The definition of socket-binding-group resources needs cleaning up a bit. There's some sharing of code between the domain wide binding resources vs what's used for the server and HC.
1) The capability registered for the domain-wide SBG may not really be appropriate for server/HC. IIRC nothing references the server/HC SBG so it doesn't need this cap, and having it in the HC case raises the potential for cap conflicts with the domain-wide sbgs. This is minor.
2) The remove handler used for server/HC only executes Stage.RUNTIME on a server which means nothing happens on the HC.