diff --git a/docs/ROO-HANDOVER.md b/docs/ROO-HANDOVER.md
index 6a5dbe7..02ea320 100644
--- a/docs/ROO-HANDOVER.md
+++ b/docs/ROO-HANDOVER.md
@@ -6,6 +6,47 @@
 
 ---
 
+## ✅ RESOLVED — 2026-06-13 — CannaManage live at http://192.168.188.119:3000
+
+All blocking issues fixed. Stack is up on TrueNAS (backend + db healthy, frontend serving).
+The frontend `pnpm build` crash was **not** a NextAuth problem — the 6 earlier fixes
+targeted the wrong layer. Three real root causes, fixed in order:
+
+1. **Frontend build crash (`ERR_INVALID_URL, input: 'undefined'`)** — commit `f6a7143`
+   Root layout `src/app/layout.tsx` evaluated `new URL(process.env.BASE_URL)` at module
+   load. `BASE_URL` was never a build-time ENV → `new URL(undefined)` threw. Because it's
+   the **root layout**, its `metadata` is collected for *every* route during "Collecting
+   page data", explaining why both `/impressum` (marketing) and `/portal-login`
+   (non-marketing) failed identically. Fix: `?? "http://localhost:3000"` fallback +
+   `BASE_URL` build ENV in Dockerfile. The middleware/force-dynamic fixes were irrelevant
+   (metadata is evaluated before middleware ever runs).
+
+2. **Backend crash: `Schema validation: missing table [audit_events]`** — commit `8490da4`
+   This is **Spring Boot 4.0.6**, which modularized autoconfiguration.
+   `FlywayAutoConfiguration` moved into a dedicated `spring-boot-flyway` module pulled in
+   only by `spring-boot-starter-flyway`. The pom had only `flyway-database-postgresql`
+   (+ transitive `flyway-core`) but NOT the starter, so `spring.flyway.enabled=true` was
+   inert: no migrations ran, no `flyway_schema_history`, Hibernate `ddl-auto=validate`
+   failed on the empty schema. Fix: add `spring-boot-starter-flyway`.
+   Ref: https://spring.io/blog/2025/10/28/modularizing-spring-boot/
+
+3. **Backend unhealthy (503 on /actuator/health)** — commit `60844ef`
+   `spring-boot-starter-mail` registers a mail health indicator that tries `localhost:1025`.
+   No SMTP container in this deployment → DOWN → aggregate health DOWN → Docker marks the
+   container unhealthy → frontend refused to start. Fix:
+   `management.health.mail.enabled=false` in the docker profile.
+
+**Infra note:** Host port 8080 was already taken by `odysseus-searxng-1`. The TrueNAS
+override (`/mnt/VM_SSD_Pool/cannamanage/docker-compose.truenas.yml`, not in git) remaps the
+backend host port to **8081** using `ports: !reset []` (compose merges list-type keys by
+concat otherwise). The internal container port stays 8080, so `BACKEND_URL=http://backend:8080`
+is unaffected.
+
+**Verified:** frontend `/login` 200, `/impressum` 200 (was the failing SSG page), `/` 307→login;
+backend `/actuator/health` UP; reachable from the workstation over LAN.
+
+---
+
 ## What We Were Doing
 
 Deploying the full CannaManage stack (Spring Boot backend + Next.js frontend + PostgreSQL) on TrueNAS.local at `192.168.188.119` so Patrick can test the app in a browser.