@tikoci/centrs 0.1.9-next.22 → 0.1.9-next.23

package/src/explain.ts

@@ -129,6 +129,7 @@ import { lookupPath } from "./explain/catalog.ts";
 import {
 	analyzeCoordinates,
 	type CoordinateAnalysis,
+	runAtByte,
 } from "./explain/coordinates.ts";
 import {
 	type Defect,
@@ -136,6 +137,7 @@ import {
 	isPositionalFact,
 } from "./explain/defects.ts";
 import { escapeSpans } from "./explain/escape-tokens.ts";
+import { findGroupFaults, type GroupFault } from "./explain/group-faults.ts";
 import { isKnownMenuPath } from "./explain/is-known-menu.ts";
 import { operatorSpans } from "./explain/operator-tokens.ts";
 import { type PathTokenCandidate, pathSpans } from "./explain/path-tokens.ts";
@@ -157,6 +159,7 @@ import {
 	findMissingSeparators,
 	type MissingSeparator,
 } from "./explain/separator.ts";
+import { findSpacedPairs, type SpacedPair } from "./explain/spaced-args.ts";
 import { stringSpans } from "./explain/string-tokens.ts";
 import { augmentSymbolOccurrences } from "./explain/symbol-values.ts";
 import {
@@ -374,7 +377,15 @@ export interface ExplainStatementFacts {
 	ev: string;
 }
 
-export type ExplainStatement = ExplainStatementFacts & ExplainReading;
+export type ExplainStatement = ExplainStatementFacts &
+	ExplainReading & {
+		/** Stable within this result: `s0`, `s1`, … in discovery order. */
+		id: string;
+		/** Owning statement's id; absent at top level. Source containment only. */
+		parent?: string;
+		/** Index of the innermost published `blocks[]` body containing this statement. */
+		block?: number;
+	};
 
 /**
  * A `[…]` command substitution, re-constituted against its enclosing menu.
@@ -394,6 +405,8 @@ export type ExplainStatement = ExplainStatementFacts & ExplainReading;
  * opinion.
  */
 export interface ExplainSubcommandFacts extends ExplainStatementFacts {
+	/** Id of the statement containing this substitution, including nested brackets. */
+	owner: string;
 	/** Menu context in force at the bracket, `/` at document root. */
 	context: string;
 	/** Every path the inner command could resolve to, shortest first. */
@@ -406,9 +419,11 @@ export type ExplainSubcommand = ExplainSubcommandFacts & ExplainReading;
 
 /** A `{…}` scope at document level. */
 export interface ExplainBlock {
+	/** Owning statement's id, when the body belongs to a published statement. */
+	owner?: string;
 	/** The argument or directive that opened it (`do`, `on-error`, …). */
 	name: string;
-	/** The BODY's span, braces excluded. */
+	/** The BODY's analyzed-byte span, braces excluded. */
 	span: ExplainSpanRange;
 	ev: string;
 }
@@ -424,10 +439,9 @@ export interface ExplainStructure {
 	 *
 	 * A `do={…}` body's statements are flattened in after their parent (which is
 	 * what RouterOS IL does to them), so a body statement's span is CONTAINED by
-	 * its parent's rather than following it, and spans may overlap. A consumer
-	 * that wants only the top level filters on containment; one that wants "every
-	 * command in this script" — the common case, and the reason to flatten — reads
-	 * the list as it stands.
+	 * its parent's rather than following it, and spans may overlap. Filter on an
+	 * absent `parent` for the top level; use `id`/`parent` for source ancestry.
+	 * Links assert no lexical inheritance, execution order, or shared environment.
 	 */
 	statements: ExplainStatement[];
 	blocks: ExplainBlock[];
@@ -750,6 +764,8 @@ const EV = {
 	braces: "e14",
 	separators: "e15",
 	escapes: "e16",
+	spaced: "e17",
+	groups: "e18",
 } as const;
 
