sync: auto-sync from HOWARD-HOME at 2026-07-14 11:14:46

Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-14 11:14:46
2026-07-14 11:15:25 -07:00
parent 4ab8137daa
commit 22503149ce
11 changed files with 3498 additions and 39 deletions
--- a/clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md
+++ b/clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md
@@ -3,8 +3,14 @@
 > Consolidated execution plan tying the open Syncro tickets to the broader migration
 > workstreams (workstations -> domain, users/departments, HIPAA caregiver lockdown).
 > Built 2026-06-24 (Howard) from a live AD+RMM diff. Companion to `PROJECT_STATE.md`
-> and `wiki/clients/cascades-tucson.md` (current truth, compiled 2026-06-23).
+> and `wiki/clients/cascades-tucson.md` (current truth).
 > Goal: finish the migration quickly by working it as one sequenced plan.
+>
+> **REFRESHED 2026-07-13** (reconcile pass vs wiki + live state): caregiver CA posture
+> updated to the 7/1 interim cutover, roster 35, Home->Pro completions folded in,
+> CS-SERVER EDR installed, ticket table reconciled against Syncro (0 open as of 7/10).
+> The "Live snapshot" below is still the 6/24 AD-vs-RMM diff -- domain-join states are
+> per-machine current in the wiki's "Migration phase status" table.

 ---

@@ -33,7 +39,7 @@ ASSISTNURSE-PC, NURSESTATION-PC, RECEPTIONIST-PC, MEGAN.
 | Health-Services-Director | vs AD `HEALTH-SERVICES` | Verify dup/rename before acting |
 | **CHEF-PC** | Culinary (Chef JD) | **Ticket #32254** — reinstall Windows, THEN join -> OU=Culinary |
 | DESKTOP-TRCIEJA | Lupe Sanchez | EOL — **replace machine** (decision 2026-06-18), join the replacement |
-| DESKTOP-KQSL232 | Lois Lane | Resistant to migration; coordinate via John Trozzi |
+| DESKTOP-KQSL232 | Lois Lane | **DECOMMISSIONED 6/26** (her HEALTH-SERVICES box is already domain-joined) |
 | CascadesProxess | Proxess access-control appliance | Likely leave un-joined — verify it's an appliance |
 | Laptop2, LAPTOP-DRQ5L558, LAPTOP-E0STJJE8, Laptop4 | Caregiver shared laptops | Join via the **Caregiver Devices** path (Workstream 3), not the staff path |

@@ -75,8 +81,8 @@ retire per-PC Synology Drive Client.
 | LAPTOP-8P7HDSEI | User | **Win10 Home** | BLOCKED: Home->Pro + OneDrive KFM ON |
 | MDIRECTOR-PC | Shelby Trozzi | **Win11 Home** | BLOCKED: Home->Pro + reboot |
 | MEMRECEPT-PC | memfrtdesk | **Win10 Home** | BLOCKED: Home->Pro + reboot |
-| NurseAssist | Veronica | **Win11 Home** | BLOCKED: Home->Pro + KFM ON + reboot |
-| SALES4-PC | Tamra (departing) | **Win11 Home** | BLOCKED: Home->Pro; Tamra leaving — repurpose? |
+| NurseAssist | Veronica | ~~Win11 Home~~ **Pro WS (upgraded 6/26)** | READY-ish: KFM ON (unlink) + reboot; confirmed distinct from ASSISTNURSE-PC |
+| SALES4-PC | Tamra (OFFBOARDED 6/30) | ~~Win11 Home~~ **Pro (supplier upgrade)** | Repurpose TBD; join when reassigned |
 | LAPTOP-DRQ5L558 | caregiver | Win11 Pro WS | BLOCKED: off-network (public DNS, no DC reach) |
 | DESKTOP-TRCIEJA | Lupe Sanchez | Win11 Pro | SKIP — EOL, being replaced |
 | Health-Services-Director | Lois Lane | Win11 Pro WS | already domain-joined (= AD `HEALTH-SERVICES`) |
@@ -99,8 +105,10 @@ retire per-PC Synology Drive Client.
      the edition to `ProfessionalWorkstation` (higher SKU, fine for domain join), `/dli` = Licensed,
      VOLUME_MAK channel. **2 MAK counts consumed -> bill 2x $99 = $198 to Cascades** (line items name each
      machine). MEMRECEPT needed an `/ato` retry (first attempt hit transient `0x8004FE92`).
-    - **Still pending:** NurseAssist (OFFLINE — and flagged as a possible dupe of `Assistnurse-pc`, verify
-      before upgrading) and SALES4-PC (bypassed — Tamra departing, repurpose TBD).
+    - **[RESOLVED 6/26-6/30]** NurseAssist + DESKTOP-MD6UQI3 upgraded to Pro for Workstations 6/26
+      (2 x $99 to bill — Syncro product 23571919, not yet invoiced as of 7/10); NurseAssist confirmed
+      a distinct machine from ASSISTNURSE-PC. SALES4-PC upgraded to Pro by its supplier (no ACG
+      charge); Tamra offboarded 6/30, machine repurpose TBD.
    - Next step for the 3 upgraded boxes = **domain-join** (they now read `EditionID=Professional`/PfW).
 - **OneDrive KFM ON** (unlink before folder-redirect GPO): LAPTOP-8P7HDSEI, NurseAssist.
 - **Pending reboots + KFM unlinks: held for onsite** (Howard) — disruptive to clear remotely.
@@ -135,24 +143,52 @@ access matrix; Synology retired as primary.

