[bfieser]

Closes #216. Decision #123 (amends #94), marked Proposed for you to accept or change.

Why

I linked my desktop and laptop and picked Home network. The laptop was on another Wi-Fi and a VPN, so the machines never heard each other's beacons. Linking had worked (relay only) and the top bar said "Machines linked", but the Sync & backup line showed "Looking for your other machines on this network…" forever (or a green "In sync…"), with no reason. Send errors and other-rig beacons were silently dropped.

What the user sees now

• First 30 s: "Looking for Brian's Laptop on this network…"
• Then, with a detected cause: "Can't find Brian's Laptop on this network: a VPN (NordLynx) is on, so Patch Pilot's messages go through it instead of your home network. Turn it off, or let it allow local network access."
• No cause detected: "Can't find Brian's Laptop on this network. Show what to check."
• Machine left: "Brian's Laptop isn't on this network now (seen 2 h ago)." This replaces the green "In sync" line.
• One here, one missing: the usual line, plus " · Laptop isn't on this network now."
• Details: each machine (on this network / last on it / not found), the full reason, and a checklist (same network, VPN, Windows Private + firewall, macOS Local Network, Patch Pilot open with Home network on the other machine, same version).

Causes this machine can actually tell, surest first: other Patch Pilot version · no Wi-Fi/Ethernet address · broadcasts leaving via a VPN or virtual adapter · macOS Local Network denied (strong guess) · Windows network set to Public · another rig's Patch Pilot on the network · VPN holding the internet route (guess). Anything on the other machine's side stays on the checklist; comparing both machines over the relay is a later PR.

How

• crates/local/src/lan_diagnosis.rs (new): pure diagnose(Facts) -> Diagnosis, adapter classification by name and Windows description (GlobalProtect calls its adapter "Ethernet 4"), egress kind (a "virtual" adapter carrying the internet route counts as home network, for Hyper-V external switches), bind error wording (10013 = Windows reserved port, not "another app").
• crates/local/src/netinfo.rs (new, read-only, sends nothing): UDP connect + local_addr for the broadcast and default-route source addresses; sysinfo network feature for interfaces (unsafe stays inside sysinfo); PowerShell Get-NetAdapter/Get-NetConnectionProfile with exact name match, env-var input, no window, below-normal priority, 5 s deadline.
• lan::read tells this rig / other version / other rig / noise apart (minimum sealed length so junk is noise).
• sync.rs keeps the relay's machine/ listing ids (no extra relay reads, Release 0.4.2, with "Bring over all Reaper scripts" #113), recorded before pulling.
• lan.rs: facts gathered on the existing 10 s beacon thread. The network is looked at only while a machine is missing, nobody is here and the grace is over (at most every 30 s; PowerShell cached 10 min per adapter). The UI is told only when the diagnosis changes. view() only reads caches. Nothing happens while unlinked. Only the broadcast's send result counts. A pull error clears (atomically) once its machine is gone.
• UI: syncLine / new LanMachines in Backup.tsx; types in api.ts (optional fields per Bring over: scripts and packages travel with every file they need; whole folders from Compare #112).

Changelog: added under Unreleased since #215 is cutting 0.4.57; rename it when releasing.

Testing

• cargo fmt --check, cargo clippy -D warnings (workspace and app), cargo test --workspace (463 pass, new tests for every diagnosis case, beacon classes, adapters, egress, external switch, bind errors, PowerShell output parsing), app cargo test, npm run build.
• On my Windows laptop the probes report Wi-Fi as home network (Private), the WSL vEthernet as virtual and the disabled GlobalProtect adapter by its description; the PowerShell call takes about 1 s.
• A pre-PR review (4 reviewers, each finding checked by a skeptic) found 19 issues, all fixed here: unlinked machine, removed machines, Hyper-V external switch, PowerShell hang and priority, probing while someone is here, UI suffix and truncation, a check-then-clear race.
• Not tested yet: the full two-machine flow by hand (needs the laptop on this build), and anything on a Mac. The Local Network path is unit-tested only; a dev build's Local Network grant belongs to the terminal, so it needs a bundled build on a Mac.

🤖 Generated with Claude Code