Gotcha.
Btw, you can straight up hit the GraphQL (?) / REST (?) Machine APIs from within Machine VMs via _api.internal: Fly Machines Manager - #2 by kurt
True. It is upto Fly engs to know what causes it as frequently as you report to have encountered them. I guess, you can treat the API as unstable and address it with retries, graceful degradation, monitoring and alerts, workarounds, etc. That said, flyctl-proxy is running wireguard (like you pointed out), and I don’t think is intended for production use (I may be wrong, of course).
Fwiw, Machines themselves have sharp edges. Just today a Machine VM was stuck in replacing state and blocked all subsequent deploys for me. I had to rid of it with a -f: fly m remove <vm-id> -a <app> -f 