fix(cli): honest offboard closing + clear pointer on failed wipe; drop stale client-list hints

[saadqbal]

Thorough review pass on the develop→main PR #164 — resolves the new Cursor Bugbot finding and the adjacent issues a full review surfaced, so #164 can go clean.

Bugbot: stale client pointer after a failed wipe

After revoke, if rm -rf ~/.tracebloc failed, the default path left the active-client pointer intact (the --keep-data path cleared it — an asymmetry my earlier #165 fix introduced). Now the pointer is cleared in memory once after revoke and persisted in both paths, including the wipe-failure branch. The host never looks enrolled under a dead credential.

Misleading success line

The closing Offboarded … no longer connected printed unconditionally, even when uninstall / cluster teardown / data wipe left real state behind (all best-effort warns). Now a degraded flag tracks the state-leaving steps and the closing tells the truth — "the credential is revoked, but some cleanup didn't complete; finish the flagged steps by hand."

• Image reclaim is pure disk cleanup, so it's excluded from degraded (its own warning already surfaces).
• Exit stays 0: the credential revoke — the security-critical core — succeeded. (Happy to make degraded exit non-zero for automation if you'd prefer — flag it.)

Online guard found=false

A stored id not in the signed-in account now emits a hint instead of silently passing the guard (wrong-account / stale-pointer case).

Stale copy

• client status errors pointed at the now-hidden client list; retargeted to client create / the installer (matching the phrasing used elsewhere in the diff).
• Fixed a create/use comment (use was removed this release).

Review scope

Fanned out a full correctness review across the whole #164 diff (offboard, surface/API, schema+parity/goldens). The schema/parity + registry changes came back clean. Remaining offboard candidates were either documented invariants (release-name = namespace) or speculative, and are left as-is.

Tests

Added: failed wipe still clears the pointer; a failed teardown produces the degraded closing. go build/vet/test ./... green (11 pkgs).

Rolls up under the §7.10 offboarding work (Bugbot follow-up — no separate ticket).

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes offboarding behavior and local config persistence after revoke; mistakes could leave users thinking offboard succeeded or still enrolled, but scope is CLI UX/guards with tests and exit 0 only when revoke succeeds.

Overview
Offboard (tracebloc delete) now reports outcomes honestly and keeps local enrollment state consistent after revoke.

After credential revoke, the active-client pointer is cleared in memory once (before --keep-data vs full wipe), so the host does not still look enrolled under a dead credential. If rm -rf ~/.tracebloc fails, the cleared pointer is persisted via cfg.Save() anyway.

A degraded flag tracks best-effort steps that leave real state behind (Helm uninstall, cluster teardown, missing namespace skip, failed data wipe). The final line is a warning when cleanup was incomplete, not an unconditional “no longer connected” success. Image prune failures still only warn and do not set degraded.

The pre-offboard online guard now hints when the stored client id is missing from the signed-in account (stale pointer / wrong env) instead of passing silently.

client status errors for a missing active client retarget guidance from hidden client list to client create / the installer. Tests cover failed wipe + pointer clear and degraded closing.

^{Reviewed by Cursor Bugbot for commit 34ff314. Bugbot is set up for automated code reviews on this repo. Configure here.}