Every book machine was published on one shared hostname
Every provisioned book published 80/443 behind a single app hostname that Fly load-balances across the whole app, so a request for one book could be answered by another book's machine.
A services block with ports put every book machine behind
countbean-books.fly.dev. Nothing in the product ever used that address — the
runtime is addressed one machine at a time over 6PN, and the control-plane proxy
is the only public way in — so the ports were pure exposure. Removed whole
rather than emptied: a portless service is not a middle ground, because it still
re-opens the structure.
The block was also the only thing stopping an idle book, and taking it out
exposed why that was never safe. Fly’s autostop is driven by traffic the Fly
proxy observes, and over 6PN it observes none, ever, including mid-session. A
book serving reads and writes through our proxy was stopped about 4.4 seconds
after the last call, with SOURCE: proxy in the machine event log — so the
platform’s autostop could stop a book under a live request.
The replacement was already on main and already running: an idle sweeper driven
by last_seen_at, which the proxy advances per request. It had never
transitioned a running machine only because Fly always got there first.
Scale-to-zero is unchanged; the actor is.