sync: auto-sync from HOWARD-HOME at 2026-07-02 14:48:25

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-02 14:48:25

clients/scileppi-law/session-logs/2026-07/2026-07-02-howard-scileppi-internet-outage-cox-wan-rca.md

@@ -89,3 +89,16 @@ Finally, per the user's request, ran an independent re-gather on the **Fable 5 m
 - **Decision:** findings went on the existing #32493 (Howard's pick) rather than a new ticket.
 - **Friction:** first comment-POST attempt was blocked by the `block-tmp-path` PreToolUse hook (a stray `/tmp/.rr` write in the same command) — the hook blocked the whole command pre-execution, so no duplicate comment was created; re-ran cleanly. No errorlog entry (handled, no functional failure).
 - **speach skill:** no skill named "speach"/"speech" exists; interpreted as the writing-polish pass and applied `stop-slop` to the customer text.
+
+## Update: 14:48 PT — Cox re-check after their "150-ping clean" claim; Cox now running a 24h test
+
+Cox ran a ~150-ping test and reported it "all clean." Re-checked the network from both angles:
+
+- **Direct in-site test (SL-SERVER):** 250 pings each to the Cox CMTS (`10.68.48.1`, hop 2), a Cox backbone hop (`68.105.30.142`), and `8.8.8.8` — **0% loss on all three**, steady latency (~8 ms to CMTS, ~24 ms to internet). Matches Cox's clean result — because the fault is intermittent; a ~50 s / 2.5-min burst lands in a clean window and misses it. (First attempt ran 3x300 sequential and hit the agent's command timeout; re-ran as 3 parallel 250-ping jobs via `/dev/shm`, ~50 s wall.)
+- **UCG 24/7 telemetry (authoritative):** `/ea/isp-metrics/5m` last 24h = **78 of 257 windows (~30%) with WAN packet loss, 1-4%**, spread across the whole day, continuing to the latest samples (4% ~12:05 PM, 3% ~12:15 PM Phoenix). `internetIssues5min` also shows a fresh `not_reported` telemetry-gap blip ~2:05 PM Phoenix (bucket 5943421) — i.e. AFTER Cox's clean test. **No hard WAN outage in the last 24h** (this morning's ~20 s drop aged out of the window); chronic low-grade loss persists.
+- **Conclusion:** Cox's short test does not clear the line — it just didn't sample a loss window. A 2.5-min ping can't detect a fault present in ~30% of 5-min windows at 1-4%.
+- **Recommendation given to Howard:** have Cox pull the modem's DOCSIS signal history + correctable/uncorrectable codeword counts + SNR over 24-48h (where chronic low-grade loss shows), or run 24h+ continuous monitoring — not a live burst.
+- **Status:** **Cox is now running a 24-hour ping test and will report back.** Awaiting their result. Cox ticket `HD0000032972890` still open.
+- **Cosmetic:** UniFi ISP label flip-flopped back to "Comcast Cable / AS7922" this pull (was Cox Business/AS22773 earlier) — still Cox; label is unreliable.
+
+**Outstanding (offered, not yet done):** compile the exact per-window loss timestamps (Phoenix) from the UCG telemetry into a list for Cox to correlate against their modem logs; optionally add this re-check to Syncro #32493 + the wiki. Neither done yet — awaiting Howard's go and the Cox 24h result.