The mesh relay is a raw unauthenticated forward to the app's loopback, and whether it or the gate owned a fips0 ULA port was decided by a bind race — the dev box happened to be safe because the gate bound first. The relay now skips ports declared auth: gated and tears down any existing bridge for a port that became gated since it was bridged (catalog refresh), releasing the bind for the gate's next sweep. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>