Maps a hostname to a network-accessible address or service, and applies that mapping on enrolled devices. It does not reserve a suffix and does not prevent shadowing public names.

Certificate, origin, redirect, cookie, and content-security-policy failures remain visible: Remap provides routing and does not relocate web applications.

Milestone M0 is complete: domain model, exact and wildcard matching, immutable registry snapshot, and an offline CLI contract. It does not yet alter DNS, bind privileged ports, install services, or modify trust.