diff --git a/dns/internal.yaml b/dns/internal.yaml
index d445bcf..85009aa 100644
--- a/dns/internal.yaml
+++ b/dns/internal.yaml
@@ -118,5 +118,6 @@ aliases:
   - {name: searxng,   site: nh3, target: nh3-docker, note: moved off ana-docker 2026-09-03 — colo egress (38.120.12.42) is CAPTCHA-gated by search engines; NH3 egresses residentially}
   - {name: gateway,   site: ana, target: ana-docker, note: LiteLLM gateway :4000}
   - {name: booth,     site: nh3, target: nh3-dev,    note: The Booth :8090}
+  - {name: wherethef, site: nh3, target: nh3-dev,    note: WhereTF :8093}
   - {name: homepage,  site: esh, target: esh-docker-vm, note: fleet dashboard :5100}
   - {name: scriberr,  site: ana, target: ana-ml2,     note: transcription + diarization :8080 (GPU1)}
diff --git a/stacks/homepage/conf/docker.yaml b/stacks/homepage/conf/docker.yaml
index f47ca10..69b5874 100644
--- a/stacks/homepage/conf/docker.yaml
+++ b/stacks/homepage/conf/docker.yaml
@@ -17,15 +17,20 @@ nh3-pfi-docker:
   host: 10.100.50.40
   port: 2375
 
-ana-ml2-docker:
-  host: 10.250.50.54
-  port: 2375
+# ana-ml2-docker DISABLED 2026-09-07: 10.250.50.54:2375 is not reachable from
+# esh-docker-vm (docker API not exposed/listening — ana-docker 10.250.50.70:2375
+# on the SAME subnet IS reachable, so this is host-specific, not routing). A dead
+# host here hangs the entire /api/services aggregation until its TCP connect times
+# out. Re-enable once ana-ml2 exposes the docker API and it is reachable from ESH.
+# ana-ml2-docker:
+#   host: 10.250.50.54
+#   port: 2375
 
-# irv-ml1 — reachable ONLY via WireGuard tunnel, so docker auto-discovery
-# traffic traverses the tunnel. If WG drops, homepage will show irv-ml1
-# services as offline until reconnect.
+# irv-ml1 — moved 10.100.79.3 -> 10.6.110.50 on 2026-09-06 (headscale cutover;
+# the old wg0 tunnel IP is dormant and no longer answers). Reachable from
+# esh-docker-vm via the mesh (10.6.110.50:2375 verified OPEN 2026-09-07).
 irv-ml1-docker:
-  host: 10.100.79.3
+  host: 10.6.110.50
   port: 2375
 
 # Example TLS socket (if/when a host moves off plaintext 2375):
diff --git a/stacks/homepage/conf/services.yaml b/stacks/homepage/conf/services.yaml
index 9af2f36..edd24d5 100644
--- a/stacks/homepage/conf/services.yaml
+++ b/stacks/homepage/conf/services.yaml
@@ -27,6 +27,13 @@
       icon: mdi-filmstrip
       siteMonitor: http://10.100.10.50:8090/healthz
       description: Media drop + upload-for-pickup + the standing agent link board — nh3-dev, 24h TTL except kept boards
+  # Manual entry — WhereTF is a user-level systemd service on nh3-dev (Bun,
+  # like the Booth), so Homepage can't auto-discover it.
+  - WhereTF:
+      href: http://10.100.10.50:8093/
+      icon: mdi-magnify-scan
+      siteMonitor: http://10.100.10.50:8093/healthz
+      description: Photograph drawers; ask where the f X is, or where a new thing should go — nh3-dev, LAN only
   - The Henge:
       href: http://park.phasefinal.com:8420/
       icon: mdi-clipboard-check