wiki: compile cascades-tucson (full) — integrate UniFi RF audit (77 APs, 2.4GHz pain band, DFS resilience, 6GHz untapped); Syncro 55.75h/0 open

2026-06-15 21:03:03 -07:00
parent b83057f6e2
commit 6532476e7f
2 changed files with 56 additions and 15 deletions
--- a/wiki/clients/cascades-tucson.md
+++ b/wiki/clients/cascades-tucson.md
@@ -2,7 +2,7 @@
 type: client
 name: cascades-tucson
 display_name: Cascades of Tucson
-last_compiled: 2026-06-13
+last_compiled: 2026-06-15
 compiled_by: HOWARD-HOME/claude-main
 sources:
  - session-logs/2026-03-24-session.md
@@ -41,6 +41,8 @@ sources:
  - clients/cascades-tucson/session-logs/2026-06/2026-06-08-howard-edge-unc-download-bug-diagnosis.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-10-howard-meredith-locked-word-doc.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-12-howard-shared-mailboxes-grievances-surveys.md
  - clients/cascades-tucson/session-logs/2026-05-16-howard-wireless-diagnostic.md
  - clients/cascades-tucson/session-logs/2026-06/2026-06-15-howard-cascades-wifi-rf-audit.md
  - clients/cascades-tucson/docs/overview.md
  - clients/cascades-tucson/docs/network/topology.md
  - clients/cascades-tucson/docs/network/vlans.md
@@ -55,6 +57,7 @@ sources:
  - .claude/memory/feedback_cascades_folder_redirect.md
 backlinks:
  - projects/gururmm
  - wiki/systems/uos-server
 ---
 # Cascades of Tucson
@@ -117,14 +120,14 @@ Because per-user **Intune** never provisioned tenant-wide (`INTUNE_A = PendingIn
  - Chris Knight — Accounting / Business Office (same access tier as Lauren Hasselman); chris.knight@cascadestucson.com (alias: c.knight@cascadestucson.com); bill.com and BOK Financial recipient (issue investigated 2026-06-04). **Workstation setup 2026-06-08:** machine **DESKTOP-N5G1ROO** (Win 11 Pro for Workstations) domain-joined + GuruRMM-enrolled (agent `205025ee-2676-4498-8a27-e88562a6f69a`, site CascadesTucson), Office (O365) installed. AD account `chris.knight` (OU=Administrative) finished to match Lauren: home folder created, added to `SG-FolderRedirect`, `mail` set, AD password `Cascades2026!` (change-at-logon cleared). Mailbox remains cloud-only/unsynced (same split state as Lauren — see Entra sync note).
  - JD Martin — Syncro-confirmed contact (jd.martin@cascadestucson.com); role not yet documented.
 - **Billing rate:** $175/hr all labor (prepaid block customer)
- **Hours remaining:** **55.75 hrs (live Syncro pull 2026-06-13).** Most recent draws: 1.0h onsite for ASSISTNURSE-PC Win11 reinstall on #32303 (implied by balance chain 57.75→56.75; no dedicated session log captured); 0.5h remote 2026-06-10 Meredith locked Word doc (ticket #32403, invoice $0.00 prepaid, 56.75→56.25); 0.5h remote 2026-06-12 shared mailboxes Grievances+Surveys (ticket #32417, invoice $0.00 prepaid, 56.25→55.75). Always live-check via `GET /customers/20149445` before billing — balance is unreliable across sessions.
+- **Hours remaining:** **55.75 hrs (live Syncro pull 2026-06-15).** Most recent draws: 1.0h onsite for ASSISTNURSE-PC Win11 reinstall on #32303 (implied by balance chain 57.75→56.75; no dedicated session log captured); 0.5h remote 2026-06-10 Meredith locked Word doc (ticket #32403, invoice $0.00 prepaid, 56.75→56.25); 0.5h remote 2026-06-12 shared mailboxes Grievances+Surveys (ticket #32417, invoice $0.00 prepaid, 56.25→55.75). Always live-check via `GET /customers/20149445` before billing — balance is unreliable across sessions.
 - **Syncro customer ID:** 20149445
- **Managed devices (Syncro):** 29 (live pull 2026-06-13)
+- **Managed devices (Syncro):** 29 (live pull 2026-06-15)
- **Active tickets:** Syncro full pull 2026-06-13 shows **one real open ticket** — #32370 [New] (eFax/scanner onsite). #32414 [New] is an automated "payment on the way" notification stub, not work.
