# Recovery Doors

audience: AI coding agents first.

status: IDLE
task IDs: #23, #24, #34, #39, #40
source request: Ensure Debian1/2 recovery access survives reboot and never repeat SSH lockout.

## Outcome

Each buildbox has proven independent recovery doors after reboot, with exact host identity and no boot-race bind failure.

## Preserved progress

- Root cause: pinned `ListenAddress` raced `tailscale0`; wildcard bind fixes it. Missing hostkeys/non-root `sshd -t` was a false diagnosis.
- Fix existed on main but initially reached only Debian1; distribution gap recorded.
- Debian2/3 later recovered and hardened.
- Three doors and RustDesk IDs are recorded in durable memory/report.
- #23/#24/#34/#39 completed claims exist.
- #40 reboot proof for Debian1/2 remains pending.

## Constraints

- Never casually mutate buildbox sshd.
- Use serialized access change workflow and retain at least one working door.
- Reboot proof is disruptive; preserve owner workloads and record before/after doors.

## Acceptance criteria

- Debian1 and Debian2 reboot.
- SSH doors return without manual intervention.
- RustDesk/alternate recovery remains available.
- Host config converges from source.

## Current receipt

Configuration fix known; reboot proof incomplete.

## Next executable action

Schedule one host at a time after workload drain, snapshot all doors, reboot, and verify every configured path before touching next host.