My WireGuard tunnel never actually dropped. The handshake stayed fresh, my NAS loaded, and yet my lab hostnames stopped resolving, ad blocking quietly switched off, and some services failed once before working on the second try. I’d already lost an evening to the Tailscale version of this problem, so I had a hunch about the cause.