+- **Active tickets:** Syncro live pull 2026-06-15 shows **0 open tickets**. #32370 (eFax/scanner onsite) was confirmed [New]/open on 2026-06-13 — verify/likely closed; Syncro shows 0 open as of 2026-06-15. #32414 [New] was an automated "payment on the way" notification stub, not work.
  - #110680053 / #32303 — Entra / domain migration project ("Domain setup-entra sync"). Status: **Invoiced** as of 2026-06-05. Latest billing: 7.0h onsite 2026-06-05, invoice #67782 ($0.00 prepaid). Monday caregiver cutover will generate further work on this ticket. Plan: `C:\Users\Howard\.claude\plans\wise-discovering-panda.md`
  - #109412123 — Entra setup project (may be invoiced as of 2026-05-18; verify status)
  - #109035475 — John Trozzi desktop WiFi upgrade (billed)
-  - #32370 — **[New] / open (confirmed live 2026-06-13)** — eFax setup on Karen's and Christin's machines + portable scanner setup on both. No appointment scheduled as of 2026-06-02.
+  - #32370 — **verify/likely closed (Syncro live 2026-06-15 shows 0 open; was confirmed [New]/open 2026-06-13)** — eFax setup on Karen's and Christin's machines + portable scanner setup on both. No appointment scheduled as of 2026-06-02.
  - #32381 — Tamra scanner onsite (0.5h onsite, billed 2026-06-04, prepaid block)
  - #32382 — Megan file access onsite (1.5h onsite, billed 2026-06-04, prepaid block)
  - #32383 — **Resolved (confirmed live 2026-06-13)** — Chris Knight bill.com / BOK email delivery (1.5h remote, billed 2026-06-04, prepaid block; Syncro id 112201209). Fix was sender-side (bill.com support call + SendGrid suppression clear; BOK portal correction); ticket since closed.
@@ -181,11 +184,19 @@ Because per-user **Intune** never provisioned tenant-wide (`INTUNE_A = PendingIn
 - **ISP / WAN:** Dual-WAN Cox Fiber (primary, static `184.191.143.62/30`, gateway `184.191.143.61`) + Cox Coax (secondary, DHCP `72.211.21.217`). Both WAN IPs added as Cascades Named Location in Entra (ID: `061c6b06-b980-40de-bff9-6a50a4071f6f`).
 - **Firewall:** pfSense 24.0 at 192.168.0.1. All DHCP. Inter-VLAN routing. 236 resident room VLANs (per-room /28, `10.[floor].[room].0/28`). Staff/infra VLAN 20 (`10.0.20.0/24`, gateway `10.0.20.1`). Guest VLAN 50 (`10.0.50.0/24`, RFC1918 blocked).
- **Switching:** Full UniFi. 82 APs + 5 managed switches (1st Floor USW-48 PoE core; floors 2-4 USW-Pro-24-PoE; MemCare USW-Pro-24-PoE; USW Lite 8 PoE; USW-16-PoE VoIP switch). Switch hardware replacement on floors 2/3/4 complete.
+- **Switching:** Full UniFi. **77 U7-Pro APs** + ~9 managed switches (1st Floor USW-48 PoE core; floors 2-4 USW-Pro-24-PoE; MemCare USW-Pro-24-PoE; USW Lite 8 PoE; USW-16-PoE VoIP switch). All managed on the shared UOS controller (172.16.3.29; see [[uos-server]]); Cascades site_id `685f39068e65331c46ef6dd2`. Switch hardware replacement on floors 2/3/4 complete.
 - **WiFi SSIDs:**
  - CSCNet — staff, VLAN 20
  - CSC ENT — legacy SSID, main LAN (192.168.0.0/22), being deprecated as migration proceeds
  - Guest — isolated, VLAN 50
 - **Wireless RF status (live audit 2026-06-15 — ~574 concurrent clients):**
  - **2.4 GHz is the primary pain band:** avg TX-retry 11.2%, cu_total 69–94% live, catastrophic neighbor BSSID density (ch6 ~33k BSSIDs, ch1 ~19k, ch11 ~17k). 27 of the 40 worst clients on 2.4 GHz (retry 11–42%), mostly IoT/legacy (Ring cameras, robotic cleaner, smart plugs, EPSON printer, Poly phone, handheld scanners, smartwatch). Root cause: ~75 2.4 GHz radios running at auto (full) power in extreme density.
