From fb8bddb421cb95b0b15fd8354b9e8525a424ba7f Mon Sep 17 00:00:00 2001
From: Jake Magar <jmagar@users.noreply.github.com>
Date: Wed, 5 Aug 2026 00:25:50 -0400
Subject: [PATCH 1/3] chore: scrub internal network identifiers

Replaces homelab-internal network identifiers in tracked text files with
neutral placeholders. aurora.tootie.tv (the public registry URL) and its
reverse-DNS Android package/path form (tv.tootie.aurora / tv/tootie/aurora)
are left untouched since they must keep resolving/compiling.

Replacement mapping:

LAN IPs:
  10.1.0.6            -> 192.0.2.6

Tailscale IPs (100.64.0.0/10):
  100.88.16.79         -> 198.51.100.1
  100.120.242.29       -> 198.51.100.2

Tailnet domain:
  <host>.manatee-triceratops.ts.net -> <mapped-host>.example.ts.net
  bare "manatee-triceratops"        -> "example-tailnet"

Other *.tootie.tv subdomains (aurora.tootie.tv excluded):
  lab.tootie.tv        -> lab.example.internal
  bare "tootie.tv" zone -> "example.internal"

Device/host names (word-boundary, case-insensitive):
  dookie    -> devhost
  tootie    -> nashost
  squirts   -> edgehost
  shart     -> backuphost
  steamy(y) -> winhost
  vivobook  -> laptophost
  steamdeck -> deckhost
  willynet  -> homelan
  mothership -> gatewayhost

Sanity check: tsc --noEmit against the repo's existing node_modules passes
identically before and after this change (two pre-existing, unrelated
"Cannot find module" errors in apps/device-catalog/vite.config.ts reproduce
on the base commit via git stash, so they are not caused by this change).
---
 .github/actionlint.yaml                       |  2 +-
 .github/workflows/synthetics.yml              |  2 +-
 .storybook/main.ts                            |  6 ++---
 CLAUDE.md                                     |  4 +--
 app/gallery/demos/empty-demo.tsx              |  2 +-
 app/gallery/demos/textarea-demo.tsx           |  4 +--
 app/gallery/demos/tool-calls-demo.tsx         | 16 ++++++------
 docs/deployment.md                            | 14 +++++-----
 docs/mockups/theme-previews.html              |  6 ++---
 ...026-05-23-android-polish-test-implement.md | 26 +++++++++----------
 .../2026-05-30-aurora-neon-zed-theme.md       | 18 ++++++-------
 ...td-dashboard-theme-merge-dependency-fix.md | 16 ++++++------
 docs/sessions/2026-06-23-cd-parity-sweep.md   |  2 +-
 .../2026-07-02-cd-aurora-html-port-phase3.md  | 18 ++++++-------
 ...rehensive-review-remediation-deployment.md |  6 ++---
 ...-17-live-demos-scroll-docker-synthetics.md |  6 ++---
 next.config.ts                                |  6 ++---
 ops/compose/production.env.example            |  6 ++---
 ops/synthetics-cloudflare.md                  | 14 +++++-----
 19 files changed, 87 insertions(+), 87 deletions(-)

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
index 1b712d85..dbc8a726 100644
--- a/.github/actionlint.yaml
+++ b/.github/actionlint.yaml
@@ -1,4 +1,4 @@
-# Custom labels for the org's self-hosted runner farm (tootie-ci-runner-1..4),
+# Custom labels for the org's self-hosted runner farm (nashost-ci-runner-1..4),
 # so actionlint (run by the Workflow and dependency policy check) accepts
 # runs-on entries like [self-hosted, unraid].
 self-hosted-runner:
diff --git a/.github/workflows/synthetics.yml b/.github/workflows/synthetics.yml
index 9902633b..79dd91cf 100644
--- a/.github/workflows/synthetics.yml
+++ b/.github/workflows/synthetics.yml
@@ -13,7 +13,7 @@ concurrency:
 
 jobs:
   public-path:
-    # Self-hosted (tootie runner farm): residential egress is not challenged by
+    # Self-hosted (nashost runner farm): residential egress is not challenged by
     # Cloudflare, unlike GitHub-hosted Azure IPs (see ops/synthetics-cloudflare.md).
     runs-on: [self-hosted, unraid]
     permissions:
diff --git a/.storybook/main.ts b/.storybook/main.ts
index b97b4c3c..2dc7df34 100644
--- a/.storybook/main.ts
+++ b/.storybook/main.ts
@@ -12,9 +12,9 @@ const config: StorybookConfig = {
     allowedHosts: [
       "localhost",
       "127.0.0.1",
-      "dookie",
-      "dookie.manatee-triceratops.ts.net",
-      "100.88.16.79",
+      "devhost",
+      "devhost.example.ts.net",
+      "198.51.100.1",
     ],
   },
 }
diff --git a/CLAUDE.md b/CLAUDE.md
index 228505da..bde200b8 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -120,8 +120,8 @@ and shadcn CLI (registry JSON from `public/r/*.json`).
   `docs/component-kotlin-map.md` (Kotlin/Compose parity matrix).
 - **SWAG upstream contract:** `aurora.dinglebear.ai` (canonical; `aurora.tootie.tv`
   also matches via the wildcard `server_name aurora.*`), `dinglebear.ai`, and
-  `www.dinglebear.ai` are reverse-proxied by SWAG on `squirts` to the immutable
-  `aurora` production container on **dookie**, host port `50000→3000`. The
+  `www.dinglebear.ai` are reverse-proxied by SWAG on `edgehost` to the immutable
+  `aurora` production container on **devhost**, host port `50000→3000`. The
   canonical digest-only Compose overlay and SWAG templates are tracked under
   `ops/`; `docs/deployment.md` is the runbook. The `aurora-dev` source bind mount
   is isolated on port 3000 and must never receive public traffic. Scheme HTTP,
diff --git a/app/gallery/demos/empty-demo.tsx b/app/gallery/demos/empty-demo.tsx
index 80528c58..ebf4954a 100644
--- a/app/gallery/demos/empty-demo.tsx
+++ b/app/gallery/demos/empty-demo.tsx
@@ -114,7 +114,7 @@ export default function EmptyStateDemo() {
               as="h2"
               icon={<CloudOff size={24} aria-hidden />}
               title="Couldn’t reach the gateway"
-              description="The request to lab.tootie.tv timed out. Check the connection and try again."
+              description="The request to lab.example.internal timed out. Check the connection and try again."
               action={
                 <Button variant="warn" iconLeft={<RefreshCw size={14} aria-hidden />}>
                   Retry
diff --git a/app/gallery/demos/textarea-demo.tsx b/app/gallery/demos/textarea-demo.tsx
index 4a76c9b2..b080a2f4 100644
--- a/app/gallery/demos/textarea-demo.tsx
+++ b/app/gallery/demos/textarea-demo.tsx
@@ -69,7 +69,7 @@ export default function TextareaDemo() {
 
   // Character-count field, controlled so the counter tracks live edits.
   const [summary, setSummary] = React.useState(
-    "Restart the qdrant container on dookie and re-run the health check."
+    "Restart the qdrant container on devhost and re-run the health check."
   )
 
   return (
@@ -177,7 +177,7 @@ export default function TextareaDemo() {
               error
               showCount
               maxLength={72}
-              defaultValue="fix: the qdrant container on dookie kept dropping its collection after a restart because the volume mount drifted"
+              defaultValue="fix: the qdrant container on devhost kept dropping its collection after a restart because the volume mount drifted"
             />
           </Field>
         </div>
diff --git a/app/gallery/demos/tool-calls-demo.tsx b/app/gallery/demos/tool-calls-demo.tsx
index b7f88d2a..c3d89c04 100644
--- a/app/gallery/demos/tool-calls-demo.tsx
+++ b/app/gallery/demos/tool-calls-demo.tsx
@@ -110,7 +110,7 @@ const TROUBLESHOOT_SESSION: ToolCall[] = [
     id: "ops-1",
     tool: "shell.exec",
     status: "completed",
-    args: { host: "tootie", command: "docker ps --filter name=sonarr --format '{{.Status}}'" },
+    args: { host: "nashost", command: "docker ps --filter name=sonarr --format '{{.Status}}'" },
     result: "Up 3 hours (unhealthy)",
     ...span(14000, 13400),
   },
@@ -118,7 +118,7 @@ const TROUBLESHOOT_SESSION: ToolCall[] = [
     id: "ops-2",
     tool: "arcane.container.inspect",
     status: "completed",
-    args: { host: "tootie", name: "sonarr" },
+    args: { host: "nashost", name: "sonarr" },
     result: "State.Health.FailingStreak = 6 · last probe: connection refused :8989",
     ...span(13300, 12600),
   },
@@ -126,7 +126,7 @@ const TROUBLESHOOT_SESSION: ToolCall[] = [
     id: "ops-3",
     tool: "arcane.container.inspect",
     status: "completed",
-    args: { host: "tootie", name: "prowlarr" },
+    args: { host: "nashost", name: "prowlarr" },
     result: "State.Health = healthy · 4 indexers online",
     ...span(12500, 11900),
   },
@@ -134,15 +134,15 @@ const TROUBLESHOOT_SESSION: ToolCall[] = [
     id: "ops-4",
     tool: "sonarr.api.get",
     status: "error",
-    args: { endpoint: "/api/v3/health", host: "tootie", port: 8989 },
-    result: "FetchError: ECONNREFUSED 100.120.242.29:8989 — API not accepting connections",
+    args: { endpoint: "/api/v3/health", host: "nashost", port: 8989 },
+    result: "FetchError: ECONNREFUSED 198.51.100.2:8989 — API not accepting connections",
     ...span(11800, 11500),
   },
   {
     id: "ops-5",
     tool: "cortex.logs.search",
     status: "completed",
-    args: { host: "tootie", container: "sonarr", query: "level:error", since: "15m" },
+    args: { host: "nashost", container: "sonarr", query: "level:error", since: "15m" },
     result: "3 matches · 'System.Data.SQLite.SQLiteException: database is locked'",
     ...span(11400, 10200),
   },
@@ -150,7 +150,7 @@ const TROUBLESHOOT_SESSION: ToolCall[] = [
     id: "ops-6",
     tool: "arcane.container.restart",
     status: "running",
-    args: { host: "tootie", name: "sonarr", timeout_s: 30 },
+    args: { host: "nashost", name: "sonarr", timeout_s: 30 },
     ...since(2600),
   },
 ]
@@ -220,7 +220,7 @@ export default function ToolCallsDemo() {
       <section style={sectionStyle}>
         <span style={lbl}>Homelab ops · mixed tools, one failure, live recovery</span>
         <p style={captionStyle}>
-          A gateway agent diagnosing an unhealthy Sonarr container on tootie: a
+          A gateway agent diagnosing an unhealthy Sonarr container on nashost: a
           shell probe, a repeated container inspect (grouped), a failed API fetch
           rendered in rose, a log search that finds the root cause, and a restart
           still in flight.
diff --git a/docs/deployment.md b/docs/deployment.md
index fe41f612..27cb7e00 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -10,7 +10,7 @@ policy with tested build-time script hashes.
 
 | Surface | Hostnames | Runtime | Port/network |
 |---|---|---|---|
-| Aurora design system | `aurora.tootie.tv` | `aurora` digest-pinned production container on dookie | host `50000` to container `3000`; external `jakenet` |
+| Aurora design system | `aurora.tootie.tv` | `aurora` digest-pinned production container on devhost | host `50000` to container `3000`; external `jakenet` |
 | Co-hosted fleet tenant | `dinglebear.ai`, `www.dinglebear.ai` | same immutable image; host routing in `proxy.ts` | same upstream |
 | Local development | no public hostname | `aurora-dev` profile with source bind mount | host `3000`; isolated `aurora-dev` network |
 | Local production smoke | no public hostname | `aurora-prod-build` profile | host `50001`; isolated `aurora-prod-build` network |
@@ -18,7 +18,7 @@ policy with tested build-time script hashes.
 The tracked production contract is `ops/compose/production.yaml`; tracked SWAG
 templates are under `ops/swag/`. `ops/check-production-topology.sh` validates
 that both sides agree on port, network, tenant names, digest use, and isolation.
-The host port binds only to `AURORA_BIND_ADDRESS` (dookie's Tailscale address),
+The host port binds only to `AURORA_BIND_ADDRESS` (devhost's Tailscale address),
 not a wildcard interface, so routable clients cannot bypass the SWAG ingress.
 
 ## Publish and promotion
@@ -51,9 +51,9 @@ the immutable digest pin plus the Trivy gate above.
    fails. The `AURORA_ALERT_WEBHOOK_URL` steps were removed: the secret was
    never set, so every "alert" was a no-op that made three workflows look
    monitored while `publish.yml` stayed broken for a week unnoticed.
-3. On dookie, create `jakenet` if it does not exist and install Docker Compose.
+3. On devhost, create `jakenet` if it does not exist and install Docker Compose.
    Keep the deployment env file outside the checkout.
-4. On squirts, render the tracked SWAG templates, review the diff against the
+4. On edgehost, render the tracked SWAG templates, review the diff against the
    installed vhosts, run `nginx -t`, then atomically install/reload them. Do not
    copy an unreviewed generated file over live proxy configuration.
 
@@ -66,7 +66,7 @@ Create a private environment file from the tracked example:
 cp ops/compose/production.env.example ~/.config/aurora/production.env
 chmod 600 ~/.config/aurora/production.env
 # Replace AURORA_IMAGE_REF and AURORA_EXPECTED_SHA with the workflow outputs.
-# Confirm AURORA_BIND_ADDRESS is dookie's current Tailscale address and set both
+# Confirm AURORA_BIND_ADDRESS is devhost's current Tailscale address and set both
 # AURORA_PUBLIC_URL and AURORA_TENANT_URL to their production HTTPS origins.
 ```
 
@@ -86,7 +86,7 @@ on both Aurora and the co-hosted dinglebear tenant:
 ops/deploy.sh ~/.config/aurora/production.env
 ```
 
-Only after that succeeds should SWAG public traffic point to dookie port 50000.
+Only after that succeeds should SWAG public traffic point to devhost port 50000.
 The dev profile remains on port 3000 and is never attached to `jakenet`.
 
