feat(device-edge): retire superseded VPS tailnet

infra/deploy-runner/test_device_edge_vps_artifact.py

@@ -98,6 +98,7 @@ class DeviceEdgeVpsArtifactTest(unittest.TestCase):
             "backhaul",
             "relay",
             "core-channel",
+            "tailscale-retirement",
         ):
             with self.subTest(phase=phase), tempfile.TemporaryDirectory(
                 prefix=f"nodedc-vps-{phase}-"
@@ -176,6 +177,7 @@ class DeviceEdgeVpsArtifactTest(unittest.TestCase):
                     "backhaul",
                     "relay",
                     "core-channel",
+                    "tailscale-retirement",
                 ):
                     result = self.build(
                         inbox,
@@ -311,6 +313,54 @@ class DeviceEdgeVpsArtifactTest(unittest.TestCase):
             self.assertIn("public_core_channel=disabled", rendered)
             self.assertIn("tracker_tcp_9921=closed", rendered)
 
+    def test_tailscale_retirement_plan_preserves_channel_and_opens_no_tracker_port(self):
+        with tempfile.TemporaryDirectory(prefix="nodedc-vps-retirement-plan-") as directory:
+            inbox = Path(directory) / "inbox"
+            inbox.mkdir()
+            result = self.build(
+                inbox,
+                "tailscale-retirement",
+                "device-edge-vps-tailscale-retirement-plan-001",
+            )
+            self.assertEqual(result.returncode, 0, result.stderr)
+            artifact = Path(json.loads(result.stdout)["artifact"])
+            old_inbox = RUNNER.INBOX_ROOT
+            RUNNER.INBOX_ROOT = inbox
+            try:
+                with patch.object(RUNNER, "assert_root"), patch.object(
+                    RUNNER,
+                    "preflight",
+                    return_value={
+                        "predecessor": "accepted-core-channel-010-with-live-tailnet",
+                    },
+                ), patch("builtins.print") as output:
+                    RUNNER.plan_artifact(str(artifact))
+            finally:
+                RUNNER.INBOX_ROOT = old_inbox
+            rendered = "\n".join(
+                " ".join(str(arg) for arg in call.args)
+                for call in output.call_args_list
+            )
+            self.assertIn("phase=tailscale-retirement", rendered)
+            self.assertIn(
+                "predecessor=accepted-core-channel-010-with-live-tailnet",
+                rendered,
+            )
+            self.assertIn(
+                "public_core_channel=preserved:155.212.211.15:443/tcp:tls13-mtls-h2",
+                rendered,
+            )
+            self.assertIn(
+                "tailscale=stop+disable+destroy-local-runtime-state",
+                rendered,
+            )
+            self.assertIn("tailscale_socks_1055=removed", rendered)
+            self.assertIn("superseded_backhaul_private_key=removed", rendered)
+            self.assertIn("tracker_tcp_9921=closed", rendered)
+            self.assertIn("external_tailnet_machine_cleanup=required-after-deploy-ok", rendered)
+            self.assertIn("command_transport=disabled", rendered)
+            self.assertIn("gelios=untouched", rendered)
+
     def test_publish_payload_preserves_unselected_executable_modes(self):
         with tempfile.TemporaryDirectory(prefix="nodedc-vps-publish-scope-") as directory:
             root = Path(directory)