An unbound `-L port:host:port` listens on every loopback family. When another
process already holds the IPv4 port, the IPv6 bind still succeeds and
ExitOnForwardFailure does not fire: the tunnel comes up on [::1] while every
client resolving 127.0.0.1 reaches the other process instead.
This is how the local State Hub cache impersonated the primary from
2026-07-08 onward — both on port 8000, separated only by IP family.
Refs CUST-WP-0067-T02, ADR-010
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
tegwick
22138474b8