 type EvidenceKey = keyof typeof EV;
@@ -904,6 +920,33 @@ const EVIDENCE: Record<EvidenceKey, ExplainEvidence> = {
 		basis: "heuristic",
 		outcome: "ok",
 	},
+	/**
+	 * `heuristic`: which adjacent operands could be the spaced spelling is read
+	 * from the token shapes alone. That the device pairs them, and marks the gap
+	 * `syntax-obsolete`, is grounded (`src/explain/spaced-args.ts`); which pairs
+	 * it pairs is per-command schema.
+	 */
+	spaced: {
+		id: EV.spaced,
+		source: "canonicalizer",
+		probe: "findSpacedPairs",
+		basis: "heuristic",
+		outcome: "ok",
+	},
+	/**
+	 * `heuristic`: every rejection it reports is a `:parse` answer
+	 * (`src/explain/group-faults.ts`), but which group is an array, an
+	 * expression or a query, and which token a property's parser would read
+	 * instead, rests on the brace-role and `where` readings a live probe could
+	 * overturn.
+	 */
+	groups: {
+		id: EV.groups,
+		source: "canonicalizer",
+		probe: "findGroupFaults",
+		basis: "heuristic",
+		outcome: "ok",
+	},
 };
 
 /** Diagnostic rendering for each defect class. */
@@ -933,6 +976,13 @@ const DEFECT_DIAGNOSTICS: Record<
 		message: () =>
 			'invalid escape in string: unknown escape, truncated hex, or lowercase hex digit — use \\n \\r \\t \\" \\\\ \\$ \\_ \\? \\a \\b \\f \\v, \\XX with uppercase hex, or \\ before whitespace to continue the line',
 	},
+	// #506. The device's answer for every follower but a name, `"`, `(` and
+	// `[` (`src/explain/quoted-string.ts`); the span is the `$` and that byte.
+	"bad-string-variable": {
+		severity: "error",
+		message: () =>
+			`\`$\` in a string must start a variable name (\`$v\`, \`$"v"\`), \`$(…)\` or \`$[…]\`, and RouterOS rejects it (\`syntax error\`) — write \`\\$\` for a literal dollar`,
+	},
 	"bad-sigil": {
 		severity: "error",
 		message: () => "invalid sigil: the run must be zero or one character",
@@ -1284,6 +1334,18 @@ export function explainCommand(
 	// `analyzed` is ASCII by construction, so the offsets need no coordinate test.
 	const analyzedRange = documentRange(analyzed, coordinates.ascii);
 	const segmented = segmentStatements(input);
+	if (segmented.discardFrom !== undefined)
+		return withDiscardedTail(
+			explainCommand(
+				input.slice(
+					0,
+					runAtByte(coordinates, segmented.discardFrom).utf16Start,
+				),
+				options,
+			),
+			coordinates,
+			segmented.discardFrom,
+		);
 	const statementAnalysis = resolveStatements(input);
 	const sourceRange = coordinates.ascii ? analyzedRange : undefined;
 	const verbs = resolveVerbsFromStatements(statementAnalysis, sourceRange);
@@ -1341,8 +1403,14 @@ export function explainCommand(
 	// segments and pairing the two by index attaches the wrong span to every statement after
 	// the first block. Each split carries its own document-space span.
 	//
-	const readStatements: ExplainStatement[] = verbs.splits.map((split) =>
-		statementOf(split, analyzed, analyzedRange),
+	const readStatements: ExplainStatement[] = verbs.splits.map((split, index) =>
+		statementOf(
+			split,
+			analyzed,
+			analyzedRange,
+			index,
+			statementAnalysis.statements[index]?.ownership?.parent,
+		),
 	);
 	const canonical = canonicalizeExecuteCommand(input);
 	// The skip-tolerant token stream every TOKEN-LEVEL rule reads (#316), one
@@ -1366,17 +1434,38 @@ export function explainCommand(
 			? findMissingSeparators(argumentTokens[index] ?? [])
 			: [],
 	);
+	// #350: the same order for the space-for-`=` spelling. Root directives are
+	// excluded because their operands are positional by grammar
+	// (`src/explain/spaced-args.ts`).
+	const spaced = readStatements.map((statement, index) =>
+		statement.resolution === "resolved" &&
+		statement.kind === "command" &&
+		statement.command.path !== "/"
+			? findSpacedPairs(argumentTokens[index] ?? [])
+			: [],
+	);
 	const gated = enforceGateParity(readStatements, canonical);
 	const statements = gated.map((statement, index) => {
 		const runs = separators[index] ?? [];
+		const pairs = spaced[index] ?? [];
+		const separated = withoutSeparatedArguments(statement, runs);
+		const unpaired = withoutSpacedArguments(separated, pairs);
 		return withStatementTransport(
-			withoutSeparatedArguments(statement, runs),
+			unpaired,
 			verbs.splits[index]?.text ?? "",
 			options,
 			runs.length === 0 ? undefined : rejectedBySeparator(runs),
+			// Only a reading this step withdrew. One the lexer already refused
+			// (`source {…}`, `[find]`) keeps the `execute` line it had.
+			unpaired === separated ? undefined : unpairedBySpacing(pairs),
 		);
 	});
 
