diff --git a/2026/2026-07-16.md b/2026/2026-07-16.md
index e3a3f81..df8251d 100644
--- a/2026/2026-07-16.md
+++ b/2026/2026-07-16.md
@@ -2,4 +2,4 @@
 
 - **koopa-nym** (nym.com) mirror → `2026-07-16--koopa-nym.md`
 - **container autostart** (podman-restart + units) → `2026-07-16--container-autostart.md`
-- **Offene Issues** → [`ISSUES.md`](../ISSUES.md)
+- **Open issues** → [`ISSUES.md`](../ISSUES.md)
diff --git a/ISSUES.md b/ISSUES.md
index 09c5b4c..2f70914 100644
--- a/ISSUES.md
+++ b/ISSUES.md
@@ -1,24 +1,24 @@
-# Offene Issues (sichtbar)
+# Open issues
 
-Stand: **2026-07-16** (koopa live scan). Keine Secrets.
+As of **2026-07-16** (live scan on koopa). No secrets.
 
 ---
 
-## I-2026-07-16-01 — firewalld: Nym-Ports auf koopa unbestätigt
+## I-2026-07-16-01 — firewalld: Nym ports on koopa unverified
 
 | | |
 |--|--|
-| **Severity** | high (für öffentliche Nym-Erreichbarkeit) |
+| **Severity** | high (for public Nym reachability) |
 | **Host** | koopa |
 | **Status** | open |
 
-VeciGate DNATed **1789/tcp+udp**, **1790/tcp**, **51822/udp** → koopa.  
-Ohne passende **firewalld**-Freigabe auf koopa bleibt der Traffic am Host stecken.
+VeciGate DNATs **1789/tcp+udp**, **1790/tcp**, **51822/udp** → koopa.  
+Without matching **firewalld** allow rules on koopa, traffic dies on the host.
 
-Agent konnte `firewall-cmd` nicht prüfen/ändern (**sudo Passwort nötig**).
+Agent could not run `firewall-cmd` (**sudo password required**).
 
 ```bash
-# auf koopa (mit sudo)
+# on koopa (with sudo)
 sudo firewall-cmd --permanent --add-port=1789/tcp
 sudo firewall-cmd --permanent --add-port=1789/udp
 sudo firewall-cmd --permanent --add-port=1790/tcp
@@ -29,33 +29,37 @@ sudo firewall-cmd --list-ports
 
 ---
 
-## I-2026-07-16-02 — Nym-Node nicht gebondet / nicht im Explorer
+## I-2026-07-16-02 — Nym node not bonded / not in public explorers
 
 | | |
 |--|--|
-| **Severity** | medium (ops / Sichtbarkeit im Nym-Netz) |
+| **Severity** | medium (visibility on the Nym network) |
 | **Host** | koopa (`koopa-nym`) |
 | **Status** | open |
 
-Container **läuft** (mixnode), API `9080` antwortet.  
-Ohne **Bond** in der Nym-Wallet erscheint die Node typischerweise **nicht** in Harbour Master / Explorer (anders als Tor nach ORPort-Publish).
+Container **is running** (mixnode); API on **9080** answers.  
+Without a **bond** in the Nym wallet the node typically does **not** show up in Harbour Master / network explorers (unlike Tor after ORPort publish).
 
-Logs: WARN `validator.nymtech.net/api/.../refresh-described` → **404** (API-Pfad/Version; Node mischt trotzdem).
+See also: `configs/nym/PUBLIC-LISTING.md`.
+
+Logs: WARN `validator.nymtech.net/api/.../refresh-described` → **404** (API path/version; node still runs mixmode).
+
+**Identity key (public):** `55gPqeyHHj4CwpVZXLEQy9MjSvVTVXM8t2pMmNCH2MsW`
 
 ---
 
-## I-2026-07-16-03 — `podman-restart.service` enabled, session noch inactive
+## I-2026-07-16-03 — `podman-restart.service` enabled, inactive this session
 
 | | |
 |--|--|
-| **Severity** | low (bis Reboot getestet) |
+| **Severity** | low (until reboot is tested) |
 | **Host** | koopa (user hernani) |
 | **Status** | open / expected until reboot |
 
 `systemctl --user is-enabled podman-restart` = **enabled**,  
-`is-active` = **inactive** (oneshot, diese Boot-Session noch nicht gelaufen).
+`is-active` = **inactive** (oneshot; has not run this boot session).
 
-Nach Reboot prüfen:
+After reboot:
 