 ## Rollback
@@ -109,7 +109,7 @@ intentional delay between merging and manual promotion is not reported as an
 outage.
 
 The `ops/install-monitor.sh` systemd watchdog was removed. It was never
-installed on dookie — `aurora-monitor.timer` did not exist there — and its
+installed on devhost — `aurora-monitor.timer` did not exist there — and its
 `AURORA_ALERT_WEBHOOK_URL` was never set, so it could not have paged anyone. CI
 was running a unit test for it. Container health is covered by the Compose
 `HEALTHCHECK` and the twice-hourly synthetics above.
diff --git a/docs/mockups/theme-previews.html b/docs/mockups/theme-previews.html
index a87121d9..c7bf9492 100644
--- a/docs/mockups/theme-previews.html
+++ b/docs/mockups/theme-previews.html
@@ -31,7 +31,7 @@
     <div class="row"><span class="ln">2</span></div>
     <div class="row"><span class="ln">3</span><span style="color:#5a7a92">// dispatch one action across surfaces</span></div>
     <div class="row"><span class="ln">4</span><span style="color:#38d2ff">pub async fn</span> <span style="color:#7ee0c8">dispatch</span><span style="color:#a8c5d8">(</span><span style="color:#f0f8fd">action</span><span style="color:#a8c5d8">:</span> <span style="color:#ffd479">Action</span><span style="color:#a8c5d8">)</span> <span style="color:#38d2ff">-></span> <span style="color:#ffd479">Result</span><span style="color:#a8c5d8">&lt;</span><span style="color:#ffd479">Json</span><span style="color:#a8c5d8">&gt; {</span></div>
-    <div class="row"><span class="ln">5</span>    <span style="color:#38d2ff">let</span> <span style="color:#f0f8fd">gw</span> <span style="color:#38d2ff">=</span> <span style="color:#ffd479">Gateway</span><span style="color:#a8c5d8">::</span><span style="color:#7ee0c8">connect</span><span style="color:#a8c5d8">(</span><span style="color:#b8e6a0">"lab.tootie.tv"</span><span style="color:#a8c5d8">).</span><span style="color:#7ee0c8">await</span><span style="color:#a8c5d8">?;</span></div>
+    <div class="row"><span class="ln">5</span>    <span style="color:#38d2ff">let</span> <span style="color:#f0f8fd">gw</span> <span style="color:#38d2ff">=</span> <span style="color:#ffd479">Gateway</span><span style="color:#a8c5d8">::</span><span style="color:#7ee0c8">connect</span><span style="color:#a8c5d8">(</span><span style="color:#b8e6a0">"lab.example.internal"</span><span style="color:#a8c5d8">).</span><span style="color:#7ee0c8">await</span><span style="color:#a8c5d8">?;</span></div>
     <div class="row"><span class="ln">6</span>    <span style="color:#f0f8fd">gw</span><span style="color:#a8c5d8">.</span><span style="color:#c9a6f0">run</span><span style="color:#a8c5d8">(</span><span style="color:#f0f8fd">action</span><span style="color:#a8c5d8">,</span> <span style="color:#ffb38a">3</span><span style="color:#a8c5d8">).</span><span style="color:#7ee0c8">await</span></div>
     <div class="row"><span class="ln">7</span><span style="color:#a8c5d8">}</span></div>
   </div>
@@ -79,7 +79,7 @@
 <div class="tile" style="background:#0a1c2e">
   <div style="height:36px;background:#103154;display:flex;align-items:flex-end;padding:0 10px;gap:6px">
     <div class="tab" style="background:#0d2640;color:#f0f8fd;margin-bottom:0">
-      <span class="dot" style="background:#4dc8fa"></span>Aurora<span style="color:#7fa8c8;font-weight:400">— tootie.tv</span></div>
+      <span class="dot" style="background:#4dc8fa"></span>Aurora<span style="color:#7fa8c8;font-weight:400">— example.internal</span></div>
     <div class="tab" style="color:#b4d2e6;margin-bottom:0;font-weight:500">Labby</div>
     <div style="color:#7fa8c8;margin-bottom:6px;font-size:16px">+</div>
   </div>
@@ -96,7 +96,7 @@
 <!-- 5. CHROME light -->
 <div class="tile" style="background:#f5f9fc">
   <div style="height:36px;background:#dbe9f4;display:flex;align-items:flex-end;padding:0 10px;gap:6px">
-    <div class="tab" style="background:#ffffff;color:#0d2236;margin-bottom:0"><span class="dot" style="background:#0288d1"></span>Aurora<span style="color:#5a7a90;font-weight:400">— tootie.tv</span></div>
+    <div class="tab" style="background:#ffffff;color:#0d2236;margin-bottom:0"><span class="dot" style="background:#0288d1"></span>Aurora<span style="color:#5a7a90;font-weight:400">— example.internal</span></div>
     <div class="tab" style="color:#3d6070;margin-bottom:0;font-weight:500">Labby</div>
     <div style="color:#5a7a90;margin-bottom:6px;font-size:16px">+</div>
   </div>
diff --git a/docs/sessions/2026-05-23-android-polish-test-implement.md b/docs/sessions/2026-05-23-android-polish-test-implement.md
index 4bf6b26d..6012a20f 100644
--- a/docs/sessions/2026-05-23-android-polish-test-implement.md
+++ b/docs/sessions/2026-05-23-android-polish-test-implement.md
@@ -13,23 +13,23 @@ beads: q007 bcjw thfe vyjr mkr1 syc7 w0am ilkm xe0i 01xq nev6 6mwo (12 closed) |
 
 ## User Request
 
-After the parallel-dispatch session that landed PRs #6–#15: ask for an auth/server briefing, run a code review on the full diff, address all findings, install the APK via emulator on dookie and walk the chat flow end-to-end via claude-in-mobile / ADB, file all UI polish opportunities as beads, run lavra-research on each, and then lavra-work the resulting backlog.
+After the parallel-dispatch session that landed PRs #6–#15: ask for an auth/server briefing, run a code review on the full diff, address all findings, install the APK via emulator on devhost and walk the chat flow end-to-end via claude-in-mobile / ADB, file all UI polish opportunities as beads, run lavra-research on each, and then lavra-work the resulting backlog.
 
 ## Session Overview
 
 Long-running execution session. Three distinct phases:
 
 1. **Code review + fixes**: 6 review findings addressed (AuthRepository, ChatViewModel handshake gate, SidebarViewModel timeout, ChatScreen empty-image guard, CodexRepository demux logging, dead `session/update` regression). Build green, APK uploaded.
-2. **Live emulator test + bead capture**: Installed APK on dookie's existing emulator, drove the chat flow via ADB. Discovered `getAuthStatus` is not a real Codex protocol method — patched StartupViewModel to trust local AUTH_METHOD. Sent a real prompt round-trip ("Say hello and count from 1 to 3" → "Hello. 1, 2, 3." + tool call). Catalogued 14 polish opportunities as beads, dispatched 4 parallel lavra-research agents to attach evidence to each.
+2. **Live emulator test + bead capture**: Installed APK on devhost's existing emulator, drove the chat flow via ADB. Discovered `getAuthStatus` is not a real Codex protocol method — patched StartupViewModel to trust local AUTH_METHOD. Sent a real prompt round-trip ("Say hello and count from 1 to 3" → "Hello. 1, 2, 3." + tool call). Catalogued 14 polish opportunities as beads, dispatched 4 parallel lavra-research agents to attach evidence to each.
 3. **Multi-wave lavra-work execution**: Three waves of parallel-then-sequential agent dispatch. Wave 1 (q007, bcjw, thfe) shipped via the user committing `5bea020 Polish Android chat components`. Wave 2 (vyjr, mkr1, syc7, w0am) shipped via three commits. Wave 3 (ilkm, xe0i, 01xq, nev6, 6mwo) all touched `ChatScreen.kt` so a single sequential agent owned the file; shipped via `830e323`. All 12 polish beads closed; APK uploaded after each wave.
 
 ## Sequence of Events
 
-1. Asked about auth model + server target; identified `codex app-server --listen ws://127.0.0.1:4500` on dookie (loopback, no auth required)
+1. Asked about auth model + server target; identified `codex app-server --listen ws://127.0.0.1:4500` on devhost (loopback, no auth required)
 2. Ran code-review skill with 3 finder angles + verifier; 6 findings consolidated
 3. Applied fixes; rebased through a large remote update that had independently fixed 2 of the same issues; resolved 4 conflict files keeping both the remote refactor and the timeout-safety additions
 4. Built APK 21M, uploaded to `gdrive:Aurora/app-debug.apk`
-5. Installed APK on dookie's emulator-5554 via ADB; launched and observed LoginScreen
+5. Installed APK on devhost's emulator-5554 via ADB; launched and observed LoginScreen
 6. Identified `getAuthStatus` is not in Codex protocol — patched StartupViewModel to trust local `AUTH_METHOD`
 7. Bypassed login, observed chat screen, sent real message; round-trip worked; tool call rendered
 8. Tested ApprovalPolicyBar dropdown (worked), model selector dropdown (didn't open — bug), attach button, sidebar (opened by accident)
@@ -122,13 +122,13 @@ Long-running execution session. Three distinct phases:
 
 ## Tools and Skills Used
 
-- **Bash**: `bd`, `git`, `gh`, `rtk` wrappers, `./gradlew`, `adb`, `ssh dookie`, `rclone`, `python3` snippets — for nearly every coordination step
+- **Bash**: `bd`, `git`, `gh`, `rtk` wrappers, `./gradlew`, `adb`, `ssh devhost`, `rclone`, `python3` snippets — for nearly every coordination step
 - **Read/Write/Edit**: file inspection and direct edits when not delegated to subagents
 - **Agent (general-purpose subagents)**: dispatched 5 planning agents + 5 execution agents (prior session continuation) + 4 lavra-research agents + 3 wave-1 implementers + 3 wave-2 implementers + 1 wave-3 sequential implementer. ~15 subagent invocations total. Inter-agent WIP races observed during parallel waves — combined build is source of truth.
 - **AskUserQuestion**: server-context confirmation, wave scope selection
 - **Skill tool**: `code-review`, `gh-pr`, `screenshots`, `save-to-md`, `vibin:save-to-md`, `lavra:lavra-learn`, `lavra:lavra-work`, `lavra:lavra-work-multi`, `superpowers:dispatching-parallel-agents`
 - **MCP tools**: `mcp__plugin_lab_lab__scout` (tool discovery), `mcp__plugin_lab_lab__invoke` (axon scrape of OpenAI Codex app-server docs)
-- **ADB over SSH to dookie**: `adb install -r`, `adb shell input tap/text/keyevent`, `adb shell screencap -p`, `adb shell uiautomator dump`, `adb shell run-as` for DataStore prefs inspection, `adb logcat` for diagnostics
+- **ADB over SSH to devhost**: `adb install -r`, `adb shell input tap/text/keyevent`, `adb shell screencap -p`, `adb shell uiautomator dump`, `adb shell run-as` for DataStore prefs inspection, `adb logcat` for diagnostics
 - **rclone**: `rclone copy` to gdrive:Aurora (5+ APK uploads, ~21M each)
 - **Issues**: (a) `device` MCP tool name collision between `lab` and `claude-in-mobile` gateways — couldn't route to claude-in-mobile, fell back to direct ADB which worked fine. (b) Raw websocket-client Python rejected with 403 due to Origin header; switched to socket-level handshake without Origin. (c) `bd auto-export` git-add failures (harmless warnings, didn't block push).
 
@@ -140,14 +140,14 @@ git diff --stat origin/main...HEAD              # establish review scope
 ./gradlew :app:assembleDebug                    # BUILD SUCCESSFUL after each wave
 
 # Server inspection
-ssh dookie "ss -tlnp | grep ':4500'"            # codex app-server on 127.0.0.1:4500
-ssh dookie "ps -p 389362 -o cmd"                # codex app-server --listen ws://127.0.0.1:4500
+ssh devhost "ss -tlnp | grep ':4500'"            # codex app-server on 127.0.0.1:4500
+ssh devhost "ps -p 389362 -o cmd"                # codex app-server --listen ws://127.0.0.1:4500
 
 # Live testing
-ssh dookie "adb devices"                        # emulator-5554 ready
-scp APK dookie:/tmp/ && ssh dookie "adb install -r /tmp/aurora-app-debug.apk"
-ssh dookie "adb shell am start -n tv.tootie.aurora.app/.MainActivity"
-ssh dookie "adb shell input tap X Y; adb shell screencap -p > /tmp/aurora-screen.png"
+ssh devhost "adb devices"                        # emulator-5554 ready
+scp APK devhost:/tmp/ && ssh devhost "adb install -r /tmp/aurora-app-debug.apk"
+ssh devhost "adb shell am start -n tv.tootie.aurora.app/.MainActivity"
+ssh devhost "adb shell input tap X Y; adb shell screencap -p > /tmp/aurora-screen.png"
 
 # Bead workflow
 bd create --title=... --description=... --type=... --priority=...     # 14 polish beads
@@ -236,7 +236,7 @@ rclone copy app-debug.apk gdrive:Aurora                               # final AP
 **Recommended immediate next commands:**
 ```bash
 # Install the final APK on the emulator for visual verification
-ssh dookie "adb install -r /tmp/aurora-app-debug.apk && adb shell am start -n tv.tootie.aurora.app/.MainActivity"
+ssh devhost "adb install -r /tmp/aurora-app-debug.apk && adb shell am start -n tv.tootie.aurora.app/.MainActivity"
 # View remaining open beads to plan next session
 bd ready --json | jq '.[].title' | head -10
 ```
diff --git a/docs/sessions/2026-05-30-aurora-neon-zed-theme.md b/docs/sessions/2026-05-30-aurora-neon-zed-theme.md
index d0738566..f7c1b8fd 100644
--- a/docs/sessions/2026-05-30-aurora-neon-zed-theme.md
+++ b/docs/sessions/2026-05-30-aurora-neon-zed-theme.md
@@ -33,7 +33,7 @@ doesn't collide with canonical Aurora.
 - Migrated the interactive shell from **zsh4humans → antidote** (static-bundle mode), preserving p10k, plugins, fzf keybindings, completions; removed dead per-startup env lines. (home dir; dotfiles repo commit `55931a4`.)
 - Expanded **chezmoi** tracking: added `statusline-aurora.sh`, encrypted `settings.json`/`settings.local.json`, codex `.credentials.json`, and gemini `settings.json`/`mcp.json`/`gemini-credentials.json`/`google_accounts.json`; removed stale gmail/proton auth; hardened perms to 0600.
 - Built the **Aurora Zed theme** (dark+light, schema v0.2.0), iterated brightness twice to a neon palette, then added a **full file-type icon theme** (60 generated glyph-tile SVGs, 98 suffix + 22 stem mappings).
-- Placed the work in this repo under `editors/zed/` + served copy `public/zed/`; deployed to dookie and steamy.
+- Placed the work in this repo under `editors/zed/` + served copy `public/zed/`; deployed to devhost and winhost.
 - Audited palette drift across all 11 Aurora theme artifacts: only Zed diverged. Per user decision (Zed-only neon), renamed Zed to **Aurora Neon** and pushed (`dfae0cf`).
 
 ## 3. Sequence of Events
@@ -41,9 +41,9 @@ doesn't collide with canonical Aurora.
 1. mise review → identified lockfile/orphan/brew-dup issues; user fixed; advised on `idiomatic_version_file` and settings.
 2. zsh4humans → antidote migration: baseline benchmark, install antidote, rewrite `.zshrc`/`.zshenv`, re-implement compinit + fzf keys, verify under pty.
 3. chezmoi audit across `~/.claude`, `~/.codex`, `~/.gemini`; encrypt+track secrets, remove auth files, harden perms; commit+push dotfiles repo.
-4. Zed theme created (`editors/zed/themes/aurora.json`), schema-validated, deployed to `~/.config/zed` + steamy.
+4. Zed theme created (`editors/zed/themes/aurora.json`), schema-validated, deployed to `~/.config/zed` + winhost.
 5. Two brightening passes (shimmer → neon); canvas lifted `#07131c`→`#102a3e`, syntax pushed to electric cyan/violet/mint/gold/rose.
-6. Full icon theme generated via `generate-icons.py`; schema-validated; extension deployed to steamy.
+6. Full icon theme generated via `generate-icons.py`; schema-validated; extension deployed to winhost.
 7. Committed editor-themes collection (`0e34218`), pushed `feat/zed-aurora-theme`.
 8. Palette-drift audit → only Zed neon; everything else canonical.
 9. Renamed Zed → "Aurora Neon"; cleared a stale `index.lock` left by a concurrent agent; committed `dfae0cf`; verified across origin + all deploy targets.
@@ -75,7 +75,7 @@ doesn't collide with canonical Aurora.
 | created | `public/zed/aurora.json` | — | Served copy of UI theme | byte-match w/ source |
 | created | `editors/warp/*`, `editors/claude-code/*`, `public/warp/*` | — | Sibling editor themes (committed in `0e34218` scope) | `git show 0e34218 --stat` |
 
-Cross-repo / cross-host (not this repo): `~/.zshrc`, `~/.zshenv` (antidote migration); `~/.local/share/chezmoi` commit `55931a4` (zsh + tracking + encrypted secrets); `~/.config/zed/themes/aurora.json` (dookie deploy); `C:\Users\jmaga\zed-aurora-extension\*` (steamy deploy).
+Cross-repo / cross-host (not this repo): `~/.zshrc`, `~/.zshenv` (antidote migration); `~/.local/share/chezmoi` commit `55931a4` (zsh + tracking + encrypted secrets); `~/.config/zed/themes/aurora.json` (devhost deploy); `C:\Users\jmaga\zed-aurora-extension\*` (winhost deploy).
 
