@tikoci/centrs 0.1.9-next.22 → 0.1.9-next.24

package/commands/explain/README.md

@@ -10,12 +10,11 @@ validation): the cheap, safe knowledge tier in front of the runners
 (`execute` / `api` / `retrieve`).
 
 Status: offline baseline `verified`; live probes over `rest-api` and `native-api`
-`designed`. **`centrs explain '<input>'` runs today**, without a router or CDB.
+`CHR-passed`. **`centrs explain '<input>'` runs without a router or CDB**, and
+`centrs explain <router> '<input>'` adds read-only device evidence.
 [`docs/MATRIX.md`](../../docs/MATRIX.md#offline-analysis) tracks these separately;
 [#90](https://github.com/tikoci/centrs/issues/90) indexes the remaining tasks.
 The spec is ratified on the [phase-0 grounding lab](#phase-0-ratification-185).
-The current finish line is [Offline baseline acceptance](#offline-baseline-acceptance),
-not completion of the live protocol cells.
 Load-bearing rules — envelope, errors, settings precedence, identity,
 validation, protocol selection — live in
 [`docs/CONSTITUTION.md`](../../docs/CONSTITUTION.md).
@@ -373,9 +372,8 @@ native API's `/execute` **with `as-string=""`** returns the parser text —
 including the `(line N column M)` diagnostic on a syntax error — byte-identical
 to what a console transport prints. The opaque `*NN` value seen otherwise is the
 **no-`as-string` job handle**, not a `:parse` limitation; the readout rule is
-"pass `as-string` and interpret `ret`". The existing execute gate already passes
-`as-string` but currently discards `ret`; phase 2 must extract/fix that shared
-readout rather than copy the omission. `/console/inspect`
+"pass `as-string` and interpret `ret`". The execute gate passes
+`as-string` and classifies `ret`; live explain reuses that shared classifier. `/console/inspect`
 (highlight/syntax/completion) works over the native API's `talk` framing too. So
 the line/column diagnostic is available on both live cells — the earlier caveat
 that only a console transport surfaces the parser text is retired.
@@ -401,10 +399,8 @@ router therefore never reinterprets a previously valid offline invocation.
 the offline form with nothing else to analyze. A positional always wins, and
 when fd 0 is redirected anyway the result carries a
 [`usage/stdin-ignored`](../../docs/errors/usage/stdin-ignored.md) warning rather
-than quietly dropping the pipe. `--file -` names stdin explicitly; it is the
-offline fix today, since the live form it also spells
-(`… | centrs explain edge1 --file -`) is parsed and then refused with
-`usage/not-implemented` until phase 2. The narrower rule is
+than quietly dropping the pipe. `--file -` names stdin explicitly in both forms,
+including live `… | centrs explain edge1 --file -`. The narrower rule is
 deliberate and measured: `runCli` is called in-process by tests, so reading fd 0
 on any path a positional invocation reaches consumes the invoking shell's
 stdin — it fed those bytes to the analyzer and broke 21 unrelated tests once,
@@ -460,6 +456,7 @@ Standard envelope (constitution: result envelope); `data` sketch:
     "statementCount": 1,
     "statements": [
       {
+        "id": "s0",
         "span": { "start": 0, "end": 51 },
         "resolution": "resolved",
         "kind": "command",
@@ -511,6 +508,36 @@ Standard envelope (constitution: result envelope); `data` sketch:
   classification, and evidence id. This is where multi-statement scripts and
   partial recovery live; a single top-level transport object cannot represent
   them.
+- **Statement ownership is syntactic (#497).** Every published statement has
+  an `id` (`s0`, `s1`, …) in discovery order, stable within one result. A nested
+  scope-body statement's `parent` names its owning statement; absence means
+  top level. Each substitution's `owner` names its containing statement,
+  including nested brackets. These links come from the resolver's traversal,
+  so widened Unicode spans do not turn siblings into ancestors. IDs are not
+  persistent across edits.
+
+  The existing `blocks[]` inventory still lists outer scope bodies only.
+  A block's optional `owner` names the statement carrying it, and a statement's
+  optional `block` indexes its innermost **published** enclosing block. A nested
+  body can therefore share its ancestor's block index. Bare/menu containers
+  add no synthetic statement or block nodes; the tree links only statements
+  the existing analysis exposes. Existing lists, order, spans and readings stay
+  unchanged. A widened span remains a coordinate limitation, not a second
+  parentage rule.
+
+  Stored/deferred `source=`, `on-event=` and callback bodies remain opaque:
+  their statements are not added to this tree. Creation versus explicit
+  stored-script execution is grounded by
+  `test/fixtures/explain/statement-ownership.json` and replayed by
+  `test/integration/explain-structure.test.ts`. Ownership asserts no lexical
+  inheritance, immediate execution, or shared user/policy environment;
+  context-sensitive binding/value semantics remain #507's responsibility.
+
+  `test/unit/explain-structure.test.ts` independently checks ancestry against
+  span containment where spans recover exact source text, with explicit
+  widened-span controls. After `bun run corpus:fetch`, run
+  `CENTRS_CHECK_CORPUS=1 bun test test/unit/explain-structure.test.ts` for the
+  same contract over the pinned study population; the corpus CI job runs it.
 - **Every derived fact keeps provenance via `evidence[]`** — facts reference
   a stable evidence id (`ev`), and the evidence entry carries source
   (`canonicalizer` vs `live-inspect`), probe, basis (direct response vs
@@ -621,7 +648,7 @@ and its phase is named below.
 | `structure.statements[].command` | `path` + `verb`, plus **`args` where the argument list was read** (#202c-1); the ordered token list is `statements[].arguments.tokens` |
 | `structure.statements[].transport` | complete for commands: `api-candidate`, `execute`, or fail-closed `unknown`, with an equivalent `centrs` invocation and opt-in `curl` for tested REST mappings (#202c-2). The `basis` names the evidence for the route it chose or refused |
 | `symbols.occurrences[]` | Q13 name/span/class plus semantic `role`, result-local `bindingIds`, sigil spelling, and an abstention note where needed; **plus** (#239 S2) `valueId` on declarations/assignments with a literal RHS in the same statement, and `reachingValueIds` + `reachingUnknown` on references (flow-sensitive, branch → set, loop/non-literal → `unknown`, no RHS evaluation) |
-| `values.occurrences[]` | result-local value id/span plus three separate fact homes: offline `shapeHints`; live `observedType` and `schemaType` remain absent until phase 2. `kind: "element"` rows are array members, carrying `parent` and, for a keyed member, `name` |
+| `values.occurrences[]` | result-local value id/span plus three separate fact homes: offline `shapeHints`; live `observedType` and `schemaType` are added only by a live call ([Live value types](#live-value-types-225)). `kind: "element"` rows are array members, carrying `parent` and, for a keyed member, `name` |
 | `spans` | comment runs and resolved variable classes only; **no value shape or type** |
 | `schema`, `completion` | absent — live evidence, phase 2 |
 
@@ -713,13 +740,10 @@ and its phase is named below.
   rejected by RouterOS at `{` and resolve no reference. In an expression the
   remaining `-dns` is scanned as subtraction plus its right operand; inside a
   string it is literal text.
-- **Evidence is offline-shaped, not the whole contract.** The bullet above says
-  an evidence entry carries `source` (`canonicalizer` vs `live-inspect`) and a
-  RouterOS version stamp; phase 1 emits neither the live source nor the stamp,
-  because no probe ran and there is no device to stamp. `ExplainEvidence` is
-  typed to what offline produces rather than pre-declaring variants nothing can
-  emit, so phase 2 widens the union and adds the stamp — an addition, not a
-  change to what a caller reads today.
+- **Evidence follows its producer.** Offline calls emit only `canonicalizer`
+  entries, with no device version. Live calls add `live-inspect` entries with
+  probe outcomes and available device provenance; existing offline entries
+  retain their meaning. See [Live probe foundation](#live-probe-foundation-491).
 - **Value facts are three axes, never one `type` string (#225).** RouterOS
   types values at parse time while `highlight` classes every value byte `none`,
   so type evidence is not a subset of Q12 spans. Each result-local
@@ -732,7 +756,7 @@ and its phase is named below.
   The stable/testing CHR matrix fixes the offline lexicon: `num`, `ip`,
   `ip-prefix`, `ip6`, `ip6-prefix`, `id`, `time`, `array`, `mac`, `bool`, and
   `str` — `op` is deliberately not a member: a deferred `(> …)` abstains
-  offline and is reported only as a live `observedType` (#288); quoted literals
+  offline and live alike (#288, #225); quoted literals
   hint only `str`, while malformed and out-of-range address-like controls
   abstain even in named attributes. Most vocabulary borrows RouterOS scripting
   type names (with the explicit `macAddr` schema exception below), so a hint
@@ -766,8 +790,9 @@ and its phase is named below.
   1 and identical `:parse` IL — only `:typeof` distinguishes them
   (`test/fixtures/explain/operators.json` → `sweep.runtime`
   `typeof-deferred`/`deferred-array-typeof` and `sweep.opAxis` `defer-*` on
-  7.21.5, 7.23.3, 7.24rc4). Offline abstains on every such form; `op` lives
-  only as a live `observedType` (#288, a bounded #225 decision).
+  7.21.5, 7.23.3, 7.24rc4). Offline abstains on every such form, and so does
+  the live `observedType`, which never sends `:typeof` (#288, #225). `op` has
+  no producer.
   Shape remains non-authoritative: `100000w` is time-shaped but observed as
   `str`. Argument context remains separate: on 7.23.3 and 7.24rc3, both
   `/ip/address address=2.2` and firewall `src-address=2.2` canonicalize it to
@@ -781,8 +806,8 @@ and its phase is named below.
   and does not widen the hint. Thus a hint never validates a value or becomes a
   diagnostic, and never changes `runtimeAcceptance`. Quoting likewise never
   earns a wrong-type diagnostic: commands may cast quoted strings at runtime.
-  Offline emits only `shapeHints`; phase 2 adds the two live facts into their
-  existing homes when its safe IL/schema producers land.
+  Offline emits only `shapeHints`; a live call adds the two live facts into
+  their existing homes ([Live value types](#live-value-types-225)).
 
   **A located array is read member by member (#225 V1).** Each member of a
   `{…}`/`(…)` literal is its own `values.occurrences[]` row with `kind:
@@ -907,7 +932,16 @@ and its phase is named below.
   top-level brace value in any other command argument emits
   `explain/canonicalizer/invalid-command-brace` at the `{`; parentheses or a
   `[…]` substitution restore the expression context where the same literal is
-  legal. An empty member is a
+  legal. So does a top-level `where` clause (#502): `print where interface in
+  {"ether1";"ether2"}` is a read, and its array is read member by member like
+  its `(…)` twin. The exception is the right side of `<name>=`, `!=` or `==`,
+  spaced or not, which the device reads with that property's own parser
+  (`expected interface value`), so `where comment={1;2}` keeps its error. The
+  device does that only for a property the menu knows (`where foo-bar={…}`
+  parses). Offline has no property list, so it treats every bare name as one.
+  The same comparison inside `( … )` or a `[ … ]` command
+  (`[find where interface={"x"}]`, `where (interface={"x"})`) is caught by the
+  group walk (#509, below) and reported with the same code. An empty member is a
   syntax error (`{;}`, `{;1}`, `{1;;2}`, `(1,)`) and withdraws the enclosing
   `array` shape with it; a single trailing separator is legal in the brace form
   only (`{1;}` and `{1;2;}` parse, `{1;2,}` and `{2,}` do not).
@@ -947,15 +981,16 @@ and its phase is named below.
 
