hub 0.166.0 source: the clock-ahead tunnel alarm wg_tunnel_stale/ok (R-1204, operator-only, edge-triggered); D21 + D4 proof evidence

hub/internal/api/handler.go

@@ -772,7 +772,9 @@ type hostReportPayload struct {
 		HostSwapMB  *int64 `json:"host_swap_mb"`
 		GuestSwapMB *int64 `json:"guest_swap_mb"`
 	} `json:"host"`
-	Guests []struct {
+	// Wireguard (R-1204): the box's own view of its tunnel to ep0. nil = an agent with no tunnel stanza.
+	Wireguard *hostWireguard `json:"wireguard"`
+	Guests    []struct {
 		VMID              int    `json:"vmid"`
 		Name              string `json:"name"`
 		Status            string `json:"status"`
@@ -994,6 +996,7 @@ func (h *Handler) handleHostReport(w http.ResponseWriter, r *http.Request) {
 	}
 	h.checkTunnel(hostID, custID, rep.Cloudflared.Status, rep.Cloudflared.Detail)
 	h.checkHostSwap(hostID, custID, rep.Host.HostSwapMB, rep.Host.GuestSwapMB)
+	h.checkWGTunnel(hostID, custID, rep.Wireguard)
 	h.checkCrash(hostID, custID, body)
 	h.checkDeliberateOff(hostID, custID, &rep)