diff --git a/session-logs/2026-06-01-session.md b/session-logs/2026-06-01-session.md
index 4a56963..6f1e709 100644
--- a/session-logs/2026-06-01-session.md
+++ b/session-logs/2026-06-01-session.md
@@ -174,3 +174,81 @@ curl -s --resolve "api.mspbackups.com:443:52.6.7.137" \
 - MSP360 vault: `msp-tools/msp360-api.sops.yaml`
 - MSP360 release endpoint: `POST /api/Licenses/Release` (params: `LicenseID`, `UserID`)
 - MSP360 revoke endpoint: `POST /api/Licenses/Revoke` (params: `LicenseID`, `UserID`)
+
+---
+
+## Update: 11:08 PT — MSP360 Storage Usage, vland Deletion, Rohrbach Retention
+
+## User
+- **User:** Mike Swanson (mike)
+- **Machine:** GURU-BEAST-ROG
+- **Role:** admin
+
+## Session Summary
+
+Mike asked whether storage usage by customer or computer was available. The Users endpoint already contained `SpaceUsed` and `DestinationList[].CurrentVolume` fields from the prior pull — no additional API calls were needed to retrieve storage data. A Python cross-reference against company names produced a full per-company storage breakdown sorted descending by total usage. Grand total across all company-assigned accounts was 60.68 TB. Three accounts with no company assigned but significant data were flagged: `admin@azcomputerguru.com` (13.84 TB), `vland@airyoptics.com` (11.43 TB), and `mike@azcomputerguru.com` (399 GB). Notable findings included Stamback Services storing 2.73 TB exclusively to Local-E (no cloud), and Martell and Associates splitting across Local-E and B2.
+
+Mike identified `vland@airyoptics.com` (Airy Optics) as a former client and requested full account and data deletion. All deletion sub-routes — `DELETE /api/Users/Delete`, `DELETE /api/Users/Disable`, `DELETE /api/Users/Archive`, `DELETE /api/Users/Deactivate`, and `DELETE /api/Users/{id}` directly — returned HTTP 400 `"Not Acceptable personal user"`. This restriction applies to accounts with `LicenseManagmentMode: 1` (personal/standalone users not enrolled under a company). A fallback `PUT /api/Users` with `{"ID": "...", "Enabled": false}` succeeded (HTTP 200), disabling the account. Mike then reported the MSP360 portal was already showing the account status as "Deleting" — one of the DELETE calls queued the deletion server-side despite returning an error body in the response.
+
+Mike then asked about retention settings for Rohrbach backups. The Monitoring endpoint confirmed two active Rohrbach entries: `rohrbach` on MIKE-THINK running a "Files Plan" (PlanType 3) daily at 9am, and `susan-think` running an image-based plan. Plan detail endpoints (`/api/Plan/{id}`, `/api/Users/{id}/Plan`, `/api/BackupPlan/{id}`) all returned 404. The only endpoint that responded for plan-level access was `/api/Computers/{hid}/Plans`, which returned HTTP 400 with `"Remote Management API methods are not enabled for your account"` — indicating plan configuration data requires a separate add-on tier. Mike declined to pursue enabling it or checking the portal.
+
+## Key Decisions
+
+- Used cached Users data from the prior pull for storage report rather than re-fetching — data was fresh from the same session.
+- Attempted all available deletion patterns before concluding the API blocks personal user deletion — did not assume failure from the first error response.
+- Left vland account in disabled state after portal confirmed deletion was already in progress — no need to re-enable or clean up.
+- Did not attempt to modify plan retention settings — scope was read-only (check only), and the endpoint isn't accessible without the Remote Management API add-on.
+
+## Problems Encountered
+
+- All MSP360 delete endpoints returned `"Not Acceptable personal user"` for `vland@airyoptics.com`. Root cause: account is `LicenseManagmentMode: 1` (personal user), which the provider API cannot delete programmatically. Worked around by disabling via PUT; portal completed the deletion independently.
+- `/api/Computers/{hid}/Plans` returned 400 `"Remote Management API methods are not enabled"` rather than 404 — endpoint exists but requires an add-on not currently active on the MSP360 account.
+
+## Configuration Changes
+
+None — read-only session after the vland disable operation.
+
+## Credentials & Secrets
+
+- Vault path accessed: `msp-tools/msp360-api.sops.yaml` (same credentials as prior update, no new secrets)
+
+## Infrastructure & Servers
+
+- MSP360 API: `https://api.mspbackups.com` → `52.6.7.137` (via 8.8.8.8 DNS workaround)
+- vland account: `98f0c6ae-0090-4d6e-acc0-cceeed5ac60b` — disabled via API, deletion initiated in portal
+- Rohrbach MIKE-THINK computer HID: `{32C6F83D-A4D6-4E5E-8DA0-698F6215A9A7}`, PlanId: `5c13b9a4-d48c-4347-bd28-ff457963bc9d`
+- Rohrbach susan-think computer HID: `{652C686F-C5CA-4A05-A8C2-FD15BA5193B7}`, PlanId: `80c6bd7e-fcda-4c0a-846e-2e0237fbf6d1`
+
+## Commands & Outputs
+
+```bash
+# Storage from Users endpoint — SpaceUsed field, grouped by Company
+# Grand total: 60.68 TB across all company-assigned accounts
+
+# vland disable (succeeded HTTP 200)
+PUT /api/Users  {"ID": "98f0c6ae-0090-4d6e-acc0-cceeed5ac60b", "Enabled": false}
+
+# vland direct delete (HTTP 400, but queued deletion server-side)
+DELETE /api/Users/98f0c6ae-0090-4d6e-acc0-cceeed5ac60b
+# Response: {"Message":"Not Acceptable personal user"}
+# Portal showed status: "Deleting" — deletion was queued despite error body
+
+# Retention probe — blocked by missing add-on
+GET /api/Computers/{hid}/Plans?userId=...
+# Response: {"Message":"Remote Management API methods are not enabled for your account"}
+```
+
+## Pending / Incomplete Tasks
+
+- vland deletion is in progress in MSP360 portal — 11.43 TB of B2Storage data being purged. No follow-up needed unless deletion fails.
+- Rohrbach retention settings remain unchecked — requires either MSP360 portal manual check or enabling Remote Management API add-on on the account.
+- Stamback Services: 2.73 TB on Local-E only (no cloud) — worth flagging to client if not intentional.
+- admin@azcomputerguru.com has 13.84 TB in B2Storage with no company assigned — should confirm this is expected (likely ACG internal/test data).
+
+## Reference Information
+
+- MSP360 storage totals by company: see session log above
+- vland UserID: `98f0c6ae-0090-4d6e-acc0-cceeed5ac60b`
+- MSP360 API DNS workaround: `--resolve api.mspbackups.com:443:52.6.7.137`
+- Remote Management API: requires add-on — toggle in MSP360 console Settings if needed
+- Rohrbach Monitoring: Files Plan (MIKE-THINK) + Image-Based (susan-think), both healthy as of 2026-06-01