From 65516ea3aca858379a45d3a29cde3a47ccaaa38e Mon Sep 17 00:00:00 2001
From: Gmer4Lfe <gmer4lfe@gmail.com>
Date: Sun, 16 Aug 2026 21:38:03 -0400
Subject: [PATCH] Report the Tailscale device as removed only when it was,
 instead of whenever the toggle was on

---
 Partnership/partnership_offboard.sh | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/Partnership/partnership_offboard.sh b/Partnership/partnership_offboard.sh
index 2ba6d7e..d835907 100755
--- a/Partnership/partnership_offboard.sh
+++ b/Partnership/partnership_offboard.sh
@@ -156,6 +156,7 @@ source "$SCRIPTS_ROOT/Plugin/$PLATFORM/Partnership/containers.sh"
 # ── Parse flags ───────────────────────────────────────────────────────────────────────────────
 REASON="manual"
 STEP_DISABLE_RSYNC_OK=true   # both paths report it; only the mirror path re-initialised it
+TAILSCALE_REMOVED=false      # set only when remove_tailscale_device actually succeeds
 FILTERED_ARGS=()
 
 for arg in "$@"; do
@@ -590,7 +591,13 @@ if [[ "${PARTNERSHIP_REMOVE_TAILSCALE:-true}" == true ]]; then
             trap - SIGTERM SIGINT
         fi
     fi
-    remove_tailscale_device "$MIRROR"
+    # Outcome recorded, not assumed. remove_tailscale_device returns 1 when TAILSCALE_API_KEY or
+    # TAILSCALE_TAILNET is unset — it warns "skipping Tailscale removal" and the summary went on
+    # to report "removed ✅" anyway, so an offboard that left the device on the tailnet said it
+    # had taken it off. Neither key is configured here, so that was the case on every run.
+    if remove_tailscale_device "$MIRROR"; then
+        TAILSCALE_REMOVED=true
+    fi
 fi
 
 # Backup handover notification
@@ -638,8 +645,13 @@ echo "  Step 9  — Keys revoked:   $(_revoke_status)"
 echo "  Step 10 — State:          INACTIVE ✅"
 echo ""
 echo "  Blocklist: $MIRROR blocked — re-onboard to permit access again ✅"
-[[ "${PARTNERSHIP_REMOVE_TAILSCALE:-true}" == true ]] && \
-    echo "  Tailscale:   $MIRROR removed ✅"
+if [[ "${PARTNERSHIP_REMOVE_TAILSCALE:-true}" == true ]]; then
+    if [[ "$TAILSCALE_REMOVED" == true ]]; then
+        echo "  Tailscale:   $MIRROR removed ✅"
+    else
+        echo "  Tailscale:   $MIRROR NOT removed ⚠ — still on the tailnet (needs TAILSCALE_API_KEY + TAILSCALE_TAILNET)"
+    fi
+fi
 # Named because it is the one partnership switch neither onboard nor offboard moves, so it
 # survives an offboard still true and there is nothing else that would ever mention it.
 [[ "${FALLBACK_ENABLED:-false}" == true ]] && \