@tikoci/centrs 0.1.9-next.22 → 0.1.9-next.23

package/commands/explain/README.md

@@ -460,6 +460,7 @@ Standard envelope (constitution: result envelope); `data` sketch:
     "statementCount": 1,
     "statements": [
       {
+        "id": "s0",
         "span": { "start": 0, "end": 51 },
         "resolution": "resolved",
         "kind": "command",
@@ -511,6 +512,36 @@ Standard envelope (constitution: result envelope); `data` sketch:
   classification, and evidence id. This is where multi-statement scripts and
   partial recovery live; a single top-level transport object cannot represent
   them.
+- **Statement ownership is syntactic (#497).** Every published statement has
+  an `id` (`s0`, `s1`, …) in discovery order, stable within one result. A nested
+  scope-body statement's `parent` names its owning statement; absence means
+  top level. Each substitution's `owner` names its containing statement,
+  including nested brackets. These links come from the resolver's traversal,
+  so widened Unicode spans do not turn siblings into ancestors. IDs are not
+  persistent across edits.
+
+  The existing `blocks[]` inventory still lists outer scope bodies only.
+  A block's optional `owner` names the statement carrying it, and a statement's
+  optional `block` indexes its innermost **published** enclosing block. A nested
+  body can therefore share its ancestor's block index. Bare/menu containers
+  add no synthetic statement or block nodes; the tree links only statements
+  the existing analysis exposes. Existing lists, order, spans and readings stay
+  unchanged. A widened span remains a coordinate limitation, not a second
+  parentage rule.
+
+  Stored/deferred `source=`, `on-event=` and callback bodies remain opaque:
+  their statements are not added to this tree. Creation versus explicit
+  stored-script execution is grounded by
+  `test/fixtures/explain/statement-ownership.json` and replayed by
+  `test/integration/explain-structure.test.ts`. Ownership asserts no lexical
+  inheritance, immediate execution, or shared user/policy environment;
+  context-sensitive binding/value semantics remain #507's responsibility.
+
+  `test/unit/explain-structure.test.ts` independently checks ancestry against
+  span containment where spans recover exact source text, with explicit
+  widened-span controls. After `bun run corpus:fetch`, run
+  `CENTRS_CHECK_CORPUS=1 bun test test/unit/explain-structure.test.ts` for the
+  same contract over the pinned study population; the corpus CI job runs it.
 - **Every derived fact keeps provenance via `evidence[]`** — facts reference
   a stable evidence id (`ev`), and the evidence entry carries source
   (`canonicalizer` vs `live-inspect`), probe, basis (direct response vs
@@ -907,7 +938,16 @@ and its phase is named below.
   top-level brace value in any other command argument emits
   `explain/canonicalizer/invalid-command-brace` at the `{`; parentheses or a
   `[…]` substitution restore the expression context where the same literal is
-  legal. An empty member is a
+  legal. So does a top-level `where` clause (#502): `print where interface in
+  {"ether1";"ether2"}` is a read, and its array is read member by member like
+  its `(…)` twin. The exception is the right side of `<name>=`, `!=` or `==`,
+  spaced or not, which the device reads with that property's own parser
+  (`expected interface value`), so `where comment={1;2}` keeps its error. The
+  device does that only for a property the menu knows (`where foo-bar={…}`
+  parses). Offline has no property list, so it treats every bare name as one.
+  The same comparison inside `( … )` or a `[ … ]` command
+  (`[find where interface={"x"}]`, `where (interface={"x"})`) is caught by the
+  group walk (#509, below) and reported with the same code. An empty member is a
   syntax error (`{;}`, `{;1}`, `{1;;2}`, `(1,)`) and withdraws the enclosing
   `array` shape with it; a single trailing separator is legal in the brace form
   only (`{1;}` and `{1;2;}` parse, `{1;2,}` and `{2,}` do not).
@@ -947,15 +987,16 @@ and its phase is named below.
 
   <!-- BEGIN GENERATED value-census — regenerate with `bun run explain:value-census:readme` -->
   The corpus census is re-derivable with `bun run explain:value-census` and
-  covers 948 source scripts. The figures below are generated from
-  `test/fixtures/explain/values.json` → `corpus` by
-  `bun run explain:value-census:readme` and gated against it by
+  covers 948 source scripts of corpus snapshot `e12d5d4e58a4`, with 882
+  auxiliary rows (7 `capture-controls`, 875 `wiresage-conformance`) excluded.
+  The figures below are generated from `test/fixtures/explain/values.json` →
+  `corpus` by `bun run explain:value-census:readme` and gated against it by
   `bun run explain:value-census:readme:check`; the fixture itself is gated
   against a fresh corpus run by `bun run explain:value-census:check`. Of the
-  13,161 emitted values in a statement the strict argument lexer ALSO read, 0
+  13,152 emitted values in a statement the strict argument lexer ALSO read, 0
   disagree with it on half-open byte span or decoded text, while the
   prefix-safe scan retains a further 6,538 values across 568 statements whose
-  strict REST reading abstains. Of 19,699 emitted occurrences, 5,636 are array
+  strict REST reading abstains. Of 19,690 emitted occurrences, 5,636 are array
   members (529 keyed, 1,147 nested inside another member) and 808 are arrays;
   the corpus holds no source-literal `id` example. The three structural
   counters — spans addressing bytes outside their own source, members naming a
@@ -982,7 +1023,8 @@ comment, a literal hash value, and a hard error at the exact byte.
 | Statement-leading at the document root, after a real statement separator, in a `do`/`else`/`foreach do` body, or immediately inside a `[…]` command substitution | `comment` through newline | Mask it and preserve byte offsets. A command first consumes that lead, so `[:put #test]` keeps `#test` as the value. |
 | First non-space content inside a stored-script brace such as `on-event={ # c` | `comment` | Treat exact `source`/`script` and `on-*`-named brace values as comment-bearing script bodies; a suffix such as `myScript` is not one. |
 | Immediate line start after `\` + newline | `comment`; the pending statement survives | Mask it in both argument views; the continuation-reach rules remain H5/#215. |
-| Inside an array (`{#test}`, `{1;#test}`, `{a=1;#b=2}`) or parenthesized expression (`(1,#test)`) | hard `error` at `#`; `:parse` reports `syntax error` | Do not mask it or emit an array value hint; semantic resolution stops there. |
+| Inside an array (`{#test}`, `{1;#test}`, `{a=1;#b=2}`) or parenthesized expression (`(1,#test)`), except at column 0 inside an array (next row) | hard `error` at `#`; `:parse` reports `syntax error` | Do not mask it or emit an array value hint; semantic resolution stops there. |
+| At column 0 of its own line inside an array, at any depth and in argument values (`:local z {a=1;⏎# c⏎b=2}`, `{a={⏎# c⏎1}}`, `({⏎# c⏎1})`, `:foreach i in={1;⏎# c⏎2} do=…`), including after `\r⏎` and a `\`-continued line (#503) | `comment` through newline; `:parse` drops it (`value=a=1;b=2`) and `highlight` has no `error` on CHR 7.24.5 and 7.22.1 | Mask it with `startsArrayCommentLine`, which every walker asks with its innermost frame. It ends nothing: the array's statement carries on. An indented `#` (space or tab), one after `{`, a value or `;` on the same line, and one at column 0 directly inside `( … )` stay errors. A comment-only array (`{⏎# c⏎}`) is rejected only because an empty array is (#511). |
 | A scope-named brace (`do=`/`else=`/`command=`/`script=`/`source=`/`on-*=`) nested inside an array (`:local z {do={ # c⏎:put 1}}`, `:local z {script={ # c⏎…}}`, `:local z { { # c…}}`) — and likewise a bare `{` or `/menu {` inside an array | hard `error` at `#`; `/console/inspect` request `highlight` classes that byte `error` on CHR 7.23.3 (grounded in #249 on the four `#249` rows plus `bare {`/`source`/`on-event` corners) | A brace bears statements only when its enclosing context already does — `enclosing && braceStartsStatements(…)` on each walker's stack (`contexts`/`delimStack`/`frames`/`stack`). Inside an array the name is an array key and its `{…}` is a nested array. A `[…]` substitution nested in that array does re-enter a statement context, so `[:do { # c…}]` stays a real comment and a bare `{` under a bracket does too. |
 | Inside a `[…]` substitution that is itself nested in an array (`{[:put #test]}`, `{1;[:put #test]}`) | literal value (`none`) — the bracket restores the statement role the array dropped | Keep it as content and keep the enclosing array readable. The role is per frame, so an array or group opened again inside that bracket (`{[:put {#test}]}`, `{[:put (1,#test)]}`) is `error` once more; skipping whole `[…]` regions would wrongly accept those. |
 | In an attribute or bare value (`comment=#test`, `comment=a#b`, `:global y #test`) | literal value (`none` highlight class) | Keep it as content. |
@@ -1020,6 +1062,14 @@ JSON-like transcript, and two shell-shaped snippets. No RouterOS command reading
 moved; these diagnostics say those bytes are not valid RouterOS, not that the
 foreign snippets were expected to parse as RouterOS.
 