 ## Workstream 3 — HIPAA caregiver lockdown — GO-LIVE (highest value, mostly built)

-Everything is built + validated on the pilot (NURSESTATION + pilot.test). Go-live = flip from
-test scope to real caregivers, one device at a time. (Detail: wiki "Entra Access Architecture".)
+**[UPDATED 2026-07-13]** The 7/1 CA cutover put caregivers in an **interim posture**: all 35
+`SG-Caregivers` may sign in on desktops AND phones, **on-network only** (`e35614e1` off-network
+block + `7d491c7a` 8h sign-in frequency enforced; `SG-Caregivers` excluded from MFA-for-all).
+The compliance-block policy `ede985e2` was **DISABLED 2026-07-01 — do not re-enable** (superseded
+by the allow-list). Temp passwords are live for phone sign-in (must-change cleared fleet-wide 7/2;
+`PSO-Caregivers` never-expire FGPP in place). Roster = **35** after the 7/1 reconcile.
+**Juan Andrade offboards 2026-07-16 afternoon** (coord todo `80716a98`).
+
+Final lockdown = flip from test scope to real caregivers, one device at a time
+(detail: wiki "Entra Access Architecture"):

 1. Swap GPO `CSC - Caregiver Workstation` security filter `SG-Caregivers-Test` -> `SG-Caregivers`.
-2. CA allow-list policy `1b7fd025`: test group `SG-Caregivers-DeviceTest` -> `SG-Caregivers`; disable the compliance-block policy `ede985e2`.
+2. CA allow-list policy `1b7fd025`: **two changes** — retarget test group `SG-Caregivers-DeviceTest`
+   -> `SG-Caregivers` AND flip from report-only (`enabledForReportingButNotEnforced`) to enforced.
+   Prereqs: `SG-Break-Glass` + GDAP/service-provider exclusions in place (break-glass accounts still
+   NOT created — do this first).
 3. Move each caregiver machine into `OU=Caregiver Devices` + `SG-PC-MainTower`/`SG-PC-MemoryCare`
-   one at a time: Laptop2, LAPTOP-DRQ5L558, LAPTOP-E0STJJE8, ASSISTNURSE-PC, NURSESTATION-PC (+ verify NurseAssist/Laptop4).
-4. ALIS email-match the 38 caregivers + medtechs (ALIS staff Email = Entra UPN); turn off ALIS-native 2FA per user.
+   one at a time: Laptop2, LAPTOP-DRQ5L558, LAPTOP-E0STJJE8, ASSISTNURSE-PC (needs re-join + re-tag
+   after Win11 reinstall), NURSESTATION-PC (+ verify NurseAssist/Laptop4). NOTE: the device-lockdown
+   (auto-logoff) GPO only applies once machines are in `OU=Caregiver Devices` — until then desktops
+   caregivers use under the interim posture have NO auto-logoff enforcement.
+4. ALIS email-match the 35 caregivers + medtechs (ALIS staff Email = Entra UPN); ALIS records still
+   to create for Munezero/Cota/Robinson; Vallejo email-match; 7 discharged-record decisions;
+   turn off ALIS-native 2FA per user, then move to SSO-only (native login is a CA bypass path).
 5. Lower ALIS app session timeout 20 -> 15 min (Howard, ALIS admin).
 6. **Reboot NURSESTATION-PC** to activate + verify the device-lockdown GPO (lock @3min, 90s warn, sign-out @15min).
+7. Phones-only lockdown cohort: deferred to end of rollout — `docs/cloud/caretaker-phones-only-list.md`.
+8. Pilot cleanup: delete `pilot.test`, remove stale `SG-Caregivers-Pilot` exclude from the MFA policy,
+   delete the pilot/test groups.

