diff --git a/01 Projects/oliver-sales-ops-platform/Oliver Sales Ops Platform.md b/01 Projects/oliver-sales-ops-platform/Oliver Sales Ops Platform.md
index 879f4fe..211c5cd 100644
--- a/01 Projects/oliver-sales-ops-platform/Oliver Sales Ops Platform.md	
+++ b/01 Projects/oliver-sales-ops-platform/Oliver Sales Ops Platform.md	
@@ -24,9 +24,14 @@ created: 2026-04-28
 - **Local path:** `/Volumes/SSD/Projects/Oliver/oliver-sales-ops-platform`
 
 ## Sessions
+### 2026-04-28 – How should SSO user access restrictions
+**Asked:** How should SSO user access restrictions be implemented — separate Azure environment or backend allowlist validation?
+**Done:** Confirmed backend allowlist approach is viable; reviewed AuthProvider.tsx and updated docstring in _upsert_app_user for clarity.
+
 
 ## Change Log
 | Date | Requested | Changed | Files |
 |------|-----------|---------|-------|
+| 2026-04-28 | SSO user restrictions | AuthProvider logic review, _upsert_app_user docstring update | AuthProvider.tsx, _upsert_app_user |
 
 ## Related
diff --git a/01 Projects/sandbox-notebookllamalm-nextjs/Sandbox NotebookLM.md b/01 Projects/sandbox-notebookllamalm-nextjs/Sandbox NotebookLM.md
index 8316cce..cd16588 100644
--- a/01 Projects/sandbox-notebookllamalm-nextjs/Sandbox NotebookLM.md	
+++ b/01 Projects/sandbox-notebookllamalm-nextjs/Sandbox NotebookLM.md	
@@ -83,6 +83,10 @@ docker compose logs frontend --tail=50
 | 2026-03-15 | Pin python-pptx to 0.6.23 |
 
 ## Sessions
+### 2026-04-28 – Can you check why a document
+**Asked:** Can you check why a document uploaded at 8am isn't processing in the notebook?
+**Done:** Diagnosed VPN connectivity issue — server at 10.220.168.x is unreachable with 100% packet loss due to downed VPN server, blocked port, or stale configuration.
+
 ### 2026-04-28 – Check why a document uploaded at
 **Asked:** Check why a document uploaded at 8am isn't processing in the notebook.
 **Done:** Diagnosed VPN connectivity issue preventing server log access; identified OpenVPN Connect socket protection error blocking VPN server connection.
@@ -198,6 +202,7 @@ docker compose logs frontend --tail=50
 ## Change Log
 | Date | Requested | Changed | Files |
 |------|-----------|---------|-------|
+| 2026-04-28 | VPN server diagnosis | Confirmed packet loss to 10.220.168.x, identified server down/port blocked/stale config as root causes | none |
 | 2026-04-28 | VPN troubleshooting | OpenVPN Connect configuration, socket protect() error diagnosis | None |
 | 2026-04-28 | Document processing issue | Checked server logs, verified SSH connection | server logs |
 | 2026-04-28 | Log | Document processing issue | Server logs, database queries | optical-web-1, notebook system |
diff --git a/99 Daily/2026-04-28.md b/99 Daily/2026-04-28.md
index 3e0ae7e..2836b8f 100644
--- a/99 Daily/2026-04-28.md	
+++ b/99 Daily/2026-04-28.md	
@@ -104,3 +104,9 @@ tags: [daily]
 - 19:23 | `sandbox-notebookllamalm-nextjs`
   - **Asked:** Check why a document uploaded at 8am isn't processing in the notebook.
   - **Done:** Diagnosed VPN connectivity issue preventing server log access; identified OpenVPN Connect socket protection error blocking VPN server connection.
+- 19:24 | `sandbox-notebookllamalm-nextjs`
+  - **Asked:** Can you check why a document uploaded at 8am isn't processing in the notebook?
+  - **Done:** Diagnosed VPN connectivity issue — server at 10.220.168.x is unreachable with 100% packet loss due to downed VPN server, blocked port, or stale configuration.
+- 19:24 | `oliver-sales-ops-platform`
+  - **Asked:** How should SSO user access restrictions be implemented — separate Azure environment or backend allowlist validation?
+  - **Done:** Confirmed backend allowlist approach is viable; reviewed AuthProvider.tsx and updated docstring in _upsert_app_user for clarity.