diff --git a/2026/2026-10-21--castopod-php-stay-off.md b/2026/2026-10-21--castopod-php-stay-off.md
new file mode 100644
index 0000000..0455ac3
--- /dev/null
+++ b/2026/2026-10-21--castopod-php-stay-off.md
@@ -0,0 +1,13 @@
+# Castopod stays off
+
+Rechecked 2026-10-21 after the stop note. Web unit container-koopa-castopod.service is disabled, inactive, dead. Container koopa-castopod is exited, finished 2026-10-21 22:48:06 +0200. Nothing listens on :9020. MariaDB and Redis user units stay loaded and active. No second stop. Caddy vhost unchanged.
+
+Log review found no sign of a successful remote code execution. Overlay file /tmp/fw-cp.php (1448 bytes, mode 600, sha256 7bb279bffa12dbb81787183108a2641b78a6657b069cbef7967950d80e13b5bc, mtime 2026-09-07 03:25:59 +0200) is a local database script for cp_users, outside the docroot, not a web shell. /tmp/os-dry.out is an apt dry-run. Five theme files differ by one branding line from 2026-07-13. Media volume has no scripts. Access logs run 2026-10-17 through the stop and show no 2xx on a non-index script. Critical lines on 2026-09-07 match other days.
+
+Limits: access logs start 2026-10-17, so HTTP from 2026-09-07 is absent. A memory-only or already rotated request is not ruled out. Whether the local script ran is not in the logs. MariaDB was not opened.
+
+Stays down until an image ships PHP newer than 8.4.18. Hub tag :1 from 2026-02-24 is not that image. Parent 537, slug castopod-restart-after-php-fix.
+
+Restore only then:
+
+ systemctl --user enable --now container-koopa-castopod.service
diff --git a/2026/2026-10-21--castopod-php-stop.md b/2026/2026-10-21--castopod-php-stop.md
new file mode 100644
index 0000000..e951d06
--- /dev/null
+++ b/2026/2026-10-21--castopod-php-stop.md
@@ -0,0 +1,23 @@
+# Castopod PHP stopped
+
+Checked 2026-10-21. Host has no php-fpm and no php package. The only PHP process was Castopod FrankenPHP in container koopa-castopod.
+
+| Item | Value |
+|------|--------|
+| image | docker.io/castopod/castopod:1 |
+| repo digest | sha256:4e4f0440520f45257bfeac7be4347defd20048b4efef8f53d73ec9ed3a4f7966 |
+| amd64 digest | sha256:757f3c2a96b31b81753c23bc092dfcf05039d9df4d13cc12c428bb752fce882b |
+| image created | 2026-02-24 |
+| hub tags 1 / latest / 1.15.5 | same digest, pushed 2026-02-24 |
+| PHP | 8.4.18 (12 Feb 2026) |
+| FrankenPHP | v2.10.2 |
+| listen | 0.0.0.0:9020 -> 8080 |
+| public | https://castopod.hacktivism.ch/ |
+
+Stable Hub tags have not moved since 2026-02-24. develop last push 2026-06-05 and is not a stable security update. php.net lists 8.4.26 (24 Sep 2026) and 8.4.27 (22 Oct 2026) after 8.4.18, with a banner to update for critical remote code execution. Pulling :1 repeats the same image. FrankenPHP ships its own PHP binary.
+
+Stopped and disabled user unit container-koopa-castopod.service. ExecStop is `podman stop -t 30 koopa-castopod`. Container status after stop: Exited (0). :9020 not listening. MariaDB and Redis units left running. Caddy vhost unchanged.
+
+Bring the web container back only when a newer image exists:
+
+ systemctl --user enable --now container-koopa-castopod.service
diff --git a/2026/2026-10-24--todo704-tor-cachyos-cookieauth.md b/2026/2026-10-24--todo704-tor-cachyos-cookieauth.md
new file mode 100644
index 0000000..46665b5
--- /dev/null
+++ b/2026/2026-10-24--todo704-tor-cachyos-cookieauth.md
@@ -0,0 +1,41 @@
+# TODO=704 Tor CachyOS CTR + CookieAuth (koopa)
+
+Relay was down (stale PIDFile / start-timeout on forking unit), keys intact. Recreated **same identity** on CachyOS container; CookieAuth for ControlPort; host tor disabled.
