Distillation

Date: Sep 17, 2026

• 🔴 (09:07) User stated the recall tool is currently broken and instructed that any needed recall should instead use lore recall or http://127.0.0.1:3207/ui/search.
• 🟡 (09:07) Assistant planned to compare persisted Tailscale preferences against service restarts and re-authentication events, then add self-healing specifically for the path that can clear exit-node advertising.
• 🟡 (09:08) Investigation found current Tailscale preferences on labs include AdvertiseRoutes=["0.0.0.0/0","::/0"], AdvertiseServices=["svc:opencode"], AdvertiseTags=["tag:opencode-host"], WantRunning=true, LoggedOut=false, OperatorUser="byk", NoStatefulFiltering=true, NetfilterMode=2, and automatic update checking/application enabled.
• 🟡 (09:08) tailscaled.service starts /usr/sbin/tailscaled --state=/var/lib/tailscale/tailscaled.state --socket=/run/tailscale/tailscaled.sock --port=${PORT} $FLAGS, uses /etc/default/tailscaled, has Restart=on-failure, runs /usr/sbin/tailscaled --cleanup on stop, is enabled, and had no systemd drop-ins.
• 🟡 (09:08) Existing recovery units were present: enabled ts-opencode-advertise.timer and static ts-opencode-advertise.service; the timer was running the service repeatedly, approximately every 65 seconds, with successful completion logs.
• 🟡 (09:08) Tailscale logs showed a preference update at Sep 17 08:44:53: EditPrefs: MaskedPrefs{WantRunning=true AdvertiseTags=["tag:opencode-host"] AdvertiseRoutes=[0.0.0.0/0 ::/0] OperatorUser="byk"}.
• 🟡 (09:08) /etc/systemd/system/ts-opencode-advertise.service is an 8-line oneshot unit described as Ensure Tailscale svc:opencode is advertised; it runs after and wants tailscaled.service, with ExecStart=/usr/local/bin/ts-opencode-watchdog.sh.
• 🟡 (09:08) Assistant identified the durability gap: the live exit-node preference was correct, but the existing watchdog restored only svc:opencode, leaving 0.0.0.0/0 and ::/0 vulnerable to preference resets.
• 🟡 (09:08) Recovery design decision: extend the existing /usr/local/bin/ts-opencode-watchdog.sh path rather than introduce a separate recovery mechanism, using one atomic check to restore both svc:opencode and exit-node route advertisements without disturbing tags or unrelated Tailscale settings. Implementation and verification remained pending.