   <!-- BEGIN GENERATED value-census — regenerate with `bun run explain:value-census:readme` -->
   The corpus census is re-derivable with `bun run explain:value-census` and
-  covers 948 source scripts. The figures below are generated from
-  `test/fixtures/explain/values.json` → `corpus` by
-  `bun run explain:value-census:readme` and gated against it by
+  covers 948 source scripts of corpus snapshot `e12d5d4e58a4`, with 882
+  auxiliary rows (7 `capture-controls`, 875 `wiresage-conformance`) excluded.
+  The figures below are generated from `test/fixtures/explain/values.json` →
+  `corpus` by `bun run explain:value-census:readme` and gated against it by
   `bun run explain:value-census:readme:check`; the fixture itself is gated
   against a fresh corpus run by `bun run explain:value-census:check`. Of the
-  13,161 emitted values in a statement the strict argument lexer ALSO read, 0
+  13,152 emitted values in a statement the strict argument lexer ALSO read, 0
   disagree with it on half-open byte span or decoded text, while the
   prefix-safe scan retains a further 6,538 values across 568 statements whose
-  strict REST reading abstains. Of 19,699 emitted occurrences, 5,636 are array
+  strict REST reading abstains. Of 19,690 emitted occurrences, 5,636 are array
   members (529 keyed, 1,147 nested inside another member) and 808 are arrays;
   the corpus holds no source-literal `id` example. The three structural
   counters — spans addressing bytes outside their own source, members naming a
@@ -982,7 +1017,8 @@ comment, a literal hash value, and a hard error at the exact byte.
 | Statement-leading at the document root, after a real statement separator, in a `do`/`else`/`foreach do` body, or immediately inside a `[…]` command substitution | `comment` through newline | Mask it and preserve byte offsets. A command first consumes that lead, so `[:put #test]` keeps `#test` as the value. |
 | First non-space content inside a stored-script brace such as `on-event={ # c` | `comment` | Treat exact `source`/`script` and `on-*`-named brace values as comment-bearing script bodies; a suffix such as `myScript` is not one. |
 | Immediate line start after `\` + newline | `comment`; the pending statement survives | Mask it in both argument views; the continuation-reach rules remain H5/#215. |
-| Inside an array (`{#test}`, `{1;#test}`, `{a=1;#b=2}`) or parenthesized expression (`(1,#test)`) | hard `error` at `#`; `:parse` reports `syntax error` | Do not mask it or emit an array value hint; semantic resolution stops there. |
+| Inside an array (`{#test}`, `{1;#test}`, `{a=1;#b=2}`) or parenthesized expression (`(1,#test)`), except at column 0 inside an array (next row) | hard `error` at `#`; `:parse` reports `syntax error` | Do not mask it or emit an array value hint; semantic resolution stops there. |
+| At column 0 of its own line inside an array, at any depth and in argument values (`:local z {a=1;⏎# c⏎b=2}`, `{a={⏎# c⏎1}}`, `({⏎# c⏎1})`, `:foreach i in={1;⏎# c⏎2} do=…`), including after `\r⏎` and a `\`-continued line (#503) | `comment` through newline; `:parse` drops it (`value=a=1;b=2`) and `highlight` has no `error` on CHR 7.24.5 and 7.22.1 | Mask it with `startsArrayCommentLine`, which every walker asks with its innermost frame. It ends nothing: the array's statement carries on. An indented `#` (space or tab), one after `{`, a value or `;` on the same line, and one at column 0 directly inside `( … )` stay errors. A comment-only array (`{⏎# c⏎}`) is rejected only because an empty array is (#511). |
 | A scope-named brace (`do=`/`else=`/`command=`/`script=`/`source=`/`on-*=`) nested inside an array (`:local z {do={ # c⏎:put 1}}`, `:local z {script={ # c⏎…}}`, `:local z { { # c…}}`) — and likewise a bare `{` or `/menu {` inside an array | hard `error` at `#`; `/console/inspect` request `highlight` classes that byte `error` on CHR 7.23.3 (grounded in #249 on the four `#249` rows plus `bare {`/`source`/`on-event` corners) | A brace bears statements only when its enclosing context already does — `enclosing && braceStartsStatements(…)` on each walker's stack (`contexts`/`delimStack`/`frames`/`stack`). Inside an array the name is an array key and its `{…}` is a nested array. A `[…]` substitution nested in that array does re-enter a statement context, so `[:do { # c…}]` stays a real comment and a bare `{` under a bracket does too. |
 | Inside a `[…]` substitution that is itself nested in an array (`{[:put #test]}`, `{1;[:put #test]}`) | literal value (`none`) — the bracket restores the statement role the array dropped | Keep it as content and keep the enclosing array readable. The role is per frame, so an array or group opened again inside that bracket (`{[:put {#test}]}`, `{[:put (1,#test)]}`) is `error` once more; skipping whole `[…]` regions would wrongly accept those. |
 | In an attribute or bare value (`comment=#test`, `comment=a#b`, `:global y #test`) | literal value (`none` highlight class) | Keep it as content. |
@@ -1020,6 +1056,14 @@ JSON-like transcript, and two shell-shaped snippets. No RouterOS command reading
 moved; these diagnostics say those bytes are not valid RouterOS, not that the
 foreign snippets were expected to parse as RouterOS.
 
+Corpus re-measurement for #503: one script of 947 moves. It is a pasted console
+session (`forum/amm0/topic-264287-…/post-0005-snippet-01.rsc`, which opens with
+`[admin@MikroTik] > {`), and it moves from `fail` to `warn`. Its `invalid-hash` sat on a column-0
+`# ... more code` line inside the brace after `>`, which the device reads as
+an array (`:local z (1 > {⏎:local a 1⏎# c⏎})` parses). The device rejects the
+script earlier, at the prompt's `@`, which is #512. Every census gate except
+the token census is unchanged; that one gains the two comment spans.
+
 The default text renderer surfaces comment spans in a `comments:` section; JSON
 continues to carry the same ranges as `spans[]` entries with `class: "comment"`.
 
@@ -1074,10 +1118,18 @@ navigated, so the context stays as unknown as it already was.
       `:parse` `expected message value`, grounded stable+testing #247),
     `bad-sigil`,
     `invalid-hash`, `invalid-apostrophe` (#355, below),
-    `missing-statement-separator` (#311, below). Nine classes
-    the device itself rejects.
+    `missing-statement-separator` (#311, below), the four group faults
+    `empty-group`, `misplaced-separator`, `missing-operand` and
+    `invalid-at-sign` (#505, #511, #512, below), and the four token faults
+    `glued-token`, `invalid-variable`, `bad-string-variable` and
+    `invalid-name` (#506, #518, below), and the two unquoted-byte faults
+    `unquoted-reserved-byte` and `unquoted-non-ascii` (#358, #371, below).
+    Nineteen classes the device itself rejects.
   - `warning` — `over-depth`, because it is centrs's own resource bound and says
-    nothing about whether the input is legal; and an `ambiguous`/`unknown`
+    nothing about whether the input is legal; `possible-spaced-argument`
+    (#350), a spelling RouterOS accepts and marks obsolete; `discarded-close`
+    (#504), a script RouterOS accepts and stops reading early, which the
+    execute gate refuses by code; and an `ambiguous`/`unknown`
     resolution, never an error, so the default `--fail-on error` cannot fail a
     document whose only sin is being unreadable without a schema — which is most
     of RouterOS scripting.
@@ -1182,6 +1234,200 @@ it. The corpus count is unchanged at **0** for the same reason it always was
 the rule is an unterminated string or an unbalanced delimiter, because neither
 walk can find a boundary to resume from.
 