+Corpus re-measurement for #503: one script of 947 moves. It is a pasted console
+session (`forum/amm0/topic-264287-…/post-0005-snippet-01.rsc`, which opens with
+`[admin@MikroTik] > {`), and it moves from `fail` to `warn`. Its `invalid-hash` sat on a column-0
+`# ... more code` line inside the brace after `>`, which the device reads as
+an array (`:local z (1 > {⏎:local a 1⏎# c⏎})` parses). The device rejects the
+script earlier, at the prompt's `@`, which is #512. Every census gate except
+the token census is unchanged; that one gains the two comment spans.
+
 The default text renderer surfaces comment spans in a `comments:` section; JSON
 continues to carry the same ranges as `spans[]` entries with `class: "comment"`.
 
@@ -1074,10 +1124,17 @@ navigated, so the context stays as unknown as it already was.
       `:parse` `expected message value`, grounded stable+testing #247),
     `bad-sigil`,
     `invalid-hash`, `invalid-apostrophe` (#355, below),
-    `missing-statement-separator` (#311, below). Nine classes
-    the device itself rejects.
+    `missing-statement-separator` (#311, below), the four group faults
+    `empty-group`, `misplaced-separator`, `missing-operand` and
+    `invalid-at-sign` (#505, #511, #512, below), and the four token faults
+    `glued-token`, `invalid-variable`, `bad-string-variable` and
+    `invalid-name` (#506, #518, below). Seventeen classes the device itself
+    rejects.
   - `warning` — `over-depth`, because it is centrs's own resource bound and says
-    nothing about whether the input is legal; and an `ambiguous`/`unknown`
+    nothing about whether the input is legal; `possible-spaced-argument`
+    (#350), a spelling RouterOS accepts and marks obsolete; `discarded-close`
+    (#504), a script RouterOS accepts and stops reading early, which the
+    execute gate refuses by code; and an `ambiguous`/`unknown`
     resolution, never an error, so the default `--fail-on error` cannot fail a
     document whose only sin is being unreadable without a schema — which is most
     of RouterOS scripting.
@@ -1182,6 +1239,151 @@ it. The corpus count is unchanged at **0** for the same reason it always was
 the rule is an unterminated string or an unbalanced delimiter, because neither
 walk can find a boundary to resume from.
 
