Fail-open default
An inability to observe a target does not prove the target has failed. Ambiguous conditions produce an alert and leave the server running.
Safety architecture
Automation should know when not to act.
The main risks in automated recovery are false positives and feedback loops. RecoverNode is designed to stop disruptive actions when evidence becomes ambiguous.
Local authority
The observer collects evidence but does not reboot targets. The protected host validates its own health before taking recovery action.
Recovery budgets
Restart and reboot limits, cooldown periods, escalating backoff and persistent lockout prevent repeated power-cycle loops.
Configuration validation
An invalid Nginx configuration triggers lockout rather than repeated restarts or a reboot that cannot correct the configuration.
Independent watchdog
A hardware watchdog protects against a complete operating-system freeze without relying on the observer or network connectivity.
Auditable actions
Health failures, restart attempts, cooldown decisions, budget exhaustion, recovery and lockout are written to the system journal and state files.
Security boundary: RecoverNode does not require the observer to hold remote reboot credentials in its default architecture.