 ---

 ## Workstream 4 — M365

- **Relicense 31 users Business Standard -> Business Premium** (Standard is SUSPENDED — time-sensitive).
- Create break-glass accounts (`breakglass1/2-csc@`) + enroll FIDO2 YubiKeys.
- Build audit retention (Log Analytics 90d + Storage 6yr) in `rg-audit-cascadestucson`.
+- **Relicense remaining suspended Business Standard users -> Business Premium** (Standard SKU is
+  SUSPENDED — time-sensitive). SPB now 45 seats enabled (Howard bought 11 on 6/30); 41 consumed as
+  of 7/1 — count seats before relicensing.
+- **Create break-glass accounts (`breakglass1/2-csc@`) + enroll FIDO2 YubiKeys** — still not created
+  (confirmed 5/27); now a **prerequisite for the WS3 allow-list enforcement flip**.
+- **Remove the standing Privileged Authentication Administrator role from the
+  `ComputerGuru - Tenant Admin` SP** (stranded by Alma's 6/25 offboarding; needs a Global Admin;
+  keep its Conditional Access Administrator role). Pending Mike.
+- Build audit retention (Log Analytics 90d + Storage 6yr) in `rg-audit-cascadestucson` — approved
+  2026-04-29, still unbuilt (HIPAA SS164.312(b) gap, includes D:\Homes object-access auditing).
+- Zeke Huerta: register Authenticator MFA (under MFA-for-all with no method since 7/1).
+- Megan Hiatt: re-verify the April credential-stuffing remediation held (flagged 6/30).

 ---

@@ -160,7 +196,11 @@ test scope to real caregivers, one device at a time. (Detail: wiki "Entra Access

 - **Cloud backup (MSP360 -> ACG-backup): VERIFIED running 2026-06-24** (last run Success, 0 failed, 575 GB baseline in cloud, incrementals working). Still confirm it is image/bare-metal/system-state (looks file-level) + set retention. [GATE for any drive work]
 - **CS-SERVER RAID -- CORRECTED 2026-06-24: HEALTHY, not degraded** (live OMSA: both mirrors Ok, all 5 disks Online, all LEDs green; the 6/15 degraded self-recovered). **NO emergency drive swap.** 1:0:4 = global hot spare (do not remove). **Planned** reliability upgrade: replace the 2 consumer 320 GB drives (esp. flaky WD 0:0:3) with the 2x enterprise SSD **already purchased**, on a scheduled window w/ confirmed image/system-state backup. **[WARN] PSU redundancy lost** -- one PSU not delivering, check onsite. Service Tag 9MQFTK1. Real fix = DC migration off the 16-yr-old R610.
- Clean up old-MSP agent sprawl (Datto RMM/CentraStage + Datto EDR/Infocyte) thrashing the spindle.
+- ~~Clean up old-MSP agent sprawl (Datto RMM/CentraStage + Datto EDR/Infocyte) thrashing the spindle~~
+  — **DONE on CS-SERVER 2026-06-26** (full legacy Datto stack removed). **Current Datto EDR installed
+  on CS-SERVER 2026-07-13** (HUNTAgent=Running, cmd `0a60cac7`) — the DC is back under managed
+  endpoint protection. Fleet stragglers tracked in the wiki (DESKTOP-TRCIEJA BD_ACTIVE, laptop3/laptop1/
+  cascades-laptop reconcile, Syncro BD-deployment removal, GravityZone portal cleanup).
 - Synology -> backup-only (Team Folder migration of the real shares; close the workgroup/Kerberos quirk).
 - Rotate the Synology signin-portal credential (was committed plaintext historically).

