Listeners came off ::2 before the address did — the other order fails to bind on restart — and the address stayed up until the CNAME to fmr-1 had landed, since dropping it earlier would have broken ACME renewal for the name the certificate is issued to. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>