+	const braceDiagnostics = invalidCommandBraceDiagnostics(
+		verbs.splits,
+		analyzed,
+		analyzedRange,
+	);
 	const diagnostics: ExplainDiagnostic[] = [
 		...defects.map(({ defect: d, ev }) => {
 			const render = DEFECT_DIAGNOSTICS[d.code];
@@ -1388,8 +1477,15 @@ export function explainCommand(
 				ev,
 			};
 		}),
-		...invalidCommandBraceDiagnostics(verbs.splits, analyzed, analyzedRange),
+		...braceDiagnostics,
+		...groupFaultDiagnostics(
+			findGroupFaults(analyzed, analyzedRange.masked),
+			braceDiagnostics,
+		),
 		...separators.flatMap((runs) => runs.map(missingSeparatorDiagnostic)),
+		...spaced.flatMap((pairs) =>
+			pairs.filter((pair) => pair.valueShaped).map(spacedArgumentDiagnostic),
+		),
 		...statements.flatMap((s) => diagnosticsForStatement(s)),
 	].sort(
 		(a, b) =>
@@ -1428,14 +1524,73 @@ export function explainCommand(
 		),
 	};
 
+	const blocks: ExplainBlock[] = scopeBlocks(input).map((b) => ({
+		name: b.name,
+		span: { start: b.start, end: b.start + b.body.length },
+		ev: EV.blocks,
+	}));
+	// Link the existing outer-block inventory in UTF-16 source coordinates.
+	// Q4's traversal supplies parentage even when Unicode widened descendant spans.
+	const sourceOffset = (byte: number): number =>
+		coordinates.ascii
+			? byte
+			: byte === coordinates.analyzed.length
+				? input.length
+				: runAtByte(coordinates, byte).utf16Start;
+	const roots = statements.filter(
+		(statement) => statement.parent === undefined,
+	);
+	let rootAt = 0;
+	const blockIndexes = new Map<number, number>();
+	for (const [index, block] of blocks.entries()) {
+		blockIndexes.set(block.span.start, index);
+		while (
+			roots[rootAt] !== undefined &&
+			sourceOffset((roots[rootAt] as ExplainStatement).span.end) <
+				block.span.start
+		)
+			rootAt++;
+		const owner = roots[rootAt];
+		if (
+			owner !== undefined &&
+			sourceOffset(owner.span.start) <= block.span.start &&
+			sourceOffset(owner.span.end) >= block.span.end
+		)
+			block.owner = owner.id;
+	}
+	for (const [index, statement] of statements.entries()) {
+		const ownership = statementAnalysis.statements[index]?.ownership;
+		if (ownership === undefined) continue;
+		const parent = statements[ownership.parent] as ExplainStatement;
+		const block =
+			parent.block ??
+			(parent.parent === undefined
+				? blockIndexes.get(
+						sourceOffset(parent.span.start) + ownership.bodyStart,
+					)
+				: undefined);
+		if (block !== undefined) statement.block = block;
+	}
+	// Publish analyzed-byte spans only after ownership has used source offsets.
+	// Shallow blocks are disjoint and ordered, so one forward walk maps both
+	// boundaries without scanning or encoding a source prefix for every body.
+	if (!coordinates.ascii) {
+		let runAt = 0;
+		const byteOffset = (offset: number): number => {
+			while ((coordinates.runs[runAt]?.utf16Start ?? Infinity) < offset)
+				runAt++;
+			return coordinates.runs[runAt]?.byteStart ?? coordinates.analyzed.length;
+		};
+		for (const block of blocks)
+			block.span = {
+				start: byteOffset(block.span.start),
+				end: byteOffset(block.span.end),
+			};
+	}
 	const structure: ExplainStructure = {
 		statementCount: statements.length,
 		statements,
-		blocks: scopeBlocks(input).map((b) => ({
-			name: b.name,
-			span: { start: b.start, end: b.start + b.body.length },
-			ev: EV.blocks,
-		})),
+		blocks,
 		containsWrite: renderWriteVerdict(write.verdict),
 		subcommands: brackets.resolutions.map(subcommandOf),
 		// `containsWrite` is the fact `structure` itself asserts; the statements
@@ -1604,12 +1759,83 @@ export function explainCommand(
 	};
 }
 
