● lab is live

Deployed by Kamal via GitHub Actions → GHCR.

Served by a non-root container bound to 127.0.0.1:4001,
fronted by Caddy with a Let's Encrypt certificate.

The DNS sinkhole on this box was never touched.

Redeploy #2 via kamal-proxy ✓