+### Faults inside groups (#505, #509, #511, #512)
+
+Four missed-rejection families share one walk, `src/explain/group-faults.ts`
+(evidence pass `findGroupFaults`). It reads the comment-masked document with
+the frame roles every other walker uses: `[` opens a statement, `(` an
+expression, and `{` a body when `braceStartsStatements` says so or the
+directive takes a program in that slot (`:execute {…}`, `:time {…}`). Each
+rule is a `:parse` answer on CHR 7.24.5 and 7.23.8, identical on both, and
+`test/fixtures/explain/group-faults.json` pins all 186 rows (100 rejections,
+86 controls). `test/integration/explain-group-faults.test.ts` holds the
+device to that fixture, and `test/unit/explain-group-faults.test.ts` holds
+offline to it.
+
+| Code | Device rule | Rejected | Accepted |
+| ---- | ----------- | -------- | -------- |
+| `empty-group` | A `( )` with nothing in it, and a `{}` that is the whole value of a directive slot | `:put ()`, `:if () do={}`, `:local z {}`, `:put [:len {}]`, `:foreach i in={} do={}` | `{1;{}}`, `{a={}}`, `({})`, `[{}]`, `where … in {}`, `do={}`, `source={}`, `:execute {}` |
+| `misplaced-separator` | A `;` with no array element before it on its line; a `;` or a bare newline directly inside `( … )` | `{;1}`, `{1;;2}`, `{1⏎;2}`, `(1; 2)`, `(1⏎+ 2)` | `{1;}`, `{1;2;⏎}`, `{1⏎2}`, `{1 \⏎;2}`, `(1 +\⏎2)`, `({1;2})` |
+| `missing-operand` | An operator with no operand: a binary one first in a group or after another operator, any one last, and a leading or trailing `,` in an array | `(1 +)`, `(+ 1)`, `(1 + + 2)`, `(1 == 2)`, `(!)`, `(1 and)`, `{1,}`, `{,1}` | `(1 2)`, `(- 1)`, `(1 + -2)`, `(-> 1)`, `(any any 1)`, `(and 1)`, `(. 1)`, `(1.)` |
+| `invalid-at-sign` | A `@` in a statement's head word, in an array, or in an expression | `[admin@MikroTik]`, `admin@x`, `:put@x`, `{1;a@b}`, `(a@b)` | `:put a@b`, `comment=a@b`, `[:len a@b]`, `[:len x] a@b` |
+
+`invalid-command-brace` gains the #509 positions: a brace after `<name>=`
+inside `( … )` or a `[ … ]` command whose statement says `where`. The top level
+and scope bodies stay with `args.ts` (#502), and a `do={` body is never read as
+a comparison.
+
+**Prefix operators are the device's set, not the operator table's arity.**
+`-`, `!`, `>`, `~` and `any` take one operand after them, so `(1 + -2)` and
+`(-> 1)` (`(- (> 1))`) parse. Every other operator needs a left operand. At
+operand position `and`, `or`, `in`, `.` and `/` are variable names
+(`(and 1)` is `( $and 1)`). `1.`, `1/`, `a_b`, `1:2` and `1.2.3.4/24` are
+single words, while `-` is always an operator (`(a-b)` is `(- $a $b)`).
+
+**A query is not an expression.** Inside `where …` and `find …`, the device
+reads the value after `<name>=` with the property's parser. So
+`where (comment=+)`, `where (comment=a-)`, `where (comment=@)` and
+`where (.id=*1)` parse, though each is an error in a plain group. A group in a
+query gets only the structural checks (empty, `;`, newline) and #509.
+
+**A brace offline cannot place is opaque, not an array.** A `{` after a
+relative menu word is a menu body (`/ip { route { } }` parses empty), and a
+brace in a command argument is `args.ts`'s. Neither is checked here. The
+array rules apply where the role is grounded: a directive slot in the
+`brace-slots.ts` array table, and an array nested in an array or an expression.
+
+**Three readings the review round grounded (PR #516).** A `\` continuation
+runs on across blank lines and line-leading comment lines, as H5 does
+elsewhere, so `(1 +\⏎# c⏎2)` and `{1\⏎⏎;2}` parse, while a blank line after a
+comment line ends it (`(1 +\⏎# c⏎⏎2)` is rejected at the blank line). A
+directive's operand is a name, so `:local where (comment={})` parses and
+`:local where (1 +)` is checked like any expression. A bare `local`/`global`
+is the same directive at the root (`local where (comment={})` is
+`/localname=$where`), while a bare `set` or `find` may be a menu command and
+stays unread. And a named element takes
+a trailing `,` (`{a=1,}` is `value=a`, `{a=1,;b=2}` is `value=a;b=2`), while
+`{a=,1}`, `{a=1,,2}` and a positional `{1,}` are rejected. A faulted group's
+descendants are opaque, since the device stops at the fault.
+
+**Spans.** Each fault spans the token it is about: the operator, the
+separator, the `@`, or the whole empty group. The device's column is the same
+byte for every rule except an empty group and a dangling operator, where it is
+the byte after.
+
+**Measured.** Corpus `e12d5d4e58a4`: 70 of 948 scripts gain an error and all
+70 are device rejections on every channel. 42 of those errors sit on the exact
+byte the 7.24.5 diagnostic names, and the other 28 come after an earlier device
+error in pasted non-RouterOS text. None precedes the device's error. 41
+verdicts move to `fail` (40 from `warn`, one from `pass`), so offline now fails
+133 of the 374 device-rejected scripts, up from 92, and false rejects stay at 1.
+`invalid-at-sign` is mostly pasted console prompts. On the conformance cases,
+22 `plain-diagnostic` missed rejections move to `fail`, with no new false
+reject.
+
+Not covered here: a `$( … )` group, a group under a `find` head
+(`[find (1 +)]`, read as a query), a `@` in a later head word
+(`/ip address@ print`), operand rules for array elements other than `,`, a
+group in a query beyond its structure, and adjacency without whitespace
+(`"x"~a`, `}else=`), which is the next section's.
+
+### Token faults and the discarded tail (#504, #506, #518)
+
+Three more missed-rejection families, and one reading that was wrong in the
+other direction. The glued-token, variable and name rules ride the same walk as
+the group faults (`src/explain/group-faults.ts`), so they share its statement,
+query and brace roles. The `$` inside a string is checked by the escape walk
+(`src/explain/quoted-string.ts`), and the stray close by the segmenter
+(`src/explain/segment.ts` → `discardFrom`). Every rule is a `:parse` answer on
+CHR 7.24.5 and 7.23.8, identical on both, and
+`test/fixtures/explain/token-faults.json` pins these rows and the unquoted-byte
+rows below: 292 in all (184 rejections and 108 acceptances, with the
+acceptances' IL). `test/integration/explain-token-faults.test.ts`
+holds the device to that fixture, and `test/unit/explain-token-faults.test.ts`
+holds offline to it.
+
+| Code | Device rule | Rejected | Accepted |
+| ---- | ----------- | -------- | -------- |
+| `discarded-close` (warning) | A `}` or `]` that closes nothing at the top level ends the script: the device accepts it and drops that byte and everything after it | — | `}` (IL `/`), `:put 1};:put 2` (IL `(evl /putmessage=1)`), `name=a}` (sets `a`) |
+| `glued-token` | After a closed string, `$name`, `$"…"` or group, only a separator; after a bare word, no `"`, `$`, `(`, `[` or `{` | `:put "a"b`, `$v.b`, `$v$v`, `(1)(2)`, `[:len a]b`, `}else=`, `src-address=$v/24`, `dst-port="80",443`, `:put a"b"`, `name=a$v` | `:put a.b`, `a-b`, `a_b`, `a#b`, `a~b`, `where comment="a"b`, `[find comment="a"b]`, `("a"b)`, `{"a"b}`, `dst-address-list=!"my list"`, `dst-port=80,"443"` |
+| `invalid-variable` | Outside a string, `$` takes a name (`[A-Za-z0-9]+`) or `$"…"` | `:put $`, `$_`, `$-`, `$.`, a `$` before a space | `$v1`, `$"a b"` |
+| `bad-string-variable` | Inside a string, `$` takes a name, `"`, `(` or `[` | `"a$ b"`, `"$-"`, `"$_"`, `"${"`, and the same in `where`, an array, a group and a nested `$[…]` string | `"$v_x"` (`$v` then `_x`), `"\$ x"`, `"$(1)"`, `"$[:len a]"` |
+| `invalid-name` | The first operand of `:local`, `:global`, `:set`, `:for` and `:foreach` is a name of letters and digits, or a string | `:local a_b`, `a-b`, `a.b`, `a$v`, `:local $a`, `:local (a)`, `:for i,j`, `:foreach a,`, `:foreach a,,b` | `:local "a_b"`, `:local 1a`, `:foreach a,b`, `:foreach "a",b`, `:local name=x value=1`, `:set (a) 1` |
+
+**The stray close was the honest-reading bug.** Offline used to fail
+`name=a}` with `unbalanced-close`, and the device accepts it. But the device
+does not just ignore the `}`: it stops reading there. `}⏎:put 1` lowers to `/`,
+and a write after the brace never runs. So `explainCommand` now analyzes only
+the prefix the device reads and adds one `warning` that spans the dropped
+bytes. The token partition still covers the whole input, with the tail
+`unclassified`. A `)` in that position, and any stray close inside an open
+group, are rejections and stay `unbalanced-close` errors. The execute gate
+refuses `discarded-close` by code, the one warning it refuses
+(`src/offline-gate.ts`; `commands/execute/examples.md` V9).
+
+**Where a property's parser decides, the glued-token rule abstains.** In a
+command argument the device hands the value to the property's parser, which can
+take a glued part after a prefix or separator: `dst-address-list=!"my list"`
+and `dst-port=80,"443"` parse, while `name=!"a"` and `name=-"a"` do not. So
+outside a `:` directive, a bare word followed by a `"`, `$` or bracket is a
+fault only after an alphanumeric byte. After a closed part no property was found
+that accepts anything (`"80",443`, `$p-90`, `$v%ether1`, `"ether"1` are all
+rejected), so that half of the rule applies everywhere outside a query.
+
+**Spans.** Each fault spans its byte, which is the device's byte too. For the
+two `$` rules the span is the `$` and the byte after it, and the device names
+that second byte.
+
+**Measured.** Corpus `e12d5d4e58a4`: 23 scripts move to `fail` (18 from
+`warn`, 5 from `pass`), and 29 already-failing scripts gain a new code. All are
+device rejections on every channel. 9 of their first new errors sit on the
+7.24.5 diagnostic's byte, 45 come after it, and none precedes it. Offline now
+fails 154 of the device-rejected scripts, up from 133. The one corpus false
+reject (a stray `}`) is gone, so false rejects are 0. Three scripts move from
+`fail` to `warn`: their `unbalanced-close` became `discarded-close`, and two of
+them are device rejections for an earlier reason offline does not see. On the
+conformance cases, false rejects go from 3 to 0 and missed rejections from 278
+to 151.
+
+**Not covered here.** `"a$"`: the device reads `$"` in a string as a quoted
+variable name, so the next `"` does not close the string. Every scanner in
+`explain` closes it there, so both `$` rules and the glued-token rule abstain
+around a string that ends in `$"` (2 of 948 corpus scripts use the form).
+`$$`, `$(…)`, `$[…]` and `${…}` outside a string, where the device's byte is
+not the `$`. A `\` continuation inside a glued token (`"a"\⏎"b"`). A glued
+head word (`$v"a"`, `{…}:put 2`). `:local a=b`, which 7.24.5 reads as
+a named argument and 7.23.8 as a syntax error. And a name in `/local` or
+`:local name=a_b`.
+
+### Unquoted bytes (#358, #371)
+
+A `?`, a backtick and a non-ASCII byte are never part of a bare word, and
+neither is a second `=` in a menu command's argument. The rules ride the
+token walk (`src/explain/group-faults.ts`). They were grounded with live
+explain (`explainLiveEnvelope`: `:parse` and `highlight`) on CHR 7.24.5 and
+7.23.8, which answered identically. The 147 rows are in
+`test/fixtures/explain/token-faults.json`.
+
+| Code | Device rule | Rejected | Accepted |
+| ---- | ----------- | -------- | -------- |
+| `unquoted-reserved-byte` | `?` and a backtick, at the byte, outside a string or comment. A second `=` in a menu command's argument, at that `=` | `name=a?b`, ``name=a`b``, `name=?b`, `:put a?b`, `[:len a?b]`, `where comment=a?b`, `[find comment=a?b]`, `where (comment=a?b)`, `where comment in {a?b}`, `{a?b}`, `(a?b)`, `/ip/address/print?`, `name=a=b`, `name==b`, `comment=x==`, `url=http://x/a?b=c`, `regexp=^a?b`, `public-key=…=`, `secret=abc==`, `on-event=a=b` | `name="a?b"`, ``name="a`b"``, `name="a=b"`, `where comment=a=b`, `[find comment=a=b]`, `[/ip/address/find comment=a=b]`, `where (comment=a=b)`, `where comment in {"a?b"}`, `{a=b}`, `{"a?"=1}`, `# a?b`, `("a"."?")` |
+| `unquoted-non-ascii` | A non-ASCII byte outside a string or comment, at its first byte; the span is the whole run | `:put café`, `$café`, `name=router-café`, `name=🛰`, `/systemé/identity`, `printé`, `namé=x`, `where comment=café`, `{café}`, `(café)`, `"x"é`, a non-breaking space, `“x”`, `address=…` | `:put "café"`, `:local "café" 1`, `$"café"`, `"a$café"` (`$caf` then `é`), `name="router-🚀"`, `# café`, `do={:put "café"}` |
+
+**Where the device reports, offline reports.** In a menu command's argument
+name the device names the name's first byte (`/ip/address/add addré=1` and
+`a?b=1` at the `a`), so the span is the name. A directive (`:put café=1`) and
+a `$` call (`$f café=1`) report at the byte. A declared name keeps the
+existing `invalid-name` (`:local café`, `:foreach café`). A query, and a
+group or array inside one, keeps `=` as an operator but not these bytes
+(`where (comment=café)` and `in {café}` are rejected at the `é`), and the slash-joined `[/ip/address/find …]` is a query, as
+`[find …]` is. A leading BOM is a positional fact and is not read as part of
+the first word. The informational `non-ascii` fact is still published beside
+the error, so `isPositionalFact("non-ascii")` is unchanged.
+
+**No property parser takes these bytes.** This is the difference from the
+glued-token rule. `regexp=a?b` (layer7 and DNS static), ``regexp=a`b``,
+`public-key=<base64>=`, `secret=abc==`, `password=abc=`,
+`http-header-field=a:b=c` and the script bodies `on-event=a=b` and
+`up-script=a=b` are all rejected at the byte.
+
+**Measured.** Corpus `e12d5d4e58a4`: 8 scripts move to `fail` (7 from `warn`,
+one from `pass`), and 20 already-failing scripts gain a new code. All 28 are
+device rejections on every channel. 8 of their first new errors sit on the
+7.24.5 diagnostic's byte, 20 come after it, and none precedes it. There are no
+false rejects. On the conformance cases, 10 missed rejections move to `fail`
+(the `non-ascii-outside-strings` u10–u12 and u14–u16, z90, z92, g18 and e33), with no new
+false reject.
+
+**Not covered here.** `:put a=b`, `:local x a=b` and `[:len a=b]`: 7.24.5
+reads them as a named argument (`bad parameter a`, at the end), and 7.23.8
+rejects the `=`. A query value that starts with `=` (`where comment==b`,
+`expected comment value`). A bare `source=` value,
+which the device rejects at its first byte whatever it holds (`source=abc`), so
+a byte rule there reports after the device's byte. And `:set` of an undeclared
+name, which the device rejects at the name's first byte (`:set zzz 2`), so
+`:set café` is reported at the `é`, after it.
+
 ### The token stream a rule reads (#316)
 