@@ -203,29 +243,36 @@ test scope to real caregivers, one device at a time. (Detail: wiki "Entra Access

 ---

-## Suggested sequence (fastest path)
+## Suggested sequence (fastest path) — re-cut 2026-07-13

-1. **Today's onsite batch (Howard, on-site):** #32342 (Copy Room switch), #32319 (Room 343 AP),
-   #32370 (eFax + scanner), #32194 (spare machine for new hire), #32254 (Chef-PC reinstall+join);
-   #32230 (Karen -> ALDOCS) once she's in. **While onsite: verify per-room 5 GHz coverage** for the
-   CSC ENT device-island consolidation (Workstream 6) so the band flip can be scheduled with the
-   vendors.
-2. **Caregiver lockdown go-live** (Workstream 3) — remote, highest HIPAA value, just needs the flip + per-device moves.
-3. **M365 relicense 31 users** (Workstream 4) — time-sensitive.
-4. **Backup verify -> RAID replacement** (Workstream 5) — critical single-DC risk.
-5. **Remaining staff domain joins + dept drives** (Workstreams 1+2) — batch the ~17 un-joined PCs, OU + drives per machine.
-6. Network tail (Vertical 5 GHz, 100 Mbps ports) + M365 break-glass/audit retention.
+1. **2026-07-16 afternoon: offboard Juan Andrade** (disable + SG-Caregivers removal + license
+   reclaim) — coord todo `80716a98`. Do NOT disable before then.
+2. **Break-glass accounts + strip the stranded PAA role** (Workstream 4) — prerequisite for the
+   allow-list enforcement flip; the tenant currently has live block policies and no break-glass.
+3. **Caregiver lockdown go-live** (Workstream 3) — highest HIPAA value; the interim posture's real
+   control (device allow-list) is still report-only/test-scoped.
+4. **M365 relicense remaining suspended-Standard users** (Workstream 4) — time-sensitive.
+5. **Backup image/system-state confirm -> planned SSD swap** (Workstream 5) — single-DC risk.
+6. **Remaining staff domain joins + dept drives** (Workstreams 1+2) + printer-share repoints /
+   Point-and-Print GPO fleet-wide (see wiki VLAN 20 section).
+7. Network tail (CSC ENT device island, 100 Mbps ports) + audit-retention build.

