diff --git a/investigations/2026-05-31-authentik-vps-migration.md b/investigations/2026-05-31-authentik-vps-migration.md
index 1ab3026..972e98d 100644
--- a/investigations/2026-05-31-authentik-vps-migration.md
+++ b/investigations/2026-05-31-authentik-vps-migration.md
@@ -78,6 +78,20 @@ Forward-auth apps (Paperless, qBittorrent, Artifacto) initially still validated
 
 Fixed with a **dedicated LAN outpost** ([106 — auth-outpost](../containers/106-auth-outpost.md), `192.168.8.6`): `goauthentik/proxy` connects outbound to the VPS core and serves forward-auth locally; Caddy → outpost over the LAN, no Traefik, header preserved. Outpost `hubris-lan-outpost` carries the 3 proxy providers. Verified with 124-Authentik **stopped**. This was Phase 1 of the broader architecture migration (plan: VPS edge / hubris LAN core / Mac Mini redundancy).
 
+### 2026-06-05 — identification stage skip: broken "Trust me" reputation policy
+
+The default authentication flow was skipping the identification stage (showing only a password field with `pending_user: ""`), making login impossible. Root cause: a **"Trust me" reputation policy** (`threshold: -3`, `negate: true`) attached to the identification stage binding (#10). The `negate: true` + broken policy evaluation caused the stage binding to fail re-evaluation, and Authentik's `ReevaluateMarker` skipped the stage entirely.
+
+**Fix:** Deleted from Postgres:
+```sql
+DELETE FROM authentik_policies_policybinding WHERE policy_id = '<uuid>';
+DELETE FROM authentik_policies_reputation_reputationpolicy WHERE policy_ptr_id = '<uuid>';
+DELETE FROM authentik_policies_policy WHERE policy_uuid = '<uuid>';
+```
+The policy was orphaned (no matched type data or had incompatible evaluation). Removing it restores normal two-stage login (identification → password).
+
+**Note:** This is different from the 2026-05-31 issue where NetBird's `login_hint` OAuth2 param intentionally pre-identifies users. That was expected behavior; this was a genuine bug.
+
 ## Outstanding
 
 - **NetBird client version skew.** Mac client is `0.68.3` vs mgmt `0.71.3`; NetBird-SSH cert exchange fails between them. Upgrade all clients toward `0.71.x`.