 ## 7. Beads Activity
 
@@ -91,7 +91,7 @@ Cross-repo / cross-host (not this repo): `~/.zshrc`, `~/.zshenv` (antidote migra
 
 ## 9. Tools and Skills Used
 
-- **Shell (Bash)**: git, rsync, ssh (steamy-wsl), `chezmoi`, `mise`, `hyperfine`, `uvx check-jsonschema`, `jq`, `python3`. Purpose: migration, validation, deployment, benchmarking.
+- **Shell (Bash)**: git, rsync, ssh (winhost-wsl), `chezmoi`, `mise`, `hyperfine`, `uvx check-jsonschema`, `jq`, `python3`. Purpose: migration, validation, deployment, benchmarking.
 - **File tools**: Read/Write/Edit for `.zshrc`/`.zshenv`, theme JSON, generator, README, extension.toml.
 - **External CLI**: `axon` (RAG `search`+`ask`) to answer "how to create Zed themes" with cited sources.
 - **AskUserQuestion**: framework choice (antidote), icon style (glyph tiles), commit scope, propagation scope.
@@ -105,7 +105,7 @@ Cross-repo / cross-host (not this repo): `~/.zshrc`, `~/.zshenv` (antidote migra
 | `python3 editors/zed/generate-icons.py` | 60 svgs, 98 suffixes, 22 stems |
 | `uvx check-jsonschema --schemafile .../v0.2.0.json editors/zed/themes/aurora.json` | `ok -- validation done` |
 | `git commit … && git push origin feat/zed-aurora-theme` (`0e34218`, `dfae0cf`) | pushed; branch in sync with origin |
-| `rsync -rtq --delete … steamy-wsl:/mnt/c/Users/jmaga/zed-aurora-extension/` | extension synced to steamy |
+| `rsync -rtq --delete … winhost-wsl:/mnt/c/Users/jmaga/zed-aurora-extension/` | extension synced to winhost |
 
 ## 11. Errors Encountered
 
@@ -119,7 +119,7 @@ Cross-repo / cross-host (not this repo): `~/.zshrc`, `~/.zshenv` (antidote migra
 |---|---|---|
 | Zed themes | none in repo | Aurora Neon / Aurora Neon Light + Aurora Neon Icons available via extension |
 | Zed theme palette | n/a | neon (canvas `#102a3e`, cyan `#38d2ff`) — divergent from canonical Aurora, intentionally |
-| Theme distribution | n/a | served at `aurora.tootie.tv/zed/aurora.json`; extension deployed to dookie + steamy |
+| Theme distribution | n/a | served at `aurora.tootie.tv/zed/aurora.json`; extension deployed to devhost + winhost |
 
 ## 13. Verification Evidence
 
@@ -128,7 +128,7 @@ Cross-repo / cross-host (not this repo): `~/.zshrc`, `~/.zshenv` (antidote migra
 | `check-jsonschema … themes/aurora.json` | valid | `ok -- validation done` | pass |
 | `check-jsonschema … icon_themes/aurora.json` | valid | `ok -- validation done` | pass |
 | hex scan of theme JSON | no malformed hex | caught + fixed `#1b3span`, `#688persp` | pass |
-| origin + 4 deploy targets carry "Aurora Neon" | all match | origin/public/dookie/steamy all "Aurora Neon" | pass |
+| origin + 4 deploy targets carry "Aurora Neon" | all match | origin/public/devhost/winhost all "Aurora Neon" | pass |
 | icon path resolution | all 60 exist | `missing icon files: none` | pass |
 
 ## 14. Risks and Rollback
@@ -155,7 +155,7 @@ Cross-repo / cross-host (not this repo): `~/.zshrc`, `~/.zshenv` (antidote migra
 
 ## 18. Next Steps
 
-1. **Activate in Zed** (each machine): `zed: install dev extension` → the extension folder (dookie `editors/zed`, steamy `C:\Users\jmaga\zed-aurora-extension`); then `theme selector` → **Aurora Neon**, `icon theme selector` → **Aurora Neon Icons**. Remove the `~/.config/zed/themes/aurora.json` drop-in to avoid a duplicate.
+1. **Activate in Zed** (each machine): `zed: install dev extension` → the extension folder (devhost `editors/zed`, winhost `C:\Users\jmaga\zed-aurora-extension`); then `theme selector` → **Aurora Neon**, `icon theme selector` → **Aurora Neon Icons**. Remove the `~/.config/zed/themes/aurora.json` drop-in to avoid a duplicate.
 2. **Open the PR** for `feat/zed-aurora-theme` (or split out the Zed commits). Suggested follow-up bead: "Open PR: Aurora Neon Zed editor + icon theme".
 3. **Decide** on the shared-branch question (Open Questions) before merge.
 4. The `feat/prompt-input-action-left` branch remains live and independent — unaffected by this session.
diff --git a/docs/sessions/2026-05-31-motd-dashboard-theme-merge-dependency-fix.md b/docs/sessions/2026-05-31-motd-dashboard-theme-merge-dependency-fix.md
index 40bb2207..7ece13b2 100644
--- a/docs/sessions/2026-05-31-motd-dashboard-theme-merge-dependency-fix.md
+++ b/docs/sessions/2026-05-31-motd-dashboard-theme-merge-dependency-fix.md
@@ -13,14 +13,14 @@ beads: aurora-design-system-bsam
 # Homelab MOTD dashboard, Aurora theme merge, and dependency security fix
 
 ## User Request
-Started with "ssh dookie … Can we make it show useful info in the motd", then iterated:
+Started with "ssh devhost … Can we make it show useful info in the motd", then iterated:
 add Docker info, make it adhere to Aurora design tokens, suppress the Ubuntu ESM
 nag, track it all with chezmoi, then `/vibin:quick-push` + "merge back into main",
 delete the merged branch, and fix the flagged Dependabot advisory.
 
 ## Session Overview
 Three threads of work in one session:
-1. Built a homelab MOTD dashboard for `dookie` (`/etc/update-motd.d/20-homelab-dashboard`),
+1. Built a homelab MOTD dashboard for `devhost` (`/etc/update-motd.d/20-homelab-dashboard`),
    colored with exact Aurora dark tokens as 24-bit truecolor, and silenced Ubuntu's
    ESM/Pro advertising. Captured the whole system change in the chezmoi dotfiles repo
    as an idempotent `run_onchange_` script.
@@ -31,7 +31,7 @@ Three threads of work in one session:
    override block was dead. Migrated it to `pnpm-workspace.yaml`.
 
 ## Sequence of Events
-1. Probed `dookie` data sources (docker, nvidia-smi, zpool, tailscale, df, free); all readable without sudo, passwordless sudo confirmed.
+1. Probed `devhost` data sources (docker, nvidia-smi, zpool, tailscale, df, free); all readable without sudo, passwordless sudo confirmed.
 2. Wrote `/etc/update-motd.d/20-homelab-dashboard`; disabled `10-help-text`, `50-motd-news`, `91-contract-ua-esm-status` and the `motd-news.timer`.
 3. Added richer Docker info (image/volume counts, wrapped running-container list); hardened the tailscale status read (post-boot JSON-empty fallback).
 4. Invoked the `vibin:aurora-design-system` skill; read exact dark token hex from `registry/aurora/styles/aurora.css`; remapped all colors to Aurora tokens as truecolor; replaced the `⚠` emoji with a `●` glow-dot and sentence-cased `ONLINE`→`Online`.
@@ -63,8 +63,8 @@ Three threads of work in one session:
 | modified | `package.json` | removed the now-ignored `pnpm` field (−24 lines) | commit 7aa883e |
 | modified | `pnpm-lock.yaml` | `tmp` 0.2.5 → 0.2.6; overrides recorded | commit 7aa883e |
 | created | `docs/sessions/2026-05-31-motd-dashboard-theme-merge-dependency-fix.md` | this session log | this commit |
-| created | `/etc/update-motd.d/20-homelab-dashboard` (dookie, system) | Aurora-tokenized homelab dashboard | rendered via run-parts |
-| modified | `/etc/update-motd.d/{10-help-text,50-motd-news,90-updates-available,91-contract-ua-esm-status}` (dookie) | `chmod -x` to silence ad/nag scripts | `ls -la /etc/update-motd.d` |
+| created | `/etc/update-motd.d/20-homelab-dashboard` (devhost, system) | Aurora-tokenized homelab dashboard | rendered via run-parts |
+| modified | `/etc/update-motd.d/{10-help-text,50-motd-news,90-updates-available,91-contract-ua-esm-status}` (devhost) | `chmod -x` to silence ad/nag scripts | `ls -la /etc/update-motd.d` |
 | created | `~/.local/share/chezmoi/run_onchange_after_60-motd.sh` (dotfiles repo) | idempotent MOTD provisioning | commit e8e5873 |
 | created | `~/.claude/.../memory/reference_pnpm10_overrides_moved.md` (+ MEMORY.md index) | global memory: pnpm 10 overrides gotcha | Write tool |
 
@@ -105,7 +105,7 @@ Three threads of work in one session:
 ## Behavior Changes (Before/After)
 | area | before | after |
 |---|---|---|
-| dookie MOTD | Ubuntu default banner + ESM/Pro advertising | Aurora-tokenized dashboard (cpu/mem/disk/pkg/gpu/zfs/docker/net), no ESM nag |
+| devhost MOTD | Ubuntu default banner + ESM/Pro advertising | Aurora-tokenized dashboard (cpu/mem/disk/pkg/gpu/zfs/docker/net), no ESM nag |
 | aurora `main` | at `ca4bd62`, no editor themes | editor/terminal themes v0.2.0 merged; tmp vuln fixed |
 | pnpm overrides | dead in ignored `package.json` field | active in `pnpm-workspace.yaml` |
 
@@ -120,7 +120,7 @@ Three threads of work in one session:
 
 ## Risks and Rollback
 - Re-activating the override pins could in principle shift transitive versions, but observed lockfile churn was just the `tmp` bump; lint + build pass. Rollback: `git revert 7aa883e` and `pnpm install`.
-- MOTD/system changes on dookie are reproducible from chezmoi `e8e5873`; ESM service masks reversible via `systemctl unmask` and re-enabling the disabled motd scripts.
+- MOTD/system changes on devhost are reproducible from chezmoi `e8e5873`; ESM service masks reversible via `systemctl unmask` and re-enabling the disabled motd scripts.
 
 ## Decisions Not Taken
 - A `tmp`-only override in a new `pnpm-workspace.yaml` while leaving the dead block in `package.json` — rejected; would split config across two locations and leave other pins inactive.
@@ -135,4 +135,4 @@ Three threads of work in one session:
 1. Confirm Dependabot alert #49 auto-closes after GitHub re-scans `main` (bead `-bsam`).
 2. Sweep `~/workspace` pnpm-10 repos (ghbd, etc.) for a stale `pnpm.overrides` in `package.json` with no `pnpm-workspace.yaml` — same silent security-pin regression.
 3. Optional: add a one-line note to `CLAUDE.md` that overrides live in `pnpm-workspace.yaml`.
-4. Optional: roll the MOTD dashboard out to tootie/squirts/shart (the chezmoi `run_onchange` script is host-portable; GPU/ZFS blocks self-skip).
+4. Optional: roll the MOTD dashboard out to nashost/edgehost/backuphost (the chezmoi `run_onchange` script is host-portable; GPU/ZFS blocks self-skip).
diff --git a/docs/sessions/2026-06-23-cd-parity-sweep.md b/docs/sessions/2026-06-23-cd-parity-sweep.md
index c018746f..afafb924 100644
--- a/docs/sessions/2026-06-23-cd-parity-sweep.md
+++ b/docs/sessions/2026-06-23-cd-parity-sweep.md
@@ -73,7 +73,7 @@ Started with housekeeping (merged `fix/registry-namespaced-deps` to main; cleane
 - **Shell/file tools**: extensive (git, pnpm, tsc, eslint, python helpers).
 - **Workflow (multi-agent)**: 6 throttled runs (chunks of 6) for reskin/create waves; one early run hit a transient 529/rate-limit at 16-concurrency, fixed by chunking.
 - **claude_design MCP**: `list_projects/list_files/read_file/render_preview` to pull CD sources + project-scoped serve token (reusable across paths).
-- **webwright skill + Playwright (firefox)**: CD reference screenshots + live gallery spot-checks; firefox driver was flaky under load (known dookie gotcha) → ran at low concurrency, some refs captured from source instead.
+- **webwright skill + Playwright (firefox)**: CD reference screenshots + live gallery spot-checks; firefox driver was flaky under load (known devhost gotcha) → ran at low concurrency, some refs captured from source instead.
 - **save-to-md / quick-push skills**: this doc + version bump + push.
 
 ## Commands Executed
diff --git a/docs/sessions/2026-07-02-cd-aurora-html-port-phase3.md b/docs/sessions/2026-07-02-cd-aurora-html-port-phase3.md
index f3f8d8d8..b0cf5087 100644
--- a/docs/sessions/2026-07-02-cd-aurora-html-port-phase3.md
+++ b/docs/sessions/2026-07-02-cd-aurora-html-port-phase3.md
@@ -24,12 +24,12 @@ Ported the remaining Claude Design (CD) `Aurora.html` page experience into the N
 2. Audited the existing app: phases 1–2 of the port already existed (commits `159a682`, `d99b22c`); built a delta list (⌘K palette, Icons/Docs views, header parity).
 3. Phase 3 (`d86e79a`): generalized the registry `command-palette` block (sections/placeholder/filter props), extracted `lib/fuzzy.ts`, built `SiteCommandPalette`, `/icons` (`IconsView` — Lucide grid + `OperationIcon` grid), `/docs` (6 CD pages on real routes with sticky sub-nav), header Search button + nav entries, hero eyebrow + footer copy parity.
 4. Hit a pre-existing `main` build break (commit `71be925` pointed `attachments.tsx` at the consumer install path). Fixed with a repo-local shim `components/aurora/attachment.ts` (`e28e960`).
-5. Verified visually: chrome-devtools MCP needs X (unavailable); the agent-browser Chrome on :9222 is network-isolated from sandbox-local ports and its screenshot API stalls on background tabs; Playwright/Firefox crashed. Working recipe: :9222 Chrome + the Tailscale IP (`100.88.16.79:3777`) + `AURORA_DEV_ORIGIN` for Next dev assets + `Page.bringToFront` before `Page.captureScreenshot`.
+5. Verified visually: chrome-devtools MCP needs X (unavailable); the agent-browser Chrome on :9222 is network-isolated from sandbox-local ports and its screenshot API stalls on background tabs; Playwright/Firefox crashed. Working recipe: :9222 Chrome + the Tailscale IP (`198.51.100.1:3777`) + `AURORA_DEV_ORIGIN` for Next dev assets + `Page.bringToFront` before `Page.captureScreenshot`.
 6. User showed the CD Components view (manifest-driven live tiles) vs our gallery-sidebar link. Built the live catalog (`8e726c5`): extracted `app/gallery/demo-map.tsx` (shared slug→demo map), rebuilt `ComponentCatalog` with lazy scaled live previews + `LiveDrawer`, added `/components`, rewired nav/⌘K/pillar.
 7. Added drawer prev/next arrows + ←/→ keys + n/total counter (`b8ae564`).
 8. Replaced the header Components dropdown with an on-page shadcn·React / Android·Compose segmented toggle (`5e9a61e`); Android flavor driven by `lib/kotlin-map.ts` parsing `docs/component-kotlin-map.md` (120 counterparts; 125 catalog items ported).
 9. Implemented suggestions 1–4 (`6303d5d`): light-mode pass over all new surfaces (found + fixed a swallowed space after a `<Strong>` in docs copy), ⌘K → `/components?c=slug` drawer deep-links, URL state via `history.replaceState` + `useSearchParams` watcher (Suspense-wrapped), mobile hamburger nav.
-10. Fixed 4 errors reported from the live site (`8438afe`): catalog tile `<button>` wrapped demos containing buttons — invalid nesting caused 3 of the 4 errors (2 console + 1 hydration); converted tiles to `div[role=button]`. The 4th (`eval()` blocked) is dev-mode React only — identified that `aurora.tootie.tv` is served by the `dev` compose target on dookie.
+10. Fixed 4 errors reported from the live site (`8438afe`): catalog tile `<button>` wrapped demos containing buttons — invalid nesting caused 3 of the 4 errors (2 console + 1 hydration); converted tiles to `div[role=button]`. The 4th (`eval()` blocked) is dev-mode React only — identified that `aurora.tootie.tv` is served by the `dev` compose target on devhost.
 11. Maintenance pass for this note: corrected the stale SWAG upstream claim in `CLAUDE.md` (`c8f9e79`).
 
 ## Key findings
@@ -38,8 +38,8 @@ Ported the remaining Claude Design (CD) `Aurora.html` page experience into the N
 - dsCards must NOT be copied into the app: they render a parallel component implementation (split-brain with the registry). Their curated hero compositions are portable, though — recorded in `bd remember` key `catalog-preview-upgrade-option-declined-2026-07-02` (user declined the port).
 - `origin/main` was un-buildable at session start: `registry/aurora/blocks/ai/elements/attachments.tsx:3` imported `@/components/aurora/attachment` (the consumer install target of `aurora-attachment` per `registry.json`), which didn't exist in-repo.
 - Interactive content cannot nest inside `<button>`: the catalog tile button wrapping live demos re-parents markup during HTML parsing and fails hydration (errors seen on the live site's dev overlay).
-- `aurora.tootie.tv` is served by the `aurora-design-system` **dev** container on **dookie** (compose `dev` target, `50000→3000`, bind-mounts the primary checkout) — merges go live with no deploy step; the `eval()` console error and dev overlay exist only because of dev mode. An unused `aurora-prod` standalone service exists in `docker-compose.yaml`.
-- Environment: browsers on dookie cannot reach sandbox-local ports; the reliable headless capture path is the :9222 Chrome + Tailscale IP + `Page.bringToFront` (new-headless background tabs never paint, so `captureScreenshot` hangs forever without it).
+- `aurora.tootie.tv` is served by the `aurora-design-system` **dev** container on **devhost** (compose `dev` target, `50000→3000`, bind-mounts the primary checkout) — merges go live with no deploy step; the `eval()` console error and dev overlay exist only because of dev mode. An unused `aurora-prod` standalone service exists in `docker-compose.yaml`.
+- Environment: browsers on devhost cannot reach sandbox-local ports; the reliable headless capture path is the :9222 Chrome + Tailscale IP + `Page.bringToFront` (new-headless background tabs never paint, so `captureScreenshot` hangs forever without it).
 