+### Faults inside groups (#505, #509, #511, #512)
+
+Four missed-rejection families share one walk, `src/explain/group-faults.ts`
+(evidence pass `findGroupFaults`). It reads the comment-masked document with
+the frame roles every other walker uses: `[` opens a statement, `(` an
+expression, and `{` a body when `braceStartsStatements` says so or the
+directive takes a program in that slot (`:execute {…}`, `:time {…}`). Each
+rule is a `:parse` answer on CHR 7.24.5 and 7.23.8, identical on both, and
+`test/fixtures/explain/group-faults.json` pins all 186 rows (100 rejections,
+86 controls). `test/integration/explain-group-faults.test.ts` holds the
+device to that fixture, and `test/unit/explain-group-faults.test.ts` holds
+offline to it.
+
+| Code | Device rule | Rejected | Accepted |
+| ---- | ----------- | -------- | -------- |
+| `empty-group` | A `( )` with nothing in it, and a `{}` that is the whole value of a directive slot | `:put ()`, `:if () do={}`, `:local z {}`, `:put [:len {}]`, `:foreach i in={} do={}` | `{1;{}}`, `{a={}}`, `({})`, `[{}]`, `where … in {}`, `do={}`, `source={}`, `:execute {}` |
+| `misplaced-separator` | A `;` with no array element before it on its line; a `;` or a bare newline directly inside `( … )` | `{;1}`, `{1;;2}`, `{1⏎;2}`, `(1; 2)`, `(1⏎+ 2)` | `{1;}`, `{1;2;⏎}`, `{1⏎2}`, `{1 \⏎;2}`, `(1 +\⏎2)`, `({1;2})` |
+| `missing-operand` | An operator with no operand: a binary one first in a group or after another operator, any one last, and a leading or trailing `,` in an array | `(1 +)`, `(+ 1)`, `(1 + + 2)`, `(1 == 2)`, `(!)`, `(1 and)`, `{1,}`, `{,1}` | `(1 2)`, `(- 1)`, `(1 + -2)`, `(-> 1)`, `(any any 1)`, `(and 1)`, `(. 1)`, `(1.)` |
+| `invalid-at-sign` | A `@` in a statement's head word, in an array, or in an expression | `[admin@MikroTik]`, `admin@x`, `:put@x`, `{1;a@b}`, `(a@b)` | `:put a@b`, `comment=a@b`, `[:len a@b]`, `[:len x] a@b` |
+
+`invalid-command-brace` gains the #509 positions: a brace after `<name>=`
+inside `( … )` or a `[ … ]` command whose statement says `where`. The top level
+and scope bodies stay with `args.ts` (#502), and a `do={` body is never read as
+a comparison.
+
+**Prefix operators are the device's set, not the operator table's arity.**
+`-`, `!`, `>`, `~` and `any` take one operand after them, so `(1 + -2)` and
+`(-> 1)` (`(- (> 1))`) parse. Every other operator needs a left operand. At
+operand position `and`, `or`, `in`, `.` and `/` are variable names
+(`(and 1)` is `( $and 1)`). `1.`, `1/`, `a_b`, `1:2` and `1.2.3.4/24` are
+single words, while `-` is always an operator (`(a-b)` is `(- $a $b)`).
+
+**A query is not an expression.** Inside `where …` and `find …`, the device
+reads the value after `<name>=` with the property's parser. So
+`where (comment=+)`, `where (comment=a-)`, `where (comment=@)` and
+`where (.id=*1)` parse, though each is an error in a plain group. A group in a
+query gets only the structural checks (empty, `;`, newline) and #509.
+
+**A brace offline cannot place is opaque, not an array.** A `{` after a
+relative menu word is a menu body (`/ip { route { } }` parses empty), and a
+brace in a command argument is `args.ts`'s. Neither is checked here. The
+array rules apply where the role is grounded: a directive slot in the
+`brace-slots.ts` array table, and an array nested in an array or an expression.
+
+**Three readings the review round grounded (PR #516).** A `\` continuation
+runs on across blank lines and line-leading comment lines, as H5 does
+elsewhere, so `(1 +\⏎# c⏎2)` and `{1\⏎⏎;2}` parse, while a blank line after a
+comment line ends it (`(1 +\⏎# c⏎⏎2)` is rejected at the blank line). A
+directive's operand is a name, so `:local where (comment={})` parses and
+`:local where (1 +)` is checked like any expression. A bare `local`/`global`
+is the same directive at the root (`local where (comment={})` is
+`/localname=$where`), while a bare `set` or `find` may be a menu command and
+stays unread. And a named element takes
+a trailing `,` (`{a=1,}` is `value=a`, `{a=1,;b=2}` is `value=a;b=2`), while
+`{a=,1}`, `{a=1,,2}` and a positional `{1,}` are rejected. A faulted group's
+descendants are opaque, since the device stops at the fault.
+
+**Spans.** Each fault spans the token it is about: the operator, the
+separator, the `@`, or the whole empty group. The device's column is the same
+byte for every rule except an empty group and a dangling operator, where it is
+the byte after.
+
+**Measured.** Corpus `e12d5d4e58a4`: 70 of 948 scripts gain an error and all
+70 are device rejections on every channel. 42 of those errors sit on the exact
+byte the 7.24.5 diagnostic names, and the other 28 come after an earlier device
+error in pasted non-RouterOS text. None precedes the device's error. 41
+verdicts move to `fail` (40 from `warn`, one from `pass`), so offline now fails
+133 of the 374 device-rejected scripts, up from 92, and false rejects stay at 1.
+`invalid-at-sign` is mostly pasted console prompts. On the conformance cases,
+22 `plain-diagnostic` missed rejections move to `fail`, with no new false
+reject.
+
+Not covered here: a `$( … )` group, a group under a `find` head
+(`[find (1 +)]`, read as a query), a `@` in a later head word
+(`/ip address@ print`), operand rules for array elements other than `,`, a
+group in a query beyond its structure, and adjacency without whitespace
+(`"x"~a`, `}else=`), which is the next section's.
+
+### Token faults and the discarded tail (#504, #506, #518)
+
+Three more missed-rejection families, and one reading that was wrong in the
+other direction. The glued-token, variable and name rules ride the same walk as
+the group faults (`src/explain/group-faults.ts`), so they share its statement,
+query and brace roles. The `$` inside a string is checked by the escape walk
+(`src/explain/quoted-string.ts`), and the stray close by the segmenter
+(`src/explain/segment.ts` → `discardFrom`). Every rule is a `:parse` answer on
+CHR 7.24.5 and 7.23.8, identical on both, and
+`test/fixtures/explain/token-faults.json` pins all 145 rows (80 rejections and
+65 acceptances, with the acceptances' IL). `test/integration/explain-token-faults.test.ts`
+holds the device to that fixture, and `test/unit/explain-token-faults.test.ts`
+holds offline to it.
+
+| Code | Device rule | Rejected | Accepted |
+| ---- | ----------- | -------- | -------- |
+| `discarded-close` (warning) | A `}` or `]` that closes nothing at the top level ends the script: the device accepts it and drops that byte and everything after it | — | `}` (IL `/`), `:put 1};:put 2` (IL `(evl /putmessage=1)`), `name=a}` (sets `a`) |
+| `glued-token` | After a closed string, `$name`, `$"…"` or group, only a separator; after a bare word, no `"`, `$`, `(`, `[` or `{` | `:put "a"b`, `$v.b`, `$v$v`, `(1)(2)`, `[:len a]b`, `}else=`, `src-address=$v/24`, `dst-port="80",443`, `:put a"b"`, `name=a$v` | `:put a.b`, `a-b`, `a_b`, `a#b`, `a~b`, `where comment="a"b`, `[find comment="a"b]`, `("a"b)`, `{"a"b}`, `dst-address-list=!"my list"`, `dst-port=80,"443"` |
+| `invalid-variable` | Outside a string, `$` takes a name (`[A-Za-z0-9]+`) or `$"…"` | `:put $`, `$_`, `$-`, `$.`, a `$` before a space | `$v1`, `$"a b"` |
+| `bad-string-variable` | Inside a string, `$` takes a name, `"`, `(` or `[` | `"a$ b"`, `"$-"`, `"$_"`, `"${"`, and the same in `where`, an array, a group and a nested `$[…]` string | `"$v_x"` (`$v` then `_x`), `"\$ x"`, `"$(1)"`, `"$[:len a]"` |
+| `invalid-name` | The first operand of `:local`, `:global`, `:set`, `:for` and `:foreach` is a name of letters and digits, or a string | `:local a_b`, `a-b`, `a.b`, `a$v`, `:local $a`, `:local (a)`, `:for i,j`, `:foreach a,`, `:foreach a,,b` | `:local "a_b"`, `:local 1a`, `:foreach a,b`, `:foreach "a",b`, `:local name=x value=1`, `:set (a) 1` |
+
+**The stray close was the honest-reading bug.** Offline used to fail
+`name=a}` with `unbalanced-close`, and the device accepts it. But the device
+does not just ignore the `}`: it stops reading there. `}⏎:put 1` lowers to `/`,
+and a write after the brace never runs. So `explainCommand` now analyzes only
+the prefix the device reads and adds one `warning` that spans the dropped
+bytes. The token partition still covers the whole input, with the tail
+`unclassified`. A `)` in that position, and any stray close inside an open
+group, are rejections and stay `unbalanced-close` errors. The execute gate
+refuses `discarded-close` by code, the one warning it refuses
+(`src/offline-gate.ts`; `commands/execute/examples.md` V9).
+
+**Where a property's parser decides, the glued-token rule abstains.** In a
+command argument the device hands the value to the property's parser, which can
+take a glued part after a prefix or separator: `dst-address-list=!"my list"`
+and `dst-port=80,"443"` parse, while `name=!"a"` and `name=-"a"` do not. So
+outside a `:` directive, a bare word followed by a `"`, `$` or bracket is a
+fault only after an alphanumeric byte. After a closed part no property was found
+that accepts anything (`"80",443`, `$p-90`, `$v%ether1`, `"ether"1` are all
+rejected), so that half of the rule applies everywhere outside a query.
+
+**Spans.** Each fault spans its byte, which is the device's byte too. For the
+two `$` rules the span is the `$` and the byte after it, and the device names
+that second byte.
+
+**Measured.** Corpus `e12d5d4e58a4`: 23 scripts move to `fail` (18 from
+`warn`, 5 from `pass`), and 29 already-failing scripts gain a new code. All are
+device rejections on every channel. 9 of their first new errors sit on the
+7.24.5 diagnostic's byte, 45 come after it, and none precedes it. Offline now
+fails 154 of the device-rejected scripts, up from 133. The one corpus false
+reject (a stray `}`) is gone, so false rejects are 0. Three scripts move from
+`fail` to `warn`: their `unbalanced-close` became `discarded-close`, and two of
+them are device rejections for an earlier reason offline does not see. On the
+conformance cases, false rejects go from 3 to 0 and missed rejections from 278
+to 151.
+
+**Not covered here.** `"a$"`: the device reads `$"` in a string as a quoted
+variable name, so the next `"` does not close the string. Every scanner in
+`explain` closes it there, so both `$` rules and the glued-token rule abstain
+around a string that ends in `$"` (2 of 948 corpus scripts use the form).
+`$$`, `$(…)`, `$[…]` and `${…}` outside a string, where the device's byte is
+not the `$`. A `\` continuation inside a glued token (`"a"\⏎"b"`). The head
+word of a statement (`$v"a"`, `{…}:put 2`). `:local a=b`, which 7.24.5 reads as
+a named argument and 7.23.8 as a syntax error. And a name in `/local` or
+`:local name=a_b`.
+
 ### The token stream a rule reads (#316)
 