  - **5 GHz:** 80 MHz channel width on 76/77 APs (should be 40 MHz at this density). 55 of 77 5 GHz radios currently on DFS channels (52–144). DFS is a **resilience risk, not a throughput killer**: Tucson is near Davis-Monthan AFB + TUS airport radar; radar-detection events force channel-vacate + CAC silence → intermittent area-level client drops. Measured retry rate on DFS (8.4%) ≈ non-DFS clear channels (9.0%) — no throughput penalty observed today.
  - **6 GHz:** active on 75 radios; only 1 client of 574 connected. Largest untapped, clean, non-DFS capacity — band-steering capable clients to 6 GHz is a top opportunity.
  - **AP-level satisfaction 95–100 fleet-wide.** Pain is in the client tail, presenting as "bad for SOME users" — those whose devices land or stick on 2.4 GHz.
  - **Config flags (remediation pending):** 6 APs have 2.4 min-RSSI OFF (615, 608, 505, 517, 622, salon); 4 APs off the 1/6/11 channel plan on auto (128, 108, 108U7 Pro, salon); 2.4 TX power auto on ~75 radios.
  - **Known hardware:** AP 108 (Floor 1) offline pending a new cable run (expected); stale duplicate controller object ("108" vs "108U7 Pro") to clean up.
  - **Creds (vault refs only):** `infrastructure/uos-server-ssh-key` (SSH/Mongo access), `infrastructure/uos-server-network-api-rw` (RW controller admin), `clients/cascades-tucson/unifi-ap-ssh` (per-AP device auth via site VPN).
 - **VoIP:** AudioCodes phones (8 units) on USW-16-PoE. CS-QB VM at 192.168.2.228. Not MSP-managed but infra must stay static.
 ### External Vendors & Mail Senders
@@ -207,6 +218,9 @@ Because per-user **Intune** never provisioned tenant-wide (`INTUNE_A = PendingIn
 - **MDM service account:** vault: `clients/cascades-tucson/mdm-service-account.sops.yaml`
 - **svc-scan (scan-to-folder service account):** vault: `clients/cascades-tucson/svc-scan.sops.yaml` (`credentials.password`). AD account on CS-SERVER for the Accounting Brother's SMB scans — see Patterns -> File Shares & Scan-to-Folder.
 - **ALIS SSO app registration:** vault: `clients/cascades-tucson/alis-sso-app-registration.sops.yaml`
 - **UOS controller SSH (root):** vault: `infrastructure/uos-server-ssh-key` — SSH/Mongo access for `unifi-wifi` skill and `uos-mongo.sh`. Vaulted 2026-06-15 by Mike.
 - **UOS controller RW admin (Network API):** vault: `infrastructure/uos-server-network-api-rw` — required to apply any radio/config changes. Vaulted 2026-06-15 by Mike.
 - **UniFi AP device auth (Cascades):** vault: `clients/cascades-tucson/unifi-ap-ssh` — direct AP SSH via site VPN (needed for `watch-ap.sh` live stream). Vaulted 2026-06-15 by Mike.
 - **GuruRMM — RECEPTIONIST-PC:** agent ID `9c91d324-1073-449c-8cc0-45c5bccfc218` (flaky WebSocket, may lag fleet updates)
 - **GuruRMM — ASSISTMAN-PC (Meredith Kuhn):** agent ID `cf86fa5e-96a2-494d-9cb1-8be22a518ad0`
 - **Remediation tool:** Full tiered app suite consented 2026-04-21. All six apps active: Security Investigator, Exchange Operator, User Manager, Tenant Admin, Defender Add-on, Intune Manager. Old app `fabb3421` (ComputerGuru - AI Remediation) still present but superseded.
@@ -315,6 +329,26 @@ Because per-user **Intune** never provisioned tenant-wide (`INTUNE_A = PendingIn
 - **Get-MessageTrace is deprecated.** Use `Get-MessageTraceV2` instead. V2 has a 10-day max window — loop 9 consecutive windows to cover 90 days. A wildcard sender with a 30-day window returns false positives due to the window-limit violation; keep windows to 10 days and use specific sender domains.
