Function env_bind_address 

pub fn env_bind_address(port: u16) -> String

The whole address a Serve statement binds — host AND port, composed HERE so no tier can build one of its own.

★ THE HOST HAD TO BECOME AN INPUT. Both tiers used to spell format!("127.0.0.1:{}", env_port_override(port)) at their own bind site, which meant a largo build --release binary in a container, on Fly, Render or a k8s pod bound loopback and was unreachable from outside its own network namespace — while docs/web.md recommended exactly that deployment. Every test dialed 127.0.0.1 from the same host, so nothing caught it.

★ AND WHY IT RETURNS THE WHOLE STRING rather than just the host: two callers composing “the host” with “the port” is two chances to compose it wrongly, and IPv6 is where that bites (see bind_address). One function answers the question both sites are actually asking. ★ IT TAKES THE PORT IT IS GIVEN. Reading LOGOS_PORT in here as well would apply the port override TWICE — harmless today because the environment dominates either way, and exactly the kind of hidden second application that stops being harmless the moment the rule gains a case. One function reads the host, one reads the port, and a call site shows both: env_bind_address(env_port_override(8080)).