The console routes to nodes (rendezvous), so it is the single public port: server -> :8081 (no host forward), console -> :8080, 8090 forward dropped. Verified: node unreachable from host, routed workstream creation lands on turnstone-vm-main at 127.0.0.1:8081, route/command proxy works, cluster view tracks the workstream.