 ---

 ## Open Syncro tickets -> workstream map

+**[RECONCILE 2026-07-13] Syncro showed 0 open tickets as of 7/10**, but the 6 tickets below were
+"Open — onsite" in the 6/24 plan and no completion is recorded in the wiki/session logs.
+**VERIFY with Howard: completed-and-closed, or closed-without-work?** Any not actually done go back
+on the board as workstream items (the underlying work — Chef-PC reinstall+join, Room 343 AP,
+Copy Room switch, eFax/scanner, spare machine, Karen ALDOCS — is still required by WS1/2/6/7).
+
 | Ticket | Workstream | Status |
 |---|---|---|
 | #32193 Executive restricted share | 2 | **DONE 2026-06-24** (E: both machines, billed 0.5h block) |
-| #32194 spare machine for new hire | 1 | Open — onsite |
-| #32230 Karen -> ALDOCS | 2 | Open — recheck when she's in |
-| #32254 Chef-PC reinstall | 1 | Open — onsite (then domain-join) |
-| #32319 WiFi Room 343 | 6 | Open — onsite |
-| #32342 Copy Room switch | 6 | Open — onsite |
-| #32370 eFax + scanner | 7 | Open — onsite |
+| #32194 spare machine for new hire | 1 | Closed in Syncro — **verify work done** |
+| #32230 Karen -> ALDOCS | 2 | Closed in Syncro — Karen's ALDocs shortcut WAS set 6/26 (drive-map); likely done |
+| #32254 Chef-PC reinstall | 1 | Closed in Syncro — **verify reinstall + domain-join happened** |
+| #32319 WiFi Room 343 | 6 | Closed in Syncro — **verify AP relocation done** |
+| #32342 Copy Room switch | 6 | Closed in Syncro — **verify switch installed/adopted** |
+| #32370 eFax + scanner | 7 | Closed in Syncro — **verify eFax + scanner delivered** |
--- a/clients/cascades-tucson/docs/cloud/caretaker-phones-only-list.md
+++ b/clients/cascades-tucson/docs/cloud/caretaker-phones-only-list.md
@@ -32,7 +32,7 @@ Transportation drivers, who do not get ALIS/M365 caregiver access at all.
 | Erica Sanchez | e.sanchez | D+P | TBD |
 | Ederick Yuzon | e.yuzon | D+P | TBD |
 | Gina Williams | g.williams | D+P | TBD |
-| Juan Andrade | j.andrade | D+P | **LEAVING** — last day 2026-07-11; held active until then, offboard on 07-11 |
+| Juan Andrade | j.andrade | D+P | **LEAVING** — offboard **2026-07-16 afternoon** (moved from 07-11 per Howard 2026-07-13); held active until then. Coord todo `80716a98`. |
 | Jahmeka Clarke | j.clarke | D+P | TBD |
 | Jinnelle Dittbenner | j.dittbenner | D+P | TBD |
 | Jen Higdon | j.higdon | D+P | TBD |
--- a/clients/dataforth/session-logs/2026-07/2026-07-14-howard-sage-printing-guru-user.md
+++ b/clients/dataforth/session-logs/2026-07/2026-07-14-howard-sage-printing-guru-user.md
@@ -0,0 +1,109 @@
+# 2026-07-14 — Dataforth: Sage GURU credential + Sage printing fix (DESKTOP-U8PHS72 / SAGE-SQL)
+
+## User
+- **User:** Howard Enos (howard)
+- **Machine:** Howard-Home
+- **Role:** tech
+
+## Session Summary
+
+Started with a lookup for a Sage application login for Dataforth. No entry existed in the SOPS
+vault (`clients/dataforth/` had only server/infra creds) or wiki. Dataforth staff reset the
+password on their Sage `guru` user; the credential was vaulted at `clients/dataforth/sage`
+(username `guru`). Initial value was corrected twice per user updates — final password is
+`Itword26!` (confirmed intentional, not a typo). Login later verified working.
+
+The real issue then surfaced: DESKTOP-U8PHS72 could not print from Sage — Sage showed no
+printers. Investigation via GuruRMM: Sage Pro 200 ERP 2010 (`S:\sbt\sbtw.exe`, Visual
+FoxPro-based) is NOT installed on the workstation; users RDP to SAGE-SQL (192.168.0.153, RDS
+Session Host) and run Sage there, so Sage printers = RDP-redirected printers. The affected user
+dlopez (new AD account created 2026-07-06) had two long-running RDP sessions on SAGE-SQL
+(session 4 active since 7/13 + session 9 stale disconnected) with ZERO redirected printers —
+each reconnect re-entered the stale sessions. His client-side `Default.rdp` correctly had
+`redirectprinters:i:1`. Mike noted a registry change to RDP behavior had been made previously
+(before this session) that required a fresh logon to take effect.
+
+Fix: logged off both dlopez sessions on SAGE-SQL via GuruRMM. Fresh RDP connection brought
+printer redirection up correctly; Mike verified in Sage as the `guru` user — printers listed
+and selectable. Resolved.
+
+Wrote Syncro ticket #32552 (Dataforth Corp), resolution comment (registry-fix detail
+intentionally omitted per Mike), billed 0.5 hr remote labor against the prepaid block
+(25.75 → 25.25 hrs), invoice 1651043602 ($0.00 prepaid), ticket marked Invoiced, block-hours
