executive` + SMB share
`Executive`: inheritance off, NTFS = SYSTEM + Administrators (Full) + the two users (Modify);
share-access limited to the two + Administrators. Mapped `E: -> \\cs-server\Executive` (persistent)
on both ASSISTMAN-PC (Meredith) and DESKTOP-U2DHAP0 (Ashley); read+write verified on both. Billed
0.5 hr remote from the prepaid block: invoice #1650785728 $0.00, block 48.75 -> 48.25 (verified),
note "Block hours remaining: 48.25.", ticket -> Invoiced.

**Drive-map "not visible" troubleshooting (Ashley).** After mapping, Ashley reported not seeing E:.
Two root causes found and fixed: (1) UNC double-backslashes were eaten to single in the
heredoc->jq->agent->PowerShell dispatch chain, so `net use \\cs-server\Executive` 67'd / hung —
fixed by building the UNC from `[char]92` at runtime. (2) The map was correctly mounted in her
session (confirmed user_session SID 1 == explorer.exe SID 1, `Test-Path E:\` True, persistent
`HKCU\Network\E`), but her already-running Explorer hadn't refreshed to show a programmatically
added drive. Fired `SHChangeNotify(SHCNE_DRIVEADD)` in session 1 to surface it without disruption;
applied the same to Meredith. Verified Meredith's E: read+write end-to-end (wrote/read/deleted a
test file). `cascades\ashley.jensen` is a standard user (Medium integrity), so no token split.

**Syncro priority fix + sweep (Winter feedback).** Winter flagged that some Claude-touched tickets
weren't getting priority/type. Audited: only #32193/#32194 (created 2026-04-22) had bare `Normal`
instead of canonical `2 Normal` (renders blank in UI) — fixed both to `2 Normal` (types were valid).
Swept all tickets created since 2026-06-01 (99): no other Claude-created malformed-priority tickets;
the 20 blank-priority ones are auto-ingested email/portal/integration tickets (payment notices,
calendar invites, CloudBerry, From Portal) = Winter's triage queue, left untouched per Howard. Did
NOT apply priority/type to the 4 genuine open service tickets (Howard declined).

### Key Decisions (continued)

- Named the share `Executive` (Exec Director + Asst Exec Director tier); direct NTFS ACL on the two
  named users rather than a new SG group (2-person static restricted share).
- Billed #32193 at 0.5 hr remote from the block (Howard's call); invoice $0.00 is correct (prepaid).
- Left the 20 blank-priority auto-ingested tickets and the 4 open service tickets alone (Howard's call)
  — only fixed the two genuinely malformed Claude-created tickets.

### Problems Encountered (continued)

- **UNC `\\` mangled to `\` in RMM dispatch** — looked like a missing/broken share (error 67 / hangs).
  Fixed by constructing UNC from `[char]92`. Logged as `--friction`; memory `reference_rmm_drive_map_explorer_refresh`.
- **Mapped drive not shown in user's Explorer** — drive was mounted in her session; Explorer hadn't
  refreshed. Fixed with `SHChangeNotify(SHCNE_DRIVEADD)` in-session. An interactive scheduled task
  (`LogonType Interactive`) to remap returned LastTaskResult=2 and did not help.
- **Syncro priority `Normal` vs `2 Normal`** — bare word renders blank; Winter flagged. Fixed both
  tickets; logged `--correction`; memory `feedback_syncro_priority_type_format`.

### Configuration Changes (continued)

- CS-SERVER: created `D:\Shares\Executive` + SMB share `Executive` (NTFS/share scoped to Ashley.Jensen + Meredith.Kuhn + admins/SYSTEM).
- DESKTOP-U2DHAP0 + ASSISTMAN-PC: persistent `E: -> \\cs-server\Executive` mapped + shell-notified.
- Syncro: #32193 resolution comment (420541806), line item (42998855), invoice 1650785728, status Invoiced; #32193/#32194 priority -> `2 Normal`.
- New memories: `feedback_syncro_priority_type_format.md`, `reference_rmm_drive_map_explorer_refresh.md` (+ MEMORY.md index lines).
- errorlog.md: 1 `--friction` (UNC mangling), 1 `--correction` (priority format).