 `lexArguments` is all-or-nothing by design: its consumer renders a runnable REST
@@ -1394,17 +1640,108 @@ print } }` is `(evl (evl (evl /ip/address/print)))` on device and
 form failed. A menu block's body is a statement list, so it may open with a
 submenu, with one of the thirteen frozen CRUD verbs (`verbs.ts`), with a
 catalog-named command, with a `:` scripting directive, or with an absolute
-command — corpus 521 is the directive case, `ethernet { :put … }`.
-
-That last rule is bounded by what a STATEMENT can start with, which is what
-keeps `{1;2}` an array literal: an array member opens with a digit or a quote
-and never reaches the identifier branch. It is also deliberately not widened
-into a claim of existence. Menu-scope resolution is schema-dependent —
-`/ip { zzznotamenu { print } }` is a `syntax error` on device — and offline has
-no schema, so a catalog MISS abstains rather than being decided either way.
-That is the catalog's own "a hit is decisive, a miss says nothing" contract, and
-turning such a miss into an acceptance would be the mirror-image defect of the
-one being fixed here.
+command — corpus script `forum/amm0/topic-184067-routeros-lsp-for-better-syntax-checking-command-completion-in-editors-like-vscod/post-0014-snippet-02.rsc` is the directive case,
+`ethernet { :put … }`.
+
+Issue #348 only stopped the failure. It still read `address { … }` as a command
+`/ip address` whose operand was the brace, so the body was never segmented.
+That rule was bounded by what a statement can start with, on the theory that
+`{1;2}` there is an array. The device says otherwise (#351, CHR 7.24.5 and
+7.23.8): a brace right after a menu word is a statement block whatever the body
+holds. `/ip { address { 1;2 } }` is `bad command name 1` at the `1`, and
+`/ip { address { a;b } }` runs `a` as `add`. The old reading failed the OUTER
+brace at depth three, and passed `print {1;2}` and `print; zzz` inside the body.
+
+So a relative run inside a menu block now opens a block of its own when the
+menu it names is known: the enclosing block's path, read outward from the
+source, plus the run, named by a shipped structure table
+(`scope-brace.ts` → `menuBlockPath`). The segmenter, the comment mask, the
+argument lexer and the group-fault walk all ask it. The body is then read like
+`/ip/address { … }`: `print {1;2}` there fails at its own `{`, the device's
+byte, and an unresolvable body statement abstains at every depth.
+
+It is deliberately not widened into a claim of existence. Menu-scope
+resolution is schema-dependent — `/ip { zzznotamenu { print } }` is a
+`syntax error` on device — and offline has no schema, so a catalog MISS
+abstains rather than being decided either way. That is the catalog's own "a
+hit is decisive, a miss says nothing" contract. Three spellings keep the older
+reading because the source alone does not name the menu: a block after a
+navigation statement (`/ip⏎address { … }`), an abbreviation (`addr {`) and a
+digit-led menu (`6to4 {`, which the resolver does not read as a path). After a
+navigation, `/ip⏎address { 1;2 }` still fails at the outer brace and
+`/ip⏎address { print {1;2} }` still passes; the device answers
+`bad command name 1` and `expected end of command` at the inner brace.
+
+### The `=` is optional in ordinary arguments too (#350)
+
+The #347 rule is the narrow half of a general one: a space can stand in for the
+`=` of any command argument. `/ip/firewall/layer7-protocol add comment
+"something" regexp 1.1` lowers to the IL of `comment="something" regexp=1.1`
+on CHR 7.22.1, 7.23.8 and 7.24.5, and `highlight` marks each gap
+`syntax-obsolete`, which is RouterOS calling the spelling deprecated. Unlike
+the four #347 scope names, this one cannot be read offline. The device pairs
+`comment` with its value because it knows the command has a `comment`
+argument, and `/system/script add zzznotanarg beep` is rejected. Which words
+are argument names is per-command schema, which offline does not ship.
+
+Offline used to publish the worst reading available: `arguments.read: true`,
+`args: {}`, the operands as positionals. That is an affirmative claim that the
+list was read and holds no arguments. Now any adjacent pair of a
+name-shaped bare operand and another operand withdraws the argument reading,
+as #311 does. The statement stays `resolved`, `command.args` is absent,
+`arguments.why` names the pair, and transport stays the `unknown` it already
+was. A **warning** (`possible-spaced-argument`, example 33) is raised only
+where the second operand cannot be a flag (quoted, numeric, `$`-led). That is
+because the same bytes are also two flags: `print detail without-paging`
+lowers to `detail=true;without-paging=true` with no `syntax-obsolete` marker,
+while `set ether1 name x` pairs. So two bare words abstain silently. `where`
+ends the scan, and root directives are excluded because their operands are
+positional by grammar (`:pick abc 0 1` lowers to `counter=abc`). Live
+`request=child` discovery (#491) is what confirms a name and makes the warning
+definite.
+
+The same applies before a script body. `source { :beep }`,
+`on-event { :beep }` and `down-script { :beep }` lower to their `=` IL, while
+`comment { :beep }` is a `syntax error`. So the brace exemption accepts the
+bare spelling, and its name shape gained the `…-script` arguments
+(`up-script`, `lease-script`) that hard-failed even with the `=`. Which slots
+take a body is per-menu and per-version schema (`lease-script={…}` parses on
+7.24.5 and not on 7.22.1). The shape decides the brace's role for every
+reader, not just the error, and it errs toward a body: an argument the
+command does not have (`zzz-script={…}`, and `on-zzz={…}` before #350) is a
+device `syntax error` that offline does not report. That is a missed
+rejection for the device preflight to catch, never a false reject. On the
+pinned corpus the widening changed no census.
+
+### First-segment script-body abbreviations warn instead of rejecting (#525)
+
+RouterOS takes any unique prefix of an argument name, including the first
+segment: `down={ :beep }` lowers to `down-script=` on CHR 7.22.1–7.25, as do
+bodies opening with one bare command word (`down={ beep }`) or after a comment
+line. Every word is a prefix of `<word>-script`, so without the command's
+argument list (schema) offline cannot tell `down=` from `comment=`, which the
+device rejects. The contract: on a non-root command, outside `where`, an
+unproven `name={` with a script-like body warns
+`explain/canonicalizer/possible-script-body-abbreviation` (verdict `warn`, the
+offline gate lets it through) instead of failing with `invalid-command-brace` —
+glued or with the brace spaced off the `=` (`down= { :beep }` lowers to
+`down-script=` on CHR 7.25 exactly like the glued spelling, so the spaced
+owner warns under the same gates). The brace reads as a body for every
+reader — a `#` inside is a comment, not `invalid-hash` — while proven slots
+(`down-script=`, `s=`, `on-…`) stay silent and control scopes (`do={…}`) are
+never guesses. A bare word followed by `;`-separated members is array
+members, not commands, so `.proplist={name;comment}` keeps its error alongside
+the other array-content braces (`{1;2}`, `{"x"}`, `{}`), the positional form,
+and `where`. A root directive's slots (`:put x={…}`, glued or spaced) and a `where` named
+comparison (`where gateway={…}`, however wrapped) keep their error too: the
+slot table and the property parser decide there, so the abbreviation guess
+never shields them (#554). The integration twin pins both device directions.
+
+The tradeoff is measured: a verdict sweep of the 948-row pinned corpus
+population against the pre-batch baseline reports zero verdict or diagnostic
+changes, so nothing in the corpus pays for the abstention. The one deliberate
+over-warn — `comment={ :beep }` warns though the device rejects it — has no
+corpus occurrence.
 
 ### `'` is not a RouterOS token (#355)
 
@@ -1443,11 +1780,14 @@ Occurrences BEFORE the defect stand, which is the lab's X1 rule.
 
 **This was a false ACCEPT, which the corpus join cannot see.** The false-reject
 measurement scores one direction only, so the analyzer passing all four forms
-with zero diagnostics never appeared in it. Over the pinned corpus the rule
-fires on 40 of the 7.24.2 scripts and **every one of them is a script the device
-rejects** — none of the 617 it accepts. It moves the false-reject count not at
-all (still 1, the extra `}` of corpus 228) while taking the caught count from 62
-to 93.
+with zero diagnostics never appeared in it. Over the corpus pinned at the time
+(stable 7.24.2, before the #498 schema-5 repin) the rule fires on 40 scripts and
+**every one of them is a script the device rejects** — none of the 617 it
+accepted. It moves the false-reject count not at all (still 1, the extra `}` of
+corpus script
+`forum/amm0/topic-167087-can-t-turn-code-into-a-function/post-0005-snippet-02.rsc`)
+while taking the caught count from 62 to 93. On the #498 sessions both figures
+hold on every channel: 1 false reject among 573 accepts, 93 caught.
 
 The token census moves, and only in the direction the fail-closed symbol stop
 predicts: 68 fewer `variable-*` tokens and their 306 bytes returning to
@@ -1524,12 +1864,12 @@ Grounded, not transcribed, for the same reason the escape set above is: the
 [manual's operator list](https://manual.mikrotik.com/docs/developer-guides/scripting/index.md#operators)
 is a lower bound. `bun run explain:probe:operators` sweeps the manual's list
 **plus** plausible non-operators (`not`, `..`, `xor`, `mod`, `is`, `div`, …)
-**plus** every IL head the corpus census saw, on CHR 7.24.2 stable, 7.23.5
-long-term and 7.25beta3 development — the same three builds the pinned corpus
-classes `complete`, so the operator axis and the token partition are finally
-scored on the same firmware (#342) — plus 7.21.5 as an **age anchor**, which is
-not a channel claim but the only live evidence that the surface behaves the same
-on a pre-7.23 branch. Re-cut the fixture with
+**plus** every IL head the corpus census saw. It runs on CHR 7.24.5 stable,
+7.23.8 long-term, 7.25rc2 testing and 7.26beta1 development, the builds the
+pinned corpus records a channel session for, so the operator axis and the token
+partition are scored on the same firmware (#342, #498). It also runs on 7.21.5
+as an **age anchor**, which is not a channel claim but the only live evidence
+that the surface behaves the same on a pre-7.23 branch. Re-cut the fixture with
 `bun run explain:operator-slice`; the table
 below is generated from `src/explain/operators.ts` by
 `bun run explain:operator-readme` and gated by
@@ -1632,13 +1972,13 @@ not concat at all** — `1.` lexes as a *variable name* and the row comes back a
 juxtaposition, `(  $1. 2)`. A rule that claims every `.` byte for the operator
 emits a span the device does not have.
 
-Everything in the sweep is identical across all four builds except one runtime
-row: `:put ({2;1} > {1;2;3})` evaluates to `true` on 7.24.2 and 7.25beta3 and
-errors on both long-term builds. **Array comparison is not fixed on current
-long-term** — 7.23.5 is newer than the 7.23.3 this was first measured on and
-still errors — so the change rode the 7.24 line and was not backported. The two
-errors also differ: 7.23.5 says `cannot compare if array is more than array`,
-7.21.5 says `cannot compare if nothing is more than nothing`, so on 7.21.5 the
+Everything in the sweep is identical across all five builds except one runtime
+row: `:put ({2;1} > {1;2;3})` evaluates to `true` on 7.24.5, 7.25rc2 and
+7.26beta1 and errors on both long-term builds. **Array comparison is not fixed
+on current long-term** — 7.23.8 is newer than the 7.23.3 this was first
+measured on and still errors — so the change rode the 7.24 line and was not
+backported. The two errors also differ: 7.23.8 says `cannot compare if array
+is more than array`, 7.21.5 says `cannot compare if nothing is more than nothing`, so on 7.21.5 the
 operands did not survive to the comparison at all.
 Identical is measured, not assumed — the slice diffs verdict, arity, precedence,
 associativity, `highlight` run, unary placement and op-axis per version. So the
@@ -1733,13 +2073,14 @@ And the grounded complement — asked, and refused:
 
   <!-- BEGIN GENERATED token-census — regenerate with `bun run explain:token-census:readme` -->
   The token census is re-derivable with `bun run explain:token-census` and
-  covers 948 source scripts. The figures below are generated from
-  `test/fixtures/explain/tokens.json` → `corpus` by
-  `bun run explain:token-census:readme` and gated against it by
+  covers 948 source scripts of corpus snapshot `e12d5d4e58a4`, with 882
+  auxiliary rows (7 `capture-controls`, 875 `wiresage-conformance`) excluded.
+  The figures below are generated from `test/fixtures/explain/tokens.json` →
+  `corpus` by `bun run explain:token-census:readme` and gated against it by
   `bun run explain:token-census:readme:check`; the fixture itself is gated
   against a fresh corpus run by `bun run explain:token-census:check`. Of
-  1,426,731 analyzed bytes, 1,023,107 are classified (71.71%), the remaining
-  403,624 are `unclassified`. The census emits 241,539 tokens (avg 254.8 per
+  1,426,731 analyzed bytes, 1,022,786 are classified (71.69%), the remaining
+  403,945 are `unclassified`. The census emits 241,282 tokens (avg 254.5 per
   script). Every byte belongs to exactly one token — sorted by `start`, no
   gaps, no overlaps, `join(slice) === input` — and the `class` field is the
   vocabulary #264 B5 settled. Each B2 fill should move the classified
@@ -1820,7 +2161,7 @@ what was wrong was the accounting of it. They are re-derived by
 `bun run explain:bracket-equals:readme:check`.
 
