@tikoci/centrs 0.1.9-next.22 → 0.1.9-next.24

package/src/cli/explain.ts

@@ -1,6 +1,6 @@
 /**
  * `centrs explain` CLI surface: command metadata, arg parsing, dispatch, and
- * envelope rendering for the phase-1 OFFLINE analysis (#202b, #202c-2).
+ * envelope rendering for offline analysis and read-only live evidence (#491).
  *
  * ## The positional grammar is conditional, and that is deliberate
  *
@@ -20,9 +20,8 @@
  *
  * ## What this surface refuses to do
  *
- * - **The live form is rejected, not degraded.** Phase 2 owns the probes; a
- *   phase-1 run that silently analyzed offline while a router was named would
- *   report `mode: "offline"` about an invocation that asked for more.
+ * - **Live probes never execute the input.** The shared live module attaches
+ *   device evidence, `--schema` and `--complete` to the offline result.
  * - **Fan-out is rejected** (`usage/fanout-not-supported`, the `terminal`
  *   pattern): `explain` takes at most one router.
  * - **`--complete` / `--schema` enumerate nothing offline.** They are accepted,
@@ -45,9 +44,17 @@ import {
 	renderExplainEnvelope,
 	resolveExplainFormat,
 } from "../explain.ts";
+import {
+	assertExplainTarget,
+	type ExplainLiveRequest,
+	explainLiveEnvelope,
+} from "../explain-live.ts";
+import { resolveExplainCursor } from "../explain-live-facets.ts";
 import { describeCentrs } from "../index.ts";
 import { loadEnvFileDefaults } from "../resolver/config-file.ts";
+import { redactTargetInput } from "../resolver/index.ts";
 import type { ResolvedSetting } from "../resolver/settings.ts";
+import { apiCommand } from "./api.ts";
 import {
 	type CliCommandMetadata,
 	expectValue,
@@ -59,10 +66,30 @@ import { selectionFlagTokens } from "./selection.ts";
 
 export const explainCliCommand: CliCommandMetadata = {
 	name: "explain",
-	usage: "centrs explain '<input>' [flags]",
+	usage: "centrs explain [<router>] '<input>' [flags]",
 	summary:
-		"Analyze a RouterOS command offline: canonical form, structure, and syntax diagnostics.",
+		"Analyze RouterOS input offline or add read-only device evidence from one router.",
 	options: [
+		...apiCommand.options.filter((o) =>
+			[
+				"--via",
+				"--host",
+				"--port",
+				"--username / --user / -u",
+				"--password",
+				"--timeout",
+				"--insecure",
+				"--cdb-file",
+				"--cdb-password",
+				"--resolve",
+			].includes(o.flag),
+		),
+		{ flag: "-p", valueName: "<secret>", description: "Alias for --password." },
+		{
+			flag: "--quickchr",
+			valueName: "<name>",
+			description: "Resolve one running quickchr VM by name.",
+		},
 		{
 			flag: "--file",
 			valueName: "<path>",
@@ -78,12 +105,23 @@ export const explainCliCommand: CliCommandMetadata = {
 		{
 			flag: "--complete",
 			description:
-				"Continuation candidates at the cursor. Live evidence — offline emits a tip and enumerates nothing.",
+				"Candidates at the cursor: menus and verbs, argument names, or values. Live evidence — offline emits a tip and enumerates nothing.",
 		},
 		{
 			flag: "--schema",
 			description:
-				"Path enumeration (verbs, args, types, enums). Live evidence — offline emits a tip and enumerates nothing.",
+				"Describe the path at the cursor: a menu's verbs and submenus, a command's arguments, `print`'s proplist. Live evidence — offline emits a tip and enumerates nothing.",
+		},
+		{
+			flag: "--cursor",
+			valueName: "<byte>",
+			description:
+				"UTF-8 byte offset for --complete/--schema. Default: the end of the input.",
+		},
+		{
+			flag: "--full",
+			description:
+				"Lift --complete/--schema sizing to its safety ceiling (1024 names, 128 expansion probes).",
 		},
 		{
 			flag: "--curl",
@@ -106,16 +144,20 @@ export const explainCliCommand: CliCommandMetadata = {
 	],
 };
 