### Infrastructure & Servers (continued)

- CS-SERVER agent id `c39f1de7-d5b6-45ae-b132-e06977ab1713`; IPs 192.168.2.248 (registered DNS `cs-server.cascades.local`, idx 16, Ethernet) + 192.168.2.254 (idx 4, Hyper-V vEthernet — does NOT cleanly serve SMB to clients). No DFS namespace.
- ASSISTMAN-PC (Meredith) agent `cf86fa5e-96a2-494d-9cb1-8be22a518ad0`; logged in as LOCAL `assistman-pc\meredithk` but authenticates to cs-server as her domain identity.
- DESKTOP-U2DHAP0 (Ashley) agent `636cfd2e-3fce-4e5c-b237-e2bd4acce8e1`; `cascades\ashley.jensen` standard user (Medium), console session 1.

### Pending / Incomplete Tasks (continued)

- Optional: confirm with Ashley she now sees E: in Explorer (shell-notified; logoff/logon or F5 is the guaranteed fallback).
- Remaining batch unchanged: 32211 (security — next), 32160, 32202, 32380, 32229, 31947; onsite-deferred 32230 (Karen out)/32194/32254/32319/32342/32370/32021.

### Reference Information (continued)

- #32193 invoice 1650785728 ($0.00, prepaid); ticket https://computerguru.syncromsp.com/tickets/109316877
- Share: `\\cs-server\Executive` = `D:\Shares\Executive`; drive `E:` both machines.

---

## Update: 12:17 PT — priority sweep, consolidated plan, device-readiness audit, wiki compile, #32230 billed

### Session Summary (continued)

Resolved Winter's priority-format flag, built a consolidated Cascades execution plan from a live
AD+RMM domain-join diff, audited device-readiness, recompiled the Cascades wiki, validated the
remaining-work priorities against the wiki, and billed two more tickets.

**Syncro priority fix + sweep.** Winter flagged tickets not getting priority/type. Audit: only
#32193/#32194 (created 2026-04-22 by Claude) had bare `Normal` instead of canonical `2 Normal`
(renders blank). Fixed both. Swept all tickets since 2026-06-01 (99) — no other Claude-created
malformed-priority tickets; the 20 blank-priority ones are auto-ingested email/portal/integration
(Winter's triage queue), left alone per Howard. Logged `--correction` + memory `feedback_syncro_priority_type_format`.

**Closed two tickets (no bill).** #32160 AT Trebesch "assess for threats" → Resolved (scanned PC +
removed apps from iPhones). #32138 Bruce Thompson "possible infection" → closed, assumed resolved,
no record of work. #32211 Jesse Trapp dropped (residential Gmail, already closed/invoiced; not our
M365 remediation scope). Handed #32380/#32229/#31947 cleanups to Winter via Discord.

**Consolidated plan + device readiness.** Built `docs/REMAINING-WORK-PLAN.md` (7 workstreams) from a
live AD+RMM diff: 12 staff PCs domain-joined, ~17 to migrate. Device-readiness probe of 15 un-joined
online machines found the headline blocker: **5 machines on Windows Home cannot domain-join until
Pro** (LAPTOP-8P7HDSEI, MDIRECTOR-PC, MEMRECEPT-PC, NurseAssist, SALES4-PC) — Howard handling the
Home→Pro upgrades (DM'd). 2 OneDrive-KFM machines need unlink; pending reboots held for onsite;
LAPTOP-DRQ5L558 off-network. Caregiver go-live deferred (Howard) until all devices domain-ready.

**Wiki compile (full, surgical).** Sonnet subagent hit the 32k output cap on the 575-line article,
so folded the 2026-06-24 delta into the existing article via staged surgical edits (prepay 48.25,
6 open tickets, Executive share, device-readiness audit, plan pointer, History + Compilation notes).
Lock 88747ef8 claimed/released; index updated; committed 5c77b88.