 <!-- BEGIN GENERATED bracket-equals — regenerate with `bun run explain:bracket-equals:readme` -->
-Measured by `bun run explain:bracket-equals` over the pinned corpus:
+Measured by `bun run explain:bracket-equals` over the population of corpus snapshot `e12d5d4e58a4`, with 882 auxiliary rows (7 `capture-controls`, 875 `wiresage-conformance`) excluded:
 **1,079** `=` bytes sit inside `[ … ]`, across
 263 of 948 scripts, and **1,067** of them come back
 `unclassified` — the operator fill abstains on essentially all of it. No
@@ -1835,15 +2176,15 @@ genuine comparisons — the device lowers `[find address=$IP]` to
 fill can take the query half later. For contrast the fill does claim
 **1,402** `=` bytes whose innermost opener is `(`.
 
-The query reading is the device's, not a guess: on 7.24.2, 93 of the
-137 scripts carrying one have IL with at least as many `(= …)` nodes.
-Of the rest, 28 are scripts the console refused outright — their IL is prose,
-with no nodes of any kind — and 16 use a menu the capture build could not
-resolve (a forum snippet on `/interface wireless` answers `bad command name
-wireless`), so the device never reached the query to lower it. Neither is a
-counter-example to the reading. Whole-corpus `(= …)` head nodes, which also
-count expression comparisons the fill already claims:
-7.23.5 1,233, 7.24.2 1,240, 7.25beta3 1,240.
+The query reading is the device's, not a guess: on 7.24.5, 91 of the
+137 scripts carrying one have IL with at least as many comparison nodes.
+Of the rest, 25 are scripts the console refused outright — their readout is
+prose, with no nodes of any kind — and 21 lowered fewer comparison nodes than the
+scan counted, typically because a command the capture build could not resolve
+(`bad command name …`) stopped the device before it reached the query. Neither is
+a counter-example to the reading. Whole-corpus `(= …)` head nodes per channel
+session, which also count expression comparisons the fill already claims:
+7.23.8 1,300, 7.24.5 1,306, 7.25rc2 1,306, 7.26beta1 1,306.
 <!-- END GENERATED bracket-equals -->
 
 ### Device agreement for the token partition (#264 B4, #263)
@@ -1893,13 +2234,13 @@ to be filled by assumption.
 
 **The device stops classifying at its first `error`, and mostly does not
 recover.** Measured over the slice, `error` appears **at most once per script
-and is always exactly one byte wide**, and on long-term 7.23.5 every byte after
+and is always exactly one byte wide**, and on long-term 7.23.8 every byte after
 it comes back `none`. Most of the slice sits in that tail. A percentage computed
 over the whole stream therefore measures the device giving up, not the parser,
 which is why the tail is its own outcome and is never folded into agreement. The
 rule is not absolute across versions, so the report does not assert it: stable
-7.24.2 and development 7.25beta3 classify again after the `error` in one run and
-stop on fewer scripts, and
+7.24.5, testing 7.25rc2 and development 7.26beta1 classify again after the
+`error` in one run and stop on fewer scripts, and
 `parser-recovered` in the table below is the figure that says by how much —
 zero would have been the claim, and it is not zero. Both counts are generated,
 not quoted here, so neither can go stale against the fixture.
@@ -1921,56 +2262,57 @@ a score.
 The agreement report is re-derivable with
 `bun run explain:highlight-agreement` and needs no router and no corpus: it
 scores the token partition against
-`test/fixtures/explain/highlight-streams.slice.json`, 70 stratified scripts of
+`test/fixtures/explain/highlight-streams.slice.json`, 67 stratified scripts of
 committed `/console/inspect request=highlight` output. The figures below are
 generated from `test/fixtures/explain/highlight-agreement.json` by
 `bun run explain:highlight-agreement:readme`, gated against it by
 `bun run explain:highlight-agreement:readme:check`, and the fixture itself is
 gated against a fresh measurement by
-`test/unit/explain-highlight-agreement.test.ts`. Of 85,529 bytes at 7.24.2,
-27,974 are bytes **both** sides decided a syntax class for, and 99.99% of
-those agree (dev 99.99%, holdout 100.00%). Set `comment` aside — it is 65.63%
+`test/unit/explain-highlight-agreement.test.ts`. Of 81,143 bytes at 7.24.5,
+27,538 are bytes **both** sides decided a syntax class for, and 99.99% of
+those agree (dev 99.99%, holdout 100.00%). Set `comment` aside — it is 63.66%
 of that decided region and mostly the corpus's harness-injected `# Source:`
-banner (#203) — and the remaining 9,615 bytes agree 99.98%. The device stops
-classifying at its one-byte `error`: 36 of 70 scripts carry one, and the
-41,968 bytes from there on are not a judgment about anything. The oracle
-itself moves between captures: 36 stop at 7.24.2 and 43 stop at 7.23.5 and 36
-stop at 7.25beta3, and 27 of the 70 streams differ between them. **This is a
-trend line, not a pass gate** — the slice is a per-(split, class) quota over a
-corpus that is 96.8% two authors, so the percentage describes this slice.
+banner (#203) — and the remaining 10,008 bytes agree 99.98%. The device stops
+classifying at its one-byte `error`: 34 of 67 scripts carry one, and the
+38,278 bytes from there on are not a judgment about anything. The oracle
+itself moves between captures: 34 stop at 7.24.5 and 39 stop at 7.23.8 and 34
+stop at 7.25rc2 and 34 stop at 7.26beta1, and 25 of the 67 streams differ
+between them. **This is a trend line, not a pass gate** — the slice is a
+per-(split, class) quota over a corpus that is 96.8% two authors, so the
+percentage describes this slice.
 
 | centrs class | projects to | agree | disagree | unprojected | of decided |
 | ------------ | ----------- | ----: | -------: | ----------: | ---------: |
-| `comment` | `comment` | 18,359 | 0 | 0 | 100.00% |
-| `variable-local` | `variable-local` | 1,123 | 0 | 0 | 100.00% |
+| `comment` | `comment` | 17,530 | 0 | 0 | 100.00% |
+| `variable-local` | `variable-local` | 1,547 | 0 | 0 | 100.00% |
 | `variable-global` | `variable-global` | 582 | 0 | 0 | 100.00% |
-| `variable-auto` | `variable-auto` | 92 | 0 | 0 | 100.00% |
-| `variable-parameter` | `variable-parameter` | 459 | 0 | 0 | 100.00% |
-| `dir` | `dir` | 1,677 | 0 | 0 | 100.00% |
-| `cmd` | `cmd` | 2,244 | 0 | 0 | 100.00% |
-| `arg` | `arg`, `arg-dot`, `arg-scope` | 2,188 | 0 | 0 | 100.00% |
-| `arg-sep` | `syntax-meta` | 382 | 0 | 0 | 100.00% |
-| `operator` | `syntax-meta` | 237 | 2 | 0 | 99.16% |
-| `brace` | `syntax-meta` | 211 | 0 | 0 | 100.00% |
-| `string` | *abstains* | 0 | 0 | 499 | — |
+| `variable-auto` | `variable-auto` | 93 | 0 | 0 | 100.00% |
+| `variable-parameter` | `variable-parameter` | 456 | 0 | 0 | 100.00% |
+| `dir` | `dir` | 1,701 | 0 | 0 | 100.00% |
+| `cmd` | `cmd` | 2,224 | 0 | 0 | 100.00% |
+| `arg` | `arg`, `arg-dot`, `arg-scope` | 2,167 | 0 | 0 | 100.00% |
+| `arg-sep` | `syntax-meta` | 368 | 0 | 0 | 100.00% |
+| `operator` | `syntax-meta` | 240 | 2 | 0 | 99.17% |
+| `brace` | `syntax-meta` | 210 | 0 | 0 | 100.00% |
+| `string` | *abstains* | 0 | 0 | 573 | — |
 | `escaped` | `escaped` | 418 | 0 | 0 | 100.00% |
-| `value` | *abstains* | 0 | 0 | 144 | — |
-
-| outcome | bytes @7.24.2 | bytes @7.23.5 | bytes @7.25beta3 |
-| ------- | ----: | ----: | ----: |
-| agree — both decided, projection accepts | 27,972 | 27,218 | 27,972 |
-| disagree — both decided, projection rejects | 2 | 2 | 2 |
-| unprojected — no declared projection covers the pair | 643 | 633 | 643 |
-| offline-silent — device decided, centrs abstained | 4,300 | 4,150 | 4,300 |
-| non-syntax — the device answered something syntax cannot decide | 847 | 733 | 847 |
-| device-silent — centrs decided, device said `none` | 5,815 | 5,674 | 5,815 |
-| both-silent | 3,886 | 3,702 | 3,886 |
-| parser-stopped — at/after the device's `error` byte, and silent from there | 41,968 | 43,417 | 41,968 |
-| parser-recovered — past that `error`, and the device classified anyway | 96 | 0 | 96 |
-
-Where the device decided and offline analysis did not (4,300 bytes at 7.24.2,
-the next fill's target list): `syntax-meta` 3,122, `comment` 355,
-`variable-local` 326, `arg` 197, `escaped` 145, `dir` 66, 89 across the rest.
+| `value` | *abstains* | 0 | 0 | 135 | — |
+
+| outcome | bytes @7.24.5 | bytes @7.23.8 | bytes @7.25rc2 | bytes @7.26beta1 |
+| ------- | ----: | ----: | ----: | ----: |
+| agree — both decided, projection accepts | 27,536 | 27,173 | 27,536 | 27,536 |
+| disagree — both decided, projection rejects | 2 | 2 | 2 | 2 |
+| unprojected — no declared projection covers the pair | 708 | 705 | 708 | 708 |
+| offline-silent — device decided, centrs abstained | 4,288 | 4,187 | 4,288 | 4,288 |
+| non-syntax — the device answered something syntax cannot decide | 731 | 662 | 721 | 721 |
+| device-silent — centrs decided, device said `none` | 5,676 | 5,606 | 5,676 | 5,676 |
+| both-silent | 3,828 | 3,736 | 3,838 | 3,838 |
+| parser-stopped — at/after the device's `error` byte, and silent from there | 38,278 | 39,072 | 38,278 | 38,278 |
+| parser-recovered — past that `error`, and the device classified anyway | 96 | 0 | 96 | 96 |
+
+Where the device decided and offline analysis did not (4,288 bytes at 7.24.5,
+the next fill's target list): `syntax-meta` 3,090, `comment` 341,
+`variable-local` 328, `arg` 230, `escaped` 145, `dir` 65, 89 across the rest.
 Most of the `syntax-meta` share is whitespace the device merged into an
 adjacent structure run rather than a token centrs missed.
 
