docs: fmr is on .150/::150 only; ::2 removed and verified across a reboot

Listeners came off ::2 before the address did — the other order fails to
bind on restart — and the address stayed up until the CNAME to fmr-1 had
landed, since dropping it earlier would have broken ACME renewal for the
name the certificate is issued to.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/build-status.md

@@ -1154,13 +1154,22 @@ and a stray process outside its config can still pollute a reserved address. A s
 checking our own configuration, and is not yet built.
 
 The admin UI and the ACME responder now take comma-separated addresses like every other listener;
-they were single-address, which is why the UI could only ever live on `::2`. It serves on
+they were single-address, which is why the UI could only ever live on `::2`. It serves on `.150:443` and
-`.150:443`, `[::150]:443` and `[::2]:443` — `::2` retained until `fmr.echo-lot.app` becomes a CNAME
+`[::150]:443`; sshd on `.150:2322` and `[::150]:2322`.
-to `fmr-1` (`.150`/`::150`), since dropping it first would break both the UI and ACME renewal for
-the very name the certificate is issued to. sshd likewise now listens on `.150`, `::150` **and**
-`::2`, added rather than moved for the same reason.
 
-The point of all this: `fmr.echo-lot.app` gains an A record, so the server stops being reachable
+`::2` is gone entirely — unbound, then removed from `/etc/systemd/network/ext.network`. The
+transition kept it bound throughout and dropped it only after the CNAME landed, because removing it
+first would have broken both the UI and ACME renewal for the very name the certificate is issued
+to. Listeners came off before the address did, in that order, or the services would have failed to
+bind on restart.
+
+Verified after a full reboot: `fmr.echo-lot.app` answers 200 over both families, `.151`/`::151` are
+closed on 80 and 443, canary DNS is still up on `.151`, and neither `::2` nor the beacon returns.
+(`echolot-server` is `After=network-online.target` with `Restart=on-failure`, which is what makes
+binding specific addresses safe across a boot — a wildcard bind would not have needed it, and that
+is the trade for the reserved addresses being meaningful.)
+
+The point of all this: `fmr.echo-lot.app` gained an A record, so the server stopped being reachable
 only over IPv6 — which is what made it unreachable from a phone with no working IPv6, presenting as
 "this host does not exist" in two different browsers.