diff --git a/clients/scileppi-law/session-logs/2026-07/2026-07-02-howard-scileppi-internet-outage-cox-wan-rca.md b/clients/scileppi-law/session-logs/2026-07/2026-07-02-howard-scileppi-internet-outage-cox-wan-rca.md
index ae50e850..1aa8e590 100644
--- a/clients/scileppi-law/session-logs/2026-07/2026-07-02-howard-scileppi-internet-outage-cox-wan-rca.md
+++ b/clients/scileppi-law/session-logs/2026-07/2026-07-02-howard-scileppi-internet-outage-cox-wan-rca.md
@@ -81,3 +81,11 @@ Finally, per the user's request, ran an independent re-gather on the **Fable 5 m
 - **Vault:** `services/unifi-site-manager` (working cloud key); `infrastructure/unifi-site-manager-api` (STALE/401); `infrastructure/gururmm-server.sops.yaml`.
 - **Prior log:** `clients/scileppi-law/session-logs/2026-07/2026-07-01-howard-sylvia-server-mount-nosleep-screenconnect.md`.
 - **Wiki:** `wiki/clients/scileppi-law.md` (updated this session); related `wiki/systems/uos-server.md`.
+
+## Update: 12:05 PT — Cox ticket recorded + customer findings note on #32493
+
+- **Cox ticket** `HD0000032972890` (submitted by Winter 2026-07-02; Type "Trouble with Service", Account Alias "115 W WASHINGTON", Internet & Data — Intermittent Connectivity / Packet Loss; contact Guru Admin — Winter/Mike, callback 520-304-8300, mornings) recorded in `wiki/clients/scileppi-law.md` (Open Items P1 + 2026-07-02 event) and this log. Note: the Cox request text quoted the first-pull figures (90/276 windows, up to 6%), not the Fable-refined ~13% / ~20 s downtime — verdict unchanged, so left as-is per Howard.
+- **Syncro:** posted a customer-facing **findings note** to ticket **#32493** (id 113284439), comment id **421854153**, `hidden:false`, `do_not_email:false` (emailed to customer). Content: cause = Cox WAN line (not on-site gear); UniFi gateway/switch/2 APs + Synology all healthy (8-day uptime); two brief drops ~4:15 AM and ~10:45 AM with packet loss; steady ~22-24 ms latency; opened Cox ticket HD0000032972890; no on-site changes needed. Reworded from an initial personal-email style to ticket findings-notes per Howard. Bot alert posted to #bot-alerts.
+- **Decision:** findings went on the existing #32493 (Howard's pick) rather than a new ticket.
+- **Friction:** first comment-POST attempt was blocked by the `block-tmp-path` PreToolUse hook (a stray `/tmp/.rr` write in the same command) — the hook blocked the whole command pre-execution, so no duplicate comment was created; re-ran cleanly. No errorlog entry (handled, no functional failure).
+- **speach skill:** no skill named "speach"/"speech" exists; interpreted as the writing-polish pass and applied `stop-slop` to the customer text.