 `lexArguments` is all-or-nothing by design: its consumer renders a runnable REST
@@ -1394,7 +1596,8 @@ print } }` is `(evl (evl (evl /ip/address/print)))` on device and
 form failed. A menu block's body is a statement list, so it may open with a
 submenu, with one of the thirteen frozen CRUD verbs (`verbs.ts`), with a
 catalog-named command, with a `:` scripting directive, or with an absolute
-command — corpus 521 is the directive case, `ethernet { :put … }`.
+command — corpus script `forum/amm0/topic-184067-routeros-lsp-for-better-syntax-checking-command-completion-in-editors-like-vscod/post-0014-snippet-02.rsc` is the directive case,
+`ethernet { :put … }`.
 
 That last rule is bounded by what a STATEMENT can start with, which is what
 keeps `{1;2}` an array literal: an array member opens with a digit or a quote
@@ -1406,6 +1609,47 @@ That is the catalog's own "a hit is decisive, a miss says nothing" contract, and
 turning such a miss into an acceptance would be the mirror-image defect of the
 one being fixed here.
 
+### The `=` is optional in ordinary arguments too (#350)
+
+The #347 rule is the narrow half of a general one: a space can stand in for the
+`=` of any command argument. `/ip/firewall/layer7-protocol add comment
+"something" regexp 1.1` lowers to the IL of `comment="something" regexp=1.1`
+on CHR 7.22.1, 7.23.8 and 7.24.5, and `highlight` marks each gap
+`syntax-obsolete`, which is RouterOS calling the spelling deprecated. Unlike
+the four #347 scope names, this one cannot be read offline. The device pairs
+`comment` with its value because it knows the command has a `comment`
+argument, and `/system/script add zzznotanarg beep` is rejected. Which words
+are argument names is per-command schema, which offline does not ship.
+
+Offline used to publish the worst reading available: `arguments.read: true`,
+`args: {}`, the operands as positionals. That is an affirmative claim that the
+list was read and holds no arguments. Now any adjacent pair of a
+name-shaped bare operand and another operand withdraws the argument reading,
+as #311 does. The statement stays `resolved`, `command.args` is absent,
+`arguments.why` names the pair, and transport stays the `unknown` it already
+was. A **warning** (`possible-spaced-argument`, example 33) is raised only
+where the second operand cannot be a flag (quoted, numeric, `$`-led). That is
+because the same bytes are also two flags: `print detail without-paging`
+lowers to `detail=true;without-paging=true` with no `syntax-obsolete` marker,
+while `set ether1 name x` pairs. So two bare words abstain silently. `where`
+ends the scan, and root directives are excluded because their operands are
+positional by grammar (`:pick abc 0 1` lowers to `counter=abc`). Live
+`request=child` discovery (#491) is what confirms a name and makes the warning
+definite.
+
+The same applies before a script body. `source { :beep }`,
+`on-event { :beep }` and `down-script { :beep }` lower to their `=` IL, while
+`comment { :beep }` is a `syntax error`. So the brace exemption accepts the
+bare spelling, and its name shape gained the `…-script` arguments
+(`up-script`, `lease-script`) that hard-failed even with the `=`. Which slots
+take a body is per-menu and per-version schema (`lease-script={…}` parses on
+7.24.5 and not on 7.22.1). The shape decides the brace's role for every
+reader, not just the error, and it errs toward a body: an argument the
+command does not have (`zzz-script={…}`, and `on-zzz={…}` before #350) is a
+device `syntax error` that offline does not report. That is a missed
+rejection for the device preflight to catch, never a false reject. On the
+pinned corpus the widening changed no census.
+
 ### `'` is not a RouterOS token (#355)
 
 `'` (U+0027) is not a string delimiter and not a legal bare byte. Only `"` opens
@@ -1443,11 +1687,14 @@ Occurrences BEFORE the defect stand, which is the lab's X1 rule.
 
 **This was a false ACCEPT, which the corpus join cannot see.** The false-reject
 measurement scores one direction only, so the analyzer passing all four forms
-with zero diagnostics never appeared in it. Over the pinned corpus the rule
-fires on 40 of the 7.24.2 scripts and **every one of them is a script the device
-rejects** — none of the 617 it accepts. It moves the false-reject count not at
-all (still 1, the extra `}` of corpus 228) while taking the caught count from 62
-to 93.
+with zero diagnostics never appeared in it. Over the corpus pinned at the time
+(stable 7.24.2, before the #498 schema-5 repin) the rule fires on 40 scripts and
+**every one of them is a script the device rejects** — none of the 617 it
+accepted. It moves the false-reject count not at all (still 1, the extra `}` of
+corpus script
+`forum/amm0/topic-167087-can-t-turn-code-into-a-function/post-0005-snippet-02.rsc`)
+while taking the caught count from 62 to 93. On the #498 sessions both figures
+hold on every channel: 1 false reject among 573 accepts, 93 caught.
 