 - **EXO access token auth:** When `Connect-ExchangeOnline -Credential` fails (MFA/modern auth block) and the app cert is not in the Windows cert store, use client_credentials flow to get an EXO-scoped token and pass it via `-AccessToken`. See access note in the Access section above.
 ### Wireless / UniFi RF
 - **Fleet (live audit 2026-06-15):** 77 U7-Pro APs, ~9 UniFi switches, ~574 concurrent wireless clients. Managed on shared UOS controller (172.16.3.29; see [[uos-server]]); Cascades site_id `685f39068e65331c46ef6dd2`.
 - **Primary pain band is 2.4 GHz.** Avg TX-retry 11.2%; cu_total 69–94% live; catastrophic neighbor BSSID density (ch6 ~33k BSSIDs, ch1 ~19k, ch11 ~17k). 27 of the 40 worst clients stuck on 2.4 GHz (retry 11–42%), mostly IoT/legacy hardware (Ring cameras, robotic cleaner, smart plugs, EPSON printer, Poly phone, handheld scanners, smartwatch). Root cause: ~75 2.4 GHz radios running at auto (full) TX power in extreme AP density.
 - **5 GHz — DFS is a resilience risk, not a throughput killer.** 76/77 radios on 80 MHz width (should be 40 MHz at this density). 55/77 radios on DFS channels (52–144). Davis-Monthan AFB + TUS airport radar are nearby → radar-detection events force channel-vacate + CAC silence → intermittent area-level client drops. Measured TX-retry rate on DFS radios (8.4%) is approximately equal to non-DFS (9.0%) — no throughput penalty observed. An earlier mid-session claim during the 2026-06-15 audit that DFS was the #1 problem was an artifact of tooling bugs (raw counter + 15-AP sample cap) and was withdrawn after correction. Do not repeat that claim.
 - **6 GHz is nearly unused.** 75 radios active; only 1 client of 574. Largest untapped, clean, non-DFS capacity. Band-steering 6E-capable clients to 6 GHz is the highest-ROI tuning opportunity.
 - **AP-level satisfaction 95–100 fleet-wide.** Network is healthy on average; pain is in the client tail, consistent with "bad for SOME users" reports.
 - **Config flags (remediation pending):** 6 APs have 2.4 min-RSSI OFF (615, 608, 505, 517, 622, salon); 4 APs off the 1/6/11 channel plan on auto (128, 108, 108U7 Pro, salon); 2.4 TX power auto on ~75 radios.
 - **Known hardware issues:** AP 108 (Floor 1) offline pending a new cable run (per Howard — expected). Stale duplicate controller object ("108" vs "108U7 Pro") to clean up separately.
 - **Tuning plan (prioritized — NOT yet applied; all writes gated on per-zone live validation):**
  1. 2.4 GHz TX power → Low, per-zone (one floor at a time; live before/after cu_total + retry% validation via `live-stats.sh`).
  2. Steer 6E-capable clients to 6 GHz (band-steering config).
  3. 5 GHz: 80 → 40 MHz width; non-DFS channel plan (UNII-1 36–48 + UNII-3 149–161) for resilience against radar events.
  4. Min data rates: kill 1–11 Mbps; 2.4 GHz floor 12/24 Mbps.
  5. 2.4 min-RSSI −75/−76 on the 6 APs where it is currently OFF; pin 4 off-plan APs to ch 1/6/11.
  - AP radio disables deferred until an AP-to-AP RF-neighbor table is built (requires rogue BSSID cross-ref vs each AP's vap_table via Mongo). Until then, power/channel/width are the safe levers. Writes require the RW cred (`infrastructure/uos-server-network-api-rw`; vaulted 2026-06-15).
 - **Tooling:** `unifi-wifi` skill + `live-stats.sh` (Network API, Plane 2) = live validation path. `uos-mongo.sh` (Mongo, Plane 1) = config/interference path. Creds: `infrastructure/uos-server-ssh-key` (SSH/Mongo), `infrastructure/uos-server-network-api-rw` (RW API), `clients/cascades-tucson/unifi-ap-ssh` (per-AP SSH, needs site VPN for L3 reach to 192.168.2.x).
 - **Prior diagnostic (2026-05-16):** cloud API only, read-only; identified 2.4 GHz saturation hypothesis. Controller access was blocked at the time. Live controller access gained 2026-06-15.
