Happened live on the bench: the box ran the debug image (SSH baked — its only remote management channel), took an A/B update to a release bundle, health-gated, committed — and dropped SSH by design. Recovery required a console the operator could not practically use (generated dashboard password too long to type) and ended in a stick reinstall.
The release image being shell-less is correct. The gap is the silent transition: nothing warned that this install would remove the channel performing it.
Fix direction: stamp the variant into the image/bundle metadata (debug|release — the SSH bake step already knows), and have the install path warn or require confirmation when a debug-variant system installs a release-variant bundle. The docs note from #816 records the trap; this issue is the guard.
🤖 Generated with Claude Code
Happened live on the bench: the box ran the debug image (SSH baked — its only remote management channel), took an A/B update to a release bundle, health-gated, committed — and dropped SSH by design. Recovery required a console the operator could not practically use (generated dashboard password too long to type) and ended in a stick reinstall.
The release image being shell-less is correct. The gap is the silent transition: nothing warned that this install would remove the channel performing it.
Fix direction: stamp the variant into the image/bundle metadata (debug|release — the SSH bake step already knows), and have the install path warn or require confirmation when a debug-variant system installs a release-variant bundle. The docs note from #816 records the trap; this issue is the guard.
🤖 Generated with Claude Code