 ```bash
 systemctl --user is-active podman-restart.service
@@ -64,18 +68,17 @@ podman ps -a --filter should-start-on-boot=true --format '{{.Names}} {{.Status}}
 
 ---
 
-## I-2026-07-16-04 — Streucontainer `kind_taussig`
+## I-2026-07-16-04 — Stray container `kind_taussig`
 
 | | |
 |--|--|
-| **Severity** | low (Hygiene) |
+| **Severity** | low (hygiene) |
 | **Host** | koopa |
 | **Status** | open |
 
-Container **Up** seit ~5 Tagen: `kind_taussig` (`debian:bookworm-slim`),  
-einmaliges Wallet-/DEB-Testskript, **`restart=no`**, kein Prod-Name.
+Container **Up** ~5 days: `kind_taussig` (`debian:bookworm-slim`), one-off wallet/DEB test script, **`restart=no`**, not a production name.
 
-Kandidat zum **Stoppen/Entfernen**, sobald Logs nicht mehr gebraucht werden:
+Candidate to stop/remove when logs are no longer needed:
 
 ```bash
 podman stop kind_taussig
@@ -84,40 +87,40 @@ podman rm kind_taussig
 
 ---
 
-## I-2026-07-16-05 — Alte exited Podman-Container (Müll)
+## I-2026-07-16-05 — Old exited Podman containers (clutter)
 
 | | |
 |--|--|
-| **Severity** | low (Hygiene) |
+| **Severity** | low (hygiene) |
 | **Host** | koopa |
 | **Status** | open |
 
-Mehrere **Exited**-Container (Monate/Jahre alt), u. a. `pensive_dubinsky`,  
+Several **Exited** containers (months/years old), e.g. `pensive_dubinsky`,  
 `hardcore_edison`, `taler-exchange-no-network`, `debian00`, …  
-Kein Autostart; belasten nur `podman ps -a`.
+No autostart; only clutter `podman ps -a`.
 
-Optional aufräumen: `podman container prune` (nur exited, nach Sichtprüfung).
+Optional cleanup: `podman container prune` (exited only, after review).
 
 ---
 
-## I-2026-07-16-06 — Nym HTTP-API `*:9080` lauscht host-weit
+## I-2026-07-16-06 — Nym HTTP API listens on `*:9080`
 
 | | |
 |--|--|
-| **Severity** | low–medium (Angriffsfläche) |
+| **Severity** | low–medium (attack surface) |
 | **Host** | koopa |
-| **Status** | open (bewusst so im compose) |
+| **Status** | open (as configured in compose) |
 
-`ss` zeigt **\*:9080** (rootlessport). **Kein** VeciGate-DNAT auf 9080.  
-Von WAN ohne NAT i. d. R. nicht erreichbar; von LAN erreichbar.
+`ss` shows **\*:9080** (rootlessport). **No** VeciGate DNAT for 9080.  
+Usually not reachable from WAN without NAT; reachable from LAN.
 
-Härten optional: Publish nur `127.0.0.1:9080:8080` in compose.
+Optional harden: publish only `127.0.0.1:9080:8080` in compose.
 
 ---
 
-## Erledigt / kein Issue (Scan)
+## Not an issue (scan)
 
-- Alle `should-start-on-boot` Prod-Container **Up**
-- Keine failed user units
-- Taler 9010–9015 antworten (401/302 ok)
+- All production `should-start-on-boot` containers **Up**
+- No failed user units
+- Taler ports 9010–9015 respond (401/302 OK)
 - Linger=yes, container-* units enabled
diff --git a/README.md b/README.md
index d3aadb1..13bdec7 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@ Ops log and config mirror for host **koopa** (openSUSE Tumbleweed).
 
