Deployment needs two DNS records this script doesn't manage: a split-horizon newsfeed.internal -> oolon (the mesh access path), and NO internal override for the public rob.fyi (an internal record pointing it elsewhere makes mesh clients land on the wrong vhost/cert — which is exactly what happened: rob.fyi resolved internally to the office proxy 10.6.0.46 and served admin.zap.pics). Surface both at the end of every run so the gap is visible. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016fKZzDpvjiJ9eYbPGgJvUP