@@ -1982,14 +2324,14 @@ every measured byte, the post-`error` tail included: where one capture stops
 parsing and the next does not, that tail IS the version disagreement, which is
 why it dominates the category.
 
-| applicability @7.24.2 | bytes | leading cells |
+| applicability @7.24.5 | bytes | leading cells |
 | ---------------------------- | ----: | ------------- |
-| offline-decidable | 32,002 | `comment` → `comment` 18,006, `unclassified` → `syntax-meta` 2,999, `cmd` → `cmd` 2,132 |
-| schema-dependent | 326 | `arg` → `obj-inactive` 326 |
-| state-dependent | 168 | `dir` → `obj-inactive` 120, `cmd` → `obj-inactive` 21, `unclassified` → `obj-dynamic` 20 |
-| version-dependent | 1,158 | `comment` → `comment` 353, `unclassified` → `obj-inactive` 159, `unclassified` → `syntax-meta` 123 |
-| uncategorized | 213 | `unclassified` → `obj-inactive` 90, `unclassified` → `variable-undefined` 75, `value` → `variable-undefined` 21 |
-| no-device-answer | 51,662 | `none` where the captures agree, wherever it falls |
+| offline-decidable | 32,043 | `comment` → `comment` 17,395, `unclassified` → `syntax-meta` 3,002, `cmd` → `cmd` 2,158 |
+| schema-dependent | 307 | `arg` → `obj-inactive` 307 |
+| state-dependent | 94 | `dir` → `obj-inactive` 49, `unclassified` → `obj-dynamic` 20, `cmd` → `obj-inactive` 18 |
+| version-dependent | 707 | `comment` → `comment` 135, `unclassified` → `obj-inactive` 124, `unclassified` → `syntax-meta` 88 |
+| uncategorized | 240 | `unclassified` → `obj-inactive` 116, `unclassified` → `variable-undefined` 75, `value` → `variable-undefined` 21 |
+| no-device-answer | 47,752 | `none` where the captures agree, wherever it falls |
 
 One representative run per cell, so B5 reads a fragment rather than a count.
 `runs` is how often that exact fragment occurs; the location is a slice script
@@ -1998,9 +2340,8 @@ and a byte offset into the stream the device saw.
 | outcome | cell | fragment | runs | first at |
 | ------- | ---- | -------- | ---: | -------- |
 | disagree | `operator` → `arg` | `"in"` | 1 | `forum/amm0/topic-169456-having-the-where-filter-in-scripting-signifantly-increases-the-execution-time-an/post-0006-snippet-01.rsc` @615 |
-| unprojected | `string` → `syntax-meta` | `"\""` | 311 | `eworm/ppp-on-up.rsc` @435 |
-| unprojected | `value` → `syntax-meta` | `"\""` | 88 | `forum/amm0/topic-153357-using-wifiwave2-to-bridge-two-audience-wirelessly-thoughts-4-address-mode/post-0001-snippet-01.rsc` @1436 |
-| unprojected | `string` → `arg` | `"as-value"` | 1 | `forum/amm0/topic-266499-how-to-condense-variables-passed-through-to-function/post-0020-snippet-01.rsc` @279 |
+| unprojected | `string` → `syntax-meta` | `"\""` | 326 | `eworm/ppp-on-up.rsc` @435 |
+| unprojected | `value` → `syntax-meta` | `"\""` | 84 | `forum/amm0/topic-153357-using-wifiwave2-to-bridge-two-audience-wirelessly-thoughts-4-address-mode/post-0001-snippet-01.rsc` @1436 |
 | unprojected | `string` → `cmd` | `"len"` | 1 | `forum/amm0/topic-155978-zerotier-on-mikrotik-a-rosetta-stone-v7-1-1/post-0001-snippet-01.rsc` @1794 |
 | unprojected | `string` → `dir` | `":"` | 1 | `forum/amm0/topic-155978-zerotier-on-mikrotik-a-rosetta-stone-v7-1-1/post-0001-snippet-01.rsc` @1793 |
 <!-- END GENERATED highlight-agreement -->
@@ -2090,9 +2431,10 @@ the 16,526 bytes `arg-sep` claims, one per attribute. Token count rises 214,503
 → 231,026 because one run became two. **This is a retag.**
 
 (Those totals are the corpus as it stood for THIS measurement. The classified
-total is 1,023,107 today: #347/#348 later classified 8 further bytes, and #355's
+total is 1,022,805 today: #347/#348 later classified 8 further bytes, #355's
 fail-closed symbol stop then unclaimed 306 of them — variable bytes sitting
-after a bare apostrophe, which the device never reaches. The identity being
+after a bare apostrophe, which the device never reaches — and #211's unlisted
+bare-path abstention unclaimed 302 more. The identity being
 claimed here is between the two sides of the split, not with any later total —
 restating it against today's figure would credit this retag with a movement a
 different change made. The generated block above carries the current numbers.)
@@ -2180,7 +2522,7 @@ bytes came from a fill that already held it — `string` gives up 17,672 and
 last decimal**, 1,023,405 of 1,426,731 (71.73076073906013%), so in byte terms
 this is a retag even though it took a new walk to make — again, the identity is
 between this change's own before and after, and the corpus total has since moved
-to 1,023,107 / 241,539 tokens under #347/#348 and #355. Only the token count
+to 1,022,805 / 241,442 tokens under #347/#348, #355 and #211. Only the token count
 moves, 231,026 → 241,663: the 7,408 new `escaped` tokens plus the 3,229
 fragments they leave behind when they split a run they sit inside (`string`
 +2,643, `value` +586). That second number is well under one per escape because
@@ -2219,22 +2561,317 @@ last byte. The `$` sigil and the `[` / `]` of a substitution stay `string` on
 the same ground — `structure.subcommands` already publishes the resolution, and
 its `innerSpan` locates the brackets around it.
 
