Description
`pkg/scanner/scanner.go:334-346` is the single source of truth for the per-node diagnosis, and it emits exactly four values:
| | network online | network offline |
|---|---|---|
| **agent online** | `healthy` | `network-issue` |
| **agent offline** | `agent-down` | `offline` |
But the docs list a different, partly fictional set:
- `CLAUDE.md:62-68` — claims `healthy | agent-down | not-on-network | unmanaged`
- `docs/runbooks/runbook.md:134-138` — repeats the same wrong four
**`not-on-network` and `unmanaged` are not diagnosis values anywhere in the codebase.** The real fourth state, `network-issue` (agent reporting but the router does not see it), is documented nowhere. This actively misleads anyone triaging from the runbook.
The same runbook also documents three endpoints that **do not exist** in `pkg/api/server.go`: `/api/v1/nodes/{id}/connectivity` (`:98`), `/api/v1/nodes` (`:105`), and `/api/v1/venues/{id}/tunnels` (`:181`, `:189`).
### Also worth documenting while fixing
`NetworkOnline` on MikroTik venues is derived from **DHCP lease status == "bound"** (`pkg/mikrotik/rest/client.go:164`), not from ARP or ICMP — there is no ping or ARP read anywhere in the repo. A bound lease survives a power-off for the remainder of the lease. So `agent-down` means *"lease still bound, agent silent"* — strongly suggestive of a live machine with a dead agent, but **not proof**. The runbook should say so plainly, because operators will reasonably read `agent-down` as "the box is definitely up".