 The token census moves, and only in the direction the fail-closed symbol stop
 predicts: 68 fewer `variable-*` tokens and their 306 bytes returning to
@@ -1524,12 +1771,12 @@ Grounded, not transcribed, for the same reason the escape set above is: the
 [manual's operator list](https://manual.mikrotik.com/docs/developer-guides/scripting/index.md#operators)
 is a lower bound. `bun run explain:probe:operators` sweeps the manual's list
 **plus** plausible non-operators (`not`, `..`, `xor`, `mod`, `is`, `div`, …)
-**plus** every IL head the corpus census saw, on CHR 7.24.2 stable, 7.23.5
-long-term and 7.25beta3 development — the same three builds the pinned corpus
-classes `complete`, so the operator axis and the token partition are finally
-scored on the same firmware (#342) — plus 7.21.5 as an **age anchor**, which is
-not a channel claim but the only live evidence that the surface behaves the same
-on a pre-7.23 branch. Re-cut the fixture with
+**plus** every IL head the corpus census saw. It runs on CHR 7.24.5 stable,
+7.23.8 long-term, 7.25rc2 testing and 7.26beta1 development, the builds the
+pinned corpus records a channel session for, so the operator axis and the token
+partition are scored on the same firmware (#342, #498). It also runs on 7.21.5
+as an **age anchor**, which is not a channel claim but the only live evidence
+that the surface behaves the same on a pre-7.23 branch. Re-cut the fixture with
 `bun run explain:operator-slice`; the table
 below is generated from `src/explain/operators.ts` by
 `bun run explain:operator-readme` and gated by
@@ -1632,13 +1879,13 @@ not concat at all** — `1.` lexes as a *variable name* and the row comes back a
 juxtaposition, `(  $1. 2)`. A rule that claims every `.` byte for the operator
 emits a span the device does not have.
 
-Everything in the sweep is identical across all four builds except one runtime
-row: `:put ({2;1} > {1;2;3})` evaluates to `true` on 7.24.2 and 7.25beta3 and
-errors on both long-term builds. **Array comparison is not fixed on current
-long-term** — 7.23.5 is newer than the 7.23.3 this was first measured on and
-still errors — so the change rode the 7.24 line and was not backported. The two
-errors also differ: 7.23.5 says `cannot compare if array is more than array`,
-7.21.5 says `cannot compare if nothing is more than nothing`, so on 7.21.5 the
+Everything in the sweep is identical across all five builds except one runtime
+row: `:put ({2;1} > {1;2;3})` evaluates to `true` on 7.24.5, 7.25rc2 and
+7.26beta1 and errors on both long-term builds. **Array comparison is not fixed
+on current long-term** — 7.23.8 is newer than the 7.23.3 this was first
+measured on and still errors — so the change rode the 7.24 line and was not
+backported. The two errors also differ: 7.23.8 says `cannot compare if array
+is more than array`, 7.21.5 says `cannot compare if nothing is more than nothing`, so on 7.21.5 the
 operands did not survive to the comparison at all.
 Identical is measured, not assumed — the slice diffs verdict, arity, precedence,
 associativity, `highlight` run, unary placement and op-axis per version. So the
@@ -1733,13 +1980,14 @@ And the grounded complement — asked, and refused:
 
   <!-- BEGIN GENERATED token-census — regenerate with `bun run explain:token-census:readme` -->
   The token census is re-derivable with `bun run explain:token-census` and
-  covers 948 source scripts. The figures below are generated from
-  `test/fixtures/explain/tokens.json` → `corpus` by
-  `bun run explain:token-census:readme` and gated against it by
+  covers 948 source scripts of corpus snapshot `e12d5d4e58a4`, with 882
+  auxiliary rows (7 `capture-controls`, 875 `wiresage-conformance`) excluded.
+  The figures below are generated from `test/fixtures/explain/tokens.json` →
+  `corpus` by `bun run explain:token-census:readme` and gated against it by
   `bun run explain:token-census:readme:check`; the fixture itself is gated
   against a fresh corpus run by `bun run explain:token-census:check`. Of
-  1,426,731 analyzed bytes, 1,023,107 are classified (71.71%), the remaining
-  403,624 are `unclassified`. The census emits 241,539 tokens (avg 254.8 per
+  1,426,731 analyzed bytes, 1,022,782 are classified (71.69%), the remaining
+  403,949 are `unclassified`. The census emits 241,279 tokens (avg 254.5 per
   script). Every byte belongs to exactly one token — sorted by `start`, no
   gaps, no overlaps, `join(slice) === input` — and the `class` field is the
   vocabulary #264 B5 settled. Each B2 fill should move the classified
@@ -1820,7 +2068,7 @@ what was wrong was the accounting of it. They are re-derived by
 `bun run explain:bracket-equals:readme:check`.
 
 <!-- BEGIN GENERATED bracket-equals — regenerate with `bun run explain:bracket-equals:readme` -->
-Measured by `bun run explain:bracket-equals` over the pinned corpus:
+Measured by `bun run explain:bracket-equals` over the population of corpus snapshot `e12d5d4e58a4`, with 882 auxiliary rows (7 `capture-controls`, 875 `wiresage-conformance`) excluded:
 **1,079** `=` bytes sit inside `[ … ]`, across
 263 of 948 scripts, and **1,067** of them come back
 `unclassified` — the operator fill abstains on essentially all of it. No
@@ -1835,15 +2083,15 @@ genuine comparisons — the device lowers `[find address=$IP]` to
 fill can take the query half later. For contrast the fill does claim
 **1,402** `=` bytes whose innermost opener is `(`.
 
-The query reading is the device's, not a guess: on 7.24.2, 93 of the
-137 scripts carrying one have IL with at least as many `(= …)` nodes.
-Of the rest, 28 are scripts the console refused outright — their IL is prose,
-with no nodes of any kind — and 16 use a menu the capture build could not
-resolve (a forum snippet on `/interface wireless` answers `bad command name
-wireless`), so the device never reached the query to lower it. Neither is a
-counter-example to the reading. Whole-corpus `(= …)` head nodes, which also
-count expression comparisons the fill already claims:
-7.23.5 1,233, 7.24.2 1,240, 7.25beta3 1,240.
+The query reading is the device's, not a guess: on 7.24.5, 91 of the
+137 scripts carrying one have IL with at least as many comparison nodes.
+Of the rest, 25 are scripts the console refused outright — their readout is
+prose, with no nodes of any kind — and 21 lowered fewer comparison nodes than the
+scan counted, typically because a command the capture build could not resolve
+(`bad command name …`) stopped the device before it reached the query. Neither is
+a counter-example to the reading. Whole-corpus `(= …)` head nodes per channel
+session, which also count expression comparisons the fill already claims:
+7.23.8 1,300, 7.24.5 1,306, 7.25rc2 1,306, 7.26beta1 1,306.
 <!-- END GENERATED bracket-equals -->
 
