Stale enforcement reports judge both clocks

plugins/geenforce/api/routes.py

@@ -1116,9 +1116,20 @@ def list_reports():
             latest_cache[key] = _current_published_version(*key)
         latest = latest_cache[key]
         known = facts.get((report.hostname or '').lower(), {})
-        isstale = (stalecutoff is not None
-                   and (report.receivedat is None
-                        or report.receivedat < stalecutoff))
+        # Two separate ways to have gone quiet, and the table has a column for
+        # each. receivedat is the SERVER's record of the last report it got;
+        # lastcheckin is the client's own claim about when it last ran. A PC can
+        # fail either way round - silent to the server, or still posting while
+        # its own cycle has stopped advancing - so both count.
+        #
+        # They are checked independently rather than by taking the newer of the
+        # two: lastcheckin is client-asserted, so a wrong or future value there
+        # must not be able to mask real silence on receivedat.
+        isstale = stalecutoff is not None and (
+            report.receivedat is None
+            or report.receivedat < stalecutoff
+            or (report.lastcheckin is not None
+                and report.lastcheckin < stalecutoff))
         data.append({
             'reportid': report.reportid,
             'hostname': report.hostname,