diff --git a/clients/cascades-tucson/session-logs/2026-05-21-session.md b/clients/cascades-tucson/session-logs/2026-05-21-session.md
new file mode 100644
index 0000000..17d7239
--- /dev/null
+++ b/clients/cascades-tucson/session-logs/2026-05-21-session.md
@@ -0,0 +1,93 @@
+## User
+- **User:** Howard Enos (howard)
+- **Machine:** HOWARD-HOME
+- **Role:** tech
+- **Session span:** 2026-05-20 ~22:47 PT – 2026-05-21 afternoon
+
+---
+
+## Session Summary
+
+Short session bridging the end of the 2026-05-20 phase 2.6 work and a midday sync on 2026-05-21. The primary action was posting an internal comment to Syncro ticket #32303 (110680053) documenting that passwords supplied for Lauren Hasselman and Crystal Rodriguez did not work this session, preventing work on their machines. The comment was posted via the Syncro API (`/api/v1/tickets/110680053/comment`) using form-encoded data (JSON body returned 400 — resolved by switching to form encoding with `--data-urlencode`).
+
+Ran `/sync` at midday on 2026-05-21 and pulled 11 commits from Mike Swanson, including a major overhaul of the `/syncro` skill. The timer-based billing workflow (`timer_entry → charge_timer_entry`) has been replaced with a direct `add_line_item` approach. Reviewed the updated `syncro.md` to understand the new billing flow before the next Cascades session.
+
+---
+
+## Key Decisions
+
+- Comment posted as hidden/internal to avoid customer-visible email. `do_not_email: true`, `hidden: true`.
+- Used form-encoded POST (`--data-urlencode`) instead of JSON body — Syncro `/comment` endpoint returns 400 on JSON content-type but requires `subject` field when form-encoded.
+- Did not attempt any machine work for Lauren or Crystal this session — passwords were not working and no alternative access path was available.
+
+---
+
+## Problems Encountered
+
+- **Syncro comment endpoint returned 400 on JSON POST:** Two JSON attempts failed with 400 (no error message in body, just HTML 400 page). Switched to `--data-urlencode` form encoding; first attempt returned `{"success":false,"message":["Subject can't be blank"]}` — added `subject` field, comment posted successfully on second attempt.
+
+---
+
+## Configuration Changes
+
+None — no server or domain changes this session.
+
+---
+
+## Credentials & Secrets
+
+- Howard Syncro API key: `Tde5174a6e9e312d14-02fd5bfe0f0ee40c87d027507c680e18`
+- GuruRMM API: http://172.16.3.30:3001 — claude-api@azcomputerguru.com / ClaudeAPI2026!@# (JWT required)
+
+---
+
+## Infrastructure & Servers
+
+- CS-SERVER: DC + file server, cascades.local
+- Cascades customer ID: 20149445, prepay remaining: 35.5 hours (as of 2026-05-20 evening)
+
+---
+
+## Commands & Outputs
+
+```bash
+# Successful comment POST (form-encoded)
+curl -s -X POST "https://computerguru.syncromsp.com/api/v1/tickets/110680053/comment" \
+  -H "Authorization: Tde5174a6e9e312d14-02fd5bfe0f0ee40c87d027507c680e18" \
+  --data-urlencode "subject=Lauren Hasselman / Crystal Rodriguez - unable to access machines" \
+  --data-urlencode "body=Attempted to continue Administrative dept migration this session. Passwords provided by Lauren Hasselman and Crystal Rodriguez did not work - could not log into their machines. Will need updated credentials or a scheduled time to access those machines before their folder redirection can be completed. Zachary Nelson folder redirection was confirmed working on ACCT2-PC." \
+  --data-urlencode "hidden=true" \
+  --data-urlencode "do_not_email=true"
+
+# Response: {"comment":{"id":412091314,"created_at":"2026-05-20T22:47:14.264-07:00","ticket_id":110680053,"subject":"Lauren Hasselman / Crystal Rodriguez - unable to access machines","tech":"Howard Enos","hidden":true,"user_id":1750}}
+```
+
+---
+
+## Pending / Incomplete Tasks
+
+1. **Lauren Hasselman** — Howard must move her OneDrive data to local folders manually first, then:
+   ```powershell
+   Add-ADGroupMember -Identity SG-FolderRedirect -Members lauren.hasselman
+   ```
+   Log her off/on, verify `\\CS-SERVER\homes\lauren.hasselman\` populated. Get working credentials first.
+
+2. **Crystal Rodriguez** — Same prereq (working credentials). Folder redirection pending.
+
+3. **Entra Connect expansion** — Add `cascadestucson.com` UPN suffix; change Administrative OU users' UPNs to `@cascadestucson.com`; add OU=Administrative to sync scope; run delta sync; verify soft-match.
+
+4. **Phase 3 domain joins** — DESKTOP-KQSL232, CHEF-PC, SALES4-PC, MDIRECTOR-PC (MDIRECTOR-PC needs Win10 Home → Pro first).
+
+5. **Pre-Phase 3 prerequisites** — Populate SG-Mgmt-RW, SG-Sales-RW, SG-Activities-RW; krbtgt rotation (569+ days); remove Meredith.Kuhn + John.Trozzi from Domain Admins.
+
+---
+
+## Reference Information
+
+- Migration master plan: `C:\Users\Howard\.claude\plans\wise-discovering-panda.md`
+- Resume command: "resume the Cascades migration plan"
+- Syncro migration ticket: https://computerguru.syncromsp.com/tickets/110680053 (#32303)
+- Cascades customer ID: 20149445, prepay: 35.5 hrs remaining
+- CSC - Folder Redirection GPO GUID: {512B43A4-F049-4CE5-BFAC-860AD13E92BE}
+- SG-FolderRedirect current members: Zachary.Nelson only
+- **Billing note:** New Syncro billing workflow uses `add_line_item` directly — do NOT use timer workflow. See `.claude/commands/syncro.md`.
diff --git a/session-logs/2026-05-21-session.md b/session-logs/2026-05-21-session.md
index 9423c14..f60f251 100644
--- a/session-logs/2026-05-21-session.md
+++ b/session-logs/2026-05-21-session.md
@@ -218,3 +218,13 @@ POST http://172.16.3.30:3001/api/auth/login
 - GuruRMM agent 0.6.2 bug: exits cleanly on startup connection failure (no error log, no retry) — fixed in 0.6.27 + watchdog
 - Peaceful Spirit agent roster: PST-SERVER (online/0.6.27), PST-SURFACE (offline/0.6.2), Maras-HP-Laptop (online/0.6.27), MaraHomeNew (online/0.6.27), BridgettePSHomeComputer (online/0.6.27)
 - `sync.md` update commit: `582c511`
+
+---
+
+## Update: afternoon PT — Howard: Cascades comment + syncro skill review
+
+**User:** Howard Enos (howard) | HOWARD-HOME
+
+Posted internal Syncro comment to ticket #32303 (Cascades migration) documenting that Lauren Hasselman and Crystal Rodriguez passwords did not work — could not access their machines. Comment ID 412091314, hidden/internal, attributed to Howard Enos.
+
+Ran `/sync`, pulled Mike's 11 commits. Reviewed updated `syncro.md` — key change: billing now uses `add_line_item` directly instead of the timer workflow. This affects all future Cascades billing. Full session log at `clients/cascades-tucson/session-logs/2026-05-21-session.md`.