 ### Device agreement for the token partition (#264 B4, #263)
@@ -1893,13 +2141,13 @@ to be filled by assumption.
 
 **The device stops classifying at its first `error`, and mostly does not
 recover.** Measured over the slice, `error` appears **at most once per script
-and is always exactly one byte wide**, and on long-term 7.23.5 every byte after
+and is always exactly one byte wide**, and on long-term 7.23.8 every byte after
 it comes back `none`. Most of the slice sits in that tail. A percentage computed
 over the whole stream therefore measures the device giving up, not the parser,
 which is why the tail is its own outcome and is never folded into agreement. The
 rule is not absolute across versions, so the report does not assert it: stable
-7.24.2 and development 7.25beta3 classify again after the `error` in one run and
-stop on fewer scripts, and
+7.24.5, testing 7.25rc2 and development 7.26beta1 classify again after the
+`error` in one run and stop on fewer scripts, and
 `parser-recovered` in the table below is the figure that says by how much —
 zero would have been the claim, and it is not zero. Both counts are generated,
 not quoted here, so neither can go stale against the fixture.
@@ -1921,56 +2169,57 @@ a score.
 The agreement report is re-derivable with
 `bun run explain:highlight-agreement` and needs no router and no corpus: it
 scores the token partition against
-`test/fixtures/explain/highlight-streams.slice.json`, 70 stratified scripts of
+`test/fixtures/explain/highlight-streams.slice.json`, 67 stratified scripts of
 committed `/console/inspect request=highlight` output. The figures below are
 generated from `test/fixtures/explain/highlight-agreement.json` by
 `bun run explain:highlight-agreement:readme`, gated against it by
 `bun run explain:highlight-agreement:readme:check`, and the fixture itself is
 gated against a fresh measurement by
-`test/unit/explain-highlight-agreement.test.ts`. Of 85,529 bytes at 7.24.2,
-27,974 are bytes **both** sides decided a syntax class for, and 99.99% of
-those agree (dev 99.99%, holdout 100.00%). Set `comment` aside — it is 65.63%
+`test/unit/explain-highlight-agreement.test.ts`. Of 81,143 bytes at 7.24.5,
+27,538 are bytes **both** sides decided a syntax class for, and 99.99% of
+those agree (dev 99.99%, holdout 100.00%). Set `comment` aside — it is 63.66%
 of that decided region and mostly the corpus's harness-injected `# Source:`
-banner (#203) — and the remaining 9,615 bytes agree 99.98%. The device stops
-classifying at its one-byte `error`: 36 of 70 scripts carry one, and the
-41,968 bytes from there on are not a judgment about anything. The oracle
-itself moves between captures: 36 stop at 7.24.2 and 43 stop at 7.23.5 and 36
-stop at 7.25beta3, and 27 of the 70 streams differ between them. **This is a
-trend line, not a pass gate** — the slice is a per-(split, class) quota over a
-corpus that is 96.8% two authors, so the percentage describes this slice.
+banner (#203) — and the remaining 10,008 bytes agree 99.98%. The device stops
+classifying at its one-byte `error`: 34 of 67 scripts carry one, and the
+38,278 bytes from there on are not a judgment about anything. The oracle
+itself moves between captures: 34 stop at 7.24.5 and 39 stop at 7.23.8 and 34
+stop at 7.25rc2 and 34 stop at 7.26beta1, and 25 of the 67 streams differ
+between them. **This is a trend line, not a pass gate** — the slice is a
+per-(split, class) quota over a corpus that is 96.8% two authors, so the
+percentage describes this slice.
 
 | centrs class | projects to | agree | disagree | unprojected | of decided |
 | ------------ | ----------- | ----: | -------: | ----------: | ---------: |
-| `comment` | `comment` | 18,359 | 0 | 0 | 100.00% |
-| `variable-local` | `variable-local` | 1,123 | 0 | 0 | 100.00% |
+| `comment` | `comment` | 17,530 | 0 | 0 | 100.00% |
+| `variable-local` | `variable-local` | 1,547 | 0 | 0 | 100.00% |
 | `variable-global` | `variable-global` | 582 | 0 | 0 | 100.00% |
-| `variable-auto` | `variable-auto` | 92 | 0 | 0 | 100.00% |
-| `variable-parameter` | `variable-parameter` | 459 | 0 | 0 | 100.00% |
-| `dir` | `dir` | 1,677 | 0 | 0 | 100.00% |
-| `cmd` | `cmd` | 2,244 | 0 | 0 | 100.00% |
-| `arg` | `arg`, `arg-dot`, `arg-scope` | 2,188 | 0 | 0 | 100.00% |
-| `arg-sep` | `syntax-meta` | 382 | 0 | 0 | 100.00% |
-| `operator` | `syntax-meta` | 237 | 2 | 0 | 99.16% |
-| `brace` | `syntax-meta` | 211 | 0 | 0 | 100.00% |
-| `string` | *abstains* | 0 | 0 | 499 | — |
+| `variable-auto` | `variable-auto` | 93 | 0 | 0 | 100.00% |
+| `variable-parameter` | `variable-parameter` | 456 | 0 | 0 | 100.00% |
+| `dir` | `dir` | 1,701 | 0 | 0 | 100.00% |
+| `cmd` | `cmd` | 2,224 | 0 | 0 | 100.00% |
+| `arg` | `arg`, `arg-dot`, `arg-scope` | 2,167 | 0 | 0 | 100.00% |
+| `arg-sep` | `syntax-meta` | 368 | 0 | 0 | 100.00% |
+| `operator` | `syntax-meta` | 240 | 2 | 0 | 99.17% |
+| `brace` | `syntax-meta` | 210 | 0 | 0 | 100.00% |
+| `string` | *abstains* | 0 | 0 | 573 | — |
 | `escaped` | `escaped` | 418 | 0 | 0 | 100.00% |
-| `value` | *abstains* | 0 | 0 | 144 | — |
-
-| outcome | bytes @7.24.2 | bytes @7.23.5 | bytes @7.25beta3 |
-| ------- | ----: | ----: | ----: |
-| agree — both decided, projection accepts | 27,972 | 27,218 | 27,972 |
-| disagree — both decided, projection rejects | 2 | 2 | 2 |
-| unprojected — no declared projection covers the pair | 643 | 633 | 643 |
-| offline-silent — device decided, centrs abstained | 4,300 | 4,150 | 4,300 |
-| non-syntax — the device answered something syntax cannot decide | 847 | 733 | 847 |
-| device-silent — centrs decided, device said `none` | 5,815 | 5,674 | 5,815 |
-| both-silent | 3,886 | 3,702 | 3,886 |
-| parser-stopped — at/after the device's `error` byte, and silent from there | 41,968 | 43,417 | 41,968 |
-| parser-recovered — past that `error`, and the device classified anyway | 96 | 0 | 96 |
-
-Where the device decided and offline analysis did not (4,300 bytes at 7.24.2,
-the next fill's target list): `syntax-meta` 3,122, `comment` 355,
-`variable-local` 326, `arg` 197, `escaped` 145, `dir` 66, 89 across the rest.
+| `value` | *abstains* | 0 | 0 | 135 | — |
+
+| outcome | bytes @7.24.5 | bytes @7.23.8 | bytes @7.25rc2 | bytes @7.26beta1 |
+| ------- | ----: | ----: | ----: | ----: |
+| agree — both decided, projection accepts | 27,536 | 27,173 | 27,536 | 27,536 |
+| disagree — both decided, projection rejects | 2 | 2 | 2 | 2 |
+| unprojected — no declared projection covers the pair | 708 | 705 | 708 | 708 |
+| offline-silent — device decided, centrs abstained | 4,288 | 4,187 | 4,288 | 4,288 |
+| non-syntax — the device answered something syntax cannot decide | 731 | 662 | 721 | 721 |
+| device-silent — centrs decided, device said `none` | 5,676 | 5,606 | 5,676 | 5,676 |
+| both-silent | 3,828 | 3,736 | 3,838 | 3,838 |
+| parser-stopped — at/after the device's `error` byte, and silent from there | 38,278 | 39,072 | 38,278 | 38,278 |
+| parser-recovered — past that `error`, and the device classified anyway | 96 | 0 | 96 | 96 |
+
+Where the device decided and offline analysis did not (4,288 bytes at 7.24.5,
+the next fill's target list): `syntax-meta` 3,090, `comment` 341,
+`variable-local` 328, `arg` 230, `escaped` 145, `dir` 65, 89 across the rest.
 Most of the `syntax-meta` share is whitespace the device merged into an
 adjacent structure run rather than a token centrs missed.
 
