chore(fleet): sync operator memory, hatch menu dialogs, and watchdog alerts

bin/netvm-node-up.sh

@@ -58,6 +58,14 @@ rm -f "$STRIPPED"
 PEER_PK=$(grep -oP '^\s*PublicKey\s*=\s*\K\S+' "$CONF" | head -1)
 if [ -n "$PEER_PK" ]; then
   nsexec wg set "$WG" peer "$PEER_PK" persistent-keepalive 25 2>/dev/null || true
+  # Prefer IPv4 peer endpoint: wg setconf may resolve the Endpoint hostname to
+  # IPv6, whose handshake then routes into the tunnel itself (no bypass route
+  # exists for it) and never completes. Observed 2026-10-06 on def.
+  EPV4=$(getent ahostsv4 "$ENDPOINT" | awk '{print $1}' | sort -u | head -1)
+  EPPORT=$(grep -oP '^\s*Endpoint\s*=\s*[^:;#]+:\K[0-9]+' "$CONF" | head -1)
+  if [ -n "$EPV4" ]; then
+    nsexec wg set "$WG" peer "$PEER_PK" endpoint "${EPV4}:${EPPORT:-2408}" 2>/dev/null || true
+  fi
 fi
 MTU=$(grep -oP '^\s*MTU\s*=\s*\K\d+' "$CONF" | head -1); MTU=${MTU:-1280}
 nsexec ip link set "$WG" mtu "$MTU"