 - **Tooling note:** `live-stats.sh` had accuracy bugs fixed 2026-06-15: removed 15-AP head cap (was hiding 62 of 77 APs), switched satisfaction to device-level (per-radio always −1), switched TX-retries to `tx_retries_pct` rate field, sorted worst-client list by satisfaction. These bugs caused a mid-session misdiagnosis that was corrected before the session ended.
 ### Known Issues / Pending Hygiene (as of 2026-06-04)
 - **[BUG] Stale exclude-group on MFA-all-users policy:** The `Require multifactor authentication for all users` policy (`7e87a1c7…`) currently excludes `SG-Caregivers-Pilot` (`0674f0bc…`) instead of the live `SG-Caregivers` (`8b8d9222…`). Functionally harmless today (pilot group still exists), but this is a known bug that must be corrected. Fix: PATCH `excludeGroups` to replace `SG-Caregivers-Pilot` with `SG-Caregivers`.
@@ -343,7 +377,7 @@ Because per-user **Intune** never provisioned tenant-wide (`INTUNE_A = PendingIn
 ## Active Work
-Primary active project as of 2026-05-24: dept-by-dept domain migration (Syncro #110680053). Syncro full pull 2026-06-13: one real open ticket — #32370 (eFax/scanner onsite); #32414 [New] is an automated payment-notification stub.
+Primary active project as of 2026-05-24: dept-by-dept domain migration (Syncro #110680053). Syncro live pull 2026-06-15: **0 open tickets** (was one real open ticket — #32370 eFax/scanner onsite — as of 2026-06-13; verify/likely closed).
 **Migration phase status (as of 2026-05-26):**
@@ -366,7 +400,7 @@ Primary active project as of 2026-05-24: dept-by-dept domain migration (Syncro #
 - RECEPTIONIST-PC GuruRMM agent (9c91d324): flaky WebSocket, lagging fleet
 - Entra Connect: OU=Administrative not yet in sync scope; UPN suffix updates for that OU pending
 - NURSESTATION-PC: reboot required to activate `CSC - Caregiver Device Lockdown` GPO (deployed 2026-06-05, linked to `OU=Caregiver Devices`; startup script runs at boot — verify lock@3min, 90s warning, sign-out@15min, never-sleep)
- #32370 [New / open — confirmed live 2026-06-13]: Howard onsite — eFax setup on Karen's and Christin's machines; portable scanner setup on both. No appointment scheduled as of 2026-06-02.
+- #32370 — eFax/scanner onsite (Howard); verify/likely closed (Syncro live 2026-06-15 shows 0 open; was confirmed [New]/open 2026-06-13). No appointment scheduled as of 2026-06-02.
 - Caregiver device allow-list: ASSISTNURSE-PC needs re-join + re-tag after Win11 reinstall; LAPTOP-8P7HDSEI Win11 upgrade + join/tag still pending; then cutover (enable allow-list policy, disable compliance-block)
 - ALIS office/privileged standardization: move office/managers/nurses to ALIS SSO-only; disable ALIS-native 2FA per-user then globally (separate workstream)
 - Fix stale `SG-Caregivers-Pilot` exclude-group on `Require MFA for all users` policy (known bug, see Known Issues)
@@ -374,6 +408,7 @@ Primary active project as of 2026-05-24: dept-by-dept domain migration (Syncro #
 - Chris Knight bill.com/BOK Financial addresses: confirm updated in bill.com backend and at BOK Financial (resolved externally 2026-06-04 but no confirmation of actual address update on vendor side)
 - Edge UNC download bug (Chromium 149): decide fix path for Ashley Jensen + Lois Lane and fleet (see Patterns -> Browser / Edge); no fix applied as of 2026-06-08
 - ALIS app session timeout: lower from 20 to 15 min (Howard, ALIS admin) — PENDING
 - **Wireless RF tuning (staged, no changes applied as of 2026-06-15):** 2.4 GHz TX power → Low per-zone (Floor 4 pilot first; live cu_total + retry% before/after validation); 6 GHz band-steering for capable clients; 5 GHz 80→40 MHz + non-DFS channel plan (UNII-1+UNII-3); min data rates; min-RSSI + channel-plan fixes on 6 flagged APs. Gated: build AP-to-AP RF-neighbor table before any AP disables; pull radar-detection event history to confirm DFS avoidance need; site VPN `.ovpn` needed for `watch-ap.sh` live stream (pfSense OpenVPN Client Export).
