diff --git a/Sources/Homelab/2026-05-17-vault-push-token-fix-verification-2026-05-16.md b/Sources/Homelab/2026-05-17-vault-push-token-fix-verification-2026-05-16.md
new file mode 100644
index 0000000..5a2cdb2
--- /dev/null
+++ b/Sources/Homelab/2026-05-17-vault-push-token-fix-verification-2026-05-16.md
@@ -0,0 +1,27 @@
+---
+created: '2026-05-17'
+path: Sources/Homelab
+project: postgres-consolidation-reflection-layer
+tags:
+- mcp
+- automation
+- git
+type: session-notes
+---
+
+## Outcome
+
+Retesting after Travis corrected the gitea PAT in `.env`. The previous failures were not a code issue — the helper wiring was correct, gitea was returning "Authentication failed" because the wrong token was in env. If this returns `pushed: true`, the queued commits (`b578f458`, `ca2c8e93`) plus this new one should all land on origin.
+
+## Topics Covered
+
+The full debugging chain ended at the cheapest possible bug: wrong env value. All the architectural fixes (HTTPS URL rewrite, credential helper, semicolon trap fix) were correct. The thing that was actually broken was the token itself.
+
+## Key Learnings
+
+When a credential helper says "Authentication failed" and the wiring is verifiable, check the credential value FIRST before assuming code issues. `curl -u "user:$TOKEN" https://gitea/api/v1/user` is a 5-second test.
+
+## Follow-ons
+
+- [ ] If pushed: true, close out the vault push fix completely
+- [ ] Mark the architectural debugging chain done
\ No newline at end of file