+/** The code the execute gate refuses although it is a warning (#504). */
+export const DISCARDED_CLOSE_CODE = "explain/canonicalizer/discarded-close";
+
+/**
+ * The reading of a script RouterOS stops reading early (#504).
+ *
+ * A `}` or `]` that closes nothing at the top level ends the program on the
+ * device: it accepts the script and silently discards that byte and everything
+ * after it (`segment.ts` → `discardFrom`). So `read` is the analysis of the
+ * prefix the device runs. What is added back is the whole input's coordinate
+ * facts, the tail's one `unclassified` token, and a `warning` that spans the
+ * discarded bytes. It is a warning because nothing was rejected; it is refused
+ * by the execute gate all the same, because running a script that is not the
+ * one the operator wrote is what validation exists to stop.
+ */
+function withDiscardedTail(
+	read: ExplainData,
+	coordinates: CoordinateAnalysis,
+	from: number,
+): ExplainData {
+	const bytes = coordinates.analyzed.length;
+	const close = String.fromCharCode(coordinates.analyzed[from] as number);
+	const diagnostics = [
+		...read.diagnostics,
+		{
+			code: DISCARDED_CLOSE_CODE,
+			severity: "warning" as const,
+			message: `stray \`${close}\` closes nothing: RouterOS accepts the script but stops reading here, silently discarding the \`${close}\` and everything after it — remove it, or add the opener it was meant to close`,
+			span: { start: from, end: bytes },
+			ev: EV.segment,
+		},
+	];
+	let tokens = read.tokens;
+	if (tokens !== undefined) {
+		const last = tokens.at(-1);
+		tokens =
+			last?.class === "unclassified" && last.end === from
+				? [...tokens.slice(0, -1), { ...last, end: bytes }]
+				: [
+						...tokens,
+						{
+							start: from,
+							end: bytes,
+							class: "unclassified",
+							ev: EV.coordinates,
+						},
+					];
+	}
+	return {
+		...read,
+		input: {
+			bytes,
+			normalized: !coordinates.ascii,
+			truncated: false,
+			positionMap: positionMap(coordinates),
+		},
+		verdict: verdictOf(diagnostics),
+		...(tokens === undefined ? {} : { tokens }),
+		diagnostics,
+		evidence: citedEvidence(
+			read.structure,
+			diagnostics,
+			read.spans,
+			read.symbols,
+			read.values,
+			tokens,
+		),
+	};
+}
+
 /** Attach transport only after the gate-parity guard has had the final word. */
 function withStatementTransport(
 	statement: ExplainStatement,
 	source: string,
 	options: ExplainCommandOptions,
 	rejected?: string,
+	unpaired?: string,
 ): ExplainStatement {
 	if (statement.kind !== "command" || statement.arguments === undefined)
 		return statement;
@@ -1621,6 +1847,7 @@ function withStatementTransport(
 				arguments: statement.arguments,
 				source,
 				...(rejected === undefined ? {} : { rejected }),
+				...(unpaired === undefined ? {} : { unpaired }),
 			},
 			{ renderCurl: options.curl, evidenceId: EV.transport },
 		),
@@ -1646,9 +1873,13 @@ function statementOf(
 	split: DocumentVerbSplit,
 	analyzed: string,
 	analyzedRange: MaskedRange,
+	index: number,
+	parent?: number,
 ): ExplainStatement {
 	const reading = readingOf(split);
 	return {
+		id: `s${index}`,
+		...(parent === undefined ? {} : { parent: `s${parent}` }),
 		span: { start: split.span.start, end: split.span.end },
 		...(reading.kind === "command"
 			? withArguments(reading, split, analyzed, analyzedRange)
@@ -1851,6 +2082,125 @@ function rejectedBySeparator(runs: readonly MissingSeparator[]): string {
 	return `a second command-shaped run (\`${first?.path} ${first?.verb}\`) sits in this operand stream with no \`;\` or newline before it, so this is not one accepted statement`;
 }
 
