diff --git a/session-logs/2026-05-28-howard-discovery-deploy-check.md b/session-logs/2026-05-28-howard-discovery-deploy-check.md
new file mode 100644
index 0000000..746917c
--- /dev/null
+++ b/session-logs/2026-05-28-howard-discovery-deploy-check.md
@@ -0,0 +1,98 @@
+# Session Log — 2026-05-28 — Discovery Deploy Verification + Server Rebuild Notice
+
+## User
+- **User:** Howard Enos (howard)
+- **Machine:** Howard-Home
+- **Role:** tech
+
+---
+
+## Session Summary
+
+Following the discovery fixes committed earlier this session (ICMP ping fallback fcf5833, scan timeout/409 guard c6f1f73), Howard asked whether Mike had deployed the new builds. Checked the live server and agent versions against the git log to determine deployment status.
+
+The CI auto-bumped the agent to 0.6.49 (commit c8c6952) after the ICMP fix landed. WIN-TG2STMODJG8 reported `agent_version: "0.6.49"`, confirming the agent-side fix is live. A test scan was run and found 25 unique devices — up from 9 previously — confirming the ICMP ping fallback is working and discovering machines that had all TCP ports firewalled.
+
+The server-side fix (scan timeout + concurrent scan 409 guard) is not deployed. The server Cargo.toml is at 0.3.36 but the live binary is still the old version. This was confirmed by triggering two back-to-back scans: both returned new scan IDs instead of the second getting a 409. The two test scans ran concurrently and both completed normally (WIN-TG2STMODJG8 was connected), but the `new_devices` counts were inflated because both scans claimed credit for the same newly-inserted IPs within their overlapping windows.
+
+A coord message was sent to Mike (id: 88c733a8) requesting a server rebuild and service restart on 172.16.3.30 to activate the 0.3.36 binary.
+
+---
+
+## Key Decisions
+
+- **Tested 409 guard by triggering two rapid scans** — the cleanest live confirmation that the server fix is or isn't deployed. Two distinct scan IDs = old binary confirmed.
+- **Coord message rather than waiting** — Howard doesn't rebuild the server; Mike owns that. Coord message is the right handoff.
+
+---
+
+## Problems Encountered
+
+- **First coord POST returned parse error** — newlines inside the JSON string literal caused the parse failure. Resolved by switching to heredoc (`--data-binary @-` with `<<'JSON'`).
+
+---
+
+## Configuration Changes
+
+None this session — no code changes, read-only verification work.
+
+---
+
+## Credentials & Secrets
+
+None created or modified this session.
+
+---
+
+## Infrastructure & Servers
+
+- **GuruRMM server:** 172.16.3.30:3001 — running old binary, needs rebuild to 0.3.36
+- **GuruRMM dashboard:** https://rmm.azcomputerguru.com
+- **Coord API:** http://172.16.3.30:8001/api/coord
+- **Discovery test site:** eeb5f001-447b-4c1e-adc8-e18db2be9b5b
+- **Discovery node:** WIN-TG2STMODJG8 — eee9f26d-0dbc-4b8e-8e42-3a901b4ff73a
+
+---
+
+## Commands & Outputs
+
+```bash
+# Agent version check
+GET /api/agents/eee9f26d... → agent_version: "0.6.49"  (ICMP fix deployed)
+
+# Server 409 guard test — two rapid scan triggers
+POST /api/sites/eeb5f001.../discovery/scan → scan_id: b29bd012... (initiated)
+POST /api/sites/eeb5f001.../discovery/scan → scan_id: fbd163b5... (initiated — NOT 409)
+# → Server fix NOT deployed, old binary still running
+
+# Both test scans completed normally
+# devices_found: 10 + 25 (concurrent, inflated new_devices count due to overlap)
+# Total unique devices in DB: 25 (up from 9 before ICMP fix)
+
+# Coord message to Mike
+POST /api/coord/messages → id: 88c733a8
+# Subject: "Server rebuild needed — discovery timeout fix (0.3.36)"
+```
+
+---
+
+## Pending / Incomplete Tasks
+
+- **Server rebuild (Mike):** 172.16.3.30 needs rebuild + restart to deploy server 0.3.36 (scan timeout + 409 concurrent guard). Coord message sent: 88c733a8.
+- **Discovery auto-deploy (P2):** Not built — future feature.
+- **Discovery scheduling (P2):** UI has options but backend not wired.
+- **SPEC-012 implementation:** Sortable table headers, ready for sprint.
+- **SPEC-013 (P3):** Deferred pending file transfer.
+- **SPEC-014 follow-up (Mike's):** Policy tab for watch rules; push rules on agent connect.
+- **Cascades pending migration:** M365 relicensing (time-sensitive), domain joins, HIPAA GPO, credential vault, Entra Connect expansion.
+
+---
+
+## Reference Information
+
+- **Agent 0.6.49 CI bump commit:** c8c6952 (0.6.48 → 0.6.49, after ICMP fix fcf5833)
+- **Server 0.3.36 CI bump commit:** a0a00bf (0.3.35 → 0.3.36, after scan timeout fix c6f1f73)
+- **ICMP fix:** fcf5833 — agent/src/discovery/mod.rs — ping_host() fallback
+- **Timeout fix:** c6f1f73 — server/src/api/discovery.rs + server/src/db/discovery.rs
+- **Coord message:** 88c733a8 — "Server rebuild needed — discovery timeout fix (0.3.36)"
+- **Discovered devices now in DB:** 25 unique IPs (was 9 before ICMP fix)