@khionu@hachyderm.io @tailscale@hachyderm.io On check mode: You can turn check mode on or off in all plans ("action": "accept" vs "action": "check"), the Premium feature is just the ability to configure the custom period (default 12 hrs) for check mode.
On localpart matching,
Just in case there's a miscommunication, when we say 'localpart username matching', we're referring to the `localpart:*@` functionality in our access controls (
https://tailscale.com/docs/reference/syntax/policy-file#users) It helps companies who need to map a Tailscale user in access controls (represented by an email address) to a specific named user on the host that matches the localpart of the email. (ie, sam@tailscale.com tailscale user will match to `sam` user on the host). It's really only used to make writing ACLs more efficient for admins, it doesn't affect the behavior for users who are using Tailscale SSH to access remote hosts.
Username matching between your device and the SSH host (ie, both usernames are `sam`) when no username was specified in the SSH command still works on all plans.