 ---
@@ -393,7 +428,7 @@ Primary active project as of 2026-05-24: dept-by-dept domain migration (Syncro #
 | 2026-04-30 | CA rollout (Report-only mode): 3 caregiver policies created. SDM bootstrap. |
 | 2026-05-01 | Howard billed 33.5 hrs against prepaid block on Entra project ticket #32214 ($0 invoice). |
 | 2026-05-07-08 | SDM phone provisioning. SDM token success. ALIS SSO app registration values captured to vault. |
-| 2026-05-14-16 | Caregiver AD accounts created. Security groups always deliberate (no OU→group automation). Wireless diagnostic. |
+| 2026-05-14-16 | Caregiver AD accounts created. Security groups always deliberate (no OU→group automation). Wireless diagnostic (read-only via cloud API; 2.4 GHz saturation hypothesis identified; local controller inaccessible at the time). |
 | 2026-05-18 | Billing review. 39.5 hrs remaining before session. 7 hrs billed separately. |
 | 2026-05-20 | Canva email delivery resolved (canva.com domains added to EOP). |
 | 2026-05-21 | Crystal Rodriguez folder redirect confirmed working. Lauren Hasselman + Crystal Rodriguez domain join attempted — passwords didn't work initially. |
@@ -411,12 +446,13 @@ Primary active project as of 2026-05-24: dept-by-dept domain migration (Syncro #
 | 2026-06-09 | **Accounting scan-to-folder built + billing reconciliation.** Created `D:\Shares\Accounting` + `\Scans` on CS-SERVER (NTFS locked to `lauren.hasselman`/`chris.knight`/`zachary.nelson` = Modify, no Everyone; `svc-scan` = Modify on `\Scans` only), shared as `\\CS-SERVER\AcctDept` (named AcctDept because a Canon MF455DW *printer* share already owns "Accounting" — restored that share after a grant collision). New vaulted AD service account `svc-scan` for the Brother's SMB auth. Brother MFC-L8900CDW (10.0.20.220) Scan-to-Network profile → `\\192.168.2.254\AcctDept\Scans` (NTLMv2, `cascades\svc-scan`); **test scan confirmed**. Found pfSense blocks main-LAN→VLAN-20 (can't reach VLAN-20 printer WBM from CS-SERVER; printer→server:445 open). Persistent drive maps to the share: Chris (Y:), Zachary on ACCT2-PC (Y:), Lauren (X:). Also reconciled crashed-session billing: #32330 (Chris Knight computer) was already invoiced (#67790) — fixed status Resolved→Invoiced; live prepay confirmed **57.75h** (prior 7.75 was pre-top-up). Updated machine inventory (ASSISTNURSE-PC reinstall, caregiver device table) in this wiki. |
 | 2026-06-10 | **Meredith Kuhn locked Word doc — stale owner files on cascadesDS.** Five orphaned Word `~$` owner files dated 2024 in `\\cascadesds\Public\Company Web Docs\Staff Trainings\` caused false "locked for editing" messages on training documents with no active session. Diagnosed and deleted all 5 via RMM in Meredith's `user_session` on ASSISTMAN-PC (agent `cf86fa5e`) — CS-SERVER SYSTEM cannot authenticate to cascadesDS (workgroup/Kerberos mismatch). Howard's post-reboot check on the Synology confirmed no live handles. Ticket #32403 (id 112502876), 0.5h remote, invoice $0.00 prepaid, block 56.75→56.25. |
 | 2026-06-12 | **Created shared mailboxes grievances@ + Surveys@ and delegated to Meredith & Ashley.** `grievances@cascadestucson.com` and `Surveys@cascadestucson.com` created as SharedMailbox (cloud-only, no license consumed), each delegated to Meredith Kuhn and Ashley Jensen with FullAccess (auto-mapping) + SendAs. Work done via ComputerGuru Exchange Operator MSP app cert auth (EXO module v3.10.0 installed on Howard-Home for this session). All 8 permission grants verified post-creation. Ticket #32417 (id 112597225), 0.5h remote, invoice #1650665832 $0.00 prepaid, block 56.25→55.75; ticket Invoiced. |