-### Designed, not implemented (the CLI surface, #202b)
-
-`src/cli/explain.ts` ships the offline command; implemented flags are generated
-into [`docs/CLI.md`](../../docs/CLI.md) and are not restated here. What the
-[Surface](#surface-option-a--decided) table above describes and the command does
-**not** yet accept:
-
-| Flag / form | Phase | Why it is not accepted yet |
-| ----------- | ----- | -------------------------- |
-| `explain <router> '<input>'` | 2 | The grammar is parsed and **refused** with `usage/not-implemented`, naming the router it did not contact. Running the offline analysis under an invocation that asked for probes would report `mode: "offline"` about a request for more. |
-| `--cursor <byte>` | 2 | It positions `--complete`, which enumerates nothing offline. A cursor with no candidate surface to position is a flag with no effect. |
-| `--full` | 3 | It lifts smart-sizing limits, and the offline result is never truncated (`input.truncated` is always `false`). Same rule: no accepted flag is a no-op. |
-
-`--complete` and `--schema` **are** accepted, because they have an offline
-behavior the spec names: they enumerate nothing and emit the live-target tip.
-That is the difference — an accepted flag must do something observable.
+### Live probe foundation (#491)
+
+`centrs explain <router> '<input>'` (or `--quickchr <name>` / `--host <host>`)
+adds read-only device evidence over REST or native API. Library callers use
+`explainLiveEnvelope({ input, targetInput, via, ... }, options)` from the root
+package; the browser-safe `@tikoci/centrs/explain` entry remains offline.
+Connection/authentication settings use the existing resolver and provider
+precedence. A pinned unsupported transport is refused. No fan-out or protocol
+fallback is performed. `AbortSignal` cancels library probes.
+An explicitly supplied connection flag such as `--via`, `--password` or
+`--timeout` without `<router>`, `--host` or `--quickchr` is a usage error before
+input is read. Connection defaults from environment and config remain inert in
+offline mode.
+Text output summarizes live observations; `--json` retains full parse and
+per-byte highlight evidence.
+
+`data.canonical`, structure, symbols, values and optional tokens retain the
+offline result. Live observations are additional facts:
+
+- `data.live.environment` records the observed version, architecture and board.
+- `data.live.parse` carries the printed parse result, rejection classification
+  and authoritative line/byte-column when reported. Only an escaped
+  `:put [:parse "…"]` wrapper runs; the analyzed input, substitutions and
+  deferred bodies are never executed.
+- `data.live.highlight` retains raw device classes. Additional `data.spans`
+  cite its evidence and use centrs classes: `dir`, `cmd`, `arg`, `escaped`,
+  comments and variable classes; device state, syntax-meta, error/obsolete and
+  unknown classes map to `unclassified`. Error/obsolete markers produce separate
+  diagnostics. Offline and live spans can overlap; distinguish them by `ev`.
+- `data.live.arguments[]` contains `path`, `names`, `statementIds` and `ev` for
+  command-level `request=child`. Repeated paths share a probe. Names confirm what
+  the device exposes; they do not rewrite offline arguments, transport eligibility
+  or lexical bindings. The highlight obsolete marker distinguishes `name x`
+  from the two flags `detail without-paging` (example 48).
+
+Every live evidence entry identifies its probe, observation time, known version
+and acquisition outcome. Input probes include SHA-256 and normalization;
+`coverage` identifies the submitted byte range for a usable response, not proof
+that every byte is syntactically valid. Parse uses original UTF-8 input;
+highlight uses the existing one-SUB-per-non-ASCII-byte normalization. Its facts
+therefore describe that explicit variant; both spaces align with `positionMap`.
+Parse can stop at its first error; highlight `none` remains unclassified.
+
+Probe outcomes distinguish `ok`, `empty`, `unsupported`, `skipped`, `timeout`,
+`auth-error`, `transport-error`, `interrupted` and `invalid-response`. A parse
+rejection is an acquired response (`ok`) plus a diagnostic, not a transport
+failure. A failed/skipped probe adds a warning diagnostic; acquired offline and
+live facts remain available. `ok:true` means analysis produced a result, never
+that all probes succeeded. Resolver/usage failures and transport/authentication/interruption failures before
+any input probe yields a result remain `ok:false`.
+`meta.operation.mode` is `live`; no execution-validation verdict is invented:
+`meta.validation` is `{ enabled: false }`, offline and live, because explain
+is not a gate (#535). `runtimeAcceptance` always remains `not-proven`.
+
+Work is bounded by the resolved per-request timeout, 32 distinct command paths,
+32,767 bytes for highlight and 65,536 bytes for parse. Larger probes are skipped
+with their reason; no silent prefix is submitted and `input.truncated` stays
+false. A transport/authentication failure stops later requests. Scripting-path
+discovery is conservatively skipped before 7.21.4 or on unknown versions. No
+command-level completion, user-expression evaluation or related
+configuration-table collection is part of this slice. `--schema` and
+`--complete` add the probes in the next section, and the value-type probes
+after it run on every live call.
+
+Committed controls are
+[`live-probes.stable.json`](../../test/fixtures/explain/live-probes.stable.json)
+(7.24.5) and
+[`live-probes.long-term.json`](../../test/fixtures/explain/live-probes.long-term.json)
+(7.23.8), both CHR reporting `x86_64`, with package manifests, input hashes,
+observation times, raw parse/highlight output and projected child names. Each
+fixture records its capture command. `test/unit/explain-live.test.ts` replays
+the parse classifier and source-aligned highlighter against these controls;
+`test/integration/explain-live.test.ts` repeats the probes on a real CHR and
+checks that the analyzed identity-setting command did not run.
+
+### Live describe and completion (#492)
+
+`--schema` and `--complete` work on the statement at the cursor. The cursor
+defaults to the end of the input. `--cursor <byte>` is a UTF-8 byte offset,
+which is also the analyzed and device byte offset. Library callers may pass
+`cursor: { line, character }` (0-based, UTF-16) instead. A cursor inside a
+multi-byte character moves back to its first byte. A cursor outside the input
+is [`usage/invalid-cursor`](../../docs/errors/usage/invalid-cursor.md), raised
+before connecting. `--cursor` or `--full` without a facet is
+`usage/conflicting-flags`. Offline, both facets still return the live-target
+tip and enumerate nothing.
+
+**Probe shapes.** Grounded on CHR 7.12.2, 7.20.8, 7.23.8 and 7.24.5 over REST
+and native API:
+
+- `child` names what exists at a path and resolves unique abbreviations
+  (`ip,addr` answers as `address`). It is safe on every build tried.
+- `syntax` is sent only for an **argument** path (`ip,address,set,address`,
+  `put,message`). That shape answers in about 25 ms on every build, scripting
+  keywords included.
+- `completion` is sent only with `input=`, the text before the cursor. It is
+  safe at every position tried, including scripting keywords and `do={`
+  bodies on 7.20.8.
+- Never sent: `syntax` or `completion` with `path=` set to a **command**
+  (`ip,address,set`). On 7.12.2 and 7.20.8 REST stops answering, and the
+  requests queued behind it stall, for about 30 s. Native API closes the
+  connection. 7.23.8 and later answer normally, but the rule is
+  version-independent (`commands/api/AGENTS.md`). restraml's crawlers never
+  meet this, because they send `syntax` to `arg` nodes only.
+
+Every probe is an `evidence[]` entry with `facet: "schema" | "complete"`, its
+path, version and outcome. Facts cite it by `ev`. A facet probe that answers
+`empty` is a result, so it adds no warning diagnostic. Other failed outcomes
+warn as in the foundation, and a transport or authentication failure stops
+later probes.
+
+**`data.schema`** describes one path: the resolved statement, or an absolute
+slash path as typed (`/ip/addr`). The `child` self row decides `node`:
+
+- `menu`: `verbs[]` and `menus[]`. Each child is expanded by one more `child`
+  probe into `arguments` (verb) or `verbs`/`menus` (submenu) counts.
+- `command`: `arguments[]`, each with its argument-level `syntax` rows. A
+  flag's blank row is dropped. For `print`, `proplist` holds the output-field
+  names from `print proplist=` (`source: "print-proplist"`). A singleton
+  settings menu offers none there, so `get value-name=` answers instead
+  (`source: "get-value-name"`; `/ip/dns`, `/system/identity`). These are names
+  a print can show, **not print rows**.
+- `argument`: its `syntax` rows.
+- `unknown`: the device reports nothing there, or the statement at the cursor
+  is neither resolved nor an absolute path (`reason`).
+
+Syntax rows are kept verbatim (`symbol`, RouterOS `symbol-type` as `kind`,
+`text`, `nested` as `depth`). They are declared help, such as
+`A.B.C.D (IP address)` or `input | forward | output` beside `string value`.
+They are not the `schemaType` value fact, which normalizes the same rows per
+value ([Live value types](#live-value-types-225)).
+
+**Smart sizing.** By default each list shows up to 64 names, and expansion
+runs only when the listed children fit in 16 probes (a menu's children, or a
+command's arguments for their `syntax`). Otherwise names are listed without
+expansion. `counts` always holds the full sizes, `truncated: true`, `next[]`
+names up to three narrower inputs, and the envelope carries
+`tip/explain-schema-truncated`. On CHR 7.24.5, `/ip` (2 verbs, 29 menus) and
+`/ip/address/print` (21 arguments) truncate; `/ip/address` (12 verbs) and
+`/ip/firewall/filter` (16) do not. `--full` raises the limits to 1024 names and
+128 probes. That is the safety ceiling, not unlimited.
+
+**`data.completion`** reports `cursor`, `at` (original line/character),
+`replace` (the bytes a candidate replaces, ending at the cursor), `prefix`,
+`context`, `candidates[]`, `count` and `truncated`. Candidates are capped like
+names. They are the device's own: one input completion of the text before the
+cursor, keeping shown, non-syntax rows. The row `offset` sets `replace`. The
+navigation punctuation (`/`, `:`, `..`) offered everywhere is left out. So a
+relative path, a block, a `where` clause or an unclosed `[` completes exactly
+as on the console: `/ip { :put 1; address add comm` → `comment`, and
+`/ip address⏎` → that menu's verbs. Where the device offers nothing, neither
+does explain: `do={ add comm` runs at root, so `add` is unknown there.
+
+The `context` comes from the device highlight of the same text. When the
+cursor is not at the end, that is one extra highlight probe whose `coverage`
+says so.
+
+- `path`: in a `dir`/`cmd` word, after a menu, or at the start of a line.
+  Candidates are `menu` or `verb` by row style. A word the device cannot
+  resolve there is `obj-inactive`, and the token before it gives its role:
+  `/ip/address re` → `remove`, `reset`, and `:lo` → `local`, `lock`, `log`.
+- `argument-name`: in an `arg` word, or after a command, flag or value.
+  `match: "exact"` marks a complete name. `takesValue` is whether the same
+  answer offers `=` at the cursor: `comment` does, and the flag `detail` does
+  not.
+- `variable`: a `where` clause, whose property names RouterOS scopes as
+  variables (`where comm` → `comment`).
+- `value`: after `name=`. Candidates may include configuration state, such as
+  interface names. They are never a closed set:
+  `chain=` offers `forward`, `input` and `output`, but custom chains are legal.
+  For a command argument, `syntax` carries its declared type text, so a
+  free-form `comment=` returns no candidates and `string value`. A `where`
+  value (`disabled=` → `no`, `yes`) has no argument path, so no `syntax` is
+  read.
+- `unsupported` with a `reason`: strings, the obsolete spaced `name value`
+  spelling, and other tokens the device does not class as a path, name or
+  value.
+
+Every candidate is an observation of the completion probe its `ev` cites.
+The declared side is `data.schema`: `child` names and argument `syntax`. So
+completion carries no second provenance label, and nothing in it is a closed
+set. `path` names the command at the
+cursor when it is known. It comes from the offline statement or `[…]`
+substitution when that resolved, otherwise from the device's `dir`/`cmd` runs.
+The command is needed only for a value's `syntax`. When it is not visible (a
+relative path after `;`), the candidates are unaffected and `syntax` is
+omitted.
+
+The verdict still judges the input as written, and the two probes agree on
+it. `/ip/address add comm` is rejected by `:parse` (`expected end of command`
+at byte 16), and the highlight marks the same byte `error`. So the result
+fails even while its candidates are published. An assist loop that only wants
+candidates passes `--fail-on never`.
+
+Committed controls are
+[`live-facets.stable.json`](../../test/fixtures/explain/live-facets.stable.json)
+(7.24.5) and
+[`live-facets.long-term.json`](../../test/fixtures/explain/live-facets.long-term.json)
+(7.23.8). They hold every recorded call and its raw answer, plus the projected
+result. `test/unit/explain-live-facets.test.ts` replays them.
+`test/integration/explain-live-facets.test.ts` asserts the examples on both
+transports and regenerates the captures when `CENTRS_EXPLAIN_FACETS_CAPTURE`
+names an output file.
+
+Not covered here: MCP (#223), related print rows and topic checks (#493),
+and per-target caching of describe results (open 3).
+
+### Live value types (#225)
+
+Every live call fills the two live homes on `data.values.occurrences[].facts`
+that offline leaves empty. Neither changes the verdict or
+`runtimeAcceptance`, and neither becomes a diagnostic. Both probes are
+`evidence[]` entries with `facet: "types"` and `basis: "derived"`; an `empty`
+answer is a result, not a warning. They run after `--schema`/`--complete`.
+
+**`observedType: { value, rendered, ev }`** is the type the device's parser
+visibly converted a bare literal to. `:parse` prints a string unquoted, so
+`:local a 123` and `:local b "123"` both render `value=123`. A rendering is
+therefore evidence only when it CHANGED the literal:
+
+| Literal | Device rendering | `observedType` |
+| ------- | ---------------- | -------------- |
+| `2.2`, `2.2/8` | `2.0.0.2`, `2.0.0.2/8` | `ip`, `ip-prefix` |
+| `1:0:0::1` | `1::1` | `ip6` |
+| `0x10`, `0123`, `99999999999999999999` | `16`, `123`, `9223372036854775807` | `num` |
+| `yes`, `no` | `true`, `false` | `bool` |
+| `200ms`, `1d`, `1:2`, `10000w` | `00:00:00.200`, `1d00:00:00`, `01:02:00`, `10000w00:00:00` | `time` |
+| `123`, `1.1.1.1`, `true`, `00:00:02`, `"2.2"` | unchanged | absent |
+| `100000w`, `abc`, `1e5`, `300.1.1.1` | unchanged | absent |
+| member `{abc}`, `{-1}` | `$abc`, `(- 1)` | absent |
+
+The literal is not looked up in the IL of the analyzed input, where a quoted
+`"x;y=1"` prints exactly like two arguments. Each bare literal is re-parsed
+alone: `:local vN <lit>` for a scripting operand, `:local vN {<lit>}` for an
+array member, `;`-joined into one escaped `:put [:parse "…"]` per context.
+`:put <lit>` converts exactly as `:local` does. Only literals of the bytes
+`A-Z a-z 0-9 . _ : / -` are sent, so no literal can leave its slot, and a
+quoted value never qualifies. One hard-error member (`{*1}`) rejects a whole
+batch, so the two contexts are separate probes and a rejected batch is
+`invalid-response` with the device's message; its literals abstain. A batch is
+at most 256 literals, otherwise `skipped`.
+
+A scripting directive's named argument converts exactly as an operand
+(`:for i from=0x10` → `from=16`, `:put message=yes` → `message=true`), so it
+joins the operand batch. A directive's NAME slot is a variable and never
+converts: `:local yes 2` renders `name=$yes`, `:for yes from=1` renders
+`counter=$yes` and `:local name=no` renders `name=$no`. So a value the symbol
+view claims as a name, or a directive's `name=`/`counter=` argument, is never
+probed.
+
+Menu-command arguments are never observed. Their own parser converts them
+and prints a per-argument encoding (`src-address=!1.1.1.1` →
+`true;1.1.1.1`, `address=2.2` → `2.0.0.2;`), and a quoted value converts only
+at run time (`address="2.2"` stays `2.2`). That slot is `schemaType`'s. `op`
+has no producer: `(>[:return 1])` and `(>{"a"=1})` parse identically, and only
+`:typeof` separates them.
+
+**`schemaType: { values, list?, declared, ev }`** is the argument's declared
+type. For each `name=value` of a resolved menu command, the name is resolved
+against that command's live `child` names, exactly or as a unique prefix
+(`dist=` → `distance`). One `syntax` probe per distinct argument path
+(`ip,route,add,distance`) reads the declaration; at most 32 per call, later
+ones `skipped`. An ambiguous or unknown name sends no probe. `syntax` is never
+sent to a command path (see [Live describe and completion](#live-describe-and-completion-492)).
+
+The rows are a small grammar (`[!]Range`, `Address[%Interface][@VRF]`), so
+`values` lists the LEAF types the declaration mentions, not alternatives of
+one value. They use the shape-hint names so the two axes compare directly,
+plus three schema-only terms:
+
+| Device leaf | Term |
+| ----------- | ---- |
+| `(integer number)`, `(decimal number)`, `integer value`, `0..65535` | `num` |
+| `(time interval)`, `time interval` | `time` |
+| `(IP address)`, `IPv4 address`, `A.B.C.D` | `ip` |
+| `IPv6 address` | `ip6` |
+| `(IP prefix)`, `(IPv6 prefix)` | `ip-prefix`, `ip6-prefix` |
+| `(IP address range)` | `ip-range` |
+| `(MAC address)` | `mac` |
+| `string value…`, `hexadecimal string value…`, `script`, `filename` | `str` |
+| a listed word set (`input \| forward \| output`, `ether1 \| lo \| ...`) | `enum` |
+
+`enum` is never a closed set: the device lists the current configuration
+names (`ether1 | lo`) exactly like keywords, and ends either kind with `...`
+when the list is long (`ftp | h323 | … | ...`). `list: true` is present when
+the declaration spells a repetition (`[,Type*]`, `(max 15 times)`); its
+absence is not a claim — `servers` (`Address[@VRF]`) splits on a comma
+without saying so. A keyword's help row (`tcp` → `transmission control
+protocol`) is not a leaf, and a blank placeholder beside a real leaf is
+skipped. The fact is ABSENT when the declaration is blank (every flag and
+boolean: `disabled`, `copy-from`) or when any leaf is `see documentation`
+(`/ipv6/address add address`). `declared` is the device's top-level text,
+verbatim (`Address[@VRF]`, `Num`).
+
+The vocabulary also names `bool` and `name` for a second schema source: the
+CLI Reference's `Type` cells (`bool`, `iface_enum`, `ipAddr`, `macAddr`,
+`ubit (…)`), which declare the booleans and object references inspect leaves
+blank or prints as words. A CLI Reference producer would fill the same fact,
+told apart by its `ev`; delivering those tables is decision 3 (#501).
+
+Grounded on CHR 7.24.5 and 7.23.8 over REST and native API, identical on both:
+a 40-command crawl (863 arguments) set the leaf table (571 project, 282 are
+blank, 7 cite `see documentation` and 3 list no names), and the conversion
+matrix is recorded raw in
+[`live-types.stable.json`](../../test/fixtures/explain/live-types.stable.json)
+and [`live-types.long-term.json`](../../test/fixtures/explain/live-types.long-term.json).
+`test/unit/explain-live-types.test.ts` replays them and pins the matrix
+reading; `test/integration/explain-live-types.test.ts` asserts examples 52–53
+on both transports and that every executed script is a `:parse` wrapper and
+every `syntax` probe names a discovered argument. It regenerates the captures
+when `CENTRS_EXPLAIN_TYPES_CAPTURE` names an output file.
 
