Every book machine was published on one shared hostname

Every provisioned book published 80/443 behind a single app hostname that Fly load-balances across the whole app, so a request for one book could be answered by another book's machine.

A services block with ports put every book machine behind countbean-books.fly.dev. Nothing in the product ever used that address — the runtime is addressed one machine at a time over 6PN, and the control-plane proxy is the only public way in — so the ports were pure exposure. Removed whole rather than emptied: a portless service is not a middle ground, because it still re-opens the structure.

The block was also the only thing stopping an idle book, and taking it out exposed why that was never safe. Fly’s autostop is driven by traffic the Fly proxy observes, and over 6PN it observes none, ever, including mid-session. A book serving reads and writes through our proxy was stopped about 4.4 seconds after the last call, with SOURCE: proxy in the machine event log — so the platform’s autostop could stop a book under a live request.

The replacement was already on main and already running: an idle sweeper driven by last_seen_at, which the proxy advances per request. It had never transitioned a running machine only because Fly always got there first. Scale-to-zero is unchanged; the actor is.