diff --git a/2026/2026-07-19.md b/2026/2026-07-19.md
index 4345769..8b5722b 100644
--- a/2026/2026-07-19.md
+++ b/2026/2026-07-19.md
@@ -3,3 +3,8 @@
 - **Caddy mon bare paths:** `redir /path/ 302` inside `handle` → Location `302` → merchant code 21; fix `redir * /path/ 302`
 - **apply-monitoring-live.sh:** smoke for-loop syntax (missing `\`); use absolute `/home/hernani/koopa-caddy/…` (root `~` = `/root`)
 - Re-apply: `sudo /home/hernani/koopa-caddy/apply-monitoring-live.sh`
+- **clementine-magikoopa-share** (`~/clementine-magikoopa-share/`): openssl AES-256-CBC + PBKDF2 iter 600000; `lock.sh`/`unlock.sh` + `ANLEITUNG.md` (usage). Inventory only after decrypt: `EXPECTED-REPOS.md` (includes vecigate-admin-log/secrets expected from magikoopa). Usage mirror in `koopa-admin-secrets/docs/clementine-magikoopa-share.md`.
+- **Share payload = all local-only / never-pushed repos:** canonical list in `koopa-admin-secrets/docs/share-payload-dirs.txt` (+ `local-only-share-repos.md`). On clementine archived: `taler-monitoring-env`, `llm`, `grok-work-log`, **`koopa-admin-secrets`**, **`francpaysan-secrets`**, **`dot-grok`** (`~/.grok` full profile); still MISSING until magikoopa locks them: `vecigate-admin-log`, `vecigate-admin-secrets`.
+- **Share README:** other machine must treat `dot-grok` / profile rules **system-wide** (install to `~/.grok`, same operator rules on clementine and magikoopa).
+
+- **secret-languages:** extracted from local branches `local/merchant-secret-ui` / `local/secret-ui-scrub` into standalone local-only repo `~/src/koopa/secret-languages` (never push). Those branches deleted on this clone. Pack via clementine-magikoopa-share.
diff --git a/2026/2026-09-05--taler-apt-src-ubuntu.md b/2026/2026-09-05--taler-apt-src-ubuntu.md
new file mode 100644
index 0000000..04b10f2
--- /dev/null
+++ b/2026/2026-09-05--taler-apt-src-ubuntu.md
@@ -0,0 +1,24 @@
+# taler apt-src ubuntu (noble) on koopa
+
+**2026-09-05** — Freigabe: create Ubuntu track next to existing trixie apt-src pods.
+
+## container
+
+| name | base | suite | image |
+|------|------|-------|-------|
+| `koopa-taler-deploy-test-apt-src-ubuntu` | `ubuntu:24.04` | `noble` @ `deb.taler.net/apt/ubuntu` | `localhost/…:setup` after commit |
+
+ensure: `~/src/taler-monitoring/host-agent/ensure-apt-deploy-test-containers.sh ubuntu`  
+(branch `llm-lightweight-monitoring` / tip after `v1.27.0`)
+
+## verify
+
+```bash
+podman ps -a --filter name=koopa-taler-deploy-test-apt-src-ubuntu
+ANSIBLE_SMOKE_PODMAN=1 ANSIBLE_SMOKE_REQUIRE_UBUNTU=1 \
+  ./taler-monitoring.sh ansible-smoke
+```
+
+## notes
+
+Debian trixie×4 unchanged. Spam mailbox secrets / durable monitord still separate Freigabe items.
diff --git a/README.md b/README.md
index 47aab15..031eff9 100644
--- a/README.md
+++ b/README.md
@@ -25,9 +25,15 @@ ports, daylogs). Start there before hunting under `configs/` / `2026/`.
 
 Hosted on **Forgejo rootless** (this host). See `2026/2026-07-10--admin-log-origin-forgejo.md`.
 
+## FIND / setup entry
+
+Plain file **`koopa-setup`** — lab + host pointers (mytops-local, regio-ng,
+ports, daylogs). Start there before hunting under `configs/` / `2026/`.
+
 ## Layout
 
 ```
+koopa-setup                # FIND: lab/host setup pointers
 host/                      # openSUSE host-level config + overview
   overview/services.md     # graphical service map
   systemd/ firewalld/ caddy/ network/
diff --git a/configs/ports.md b/configs/ports.md
index 52ca815..ff863de 100644
--- a/configs/ports.md
+++ b/configs/ports.md
@@ -30,6 +30,9 @@ Git SSH needs separate NAT/firewall **9200/tcp** if exposed to WAN.
 | **1789** | podman **`koopa-nym`** mixnet (nym.com nym-node) |
 | **1790** | podman **`koopa-nym`** verloc |
 | **9080** | podman **`koopa-nym`** HTTP API (mapped from container 8080; Tor keeps **8080**) |
+| **9180** | lab **`goa-regio-ng`** HTTP (loopback only; see `configs/lab-local/`) |
+| **9322** | lab **`goa-regio-ng`** SSH/ansible (loopback only) |
+| **8288** | lab **`mytops-local`** HTTP (loopback only) |
 | **19000** | optional nym entry WS (gateway mode) |
 | **51822/udp** | optional nym WireGuard (dVPN path) |
 | **9180** | lab **`goa-regio-ng`** HTTP (loopback only; see `configs/lab-local/`) |