_take_ip and _new_decky were closures capturing outer-scope state. Promoted to module-level with explicit parameters. seen_service_pairs name makes the intent clear — it prevents the same service frozenset from being assigned repeatedly.
