linode: fix tag-check page_size, doc path, trim comments (address review)

- prune-tags.sh: GET /tags/<label> min page_size is 25, not 1 -- page_size=1
  could fail under curl -f and skip a legitimate orphan-tag delete.
- SKILL.md: give prune-lke-orphans.sh's real path
  (.claude/skills/linode-ha-provisioning/scripts), not "same dir" which implied
  terraform/linode-runner.
- Trim the reaper and destroy-lke comments that restated the script headers.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DBhvZuEUQU8ym347Xat4Yy

Author: claude

.claude/integrations/slack/relay/relay.js

@@ -620,11 +620,8 @@ async function reapLke() {
         await execFileP("bash", [`${RUNNER_DIR}/prune-tags.sh`], { env: process.env, timeout: 120000, maxBuffer: 4 * 1024 * 1024 });
       } catch (e) { console.error(`lke-reaper: tag prune skipped (non-fatal): ${e.message}`); }
     }
-    // Every tick, delete the volumes/NodeBalancers LKE teardown orphans
-    // (cluster-delete doesn't cascade to them). Runs unconditionally because a
-    // just-deleted cluster's volumes only become sweepable a little later. The
-    // script deletes only volumes tagged for a run whose cluster is gone (and
-    // NBs of a gone cluster), so a live cluster's resources are never touched.
+    // Runs every tick, not just when reaped: a just-deleted cluster's volumes
+    // detach a little later, so they're sweepable on a later tick that reaped nothing.
     try {
       await execFileP("bash", [`${HA_DIR}/prune-lke-orphans.sh`], { env: process.env, timeout: 120000, maxBuffer: 4 * 1024 * 1024 });
     } catch (e) { console.error(`lke-reaper: orphan sweep skipped (non-fatal): ${e.message}`); }

.claude/skills/linode-ha-provisioning/SKILL.md

@@ -200,4 +200,4 @@ curl -sS -m 240 --fail-with-body -X POST "$RELAY/linode/destroy-lke" \
   -d "$(jq -n --arg id "$RUN_ID" '{run_id:$id}')"
 ```
 
-Delete the cluster whether the run passed, failed, or was blocked — this is the last step, always. Unlike the single-VM path there is **no on-box self-destruct timer**; the guarantee is the **relay's TTL reaper**, which deletes any `pmm-qa-ephemeral` cluster past its `expires-<epoch>` tag (default 24h) even if this call never runs — the LKE equivalent of the VM's on-box timer. The SessionEnd hook fires the same `/linode/destroy-lke` for any run dir carrying an `lke` marker, so a normal session cleans up on its own; still call it explicitly at end of run — the reaper is the backstop, not the primary path. If you also created a box with `linode-docker-provisioning`, tear that VM down too — destroying the cluster does not touch it. Both teardown and the reaper now delete the cluster's unique account-level tags (`expires-<epoch>`, `pmm-qa-run:<id>`); Linode leaves those behind otherwise, so they pile up. Sweep leftovers on the relay with `LINODE_TOKEN=… terraform/linode-runner/prune-tags.sh --dry-run` (then without `--dry-run`). The **relay reaper** also deletes the orphaned Block Storage volumes and NodeBalancer that `cluster-delete` leaves behind — the biggest HA cost leak — via `prune-lke-orphans.sh` (same dir; `--dry-run` to preview). It deletes by **positive attribution**: `create-lke` stamps each cluster's volumes with its `pmm-qa-run:<id>` tag, and the sweep removes a volume only when that run has **no live cluster** (and NodeBalancers only when their `lke<id>` cluster is gone) — so a live cluster's volumes (unattached during provisioning/failover) and other owners' volumes are never touched. `destroy-lke` does **not** sweep (cluster-delete is async — it would only see other runs' resources); the reaper owns it.
+Delete the cluster whether the run passed, failed, or was blocked — this is the last step, always. Unlike the single-VM path there is **no on-box self-destruct timer**; the guarantee is the **relay's TTL reaper**, which deletes any `pmm-qa-ephemeral` cluster past its `expires-<epoch>` tag (default 24h) even if this call never runs — the LKE equivalent of the VM's on-box timer. The SessionEnd hook fires the same `/linode/destroy-lke` for any run dir carrying an `lke` marker, so a normal session cleans up on its own; still call it explicitly at end of run — the reaper is the backstop, not the primary path. If you also created a box with `linode-docker-provisioning`, tear that VM down too — destroying the cluster does not touch it. Both teardown and the reaper now delete the cluster's unique account-level tags (`expires-<epoch>`, `pmm-qa-run:<id>`); Linode leaves those behind otherwise, so they pile up. Sweep leftovers on the relay with `LINODE_TOKEN=… terraform/linode-runner/prune-tags.sh --dry-run` (then without `--dry-run`). The **relay reaper** also deletes the orphaned Block Storage volumes and NodeBalancer that `cluster-delete` leaves behind — the biggest HA cost leak — via `.claude/skills/linode-ha-provisioning/scripts/prune-lke-orphans.sh` (`--dry-run` to preview). It deletes by **positive attribution**: `create-lke` stamps each cluster's volumes with its `pmm-qa-run:<id>` tag, and the sweep removes a volume only when that run has **no live cluster** (and NodeBalancers only when their `lke<id>` cluster is gone) — so a live cluster's volumes (unattached during provisioning/failover) and other owners' volumes are never touched. `destroy-lke` does **not** sweep (cluster-delete is async — it would only see other runs' resources); the reaper owns it.

.claude/skills/linode-ha-provisioning/scripts/destroy-lke.sh

@@ -20,10 +20,8 @@ echo "[pmm-ha] Deleted."
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
-# The orphaned CSI volumes and NodeBalancer this cluster leaves behind are swept
-# by the relay reaper (prune-lke-orphans.sh on a timer), not here: cluster-delete
-# is async, so a sweep now would still see this cluster's nodes attached and the
-# cluster itself listed -- it could only act on OTHER runs' resources.
+# Orphaned volumes/NodeBalancer are swept by the relay reaper, not here:
+# cluster-delete is async, so a sweep now would only see OTHER runs' resources.
 
 # Sweep the cluster's orphan tags (best-effort).
 PRUNE="$SCRIPT_DIR/../../../../terraform/linode-runner/prune-tags.sh"

terraform/linode-runner/prune-tags.sh

@@ -52,7 +52,7 @@ for t in "${candidates[@]:-}"; do
   enc="$(jq -rn --arg t "$t" '$t|@uri')"
   # Authoritative check across ALL resource types, right before deleting. A tag
   # that raced back into use (or a transient error) is left alone, not deleted.
-  info="$("${CURL[@]}" "$BASE/tags/${enc}?page_size=1" 2>/dev/null || true)"
+  info="$("${CURL[@]}" "$BASE/tags/${enc}?page_size=25" 2>/dev/null || true)"
   [ -n "$info" ] || { kept=$((kept + 1)); continue; }
   n="$(printf '%s' "$info" | jq -r '.results // (.data | length)')"
   [ "$n" = "0" ] || { kept=$((kept + 1)); continue; }