I reverse proxy everything through a Caddy instance running on the same machine so I avoid the firewall dance entirely by just prefixing all my port assignments in the compose file with the loopback IP (eg. 127.0.0.1:3000:3000). Nftables denies all but 80 and 443 and I don't have to worry about restarts/flushes breaking things.
>We WANT to know that there's a collision in transmission so that we know we need to retransmit
Digital trunked public safety systems solved this problem decades ago. If you key up when the frequency is in use you get a distinct rejected tone. I'd think prevention is far preferable to sorting it out once everyone's finished walking on each other.