diff --git a/session-logs/2026-06-01-session.md b/session-logs/2026-06-01-session.md
index 6f1e709..ccbdc17 100644
--- a/session-logs/2026-06-01-session.md
+++ b/session-logs/2026-06-01-session.md
@@ -252,3 +252,63 @@ GET /api/Computers/{hid}/Plans?userId=...
 - MSP360 API DNS workaround: `--resolve api.mspbackups.com:443:52.6.7.137`
 - Remote Management API: requires add-on — toggle in MSP360 console Settings if needed
 - Rohrbach Monitoring: Files Plan (MIKE-THINK) + Image-Based (susan-think), both healthy as of 2026-06-01
+
+---
+
+## Update: 20:28 PDT — Session recovery toolset + wiki-on-save (Sonnet)
+
+### Session Summary
+
+Recovered lost context for the Lone Star Electrical Sophos removal (LS-1/LS-2): the ~May 28-29 work had never been saved to a session log and survived only in a gitignored Ollama draft (`.claude/tmp/ollama_prompt.txt`) and coordinator message `8a5cb25c`. Reassembled the full picture, reconstructed it into `clients/lonestar-electrical/session-logs/2026-05-29-sophos-removal.md`, recompiled the Lone Star wiki article (added the inherited-Sophos kernel-driver tamper-protection removal pattern), and sent a complete handoff to Howard via coordinator message `689cfb7c` including the WinRE completion procedure.
+
+Diagnosed why that work was invisible to search: never `/save`d, so it lived only in a gitignored temp file and the coord-message DB — neither indexed by GrepAI nor in git. To close the gap, built a session-recovery toolset: `recover_session.py` (engine that parses a Claude Code transcript JSONL, classifies substantive/saved, extracts a verbatim command/config/reference trail, drafts prose), `detect_orphaned_sessions.py` (scheduled scanner that auto-builds banner-marked logs for substantive/unsaved transcripts, commits them, pings #bot-alerts), `/recover` (manual command), a scheduled-task registrar, `RECOVERY.md`, and a memory entry. Registered the scheduled task on GURU-5070 (logon + every 4h).
+
+Code-reviewed the toolset: fixed a Critical bug (staging the gitignored ledger aborted `git add`, so nothing ever committed), High issues (write ledger only after a successful push; per-uuid idempotency; `--max` cap), and a submodule-routing bug (recovered logs must not land inside the guru-rmm/guru-connect submodules — route to root `session-logs/`). Ran a reviewed backfill of 12 historical orphans; standout recovery was the Peaceful Spirit RADIUS/VPN buildout (full verbatim command trail). Moved the Peaceful Spirit recovered log into `clients/peaceful-spirit/`, cross-linked it with the existing manual 2026-05-10 log (it is the primary-source transcript of the crashed session that log reconstructed second-hand), and corrected its machine attribution to DESKTOP-0O8A1RL.
+
+Integrated wiki maintenance into `/save`: a pre-sync Phase 3 that recompiles the worked-on client/project article so it ships in the same commit. Iterated the design from refresh-only to full recompile (per user), then switched the drafting engine from Ollama qwen3 to a Sonnet subagent for better prose quality and no local-Ollama dependency. Verified the `/save` wiki-recompile end-to-end with a Lone Star-scoped test save.
+
+### Key Decisions
+
+- Recovered logs are auto-built but banner-marked `[RECOVERED -- UNVERIFIED]`; Python extracts verbatim commands/IPs/SHAs while the model drafts only prose — no hallucinated command can enter a saved log.
+- The ledger (`.claude/state/recovered-sessions.json`) is machine-local and gitignored, never staged; recovered uuids are marked only after a successful push so failed runs retry.
+- Recovered logs are never written inside submodules; project scopes whose dir is a submodule route to root `session-logs/`.
+- `/save` full-recompiles the worked-on wiki article before sync (skips general/root scope); softfails to a surgical refresh so a save is never blocked.
+- Wiki drafting moved off Ollama to a Sonnet subagent (`model: "sonnet"`); refresh mode stays surgical/no-model.
+- GrepAI was deliberately NOT pointed at raw transcripts (too noisy/large); recovery distills them into `session-logs/`, which GrepAI already indexes.
+
+### Problems Encountered
+
+- Sophos/Lone Star work unsearchable — never `/save`d; recovered from temp draft + coord message. This was the root cause that motivated the whole session.
+- Code review found a Critical: `git add` of the gitignored ledger aborted atomically, silently disabling all auto-commits. Fixed by never staging the ledger.
+- Reviewed backfill caught recovered logs landing inside the guru-rmm/guru-connect submodules; moved 4 out to root and patched the engine's `compute_output_path`.
+- The recovery engine stamps the current machine (GURU-5070) in the User block, not the machine where the work happened (DESKTOP-0O8A1RL for the 2026-05-10 PST session). Corrected manually; noted as a known limitation of recovered logs.
+
+### Configuration Changes
+
+- [created] `.claude/scripts/recover_session.py`, `.claude/scripts/detect_orphaned_sessions.py`, `.claude/scripts/register-orphan-detector.ps1`
+- [created] `.claude/commands/recover.md`, `.claude/RECOVERY.md`, `.claude/memory/feedback_session_recovery.md` (+ MEMORY.md pointer)
+- [modified] `.claude/commands/save.md` (Phase 3 wiki recompile via Sonnet subagent, before sync)
+- [modified] `.claude/commands/wiki-compile.md` (Sonnet-subagent synthesis; dropped Ollama)
+- [modified] `.gitignore` (`.claude/state/`)
+- [created] `clients/lonestar-electrical/session-logs/2026-05-29-sophos-removal.md`, `2026-06-01-session.md`
+- [modified] `wiki/clients/lonestar-electrical.md` (Sophos pattern + recompile)
+- [created] 12 recovered backfill logs across `session-logs/`, `clients/`, `projects/gururmm-agent/`
+- [moved] Peaceful Spirit recovered log -> `clients/peaceful-spirit/session-logs/` (+ cross-link in `2026-05-10-session.md`)
+
+### Scheduled Tasks
+
+- Registered `ClaudeTools - Orphaned Session Detector` on GURU-5070 (AtLogOn + every 4h).
+
+### Pending / Incomplete Tasks
+
+- Howard to complete the offline WinRE Sophos removal on LS-1/LS-2, then `SophosZap --confirm`; verify the drafted Syncro ticket exists before logging time.
+- The 12 backfilled recovered logs are UNVERIFIED — review and clear banners as time permits.
+- The Ollama -> Sonnet wiki draft path is wired but not yet exercised live (integration verified Claude-direct; the Sonnet subagent draft itself is untested on a real recompile).
+
+### Reference Information
+
+- Commits: `eed3ece` (toolset), `59397e8` (submodule fix), `aa9bd26` (12-log backfill), `5afb781` (save+recompile test), `c893d3e` (Sonnet subagent), `f44a96b`/`2a5476f` (save wiki phases), `4651990` (Lone Star wiki+log), `07c86c7` (PST move)
+- Coordinator messages: `689cfb7c` (Howard handoff), `8a5cb25c` (WinRE commands source)
+- Scheduled task: `ClaudeTools - Orphaned Session Detector` (GURU-5070)
+- Ledger: `.claude/state/recovered-sessions.json` (machine-local, gitignored)
+- Transcripts: `~/.claude/projects/D--claudetools/*.jsonl`