[bug] Reimaged Pi joins SideroLink but unique token stays undetermined; Omni never collects inventory or generates config

[AnthonyPoschen]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

SideroLink connects. A Machine is created immediately. No lasting Pending/Accept step.

• NodeUniqueTokenStatus.spec.state stays 0
• Link.spec.nodeuniquetoken is ""
• MachineStatus.hardware / network / talosversion stay null
• Omni never generates machine config
• Join-token warning: The machine node unique token status is not determined
• Generic Omni talosctl can get machinestatus / get disks (Talos is maintenance, mmcblk0 present)
• talosctl reboot|reset|apply-config fail: cluster "" endpoint not found
• omnictl machine install|shutdown fail: “neither in maintenance nor allocated”
• omnictl configure machine --reset-node-unique-token fails: no NodeUniqueTokens resource
• Admin user and Admin service account cannot GET NodeUniqueTokens or delete Machine (“only read access”)

Expected Behavior

On first SideroLink connect after a reimage (same board UUID, new SD):

1. If the node has no unique token, Omni puts it in Pending / limbo until an admin Accepts it (Put the machine into the limbo state when it join Omni for the first time #840 (Put the machine into the limbo state when it join Omni for the first time #840)).
2. After Accept, Omni creates a NodeUniqueToken, collects hardware/disks, and generates machine config.
3. If the token matches, the machine joins as a normal unallocated machine with inventory.
4. If the token mismatches, Omni rejects the join instead of creating a half-dead Machine.
5. While the node is in Talos maintenance, Omni treats it as maintenance so omnictl machine install / talosctl reboot through the generic Omni talosconfig work.

Steps To Reproduce

1. Omni SaaS (hobby), backend/omnictl 1.10.3. Existing cluster with Raspberry Pi control planes (board UUIDs like 30303031-3030-3030-6261-…).
2. Delete the control-plane MachineSet (etcd restore planned via ControlPlane.bootstrapSpec.snapshot).
3. Flash the Pi SD with the Omni Raspberry Pi disk image (same default join token) or stock Image Factory rpi_generic v1.13.8 + Omni Machine Join Config.
4. Boot the Pi. It reconnects on the same hardware UUID.
5. Observe: connected Machine, empty inventory, token state 0, no config. Optional: add it back to the control-plane set — it sits in Configuring forever.

Same result if the Machine/Link is deleted and the Pi is left to rejoin unallocated. PendingMachines may appear for a few seconds, then a Machine is created with no token.

What browsers are you seeing the problem on?

Chrome

Anything else?

issue ongoing inside https://ap.omni.siderolabs.io/