diff --git a/session-logs/2026-05-28-gururmm-log-analysis-ui.md b/session-logs/2026-05-28-gururmm-log-analysis-ui.md
new file mode 100644
index 0000000..36c0cdd
--- /dev/null
+++ b/session-logs/2026-05-28-gururmm-log-analysis-ui.md
@@ -0,0 +1,163 @@
+# Session Log: GuruRMM Log Analysis UI Enhancement & Deployment
+
+## User
+- **User:** Mike Swanson (mike)
+- **Machine:** Mikes-MacBook-Air.local
+- **Role:** admin
+
+## Session Summary
+
+Enhanced the GuruRMM dashboard log analysis feature with Sentry-style deduplication UI, per-machine instance tracking, and PSA-agnostic remediation workflow. The work was a direct continuation of Howard's detailed feedback provided via coordination API, which requested prominent count badges, expandable per-machine lists, manual Syncro ticket creation, and platform bug auto-filing capabilities.
+
+Started by loading the existing LogAnalysis.tsx component to understand current implementation. The component already had basic deduplication (small ×N text) and `affected_agents` data structure but wasn't displaying machine-level context. Used the `/impeccable` skill to design and implement the enhanced UI following GuruRMM's product design principles: dark theme, restrained color strategy, information density without chaos, and trust-the-user posture. Key enhancements included: (1) prominent monospace count badge with muted background replacing tiny ×N text, (2) collapsible "Affected Machines" section showing per-machine instances with site names, (3) "Create Ticket" button with PSA-agnostic label (not "Create Syncro Ticket"), (4) "Flag RMM Bug" button posting to coordination API.
+
+Wired up both Logs.tsx and AgentDetail.tsx with two callbacks: `onCreateTicket` (stubbed with info toast "PSA integration pending") and `onFlagPlatformBug` (live mutation posting to http://172.16.3.30:8001/api/coord/todos with priority mapping, auto-assignment to mike, and full finding context). Created comprehensive integration documentation covering PSA abstraction architecture, backend requirements, org config schema, and testing checklist.
+
+Built dashboard encountered TypeScript errors: missing useSearch hook (Layout.tsx imported but file didn't exist), missing __APP_VERSION__ type declaration, unused imports, and non-existent Agent.logged_in_user field. Created useSearch.ts hook with simple useState pattern, added vite-env.d.ts with global type declaration, removed unused Sparkles/Loader2 imports, and removed logged_in_user filter from SiteDetail.tsx. Dashboard built successfully (1.28 MB bundle) and deployed via rsync to /var/www/gururmm/dashboard/ on 172.16.3.30.
+
+Committed all changes across two repos: gururmm submodule (d522c14 feature, 4e4af5a build fixes) and claudetools parent (5c1577f, 535771f submodule bumps). Dashboard is now live at https://rmm.azcomputerguru.com with enhanced log analysis UI ready for testing.
+
+## Key Decisions
+
+- **PSA-agnostic button label**: Changed "Create Syncro Ticket" to "Create Ticket" after user clarified that not all GuruRMM partners will use Syncro — multi-tenant MSP platform requires pluggable PSA integration with adapters for Syncro, ConnectWise, Autotask, Kaseya, etc.
+
+- **Platform bug filing prioritized over PSA tickets**: Implemented coordination API integration first because the endpoint already exists and is simpler than building PSA abstraction layer. PSA ticket creation stubbed with informational toast pending backend work.
+
+- **Count badge prominence**: Made ×N badge a distinct monospace element with muted background rather than inline text, matching Sentry's pattern for repeated error deduplication — improves scannability at a glance.
+
+- **Per-machine instances always available**: "Affected Machines" section shows count in collapsed state and full list when expanded, even for single findings — preserves machine context that was previously hidden in the data.
+
+- **Command dispatch pre-filtered**: Agent selector dropdown in FindingCard now shows only affected agents rather than full fleet — reduces noise and makes remediation action more targeted.
+
+- **Documentation before implementation**: Created log-analysis-integration.md and log-analysis-implementation-status.md before deployment to ensure backend team has clear PSA architecture guidance and testing checklist.
+
+## Problems Encountered
+
+- **Missing useSearch hook**: Layout.tsx imported `../hooks/useSearch` but file didn't exist. TypeScript build failed. Created simple hook with useState pattern matching Layout's usage (query text for context-aware search bar).
+
+- **Missing __APP_VERSION__ global**: vite.config.ts defines `__APP_VERSION__` via plugin but no ambient type declaration. TypeScript complained. Created vite-env.d.ts with `declare const __APP_VERSION__: string`.
+
+- **Agent.logged_in_user field doesn't exist**: SiteDetail.tsx filter referenced `agent.logged_in_user` but Agent interface has no such field. Removed from filter — likely leftover from earlier spec or future planned field.
+
+- **Submodule working directory confusion**: First rsync attempt used wrong path (tried `dashboard/dist/` from parent repo context instead of from submodule root). Fixed by verifying pwd before rsync.
+
+- **identity.json hostname mismatch**: whoami-block.sh warned "Mac" != "Mikes-MacBook-Air.local". Fixed by editing identity.json machine field to match actual hostname before saving session log.