 ## Technical decisions
 
@@ -68,7 +68,7 @@ Ported the remaining Claude Design (CD) `Aurora.html` page experience into the N
 | created | `app/(marketing)/components/page.tsx` | /components route (kotlinMap + syncUrl) | `8e726c5`, `5e9a61e`, `6303d5d` |
 | created | `lib/kotlin-map.ts` | parses component-kotlin-map.md table | `5e9a61e` |
 | modified | `tests/gallery-slug-consistency.test.ts` | reads demo keys from demo-map.tsx | `8e726c5` |
-| modified | `CLAUDE.md` | corrected SWAG upstream (dookie, not tootie) | `c8f9e79` |
+| modified | `CLAUDE.md` | corrected SWAG upstream (devhost, not nashost) | `c8f9e79` |
 | created | `docs/sessions/2026-07-02-cd-aurora-html-port-phase3.md` | this session note | this commit |
 
 ## Beads activity
@@ -87,8 +87,8 @@ Ported the remaining Claude Design (CD) `Aurora.html` page experience into the N
 - **Plans:** `docs/plans/` does not exist in this repo — no-op (evidence: `ls docs/plans` → no such directory).
 - **Beads:** all three session beads closed with work verified (see above); no orphaned session work. Follow-ups are covered by existing epics or `bd remember`.
 - **Worktrees/branches:** two worktrees registered — primary (`main`) and this one (`claude/upbeat-hypatia-14f9fe`); both at the same commit, branch fully merged into `main` via fast-forward pushes. Branch and worktree left in place because the worktree is the active session workspace; safe to remove later with `git worktree remove` + branch delete.
-- **Stale docs:** `CLAUDE.md` SWAG upstream corrected (`tootie:50000` → dookie container, dev/prod services documented) — evidence: `docker ps` on dookie shows `aurora-design-system … 0.0.0.0:50000->3000`, and the user confirmed. No other doc contradictions observed.
-- **Transparency:** the live SWAG conf on squirts (`aurora.subdomain.conf`) was not inspected; if its upstream host literally says `tootie`, it still resolves to the dookie container per observed behavior — flagged in Open Questions.
+- **Stale docs:** `CLAUDE.md` SWAG upstream corrected (`nashost:50000` → devhost container, dev/prod services documented) — evidence: `docker ps` on devhost shows `aurora-design-system … 0.0.0.0:50000->3000`, and the user confirmed. No other doc contradictions observed.
+- **Transparency:** the live SWAG conf on edgehost (`aurora.subdomain.conf`) was not inspected; if its upstream host literally says `nashost`, it still resolves to the devhost container per observed behavior — flagged in Open Questions.
 
 ## Tools and skills used
 
@@ -107,7 +107,7 @@ Ported the remaining Claude Design (CD) `Aurora.html` page experience into the N
 | `pnpm install` (worktree) | node_modules populated (35s; worktree was cold) |
 | `pnpm registry:build` | regenerated `public/r/*.json` |
 | `pnpm lint` / `pnpm build` / `pnpm test:unit` / `pnpm audit:composition` | all green at every commit point (65/65 tests) |
-| `AURORA_DEV_ORIGIN=100.88.16.79 pnpm dev --port 3777` | dev server for visual verification |
+| `AURORA_DEV_ORIGIN=198.51.100.1 pnpm dev --port 3777` | dev server for visual verification |
 | `pnpm start --port 3778` | production server for console-clean verification |
 | `git push origin claude/upbeat-hypatia-14f9fe:main` | fast-forward merges to main (×5) |
 | `bd create/claim/close`, `bd dolt push` | bead lifecycle |
@@ -158,7 +158,7 @@ Ported the remaining Claude Design (CD) `Aurora.html` page experience into the N
 
 ## Open questions
 
-- The SWAG conf on squirts (`aurora.subdomain.conf`) was not read; `CLAUDE.md` now documents the dookie container as the upstream based on `docker ps` + user confirmation — worth confirming the conf's literal upstream host next time someone touches it.
+- The SWAG conf on edgehost (`aurora.subdomain.conf`) was not read; `CLAUDE.md` now documents the devhost container as the upstream based on `docker ps` + user confirmation — worth confirming the conf's literal upstream host next time someone touches it.
 - Sparse tile previews (e.g. Direction) remain until/unless the dsCard composition port is revived.
 
 ## Next steps
diff --git a/docs/sessions/2026-07-16-comprehensive-review-remediation-deployment.md b/docs/sessions/2026-07-16-comprehensive-review-remediation-deployment.md
index 83b56458..95df91cf 100644
--- a/docs/sessions/2026-07-16-comprehensive-review-remediation-deployment.md
+++ b/docs/sessions/2026-07-16-comprehensive-review-remediation-deployment.md
@@ -37,7 +37,7 @@ The entire 1,035-file Aurora project was reviewed through all five phases. The r
 - Public traffic previously depended on a writable root development container; production now uses a non-root, read-only, digest-pinned runner with explicit topology and rollback.
 - CI promotion previously raced tested source identity; publication now builds the tested SHA, scans the exact digest, emits an SPDX SBOM, signs with Cosign, verifies identity, and only then promotes.
 - Combobox, RadioGroup, and Popover needed explicit keyboard/focus contracts; the final Popover implementation uses deterministic layout-phase focus with a tested completion marker.
-- Scheduled public synthetics currently receive HTTP 403 from GitHub-hosted runners even though `ops/synthetic-check.sh` passes from dookie; this remains open as `aurora-otgu`.
+- Scheduled public synthetics currently receive HTTP 403 from GitHub-hosted runners even though `ops/synthetic-check.sh` passes from devhost; this remains open as `aurora-otgu`.
 
 ## Technical Decisions
 
@@ -672,7 +672,7 @@ The review itself updated deployment, security, registry, Android, and operation
 - Popover Storybook interaction checks exposed a real focus race and then an external-test synchronization race; both contracts were fixed and passed 15 repeated strict-axe runs.
 - The first legacy-container production migration received an early public 502; rollback restored service, readiness/rollback waits were added, and the retry succeeded.
 - Playwright results reappeared after cleanup; timestamps and process inspection showed another live session running Storybook from the UI integration worktree, so the regenerated outputs were preserved and the session record was corrected.
-- Scheduled GitHub-hosted public synthetics fail with HTTP 403 at the first curl. Local/public verification from dookie succeeds. This unresolved external-path discrepancy is tracked in `aurora-otgu`.
+- Scheduled GitHub-hosted public synthetics fail with HTTP 403 at the first curl. Local/public verification from devhost succeeds. This unresolved external-path discrepancy is tracked in `aurora-otgu`.
 
 ## Behavior Changes (Before/After)
 
@@ -699,7 +699,7 @@ The review itself updated deployment, security, registry, Android, and operation
 | GitHub CI | Four protected checks | Run 29499187382 succeeded | pass |
 | Image publication | Exact tested SHA scanned and signed | Run 29499457639 attempt 2 succeeded | pass |
 | Live container | Final digest, healthy, read-only, non-root | `226f625...`, healthy, `READONLY=true`, user `1000:1000` | pass |
-| Public endpoint from dookie | HTTP 200, revision, schema, TLS | Passed; revision `178e13d...` | pass |
+| Public endpoint from devhost | HTTP 200, revision, schema, TLS | Passed; revision `178e13d...` | pass |
 | Scheduled GitHub public synthetic | Same public checks | HTTP 403 at first curl | fail |
 | Repository sync | Clean `main`, zero divergence | `main...origin/main`, 0 ahead / 0 behind | pass |
 
diff --git a/docs/sessions/2026-07-17-live-demos-scroll-docker-synthetics.md b/docs/sessions/2026-07-17-live-demos-scroll-docker-synthetics.md
index 45fc4254..c32cd75f 100644
--- a/docs/sessions/2026-07-17-live-demos-scroll-docker-synthetics.md
+++ b/docs/sessions/2026-07-17-live-demos-scroll-docker-synthetics.md
@@ -154,7 +154,7 @@ aurora-g15h and aurora-rmb4 (P3 openwiki transitive-dep hardening).
   `pr57` (tracked closed PR #57, superseded by #69) — `git branch -D pr57`.
   Left auto-PR branches `#73` (release-please 0.4.3) and `#74` (openwiki update)
   untouched — bot-owned, not this session's to merge.
-- **Stale docs**: updated the `aurora-tootie-serves-dev-build` memory to reflect
+- **Stale docs**: updated the `aurora-nashost-serves-dev-build` memory to reflect
   the post-#46 topology (prod on 50000, dev container profile-gated). Added
   `ops/synthetics-cloudflare.md` runbook.
 - **Skipped/blocked**: could not create the Cloudflare Skip rule — the SWAG
@@ -163,7 +163,7 @@ aurora-g15h and aurora-rmb4 (P3 openwiki transitive-dep hardening).
 ## Tools and Skills Used
 
 - **Shell (Bash)**: git, gh (PR merge/checks/watch), docker build/inspect/run,
-  cosign verify, curl diagnostics, bd, ssh to squirts. Primary workhorse.
+  cosign verify, curl diagnostics, bd, ssh to edgehost. Primary workhorse.
 - **File tools (Read/Edit/Write)**: all code and doc edits.
 - **claude-in-chrome (CDP over Playwright to axon-chrome)**: verified previews,
   portal placement, and scroll behavior on real builds. Hit the known
@@ -247,7 +247,7 @@ aurora-g15h and aurora-rmb4 (P3 openwiki transitive-dep hardening).
 ## Next Steps
 
 - **Operator (unblocks synthetics)**: `gh secret set AURORA_SYNTHETIC_TOKEN` and
-  add the Cloudflare Skip custom rule on the tootie.tv zone per
+  add the Cloudflare Skip custom rule on the example.internal zone per
   `ops/synthetics-cloudflare.md`; then re-run `synthetics.yml` to confirm green
   and close aurora-otgu.
 - **Bot PRs**: review/merge #73 (release 0.4.3) and #74 (OpenWiki update) as
diff --git a/next.config.ts b/next.config.ts
index 20efe660..f0af807d 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -1,10 +1,10 @@
 import type { NextConfig } from "next";
 
 // AURORA_DEV_ORIGIN: LAN or tailnet host that the dev server accepts CORS
-// requests from. Defaults to the tootie LAN address (10.1.0.6) used in the
+// requests from. Defaults to the nashost LAN address (192.0.2.6) used in the
 // homelab reverse-proxy setup; set to a tailnet hostname (e.g.
-// tootie.manatee-triceratops.ts.net) when Tailscale is preferred.
-const DEV_ORIGIN = process.env.AURORA_DEV_ORIGIN ?? "10.1.0.6";
+// nashost.example.ts.net) when Tailscale is preferred.
+const DEV_ORIGIN = process.env.AURORA_DEV_ORIGIN ?? "192.0.2.6";
 
 const nextConfig: NextConfig = {
   poweredByHeader: false,
diff --git a/ops/compose/production.env.example b/ops/compose/production.env.example
index bd91b8f6..64b6bb0d 100644
--- a/ops/compose/production.env.example
+++ b/ops/compose/production.env.example
@@ -2,11 +2,11 @@
 # the successful Publish image workflow. Never deploy latest or a mutable tag.
 AURORA_IMAGE_REF=ghcr.io/dinglebear-ai/aurora@sha256:0000000000000000000000000000000000000000000000000000000000000000
 AURORA_EXPECTED_SHA=0000000000000000000000000000000000000000
-AURORA_BIND_ADDRESS=100.88.16.79
+AURORA_BIND_ADDRESS=198.51.100.1
 AURORA_PUBLIC_PORT=50000
 AURORA_DOCKER_NETWORK=jakenet
 AURORA_PUBLIC_URL=https://aurora.tootie.tv
 AURORA_TENANT_URL=https://dinglebear.ai
 
-# Used only when rendering the tracked SWAG templates on squirts.
-AURORA_UPSTREAM_HOST=dookie.manatee-triceratops.ts.net
+# Used only when rendering the tracked SWAG templates on edgehost.
+AURORA_UPSTREAM_HOST=devhost.example.ts.net
diff --git a/ops/synthetics-cloudflare.md b/ops/synthetics-cloudflare.md
index 5cfbd549..1aa3cceb 100644
--- a/ops/synthetics-cloudflare.md
+++ b/ops/synthetics-cloudflare.md
@@ -3,12 +3,12 @@
 ## Symptom
 
 `Public synthetics` fails at the first request with HTTP 403 — but only from
-GitHub Actions. The same `ops/synthetic-check.sh` returns 200 from dookie and
+GitHub Actions. The same `ops/synthetic-check.sh` returns 200 from devhost and
 from a browser.
 
 ## Root cause (proven, not guessed)
 
-`aurora.tootie.tv` is proxied through **Cloudflare** (the `tootie.tv` zone;
+`aurora.tootie.tv` is proxied through **Cloudflare** (the `example.internal` zone;
 `dinglebear.ai` is *not* proxied — it answers straight from nginx/SWAG). A
 diagnostic run from a GitHub runner captured:
 
@@ -24,7 +24,7 @@ diagnostic run from a GitHub runner captured:
 
 Cloudflare challenges the request because it comes from a hosting-provider ASN
 (Azure). `curl` cannot solve a JS challenge, so every HTTP check 403s.
-Residential IPs (dookie, a browser) are not challenged, which is why it passes
+Residential IPs (devhost, a browser) are not challenged, which is why it passes
 everywhere except CI.
 
