> Port allocation is hash-based—deterministic from branch name, no conflicts:

> hash_val = sum(ord(c) for c in branch_name)

> django_port = 8001 + (hash_val % 99)

> Six agents, six features, one phone.

What do you mean, no conflicts? The probability of a collision with six branches and 99 ports slots is ~14% assuming optimal hashing (which this decidedly isn't).

You also don't need fail2ban, if the entire VM is behind a firewall that only allows the tailscale coordination traffic, nothing is going to reach the VM for fail2ban to work on.