 | 2026-06-15 | **Wireless RF full audit — controller access gained.** Mike vaulted `infrastructure/uos-server-ssh-key` + `clients/cascades-tucson/unifi-ap-ssh`; `unifi-wifi` skill used end-to-end. Live audit via UOS Mongo (Plane 1) confirmed 77 U7-Pro APs, 574 clients, 2.4 GHz saturation as primary pain band (avg retry 11.2%, cu_total 69–94%, catastrophic neighbor density). Accuracy bugs in `live-stats.sh` found and fixed mid-session (15-AP head cap, wrong satisfaction/retry fields) — corrected the data and corrected a mid-session misdiagnosis that DFS was the #1 problem (withdrawn; DFS retry rate 8.4% ≈ non-DFS 9.0%). Mike also vaulted `infrastructure/uos-server-network-api-rw` (RW controller admin) same day; Plane 2 (Network API) re-audited and confirmed findings. DFS designated a resilience concern (near Davis-Monthan AFB + TUS radar), not a throughput concern. 6 GHz (1 client of 574) identified as largest untapped capacity. Tuning plan staged (see Patterns -> Wireless / UniFi RF); no changes applied. |
 ---
 ## Compilation Notes
-**Session logs read:** 28 root session logs + client-specific logs in `clients/cascades-tucson/session-logs/` (through 2026-06-12 shared-mailbox session) + 7 memory files + 5 structured docs. Date range: 2026-03-06 through 2026-06-12.
+**Session logs read:** 28 root session logs + client-specific logs in `clients/cascades-tucson/session-logs/` (through 2026-06-15 wireless RF audit) + 7 memory files + 5 structured docs. Date range: 2026-03-06 through 2026-06-15.
 **Client folder:** `clients/cascades-tucson/` (NOT `clients/cascades/` — that directory does not exist).
@@ -426,12 +462,16 @@ Primary active project as of 2026-05-24: dept-by-dept domain migration (Syncro #
 - dunedolly21@gmail.com guest invite — confirm with Lauren
 - Windows MDM auto-enroll scope — confirm in portal (Entra → Devices → Mobility → Microsoft Intune → MDM user scope)
 - #32381 / #32382 ticket details (Tamra scanner, Megan file access) — referenced in 2026-06-04 session log reference table only; full ticket details not documented in session logs
- #32370 — confirmed [New]/open in Syncro 2026-06-13 (eFax/scanner onsite, not yet scheduled)
+- #32370 — verify/likely closed; Syncro live 2026-06-15 shows 0 open tickets (was confirmed [New]/open on 2026-06-13)
 - Edge UNC download bug fix path — no fix applied as of 2026-06-08; decision pending Howard
 - ALIS BAA with Medtelligent — not yet verified; confirm with Meredith
 - JD Martin (jd.martin@cascadestucson.com) — confirmed Syncro contact; role not yet documented
 - Wireless RF tuning — tuning plan staged 2026-06-15; no changes applied; per-zone execution pending RW cred + go-ahead
-**Resolved since last compile (2026-06-05 → 2026-06-13):**
+**Resolved since last compile (2026-06-13 → 2026-06-15):**
 - Wireless controller access unblocked (2026-06-15): `infrastructure/uos-server-ssh-key` + `infrastructure/uos-server-network-api-rw` + `clients/cascades-tucson/unifi-ap-ssh` vaulted by Mike; live RF audit completed with `unifi-wifi` skill; `live-stats.sh` accuracy bugs fixed; tuning plan staged.
 **Carried forward from prior compile (2026-06-05 → 2026-06-13):**
 - New tiered remediation app suite — confirmed consented 2026-04-21 (all 6 apps active)
 - DMARC — confirmed upgraded to p=quarantine;pct=100
 - ALIS AADSTS65001 sign-in failures — resolved 2026-06-03 by granting admin consent
@@ -446,3 +486,4 @@ Primary active project as of 2026-05-24: dept-by-dept domain migration (Syncro #
 ## Backlinks
 - [[projects/gururmm]] — RECEPTIONIST-PC enrolled (site CascadesTucson); CS-SERVER enrolled
 - [[wiki/systems/uos-server]] — shared UOS controller hosts the Cascades UniFi site (site_id `685f39068e65331c46ef6dd2`); SSH/Mongo access via `infrastructure/uos-server-ssh-key`
--- a/wiki/index.md
+++ b/wiki/index.md
@@ -1,7 +1,7 @@
 # Wiki Index
-Last updated: 2026-06-14
+Last updated: 2026-06-15
-Compiled by: Mikes-MacBook-Air/claude-main
+Compiled by: HOWARD-HOME/claude-main
 This wiki is LLM-maintained. Do not edit articles manually — run `/wiki-compile` to update.