 ## Fix — narrow, header-matched Skip rule
@@ -57,7 +57,7 @@ gh secret set AURORA_SYNTHETIC_TOKEN --repo dinglebear-ai/aurora --body "$TOKEN"
 echo "Cloudflare rule value: $TOKEN"   # paste into the rule below, then clear scrollback
 ```
 
-In the Cloudflare dashboard for the **tootie.tv** zone →
+In the Cloudflare dashboard for the **example.internal** zone →
 **Security → WAF → Custom rules → Create rule**:
 
 - **Field / expression:**
@@ -93,14 +93,14 @@ four HTTP checks need the header.
 ## Resolution (2026-07-29) — self-hosted runners instead of the Skip rule
 
 The workflow now runs on the org's self-hosted runner farm
-(`runs-on: [self-hosted, unraid]`, `tootie-ci-runner-1..4`). Their egress is
+(`runs-on: [self-hosted, unraid]`, `nashost-ci-runner-1..4`). Their egress is
 the residential ISP that Cloudflare already does not challenge, so no Skip
 rule is required and the workflow no longer sends the bypass header. This
-still tests the genuine public path: tootie resolves `aurora.tootie.tv` to
+still tests the genuine public path: nashost resolves `aurora.tootie.tv` to
 Cloudflare anycast IPs (`104.21.x` / `172.67.x`), not a LAN rewrite, so DNS,
 the Cloudflare edge, SWAG, TLS, and the app are all in the loop.
 
 The `AURORA_SYNTHETIC_TOKEN` repository secret exists (set 2026-07-28; value
-stashed in `~/.config/aurora/synthetic-token.txt` on dookie, mode 0600) but is
+stashed in `~/.config/aurora/synthetic-token.txt` on devhost, mode 0600) but is
 dormant. The header-matched Skip rule above remains the documented path if
 these checks ever move back to GitHub-hosted runners.

From 3bdea18f2b2ff228a26a89ea2a35f4b114b43995 Mon Sep 17 00:00:00 2001
From: Jake Magar <jmagar@users.noreply.github.com>
Date: Wed, 5 Aug 2026 00:25:50 -0400
Subject: [PATCH 2/3] chore: scrub internal network identifiers

Replace internal IP addresses, the internal tailnet domain, and host
aliases in tracked files with neutral documentation placeholders
(192.0.2.0/24, 198.51.100.0/24, example.ts.net, *.example.internal,
role-based host aliases).
---
 .github/actionlint.yaml                       |  2 +-
 .github/workflows/synthetics.yml              |  2 +-
 .storybook/main.ts                            |  6 ++---
 CLAUDE.md                                     |  4 +--
 app/gallery/demos/empty-demo.tsx              |  2 +-
 app/gallery/demos/textarea-demo.tsx           |  4 +--
 app/gallery/demos/tool-calls-demo.tsx         | 16 ++++++------
 docs/deployment.md                            | 14 +++++-----
 docs/mockups/theme-previews.html              |  6 ++---
 ...026-05-23-android-polish-test-implement.md | 26 +++++++++----------
 .../2026-05-30-aurora-neon-zed-theme.md       | 18 ++++++-------
 ...td-dashboard-theme-merge-dependency-fix.md | 16 ++++++------
 docs/sessions/2026-06-23-cd-parity-sweep.md   |  2 +-
 .../2026-07-02-cd-aurora-html-port-phase3.md  | 18 ++++++-------
 ...rehensive-review-remediation-deployment.md |  6 ++---
 ...-17-live-demos-scroll-docker-synthetics.md |  6 ++---
 next.config.ts                                |  6 ++---
 ops/compose/production.env.example            |  6 ++---
 ops/synthetics-cloudflare.md                  | 14 +++++-----
 19 files changed, 87 insertions(+), 87 deletions(-)

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
index 1b712d85..dbc8a726 100644
--- a/.github/actionlint.yaml
+++ b/.github/actionlint.yaml
@@ -1,4 +1,4 @@
-# Custom labels for the org's self-hosted runner farm (tootie-ci-runner-1..4),
+# Custom labels for the org's self-hosted runner farm (nashost-ci-runner-1..4),
 # so actionlint (run by the Workflow and dependency policy check) accepts
 # runs-on entries like [self-hosted, unraid].
 self-hosted-runner:
diff --git a/.github/workflows/synthetics.yml b/.github/workflows/synthetics.yml
index 9902633b..79dd91cf 100644
--- a/.github/workflows/synthetics.yml
+++ b/.github/workflows/synthetics.yml
@@ -13,7 +13,7 @@ concurrency:
 
 jobs:
   public-path:
-    # Self-hosted (tootie runner farm): residential egress is not challenged by
+    # Self-hosted (nashost runner farm): residential egress is not challenged by
     # Cloudflare, unlike GitHub-hosted Azure IPs (see ops/synthetics-cloudflare.md).
     runs-on: [self-hosted, unraid]
     permissions:
diff --git a/.storybook/main.ts b/.storybook/main.ts
index b97b4c3c..2dc7df34 100644
--- a/.storybook/main.ts
+++ b/.storybook/main.ts
@@ -12,9 +12,9 @@ const config: StorybookConfig = {
     allowedHosts: [
       "localhost",
       "127.0.0.1",
-      "dookie",
-      "dookie.manatee-triceratops.ts.net",
-      "100.88.16.79",
+      "devhost",
+      "devhost.example.ts.net",
+      "198.51.100.1",
     ],
   },
 }
diff --git a/CLAUDE.md b/CLAUDE.md
index 228505da..bde200b8 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -120,8 +120,8 @@ and shadcn CLI (registry JSON from `public/r/*.json`).
   `docs/component-kotlin-map.md` (Kotlin/Compose parity matrix).
 - **SWAG upstream contract:** `aurora.dinglebear.ai` (canonical; `aurora.tootie.tv`
   also matches via the wildcard `server_name aurora.*`), `dinglebear.ai`, and
-  `www.dinglebear.ai` are reverse-proxied by SWAG on `squirts` to the immutable
-  `aurora` production container on **dookie**, host port `50000→3000`. The
+  `www.dinglebear.ai` are reverse-proxied by SWAG on `edgehost` to the immutable
+  `aurora` production container on **devhost**, host port `50000→3000`. The
   canonical digest-only Compose overlay and SWAG templates are tracked under
   `ops/`; `docs/deployment.md` is the runbook. The `aurora-dev` source bind mount
   is isolated on port 3000 and must never receive public traffic. Scheme HTTP,
diff --git a/app/gallery/demos/empty-demo.tsx b/app/gallery/demos/empty-demo.tsx
index 80528c58..ebf4954a 100644
--- a/app/gallery/demos/empty-demo.tsx
+++ b/app/gallery/demos/empty-demo.tsx
@@ -114,7 +114,7 @@ export default function EmptyStateDemo() {
               as="h2"
               icon={<CloudOff size={24} aria-hidden />}
               title="Couldn’t reach the gateway"
-              description="The request to lab.tootie.tv timed out. Check the connection and try again."
+              description="The request to lab.example.internal timed out. Check the connection and try again."
               action={
                 <Button variant="warn" iconLeft={<RefreshCw size={14} aria-hidden />}>
                   Retry
diff --git a/app/gallery/demos/textarea-demo.tsx b/app/gallery/demos/textarea-demo.tsx
index 4a76c9b2..b080a2f4 100644
--- a/app/gallery/demos/textarea-demo.tsx
+++ b/app/gallery/demos/textarea-demo.tsx
@@ -69,7 +69,7 @@ export default function TextareaDemo() {
 
   // Character-count field, controlled so the counter tracks live edits.
   const [summary, setSummary] = React.useState(
-    "Restart the qdrant container on dookie and re-run the health check."
+    "Restart the qdrant container on devhost and re-run the health check."
   )
 
   return (
@@ -177,7 +177,7 @@ export default function TextareaDemo() {
               error
               showCount
               maxLength={72}
-              defaultValue="fix: the qdrant container on dookie kept dropping its collection after a restart because the volume mount drifted"
+              defaultValue="fix: the qdrant container on devhost kept dropping its collection after a restart because the volume mount drifted"
             />
           </Field>
         </div>
diff --git a/app/gallery/demos/tool-calls-demo.tsx b/app/gallery/demos/tool-calls-demo.tsx
index b7f88d2a..c3d89c04 100644
--- a/app/gallery/demos/tool-calls-demo.tsx
+++ b/app/gallery/demos/tool-calls-demo.tsx
@@ -110,7 +110,7 @@ const TROUBLESHOOT_SESSION: ToolCall[] = [
     id: "ops-1",
     tool: "shell.exec",
     status: "completed",
-    args: { host: "tootie", command: "docker ps --filter name=sonarr --format '{{.Status}}'" },
+    args: { host: "nashost", command: "docker ps --filter name=sonarr --format '{{.Status}}'" },
     result: "Up 3 hours (unhealthy)",
     ...span(14000, 13400),
   },
@@ -118,7 +118,7 @@ const TROUBLESHOOT_SESSION: ToolCall[] = [
     id: "ops-2",
     tool: "arcane.container.inspect",
     status: "completed",
-    args: { host: "tootie", name: "sonarr" },
+    args: { host: "nashost", name: "sonarr" },
     result: "State.Health.FailingStreak = 6 · last probe: connection refused :8989",
     ...span(13300, 12600),
   },
@@ -126,7 +126,7 @@ const TROUBLESHOOT_SESSION: ToolCall[] = [
     id: "ops-3",
     tool: "arcane.container.inspect",
     status: "completed",
-    args: { host: "tootie", name: "prowlarr" },
+    args: { host: "nashost", name: "prowlarr" },
     result: "State.Health = healthy · 4 indexers online",
     ...span(12500, 11900),
   },
@@ -134,15 +134,15 @@ const TROUBLESHOOT_SESSION: ToolCall[] = [
     id: "ops-4",
     tool: "sonarr.api.get",
     status: "error",
-    args: { endpoint: "/api/v3/health", host: "tootie", port: 8989 },
-    result: "FetchError: ECONNREFUSED 100.120.242.29:8989 — API not accepting connections",
+    args: { endpoint: "/api/v3/health", host: "nashost", port: 8989 },
+    result: "FetchError: ECONNREFUSED 198.51.100.2:8989 — API not accepting connections",
     ...span(11800, 11500),
   },
   {
     id: "ops-5",
     tool: "cortex.logs.search",
     status: "completed",
-    args: { host: "tootie", container: "sonarr", query: "level:error", since: "15m" },
+    args: { host: "nashost", container: "sonarr", query: "level:error", since: "15m" },
     result: "3 matches · 'System.Data.SQLite.SQLiteException: database is locked'",
     ...span(11400, 10200),
   },
@@ -150,7 +150,7 @@ const TROUBLESHOOT_SESSION: ToolCall[] = [
     id: "ops-6",
     tool: "arcane.container.restart",
     status: "running",
-    args: { host: "tootie", name: "sonarr", timeout_s: 30 },
+    args: { host: "nashost", name: "sonarr", timeout_s: 30 },
     ...since(2600),
   },
 ]
@@ -220,7 +220,7 @@ export default function ToolCallsDemo() {
       <section style={sectionStyle}>
         <span style={lbl}>Homelab ops · mixed tools, one failure, live recovery</span>
         <p style={captionStyle}>
-          A gateway agent diagnosing an unhealthy Sonarr container on tootie: a
+          A gateway agent diagnosing an unhealthy Sonarr container on nashost: a
           shell probe, a repeated container inspect (grouped), a failed API fetch
           rendered in rose, a log search that finds the root cause, and a restart
           still in flight.
diff --git a/docs/deployment.md b/docs/deployment.md
index fe41f612..27cb7e00 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -10,7 +10,7 @@ policy with tested build-time script hashes.
 
 | Surface | Hostnames | Runtime | Port/network |
 |---|---|---|---|
-| Aurora design system | `aurora.tootie.tv` | `aurora` digest-pinned production container on dookie | host `50000` to container `3000`; external `jakenet` |
+| Aurora design system | `aurora.tootie.tv` | `aurora` digest-pinned production container on devhost | host `50000` to container `3000`; external `jakenet` |
 | Co-hosted fleet tenant | `dinglebear.ai`, `www.dinglebear.ai` | same immutable image; host routing in `proxy.ts` | same upstream |
 | Local development | no public hostname | `aurora-dev` profile with source bind mount | host `3000`; isolated `aurora-dev` network |
 | Local production smoke | no public hostname | `aurora-prod-build` profile | host `50001`; isolated `aurora-prod-build` network |
@@ -18,7 +18,7 @@ policy with tested build-time script hashes.
 The tracked production contract is `ops/compose/production.yaml`; tracked SWAG
 templates are under `ops/swag/`. `ops/check-production-topology.sh` validates
 that both sides agree on port, network, tenant names, digest use, and isolation.
-The host port binds only to `AURORA_BIND_ADDRESS` (dookie's Tailscale address),
+The host port binds only to `AURORA_BIND_ADDRESS` (devhost's Tailscale address),
 not a wildcard interface, so routable clients cannot bypass the SWAG ingress.
 
 ## Publish and promotion
@@ -51,9 +51,9 @@ the immutable digest pin plus the Trivy gate above.
    fails. The `AURORA_ALERT_WEBHOOK_URL` steps were removed: the secret was
    never set, so every "alert" was a no-op that made three workflows look
    monitored while `publish.yml` stayed broken for a week unnoticed.
-3. On dookie, create `jakenet` if it does not exist and install Docker Compose.
+3. On devhost, create `jakenet` if it does not exist and install Docker Compose.
    Keep the deployment env file outside the checkout.
-4. On squirts, render the tracked SWAG templates, review the diff against the
+4. On edgehost, render the tracked SWAG templates, review the diff against the
    installed vhosts, run `nginx -t`, then atomically install/reload them. Do not
    copy an unreviewed generated file over live proxy configuration.
 
@@ -66,7 +66,7 @@ Create a private environment file from the tracked example:
 cp ops/compose/production.env.example ~/.config/aurora/production.env
 chmod 600 ~/.config/aurora/production.env
 # Replace AURORA_IMAGE_REF and AURORA_EXPECTED_SHA with the workflow outputs.
-# Confirm AURORA_BIND_ADDRESS is dookie's current Tailscale address and set both
+# Confirm AURORA_BIND_ADDRESS is devhost's current Tailscale address and set both
 # AURORA_PUBLIC_URL and AURORA_TENANT_URL to their production HTTPS origins.
 ```
 