**Priority re-check (Howard request).** Verified live: CS-SERVER up/stable since 6/23 07:32 (outage
recovery succeeded — wiki "bring-up pending" was stale). Windows shows virtual disks Healthy but the
PERC-level degraded mirror is invisible to the OS — RAID risk stands. MSP360 services running but
first-full SUCCESS not confirmed. Flagged backup-verify→RAID and M365 relicense (31 users
Standard→Premium, SUSPENDED) as the higher-risk remote items that outrank the onsite batch on risk.

**Billed #32230** (Karen Rossini → ALDOCS, Howard fixed it): 0.5h remote from block, invoice
#1650788180 $0.00, block 48.25→47.75, Invoiced. **New onsite work (Howard):** Memory Care front-desk
machine battery backup + MC switch rack-mount UPS — billing pending (task #8; needs ticket + UPS
cost + labor).

### Configuration Changes (continued)

- New: `clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md`; PROJECT_STATE.md pointer added.
- Wiki: `wiki/clients/cascades-tucson.md` (surgical full recompile, last_compiled 2026-06-24) + `wiki/index.md` row.
- New memories: `feedback_syncro_priority_type_format.md`, `reference_rmm_drive_map_explorer_refresh.md`.
- Syncro: #32193/#32194 priority→`2 Normal`; #32160 Resolved (no bill); #32138 Resolved (no bill); #32230 billed (invoice 1650788180); #32193 billed earlier (1650785728).
- Tasks: #1–#8 (Cascades open tickets + battery-backup pending). #2/#3 completed.

### Pending / Incomplete Tasks (continued)

- **Battery backup billing (task #8):** MC front-desk UPS + MC switch rack-mount UPS — get UPS model/cost + onsite minutes from Howard, open a ticket, bill. Distinct from #32443 (Tower).
- **Higher-risk remote (re-ranked up):** verify CS-SERVER backup first-full → schedule RAID-1 replacement; M365 relicense 31 users.
- **Onsite batch (Howard today):** #32194, #32254, #32319, #32342, #32370. **Home→Pro:** 5 machines (Howard).
- Remaining batch items unchanged: #32202 AMT (verify still a client), #32380/#32229/#31947 (Winter).

### Reference Information (continued)

- #32230 invoice 1650788180 ($0.00, prepaid); block 47.75.
- CS-SERVER: up since 6/23 07:32; agent c39f1de7; C: 151GB free, D: 465GB free; MSP360 "Online Backup Service" running.
- Wiki commit 5c77b88.

---

## Update: 15:22 PT — CS-SERVER RAID live-verified (stale data lesson), printer, vault, MAK key + 6PM Home→Pro schedule

### Session Summary (continued)

**CS-SERVER RAID — the "degraded/failing" flag was STALE; live OMSA proved it healthy.** Howard
went onsite ready to hot-swap a "failing" drive based on the 9-day-old wiki. Live Dell OMSA
(`omreport` via RMM) showed **both mirrors Ok, all 5 disks Online/green, Failure Predicted No**; the
6/15 degraded (PD 0:0:3 WD) self-recovered after a power cycle (ESM log shows repeated drive
remove/install across the outages). The "5th unused drive" (1:0:4) is the **GLOBAL HOT SPARE** for
the D: mirror — Howard nearly pulled it. Also surfaced **PSU redundancy lost**. Backup verified
running (last run Success, 0 failed, 575 GB baseline; confirm BMR/system-state). **No drive pulled;
the 2x SSD already bought become a planned upgrade, not an emergency.** Corrected the wiki
(Infrastructure block, Active-Work, History, Compilation Notes, index) + plan Workstream 5. Saved
the lesson (`feedback_verify_live_before_acting` + errorlog correction): always pull live OMSA/iDRAC
before acting; Windows `Get-PhysicalDisk` can't see RAID member health. No iDRAC skill / iDRAC creds
in vault (offered to set up; OMSA-via-RMM is the working path). Service Tag 9MQFTK1, SAS 6/iR.

