Phones on the FIPS mesh reach the node at http://[<fips0 ULA>], but every shipped nginx config listened on IPv4 only — nothing answered [::]:80/443, so mesh HTTP failed with the tunnel fully healthy (found live on framework-pt during the vc24 5G session, 2026-07-23). Canonical conf gains listen [::] lines and patch_nginx_conf self-heals deployed nodes (covers the sites-enabled -> archipelago-http dev variant via the existing canonicalize pass); validated by the existing nginx -t + rollback flow. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>