diff --git a/session-logs/2026-06/2026-06-10-howard-reboot-recovery-orientation.md b/session-logs/2026-06/2026-06-10-howard-reboot-recovery-orientation.md
new file mode 100644
index 0000000..9fd637a
--- /dev/null
+++ b/session-logs/2026-06/2026-06-10-howard-reboot-recovery-orientation.md
@@ -0,0 +1,91 @@
+# Session resume after update-reboot — context recovery + Safesite mis-dispatch correction
+
+## User
+- **User:** Howard Enos (howard)
+- **Machine:** Howard-Home
+- **Role:** tech
+
+## Session Summary
+
+Short orientation session to recover context after Howard-Home rebooted from a Windows update.
+Howard asked to "pick up where we left off." Initial context load mis-identified the live thread:
+the most recent log surfaced was Mike's `2026-06-09-mike-dataforth-freepbx-safesite-forensics.md`
+(GURU-5070), and the coord API carried a fleet auto-followup todo (`5766a59f`) for the Safesite
+recalled-PDF forensic sweep. I treated that as the resume target and re-dispatched the interrupted
+forensic sweep to one of the two remaining Safesite machines.
+
+Howard corrected: he never worked Safesite — that was Mike's thread. Re-ran recovery scoped to
+Howard's own work: the two `HOWARD-HOME` syncs on 2026-06-09 (10:33 + 17:08) corresponded to two
+Cascades-of-Tucson client logs that lived under `clients/cascades-tucson/session-logs/2026-06/`
+(not the root `session-logs/` glob I first searched), so the 06-09 work *was* saved. The latest,
+`2026-06-09-howard-cascades-accounting-scan-folder.md` (17:08, immediately pre-reboot), is the real
+"where we left off."
+
+That Cascades scan-to-folder build is essentially complete (svc-scan account vaulted,
+`\\CS-SERVER\AcctDept` share locked to Lauren/Chris/Zachary, Brother MFC-L8900CDW profile
+configured, test scan succeeded, drive maps pushed). Surfaced its three open items to Howard; the
+clear resume candidate is the **ASSISTNURSE-PC 1.0h onsite billing on Syncro #32303**, paused at
+preview awaiting Howard's go. Awaiting Howard's direction at session end.
+
+## Key Decisions
+
+- **Left the queued Safesite sweep in place rather than cancelling it.** The re-dispatch (cmd
+  `7e835f51`) is a legitimate fleet auto-followup for Mike's thread and is harmless queued — it
+  helps complete todo `5766a59f` whenever DESKTOP-3USU20B reconnects. No reason to cancel.
+- **Scoped recovery to Howard-authored artifacts** (HOWARD-HOME sync commits + `*howard*` logs)
+  after the first pass conflated a fleet todo with Howard's personal thread.
+
+## Problems Encountered
+
+- **Mis-identified the resume thread.** "Where we left off" was read against the newest fleet log +
+  coord todo (both Mike/Safesite) instead of Howard's own recent work. Root cause: the initial
+  `ls session-logs/**/*.md` recursive glob did not surface the client-scoped logs under
+  `clients/cascades-tucson/session-logs/2026-06/`, so the latest visible logs were all Mike's.
+  Resolved by recovering via `git log --author=Howard` + the HOWARD-HOME sync commit file lists,
+  which pointed at the Cascades client-folder logs. Saved as feedback memory for future resumes.
+- **GuruRMM vault path guess wrong.** First attempt to read an RMM token from
+  `msp-tools/gururmm-api` failed; the correct path is `infrastructure/gururmm-server.sops.yaml`
+  via the `/rmm` skill's `rmm-auth.sh`. Used the skill bootstrap instead of hand-rolling auth.
+
+## Configuration Changes
+
+- None to code/config. One GuruRMM command dispatched (see below). This session log created.
+
+## Credentials & Secrets
+
+- None created or discovered this session. (Cascades `svc-scan` creds remain vaulted at
+  `clients/cascades-tucson/svc-scan.sops.yaml` from the 06-09 session.)
+
+## Infrastructure & Servers
+
+- **DESKTOP-3USU20B** (Safesite, lennyg): GuruRMM agent `f9a86061-a4a4-42ee-8c82-7848f95693a4`,
+  now enrolled, WS-disconnected (`last_seen 2026-06-10T16:22:26Z`, status offline). Queued sweep
+  cmd `7e835f51-71c0-4b52-8fec-4fd4b3db7619` (timeout 1800) pending its next reconnect.
+- **DESKTOP-LOPKB4G** (Safesite, jeremiahw): still NOT enrolled in GuruRMM (absent from
+  `/api/agents`) — blocker for the second Safesite machine; needs Datto/Intune or agent install.
+- **CS-SERVER** (Cascades): 192.168.2.254, RMM agent `c39f1de7-d5b6-45ae-b132-e06977ab1713`.
+  Share `\\CS-SERVER\AcctDept` → `D:\Shares\Accounting` (from 06-09 work).
+
+## Commands & Outputs
+
+- RMM history for DESKTOP-3USU20B showed prior sweep `1cf8dfea` = `interrupted` (agent restarted
+  mid-run — same update-reboot wave), earlier two = `failed` (timeouts) → no results yet, so
+  re-dispatched the identical sweep script with `timeout_seconds=1800`. Returned `pending`
+  (agent offline/queued). Bot alert posted to #dev-alerts.
+
+## Pending / Incomplete Tasks
+
+- **Howard's real resume thread — Cascades, from `2026-06-09-howard-cascades-accounting-scan-folder.md`:**
+  1. **ASSISTNURSE-PC 1.0h onsite billing on Syncro #32303** — paused at preview, awaiting Howard's go (primary).
+  2. (optional) Normalize the three accounting drive maps to one consistent letter (Lauren X:, Chris Y:, Zachary Y:).
+  3. (optional) Lock down legacy `Main\Company Web Docs\Accounting` `Everyone:Full` folder — HIPAA cleanup.
+- **Fleet (not Howard's):** Safesite todo `5766a59f` still open — DESKTOP-3USU20B sweep queued
+  (`7e835f51`); DESKTOP-LOPKB4G unenrolled. Any free session completes both, then posts to
+  Jonathan on #32395 and marks the todo done.
+
+## Reference Information
+
+- Howard's last pre-reboot log: `clients/cascades-tucson/session-logs/2026-06/2026-06-09-howard-cascades-accounting-scan-folder.md`
+- Safesite auto-followup todo: `5766a59f-0ddf-43d8-b16b-1c60024a3c04` (project `clients/safesite`).
+- Coord API: `http://172.16.3.30:8001/api/coord`. GuruRMM API: `http://172.16.3.30:3001`.
+- Syncro tickets referenced: #32303 (Cascades ASSISTNURSE-PC billing), #32395 (Safesite forensics, Mike).