Setup checklist

1. Know what’s reachable
2. Prefer attended when you can
3. Lock the account, not just the tool
4. Separate “remote in” from “browse out”
5. Plan the failure path