Make tailscale removal opt-in, since it depends on a key that expires and no-ops silently once it has

Deployment/master.conf.template

@@ -273,8 +273,10 @@
     VARAVERK_SETUP_FILE="$STATE_DIR/varaverk_setup.db"
 
 # Tailscale removal on offboard.
-    PARTNERSHIP_REMOVE_TAILSCALE=true       # remove mirror from Tailscale tailnet on offboard
-                                            # false = skip removal (manual or testing)
+    PARTNERSHIP_REMOVE_TAILSCALE=false      # opt-in — removes the mirror from the tailnet on offboard.
+                                            # OFF by default: it needs a TAILSCALE_API_KEY, which
+                                            # expires and must be reissued, and a feature that
+                                            # silently no-ops on a stale key should not be opt-out.
 
 # Tailscale API — required when PARTNERSHIP_REMOVE_TAILSCALE=true.
 # Stays in shared conf — only owner uses it, and owner is always running this script.

Partnership/partnership_offboard.sh

@@ -603,7 +603,7 @@ else
 fi
 
 # Tailscale removal — after state written so --check does not re-trigger offboard during grace sleep
-if [[ "${PARTNERSHIP_REMOVE_TAILSCALE:-true}" == true ]]; then
+if [[ "${PARTNERSHIP_REMOVE_TAILSCALE:-false}" == true ]]; then
     echo ""
     echo "━━━ $ICON_NET Tailscale Separation ━━━"
     # The grace period is recorded as a deadline, not slept through.
@@ -694,7 +694,7 @@ echo "  Step 9  — Keys revoked:   $(_revoke_status)"
 echo "  Step 10 — State:          $( [[ "$STEP_STATE_WRITE_OK" == true ]] && echo "INACTIVE ✅" || echo "⚠️  WRITE FAILED — still looks ACTIVE here" )"
 echo ""
 echo "  Blocklist: $MIRROR blocked — re-onboard to permit access again ✅"
-if [[ "${PARTNERSHIP_REMOVE_TAILSCALE:-true}" == true ]]; then
+if [[ "${PARTNERSHIP_REMOVE_TAILSCALE:-false}" == true ]]; then
     case "$TAILSCALE_REMOVED" in
         true)     echo "  Tailscale:   $MIRROR removed ✅" ;;
         deferred) echo "  Tailscale:   $MIRROR kept until the grace period expires — see ${STATE_DIR}/tailscale_removal_due.db" ;;

Plugin/unraid/include/partnership.php

@@ -72,7 +72,7 @@ function vv_pt_config(): array {
         'grace_hours'       => (int)($v['PARTNERSHIP_GRACE_HOURS']     ?? 6),
         'offline_threshold' => (int)($v['PARTNERSHIP_OFFLINE_THRESHOLD'] ?? 30),
         'offline_days'      => $offlineDays,
-        'remove_tailscale'  => ($v['PARTNERSHIP_REMOVE_TAILSCALE']  ?? 'true') === 'true',
+        'remove_tailscale'  => ($v['PARTNERSHIP_REMOVE_TAILSCALE']  ?? 'false') === 'true',
         'folderview3'       => ($v['PARTNERSHIP_FOLDERVIEW3']       ?? 'false') === 'true',
         'tailscale_configured' => !empty($v['TAILSCALE_API_KEY']) && !empty($v['TAILSCALE_TAILNET']),
         'transfer_confirm'  => $v['PARTNERSHIP_TRANSFER_CONFIRM'] ?? 'i-understand-this-transfers-ownership',