**Printer.** The "Accounting Assistant printer" (room 101, Brother L8900CDW, 10.0.20.220) is the
SAME physical unit already on CS-SERVER as shared queue `\\CS-SERVER\BusinessOffice`. Per Howard:
left it named "Business Office," attached it to Chris Knight's PC (DESKTOP-N5G1ROO, in his session,
not default). Corrected ANOTHER stale wiki note: CS-SERVER CAN reach VLAN 20 (pings gw 10.0.20.1);
the old "VLAN-20 blocked" was wrong — idle printers just don't answer ping.

**Vault.** Vaulted Meredith Kuhn's login (`clients/cascades-tucson/meredith-kuhn`, local acct
meredithk → domain after join). Vaulted the **ACG Windows Pro MAK key** (Mike's, NOT client-specific)
at `infrastructure/windows-pro-mak`. Saved billing rule memory `feedback_windows_pro_upgrade_billing`:
**$99 per machine** activated with the MAK, invoiced to that customer, machine named on the line,
billed after success, not from a labor block.

**Home→Pro upgrade scheduled for 6PM.** Pre-flighted the 5 Home machines (DISM) — all confirmed Core
with Professional a valid target. Scheduled CronCreate job **ad0a56a9** for 18:00 today to run the
per-machine sequence: online + query-user check (hold active users) → small Wscript.Shell popup
(msg.exe absent on Home) → changepk with generic key → 5-min wait → reboot → slmgr /ipk MAK + /ato →
verify Professional + Licensed. Session-bound (terminal stays open per Howard). Pauses for Howard's OK
before the 5×$99 Cascades invoice.

### Key Decisions (continued)
- Did NOT pull any CS-SERVER drive — live state healthy; 1:0:4 is the hot spare; SSDs = planned upgrade.
- Printer left as "Business Office," attached to Chris (no duplicate queue, not default).
- MAK billing: $99/machine, after success, not from the prepaid block.
- 6PM upgrade automated via session-bound cron; holds any in-use machine; bills only on Howard's confirm.

### Configuration Changes (continued)
- Wiki: RAID block + VLAN-20 printer note + Active-Work + History + Compilation Notes corrected (commits be2ae8b, 855a67d); index updated. Plan Workstream 5 corrected.
- Vault: `clients/cascades-tucson/meredith-kuhn` (174fc2f), `infrastructure/windows-pro-mak` (d90599c).
- Memories: `feedback_verify_live_before_acting`, `feedback_windows_pro_upgrade_billing` (+ MEMORY.md). errorlog: RAID stale-data correction.
- RMM: attached `\\CS-SERVER\BusinessOffice` to DESKTOP-N5G1ROO (chris.knight).
- Tasks #9 (6PM Home→Pro) created+updated; #3 (Karen) completed earlier.

### Pending / Incomplete Tasks (continued)
- **6PM (auto, job ad0a56a9):** Home→Pro on the 5 machines → verify → bill Cascades 5×$99 (Howard confirms).
- **Planned (not emergency):** CS-SERVER consumer 320GB drives → 2x SSD on a scheduled window w/ confirmed image/system-state backup; check PSU redundancy onsite; confirm backup is BMR/system-state.
- Battery-backup billing (task #8) still pending UPS cost + minutes.
- Domain joins for the ready set + (post-upgrade) the 5 Home machines.

### Reference Information (continued)
- CS-SERVER: Dell R610, Service Tag 9MQFTK1, SAS 6/iR; PD map — 0:0:0/0:0:1 (1.2TB SAS, D:), 0:0:2 Hitachi + 0:0:3 WD (320GB, C:), 1:0:4 = global hot spare.
- `\\CS-SERVER\BusinessOffice` = Brother L8900CDW @ 10.0.20.220 = "Accounting Assistant" printer (room 101).
- Vault: `infrastructure/windows-pro-mak` (credentials.product_key), `clients/cascades-tucson/meredith-kuhn`.
- Generic Pro key VK7JG-NPHTM-C97JM-9MPGT-3V66T (edition flip); MAK in vault (activation).
- Cron job ad0a56a9 @ 18:00 2026-06-24.

