Report members, not symptoms

A peer going away showed up as three unrelated yellow rows: no peers
authenticated, N dial failures, one packet to an address nobody owns.
Each was true and none of them said the actual thing, which is that a
member we know about is offline. Worse, they are cumulative, so after
the peer came back the report still looked broken.

Two changes behind that.

Members are now a list, joined from the three sources that each know
part of the answer: signed state says who belongs and keeps saying it
while they are away, the session list says who is here, the overlay says
whose tunnel is up. Online first, then away, this agent left out because
the device section already covers it. An absent member is stated rather
than flagged — in a mesh of laptops being away is the ordinary condition
— and its failed dials are attributed to it instead of floating free as
a network-wide number.

Counters are history and no longer grade anything. Grading them is what
kept the report red long after the cause had gone. The one exception is
context-sensitive rather than cumulative: handshake failures with nobody
connected is the signature of a mismatched secret, so that is called
out.

NetworkStatus grows a member roster from the signed records, and the
overlay report carries the endpoint id so a tunnel can be matched to its
session. Note what the roster cannot do: a member is in signed state
only once it has claimed something, which today means an IPv4 address,
so an IPv6-only network still has no durable roster. Hostnames are not
persisted either, so an absent member is named by its id.

The control socket gained a version word. Adding these fields changed
how postcard parses the bytes, and without it a client one build ahead
of its agent reported "Found an Option discriminant that wasn't 0 or 1".
The check names a mismatch for whichever side is newer; an older agent
reading a newer request just drops the connection, so the CLI offers
that as a possibility rather than asserting it. It also now separates an
agent that is absent, which is an ordinary answer, from one that is
there and will not answer, which is a fault.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/ipc/mod.rs

@@ -104,6 +104,13 @@ pub struct NetworkReport {
     pub active: bool,
     /// Authenticated control plane peers.
     pub peers: Vec<PeerReport>,
+    /// Members the signed state knows about, connected or not.
+    ///
+    /// This is what makes "offline" sayable. Without it a member that is away
+    /// is indistinguishable from one that never existed, and the only thing
+    /// left to report is a dial-failure counter — which describes the symptom
+    /// and not the cause.
+    pub members: Vec<MemberReport>,
     /// Outbound dials that failed.
     pub dial_failures: u64,
     /// Handshakes rejected in either direction.
@@ -114,6 +121,17 @@ pub struct NetworkReport {
     pub overlay: Option<OverlayReport>,
 }
 
+/// One member of the network, from signed state.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct MemberReport {
+    /// The member's device identity.
+    pub endpoint_id: String,
+    /// The IPv4 overlay address it claimed and signed for.
+    pub overlay_address_v4: Option<String>,
+    /// Consecutive failed dial attempts, when this agent is trying to reach it.
+    pub failed_dials: u32,
+}
+
 /// One control plane peer.
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
 pub struct PeerReport {
@@ -156,6 +174,9 @@ pub struct OverlayReport {
 /// One overlay peer.
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
 pub struct OverlayPeerReport {
+    /// The peer's control plane identity, so a tunnel can be matched to the
+    /// session and the member it belongs to.
+    pub endpoint_id: String,
     /// The peer's WireGuard public key.
     pub public_key: String,
     /// Its overlay address.