-export interface ExplainCliArgs {
+export interface ExplainCliArgs extends Omit<ExplainLiveRequest, "input"> {
 	help?: boolean;
 	positionals: string[];
 	filePath?: string;
 	failOn: ExplainFailOn;
 	facets: string[];
+	cursor?: number;
+	full?: boolean;
 	curl?: boolean;
 	tokens?: boolean;
 	format?: ExplainOutputFormat;
 	verbose?: boolean;
+	/** First explicitly supplied connection flag, for the missing-target refusal. */
+	connectionFlag?: string;
 }
 
 export function parseExplainCliArgs(args: readonly string[]): ExplainCliArgs {
@@ -133,6 +175,7 @@ export function parseExplainCliArgs(args: readonly string[]): ExplainCliArgs {
 			parsed.positionals.push(arg);
 			continue;
 		}
+		if (LIVE_CONNECTION_FLAGS.has(arg)) parsed.connectionFlag ??= arg;
 		switch (arg) {
 			case "--":
 				// Everything after `--` is input, however command-shaped it looks:
@@ -144,6 +187,54 @@ export function parseExplainCliArgs(args: readonly string[]): ExplainCliArgs {
 			case "-h":
 				parsed.help = true;
 				break;
+			case "--via":
+				parsed.via = expectValue(args, ++index, arg);
+				break;
+			case "--host":
+				parsed.host = expectValue(args, ++index, arg);
+				break;
+			case "--quickchr":
+				if (parsed.quickchr !== undefined)
+					throw fanoutNotSupportedError({ flag: arg });
+				parsed.quickchr = expectValue(args, ++index, arg);
+				break;
+			case "--timeout":
+				parsed.timeout = expectValue(args, ++index, arg);
+				break;
+			case "--cdb-file":
+				parsed.cdbFile = expectValue(args, ++index, arg);
+				break;
+			case "--cdb-password":
+				parsed.cdbPassword = expectValue(args, ++index, arg);
+				break;
+			case "--resolve":
+				parsed.resolve = expectValue(args, ++index, arg);
+				break;
+			case "--password":
+				parsed.password = expectValue(args, ++index, arg);
+				break;
+			case "-p":
+				parsed.password = expectValue(args, ++index, arg);
+				break;
+			case "-u":
+			case "--user":
+			case "--username":
+				parsed.username = expectValue(args, ++index, arg);
+				break;
+			case "--insecure":
+				parsed.insecure = true;
+				break;
+			case "--port": {
+				const value = expectValue(args, ++index, arg);
+				if (!/^\d+$/.test(value))
+					throw new CentrsError({
+						code: "input/invalid-command",
+						summary: "Port must be an integer.",
+						remediation: "Pass a TCP port between 1 and 65535.",
+					});
+				parsed.port = Number(value);
+				break;
+			}
 			case "--file":
 				parsed.filePath = expectValue(args, ++index, arg);
 				break;
@@ -167,6 +258,22 @@ export function parseExplainCliArgs(args: readonly string[]): ExplainCliArgs {
 			case "--schema":
 				parsed.facets.push("--schema");
 				break;
+			case "--cursor": {
+				const value = expectValue(args, ++index, arg);
+				if (!/^\d+$/.test(value))
+					throw new CentrsError({
+						code: "usage/invalid-cursor",
+						summary: `--cursor must be a non-negative byte offset; got ${value}.`,
+						remediation:
+							"Pass a UTF-8 byte offset into the input, or omit --cursor to complete at the end.",
+						context: { cursor: value },
+					});
+				parsed.cursor = Number(value);
+				break;
+			}
+			case "--full":
+				parsed.full = true;
+				break;
 			case "--curl":
 				parsed.curl = true;
 				break;
@@ -236,35 +343,11 @@ function fanoutNotSupportedError(context: {
 			...(context.flag === undefined ? {} : { flag: context.flag }),
 			...(context.targets === undefined
 				? {}
-				: { targets: [...context.targets] }),
+				: { targets: context.targets.map(redactTargetInput) }),
 		},
 	});
 }
 
