One small part per post: a probe, a daily job, a trick, a trap that cost an afternoon.
A Mac sits at home behind a normal router, no public IP, no port forwarding, and I open a shell on it from a laptop anywhere. Tailscale does the network and the keys, MagicDNS gives it a name. Plus the three things to check when it stops answering.
An older MacBook does fine as an always-on machine for scheduled jobs and builds, if you stop it from sleeping, let it log itself in, and leave it alone. The handful of settings that matter and what to re-check after every macOS update.
Scheduled jobs on a Mac belong in a launchd plist: they survive reboots, run as your user, and log where you can find them. One minimal plist, the commands to load it, and the privacy gotcha that makes a job under Documents fail with Operation not permitted.
launchctl kickstart -k restarts a launchd job with the configuration it already has in memory. Edit the plist, kickstart, and the service comes back running the old settings while looking freshly restarted. How it bites and the two lines that fix it.