 Run `/wiki-lint` to check for stale entries and broken backlinks.
@@ -18,7 +18,7 @@ Run `/wiki-lint` to check for stale entries and broken backlinks.
 | Article | Summary | Last Compiled |
 |---|---|---|
-| [Cascades of Tucson](clients/cascades-tucson.md) | Prepaid block $175/hr, **55.75 hrs remaining** (live 2026-06-13); senior living; active domain migration + HIPAA compliance project; single DC on aging R610 hardware; caregiver restricted-access model PROVEN 2026-06-05: Hybrid Entra Join + CA allow-list + ALIS SSO validated on NURSESTATION-PC/pilot.test; GPO `CSC - Caregiver Workstation` (shortcuts + printers) built + validated; GPO `CSC - Caregiver Device Lockdown` deployed (HIPAA auto-logoff, activates on reboot); INTUNE_A PendingInput tenant-wide (MS case open; GPO path used instead); folder-redirection root cause fixed 2026-06-08 (fdeploy.ini); shared mailboxes grievances@/Surveys@ created + delegated 2026-06-12 (#32417); Monday cutover to real caregivers pending; open ticket #32370 (eFax + scanner); #32383 (bill.com/BOK chris.knight) Resolved | 2026-06-13 |
+| [Cascades of Tucson](clients/cascades-tucson.md) | Prepaid block $175/hr, **55.75 hrs remaining** (live 2026-06-13); senior living; active domain migration + HIPAA compliance project; single DC on aging R610 hardware; caregiver restricted-access model PROVEN 2026-06-05: Hybrid Entra Join + CA allow-list + ALIS SSO validated on NURSESTATION-PC/pilot.test; GPO `CSC - Caregiver Workstation` (shortcuts + printers) built + validated; GPO `CSC - Caregiver Device Lockdown` deployed (HIPAA auto-logoff, activates on reboot); INTUNE_A PendingInput tenant-wide (MS case open; GPO path used instead); folder-redirection root cause fixed 2026-06-08 (fdeploy.ini); shared mailboxes grievances@/Surveys@ created + delegated 2026-06-12 (#32417); Monday cutover to real caregivers pending; #32383 (bill.com/BOK chris.knight) Resolved; UniFi wifi RF audit 2026-06-15 (77 U7-Pro APs/~574 clients via UOS controller): 2.4GHz primary pain band, DFS=resilience risk near Davis-Monthan, 6GHz untapped — tuning plan staged, not applied; Syncro 0 open tickets (verify #32370) | 2026-06-15 |
 | [Dataforth Corporation](clients/dataforth.md) | Prepaid block ~$2,099/mo, 34.5 hrs remaining; signal conditioning manufacturer; 64 DOS test stations; 2025 crypto attack recovery + incomplete restore (files dropped across shares — migration-gap audit in progress); 2026-03-27 phishing incident + MFA rollout; active test datasheet pipeline project; Neptune Exchange colocated at D2; 2026-06-04 SP1366 file recovery (19/20 PDFs restored from HGHAUBNER pre-attack backup); GuruRMM fleet 13→45 agents; 2026-06-02 Syncro asset reconciliation (78→20 keep/21 flag/28 remove/9 verify); fleet-wide Syncro agent break ~2025-10-06; Bitdefender phase-off in progress | 2026-06-04 |
 | [Instrumental Music Center](clients/instrumental-music-center.md) | Prepaid block $175/hr, 12.5 hrs remaining; music retail/repair; AIMsi POS on SQL Server 2019; phantom DC causing slow logons; GuruRMM enrolled (IMC1) | 2026-05-24 |
 | [Valley Wide Plastering](clients/valleywide.md) | Prepaid block, 10 hrs remaining; plastering/stucco contractor; HP DL360 Gen10 + XenServer; VB6 app modernization project; RDWeb brute-force incident; 11 Yealink phones pending | 2026-06-14 |