- data/mesh-hosts.json: "dx": {"hide_homelan": true} (with note). Data for apricot/pear/fennel/lan/services fully preserved for recovery.
- bin/mesh-hosts-render + bin/host-apply: respect the flag — filter to .class=="cloud" hosts only (yuzu, lime), emit dx mode note in headers, services filtered too.
- When true: generated /etc/hosts mesh-block and ~/.ssh/config net-tools fleet block only contain DO/cloud (homelan names like apricot.lan, bare fennel etc. hidden). dx-forges (ctforge/mcforge) unaffected at bottom.
- `net sync` (and direct renderers) now produce clean DO-only configs.
- README updated. To recover: set false + net sync.
Fulfills "hide the homelan config... now only use DO... may try to recover homelan so dont delete it".
The DigitalOcean backend droplet (was bare ssh alias lilith-store-backend,
209.38.51.98) joins wg1 at 10.9.0.5 as a first-class cloud-class member —
runs quinn.api INTERNAL, the MCP gateways, DO Managed PG access, and private
workers (general backend node, not MCP-only). The .5 slot was held by
strawberry (Quinn's iPhone), which never worked reliably and is now off the
mesh; re-enrollable later via wg-phone-add. public=null so host-apply renders
the wg path (private node, no public app ports; reached via ProxyJump yuzu).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