@@ -86,7 +86,7 @@ on both Aurora and the co-hosted dinglebear tenant:
 ops/deploy.sh ~/.config/aurora/production.env
 ```
 
-Only after that succeeds should SWAG public traffic point to dookie port 50000.
+Only after that succeeds should SWAG public traffic point to devhost port 50000.
 The dev profile remains on port 3000 and is never attached to `jakenet`.
 
 ## Rollback
@@ -109,7 +109,7 @@ intentional delay between merging and manual promotion is not reported as an
 outage.
 
 The `ops/install-monitor.sh` systemd watchdog was removed. It was never
-installed on dookie — `aurora-monitor.timer` did not exist there — and its
+installed on devhost — `aurora-monitor.timer` did not exist there — and its
 `AURORA_ALERT_WEBHOOK_URL` was never set, so it could not have paged anyone. CI
 was running a unit test for it. Container health is covered by the Compose
 `HEALTHCHECK` and the twice-hourly synthetics above.
diff --git a/docs/mockups/theme-previews.html b/docs/mockups/theme-previews.html
index a87121d9..c7bf9492 100644
--- a/docs/mockups/theme-previews.html
+++ b/docs/mockups/theme-previews.html
@@ -31,7 +31,7 @@
     <div class="row"><span class="ln">2</span></div>
     <div class="row"><span class="ln">3</span><span style="color:#5a7a92">// dispatch one action across surfaces</span></div>
     <div class="row"><span class="ln">4</span><span style="color:#38d2ff">pub async fn</span> <span style="color:#7ee0c8">dispatch</span><span style="color:#a8c5d8">(</span><span style="color:#f0f8fd">action</span><span style="color:#a8c5d8">:</span> <span style="color:#ffd479">Action</span><span style="color:#a8c5d8">)</span> <span style="color:#38d2ff">-></span> <span style="color:#ffd479">Result</span><span style="color:#a8c5d8">&lt;</span><span style="color:#ffd479">Json</span><span style="color:#a8c5d8">&gt; {</span></div>
-    <div class="row"><span class="ln">5</span>    <span style="color:#38d2ff">let</span> <span style="color:#f0f8fd">gw</span> <span style="color:#38d2ff">=</span> <span style="color:#ffd479">Gateway</span><span style="color:#a8c5d8">::</span><span style="color:#7ee0c8">connect</span><span style="color:#a8c5d8">(</span><span style="color:#b8e6a0">"lab.tootie.tv"</span><span style="color:#a8c5d8">).</span><span style="color:#7ee0c8">await</span><span style="color:#a8c5d8">?;</span></div>
+    <div class="row"><span class="ln">5</span>    <span style="color:#38d2ff">let</span> <span style="color:#f0f8fd">gw</span> <span style="color:#38d2ff">=</span> <span style="color:#ffd479">Gateway</span><span style="color:#a8c5d8">::</span><span style="color:#7ee0c8">connect</span><span style="color:#a8c5d8">(</span><span style="color:#b8e6a0">"lab.example.internal"</span><span style="color:#a8c5d8">).</span><span style="color:#7ee0c8">await</span><span style="color:#a8c5d8">?;</span></div>
     <div class="row"><span class="ln">6</span>    <span style="color:#f0f8fd">gw</span><span style="color:#a8c5d8">.</span><span style="color:#c9a6f0">run</span><span style="color:#a8c5d8">(</span><span style="color:#f0f8fd">action</span><span style="color:#a8c5d8">,</span> <span style="color:#ffb38a">3</span><span style="color:#a8c5d8">).</span><span style="color:#7ee0c8">await</span></div>
     <div class="row"><span class="ln">7</span><span style="color:#a8c5d8">}</span></div>
   </div>
@@ -79,7 +79,7 @@
 <div class="tile" style="background:#0a1c2e">
   <div style="height:36px;background:#103154;display:flex;align-items:flex-end;padding:0 10px;gap:6px">
     <div class="tab" style="background:#0d2640;color:#f0f8fd;margin-bottom:0">
-      <span class="dot" style="background:#4dc8fa"></span>Aurora<span style="color:#7fa8c8;font-weight:400">— tootie.tv</span></div>
+      <span class="dot" style="background:#4dc8fa"></span>Aurora<span style="color:#7fa8c8;font-weight:400">— example.internal</span></div>
     <div class="tab" style="color:#b4d2e6;margin-bottom:0;font-weight:500">Labby</div>
     <div style="color:#7fa8c8;margin-bottom:6px;font-size:16px">+</div>
   </div>
@@ -96,7 +96,7 @@
 <!-- 5. CHROME light -->
 <div class="tile" style="background:#f5f9fc">
   <div style="height:36px;background:#dbe9f4;display:flex;align-items:flex-end;padding:0 10px;gap:6px">
-    <div class="tab" style="background:#ffffff;color:#0d2236;margin-bottom:0"><span class="dot" style="background:#0288d1"></span>Aurora<span style="color:#5a7a90;font-weight:400">— tootie.tv</span></div>
+    <div class="tab" style="background:#ffffff;color:#0d2236;margin-bottom:0"><span class="dot" style="background:#0288d1"></span>Aurora<span style="color:#5a7a90;font-weight:400">— example.internal</span></div>
     <div class="tab" style="color:#3d6070;margin-bottom:0;font-weight:500">Labby</div>
     <div style="color:#5a7a90;margin-bottom:6px;font-size:16px">+</div>
   </div>
diff --git a/docs/sessions/2026-05-23-android-polish-test-implement.md b/docs/sessions/2026-05-23-android-polish-test-implement.md
index 4bf6b26d..6012a20f 100644
--- a/docs/sessions/2026-05-23-android-polish-test-implement.md
+++ b/docs/sessions/2026-05-23-android-polish-test-implement.md
@@ -13,23 +13,23 @@ beads: q007 bcjw thfe vyjr mkr1 syc7 w0am ilkm xe0i 01xq nev6 6mwo (12 closed) |
 
 ## User Request
 
-After the parallel-dispatch session that landed PRs #6–#15: ask for an auth/server briefing, run a code review on the full diff, address all findings, install the APK via emulator on dookie and walk the chat flow end-to-end via claude-in-mobile / ADB, file all UI polish opportunities as beads, run lavra-research on each, and then lavra-work the resulting backlog.
+After the parallel-dispatch session that landed PRs #6–#15: ask for an auth/server briefing, run a code review on the full diff, address all findings, install the APK via emulator on devhost and walk the chat flow end-to-end via claude-in-mobile / ADB, file all UI polish opportunities as beads, run lavra-research on each, and then lavra-work the resulting backlog.
 
 ## Session Overview
 
 Long-running execution session. Three distinct phases:
 
 1. **Code review + fixes**: 6 review findings addressed (AuthRepository, ChatViewModel handshake gate, SidebarViewModel timeout, ChatScreen empty-image guard, CodexRepository demux logging, dead `session/update` regression). Build green, APK uploaded.
-2. **Live emulator test + bead capture**: Installed APK on dookie's existing emulator, drove the chat flow via ADB. Discovered `getAuthStatus` is not a real Codex protocol method — patched StartupViewModel to trust local AUTH_METHOD. Sent a real prompt round-trip ("Say hello and count from 1 to 3" → "Hello. 1, 2, 3." + tool call). Catalogued 14 polish opportunities as beads, dispatched 4 parallel lavra-research agents to attach evidence to each.
+2. **Live emulator test + bead capture**: Installed APK on devhost's existing emulator, drove the chat flow via ADB. Discovered `getAuthStatus` is not a real Codex protocol method — patched StartupViewModel to trust local AUTH_METHOD. Sent a real prompt round-trip ("Say hello and count from 1 to 3" → "Hello. 1, 2, 3." + tool call). Catalogued 14 polish opportunities as beads, dispatched 4 parallel lavra-research agents to attach evidence to each.
 3. **Multi-wave lavra-work execution**: Three waves of parallel-then-sequential agent dispatch. Wave 1 (q007, bcjw, thfe) shipped via the user committing `5bea020 Polish Android chat components`. Wave 2 (vyjr, mkr1, syc7, w0am) shipped via three commits. Wave 3 (ilkm, xe0i, 01xq, nev6, 6mwo) all touched `ChatScreen.kt` so a single sequential agent owned the file; shipped via `830e323`. All 12 polish beads closed; APK uploaded after each wave.
 
 ## Sequence of Events
 
-1. Asked about auth model + server target; identified `codex app-server --listen ws://127.0.0.1:4500` on dookie (loopback, no auth required)
+1. Asked about auth model + server target; identified `codex app-server --listen ws://127.0.0.1:4500` on devhost (loopback, no auth required)
 2. Ran code-review skill with 3 finder angles + verifier; 6 findings consolidated
 3. Applied fixes; rebased through a large remote update that had independently fixed 2 of the same issues; resolved 4 conflict files keeping both the remote refactor and the timeout-safety additions
 4. Built APK 21M, uploaded to `gdrive:Aurora/app-debug.apk`
-5. Installed APK on dookie's emulator-5554 via ADB; launched and observed LoginScreen
+5. Installed APK on devhost's emulator-5554 via ADB; launched and observed LoginScreen
 6. Identified `getAuthStatus` is not in Codex protocol — patched StartupViewModel to trust local `AUTH_METHOD`
 7. Bypassed login, observed chat screen, sent real message; round-trip worked; tool call rendered
 8. Tested ApprovalPolicyBar dropdown (worked), model selector dropdown (didn't open — bug), attach button, sidebar (opened by accident)
@@ -122,13 +122,13 @@ Long-running execution session. Three distinct phases:
 
 ## Tools and Skills Used
 
-- **Bash**: `bd`, `git`, `gh`, `rtk` wrappers, `./gradlew`, `adb`, `ssh dookie`, `rclone`, `python3` snippets — for nearly every coordination step
+- **Bash**: `bd`, `git`, `gh`, `rtk` wrappers, `./gradlew`, `adb`, `ssh devhost`, `rclone`, `python3` snippets — for nearly every coordination step
 - **Read/Write/Edit**: file inspection and direct edits when not delegated to subagents
 - **Agent (general-purpose subagents)**: dispatched 5 planning agents + 5 execution agents (prior session continuation) + 4 lavra-research agents + 3 wave-1 implementers + 3 wave-2 implementers + 1 wave-3 sequential implementer. ~15 subagent invocations total. Inter-agent WIP races observed during parallel waves — combined build is source of truth.
 - **AskUserQuestion**: server-context confirmation, wave scope selection
 - **Skill tool**: `code-review`, `gh-pr`, `screenshots`, `save-to-md`, `vibin:save-to-md`, `lavra:lavra-learn`, `lavra:lavra-work`, `lavra:lavra-work-multi`, `superpowers:dispatching-parallel-agents`
 - **MCP tools**: `mcp__plugin_lab_lab__scout` (tool discovery), `mcp__plugin_lab_lab__invoke` (axon scrape of OpenAI Codex app-server docs)
-- **ADB over SSH to dookie**: `adb install -r`, `adb shell input tap/text/keyevent`, `adb shell screencap -p`, `adb shell uiautomator dump`, `adb shell run-as` for DataStore prefs inspection, `adb logcat` for diagnostics
+- **ADB over SSH to devhost**: `adb install -r`, `adb shell input tap/text/keyevent`, `adb shell screencap -p`, `adb shell uiautomator dump`, `adb shell run-as` for DataStore prefs inspection, `adb logcat` for diagnostics
 - **rclone**: `rclone copy` to gdrive:Aurora (5+ APK uploads, ~21M each)
 - **Issues**: (a) `device` MCP tool name collision between `lab` and `claude-in-mobile` gateways — couldn't route to claude-in-mobile, fell back to direct ADB which worked fine. (b) Raw websocket-client Python rejected with 403 due to Origin header; switched to socket-level handshake without Origin. (c) `bd auto-export` git-add failures (harmless warnings, didn't block push).
 
@@ -140,14 +140,14 @@ git diff --stat origin/main...HEAD              # establish review scope
 ./gradlew :app:assembleDebug                    # BUILD SUCCESSFUL after each wave
 
 # Server inspection
-ssh dookie "ss -tlnp | grep ':4500'"            # codex app-server on 127.0.0.1:4500
-ssh dookie "ps -p 389362 -o cmd"                # codex app-server --listen ws://127.0.0.1:4500
+ssh devhost "ss -tlnp | grep ':4500'"            # codex app-server on 127.0.0.1:4500
+ssh devhost "ps -p 389362 -o cmd"                # codex app-server --listen ws://127.0.0.1:4500
 
 # Live testing
-ssh dookie "adb devices"                        # emulator-5554 ready
-scp APK dookie:/tmp/ && ssh dookie "adb install -r /tmp/aurora-app-debug.apk"
-ssh dookie "adb shell am start -n tv.tootie.aurora.app/.MainActivity"
-ssh dookie "adb shell input tap X Y; adb shell screencap -p > /tmp/aurora-screen.png"
+ssh devhost "adb devices"                        # emulator-5554 ready
+scp APK devhost:/tmp/ && ssh devhost "adb install -r /tmp/aurora-app-debug.apk"
+ssh devhost "adb shell am start -n tv.tootie.aurora.app/.MainActivity"
+ssh devhost "adb shell input tap X Y; adb shell screencap -p > /tmp/aurora-screen.png"
 
 # Bead workflow
 bd create --title=... --description=... --type=... --priority=...     # 14 polish beads
@@ -236,7 +236,7 @@ rclone copy app-debug.apk gdrive:Aurora                               # final AP
 **Recommended immediate next commands:**
 ```bash
 # Install the final APK on the emulator for visual verification
-ssh dookie "adb install -r /tmp/aurora-app-debug.apk && adb shell am start -n tv.tootie.aurora.app/.MainActivity"
+ssh devhost "adb install -r /tmp/aurora-app-debug.apk && adb shell am start -n tv.tootie.aurora.app/.MainActivity"
 # View remaining open beads to plan next session
 bd ready --json | jq '.[].title' | head -10
 ```
diff --git a/docs/sessions/2026-05-30-aurora-neon-zed-theme.md b/docs/sessions/2026-05-30-aurora-neon-zed-theme.md
index d0738566..f7c1b8fd 100644
--- a/docs/sessions/2026-05-30-aurora-neon-zed-theme.md
+++ b/docs/sessions/2026-05-30-aurora-neon-zed-theme.md
@@ -33,7 +33,7 @@ doesn't collide with canonical Aurora.
 - Migrated the interactive shell from **zsh4humans → antidote** (static-bundle mode), preserving p10k, plugins, fzf keybindings, completions; removed dead per-startup env lines. (home dir; dotfiles repo commit `55931a4`.)
 - Expanded **chezmoi** tracking: added `statusline-aurora.sh`, encrypted `settings.json`/`settings.local.json`, codex `.credentials.json`, and gemini `settings.json`/`mcp.json`/`gemini-credentials.json`/`google_accounts.json`; removed stale gmail/proton auth; hardened perms to 0600.
 - Built the **Aurora Zed theme** (dark+light, schema v0.2.0), iterated brightness twice to a neon palette, then added a **full file-type icon theme** (60 generated glyph-tile SVGs, 98 suffix + 22 stem mappings).
-- Placed the work in this repo under `editors/zed/` + served copy `public/zed/`; deployed to dookie and steamy.
+- Placed the work in this repo under `editors/zed/` + served copy `public/zed/`; deployed to devhost and winhost.
 - Audited palette drift across all 11 Aurora theme artifacts: only Zed diverged. Per user decision (Zed-only neon), renamed Zed to **Aurora Neon** and pushed (`dfae0cf`).
 
 ## 3. Sequence of Events
@@ -41,9 +41,9 @@ doesn't collide with canonical Aurora.
 1. mise review → identified lockfile/orphan/brew-dup issues; user fixed; advised on `idiomatic_version_file` and settings.
 2. zsh4humans → antidote migration: baseline benchmark, install antidote, rewrite `.zshrc`/`.zshenv`, re-implement compinit + fzf keys, verify under pty.
 3. chezmoi audit across `~/.claude`, `~/.codex`, `~/.gemini`; encrypt+track secrets, remove auth files, harden perms; commit+push dotfiles repo.
-4. Zed theme created (`editors/zed/themes/aurora.json`), schema-validated, deployed to `~/.config/zed` + steamy.
+4. Zed theme created (`editors/zed/themes/aurora.json`), schema-validated, deployed to `~/.config/zed` + winhost.
 5. Two brightening passes (shimmer → neon); canvas lifted `#07131c`→`#102a3e`, syntax pushed to electric cyan/violet/mint/gold/rose.
-6. Full icon theme generated via `generate-icons.py`; schema-validated; extension deployed to steamy.
+6. Full icon theme generated via `generate-icons.py`; schema-validated; extension deployed to winhost.
 7. Committed editor-themes collection (`0e34218`), pushed `feat/zed-aurora-theme`.
 8. Palette-drift audit → only Zed neon; everything else canonical.
 9. Renamed Zed → "Aurora Neon"; cleared a stale `index.lock` left by a concurrent agent; committed `dfae0cf`; verified across origin + all deploy targets.
@@ -75,7 +75,7 @@ doesn't collide with canonical Aurora.
 | created | `public/zed/aurora.json` | — | Served copy of UI theme | byte-match w/ source |
 | created | `editors/warp/*`, `editors/claude-code/*`, `public/warp/*` | — | Sibling editor themes (committed in `0e34218` scope) | `git show 0e34218 --stat` |
 
-Cross-repo / cross-host (not this repo): `~/.zshrc`, `~/.zshenv` (antidote migration); `~/.local/share/chezmoi` commit `55931a4` (zsh + tracking + encrypted secrets); `~/.config/zed/themes/aurora.json` (dookie deploy); `C:\Users\jmaga\zed-aurora-extension\*` (steamy deploy).
+Cross-repo / cross-host (not this repo): `~/.zshrc`, `~/.zshenv` (antidote migration); `~/.local/share/chezmoi` commit `55931a4` (zsh + tracking + encrypted secrets); `~/.config/zed/themes/aurora.json` (devhost deploy); `C:\Users\jmaga\zed-aurora-extension\*` (winhost deploy).
 
 ## 7. Beads Activity
 
@@ -91,7 +91,7 @@ Cross-repo / cross-host (not this repo): `~/.zshrc`, `~/.zshenv` (antidote migra
 
 ## 9. Tools and Skills Used
 
-- **Shell (Bash)**: git, rsync, ssh (steamy-wsl), `chezmoi`, `mise`, `hyperfine`, `uvx check-jsonschema`, `jq`, `python3`. Purpose: migration, validation, deployment, benchmarking.
+- **Shell (Bash)**: git, rsync, ssh (winhost-wsl), `chezmoi`, `mise`, `hyperfine`, `uvx check-jsonschema`, `jq`, `python3`. Purpose: migration, validation, deployment, benchmarking.
 - **File tools**: Read/Write/Edit for `.zshrc`/`.zshenv`, theme JSON, generator, README, extension.toml.
 - **External CLI**: `axon` (RAG `search`+`ask`) to answer "how to create Zed themes" with cited sources.
 - **AskUserQuestion**: framework choice (antidote), icon style (glyph tiles), commit scope, propagation scope.
@@ -105,7 +105,7 @@ Cross-repo / cross-host (not this repo): `~/.zshrc`, `~/.zshenv` (antidote migra
 | `python3 editors/zed/generate-icons.py` | 60 svgs, 98 suffixes, 22 stems |
 | `uvx check-jsonschema --schemafile .../v0.2.0.json editors/zed/themes/aurora.json` | `ok -- validation done` |
 | `git commit … && git push origin feat/zed-aurora-theme` (`0e34218`, `dfae0cf`) | pushed; branch in sync with origin |
-| `rsync -rtq --delete … steamy-wsl:/mnt/c/Users/jmaga/zed-aurora-extension/` | extension synced to steamy |
+| `rsync -rtq --delete … winhost-wsl:/mnt/c/Users/jmaga/zed-aurora-extension/` | extension synced to winhost |
 
 ## 11. Errors Encountered
 
@@ -119,7 +119,7 @@ Cross-repo / cross-host (not this repo): `~/.zshrc`, `~/.zshenv` (antidote migra
 |---|---|---|
 | Zed themes | none in repo | Aurora Neon / Aurora Neon Light + Aurora Neon Icons available via extension |
 | Zed theme palette | n/a | neon (canvas `#102a3e`, cyan `#38d2ff`) — divergent from canonical Aurora, intentionally |
-| Theme distribution | n/a | served at `aurora.tootie.tv/zed/aurora.json`; extension deployed to dookie + steamy |
+| Theme distribution | n/a | served at `aurora.tootie.tv/zed/aurora.json`; extension deployed to devhost + winhost |
 
 ## 13. Verification Evidence
 
@@ -128,7 +128,7 @@ Cross-repo / cross-host (not this repo): `~/.zshrc`, `~/.zshenv` (antidote migra
 | `check-jsonschema … themes/aurora.json` | valid | `ok -- validation done` | pass |
 | `check-jsonschema … icon_themes/aurora.json` | valid | `ok -- validation done` | pass |
 | hex scan of theme JSON | no malformed hex | caught + fixed `#1b3span`, `#688persp` | pass |
-| origin + 4 deploy targets carry "Aurora Neon" | all match | origin/public/dookie/steamy all "Aurora Neon" | pass |
+| origin + 4 deploy targets carry "Aurora Neon" | all match | origin/public/devhost/winhost all "Aurora Neon" | pass |
 | icon path resolution | all 60 exist | `missing icon files: none` | pass |
 
 ## 14. Risks and Rollback
@@ -155,7 +155,7 @@ Cross-repo / cross-host (not this repo): `~/.zshrc`, `~/.zshenv` (antidote migra
 
 ## 18. Next Steps
 
-1. **Activate in Zed** (each machine): `zed: install dev extension` → the extension folder (dookie `editors/zed`, steamy `C:\Users\jmaga\zed-aurora-extension`); then `theme selector` → **Aurora Neon**, `icon theme selector` → **Aurora Neon Icons**. Remove the `~/.config/zed/themes/aurora.json` drop-in to avoid a duplicate.
+1. **Activate in Zed** (each machine): `zed: install dev extension` → the extension folder (devhost `editors/zed`, winhost `C:\Users\jmaga\zed-aurora-extension`); then `theme selector` → **Aurora Neon**, `icon theme selector` → **Aurora Neon Icons**. Remove the `~/.config/zed/themes/aurora.json` drop-in to avoid a duplicate.
 2. **Open the PR** for `feat/zed-aurora-theme` (or split out the Zed commits). Suggested follow-up bead: "Open PR: Aurora Neon Zed editor + icon theme".
 3. **Decide** on the shared-branch question (Open Questions) before merge.
 4. The `feat/prompt-input-action-left` branch remains live and independent — unaffected by this session.
diff --git a/docs/sessions/2026-05-31-motd-dashboard-theme-merge-dependency-fix.md b/docs/sessions/2026-05-31-motd-dashboard-theme-merge-dependency-fix.md
index 40bb2207..7ece13b2 100644
--- a/docs/sessions/2026-05-31-motd-dashboard-theme-merge-dependency-fix.md
+++ b/docs/sessions/2026-05-31-motd-dashboard-theme-merge-dependency-fix.md
@@ -13,14 +13,14 @@ beads: aurora-design-system-bsam
 # Homelab MOTD dashboard, Aurora theme merge, and dependency security fix
 
 ## User Request
-Started with "ssh dookie … Can we make it show useful info in the motd", then iterated:
+Started with "ssh devhost … Can we make it show useful info in the motd", then iterated:
 add Docker info, make it adhere to Aurora design tokens, suppress the Ubuntu ESM
 nag, track it all with chezmoi, then `/vibin:quick-push` + "merge back into main",
 delete the merged branch, and fix the flagged Dependabot advisory.
 
 ## Session Overview
 Three threads of work in one session:
-1. Built a homelab MOTD dashboard for `dookie` (`/etc/update-motd.d/20-homelab-dashboard`),
+1. Built a homelab MOTD dashboard for `devhost` (`/etc/update-motd.d/20-homelab-dashboard`),
    colored with exact Aurora dark tokens as 24-bit truecolor, and silenced Ubuntu's
    ESM/Pro advertising. Captured the whole system change in the chezmoi dotfiles repo
    as an idempotent `run_onchange_` script.
@@ -31,7 +31,7 @@ Three threads of work in one session:
    override block was dead. Migrated it to `pnpm-workspace.yaml`.
 
 ## Sequence of Events
-1. Probed `dookie` data sources (docker, nvidia-smi, zpool, tailscale, df, free); all readable without sudo, passwordless sudo confirmed.
+1. Probed `devhost` data sources (docker, nvidia-smi, zpool, tailscale, df, free); all readable without sudo, passwordless sudo confirmed.
 2. Wrote `/etc/update-motd.d/20-homelab-dashboard`; disabled `10-help-text`, `50-motd-news`, `91-contract-ua-esm-status` and the `motd-news.timer`.
 3. Added richer Docker info (image/volume counts, wrapped running-container list); hardened the tailscale status read (post-boot JSON-empty fallback).
 4. Invoked the `vibin:aurora-design-system` skill; read exact dark token hex from `registry/aurora/styles/aurora.css`; remapped all colors to Aurora tokens as truecolor; replaced the `⚠` emoji with a `●` glow-dot and sentence-cased `ONLINE`→`Online`.
@@ -63,8 +63,8 @@ Three threads of work in one session:
 | modified | `package.json` | removed the now-ignored `pnpm` field (−24 lines) | commit 7aa883e |
