sync: auto-sync from HOWARD-HOME at 2026-06-24 10:21:03

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-06-24 10:21:03

.claude/memory/MEMORY.md

@@ -33,6 +33,7 @@
 - [INKY outbound breaks DMARC](reference_inky_outbound_breaks_dmarc.md) — Reverse-resolve DMARC rua failing IPs before blaming a sender: ipw-outbound.inkyphishfence.com / us.cloud-sec-av.com = INKY re-injection breaking DKIM+SPF. INKY is in-M365 (connectors+transport rules) per enrolled tenant, but hosting-level (IX/cPanel website) outbound also routes through it independent of M365 enrollment. Fix is INKY-side (outbound DKIM/SPF/ARC), not cPanel DNS.
 - [Syncro prepay: full-GET only](feedback_syncro_prepay_full_get_only.md) — read prepay_hours ONLY from GET /customers/{id}; the customer search/list endpoint returns null/stale prepay. Never assert "no block" in a billing preview from search data.
 - [Syncro priority/type format](feedback_syncro_priority_type_format.md) — every ticket create needs a number-prefixed priority ("2 Normal", not bare "Normal" which renders blank) AND a valid problem_type. Winter flagged #32193/#32194. Use the syncro skill's create flow.
+- [RMM drive-map Explorer refresh](reference_rmm_drive_map_explorer_refresh.md) — drive mapped via RMM user_session works but the user's running Explorer won't show it until SHChangeNotify(DRIVEADD); also UNC \\ gets eaten in heredoc+jq, build it from [char]92.
 - [AAD Connect msDS-KeyCredentialLink writeback](reference_aadconnect_keycredlink_writeback.md) — "completed-export-errors" + 8344 INSUFF_ACCESS_RIGHTS on a protected admin account = WHfB key writeback blocked by AdminSDHolder. Diagnose with csexport /f:x; fix with dsacls WP;msDS-KeyCredentialLink on AdminSDHolder + SDProp.
 - [UniFi Site Manager cloud API](reference_unifi_site_manager_api.md) — `api.ui.com` + `X-API-KEY` (vault `services/unifi-site-manager`) = remote access to the WHOLE ACG UniFi fleet (~36 consoles) outside UOS. Tier1 `/v1/hosts|sites|devices|isp-metrics` = inventory+health+WAN. Tier2 CONNECTOR `/v1/connector/consoles/{id}/proxy/network/api/s/default/stat/{device,sta}` = **full UOS parity** (per-radio cu_total airtime + per-client RSSI) for ANY console, remote. Backend `unifi-wifi/scripts/gw-sitemanager.sh` (`fleet|devices|sites|isp|net`). Standalone UDM WAN SSH usually firewalled; per-console SSH pw at `clients/<slug>/udm-ssh`.
 - [reference_sqlx_migrations_immutable](reference_sqlx_migrations_immutable.md) -- NEVER edit an already-applied sqlx migration file — even a comment. sqlx::migrate! checksums each file at compile time and validates against _sqlx_migrations at startup; a changed checksum crash-loops the server with "migration N was previously applied but has been modified". Code review MUST flag any edit to an applied migration.

.claude/memory/reference_rmm_drive_map_explorer_refresh.md

@@ -0,0 +1,34 @@
+---
+name: reference_rmm_drive_map_explorer_refresh
+description: Mapping a drive for a user via RMM user_session works but their running Explorer won't show it until a shell DRIVEADD notify; also UNC \\ gets eaten in heredoc+jq dispatch
+metadata:
+  type: reference
+---
+
+When you map a persistent network drive **for a logged-on user** via the GuruRMM agent's
+`context: user_session` (`net use` / `New-SmbMapping -Persistent $true`), two things bite:
+
+1. **The map lands in the user's session but their already-running Explorer won't display it.**
+   The drive IS mounted (verify: `user_session` SID == `explorer.exe` SID via
+   `Get-CimInstance Win32_Process -Filter "Name='explorer.exe'"`) and `Test-Path X:\` is True,
+   but "This PC" doesn't show the icon because the shell never got the add notification.
+   **Fix (no disruption, runs in user_session = the user's session 1):**
+   ```powershell
+   $sig = @'
+   [DllImport("shell32.dll", CharSet=CharSet.Unicode)] public static extern void SHChangeNotify(int eventId, uint flags, string item1, string item2);
+   '@
+   $sh = Add-Type -MemberDefinition $sig -Name ShellNotify -Namespace W -PassThru
+   $sh::SHChangeNotify(0x00000100, 0x0005, 'X:' + [char]92, $null)  # SHCNE_DRIVEADD, SHCNF_PATHW
+   ```
+   The persistent map (`HKCU\Network\X`) auto-reconnects + shows on the user's NEXT logon anyway,
+   so this is only to surface it in the current session. Restarting explorer.exe also works but
+   closes the user's open windows. An interactive scheduled task (`LogonType Interactive`) to
+   "remap in the session" returned `LastTaskResult=2` and did NOT help — use SHChangeNotify.
+
+2. **UNC double-backslashes get mangled to single in the heredoc -> jq -> agent -> PowerShell chain.**
+   `\\cs-server\share` arrives as `\cs-server\share` -> "error 67 / network name not found" or net-use
+   hangs (looks like a missing/broken share). Single-backslash local paths (`D:\Shares`) are fine.
+   **Fix:** build the UNC at runtime from `[char]92` so no literal `\\` traverses the dispatch:
+   `$bs=[char]92; $unc = "{0}{0}server{0}share" -f $bs`. See [[feedback_windows_quote_stripping]].
+
+Proven 2026-06-24 on Cascades #32193 (Executive share, E: for Ashley.Jensen + Meredith.Kuhn).