One character in /etc/shadow locked me out

I built a small container to run coding agents on my ZimaBoard, reachable over SSH, key-only, no root login. It is the same box from the Tailscale login that could never finish. The first login was refused: Permission denied (publickey) Narrowing it down An ssh -v trace showed my machine offering the right key and the server rejecting it, so the fault was inside the container. The sshd config was fine: sshd -T confirmed PasswordAuthentication no, PermitRootLogin no and AllowUsers dev, all as intended.