@@ -1982,14 +2231,14 @@ every measured byte, the post-`error` tail included: where one capture stops
 parsing and the next does not, that tail IS the version disagreement, which is
 why it dominates the category.
 
-| applicability @7.24.2 | bytes | leading cells |
+| applicability @7.24.5 | bytes | leading cells |
 | ---------------------------- | ----: | ------------- |
-| offline-decidable | 32,002 | `comment` → `comment` 18,006, `unclassified` → `syntax-meta` 2,999, `cmd` → `cmd` 2,132 |
-| schema-dependent | 326 | `arg` → `obj-inactive` 326 |
-| state-dependent | 168 | `dir` → `obj-inactive` 120, `cmd` → `obj-inactive` 21, `unclassified` → `obj-dynamic` 20 |
-| version-dependent | 1,158 | `comment` → `comment` 353, `unclassified` → `obj-inactive` 159, `unclassified` → `syntax-meta` 123 |
-| uncategorized | 213 | `unclassified` → `obj-inactive` 90, `unclassified` → `variable-undefined` 75, `value` → `variable-undefined` 21 |
-| no-device-answer | 51,662 | `none` where the captures agree, wherever it falls |
+| offline-decidable | 32,043 | `comment` → `comment` 17,395, `unclassified` → `syntax-meta` 3,002, `cmd` → `cmd` 2,158 |
+| schema-dependent | 307 | `arg` → `obj-inactive` 307 |
+| state-dependent | 94 | `dir` → `obj-inactive` 49, `unclassified` → `obj-dynamic` 20, `cmd` → `obj-inactive` 18 |
+| version-dependent | 707 | `comment` → `comment` 135, `unclassified` → `obj-inactive` 124, `unclassified` → `syntax-meta` 88 |
+| uncategorized | 240 | `unclassified` → `obj-inactive` 116, `unclassified` → `variable-undefined` 75, `value` → `variable-undefined` 21 |
+| no-device-answer | 47,752 | `none` where the captures agree, wherever it falls |
 
 One representative run per cell, so B5 reads a fragment rather than a count.
 `runs` is how often that exact fragment occurs; the location is a slice script
@@ -1998,9 +2247,8 @@ and a byte offset into the stream the device saw.
 | outcome | cell | fragment | runs | first at |
 | ------- | ---- | -------- | ---: | -------- |
 | disagree | `operator` → `arg` | `"in"` | 1 | `forum/amm0/topic-169456-having-the-where-filter-in-scripting-signifantly-increases-the-execution-time-an/post-0006-snippet-01.rsc` @615 |
-| unprojected | `string` → `syntax-meta` | `"\""` | 311 | `eworm/ppp-on-up.rsc` @435 |
-| unprojected | `value` → `syntax-meta` | `"\""` | 88 | `forum/amm0/topic-153357-using-wifiwave2-to-bridge-two-audience-wirelessly-thoughts-4-address-mode/post-0001-snippet-01.rsc` @1436 |
-| unprojected | `string` → `arg` | `"as-value"` | 1 | `forum/amm0/topic-266499-how-to-condense-variables-passed-through-to-function/post-0020-snippet-01.rsc` @279 |
+| unprojected | `string` → `syntax-meta` | `"\""` | 326 | `eworm/ppp-on-up.rsc` @435 |
+| unprojected | `value` → `syntax-meta` | `"\""` | 84 | `forum/amm0/topic-153357-using-wifiwave2-to-bridge-two-audience-wirelessly-thoughts-4-address-mode/post-0001-snippet-01.rsc` @1436 |
 | unprojected | `string` → `cmd` | `"len"` | 1 | `forum/amm0/topic-155978-zerotier-on-mikrotik-a-rosetta-stone-v7-1-1/post-0001-snippet-01.rsc` @1794 |
 | unprojected | `string` → `dir` | `":"` | 1 | `forum/amm0/topic-155978-zerotier-on-mikrotik-a-rosetta-stone-v7-1-1/post-0001-snippet-01.rsc` @1793 |
 <!-- END GENERATED highlight-agreement -->
@@ -2090,9 +2338,10 @@ the 16,526 bytes `arg-sep` claims, one per attribute. Token count rises 214,503
 → 231,026 because one run became two. **This is a retag.**
 
 (Those totals are the corpus as it stood for THIS measurement. The classified
-total is 1,023,107 today: #347/#348 later classified 8 further bytes, and #355's
+total is 1,022,805 today: #347/#348 later classified 8 further bytes, #355's
 fail-closed symbol stop then unclaimed 306 of them — variable bytes sitting
-after a bare apostrophe, which the device never reaches. The identity being
+after a bare apostrophe, which the device never reaches — and #211's unlisted
+bare-path abstention unclaimed 302 more. The identity being
 claimed here is between the two sides of the split, not with any later total —
 restating it against today's figure would credit this retag with a movement a
 different change made. The generated block above carries the current numbers.)
@@ -2180,7 +2429,7 @@ bytes came from a fill that already held it — `string` gives up 17,672 and
 last decimal**, 1,023,405 of 1,426,731 (71.73076073906013%), so in byte terms
 this is a retag even though it took a new walk to make — again, the identity is
 between this change's own before and after, and the corpus total has since moved
-to 1,023,107 / 241,539 tokens under #347/#348 and #355. Only the token count
+to 1,022,805 / 241,442 tokens under #347/#348, #355 and #211. Only the token count
 moves, 231,026 → 241,663: the 7,408 new `escaped` tokens plus the 3,229
 fragments they leave behind when they split a run they sit inside (`string`
 +2,643, `value` +586). That second number is well under one per escape because
@@ -2450,31 +2699,65 @@ config genre in question). Since phase 0 the corpus has grown to 948 with a
 export-banner share to 4.6%; **that stratum is not part of any phase-0 figure
 above**. Current whole-corpus offline censuses include its source text.
 