+/**
+ * Withdraw an argument reading that may be the spaced spelling (#350).
+ *
+ * `read: true` with `args: {}` and the operands as positionals is an
+ * affirmative claim that the list was read and names no argument, and the
+ * device contradicts it: `comment "something" regexp 1.1` is
+ * `comment=something;regexp=1.1`. Which adjacent words pair is per-command
+ * schema, so neither reading is published. The statement stays `resolved`;
+ * only the argument list is withdrawn, as #311 does.
+ */
+function withoutSpacedArguments(
+	statement: ExplainStatement,
+	pairs: readonly SpacedPair[],
+): ExplainStatement {
+	if (pairs.length === 0 || statement.kind !== "command") return statement;
+	if (statement.arguments?.read !== true) return statement;
+	const { args: _dropped, ...command } = statement.command;
+	return {
+		...statement,
+		command,
+		arguments: { read: false, why: unpairedBySpacing(pairs) },
+	};
+}
+
+/** The one sentence both the withdrawn argument list and transport give. */
+function unpairedBySpacing(pairs: readonly SpacedPair[]): string {
+	const first = pairs[0];
+	return `\`${first?.name} ${first?.value}\` may be an argument and its value with the \`=\` left out, which RouterOS accepts; offline has no per-command argument list to tell an argument name from a positional operand or a value-less flag`;
+}
+
+/**
+ * The spaced spelling, said out loud where the value proves it is not a flag.
+ *
+ * `warning`, not `error`: RouterOS accepts the form, but its own highlighter
+ * marks the gap `syntax-obsolete`, which is RouterOS calling the spelling
+ * deprecated. "Possible" because the name is unconfirmed offline;
+ * `/system/script add zzznotanarg "beep"` is the same shape and the device
+ * rejects it. A live `request=child` probe (#491) confirms the name.
+ */
+function spacedArgumentDiagnostic(pair: SpacedPair): ExplainDiagnostic {
+	return {
+		code: "explain/canonicalizer/possible-spaced-argument",
+		severity: "warning",
+		message: `possible obsolete spelling: \`${pair.name} ${pair.value}\` reads as \`${pair.name}=${pair.value}\` if \`${pair.name}\` is an argument of this command — RouterOS accepts a space for the \`=\` but marks it obsolete; write \`${pair.name}=${pair.value}\``,
+		span: { start: pair.span.start, end: pair.span.end },
+		ev: EV.spaced,
+	};
+}
+
+const INVALID_COMMAND_BRACE =
+	"brace arrays are not valid in command arguments — use a parenthesized comma list such as `(1,2)`, or a bare comma list where the argument schema accepts one";
+
+/**
+ * The group faults as diagnostics (#505, #509, #511, #512).
+ *
+ * All `error`: each is a `:parse` rejection on CHR 7.24.5 and 7.23.8. An
+ * empty `{}` that `invalidCommandBraceDiagnostics` already rejects as a brace
+ * array in a command argument is one defect, so it is reported once, as that.
+ * The span is the token the fault is about (the operator, the separator, the
+ * `@`, or the whole empty group); the device's column is the byte after an
+ * empty group or a dangling operator.
+ */
+function groupFaultDiagnostics(
+	faults: readonly GroupFault[],
+	braces: readonly ExplainDiagnostic[],
+): ExplainDiagnostic[] {
+	const braceAt = new Set(braces.map((d) => d.span.start));
+	return faults
+		.filter(
+			(f) =>
+				!(
+					f.code === "empty-group" &&
+					f.detail === "{" &&
+					braceAt.has(f.start)
+				) &&
+				!(
+					(f.code === "named-value-brace" || f.code === "glued-token") &&
+					braceAt.has(f.start)
+				),
+		)
+		.map((f) => ({
+			code:
+				f.code === "named-value-brace"
+					? "explain/canonicalizer/invalid-command-brace"
+					: `explain/canonicalizer/${f.code}`,
+			severity: "error",
+			message: groupFaultMessage(f),
+			span: { start: f.start, end: f.end },
+			ev: f.code === "named-value-brace" ? EV.values : EV.groups,
+		}));
+}
+
+function groupFaultMessage(f: GroupFault): string {
+	switch (f.code) {
+		case "empty-group":
+			return f.detail === "("
+				? "empty expression: `()` has nothing to evaluate, and RouterOS rejects it (`syntax error`)"
+				: "empty array: RouterOS rejects a `{}` that is the whole value of a statement or an argument (`syntax error`); a nested `{}` (`{1;{}}`) or one in parentheses (`({})`) parses";
+		case "misplaced-separator":
+			if (f.group === "{")