 | modified | `pnpm-lock.yaml` | `tmp` 0.2.5 → 0.2.6; overrides recorded | commit 7aa883e |
 | created | `docs/sessions/2026-05-31-motd-dashboard-theme-merge-dependency-fix.md` | this session log | this commit |
-| created | `/etc/update-motd.d/20-homelab-dashboard` (dookie, system) | Aurora-tokenized homelab dashboard | rendered via run-parts |
-| modified | `/etc/update-motd.d/{10-help-text,50-motd-news,90-updates-available,91-contract-ua-esm-status}` (dookie) | `chmod -x` to silence ad/nag scripts | `ls -la /etc/update-motd.d` |
+| created | `/etc/update-motd.d/20-homelab-dashboard` (devhost, system) | Aurora-tokenized homelab dashboard | rendered via run-parts |
+| modified | `/etc/update-motd.d/{10-help-text,50-motd-news,90-updates-available,91-contract-ua-esm-status}` (devhost) | `chmod -x` to silence ad/nag scripts | `ls -la /etc/update-motd.d` |
 | created | `~/.local/share/chezmoi/run_onchange_after_60-motd.sh` (dotfiles repo) | idempotent MOTD provisioning | commit e8e5873 |
 | created | `~/.claude/.../memory/reference_pnpm10_overrides_moved.md` (+ MEMORY.md index) | global memory: pnpm 10 overrides gotcha | Write tool |
 
@@ -105,7 +105,7 @@ Three threads of work in one session:
 ## Behavior Changes (Before/After)
 | area | before | after |
 |---|---|---|
-| dookie MOTD | Ubuntu default banner + ESM/Pro advertising | Aurora-tokenized dashboard (cpu/mem/disk/pkg/gpu/zfs/docker/net), no ESM nag |
+| devhost MOTD | Ubuntu default banner + ESM/Pro advertising | Aurora-tokenized dashboard (cpu/mem/disk/pkg/gpu/zfs/docker/net), no ESM nag |
 | aurora `main` | at `ca4bd62`, no editor themes | editor/terminal themes v0.2.0 merged; tmp vuln fixed |
 | pnpm overrides | dead in ignored `package.json` field | active in `pnpm-workspace.yaml` |
 
@@ -120,7 +120,7 @@ Three threads of work in one session:
 
 ## Risks and Rollback
 - Re-activating the override pins could in principle shift transitive versions, but observed lockfile churn was just the `tmp` bump; lint + build pass. Rollback: `git revert 7aa883e` and `pnpm install`.
-- MOTD/system changes on dookie are reproducible from chezmoi `e8e5873`; ESM service masks reversible via `systemctl unmask` and re-enabling the disabled motd scripts.
+- MOTD/system changes on devhost are reproducible from chezmoi `e8e5873`; ESM service masks reversible via `systemctl unmask` and re-enabling the disabled motd scripts.
 
 ## Decisions Not Taken
 - A `tmp`-only override in a new `pnpm-workspace.yaml` while leaving the dead block in `package.json` — rejected; would split config across two locations and leave other pins inactive.
@@ -135,4 +135,4 @@ Three threads of work in one session:
 1. Confirm Dependabot alert #49 auto-closes after GitHub re-scans `main` (bead `-bsam`).
 2. Sweep `~/workspace` pnpm-10 repos (ghbd, etc.) for a stale `pnpm.overrides` in `package.json` with no `pnpm-workspace.yaml` — same silent security-pin regression.
 3. Optional: add a one-line note to `CLAUDE.md` that overrides live in `pnpm-workspace.yaml`.
-4. Optional: roll the MOTD dashboard out to tootie/squirts/shart (the chezmoi `run_onchange` script is host-portable; GPU/ZFS blocks self-skip).
+4. Optional: roll the MOTD dashboard out to nashost/edgehost/backuphost (the chezmoi `run_onchange` script is host-portable; GPU/ZFS blocks self-skip).
diff --git a/docs/sessions/2026-06-23-cd-parity-sweep.md b/docs/sessions/2026-06-23-cd-parity-sweep.md
index c018746f..afafb924 100644
--- a/docs/sessions/2026-06-23-cd-parity-sweep.md
+++ b/docs/sessions/2026-06-23-cd-parity-sweep.md
@@ -73,7 +73,7 @@ Started with housekeeping (merged `fix/registry-namespaced-deps` to main; cleane
 - **Shell/file tools**: extensive (git, pnpm, tsc, eslint, python helpers).
 - **Workflow (multi-agent)**: 6 throttled runs (chunks of 6) for reskin/create waves; one early run hit a transient 529/rate-limit at 16-concurrency, fixed by chunking.
 - **claude_design MCP**: `list_projects/list_files/read_file/render_preview` to pull CD sources + project-scoped serve token (reusable across paths).
-- **webwright skill + Playwright (firefox)**: CD reference screenshots + live gallery spot-checks; firefox driver was flaky under load (known dookie gotcha) → ran at low concurrency, some refs captured from source instead.
+- **webwright skill + Playwright (firefox)**: CD reference screenshots + live gallery spot-checks; firefox driver was flaky under load (known devhost gotcha) → ran at low concurrency, some refs captured from source instead.
 - **save-to-md / quick-push skills**: this doc + version bump + push.
 
 ## Commands Executed
diff --git a/docs/sessions/2026-07-02-cd-aurora-html-port-phase3.md b/docs/sessions/2026-07-02-cd-aurora-html-port-phase3.md
index f3f8d8d8..b0cf5087 100644
--- a/docs/sessions/2026-07-02-cd-aurora-html-port-phase3.md
+++ b/docs/sessions/2026-07-02-cd-aurora-html-port-phase3.md
@@ -24,12 +24,12 @@ Ported the remaining Claude Design (CD) `Aurora.html` page experience into the N
 2. Audited the existing app: phases 1–2 of the port already existed (commits `159a682`, `d99b22c`); built a delta list (⌘K palette, Icons/Docs views, header parity).
 3. Phase 3 (`d86e79a`): generalized the registry `command-palette` block (sections/placeholder/filter props), extracted `lib/fuzzy.ts`, built `SiteCommandPalette`, `/icons` (`IconsView` — Lucide grid + `OperationIcon` grid), `/docs` (6 CD pages on real routes with sticky sub-nav), header Search button + nav entries, hero eyebrow + footer copy parity.
 4. Hit a pre-existing `main` build break (commit `71be925` pointed `attachments.tsx` at the consumer install path). Fixed with a repo-local shim `components/aurora/attachment.ts` (`e28e960`).
-5. Verified visually: chrome-devtools MCP needs X (unavailable); the agent-browser Chrome on :9222 is network-isolated from sandbox-local ports and its screenshot API stalls on background tabs; Playwright/Firefox crashed. Working recipe: :9222 Chrome + the Tailscale IP (`100.88.16.79:3777`) + `AURORA_DEV_ORIGIN` for Next dev assets + `Page.bringToFront` before `Page.captureScreenshot`.
+5. Verified visually: chrome-devtools MCP needs X (unavailable); the agent-browser Chrome on :9222 is network-isolated from sandbox-local ports and its screenshot API stalls on background tabs; Playwright/Firefox crashed. Working recipe: :9222 Chrome + the Tailscale IP (`198.51.100.1:3777`) + `AURORA_DEV_ORIGIN` for Next dev assets + `Page.bringToFront` before `Page.captureScreenshot`.
 6. User showed the CD Components view (manifest-driven live tiles) vs our gallery-sidebar link. Built the live catalog (`8e726c5`): extracted `app/gallery/demo-map.tsx` (shared slug→demo map), rebuilt `ComponentCatalog` with lazy scaled live previews + `LiveDrawer`, added `/components`, rewired nav/⌘K/pillar.
 7. Added drawer prev/next arrows + ←/→ keys + n/total counter (`b8ae564`).
 8. Replaced the header Components dropdown with an on-page shadcn·React / Android·Compose segmented toggle (`5e9a61e`); Android flavor driven by `lib/kotlin-map.ts` parsing `docs/component-kotlin-map.md` (120 counterparts; 125 catalog items ported).
 9. Implemented suggestions 1–4 (`6303d5d`): light-mode pass over all new surfaces (found + fixed a swallowed space after a `<Strong>` in docs copy), ⌘K → `/components?c=slug` drawer deep-links, URL state via `history.replaceState` + `useSearchParams` watcher (Suspense-wrapped), mobile hamburger nav.
-10. Fixed 4 errors reported from the live site (`8438afe`): catalog tile `<button>` wrapped demos containing buttons — invalid nesting caused 3 of the 4 errors (2 console + 1 hydration); converted tiles to `div[role=button]`. The 4th (`eval()` blocked) is dev-mode React only — identified that `aurora.tootie.tv` is served by the `dev` compose target on dookie.
+10. Fixed 4 errors reported from the live site (`8438afe`): catalog tile `<button>` wrapped demos containing buttons — invalid nesting caused 3 of the 4 errors (2 console + 1 hydration); converted tiles to `div[role=button]`. The 4th (`eval()` blocked) is dev-mode React only — identified that `aurora.tootie.tv` is served by the `dev` compose target on devhost.
 11. Maintenance pass for this note: corrected the stale SWAG upstream claim in `CLAUDE.md` (`c8f9e79`).
 
 ## Key findings
@@ -38,8 +38,8 @@ Ported the remaining Claude Design (CD) `Aurora.html` page experience into the N
 - dsCards must NOT be copied into the app: they render a parallel component implementation (split-brain with the registry). Their curated hero compositions are portable, though — recorded in `bd remember` key `catalog-preview-upgrade-option-declined-2026-07-02` (user declined the port).
 - `origin/main` was un-buildable at session start: `registry/aurora/blocks/ai/elements/attachments.tsx:3` imported `@/components/aurora/attachment` (the consumer install target of `aurora-attachment` per `registry.json`), which didn't exist in-repo.
 - Interactive content cannot nest inside `<button>`: the catalog tile button wrapping live demos re-parents markup during HTML parsing and fails hydration (errors seen on the live site's dev overlay).
-- `aurora.tootie.tv` is served by the `aurora-design-system` **dev** container on **dookie** (compose `dev` target, `50000→3000`, bind-mounts the primary checkout) — merges go live with no deploy step; the `eval()` console error and dev overlay exist only because of dev mode. An unused `aurora-prod` standalone service exists in `docker-compose.yaml`.
-- Environment: browsers on dookie cannot reach sandbox-local ports; the reliable headless capture path is the :9222 Chrome + Tailscale IP + `Page.bringToFront` (new-headless background tabs never paint, so `captureScreenshot` hangs forever without it).
+- `aurora.tootie.tv` is served by the `aurora-design-system` **dev** container on **devhost** (compose `dev` target, `50000→3000`, bind-mounts the primary checkout) — merges go live with no deploy step; the `eval()` console error and dev overlay exist only because of dev mode. An unused `aurora-prod` standalone service exists in `docker-compose.yaml`.
+- Environment: browsers on devhost cannot reach sandbox-local ports; the reliable headless capture path is the :9222 Chrome + Tailscale IP + `Page.bringToFront` (new-headless background tabs never paint, so `captureScreenshot` hangs forever without it).
 
 ## Technical decisions
 
@@ -68,7 +68,7 @@ Ported the remaining Claude Design (CD) `Aurora.html` page experience into the N
 | created | `app/(marketing)/components/page.tsx` | /components route (kotlinMap + syncUrl) | `8e726c5`, `5e9a61e`, `6303d5d` |
 | created | `lib/kotlin-map.ts` | parses component-kotlin-map.md table | `5e9a61e` |
 | modified | `tests/gallery-slug-consistency.test.ts` | reads demo keys from demo-map.tsx | `8e726c5` |
-| modified | `CLAUDE.md` | corrected SWAG upstream (dookie, not tootie) | `c8f9e79` |
+| modified | `CLAUDE.md` | corrected SWAG upstream (devhost, not nashost) | `c8f9e79` |
 | created | `docs/sessions/2026-07-02-cd-aurora-html-port-phase3.md` | this session note | this commit |
 
 ## Beads activity
@@ -87,8 +87,8 @@ Ported the remaining Claude Design (CD) `Aurora.html` page experience into the N
 - **Plans:** `docs/plans/` does not exist in this repo — no-op (evidence: `ls docs/plans` → no such directory).
 - **Beads:** all three session beads closed with work verified (see above); no orphaned session work. Follow-ups are covered by existing epics or `bd remember`.
 - **Worktrees/branches:** two worktrees registered — primary (`main`) and this one (`claude/upbeat-hypatia-14f9fe`); both at the same commit, branch fully merged into `main` via fast-forward pushes. Branch and worktree left in place because the worktree is the active session workspace; safe to remove later with `git worktree remove` + branch delete.
-- **Stale docs:** `CLAUDE.md` SWAG upstream corrected (`tootie:50000` → dookie container, dev/prod services documented) — evidence: `docker ps` on dookie shows `aurora-design-system … 0.0.0.0:50000->3000`, and the user confirmed. No other doc contradictions observed.
-- **Transparency:** the live SWAG conf on squirts (`aurora.subdomain.conf`) was not inspected; if its upstream host literally says `tootie`, it still resolves to the dookie container per observed behavior — flagged in Open Questions.
+- **Stale docs:** `CLAUDE.md` SWAG upstream corrected (`nashost:50000` → devhost container, dev/prod services documented) — evidence: `docker ps` on devhost shows `aurora-design-system … 0.0.0.0:50000->3000`, and the user confirmed. No other doc contradictions observed.
+- **Transparency:** the live SWAG conf on edgehost (`aurora.subdomain.conf`) was not inspected; if its upstream host literally says `nashost`, it still resolves to the devhost container per observed behavior — flagged in Open Questions.
 
 ## Tools and skills used
 
@@ -107,7 +107,7 @@ Ported the remaining Claude Design (CD) `Aurora.html` page experience into the N
 | `pnpm install` (worktree) | node_modules populated (35s; worktree was cold) |
 | `pnpm registry:build` | regenerated `public/r/*.json` |
 | `pnpm lint` / `pnpm build` / `pnpm test:unit` / `pnpm audit:composition` | all green at every commit point (65/65 tests) |
-| `AURORA_DEV_ORIGIN=100.88.16.79 pnpm dev --port 3777` | dev server for visual verification |
+| `AURORA_DEV_ORIGIN=198.51.100.1 pnpm dev --port 3777` | dev server for visual verification |
 | `pnpm start --port 3778` | production server for console-clean verification |
 | `git push origin claude/upbeat-hypatia-14f9fe:main` | fast-forward merges to main (×5) |
 | `bd create/claim/close`, `bd dolt push` | bead lifecycle |
@@ -158,7 +158,7 @@ Ported the remaining Claude Design (CD) `Aurora.html` page experience into the N
 
 ## Open questions
 
-- The SWAG conf on squirts (`aurora.subdomain.conf`) was not read; `CLAUDE.md` now documents the dookie container as the upstream based on `docker ps` + user confirmation — worth confirming the conf's literal upstream host next time someone touches it.
+- The SWAG conf on edgehost (`aurora.subdomain.conf`) was not read; `CLAUDE.md` now documents the devhost container as the upstream based on `docker ps` + user confirmation — worth confirming the conf's literal upstream host next time someone touches it.
 - Sparse tile previews (e.g. Direction) remain until/unless the dsCard composition port is revived.
 
 ## Next steps
diff --git a/docs/sessions/2026-07-16-comprehensive-review-remediation-deployment.md b/docs/sessions/2026-07-16-comprehensive-review-remediation-deployment.md
index 83b56458..95df91cf 100644
--- a/docs/sessions/2026-07-16-comprehensive-review-remediation-deployment.md
+++ b/docs/sessions/2026-07-16-comprehensive-review-remediation-deployment.md
@@ -37,7 +37,7 @@ The entire 1,035-file Aurora project was reviewed through all five phases. The r
 - Public traffic previously depended on a writable root development container; production now uses a non-root, read-only, digest-pinned runner with explicit topology and rollback.
 - CI promotion previously raced tested source identity; publication now builds the tested SHA, scans the exact digest, emits an SPDX SBOM, signs with Cosign, verifies identity, and only then promotes.
 - Combobox, RadioGroup, and Popover needed explicit keyboard/focus contracts; the final Popover implementation uses deterministic layout-phase focus with a tested completion marker.
-- Scheduled public synthetics currently receive HTTP 403 from GitHub-hosted runners even though `ops/synthetic-check.sh` passes from dookie; this remains open as `aurora-otgu`.
+- Scheduled public synthetics currently receive HTTP 403 from GitHub-hosted runners even though `ops/synthetic-check.sh` passes from devhost; this remains open as `aurora-otgu`.
 
 ## Technical Decisions
 
@@ -672,7 +672,7 @@ The review itself updated deployment, security, registry, Android, and operation
 - Popover Storybook interaction checks exposed a real focus race and then an external-test synchronization race; both contracts were fixed and passed 15 repeated strict-axe runs.
 - The first legacy-container production migration received an early public 502; rollback restored service, readiness/rollback waits were added, and the retry succeeded.
 - Playwright results reappeared after cleanup; timestamps and process inspection showed another live session running Storybook from the UI integration worktree, so the regenerated outputs were preserved and the session record was corrected.
-- Scheduled GitHub-hosted public synthetics fail with HTTP 403 at the first curl. Local/public verification from dookie succeeds. This unresolved external-path discrepancy is tracked in `aurora-otgu`.
+- Scheduled GitHub-hosted public synthetics fail with HTTP 403 at the first curl. Local/public verification from devhost succeeds. This unresolved external-path discrepancy is tracked in `aurora-otgu`.
 
 ## Behavior Changes (Before/After)
 
@@ -699,7 +699,7 @@ The review itself updated deployment, security, registry, Android, and operation
 | GitHub CI | Four protected checks | Run 29499187382 succeeded | pass |
 | Image publication | Exact tested SHA scanned and signed | Run 29499457639 attempt 2 succeeded | pass |
 | Live container | Final digest, healthy, read-only, non-root | `226f625...`, healthy, `READONLY=true`, user `1000:1000` | pass |
-| Public endpoint from dookie | HTTP 200, revision, schema, TLS | Passed; revision `178e13d...` | pass |
+| Public endpoint from devhost | HTTP 200, revision, schema, TLS | Passed; revision `178e13d...` | pass |
 | Scheduled GitHub public synthetic | Same public checks | HTTP 403 at first curl | fail |
 | Repository sync | Clean `main`, zero divergence | `main...origin/main`, 0 ahead / 0 behind | pass |
 
diff --git a/docs/sessions/2026-07-17-live-demos-scroll-docker-synthetics.md b/docs/sessions/2026-07-17-live-demos-scroll-docker-synthetics.md
index 45fc4254..c32cd75f 100644
--- a/docs/sessions/2026-07-17-live-demos-scroll-docker-synthetics.md
+++ b/docs/sessions/2026-07-17-live-demos-scroll-docker-synthetics.md
@@ -154,7 +154,7 @@ aurora-g15h and aurora-rmb4 (P3 openwiki transitive-dep hardening).
   `pr57` (tracked closed PR #57, superseded by #69) — `git branch -D pr57`.
   Left auto-PR branches `#73` (release-please 0.4.3) and `#74` (openwiki update)
   untouched — bot-owned, not this session's to merge.
-- **Stale docs**: updated the `aurora-tootie-serves-dev-build` memory to reflect
+- **Stale docs**: updated the `aurora-nashost-serves-dev-build` memory to reflect
   the post-#46 topology (prod on 50000, dev container profile-gated). Added
   `ops/synthetics-cloudflare.md` runbook.
 - **Skipped/blocked**: could not create the Cloudflare Skip rule — the SWAG
@@ -163,7 +163,7 @@ aurora-g15h and aurora-rmb4 (P3 openwiki transitive-dep hardening).
 ## Tools and Skills Used
 
 - **Shell (Bash)**: git, gh (PR merge/checks/watch), docker build/inspect/run,
-  cosign verify, curl diagnostics, bd, ssh to squirts. Primary workhorse.
+  cosign verify, curl diagnostics, bd, ssh to edgehost. Primary workhorse.
 - **File tools (Read/Edit/Write)**: all code and doc edits.
 - **claude-in-chrome (CDP over Playwright to axon-chrome)**: verified previews,
   portal placement, and scroll behavior on real builds. Hit the known
@@ -247,7 +247,7 @@ aurora-g15h and aurora-rmb4 (P3 openwiki transitive-dep hardening).
 ## Next Steps
 
 - **Operator (unblocks synthetics)**: `gh secret set AURORA_SYNTHETIC_TOKEN` and
-  add the Cloudflare Skip custom rule on the tootie.tv zone per
+  add the Cloudflare Skip custom rule on the example.internal zone per
   `ops/synthetics-cloudflare.md`; then re-run `synthetics.yml` to confirm green
   and close aurora-otgu.
 - **Bot PRs**: review/merge #73 (release 0.4.3) and #74 (OpenWiki update) as
diff --git a/next.config.ts b/next.config.ts
index 20efe660..f0af807d 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -1,10 +1,10 @@
 import type { NextConfig } from "next";
 
 // AURORA_DEV_ORIGIN: LAN or tailnet host that the dev server accepts CORS
-// requests from. Defaults to the tootie LAN address (10.1.0.6) used in the
+// requests from. Defaults to the nashost LAN address (192.0.2.6) used in the
 // homelab reverse-proxy setup; set to a tailnet hostname (e.g.
-// tootie.manatee-triceratops.ts.net) when Tailscale is preferred.
-const DEV_ORIGIN = process.env.AURORA_DEV_ORIGIN ?? "10.1.0.6";
+// nashost.example.ts.net) when Tailscale is preferred.
+const DEV_ORIGIN = process.env.AURORA_DEV_ORIGIN ?? "192.0.2.6";
 
 const nextConfig: NextConfig = {
   poweredByHeader: false,
diff --git a/ops/compose/production.env.example b/ops/compose/production.env.example
index bd91b8f6..64b6bb0d 100644
--- a/ops/compose/production.env.example
+++ b/ops/compose/production.env.example
@@ -2,11 +2,11 @@
 # the successful Publish image workflow. Never deploy latest or a mutable tag.
 AURORA_IMAGE_REF=ghcr.io/dinglebear-ai/aurora@sha256:0000000000000000000000000000000000000000000000000000000000000000
 AURORA_EXPECTED_SHA=0000000000000000000000000000000000000000
-AURORA_BIND_ADDRESS=100.88.16.79
+AURORA_BIND_ADDRESS=198.51.100.1
 AURORA_PUBLIC_PORT=50000
 AURORA_DOCKER_NETWORK=jakenet
 AURORA_PUBLIC_URL=https://aurora.tootie.tv
 AURORA_TENANT_URL=https://dinglebear.ai
 
-# Used only when rendering the tracked SWAG templates on squirts.
-AURORA_UPSTREAM_HOST=dookie.manatee-triceratops.ts.net
+# Used only when rendering the tracked SWAG templates on edgehost.
+AURORA_UPSTREAM_HOST=devhost.example.ts.net
diff --git a/ops/synthetics-cloudflare.md b/ops/synthetics-cloudflare.md
index 5cfbd549..1aa3cceb 100644
--- a/ops/synthetics-cloudflare.md
+++ b/ops/synthetics-cloudflare.md
@@ -3,12 +3,12 @@
 ## Symptom
 
 `Public synthetics` fails at the first request with HTTP 403 — but only from
-GitHub Actions. The same `ops/synthetic-check.sh` returns 200 from dookie and
+GitHub Actions. The same `ops/synthetic-check.sh` returns 200 from devhost and
 from a browser.
 
 ## Root cause (proven, not guessed)
 
-`aurora.tootie.tv` is proxied through **Cloudflare** (the `tootie.tv` zone;
+`aurora.tootie.tv` is proxied through **Cloudflare** (the `example.internal` zone;
 `dinglebear.ai` is *not* proxied — it answers straight from nginx/SWAG). A
 diagnostic run from a GitHub runner captured:
 
@@ -24,7 +24,7 @@ diagnostic run from a GitHub runner captured:
 
 Cloudflare challenges the request because it comes from a hosting-provider ASN
 (Azure). `curl` cannot solve a JS challenge, so every HTTP check 403s.
-Residential IPs (dookie, a browser) are not challenged, which is why it passes
+Residential IPs (devhost, a browser) are not challenged, which is why it passes
 everywhere except CI.
 
 ## Fix — narrow, header-matched Skip rule
@@ -57,7 +57,7 @@ gh secret set AURORA_SYNTHETIC_TOKEN --repo dinglebear-ai/aurora --body "$TOKEN"
 echo "Cloudflare rule value: $TOKEN"   # paste into the rule below, then clear scrollback
 ```
 