 ## MCP and library surfaces
 
@@ -2450,31 +3087,65 @@ config genre in question). Since phase 0 the corpus has grown to 948 with a
 export-banner share to 4.6%; **that stratum is not part of any phase-0 figure
 above**. Current whole-corpus offline censuses include its source text.
 
-The pinned snapshot carries **three complete builds** — long-term `7.23.5`,
-stable `7.24.2` and development `7.25beta3` — each with *both* oracles over all
-948 scripts, alongside six partial captures (parseIL at 7.20.8, 7.22.1,
-7.23rc1; highlight at 7.9.2, 7.23.2, 7.24rc2) that cover only 913. Schema v4
-names that split rather than leaving it to be discovered by hand: the
-`v_version_coverage` view classifies each build, and
-`coverage_class = 'complete'` is the filter every version-comparable query uses.
-`source_scripts` is byte-identical across both repins that reached this
-snapshot, so every text-derived report — the token and value censuses,
-`explain:arg-reach`, the browser-consumer proof — is unchanged by construction,
-and only the IL-derived operator census moved.
-
-**The three complete builds do not agree with each other, and that is the
-finding.** Scored over all 948 scripts:
-
-| oracle | long-term 7.23.5 ↔ stable 7.24.2 | stable 7.24.2 ↔ development 7.25beta3 |
-| ------ | -------------------------------: | ------------------------------------: |
-| `:parse` IL (`il_sha256`) | 87 scripts differ | 11 |
-| `highlight` (count + class set) | 33 | 0 |
-
-Stable and development are the same build for these purposes; long-term is the
-one that moves. So an operator-axis or token-partition figure is a claim *about
-a channel*, not about RouterOS — which is why the census reports its builds as
-separate columns and states its version set, rather than collapsing them to one
-number. Long-term is also the channel a real device most likely runs.
+The pinned snapshot (schema 5, tikoci/lsp-routeros-ts#40, plus the
+`wiresage-conformance` collection from tikoci/lsp-routeros-ts#42) carries one
+recorded capture session per release channel — long-term `7.23.8`, stable `7.24.5`,
+testing `7.25rc2` and development `7.26beta1`. Each is a `:parse` run and a
+`highlight` run over all 948 population scripts, bound to the exact submitted
+bytes and one device environment with every package installed. Two legacy
+`:parse` captures (7.20.8 and 7.22.1: 913 scripts, unknown input bytes, base
+package only) and a legacy 7.9.2 highlight summary remain as history, never as
+exact-input evidence.
+
+Every census reads the corpus through `scripts/corpus-db.ts`, in three ways
+(#498):
+
+- **Population.** `v_corpus_population` leaves out the upstream auxiliary
+  collections: 7 `capture-controls` rows and 875 `wiresage-conformance`
+  synthetic grammar cases. An observation is in the population by `script_id`,
+  not by path prefix, so a collection added upstream cannot leak into a census
+  (it did, briefly, when #42 added 875 rows to every run).
+- **Sessions.** Comparable figures name their channel run ids
+  (`capture_channels`), not a coverage label.
+- **Verdict.** The device verdict is the upstream `response_class`. Only
+  `il-no-recognized-diagnostic` is an accept, so IL carrying an embedded
+  `bad command name …` is a rejection. The shipped `:parse` reader
+  (`classifyParseResult`) agrees with it on all 5,640 channel and legacy
+  observations.
+
+The population text is byte-identical to the previous snapshot, so the
+text-derived reports are unchanged by construction: the token and value
+censuses, `explain:arg-reach` and the browser-consumer proof. The IL- and
+highlight-derived figures moved.
+
+**The channels do not agree with each other, and that is the finding.** Scored
+over all 948 scripts:
+
+| oracle | long-term 7.23.8 ↔ stable 7.24.5 | stable ↔ testing 7.25rc2 | testing ↔ development 7.26beta1 |
+| ------ | -------------------------------: | -----------------------: | ------------------------------: |
+| `:parse` readout | 95 scripts differ | 12 | 13 |
+| `:parse` response class | 5 | 0 | 0 |
+| `highlight` stream | 24 | 1 | 0 |
+
+The newer channels are nearly the same build for these purposes; long-term is
+the one that moves. So an operator-axis or token-partition figure is a claim
+*about a channel*, not about RouterOS. That is why the census reports its
+builds as separate columns and states its session set, rather than collapsing
+them to one number. Long-term is also the channel a real device most likely
+runs.
+
+**The `wiresage-conformance` cases are read separately, never as population.**
+`conformanceCases` returns the 875 third-party grammar probes with their
+upstream label, and `parseObservations(…, { collection })` returns their
+device answers. `bun run explain:conformance` scores the execute gate's offline
+answer (`fail` refuses) against `:parse` on every channel. It lists false
+rejects, missed rejections (split by device class: `plain-diagnostic` is
+syntax, while `embedded-diagnostic` is mostly a menu or parameter name, which
+needs the #501 argument lists), cases where the channels disagree, cases
+with no device answer (`unscorable`, never read as a rejection), and the
+upstream-label disagreements that #507 needs. The lists are committed in
+`test/fixtures/explain/conformance.json` and gated in CI, so a fix for any
+of #504–#506 shows the cases it moved.
 
 The corpus itself is not in this repo and is not moving here — `lsp-routeros-ts`
 owns producing snapshots, centrs owns which snapshot it measures against.
@@ -2544,10 +3215,27 @@ to mention. `/system/reboot` no longer moves the context, so a statement after
 it resolves where it actually is; `verbsplit` and `pathresolve` agree, which
 they would otherwise now do *confidently* in opposite directions. What is left
 is the honest residue of both floors — `/terminal/cuu` is a real no-argument
-command MikroTik publishes nowhere — and it stays pinned as a KNOWN LIMIT
-fixture rather than assumed closed. The contradiction that #202 would have
+command MikroTik publishes nowhere. The contradiction that #202 would have
 rendered is gone.
 
+**#211 makes that residue abstain (R14).** A verb-free absolute path that
+neither table knows used to still move the context, so `/terminal/cuu` then
+`print` resolved to an invented `/terminal/cuu/print`. On CHR 7.24.5 `:parse`
+reads `/terminal/cuu` as a command and that `print` as `bad command name print`
+at the root. `/ip fire conn` has the same shape and is navigation to
+`/ip/firewall/connection`, because RouterOS accepts abbreviated menus. A table
+miss therefore cannot decide either way. The statement now reads as R13's
+relative abstention does: not navigation, flagged `maybeNav`, with the
+statements after it `unknown` until a known absolute navigation recovers the
+context ([example 34](examples.md#34-an-unlisted-bare-path-does-not-become-a-menu)).
+Over the pinned corpus, 14 of 18,650 statement readings lose a path, in 6
+scripts. Every one was an invented path: `/ip/fire/conn/remove`,
+`/ip/firewall/layer7/add`, the v6 `/routing/bgp/network/add`, and
+`/terminal/style/error/put`. No `explain` verdict changes. Four `containsWrite`
+verdicts move from `true` to `unknown`, because their write was proven only at
+an invented path. Rule P, which would read the tables as a per-menu closed
+world and expand abbreviations, is not adopted (#372).
+
 **The command axis also outranks the punctuation guess.** `splitRun`'s last
 rule reads the first space-separated token as the verb, which lands on the
 operand whenever the command itself was written slash-joined:
@@ -2677,8 +3365,8 @@ The offline capability can advance from `coded` to `verified` when:
 - **Reachable evidence and explicit residue:** changed RouterOS semantic claims
   have committed CHR-grounded controls and a reproducible capture/replay path.
   Every remaining issue has a stated scope and dependency; #225 distinguishes
-  offline value work from live types, #272 owns evidence reachability, and #211's
-  unlisted-path decision retains the current abstention until separately decided.
+  offline value work from live types, #272 owns evidence reachability, and an
+  unlisted bare path abstains (#211) until #372 prices a closed-world reading.
 
 Retain the existing checks: `bun run lint`, `bun run test`, `bun run build`, and
 `bun run lint:ci`, plus the affected CHR grounding/integration procedure from
@@ -2688,9 +3376,10 @@ test framework is part of this baseline.
 
 ### Current and following capabilities
 
-- **Current — live probes (#236, phase 2):** highlight + `:parse` and
-  completion/child/syntax over rest-api/native-api. B4's projection/agreement
-  informs this work; each live cell requires its own CHR-passing examples.
+- **Done — live probes (#236, phase 2):** highlight + `:parse` (#491),
+  completion/child/syntax (#492) and live value types (#225) over
+  rest-api/native-api, `CHR-passed` on stable and long-term.
+  `runtimeAcceptance` stays `not-proven`.
 - **MCP alignment (#223):** the deliberate flat-to-rich response migration,
   coordinated with rosetta. Independent of the offline token vocabulary.
 - **Facet polish (phase 3):** live sizing, `--full`, completion/schema ergonomics.
@@ -2761,8 +3450,10 @@ round):
 
 Still open (implementation opens — none block ratification):
 
-1. Final flag names (`--full`, `--curl`, facet names) and the smart-sizing
-   thresholds (what counts as "cheap", what triggers truncation).
+1. ~~Final flag names and smart-sizing thresholds.~~ Decided by #492:
+   `--schema`, `--complete`, `--cursor <byte>` and `--full`; 64 names and 16
+   expansion probes by default, and 1024 / 128 with `--full`
+   ([Live describe and completion](#live-describe-and-completion-492)).
 2. The mapping table from RouterOS highlight classes to **colors**, and how
    unknown/new upstream classes degrade. Phase 0 pinned the raw inputs (Q13's
    per-occurrence highlight-class corpus; the observed 19 classes on 7.23.2 plus