+
+## Configuration Changes
+
+### Files Created
+- `projects/msp-tools/guru-rmm/dashboard/src/hooks/useSearch.ts` — Simple search state hook for Layout
+- `projects/msp-tools/guru-rmm/dashboard/src/vite-env.d.ts` — Global type declaration for __APP_VERSION__
+- `projects/msp-tools/guru-rmm/dashboard/docs/log-analysis-integration.md` — PSA abstraction architecture
+- `projects/msp-tools/guru-rmm/dashboard/docs/log-analysis-implementation-status.md` — Feature tracking doc
+
+### Files Modified
+- `projects/msp-tools/guru-rmm/dashboard/src/components/LogAnalysis.tsx` — Enhanced with deduplication UI, affected machines list, action buttons
+- `projects/msp-tools/guru-rmm/dashboard/src/pages/Logs.tsx` — Added LogFinding import, flagBugMutation, handleCreateTicket stub, wired callbacks
+- `projects/msp-tools/guru-rmm/dashboard/src/pages/AgentDetail.tsx` — Same integration as Logs.tsx for single-agent context
+- `projects/msp-tools/guru-rmm/dashboard/src/pages/SiteDetail.tsx` — Removed logged_in_user field filter
+- `.claude/identity.json` — Fixed machine field: "Mac" → "Mikes-MacBook-Air.local"
+
+### Deployed Files
+- `/var/www/gururmm/dashboard/` on 172.16.3.30 — Full dashboard build via rsync (363 KB transferred, 1.36 MB total)
+
+## Credentials & Secrets
+
+None created or modified. Coordination API endpoint (http://172.16.3.30:8001) is internal network only, no authentication required.
+
+## Infrastructure & Servers
+
+- **GuruRMM Server**: 172.16.3.30 (Saturn)
+  - Dashboard: /var/www/gururmm/dashboard/ (nginx serves, proxies /api to :3001)
+  - Coordination API: http://172.16.3.30:8001/api/coord
+  - Public URL: https://rmm.azcomputerguru.com
+
+- **Gitea**: http://172.16.3.20:3000
+  - GuruRMM repo: azcomputerguru/gururmm (active, submodule tracked)
+  - ClaudeTools repo: azcomputerguru/claudetools (parent)
+
+## Commands & Outputs
+
+```bash
+# Build dashboard
+cd projects/msp-tools/guru-rmm/dashboard
+npm run build
+# Output: dist/ with 1.28 MB bundle (2.09s build time)
+
+# Deploy to server
+rsync -avz --delete dist/ guru@172.16.3.30:/var/www/gururmm/dashboard/
+# Transferred 363 KB, deleted 2 old asset files
+
+# Verify deployment
+ssh guru@172.16.3.30 "ls -lh /var/www/gururmm/dashboard/"
+# total 12K: assets/, index.html, vite.svg
+
+# Check dashboard accessibility
+curl -s -I https://rmm.azcomputerguru.com | head -5
+# HTTP/2 403 (expected — auth required, but proves nginx is serving)
+```
+
+## Pending / Incomplete Tasks
+
+### Backend Work (PSA Integration)
+1. Create PSA adapter trait/interface in GuruRMM server
+2. Implement Syncro adapter (migrate logic from `/syncro` skill)
+3. Add org PSA config table (type, endpoint, encrypted credentials)
+4. Create `POST /api/tickets/create` endpoint
+5. Wire up frontend to replace stub with real mutation
+
+### Testing
+1. Test platform bug filing end-to-end (flag bug → verify coord API todo)
+2. Gather Howard feedback on deduplication UX
+3. Test affected machines list with multi-site agents
+4. Verify command dispatch filtering works correctly
+5. Test on different screen sizes (responsive behavior)
+
+### Documentation
+1. Update FEATURE_ROADMAP.md with completed log analysis enhancements
+2. Add PSA integration as separate roadmap item
+3. Consider wiki article for log analysis feature usage
+
+## Reference Information
+
+### Commits
+- **gururmm submodule**:
+  - `d522c14` — feat(dashboard): enhance log analysis UI with deduplication and remediation actions
+  - `4e4af5a` — fix(dashboard): resolve TypeScript build errors
+
+- **claudetools parent**:
+  - `5c1577f` — chore(gururmm): bump submodule to d522c14 (log analysis UI enhancements)
+  - `535771f` — chore(gururmm): bump submodule to 4e4af5a (dashboard build fixes + deployment)
+
+### Key Files
+- Component: `dashboard/src/components/LogAnalysis.tsx` (+115 lines)
+- Integration: `dashboard/src/pages/Logs.tsx`, `dashboard/src/pages/AgentDetail.tsx`
+- Docs: `dashboard/docs/log-analysis-*.md`
+
+### Coordination API Payload
+```json
+POST http://172.16.3.30:8001/api/coord/todos
+{
+  "project_key": "gururmm",
+  "title": "Platform Bug: {pattern}",
+  "description": "Severity + agents + sample + suggestion",
+  "priority": 1 or 2,
+  "auto_created": true,
+  "source_context": "log_analysis_ui",
+  "assigned_to_user": "mike"
+}
+```
+
+### Feature Comparison
+| Aspect | Before | After |
+|--------|--------|-------|
+| Count display | Small ×10 text | Prominent monospace badge |
+| Machine context | Hidden | Expandable per-machine list |
+| Ticket creation | None | Button (stubbed) |
+| Platform bugs | None | Button → coord API (live) |
+| Command dispatch | All agents | Filtered to affected only |
+
+### URLs
+- Dashboard: https://rmm.azcomputerguru.com
+- Coordination API: http://172.16.3.30:8001/api/coord
+- Gitea: http://172.16.3.20:3000/azcomputerguru/gururmm