Docs: Explain transactional SSH hardening

tests/setup/readme-contract

@@ -36,6 +36,42 @@ elif (( claimed != actual )); then
     note "the README says $claimed contracts; there are $actual"
 fi
 
+# ── Root server bootstrap ───────────────────────────────────────────────────
+#
+# This path runs before the repository exists on a fresh VPS. Its safety
+# properties need to be stated beside the public `boot --server` example, not
+# inferred from the shell implementation or buried in a fixture.
+
+bootstrap_doc="$(sed -n '/^That command also works from a brand-new VPS/,/^`install` asks/p' "$readme" | tr '\n' ' ')"
+
+require_bootstrap_doc() {
+    local pattern="$1" explanation="$2"
+    grep -qiE "$pattern" <<<"$bootstrap_doc" || note "$explanation"
+}
+
+require_bootstrap_doc 'verified target key' \
+    'the root bootstrap docs do not require a verified target key'
+require_bootstrap_doc '700.*600|600.*700' \
+    'the root bootstrap docs do not state the exact SSH ownership and modes'
+require_bootstrap_doc 'hardening (is )?unavailable.*(without|until).*key' \
+    'the root bootstrap docs do not say hardening is unavailable without a key'
+require_bootstrap_doc 'sshd -t' \
+    'the root bootstrap docs do not name sshd -t validation'
+require_bootstrap_doc 'atomic.*same.directory|same.directory.*atomic' \
+    'the root bootstrap docs do not describe the atomic same-directory drop-in'
+require_bootstrap_doc 'detected (SSH )?unit.*reload|reload.*detected (SSH )?unit' \
+    'the root bootstrap docs do not describe reloading the detected SSH unit'
+require_bootstrap_doc 'restores? (the )?previous drop-in.*(validation|reload)|(validation|reload).*restores? (the )?previous drop-in' \
+    'the root bootstrap docs do not promise rollback on validation or reload failure'
+require_bootstrap_doc 'fixture contracts.*(these|this) (path|branch)|fixture contracts.*test' \
+    'the root bootstrap docs do not limit proof to fixture contracts'
+require_bootstrap_doc 'no real daemon reload.*panama test --safe|panama test --safe.*no real daemon reload' \
+    'the root bootstrap docs imply a live daemon reload under the safe suite'
+
+if grep -qiE 'merely writes? (the )?(SSH )?(drop-in|file)|reload failure.*ignored|ignores? .*reload failure' <<<"$bootstrap_doc"; then
+    note 'the root bootstrap docs weaken the transaction by treating the write or reload failure as harmless'
+fi
+
 # ── Documented subcommands exist ─────────────────────────────────────────────
 #
 # A README listing a command the dispatcher does not have sends somebody to a