diff --git a/clients/scileppi-law/session-logs/2026-07/2026-07-02-howard-scileppi-internet-outage-cox-wan-rca.md b/clients/scileppi-law/session-logs/2026-07/2026-07-02-howard-scileppi-internet-outage-cox-wan-rca.md
index e1dbc8d1..ae50e850 100644
--- a/clients/scileppi-law/session-logs/2026-07/2026-07-02-howard-scileppi-internet-outage-cox-wan-rca.md
+++ b/clients/scileppi-law/session-logs/2026-07/2026-07-02-howard-scileppi-internet-outage-cox-wan-rca.md
@@ -67,7 +67,7 @@ Finally, per the user's request, ran an independent re-gather on the **Fable 5 m
 
 ## Pending / Incomplete Tasks
 
-- **P1 — Open a Cox service ticket** for circuit `184.183.92.165` (Cox Business, AS22773): intermittent WAN packet loss (spiking ~13%) + brief WAN drops (~20 s ~04:15 and a fast blip ~10:45–10:55 on 2026-07-02); have Cox check upstream/downstream signal + SNR at the modem/ONT.
+- **P1 — Cox ticket OPEN `HD0000032972890`** (submitted by Winter 2026-07-02) for circuit `184.183.92.165` — intermittent connectivity + packet loss; Cox to check upstream/downstream signal + SNR at modem/ONT. Awaiting Cox. Account Alias "115 W WASHINGTON"; contact Guru Admin (Winter/Mike), callback 520-304-8300, `admin@azcomputerguru.com`, mornings. Ticket text used the first-pull numbers (90/276, up to 6%); verdict unchanged.
 - **Identify the "other laptop"** (likely `rose` or `andrew` — both had ~23h AFP sessions) and consider enrolling `rose`/`andrew` machines in RMM; they are active users the wiki doesn't cover.
 - **Move `Mac-mini-2` to wired Ethernet** — durable fix for Wi-Fi idle drops (`displaysleep 0` is interim).
 - **Consider re-notifying Winter** with the corrected numbers — the DM sent earlier said up-to-6% / ~1/3 of windows; the verified figures are up-to-13% + a ~20 s downtime event. Verdict unchanged (Cox line).
diff --git a/wiki/clients/scileppi-law.md b/wiki/clients/scileppi-law.md
index f9998d77..ca7efc2c 100644
--- a/wiki/clients/scileppi-law.md
+++ b/wiki/clients/scileppi-law.md
@@ -111,7 +111,7 @@ Scileppi is an **all-UniFi site, cloud-managed under ACG's Ubiquiti account** (o
 
 | Priority | Action | Owner |
 |---|---|---|
-| P1 | **Open a Cox service ticket** for circuit `184.183.92.165` (Cox Business, AS22773) — intermittent WAN packet loss (spiking to ~13%) + brief WAN drops (a ~20 s downtime ~04:15 and a fast blip ~10:45–10:55 on 2026-07-02); have Cox check upstream/downstream signal + SNR at the modem/ONT | Mike / Howard |
+| P1 | **Cox service ticket OPEN — `HD0000032972890`** (submitted by Winter 2026-07-02) for circuit `184.183.92.165` (Cox Business, AS22773): intermittent connectivity + packet loss, requested Cox check upstream/downstream signal + SNR at the modem/ONT. Awaiting Cox. **Track this ID.** | Winter / Mike |
 | P2 | Move `Mac-mini-2` to **wired Ethernet** — durable fix for Wi‑Fi idle drops (`displaysleep 0` is the interim mitigation) | Howard (onsite) |
 | P2 | Verify NAS-share auto-mount from a clean login/boot now that the agent uses `SL-SERVER.local` (not exercised from scratch on 2026-07-01) | Howard |
 | P2 | Confirm replacement-Mac status (was the 8 GB M2 ever replaced?); if not, spec/quote/order M4 (16/24 GB) | Mike / Howard |
@@ -129,6 +129,7 @@ Reported: USG "reports no internet"; intermittent drops + users unable to reach
 - **WAN telemetry (UCG cloud API):** `internetIssues5min` shows a brief WAN-downtime + packet-loss cluster ~03:50–04:25 (Phoenix, `wan_downtime` flag ~04:15) and a `not_reported` telemetry gap ~10:45–10:55 (the "one it just had that didn't report" — a blip that briefly severed the UCG's own cloud link, so the dashboard didn't graph it). `/ea/isp-metrics/5m` over 24 h: a minority of 5-min windows had WAN packet loss (**spiking to ~13%**) on steady ~22–24 ms latency, and **two downtime samples of 2 s + 18 s at ~04:15–04:20** — i.e. one ~20 s WAN drop, no multi-minute hard outage. (Counts differ between pulls — UniFi backfills the series; the ~20 s downtime and 13% spike were confirmed on a second, independent pull.)
 - **ISP:** carrier is **Cox** — `Cox Business`, **AS22773** (WAN `184.183.92.165`; traceroute via Cox). UniFi's ISP name flip-flops (seen as both "Cox Business/AS22773" and "Comcast Cable/AS7922") — it's Cox regardless.
 - **Action:** recommended Cox service call for line/signal quality (see Open Items P1). UniFi gear needs no change. Findings DM'd to Winter. Sylvia's Mac Wi-Fi drops are a **separate** issue (display-sleep; fix = Ethernet).
+- **Cox ticket submitted (Winter, 2026-07-02): `HD0000032972890`.** Type "Trouble with Service"; Account Alias **115 W WASHINGTON**; Services Affected: Internet & Data — Intermittent Connectivity, Slow Speed/Packet Loss; requested Cox check upstream/downstream signal + SNR at the modem/ONT. Preferred contact: **Guru Admin — Winter or Mike**, callback **520-304-8300**, `admin@azcomputerguru.com`, mornings. (Ticket text quoted the first-pull figures — 90/276 windows, up to 6% — not the later-refined ~13% / ~20 s downtime; verdict and the ask to Cox are unchanged.)
 - **Doc/tooling notes:** documented Scileppi's full UniFi layer here (was previously undocumented); flagged stale vault key `infrastructure/unifi-site-manager-api` (401) — use `services/unifi-site-manager`.
 
 ### 2026-07-01 — Sylvia "can't connect to server" (dropped drive) + no-sleep + ScreenConnect