HydraIssues

pkg/scanner/scanner.go:334-346 is the single source of truth for the per-node diagnosis, and it emits exactly four values:

But the docs list a different, partly fictional set:

• CLAUDE.md:62-68 — claims healthy | agent-down | not-on-network | unmanaged
• docs/runbooks/runbook.md:134-138 — repeats the same wrong four

not-on-network and unmanaged are not diagnosis values anywhere in the codebase. The real fourth state, network-issue (agent reporting but the router does not see it), is documented nowhere. This actively misleads anyone triaging from the runbook.

The same runbook also documents three endpoints that do not exist in pkg/api/server.go: /api/v1/nodes/{id}/connectivity (:98), /api/v1/nodes (:105), and /api/v1/venues/{id}/tunnels (:181, :189).

Also worth documenting while fixing

NetworkOnline on MikroTik venues is derived from DHCP lease status == "bound" (pkg/mikrotik/rest/client.go:164), not from ARP or ICMP — there is no ping or ARP read anywhere in the repo. A bound lease survives a power-off for the remainder of the lease. So agent-down means "lease still bound, agent silent" — strongly suggestive of a live machine with a dead agent, but not proof. The runbook should say so plainly, because operators will reasonably read agent-down as "the box is definitely up".