 ## Open issues
 
-**Sichtbare Issue-Liste:** [`ISSUES.md`](ISSUES.md)
+**Visible issue list:** [`ISSUES.md`](ISSUES.md)
 
 ## Git origin
 
diff --git a/configs/nym/PUBLIC-LISTING.md b/configs/nym/PUBLIC-LISTING.md
new file mode 100644
index 0000000..880accb
--- /dev/null
+++ b/configs/nym/PUBLIC-LISTING.md
@@ -0,0 +1,62 @@
+# Where is koopa listed publicly? (Nym / nym.com)
+
+Similar idea to **Tor relay directories**, but Nym uses different explorers and
+requires a **bond** on-chain before the node shows up reliably.
+
+## Public directories / explorers
+
+| Site | Role |
+|------|------|
+| [https://harbourmaster.nymtech.net/](https://harbourmaster.nymtech.net/) | Operator / performance view (search by identity key or node id) |
+| [https://explorer.nymtech.net/](https://explorer.nymtech.net/) | Network explorer (mixnodes / components) |
+| [https://nym.com/explorer](https://nym.com/explorer) | Nym.com explorer UI |
+
+After bonding, a typical deep link shape is:
+
+`https://nym.com/explorer/nym-node/<IDENTITY_KEY>`
+
+or Harbour Master mixnode pages by numeric id once assigned.
+
+## This host (`koopa-nym`)
+
+| Field | Value |
+|-------|--------|
+| Container | `koopa-nym` (running, mode **mixnode**) |
+| Announced public IP | `212.51.151.254` (WAN / VeciGate) |
+| Mixnet | host **1789** tcp/udp |
+| Verloc | host **1790** tcp |
+| Local HTTP API | `http://127.0.0.1:9080` (not DNATed to WAN) |
+| **Ed25519 identity (public)** | `55gPqeyHHj4CwpVZXLEQy9MjSvVTVXM8t2pMmNCH2MsW` |
+| Location (aux) | `CH` |
+| Operator T&Cs accepted | yes (run flag) |
+
+### How to re-read identity on the host
+
+```bash
+podman exec -e HOME=/var/lib/nym koopa-nym \
+  nym-node node-details --id koopa-nym
+```
+
+Search explorers with the **ed25519 identity** string above.
+
+## When it becomes visible
+
+1. Node process running (done).
+2. Ports reachable from the internet (VeciGate DNAT + **firewalld** on koopa).
+3. **Bond** the node with the Nym wallet (NYM stake / bond flow).
+4. Wait for network / epoch updates; inactive nodes may lag in Harbour Master.
+
+Until step 3, public explorers often show **nothing** for this identity — that is expected.
+
+## Not the same as Tor
+
+| Tor | Nym |
+|-----|-----|
+| Relay Search / metrics after ORPort publish | Explorer / Harbour Master after **bond** + healthy announce |
+| Nickname optional | Identity key is the stable public id |
+
+## Related
+
+- Ops mirror: `configs/nym/`
+- Open issues: root [`ISSUES.md`](../../ISSUES.md) (I-2026-07-16-01, I-2026-07-16-02)
+- VeciGate NAT: `vecigate-admin-log/ip/firewall/nat/README.md`
diff --git a/configs/nym/README.md b/configs/nym/README.md
index 55e089a..3b3c01d 100644
--- a/configs/nym/README.md
+++ b/configs/nym/README.md
@@ -59,3 +59,5 @@ Secrets layout (values in **koopa-admin-secrets**):
 | `~/koopa-nym/data/` | host-only (node identity; not git) |
 
 Path map: `koopa-admin-log/SECRETS.md`.
+
+**Public listing (explorers):** see [`PUBLIC-LISTING.md`](PUBLIC-LISTING.md).