The safety-net timer in Step 3 is the part that usually gets skipped, and it's the one that saves you. Especially the note about keeping nohup — I've seen people lose the disable job when the SSH session that started it died, which is exactly the lockout case.

Also appreciated calling out leftover ufw allow ssh / Anywhere rules and that first-match order means the IP allow changes nothing until that line is gone. Using $SSH_CLIENT instead of a "what is my IP" site is the other detail that avoids a surprising source address behind NAT or a provider mapping.