diff --git a/serverAppConfigs-docs/log.md b/serverAppConfigs-docs/log.md
index baf497e..bf2e60c 100644
--- a/serverAppConfigs-docs/log.md
+++ b/serverAppConfigs-docs/log.md
@@ -16,15 +16,15 @@ timestamp: 2026-09-14
   hosting partner); Dankclaw's tunnel v6 `2a07:b944::2:2` sits in
   CH-PROTONVPN-20160719; observed exit IP `149.22.88.19` = CDNEXT-SEA-CG.
   The "custom WG server" is a ProtonVPN Seattle WireGuard server - there is
-  no peer-registration step on any box of ours (no SSH, only silent TLS
-  listeners on 443/4443/4444/8443).
-- Mac gate corrected: provision a **second** Proton WG config (dashboard,
+  no peer-registration step on any box of ours (full 65535-port scan: no
+  SSH anywhere, just silent TLS listeners - 443, 4443-4468, 5995, 7770,
+  8443 - Proton's protocol-stealth port map, no admin surface).
+-   Mac gate corrected: provision a **second** Proton WG config (dashboard,
   named e.g. `frankbook`) - one config = one keypair; two hosts on
   Dankclaw's config bounce the server-side endpoint and kill SearXNG. Values
   paste straight into the gluetun `custom` env. Earlier prepared keypair on
   dankclaw (`~/frankbook-wg/`) retired to `~/.AGENTTRASH/` (Proton generates
   the keypair per config; no BYO pubkey).
-### 
 - [[FrankBook-Pro]] provisioning section rewritten.
 
 ## 2026-09-01 — Jellyfin authentication moved to Authentik LDAP