diff --git a/session-logs/2026-05-27-session.md b/session-logs/2026-05-27-session.md
index 8fb4c9b..070e86f 100644
--- a/session-logs/2026-05-27-session.md
+++ b/session-logs/2026-05-27-session.md
@@ -492,3 +492,58 @@ None.
 - Invoice #1650438933: $393.75
 - Commit: 58d424e (main, pushed to Gitea)
 - syncro.md edited: `.claude/commands/syncro.md`
+
+---
+
+## Update: 19:40 PT — LHM Security Violation Discovery (Mac)
+
+### User
+- **User:** Mike Swanson (mike)
+- **Machine:** Mac
+- **Role:** admin
+
+### Summary
+
+Session focused on log analysis feature design and critical security discovery about LibreHardwareMonitor. Coordinated identity.json Phase 2 completion (GURU-5070, GURU-KALI, GURU-BEAST-ROG confirmed via coord). Updated sync.sh and syncro.md to read Python/Ollama config from identity.json, eliminating 2-second probe delays. Cleaned up CLAUDE.md redundant Ollama content.
+
+Investigated why log analysis findings UI (committed May 27 07:18) wasn't visible—dashboard last built May 20 (7 days stale). While planning rebuild, user asked about LHM origins. Historical analysis revealed LHM added May 14, 2026 as "quick fix" when sysinfo couldn't collect Windows temps. User then revealed **LHM fails Windows Defender with kernel-level exploit detection**.
+
+Critical discovery: LHM violates GuruRMM's founding "no external binaries" security principle. LHM is third-party .exe bundled in MSI that loads kernel driver (WinRing0x64.sys), creating supply chain attack surface GuruRMM was designed to avoid. Defender flags it as PUA. 64 agents deployed, unknown Defender impact.
+
+User requested comprehensive interview for Howard about log analysis feature design (3-level system: platform/site/machine issues with different remediation strategies). Sent two coord messages to Howard: (1) 20-question interview about workflows and priorities, (2) high-priority LHM security violation analysis with emergency removal recommendation.
+
+### Key Decisions
+
+- **Dashboard rebuild paused** — Waiting for Howard's log analysis workflow requirements before implementing feature
+- **LHM emergency removal recommended** — v0.6.28 with LHM stripped (temps unavailable but secure), then proper WMI solution in v0.6.29
+- **ADR-007 documentation needed** — "No External Binaries" architecture decision to prevent future violations
+- **Interview Howard first** — His field perspective critical for log analysis design (not just implementing Mike's proposal)
+
+### Configuration Changes
+
+- `.claude/identity.json`: Fixed hostname `Mikes-MacBook-Air` → `Mac`
+- `.claude/scripts/sync.sh`: Read Python from identity.json (lines 119-133)
+- `.claude/commands/syncro.md`: Read Ollama/Python from identity.json (lines 59-62, 138-191)
+- `.claude/CLAUDE.md`: Removed Ollama table, condensed descriptions
+
+### Coordination Messages Sent
+
+- `38df069e`: Log analysis interview (20 questions, normal priority, to Howard-Home)
+- `5b1f36e8`: LHM security violation (high priority, to Howard-Home)
+
+### LHM Timeline
+
+- Dec 21, 2025 (`dfc3be1`): Temperature feature added via sysinfo (Rust crate, acceptable)
+- May 14, 2026 (`70c1fff`): LHM bundled as workaround (VIOLATED security principle)
+- 6 months of bugs: Session 0 issues, WMI failures, complexity
+- May 27, 2026 (`612c00a`): Analysis panel fix for LHM_RUNNING flag
+- May 27, 2026 (today): Defender blocker discovered, violation recognized
+
+### Pending
+
+- Howard's interview response (log analysis workflows)
+- Howard's LHM impact assessment (Defender blocks? Temp value?)
+- Emergency patch decision (ship v0.6.28 this week?)
+- ADR-007 documentation
+- Dashboard rebuild (after feature design clear)
+