+				return "`;` with no array element before it on its line: RouterOS rejects it (`syntax error`) — a `;` must follow an element, and a newline already separates elements";
+			return f.detail === ";"
+				? "`;` inside `( … )`: an expression cannot hold a statement separator, and RouterOS rejects it (`syntax error`)"
+				: "a newline inside `( … )` ends the statement in the middle of the expression, and RouterOS rejects it (`syntax error`) — join the lines, or end the line with `\\` to continue it";
+		case "missing-operand":
+			return `operator \`${f.detail}\` is missing an operand, and RouterOS rejects it (\`syntax error\`) — only \`-\`, \`!\`, \`>\`, \`~\` and \`any\` take a single operand after them; every other operator needs one on each side`;
+		case "invalid-at-sign":
+			return "unquoted `@` is a syntax error in a command word, an array or an expression — RouterOS accepts it only inside an argument value (`comment=a@b`); quote it, and drop a pasted console prompt such as `[admin@MikroTik] >`";
+		case "named-value-brace":
+			return INVALID_COMMAND_BRACE;
+		case "glued-token":
+			return 'nothing may follow a closed string, `$name` or group in the same token, and a bare word may not run into a `"`, `$` or bracket: RouterOS rejects it (`expected end of command`) — put a space between the two arguments, or join them inside an expression such as `("a" . $v)`';
+		case "invalid-variable":
+			return '`$` must be followed by a variable name (letters and digits) or `"name"`, and RouterOS rejects it here (`syntax error`) — quote a literal dollar (`"\\$"`)';
+		case "invalid-name":
+			return 'a variable name is letters and digits only, and RouterOS rejects any other byte in it (`expected end of command`) — quote the name (`:local "a_b"`) to use other characters';
+	}
+}
+
 function invalidCommandBraceDiagnostics(
 	splits: readonly DocumentVerbSplit[],
 	analyzed: string,
@@ -1868,10 +2218,19 @@ function invalidCommandBraceDiagnostics(
 		// Require evidence that the brace actually opens a menu container
 		// (body starts with a submenu name), so `/ip/route/print {1;2}` and
 		// `/ip { firewall/filter/print {1;2} }` still diagnose the `{1;2}` array.
+		//
+		// A verb the vocabulary or the catalog names is no menu, so its leading
+		// brace is a positional operand: `/system/script add { :beep }` and
+		// `/system/reboot { :beep }` are rejected on CHR 7.24.5 (#496).
 		const argsText = text.slice(split.argsAt);
 		const leadingBraceAt = argsText.search(/\S/);
+		const verbIsCommand =
+			VERBS.has(split.verb) ||
+			lookupPath([...split.path.split("/").filter(Boolean), split.verb])
+				?.kind === "command";
 		let menuBraceAt: number | null = null;
 		if (
+			!verbIsCommand &&
 			leadingBraceAt >= 0 &&
 			argsText[leadingBraceAt] === "{" &&
 			split.candidates.some((candidate) =>
@@ -1887,7 +2246,8 @@ function invalidCommandBraceDiagnostics(
 				// A menu block body is a statement list, and a statement may be a
 				// scripting directive or an ABSOLUTE command — neither of which the
 				// enclosing menu can vouch for, and neither of which any array literal
-				// can start with. `/interface { ethernet { :put x } }` is corpus 521,
+				// can start with. `/interface { ethernet { :put x } }` is the shape of
+				// corpus script `forum/amm0/topic-184067-routeros-lsp-for-better-syntax-checking-command-completion-in-editors-like-vscod/post-0014-snippet-02.rsc`,
 				// accepted on 7.21.5/7.23.5/7.24.2/7.25beta3 as
 				// `(evl /interface/ethernet/ (evl /putmessage=…))` — #348.
 				menuBraceAt = braceAt;
@@ -1934,8 +2294,7 @@ function invalidCommandBraceDiagnostics(
 			out.push({
 				code: "explain/canonicalizer/invalid-command-brace",
 				severity: "error",
-				message:
-					"brace arrays are not valid in command arguments — use a parenthesized comma list such as `(1,2)`, or a bare comma list where the argument schema accepts one",
+				message: INVALID_COMMAND_BRACE,
 				span: { start: start + at, end: start + at + 1 },
 				ev: EV.values,
 			});
@@ -2107,6 +2466,7 @@ function subcommandOf(r: Resolution): ExplainSubcommand {
 					),
 				);
 	return {
+		owner: `s${r.owner}`,
 		span: { start: r.span.start, end: r.span.end },
 		context: r.context,
 		...reading,

