## User
- **User:** Howard Enos (howard)
- **Machine:** ACG-TECH03L
- **Role:** tech

## Session Summary

Howard flagged that the old install of his machine still appeared in the Tailscale tailnet as
`acg-tech03l` (offline, last seen 2h ago) and suggested removing the stale node to avoid a
duplicate.

Before taking any action against the tailnet, verified the facts. Read `.claude/identity.json`
(machine = `ACG-TECH03L`) and ran `tailscale status` / `tailscale status --json`. Confirmed the
current live node registers as `acg-tech03l-1` (100.113.43.66, online, howard@) — Tailscale
appended the `-1` suffix when this install re-registered — while the old `acg-tech03l`
(100.113.45.7, offline 2h, howard@) is the orphaned prior registration of the same physical
machine. Both nodes are howard-owned, so the offline one is a safe delete.

Checked the vault for a Tailscale admin API token to script the deletion. The only `tailscale`
reference is inside `infrastructure/pfsense-firewall.sops.yaml` (a node auth key, not an admin
API token); no `tailscale/` subdir, no `tskey`/`api.tailscale` entries. The `tailscale` CLI
cannot delete tailnet nodes (admin API / console only). Concluded that minting an API token for a
single one-off cleanup was not worth it, and handed Howard the exact node identity plus the
admin-console removal steps — matching his original suggestion.

Also offered an optional follow-up: after deleting the stale node, run
`tailscale up --reset --hostname acg-tech03l` to reclaim the clean base hostname (drop the `-1`
suffix). Left that pending Howard's confirmation.

## Key Decisions

- Verified machine identity and tailnet node ownership BEFORE any delete — a tailnet node delete
  is outward-facing/hard-to-reverse, and deleting the wrong (live `-1`) node would drop this
  machine off the tailnet.
- Did not mint a Tailscale admin API token for a one-off cleanup; pointed Howard to the admin
  console (his suggested path) instead. No admin token exists in the vault to script it.
- Recommended matching the stale node by IP (100.113.45.7 / "offline, 2h ago"), not by name,
  since `acg-tech03l` and `acg-tech03l-1` differ only by suffix and are easy to confuse.

## Problems Encountered

- No Tailscale admin API credential in the vault, so programmatic deletion was not possible.
  Resolved by handing off the console removal steps with the precise device identity.

## Configuration Changes

- None. No files modified. (Session log added by /save.)

## Credentials & Secrets

- None created or discovered. Confirmed no Tailscale admin API token is vaulted; the only
  `tailscale` reference is a node auth key inside `infrastructure/pfsense-firewall.sops.yaml`.

## Infrastructure & Servers

Tailnet: `tailea2889.ts.net`

| Node | Tailscale IP | Status | Device ID | Action |
|------|-------------|--------|-----------|--------|
| `acg-tech03l-1` | 100.113.43.66 / fd7a:115c:a1e0::dc38:2b43 | online (current machine) | `nhePgky8rB11CNTRL` | KEEP |
| `acg-tech03l` | 100.113.45.7 / fd7a:115c:a1e0::8e38:2d07 | offline, last seen 2h ago | `na9RzMbRmg11CNTRL` | REMOVE (stale duplicate) |

Both owned by `howard@`; same physical machine (ACG-TECH03L, Windows arm64).

## Commands & Outputs

- `command -v tailscale` -> `/c/Program Files/Tailscale/tailscale`
- `tailscale status` — showed both `acg-tech03l-1` (online) and `acg-tech03l` (offline, 2h).
- `tailscale status --json` — extracted device IDs (see table above).
- `bash .claude/scripts/vault.sh search tailscale` -> only
  `infrastructure/pfsense-firewall.sops.yaml: tailscale:`
- `bash .claude/scripts/vault.sh list tailscale` -> `find: '/c/vault/tailscale': No such file or directory`
- `vault.sh search "tailscale api" | "api.tailscale" | "tskey"` -> no matches.

## Pending / Incomplete Tasks

- Howard to delete stale node `acg-tech03l` (100.113.45.7, device `na9RzMbRmg11CNTRL`) from the
  admin console: https://login.tailscale.com/admin/machines -> match by IP -> `...` -> Delete.
- OPTIONAL, pending Howard's go-ahead: after the delete, run
  `tailscale up --reset --hostname acg-tech03l` on this machine to reclaim the base hostname and
  drop the `-1` suffix. Claude offered to run this step once the old node is gone.

## Reference Information

- Tailscale admin machines page: https://login.tailscale.com/admin/machines
- Tailnet: `tailea2889.ts.net`
- Stale node device ID: `na9RzMbRmg11CNTRL` | Live node device ID: `nhePgky8rB11CNTRL`
- Tailscale device delete API (if a token is ever vaulted):
  `DELETE https://api.tailscale.com/api/v2/device/{deviceID}` (Bearer token)