Find the active PTO sync writer that creates or updates Outlook PTO events and patches Time_Off_Request__c.Outlook_Event_ID__c, because the SAIL Boat to SAIL-AWAY calendar migration cannot safely finish until the writer or operating process is changed.
admin/outlook-audits/sail-away-calendar-migration-20260603/.LITIFY_ORG for recent PTO records with Outlook_Event_ID__c, sync status counts, field history tracking, Named Credentials, active metadata evidence, and recent synced samples.Outlook_Event_ID__c and Outlook_Sync_Status__c field history tracking is off, so Salesforce cannot directly show field-level update history for these fields.LastModifiedBy for records with Outlook event IDs: Sam Aguiar 474, Nathaniel Hatfield 422, Alyssia Higgs 138, Jennifer Hubbard 30, Jeremy Raines 5, Kyle Medlin 3.Sent to Outlook rows are older January and February 2026 records, mostly created or last modified by Jennifer Hubbard, with several null event IDs and one subject stored in the event ID field.Outlook_Event_ID__c, Outlook_Sync_Status__c, Time_Off_Request__c, SAIL Boat, SAIL-AWAY, and Graph calendar calls. No committed PTO writer was found.admin/outlook-audits/sail-away-calendar-migration-20260603/PTO-sync-writer-trace-2026-06-03.md.The active PTO calendar writer was not definitively located in code or standard Salesforce metadata. The strongest evidence points to a Nathaniel-owned Outlook write path plus Salesforce edits under ordinary user accounts, especially Nathaniel and Jennifer. That could be manual or semi-manual calendar entry, an external user-context automation such as Power Automate, Zapier, Pipedream, or a non-repo script, or a managed/UI action not represented in the retrieved source. Confidence is medium that the writer is external to committed Salesforce metadata and local scheduled routines.
No live Outlook events were created, copied, edited, or deleted. No mailbox was created. No Salesforce records or metadata were updated. This was read-only except for the local trace note.
The selected investigation path was completed to the point available through live Salesforce reads, Graph evidence already captured, local scheduled-task review, repo search, and GitHub code search. The remaining proof requires delegated/admin inspection of external automation surfaces or Exchange/Purview audit logs that need interactive or additional access.