diff --git a/engine/changelog.md b/engine/changelog.md
index aba446e..b710562 100644
--- a/engine/changelog.md
+++ b/engine/changelog.md
@@ -137,3 +137,5 @@
 ## 2026-06-28T09:00:01Z — sweep deferred (competing GPU process: 4201 node /usr/bin/peertube-runner server --enable-job vod-hls-transcoding --enable-job vod-audio-merge-transcoding --enable-job live-rtmp-hls-transcoding --enable-job video-studio-transcoding --enable-job video-transcription)
 
 ## 2026-06-29T09:00:02Z — sweep deferred (competing GPU process: 4201 node /usr/bin/peertube-runner server --enable-job vod-hls-transcoding --enable-job vod-audio-merge-transcoding --enable-job live-rtmp-hls-transcoding --enable-job video-studio-transcoding --enable-job video-transcription)
+
+## 2026-06-30T09:00:01Z — sweep deferred (competing GPU process: 4201 node /usr/bin/peertube-runner server --enable-job vod-hls-transcoding --enable-job vod-audio-merge-transcoding --enable-job live-rtmp-hls-transcoding --enable-job video-studio-transcoding --enable-job video-transcription)
diff --git a/engine/lint-report.md b/engine/lint-report.md
index b2bd39b..6f2acb3 100644
--- a/engine/lint-report.md
+++ b/engine/lint-report.md
@@ -1,6 +1,6 @@
 # Vault Lint Report
 
-Generated: 2026-06-29T18:00:06Z  |  Docs scanned: 97  |  Elapsed: 0.0s
+Generated: 2026-06-30T06:00:04Z  |  Docs scanned: 97  |  Elapsed: 0.0s
 
 ## Summary
 
diff --git a/vault/.obsidian/workspace.json b/vault/.obsidian/workspace.json
index ab1be14..9c7ecc2 100644
--- a/vault/.obsidian/workspace.json
+++ b/vault/.obsidian/workspace.json
@@ -199,6 +199,11 @@
   },
   "active": "17bd4a6166f789d0",
   "lastOpenFiles": [
+    "runbooks/headscale-onboard-node.md.tmp.246153.9adf70459e77",
+    "runbooks/headscale-onboard-node.md.tmp.246153.0132e66f616c",
+    "runbooks/headscale-onboard-node.md.tmp.246153.52329ab2810a",
+    "runbooks/headscale-onboard-node.md.tmp.246153.033a7189f5f5",
+    "runbooks/headscale-onboard-node.md.tmp.246153.5eaf55f2b459",
     "runbooks/ia-cli-reference.md.tmp.3603785.daa56d288051",
     "runbooks/pipeline-patterns.md.tmp.3603785.ea95256eaac1",
     "runbooks/headless-browser-page-verification.md.tmp.3603785.4eb1d115aefe",
@@ -206,11 +211,6 @@
     "runbooks/headless-browser-page-verification.md",
     "runbooks/headless-browser-page-verification.md.tmp.3603785.012d08be6da5",
     "docs/software/central.md.tmp.3603785.6c9205f08816",
-    "docs/software/central.md.tmp.3603785.ecf07e484b59",
-    "runbooks/central-deploy-cutover.md.tmp.3603785.4e7865cbcf79",
-    "runbooks/central-deploy-cutover.md.tmp.3603785.af9622a37ece",
-    "runbooks/central-deploy-cutover.md.tmp.3603785.45f414c68859",
-    "runbooks/central-deploy-cutover.md.tmp.3603785.ae5558fd7b31",
     "runbooks/central-deploy-cutover.md",
     "runbooks/fleet-magicdns-resolved-migration.md",
     "projects/fleet-platform-baseline.md",
diff --git a/vault/runbooks/headscale-onboard-node.md b/vault/runbooks/headscale-onboard-node.md
index f1a2cdd..7ab3c50 100644
--- a/vault/runbooks/headscale-onboard-node.md
+++ b/vault/runbooks/headscale-onboard-node.md
@@ -10,22 +10,22 @@ related:
   - [[caddy]]
   - [[meshtastic-headscale-runbook]]
   - [[lxc-service-migration]]
-updated: 2026-06-18
+updated: 2026-06-30
 ---
 # Headscale / Tailscale — Onboard a New Node
 
 Standard procedure to bring any new system (Proxmox host, bare-metal, VM, or LXC) onto the Echo6 tailnet.
 
 ## Overview
-- **Control server:** Headscale on Contabo — `ssh root@100.64.0.1`, Docker container `headscale`.
+- **Control server:** Headscale on **edge2 CT107** — `ssh edge2` then `sudo pct exec 107 -- docker exec headscale headscale <cmd>`, Docker container `headscale`. (Migrated off Contabo 2026-06-19.)
 - **Login server:** `https://vpn.echo6.co` · **Admin UI (Headplane):** `https://vpn.echo6.co/admin`
 - **User/namespace:** all Echo6 nodes join `echo6` (user ID 1).
 - **MagicDNS base domain:** `echo6.mesh` (e.g. `ping data.echo6.mesh`).
 - **Naming:** lowercase, hyphens OK, no dots/underscores. Matches `--hostname` and the cortex SSH alias.
 
-## 1. Generate a preauth key (on Contabo)
+## 1. Generate a preauth key (on edge2 CT107)
 ```bash
-ssh root@100.64.0.1 'docker exec headscale headscale preauthkeys create --user echo6 --reusable --expiration 1h'
+ssh edge2 "sudo pct exec 107 -- docker exec headscale headscale preauthkeys create --user echo6 --reusable --expiration 1h"
 # If the name form errors, use the user ID: --user 1
 ```
 
@@ -71,7 +71,7 @@ tailscale up --login-server=https://vpn.echo6.co --auth-key=<KEY> --hostname=<NA
 ```bash
 tailscale status
 tailscale ip -4
-ssh root@100.64.0.1 'docker exec headscale headscale nodes list'   # confirm node + assigned 100.64.0.x
+ssh edge2 "sudo pct exec 107 -- docker exec headscale headscale nodes list"   # confirm node + assigned 100.64.0.x
 ```
 Headscale assigns the IP **sequentially at registration** — don't pre-assign; read it back here.
 
@@ -103,7 +103,7 @@ Proxmox host on Contabo. Preauth key → `tailscale up --login-server=https://vp
 
 ## Checklist
 ```
-[ ] Preauth key generated on Contabo (user echo6)
+[ ] Preauth key generated on edge2 CT107 (user echo6)
 [ ] Tailscale installed + tailscaled enabled
 [ ] DNS-bootstrap drop-in in place (LXC: required)
 [ ] (LXC) TUN device added to CT config