-/**
- * The one live-form error.
- *
- * Named separately because it is a PHASE boundary, not a usage mistake: the
- * invocation is the ratified grammar and will work unchanged when phase 2
- * lands, so the remediation points at the offline form rather than at `--help`.
- */
-function liveNotImplementedError(router: string): CentrsError {
-	// A "router" that starts `/` or `:` is almost always an unquoted input the
-	// shell split, so name that reading first rather than reporting a router
-	// nobody meant to give.
-	const looksLikeInput = /^[/:]/.test(router);
-	return new CentrsError({
-		code: "usage/not-implemented",
-		summary: looksLikeInput
-			? `Read \`${router}\` as a router, because two positionals mean \`<router> '<input>'\` — the input was probably not quoted.`
-			: `\`centrs explain <router> '<input>'\` needs live \`/console/inspect\` evidence, which is phase 2; the router \`${router}\` was not contacted.`,
-		remediation: looksLikeInput
-			? "Quote the whole input as one argument: `centrs explain '/ip/route print'`."
-			: "Drop the router for the offline analysis (`centrs explain '<input>'`), or use `rosetta` for documented RouterOS schema facts.",
-		context: { router, phase: "2" },
-	});
-}
-
 /**
  * Is fd 0 attached to something that could be carrying input?
  *
@@ -290,11 +373,8 @@ function stdinMayCarryInput(): boolean {
 /**
  * Split the positionals into targets and the one that may be the input.
  *
- * Pure and cheap **on purpose**: the caller must be able to refuse the live and
- * fan-out forms BEFORE any input source is touched. Reading first meant
- * `centrs explain router --file -` blocked on EOF before returning
- * `usage/not-implemented`, and `… --file missing` reported a file error instead
- * of the live refusal — the wrong answer, arrived at slowly.
+ * Pure and cheap: fan-out and unsupported facets are refused before any file
+ * or stdin is read. Supported live calls read the input before connecting.
  *
  * `--file` replaces the input positional, so with it every positional is a
  * target. Otherwise the LAST positional is the input and everything before it is
@@ -320,7 +400,7 @@ function splitPositionals(parsed: ExplainCliArgs): {
 }
 
 /**
- * Read the input text, once the invocation is known to be offline.
+ * Read the input text after the invocation shape has been checked.
  *
  * ## Ambient stdin is read ONLY when nothing else could be the input
  *
@@ -396,7 +476,40 @@ async function readFileInput(path: string): Promise<string> {
 }
 
 /** Flags whose NEXT token is a value, so a scanner must skip it. */
-const VALUE_FLAGS = new Set(["--file", "--fail-on", "--format"]);
+const VALUE_FLAGS = new Set([
+	"--file",
+	"--fail-on",
+	"--format",
+	"--via",
+	"--host",
+	"--port",
+	"--username",
+	"--user",
+	"-u",
+	"--password",
+	"-p",
+	"--timeout",
+	"--cdb-file",
+	"--cdb-password",
+	"--resolve",
+	"--quickchr",
+	"--cursor",
+]);
+
+const LIVE_CONNECTION_FLAGS = new Set([
+	"--via",
+	"--port",
+	"--username",
+	"--user",
+	"-u",
+	"--password",
+	"-p",
+	"--timeout",
+	"--insecure",
+	"--cdb-file",
+	"--cdb-password",
+	"--resolve",
+]);
 
 /**
  * The render options, recovered when the parse loop THREW.
@@ -472,22 +585,68 @@ export async function runExplainCli(args: readonly string[]): Promise<number> {
 		const { targets, inputPositional } = splitPositionals(parsed);
 		if (targets.length > 1) throw fanoutNotSupportedError({ targets });
 		const router = targets[0];
-		if (router !== undefined) throw liveNotImplementedError(router);
+		assertExplainTarget({ targetInput: router, quickchr: parsed.quickchr });
+		if (router !== undefined && (/^\//.test(router) || /^:[a-z]/i.test(router)))
+			throw new CentrsError({
+				code: "input/invalid-command",
+				summary:
+					"The input was probably not quoted; two positionals mean router then input.",
+				remediation:
+					"Quote the whole input as one argument: `centrs explain '/ip/route print'`.",
+			});
+		const live =
+			router !== undefined ||
+			parsed.quickchr !== undefined ||
+			parsed.host !== undefined;
+		if (!live && parsed.connectionFlag !== undefined)
+			throw new CentrsError({
+				code: "input/invalid-command",
+				summary: `${parsed.connectionFlag} requires a router target for live explain.`,
+				remediation:
+					"Add <router>, --host <host>, or --quickchr <name>; remove the connection flag for offline analysis.",
+				context: { flag: parsed.connectionFlag },
+			});
+		if (
+			parsed.facets.length === 0 &&
+			(parsed.cursor !== undefined || parsed.full)
+		)
+			throw new CentrsError({
+				code: "usage/conflicting-flags",
+				summary: `${parsed.cursor !== undefined ? "--cursor" : "--full"} applies only with --complete or --schema.`,
+				remediation: "Add --complete or --schema, or remove the flag.",
+			});
 
 		const { input, warnings } = await readInput(parsed, inputPositional);
+		resolveExplainCursor(input, parsed.cursor);
 
