The cutover unit joined dankserver_appnet but dropped the compose-era 0.0.0.0:3923 mapping (live inspect: bridge, 3923 published), so copyparty listened inside the netns while the host refused. New seam asserts every host-facing port matches the pre-cutover PortBindings: romm 8085->8080, jellyfin 8096, calibre-web 8083, copyparty 3923.