the door you never close behind you

Hardening runs once, unwatched, on a machine whose only access path it is about to change. That makes it the most dangerous program in the estate: it is the change that removes the ability to make changes. A machine that closes its permissive door before proving the restrictive one is not broken. It is running perfectly, doing its job, and unreachable.

The temptation is to close first, because closing is the point. The discipline is to prove the new path from outside the machine being changed, then remove the old one in the same session, so there is never a moment with zero doors. One host in this estate had its remote access closed on the strength of a plan rather than a test: the replacement keys had been described but not distributed, and the recovery was a console session measured in hours instead of seconds.

The other half is not trusting the replacement because the plan says it works. The version worth defending is the boring one: the new path answers from a different machine, the old path still answers, and only then is the old path closed.

What this proves is that access is the one property you cannot repair from inside after you break it, so it gets the slowest, most checked procedure in the fleet — not the fastest one.