diff --git a/serverAppConfigs-docs/log.md b/serverAppConfigs-docs/log.md
index cf7633f..2241ac6 100644
--- a/serverAppConfigs-docs/log.md
+++ b/serverAppConfigs-docs/log.md
@@ -43,6 +43,26 @@ timestamp: 2026-09-14
   which 500s every Laravel app route (`Unsupported cipher or incorrect key
   length`). Re-keyed with the required `base64:` prefix before any encrypted
   data persisted. See [[Marreta]] § Secrets.
+- **Login-wall fixed 2026-09-12 (post-deploy).** The homepage Marreta link
+  parked on `marreta.franksdank.cloud/if/flow/default-authentication-flow/`
+  instead of the app. Root cause chain, in the order found:
+  1. `marreta-proxy` had `invalidation_flow = null`, which crashed the Rust
+     embedded outpost's serde (`invalid type: null, expected a formatted UUID
+     string`) and took down **every** provider on the outpost. Set to
+     `default-provider-invalidation-flow`.
+  2. `authentication_flow` / `authorization_flow` were null; set to
+     `default-authentication-flow` / `default-provider-authorization-implicit-consent`.
+  3. **The real blocker:** the outpost's config API filters
+     `ProxyProvider.objects.filter(application__isnull=False)`. `marreta-proxy`
+     had no linked **Application**, so the outpost never loaded it and the
+     request fell through to raw flow serving on the marreta host — where the
+     IdP session cookie (scoped to `auth.franksdank.cloud`) is invisible.
+     Created `Application(name="Marreta", slug="marreta", provider=marreta-proxy)`.
+- After `systemctl --user restart authentik-server authentik-outpost`, the
+  outpost loaded `marreta-proxy` and the OAuth dance completes: `/` →
+  `/outpost.goauthentik.io/start` → `auth…/o/authorize` → callback → Marreta.
+  Regression test: `tests/e2e/specs/16-marreta.spec.ts`. Providers remain
+  **live-only (no repo blueprint)** — a provenance gap to close.
 
 ## 2026-09-04 — *arr fleet consolidated on FrankBook-Pro; all egress VPN-gated
 - Operator decision: **FrankBook-Pro is the sole *arr deployment.** The