-The pinned snapshot carries **three complete builds** — long-term `7.23.5`,
-stable `7.24.2` and development `7.25beta3` — each with *both* oracles over all
-948 scripts, alongside six partial captures (parseIL at 7.20.8, 7.22.1,
-7.23rc1; highlight at 7.9.2, 7.23.2, 7.24rc2) that cover only 913. Schema v4
-names that split rather than leaving it to be discovered by hand: the
-`v_version_coverage` view classifies each build, and
-`coverage_class = 'complete'` is the filter every version-comparable query uses.
-`source_scripts` is byte-identical across both repins that reached this
-snapshot, so every text-derived report — the token and value censuses,
-`explain:arg-reach`, the browser-consumer proof — is unchanged by construction,
-and only the IL-derived operator census moved.
-
-**The three complete builds do not agree with each other, and that is the
-finding.** Scored over all 948 scripts:
-
-| oracle | long-term 7.23.5 ↔ stable 7.24.2 | stable 7.24.2 ↔ development 7.25beta3 |
-| ------ | -------------------------------: | ------------------------------------: |
-| `:parse` IL (`il_sha256`) | 87 scripts differ | 11 |
-| `highlight` (count + class set) | 33 | 0 |
-
-Stable and development are the same build for these purposes; long-term is the
-one that moves. So an operator-axis or token-partition figure is a claim *about
-a channel*, not about RouterOS — which is why the census reports its builds as
-separate columns and states its version set, rather than collapsing them to one
-number. Long-term is also the channel a real device most likely runs.
+The pinned snapshot (schema 5, tikoci/lsp-routeros-ts#40, plus the
+`wiresage-conformance` collection from tikoci/lsp-routeros-ts#42) carries one
+recorded capture session per release channel — long-term `7.23.8`, stable `7.24.5`,
+testing `7.25rc2` and development `7.26beta1`. Each is a `:parse` run and a
+`highlight` run over all 948 population scripts, bound to the exact submitted
+bytes and one device environment with every package installed. Two legacy
+`:parse` captures (7.20.8 and 7.22.1: 913 scripts, unknown input bytes, base
+package only) and a legacy 7.9.2 highlight summary remain as history, never as
+exact-input evidence.
+
+Every census reads the corpus through `scripts/corpus-db.ts`, in three ways
+(#498):
+
+- **Population.** `v_corpus_population` leaves out the upstream auxiliary
+  collections: 7 `capture-controls` rows and 875 `wiresage-conformance`
+  synthetic grammar cases. An observation is in the population by `script_id`,
+  not by path prefix, so a collection added upstream cannot leak into a census
+  (it did, briefly, when #42 added 875 rows to every run).
+- **Sessions.** Comparable figures name their channel run ids
+  (`capture_channels`), not a coverage label.
+- **Verdict.** The device verdict is the upstream `response_class`. Only
+  `il-no-recognized-diagnostic` is an accept, so IL carrying an embedded
+  `bad command name …` is a rejection. The shipped `:parse` reader
+  (`classifyParseResult`) agrees with it on all 5,640 channel and legacy
+  observations.
+
+The population text is byte-identical to the previous snapshot, so the
+text-derived reports are unchanged by construction: the token and value
+censuses, `explain:arg-reach` and the browser-consumer proof. The IL- and
+highlight-derived figures moved.
+
+**The channels do not agree with each other, and that is the finding.** Scored
+over all 948 scripts:
+
+| oracle | long-term 7.23.8 ↔ stable 7.24.5 | stable ↔ testing 7.25rc2 | testing ↔ development 7.26beta1 |
+| ------ | -------------------------------: | -----------------------: | ------------------------------: |
+| `:parse` readout | 95 scripts differ | 12 | 13 |
+| `:parse` response class | 5 | 0 | 0 |
+| `highlight` stream | 24 | 1 | 0 |
+
+The newer channels are nearly the same build for these purposes; long-term is
+the one that moves. So an operator-axis or token-partition figure is a claim
+*about a channel*, not about RouterOS. That is why the census reports its
+builds as separate columns and states its session set, rather than collapsing
+them to one number. Long-term is also the channel a real device most likely
+runs.
+
+**The `wiresage-conformance` cases are read separately, never as population.**
+`conformanceCases` returns the 875 third-party grammar probes with their
+upstream label, and `parseObservations(…, { collection })` returns their
+device answers. `bun run explain:conformance` scores the execute gate's offline
+answer (`fail` refuses) against `:parse` on every channel. It lists false
+rejects, missed rejections (split by device class: `plain-diagnostic` is
+syntax, while `embedded-diagnostic` is mostly a menu or parameter name, which
+needs the #501 argument lists), cases where the channels disagree, cases
+with no device answer (`unscorable`, never read as a rejection), and the
+upstream-label disagreements that #507 needs. The lists are committed in
+`test/fixtures/explain/conformance.json` and gated in CI, so a fix for any
+of #504–#506 shows the cases it moved.
 
 The corpus itself is not in this repo and is not moving here — `lsp-routeros-ts`
 owns producing snapshots, centrs owns which snapshot it measures against.
@@ -2544,10 +2827,27 @@ to mention. `/system/reboot` no longer moves the context, so a statement after
 it resolves where it actually is; `verbsplit` and `pathresolve` agree, which
 they would otherwise now do *confidently* in opposite directions. What is left
 is the honest residue of both floors — `/terminal/cuu` is a real no-argument
-command MikroTik publishes nowhere — and it stays pinned as a KNOWN LIMIT
-fixture rather than assumed closed. The contradiction that #202 would have
+command MikroTik publishes nowhere. The contradiction that #202 would have
 rendered is gone.
 
+**#211 makes that residue abstain (R14).** A verb-free absolute path that
+neither table knows used to still move the context, so `/terminal/cuu` then
+`print` resolved to an invented `/terminal/cuu/print`. On CHR 7.24.5 `:parse`
+reads `/terminal/cuu` as a command and that `print` as `bad command name print`
+at the root. `/ip fire conn` has the same shape and is navigation to
+`/ip/firewall/connection`, because RouterOS accepts abbreviated menus. A table
+miss therefore cannot decide either way. The statement now reads as R13's
+relative abstention does: not navigation, flagged `maybeNav`, with the
+statements after it `unknown` until a known absolute navigation recovers the
+context ([example 34](examples.md#34-an-unlisted-bare-path-does-not-become-a-menu)).
+Over the pinned corpus, 14 of 18,650 statement readings lose a path, in 6
+scripts. Every one was an invented path: `/ip/fire/conn/remove`,
+`/ip/firewall/layer7/add`, the v6 `/routing/bgp/network/add`, and
+`/terminal/style/error/put`. No `explain` verdict changes. Four `containsWrite`
+verdicts move from `true` to `unknown`, because their write was proven only at
+an invented path. Rule P, which would read the tables as a per-menu closed
+world and expand abbreviations, is not adopted (#372).
+
 **The command axis also outranks the punctuation guess.** `splitRun`'s last
 rule reads the first space-separated token as the verb, which lands on the
 operand whenever the command itself was written slash-joined:
@@ -2677,8 +2977,8 @@ The offline capability can advance from `coded` to `verified` when:
 - **Reachable evidence and explicit residue:** changed RouterOS semantic claims
   have committed CHR-grounded controls and a reproducible capture/replay path.
   Every remaining issue has a stated scope and dependency; #225 distinguishes
-  offline value work from live types, #272 owns evidence reachability, and #211's
-  unlisted-path decision retains the current abstention until separately decided.
+  offline value work from live types, #272 owns evidence reachability, and an
+  unlisted bare path abstains (#211) until #372 prices a closed-world reading.
 
 Retain the existing checks: `bun run lint`, `bun run test`, `bun run build`, and
 `bun run lint:ci`, plus the affected CHR grounding/integration procedure from