---

## Update: 17:36 PT — M365 relicense assessment (Workstream 4): seat shortfall + cleanup opportunity

### Session Summary (continued)

Started the plan's Workstream 4 (M365 relicense) remotely. Pulled the LIVE license state via the
remediation-tool (investigator/Graph token, tenant 207fa277-e9d8-4eb7-ada1-1064d2221498) before
touching anything. The plan's "relicense 31 Standard->Premium" is **blocked by a 3-seat shortfall**
and surfaced a licensing-cleanup opportunity.

**Live SKU state:** SPB (Business Premium) Enabled 34 seats, 6 consumed -> **28 free**.
O365_BUSINESS_PREMIUM (the legacy-named "Business Standard") **SUSPENDED**, **31 users still
assigned**. Also EXCHANGE_S_ESSENTIALS SUSPENDED with 5 users (separate cleanup). AAD_PREMIUM_P2
suspended (1).

**Per-user overlap (decisive):** all **31** Standard users, and **0 of them already hold SPB** -> all
31 need a NEW SPB seat. 31 needed vs 28 free = **3 short** for a straight 1:1 migration.

**Cleanup opportunity:** ~8 of the 31 are shared/role accounts (accounting@, accountingassistant@,
frontdesk@, hr@, security@, memcarereceptionist@, boadmin@, Training@, dax.howard@?) that likely
should be UNLICENSED shared mailboxes, not $22/mo Premium users. The 22 clearly-real people fit in
the 28 free seats with room to spare -> converting the true shared mailboxes to unlicensed both
removes the shortfall AND drops ~8 paid licenses. Caveat: any "shared" account that is actually an
interactive login (e.g. frontdesk@ / memcarereceptionist@ signing into shared reception PCs) must
keep a license (shared mailboxes can't sign in). Presented both paths to Howard; **awaiting his
decision** on which flagged accounts are shared mailboxes vs login accounts (path 1, recommended) vs
buy 3 more SPB seats (path 2). Nothing changed — assessment only.

### Key Decisions (continued)
- Did NOT bulk-assign SPB — live data showed a 3-seat shortfall the wiki/plan didn't capture; a blind
  "assign 28, strand 3" would be wrong. Surfaced the shared-mailbox cleanup as the better fix.

### Configuration Changes (continued)
- No changes this segment (read-only M365 license assessment).

### Pending / Incomplete Tasks (continued)
- **M365 relicense (Workstream 4) — BLOCKED on Howard's decision:** path 1 (unlicense the true shared
  mailboxes among accounting@/accountingassistant@/frontdesk@/hr@/security@/memcarereceptionist@/
  boadmin@/Training@/dax.howard@, then assign SPB to the 22 real people — fits 28 free) vs path 2
  (buy 3 more SPB, migrate all 31 as-is). Then execute via user-manager tier.
- **5 users on suspended EXCHANGE_S_ESSENTIALS** — assess/clean up next.
- 6PM cron ad0a56a9 (Home->Pro) still pending its fire.

### Reference Information (continued)
- SKU IDs: SPB cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46; O365_BUSINESS_PREMIUM (Standard, suspended) f245ecc8-75af-4f8e-b61f-27d8114de5f3; EXCHANGE_S_ESSENTIALS e8f81a67-bd96-4074-b108-cf193eb9433b.
- 22 real people on Standard needing SPB: Allison Reibschied, Shelby Trozzi, Alyssa Brooks, Ashley Jensen, Christina DuPras, Christine Nyanzunda, Crystal Rodriguez, JD Martin, Jodi Ramstack, John Trozzi, Karen Rossini, Lauren Hasselman, Lois Lane, Lupe Sanchez, Matthew Brooks, Megan Hiatt, Meredith Kuhn, Ramon Castaneda, Sharon Edwards, Susan Hicks, Tamra Matthews, Veronica Feller.
- Tenant 207fa277-e9d8-4eb7-ada1-1064d2221498 (cascadestucson.com).
