state: note tagged-path coverage and self-healing behaviour for #3199

- test: comment that the !regReq.Expiry.IsZero() gate also covers
  the tags-only PreAuthKey path
- CHANGELOG: note pre-existing 0001-01-01 rows self-heal on
  re-registration rather than being backfilled

CHANGELOG.md

@@ -184,6 +184,7 @@ connected" routers that maintain their control session but cannot route packets.
 - Remove old migrations for the debian package [#3185](https://github.com/juanfont/headscale/pull/3185)
 - Install `config-example.yaml` as example for the debian package [#3186](https://github.com/juanfont/headscale/pull/3186)
 - **Node Expiry**: Fix user owned re registration with zero client expiry and no default storing `0001-01-01 00:00:00` in the database instead of NULL [#3199](https://github.com/juanfont/headscale/pull/3199)
+  - Pre-existing rows with `0001-01-01 00:00:00` are not backfilled; they clear themselves the next time the node re-registers
 
 ## 0.28.0 (2026-02-04)
 

hscontrol/auth_tags_test.go

@@ -1126,6 +1126,11 @@ func TestReregistrationAppliesDefaultExpiry(t *testing.T) {
 // time. Regression test for the else branch introduced in commit 6337a3db
 // which assigned `&regReq.Expiry` (pointer to time.Time{}) instead of nil,
 // causing the database row to hold `0001-01-01 00:00:00` instead of NULL.
+//
+// The same !regReq.Expiry.IsZero() gate at state.go:2221-2228 is shared by
+// the tags-only PreAuthKey path (createAndSaveNewNode also receives nil
+// when the client sends zero expiry), so this regression is covered for
+// tagged nodes by inspection.
 func TestReregistrationZeroExpiryStaysNil(t *testing.T) {
 	t.Parallel()