Map every running service to NS1 host names.

Document machine DNS (NS1.GEORGELAMBERT.ORG) and suggested
*.zapier.georgelambert.org names for public doors versus loopback workers.

packages/overview/11-hostnames.md

@@ -0,0 +1,68 @@
+# Host names
+
+All of the running Verae Time × Zapier processes on **2026-09-11** live on one machine unless noted.
+
+## Machines
+
+| Fleet id | Hostname | Address | Role |
+|----------|----------|---------|------|
+| `local` (NS1 all-in-one) | **NS1.GEORGELAMBERT.ORG** | `70.88.205.138` | Control plane + archive workers + keep |
+| `ns1` (SSH worker profile) | **NS1.GEORGELAMBERT.ORG** | `70.88.205.138` | Same box; SSH spawn unused while all-in-one is local |
+| `lan-134` | *(none yet)* | `70.88.205.134` | Disabled until SSH works |
+
+Loopback on that box is `127.0.0.1`. Do **not** publish NATS `:4222`.
+
+## DNS that already exists
+
+| Hostname | What it is |
+|----------|------------|
+| **NS1.GEORGELAMBERT.ORG** | The server |
+| **zapier.georgelambert.org** | Documentation catalog (Caddy → `/SSD2/sites/zapier.georgelambert.org`) |
+| **git.georgelambert.org** | Forgejo (SSH **2223**) |
+| **api.veraetime.net** | Live Verae chain (not this lab; lab uses `MOCK_VERAE`) |
+
+## Service → hostname (NS1 all-in-one)
+
+Suggested public names are under `zapier.georgelambert.org`. They are **not** in Caddy yet except the docs site. Until they are, use `NS1.GEORGELAMBERT.ORG:<port>` (or SSH tunnel for loopback).
+
+| Service | Port | Bind now | Machine hostname | Suggested service hostname | Public? |
+|---------|------|----------|------------------|----------------------------|---------|
+| Operator console (fleet) | 3850 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `fleet.zapier.georgelambert.org` | LAN/operator |
+| Customer portal (access-web) | 3021 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `portal.zapier.georgelambert.org` | **yes** (`/portal/`) |
+| Customer API (access-api) | 3022 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `api.zapier.georgelambert.org` | **yes** (API keys) |
+| S2S leaf (access-leaf) | 3023 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `leaf.zapier.georgelambert.org` | partners only |
+| Zapier plane (access-zapier) | 3024 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `zap.zapier.georgelambert.org` | **yes** (Zapier HTTPS) |
+| Staff plane (access-staff) | 3025 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `staff.zapier.georgelambert.org` | staff |
+| Staff IAM | 3028 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `iam.zapier.georgelambert.org` | staff |
+| Staff session | 3027 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `login.zapier.georgelambert.org` | staff |
+| Customer service | 3011 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `cs.zapier.georgelambert.org` | staff |
+| Sales | 3012 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `sales.zapier.georgelambert.org` | staff |
+| Accounting | 3013 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `acct.zapier.georgelambert.org` | staff |
+| Middleware | 3100 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `mw.zapier.georgelambert.org` | internal HTTPS |
+| Docs catalog | 443 | Caddy | NS1.GEORGELAMBERT.ORG | **zapier.georgelambert.org** | **yes** |
+| Forgejo | 443 / SSH 2223 | Caddy | NS1.GEORGELAMBERT.ORG | **git.georgelambert.org** | **yes** |
+| zappier-edge (admin) | 13000 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | `edge.zapier.georgelambert.org` (tunnel only) | **no** — host `:3000` is another app |
+| Access authz | 3020 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `authz.zapier.georgelambert.org` | no (internal) |
+| Identity | 3026 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `id.zapier.georgelambert.org` | no |
+| Account-balance | 3010 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `books.zapier.georgelambert.org` | no |
+| jobs.events mailbox | 3030 | `0.0.0.0` | NS1.GEORGELAMBERT.ORG | `events.zapier.georgelambert.org` | no |
+| Keep | 3860 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | `keep.zapier.georgelambert.org` | no |
+| Keep watch | 3861 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | *(same host, watch)* | no |
+| NATS JetStream | 4222 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | `nats.zapier.georgelambert.org` | **never public** |
+| NATS monitor | 8222 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | *(loopback)* | no |
+| job-poller-0 | 13200 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | *(worker)* | no |
+| webhook-deliver-0 | 13300 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | *(worker)* | no |
+| archive-aggregator-0 | 13400 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | *(worker)* | no |
+| archive-worm-0 | 13500 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | *(worker)* | no |
+| archive-worm-1 | 13501 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | *(worker)* | no |
+| archive-worm-2 | 13502 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | *(worker)* | no |
+| tree-node-0 | 13600 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | *(worker)* | no |
+| tree-node-1 | 13601 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | *(worker)* | no |
+| tree-node-2 | 13602 | `127.0.0.1` | NS1.GEORGELAMBERT.ORG | *(worker)* | no |
+| Simulator | 3847 | off (`min 0`) | — | `sim.zapier.georgelambert.org` | no |
+
+Reach loopback ports from a laptop with:
+
+```bash
+ssh -L 13000:127.0.0.1:13000 -L 4222:127.0.0.1:4222 -L 3860:127.0.0.1:3860 marchon@NS1.GEORGELAMBERT.ORG
+```

packages/zapier-decisions/LOG.md

@@ -32,6 +32,11 @@
 - Disable lan-134 unless `FLEET_ENABLE_LAN134=1`.
 - SSH spawn timeout 8s; failed hosts skipped.
 
+## 2026-09-11 — host names
+
+- Mapped every running service to **NS1.GEORGELAMBERT.ORG** (`70.88.205.138`).
+- Suggested `*.zapier.georgelambert.org` names for public doors; only `zapier.georgelambert.org` (docs) and `git.georgelambert.org` exist in Caddy today.
+
 ## 2026-09-11 — docs sync, bootstrap, NS1 all-in-one
 
 - Catalog and ops docs: public portal is access-web `:3021/portal/`; edge is loopback; IAM + keep listed.

scripts/build-docs-site.py

@@ -43,6 +43,7 @@ SECTIONS = [
             ("packages/overview/06-address-routing.md", "Address routing"),
             ("packages/overview/08-diagrams.md", "Architectural diagrams"),
             ("packages/overview/10-docs-sync.md", "Docs sync: portal, IAM, keep, bootstrap"),
+            ("packages/overview/11-hostnames.md", "Service → machine and DNS host names"),
         ],
     ),
     (