+
+## Stand after APPLY (2026-10-24 ~21:47–21:51 Europe/Zurich)
+
+| Item | Value |
+|------|--------|
+| CTR | `koopa-tor-relay` Up, image `localhost/koopa-tor-relay:latest` (=`:cachyos`) |
+| Tor | 0.4.9.14 (CachyOS/Arch extra) |
+| Unit | `container-koopa-tor-relay.service` Type=simple, active |
+| Host tor | `tor.service` disabled + failed/inactive |
+| FP | `02C7EECCDF7814FBA2DB1CBAED000D06E8A32EE8` (keys mtime 2024-11-14) |
+| ORPort | 8080 |
+| ControlPort | 127.0.0.1:9051 CookieAuthentication=1, CookieAuthFile=/var/lib/tor/control_auth_cookie |
+| Bootstrap | PROGRESS=100 done; status/circuit-established=1 |
+| Unauth ControlPort | 514 Authentication required |
+| Cookie AUTH | 250 OK |
+
+## Steps
+
+1. Dry-run `/tmp/tor.sh` on koopa → STATUS=dry-run-ok; NEXT=`sudo APPLY=1 /tmp/tor.sh` (host tor was still enabled).
+2. Human: `systemctl disable --now tor.service`, then `sudo APPLY=1 /tmp/tor.sh`.
+3. APPLY: wrote CachyOS Containerfile, pulled `docker.io/cachyos/cachyos:latest`, build (cache hit), `podman create --replace --network host --user 1000:1000 --userns keep-id`, torrc bak `torrc.bak-cookie-20261024-214720`, CookieAuth on.
+4. First APPLY hit dbus fail under sudo (`$DBUS_SESSION_BUS_ADDRESS` / `$XDG_RUNTIME_DIR` unset). Unit rewrite + enable finished with XDG/DBUS set; script path re-exec as SUDO_USER for later runs.
+5. Verify from magikoopa SSH: unit active, CTR Up, FP match, circuit-established=1, unauth 514.
+
+## Live paths
+
+- `~/koopa-tor-relay/{torrc,data,log,build/Containerfile}`
+- `~/.config/systemd/user/container-koopa-tor-relay.service`
+- Driver: `/tmp/tor.sh` (TARGET=koopa); upgrade later: `~/upgrade-containers.sh --apply --rebuild-local --only koopa-tor-relay`
+
+## Akte mirrors
+
+- `configs/tor/torrc`
+- `configs/tor/build/Containerfile`
+- `configs/systemd/user/container-koopa-tor-relay.service`
+- `host/tor/README.md` updated (was stale host `tor.service`)
+
+Sibling: firecuda brew tor CookieAuth same day (FP `52BB94DDC1292F950CF728708AC48523E018A718`, MyFamily both ways). Parent TODO=704.
diff --git a/configs/systemd/user/container-koopa-tor-relay.service b/configs/systemd/user/container-koopa-tor-relay.service
new file mode 100644
index 0000000..b65e1ce
--- /dev/null
+++ b/configs/systemd/user/container-koopa-tor-relay.service
@@ -0,0 +1,21 @@
+# container-koopa-tor-relay.service — regenerated by tor.sh 2026-10-24T21:47:24+02:00
+# Prefer simple over podman-generate-systemd forking+PIDFile (stale CID storm).
+
+[Unit]
+Description=Podman koopa-tor-relay
+Wants=network-online.target
+After=network-online.target
+RequiresMountsFor=%t/containers
+
+[Service]
+Environment=PODMAN_SYSTEMD_UNIT=%n
+Restart=always
+RestartSec=5
+TimeoutStartSec=120
+TimeoutStopSec=70
+ExecStart=/usr/bin/podman start --attach koopa-tor-relay
+ExecStop=/usr/bin/podman stop -t 10 koopa-tor-relay
+Type=simple
+
+[Install]
+WantedBy=default.target
diff --git a/configs/tor/build/Containerfile b/configs/tor/build/Containerfile
new file mode 100644
index 0000000..c57a137
--- /dev/null
+++ b/configs/tor/build/Containerfile
@@ -0,0 +1,24 @@
+# koopa-tor-relay — Tor non-exit relay on CachyOS (Arch extra/tor)
+# Same pattern as koopa-meet-web:cachyos. Rootless: tor user -> uid/gid 1000.