+note set on invoice, bot alert posted.
+
+## Key Decisions
+
+- Vaulted the Sage credential at `clients/dataforth/sage` even before testing — capture-first
+  policy; updated in place when the username/password were corrected.
+- Diagnosis order: workstation recon → server-side RDS policy/printers → per-user RDP files →
+  session source IPs → Sage process identification. Ruled out server policy (fDisableCpm=0, no
+  printer cap), client config (redirectprinters:i:1 present), and driver-level issues before
+  landing on stale sessions.
+- Registry fix left out of ticket notes per Mike's explicit request.
+- Ticket created directly in Resolved status (work already complete), then Invoiced after billing.
+
+## Problems Encountered
+
+- Inline JSON dispatch to RMM failed on `\\` escapes ("invalid escape") — switched to
+  `ps-encoded.sh` file-based encoded dispatch per the /rmm skill guidance.
+- Vault push rejected (remote ahead) — `git pull --rebase` then push, clean.
+- Initial theory (VFP/Sage Pro can't use Easy Print queues) was plausible but superseded:
+  Mike reproduced the failure in a session that HAD Easy Print printers, then revealed the
+  prior registry change; stale sessions predating it were the actual blocker. Note: session
+  defaults on SAGE-SQL are all "Microsoft Print to PDF" and native Brother/HP drivers are NOT
+  installed server-side (event 1111s) — may resurface as a future issue.
+
+## Configuration Changes
+
+- Vault: created `clients/dataforth/sage.sops.yaml` (then updated username/password) — pushed
+  (final vault commit 73cf333).
+- SAGE-SQL: logged off dlopez sessions 4 and 9 (only change made this session — no
+  settings/drivers/registry touched today).
+- Scratch recon .ps1 files created and deleted in repo root.
+
+## Credentials & Secrets
+
+- **Sage Pro ERP login (Dataforth):** username `guru`, password `Itword26!` — vaulted at
+  `clients/dataforth/sage` (kind generic, notes describe SAGE-SQL usage). Password reset by
+  Dataforth staff 2026-07-14; verified working by Mike in Sage. NOTE: password is `Itword26!`
+  ("Itword", NOT "Itworks") — confirmed intentional.
+
+## Infrastructure & Servers
+
+- DESKTOP-U8PHS72 = 192.168.0.48, Dataforth D2, GuruRMM agent 25a75932-31cf-4b33-b94b-f4c404830877.
+  Users: dlopez (console), kellynwackerly. Local printers: Brother DCP-L2550DW (USB002, default
+  for both users), HP LaserJet Pro 400 M401n "Kellyn Desk" (USB001), ASSEMBLY-LJD2 + NPI3EDBF9
+  HPs (WSD/network).
+- SAGE-SQL = 192.168.0.153, RDS Session Host, GuruRMM agent 120ba7bf-8544-48a0-98a1-40ed5cdd3e1f.
+  Sage Pro 200 ERP 2010 at `S:\sbt\sbtw.exe` (share C:\sage). ~10 concurrent RDP users.
+  Kellyn connects from 192.168.0.68 (different machine than U8PHS72).
+- RDS printer redirection: enabled, no policy key, no MaxPrintersPerSession set. All redirected
+  queues use "Remote Desktop Easy Print". Native Brother/HP Universal drivers NOT installed on
+  server (event 1111 "driver unknown"). Every user's session default printer = Microsoft Print
+  to PDF.
+
+## Commands & Outputs
+
+- Vault: `vault-helper.sh new/set clients/dataforth/sage`; read with
+  `vault.sh get-field clients/dataforth/sage credentials.password`.
+- RMM quote-safe dispatch: `bash .claude/scripts/ps-encoded.sh rmm <agent-id> <script.ps1> --timeout 120`
+  (inline JSON with `\\` fails the API's JSON parse).
+- Session logoff (SAGE-SQL): `logoff 9 /v; logoff 4 /v` — logoff returns nonzero exit (status
+  "failed") but works; verify with `query user`.
+- Session source IPs: TerminalServices-LocalSessionManager/Operational events 21/25.
+- Per-user default printer: `HKU\<SID>\Software\Microsoft\Windows NT\CurrentVersion\Windows\Device`.
+
+## Pending / Incomplete Tasks
+
+- None for this issue. Watch-item: if Sage printing complaints recur (esp. for the VFP app vs
+  Easy Print queues), next step is installing native Brother DCP-L2550DW + HP Universal PCL 6
+  drivers on SAGE-SQL. Also `staff` share still missing on FILES-D1 (pre-existing note).
+
+## Reference Information
+
+- Syncro ticket #32552 (id 113826861) — https://computerguru.syncromsp.com/tickets/113826861
+- Invoice 1651043602, $0.00 prepaid, line 43262662 (0.5 hr Labor - Remote Business), Dataforth
+  prepay block 25.75 → 25.25 hrs.
+- Vault: `clients/dataforth/sage` (vault repo commit 73cf333).
+- Related session log: `2026-07-06-mike-sage-sql-peter-session-reset.md` (prior SAGE-SQL session work).