Only off-LAN-reachable workstations (e.g. republic-laptop, mac-mini) need to join Netbird. LAN-reachable LXCs/VMs on 192.168.8.0/24 don't — they're already directly reachable, and off-LAN clients reach them via hubris's routed 192.168.8.0/24 Netbird network resource. Brings the runbook in line with oikos/ontology.yaml's lifecycle transition, which already says "mesh-joined-if-needed". Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>