diff --git a/README.md b/README.md
index 17225fe2..1bd7e613 100644
--- a/README.md
+++ b/README.md
@@ -878,6 +878,12 @@ A CommonJS preload module that runs a Prometheus scrape endpoint on port 9209 (c
 
 ### 2026-04-09
 
+**fix: inbox processor never started — startup-gate signal file missing** (`6a005c0`)
+The new fork (v3.13.4) introduced `@rmdes/indiekit-startup-gate`, which wraps `startInboxProcessor` (and key refresh, batch refollow) in `waitForReady()`. That function polls for `/app/data/.indiekit-ready` — a Cloudron deployment convention — before firing its callback. On this FreeBSD server the file is never created automatically, so the callback never ran: all inbound AP activities queued up in `ap_inbox_queue` at `attempts: 0` indefinitely with no error logging. Added `scripts/preflight-startup-gate.mjs` to `npm run serve` — it creates the signal file on every startup, causing `waitForReady()` to fire immediately.
+
+**fix(ap): OAuth access tokens expire 10 min after login** (`5b6fd57`)
+`patch-ap-oauth-token-expiry-fix`: the `authorization_code` exchange updated the token document in-place but never cleared the auth code's `expiresAt` (now + 10 min). `tokenRequired` middleware returned null once that time elapsed → 401 on all authenticated endpoints. Fixed by adding `$unset: { expiresAt: "" }` to the exchange update, matching the existing behaviour of the `refresh_token` grant.
+
 **chore(deps): update indiekit-endpoint-activitypub fork** (`c8ca991`)
 Pulled latest commit from svemagie/indiekit-endpoint-activitypub. Key upstream changes: status IDs migrated from timestamp cursors to MongoDB ObjectIds (`findTimelineItemById` now does `findOne({ _id: new ObjectId(id) })`); `in_reply_to_id` serialiser uses `resolveReplyIds()` batch lookup (`resolve-reply-ids.js`) instead of the tautological null; `objectId` ReferenceError in DELETE route fixed upstream; draft/unlisted syndication guards moved from patches into `index.js` natively.