sync: auto-sync from HOWARD-HOME at 2026-06-02 15:12:52

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-06-02 15:12:52

clients/lonestar-electrical/session-logs/2026-06-02-session.md

@@ -65,3 +65,53 @@ Because a new USB has a new GUID, the existing license key would not validate ag
 - License transfer/registration: webGUI → Tools → Registration → Replace Key (self-service transfer limited to once per 12 months; LimeTech support for dead-stick reissue).
 - Files on a bootable Unraid stick: `bzimage`, `bzroot`, `bzroot-gui`, `bzmodules`, `bzfirmware` (+ matching `.sha256`), `syslinux/`, `make_bootable*`. The `config/` folder holds array/license state and must be preserved across migrations.
 - Lonestar wiki: `wiki/clients/lonestar-electrical.md`. Syncro customer: `33809612`.
+
+## Update: 22:10 PT — LS-1 Sophos removal prep + packetdial sync resurrection
+
+### Session Summary
+Resumed the long-pending Sophos Endpoint removal on the Lone Star workstations (the `SophosED.sys` kernel boot driver that blocks every user-mode removal; offline WinRE/PE completion was staged 2026-05-29). Howard has both LS-1 and LS-2 on hand plus a bootable PE. Pulled the exact offline procedure from the 2026-05-29 sophos-removal log and walked it through for LS-1.
+
+Started with LS-1. Howard booted into normal Windows to verify BitLocker before the offline edit (PE cannot reach `System32` on a locked volume without the recovery key). Confirmed BitLocker is OFF on LS-1, and staged `SophosZap.exe` in Downloads for the post-reboot cleanup. LS-1 was about to boot to PE to run the driver delete + offline-hive service disable. Awaiting the `dir` drive-letter check from PE before greenlighting the `del`.
+
+Separately, a `/sync` exposed a fleet repo-coordination problem: the `.claude/skills/packetdial/` skill was sitting untracked on HOWARD-HOME, so `git add -A` re-committed it just as Mike's incoming commit `c759f04` ("re-apply consolidation deletions") deleted it. The rebase replayed the add on top of the delete, resurrecting packetdial at HEAD (`dd414c4`) and pushing it back to origin — the exact additive-sync resurrection loop Mike's commit message was fighting (memory files deleted in `0c00010` were resurrected by `sync-memory.sh` on GURU-5070). Flagged to Howard; packetdial is a live, functional skill in the registry, so its deletion inside a memory-consolidation commit may have been collateral. Left the keep/re-delete decision to Mike rather than acting unilaterally.
+
+### Key Decisions
+- Verified BitLocker OFF on LS-1 from inside Windows before the PE step, rather than discovering a locked volume at the PE prompt — avoids needing the recovery key mid-procedure.
+- Did NOT unilaterally re-delete the resurrected packetdial skill nor silently keep it; surfaced to the human (Mike's call) because it is a working skill and its deletion may have been unintentional collateral in a memory-cleanup commit.
+- Deferred the broadcast `/self-check` fleet-census request (from GURU-5070) until after the LS-1 field work, rather than interrupting the active ticket.
+
+### Problems Encountered
+- **Push race during sync.** First `sync.sh` push rejected ("fetch first") because the remote advanced between fetch and push. Resolved by re-running sync (fetch + rebase + push succeeded: `c759f04..dd414c4`).
+- **packetdial skill resurrection.** Untracked local files re-added by additive sync, undoing Mike's deletion. Surfaced for Mike's decision; not yet resolved.
+
+### Configuration Changes
+- `.claude/skills/packetdial/` (SKILL.md, references/api.md, scripts/ns.py, scripts/ns_client.py) re-added to repo at `dd414c4` (UNINTENTIONAL resurrection — pending Mike's keep/delete decision).
+- Pulled in from fleet: `.claude/skills/self-check/` + `.claude/commands/self-check.md` (Mike), guru-connect/gururmm submodule bumps, memory consolidation deletions.
+
+### Infrastructure & Servers
+- **LS-1, LS-2** — Win11 workstations, Lone Star Norris site. BitLocker confirmed OFF on LS-1. Sophos removal blocked by `SophosED.sys` kernel boot driver (`Start=0`).
+- Service to disable in offline hive: `Sophos Endpoint Defense` (set `Start=4`).
+
+### Commands & Outputs
+- Offline removal (run in PE, substitute real Windows drive letter for `D:`):
+  - `del /f D:\Windows\System32\drivers\SophosED.sys`
+  - `reg load HKLM\TEMPSYS D:\Windows\System32\config\SYSTEM`
+  - `reg add "HKLM\TEMPSYS\CurrentControlSet\services\Sophos Endpoint Defense" /v Start /t REG_DWORD /d 4 /f`
+  - `reg unload HKLM\TEMPSYS`
+  - reboot normal, then `SophosZap.exe --confirm`
+- Drive-letter discovery in PE: `dir C:\Windows & dir D:\Windows & dir E:\Windows`
+- BitLocker check (normal Windows, elevated): `manage-bde -status`
+
+### Pending / Incomplete Tasks
+- **LS-1:** boot PE, confirm Windows drive letter, run offline SophosED.sys removal, reboot, `SophosZap --confirm`. Awaiting drive-letter check.
+- **LS-2:** same offline procedure, not yet started.
+- **Syncro ticket** "Sophos Endpoint Removal - LS-1 and LS-2": verify it exists / create, then log time (prepaid block, live-check `GET /customers/33809612`).
+- **packetdial resurrection:** Mike to decide keep vs. re-delete; offered to send a coord message to him.
+- **Fleet `/self-check`:** run on HOWARD-HOME after field work, apply fixes, re-run to GREEN, then `/self-check --publish`.
+- Vault + document the Lonestar Unraid server (root pw, hostname, IP, license type).
+
+### Reference Information
+- Coord handoff: msg `689cfb7c` (2026-06-01, Sophos removal to Howard).
+- Mike's deletion commit: `c759f04` "chore(memory): re-apply consolidation deletions + lift additive-only constraint".
+- HEAD after sync: `dd414c4`.
+- Full LS-1/LS-2 offline procedure: `clients/lonestar-electrical/session-logs/2026-05-29-sophos-removal.md`.