package/src/offline-gate.ts

@@ -25,6 +25,15 @@
  * module never reports success on its behalf. `verdict: "warn"` is an
  * ABSTENTION, not a rejection, and passes through for the same reason.
  *
+ * **One warning is refused by code: {@link REFUSED_WARNING_CODES}.** It is not
+ * an abstention but a known device behaviour. A `}` or `]` that closes nothing
+ * at the top level makes RouterOS accept the script and silently stop reading
+ * there, so `/system identity set name=a}` sets `a` and `:put 1};:put 2` runs
+ * one command (#504, CHR 7.24.5 and 7.23.8). `explain` reports it as a warning
+ * because nothing is rejected; the gate refuses it because the script the
+ * device would run is not the one that was written. The list is explicit and
+ * stays small: a code joins it only for the same reason.
+ *
  * `--validate=false` disables BOTH stages — one flag, one meaning. That was
  * settled with the `--raw` precedence layer on GH#154 and is why callers gate
  * this on the same resolved `validate` setting as the device stage; the escape
@@ -39,11 +48,20 @@
  */
 
 import { CentrsError } from "./errors.ts";
-import { type ExplainDiagnostic, explainCommand } from "./explain.ts";
+import {
+	DISCARDED_CLOSE_CODE,
+	type ExplainDiagnostic,
+	explainCommand,
+} from "./explain.ts";
 
 /** Validator identity for `meta.validation` and error context. */
 export const OFFLINE_GATE_SOURCE = "offline explain (canonicalizer)";
 
+/** Warning codes the gate refuses as it refuses an error (module header). */
+export const REFUSED_WARNING_CODES: ReadonlySet<string> = new Set([
+	DISCARDED_CLOSE_CODE,
+]);
+
 /** Which stage of the two-stage gate produced a verdict. */
 export type ValidationStageName = "offline" | "device";
 
@@ -61,8 +79,8 @@ export interface OfflineGateFinding {
 export interface OfflineGateResult {
 	/**
 	 * `pass` — the analyzer read the whole input. `warn` — it ABSTAINED on part
-	 * of it (an unresolved menu, say). Both proceed to the device stage; only
-	 * `fail` throws.
+	 * of it (an unresolved menu, say). Both proceed to the device stage; a
+	 * `fail`, or a warning in {@link REFUSED_WARNING_CODES}, throws.
 	 */
 	verdict: "pass" | "warn";
 	/** Warning-severity diagnostics, kept so a caller can surface the abstention. */
@@ -95,25 +113,28 @@ export function assertOfflineSyntax(
 ): OfflineGateResult {
 	const analysis = explainCommand(command);
 	const errors = analysis.diagnostics.filter(
-		(diagnostic) => diagnostic.severity === "error",
+		(diagnostic) =>
+			diagnostic.severity === "error" ||
+			REFUSED_WARNING_CODES.has(diagnostic.code),
 	);
 	const warnings = analysis.diagnostics
 		.filter((diagnostic) => diagnostic.severity === "warning")
 		.map(findingOf);
 
-	if (analysis.verdict !== "fail") {
+	if (errors.length === 0) {
 		return { verdict: analysis.verdict === "warn" ? "warn" : "pass", warnings };
 	}
 
-	// A `fail` verdict always carries at least one error diagnostic, but read it
-	// defensively: an empty list would otherwise produce an error that says
-	// nothing about what was wrong, which is worse than a generic summary.
 	const findings = errors.map(findingOf);
 	const first = findings[0];
 	throw new CentrsError({
 		code: "validation/syntax",
 		summary: first
-			? `RouterOS syntax rejected by offline analysis: ${first.message}`
+			? `${
+					REFUSED_WARNING_CODES.has(first.code)
+						? "Refused by offline analysis"
+						: "RouterOS syntax rejected by offline analysis"
+				}: ${first.message}`
 			: "RouterOS syntax rejected by offline analysis.",
 		remediation:
 			"Run `centrs explain '<command>'` to see the offending bytes in context, " +