diff --git a/2026/2026-07-10--forgejo-rootless.md b/2026/2026-07-10--forgejo-rootless.md
index 89f9702..ebfc2cf 100644
--- a/2026/2026-07-10--forgejo-rootless.md
+++ b/2026/2026-07-10--forgejo-rootless.md
@@ -54,6 +54,8 @@ curl -sS https://git.hacktivism.ch/api/healthz
 
 ## Caddy (host root)
 
+Live `/etc/caddy/Caddyfile` matches `configs/caddy/Caddyfile` (applied 2026-07-10; `http://git.` in ACME list; SSH note **9200**).
+
 Site block live in `/etc/caddy/Caddyfile` (mirror under `configs/caddy/`).  
 Prefer including `http://git.hacktivism.ch` in the shared ACME/redirect host list.
 
diff --git a/2026/2026-07-10.md b/2026/2026-07-10.md
index 9a43a74..0ce62cd 100644
--- a/2026/2026-07-10.md
+++ b/2026/2026-07-10.md
@@ -13,3 +13,4 @@
   → topic: `2026-07-10--admin-log-origin-forgejo.md`
 - admin-log: castopod/prime compose mirrors; firewalld list-all +9200; Caddyfile.taler-host marked legacy
 - admin-log: Tor relay mirror documented (`configs/tor/`, host/tor)
+- Caddyfile applied on host: git. in ACME/redirect list, SSH note :9200; live matches configs/caddy mirror (verified)
diff --git a/ops/LOCAL-CHANGES-PENDING.md b/ops/LOCAL-CHANGES-PENDING.md
new file mode 100644
index 0000000..f020950
--- /dev/null
+++ b/ops/LOCAL-CHANGES-PENDING.md
@@ -0,0 +1,40 @@
+# Local changes / follow-ups — not yet committed
+
+Working list for koopa-admin-log. Items here are **to do or only local** until explicitly committed and pushed to `git.hacktivism.ch`.
+
+Status legend: `open` · `local-only` · `done-on-host` · `blocked`
+
+---
+
+## Nachführen (sync / mirror)
+
+| Item | Status | Notes |
+|------|--------|--------|
+| Live `/etc/caddy/Caddyfile` vs `configs/caddy/Caddyfile` | `done-on-host` | Applied 2026-07-10; live **MATCH** mirror (git. in ACME list, SSH :9200). |
+| `firewall-cmd --list-all` re-export | `open` | `host/firewalld/list-all.txt` updated by hand with **9200/tcp** (verified open). Re-export as root when possible for exact dump. |
+| Castopod compose mirror | `done` (committed) | `configs/castopod/` |
+| Prime compose mirror | `done` (committed) | `configs/prime/` (WEBUI_PASSWORD redacted) |
+| Tor `configs/tor/` | `done` (committed) | matched live; README added |
+| `host/caddy/` full vhost map | `done` (committed) | was stale Taler-only |
+
+## Local-only / do not commit yet
+
+| Path / topic | Status | Notes |
+|--------------|--------|--------|
+| *(none staged intentionally)* | — | Keep secrets out of this repo always. |
+| This file (`ops/LOCAL-CHANGES-PENDING.md`) | `done` | Committed with Caddy apply verification. |
+
+## Host ops (not in git)
+
+| Item | Status | Notes |
+|------|--------|--------|
+| Apply desired Caddyfile on koopa | `done-on-host` | verified MATCH 2026-07-10 |
+| firewalld permanent 9200 | `done-on-host` | verified LAN/hairpin/`ssh -T` |
+| VeciGate 9200 DNAT/hairpin/IPv6 | `done-on-host` | see vecigate-admin-log |
+
+## When closing an item
+
+1. Fix on host and/or update mirror in this tree.  
+2. `git add` · commit · `git push origin main`.  
+3. Mark row `done` or remove from this list.  
+4. If this tracking file itself should be public, commit it in a separate intentional commit.