diff --git a/clients/bardach/session-logs/2026-07/2026-07-22-howard-laptop-slowness-diag.md b/clients/bardach/session-logs/2026-07/2026-07-22-howard-laptop-slowness-diag.md
index fec6b793..dd032c74 100644
--- a/clients/bardach/session-logs/2026-07/2026-07-22-howard-laptop-slowness-diag.md
+++ b/clients/bardach/session-logs/2026-07/2026-07-22-howard-laptop-slowness-diag.md
@@ -99,3 +99,23 @@ reboot, on an ARM chip. Howard disabled Nord Threat Protection himself during th
 - Dev-alerts posts: 1529625522437488650 (diag), 1529625749848592556 (HMP dispatch),
   1529634487640522814 (ARM incompat + Defender substitute)
 - errorlog.md entry: 2026-07-22 GURU-BEAST-ROG rmm/hitmanpro (HMP-on-ARM)
+
+## Update: 18:35 AZ — Event-log window review + Syncro ticket/billing
+
+Howard asked what happened 3:20-3:40 PM on the endpoint. Event log pull (cmd aeaba312):
+woke from Modern Standby 3:23; user-initiated restart 3:25:33 with ~38 DCOM 10010
+timeout errors during the crawling shutdown; reboot 3:26:37 with ~10 WudfRd/Surface
+driver warnings (device is a Surface Pro ARM); Firefox hang force-closed 3:27:14
+(Application Hang 1002); firmware CPU throttling 3:28:12 (Kernel-Processor-Power 37);
+DNS-Client 1014 "no configured DNS servers responded" 3:31:20 — consistent with
+NordVPN Threat Protection DNS filtering stalling. No malware indicators. Howard
+disabled Nord Threat Protection manually.
+
+Syncro (Howard's key, his attribution): created ticket #32582 (id 114134478),
+"Remote - LAPTOP-E5EKEJT8 slow and unresponsive - diagnostics", asset 2185808
+(Microsoft Surface Pro Pink Tablet) attached. Comments: Initial Issue (424964795) +
+Diagnostics and Resolution (424964797), both do_not_email; HitmanPro excluded per
+Howard. Billed 0.5h Labor - Remote Business (product 1190473, line 43381261);
+invoice 1651137956 at $0.00, prepay block verified 16.25 -> 15.75; invoice note
+"Block hours remaining: 15.75."; ticket marked Invoiced. Bot alert posted
+(message 1529658687298473998).