+# Recreate: --user 1000:1000 --userns=keep-id  (see README / tor.sh)
+ARG CACHYOS_IMAGE=docker.io/cachyos/cachyos:latest
+FROM ${CACHYOS_IMAGE}
+ENV TZ=Europe/Zurich
+RUN pacman -Syu --noconfirm --needed tor nyx ca-certificates \
+ && pacman -Scc --noconfirm \
+ && rm -rf /var/cache/pacman/pkg/* /tmp/* \
+ && mkdir -p /var/lib/tor /var/log/tor \
+ && if id tor >/dev/null 2>&1; then \
+      groupmod -g 1000 tor 2>/dev/null || true; \
+      usermod -u 1000 -g 1000 tor 2>/dev/null || true; \
+    elif id debian-tor >/dev/null 2>&1; then \
+      groupmod -g 1000 debian-tor; usermod -u 1000 -g 1000 debian-tor; \
+    else \
+      groupadd -g 1000 tor; useradd -u 1000 -g 1000 -d /var/lib/tor -s /usr/bin/nologin tor; \
+    fi \
+ && chown -R 1000:1000 /var/lib/tor /var/log/tor \
+ && chmod 700 /var/lib/tor
+EXPOSE 8080 9051
+USER 1000:1000
+ENTRYPOINT ["/usr/bin/tor"]
+CMD ["-f", "/etc/tor/torrc", "--runasdaemon", "0"]
diff --git a/configs/tor/torrc b/configs/tor/torrc
new file mode 100644
index 0000000..9f1705f
--- /dev/null
+++ b/configs/tor/torrc
@@ -0,0 +1,18 @@
+# KoopaRelay — same policy as live /etc/tor/torrc + admin-log configs/tor/torrc
+# Identity: keys in DataDirectory (migrate from host /var/lib/tor)
+Log notice file /var/log/tor/notices.log
+Nickname    KoopaRelay
+ContactInfo info+koopa@hacktivism.ch
+# dual-stack: bind all addresses on 8080 (IPv4 + IPv6), same as host tor
+ORPort      8080
+ControlPort 127.0.0.1:9051
+CookieAuthentication 1
+CookieAuthFile /var/lib/tor/control_auth_cookie
+ExitRelay   0
+SocksPort   0
+MyFamily    52BB94DDC1292F950CF728708AC48523E018A718
+BandwidthRate 2000 MBytes
+BandwidthBurst 2000 MBytes
+RelayBandwidthRate 2000 MBytes
+RelayBandwidthBurst 2000 MBytes
+DataDirectory /var/lib/tor
diff --git a/host/tor/README.md b/host/tor/README.md
index 138d11d..fa68a9c 100644
--- a/host/tor/README.md
+++ b/host/tor/README.md
@@ -1,13 +1,30 @@
 # Tor on koopa
 
-**Runtime:** host **`tor.service`** (not a podman container).  
-**Ports:** ORPort **8080** · ControlPort **9051** (loopback).  
-**Non-exit** relay (`ExitRelay 0`).
+**Runtime:** rootless podman container **`koopa-tor-relay`** (CachyOS base, Arch `extra/tor`), managed by user unit **`container-koopa-tor-relay.service`** (`Type=simple`, `podman start --attach`).  
+**Host `tor.service`:** disabled / must stay off (port clash on ORPort 8080 + ControlPort 9051).  
+**Ports:** ORPort **8080** · ControlPort **127.0.0.1:9051** (CookieAuthentication + CookieAuthFile).  
+**Non-exit** relay (`ExitRelay 0`). Nickname **KoopaRelay**.  
+**Fingerprint (stable keys under `~/koopa-tor-relay/data/keys/`):** `02C7EECCDF7814FBA2DB1CBAED000D06E8A32EE8`  
+**Family:** firecuda FireCudaRelay `52BB94DDC1292F950CF728708AC48523E018A718`
+
+Live tree: `~/koopa-tor-relay/` (`torrc`, `data/`, `log/`, `build/Containerfile`).  
+Mirrors in this repo: `configs/tor/torrc`, `configs/tor/build/Containerfile`, `configs/systemd/user/container-koopa-tor-relay.service`.
 
 ```bash
-systemctl status tor
-ss -lntp | grep -E '8080|9051'
+# status
+systemctl --user status container-koopa-tor-relay.service
+podman ps --filter name=koopa-tor-relay
+# ControlPort cookie auth (hex)
+COOKIE=$(xxd -p -c 256 ~/koopa-tor-relay/data/control_auth_cookie)
+printf 'AUTHENTICATE %s\r\nGETINFO fingerprint\r\nGETINFO status/circuit-established\r\nQUIT\r\n' "$COOKIE" | nc -w 3 127.0.0.1 9051
 ```
 
-login-health: WARN if `tor.service` not active.  
-Legacy `koopa-tor-relay` / `configs/tor/` removed from live inventory (git history keeps them).
+Apply / recreate (after host tor off):
+
+```bash
+sudo APPLY=1 /tmp/tor.sh
+# later upgrades:
+~/upgrade-containers.sh --apply --rebuild-local --only koopa-tor-relay
+```
+
+login-health: expect user unit active + CTR Up; host `tor.service` inactive. Parent TODO=704.