-In the Cloudflare dashboard for the **tootie.tv** zone →
+In the Cloudflare dashboard for the **example.internal** zone →
 **Security → WAF → Custom rules → Create rule**:
 
 - **Field / expression:**
@@ -93,14 +93,14 @@ four HTTP checks need the header.
 ## Resolution (2026-07-29) — self-hosted runners instead of the Skip rule
 
 The workflow now runs on the org's self-hosted runner farm
-(`runs-on: [self-hosted, unraid]`, `tootie-ci-runner-1..4`). Their egress is
+(`runs-on: [self-hosted, unraid]`, `nashost-ci-runner-1..4`). Their egress is
 the residential ISP that Cloudflare already does not challenge, so no Skip
 rule is required and the workflow no longer sends the bypass header. This
-still tests the genuine public path: tootie resolves `aurora.tootie.tv` to
+still tests the genuine public path: nashost resolves `aurora.tootie.tv` to
 Cloudflare anycast IPs (`104.21.x` / `172.67.x`), not a LAN rewrite, so DNS,
 the Cloudflare edge, SWAG, TLS, and the app are all in the loop.
 
 The `AURORA_SYNTHETIC_TOKEN` repository secret exists (set 2026-07-28; value
-stashed in `~/.config/aurora/synthetic-token.txt` on dookie, mode 0600) but is
+stashed in `~/.config/aurora/synthetic-token.txt` on devhost, mode 0600) but is
 dormant. The header-matched Skip rule above remains the documented path if
 these checks ever move back to GitHub-hosted runners.

From 96fe233fe73ba2cdc5fb0eb122b37c632a6197d2 Mon Sep 17 00:00:00 2001
From: Jake Magar <jmagar@users.noreply.github.com>
Date: Wed, 5 Aug 2026 16:02:59 -0400
Subject: [PATCH 3/3] fix(docs): restore public tootie.tv zone name in
 synthetics doc

The internal-identifier scrub replaced the bare Cloudflare zone name
with a placeholder, but left the aurora subdomain reference untouched
a few words later in the same doc (correctly, per the allowed public
app-domain exception). That made the doc self-contradictory. Restore
the bare zone-name references in the ops runbook and the theme mockup
for consistency with the rest of the file/PR.
---
 docs/mockups/theme-previews.html | 4 ++--
 ops/synthetics-cloudflare.md     | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/docs/mockups/theme-previews.html b/docs/mockups/theme-previews.html
index c7bf9492..486bb6e6 100644
--- a/docs/mockups/theme-previews.html
+++ b/docs/mockups/theme-previews.html
@@ -79,7 +79,7 @@
 <div class="tile" style="background:#0a1c2e">
   <div style="height:36px;background:#103154;display:flex;align-items:flex-end;padding:0 10px;gap:6px">
     <div class="tab" style="background:#0d2640;color:#f0f8fd;margin-bottom:0">
-      <span class="dot" style="background:#4dc8fa"></span>Aurora<span style="color:#7fa8c8;font-weight:400">— example.internal</span></div>
+      <span class="dot" style="background:#4dc8fa"></span>Aurora<span style="color:#7fa8c8;font-weight:400">— tootie.tv</span></div>
     <div class="tab" style="color:#b4d2e6;margin-bottom:0;font-weight:500">Labby</div>
     <div style="color:#7fa8c8;margin-bottom:6px;font-size:16px">+</div>
   </div>
@@ -96,7 +96,7 @@
 <!-- 5. CHROME light -->
 <div class="tile" style="background:#f5f9fc">
   <div style="height:36px;background:#dbe9f4;display:flex;align-items:flex-end;padding:0 10px;gap:6px">
-    <div class="tab" style="background:#ffffff;color:#0d2236;margin-bottom:0"><span class="dot" style="background:#0288d1"></span>Aurora<span style="color:#5a7a90;font-weight:400">— example.internal</span></div>
+    <div class="tab" style="background:#ffffff;color:#0d2236;margin-bottom:0"><span class="dot" style="background:#0288d1"></span>Aurora<span style="color:#5a7a90;font-weight:400">— tootie.tv</span></div>
     <div class="tab" style="color:#3d6070;margin-bottom:0;font-weight:500">Labby</div>
     <div style="color:#5a7a90;margin-bottom:6px;font-size:16px">+</div>
   </div>
diff --git a/ops/synthetics-cloudflare.md b/ops/synthetics-cloudflare.md
index 1aa3cceb..64733fef 100644
--- a/ops/synthetics-cloudflare.md
+++ b/ops/synthetics-cloudflare.md
@@ -8,7 +8,7 @@ from a browser.
 
 ## Root cause (proven, not guessed)
 
-`aurora.tootie.tv` is proxied through **Cloudflare** (the `example.internal` zone;
+`aurora.tootie.tv` is proxied through **Cloudflare** (the `tootie.tv` zone;
 `dinglebear.ai` is *not* proxied — it answers straight from nginx/SWAG). A
 diagnostic run from a GitHub runner captured:
 
@@ -57,7 +57,7 @@ gh secret set AURORA_SYNTHETIC_TOKEN --repo dinglebear-ai/aurora --body "$TOKEN"
 echo "Cloudflare rule value: $TOKEN"   # paste into the rule below, then clear scrollback
 ```
 
-In the Cloudflare dashboard for the **example.internal** zone →
+In the Cloudflare dashboard for the **tootie.tv** zone →
 **Security → WAF → Custom rules → Create rule**:
 
 - **Field / expression:**