The handoff arrives in installments

Handoff isn't a meeting; it's four PATCH requests, a week apart.

Week one, the client's team gets a permission group with the display only: they watch their new system being operated. Week two, the group gains files: they touch content, they can't touch processes. Week three, terminal: they run the runbook themselves while you're still around to catch them. Week four, ownership of the server transfers, and your access is the thing that expires.

Every step is one change to a permission document the proxy enforces on every request. Nobody gets root on day one and panics. Nobody is still asking you to deploy for them in month six.