-		const envelope = explainEnvelope(input, {
+		const options = {
 			format,
 			curl: parsed.curl,
 			tokens: parsed.tokens,
 			warnings,
 			tips:
-				parsed.facets.length > 0
+				!live && parsed.facets.length > 0
 					? [buildExplainFacetTip(parsed.facets)]
 					: undefined,
-		});
-		console.log(renderExplainEnvelope(envelope, format.value));
-		return explainExitCode(envelope.data.verdict, parsed.failOn);
+		};
+		const envelope = live
+			? await explainLiveEnvelope(
+					{
+						...parsed,
+						targetInput: router,
+						input,
+						schema: parsed.facets.includes("--schema"),
+						complete: parsed.facets.includes("--complete"),
+					},
+					options,
+					env,
+				)
+			: explainEnvelope(input, options);
+		if (envelope.ok) console.log(renderExplainEnvelope(envelope, format.value));
+		else console.error(renderExplainEnvelope(envelope, format.value));
+		return envelope.ok
+			? explainExitCode(envelope.data.verdict, parsed.failOn)
+			: 1;
 	} catch (error) {
 		// Only here is the parser's answer unavailable — it threw. `config` is
 		// whatever loaded before the throw, which is `{}` when the loader itself is

package/src/core/envelope.ts

@@ -185,10 +185,17 @@ export interface EnvelopeValidationMeta {
 	 * `stages[]` then says which stage was not reached and why (GH#435).
 	 */
 	result?: "passed" | "failed" | "skipped";
-	/** Syntax gate status for commands that use RouterOS `:parse`. */
+	/**
+	 * The syntax verdict (`:parse` or the offline analyzer). Present only when a
+	 * stage gave one; absent means no stage was asked (#535).
+	 */
 	syntax?: boolean;
-	/** Semantic `/console/inspect` gate status, or not-applicable for script mode. */
-	semantic?: boolean | "not-applicable";
+	/**
+	 * The name-level verdict (`/console/inspect` or a console `:parse` `bad
+	 * parameter`). Present only when a stage gave one; absent means no stage was
+	 * asked, including for script input, which has no names to check (#535).
+	 */
+	semantic?: boolean;
 	availableAttributes?: readonly string[];
 	/**
 	 * Per-stage detail for the gate described in

package/src/core/error-catalog.ts

@@ -431,6 +431,11 @@ export const errorCatalog: readonly ErrorCatalogEntry[] = [
 		code: "routeros/mac-telnet-unsupported-auth",
 		summary: "The device requested an unsupported MAC-Telnet auth mode.",
 	},
+	{
+		code: "routeros/permission-denied",
+		summary:
+			"RouterOS refused the command because the user's group lacks a policy it needs.",
+	},
 	{
 		code: "routeros/protocol-not-implemented",
 		summary: "The requested protocol is planned but not implemented yet.",
@@ -563,6 +568,11 @@ export const errorCatalog: readonly ErrorCatalogEntry[] = [
 		code: "transport/dns",
 		summary: "The device host name could not be resolved.",
 	},
+	{
+		code: "transport/edge-auth-failed",
+		summary:
+			"An HTTP layer in front of RouterOS (auth proxy, tunnel edge, WAF) refused the request before RouterOS answered it.",
+	},
 	{
 		code: "transport/host-key-mismatch",
 		summary: "The device's SSH host key did not match the known key.",
@@ -652,6 +662,11 @@ export const errorCatalog: readonly ErrorCatalogEntry[] = [
 		summary:
 			"The command or mode cannot fan out across multiple targets (e.g. terminal, --listen/--stream).",
 	},
+	{
+		code: "usage/invalid-cursor",
+		summary:
+			"An explain --cursor is not a byte offset inside the input being analyzed.",
+	},
 	{
 		code: "usage/invalid-method",
 		summary: "The -X/--method value is not a supported HTTP method.",

package/src/core/execute-command.ts

@@ -104,11 +104,64 @@ export function isWriteShaped(command: CanonicalExecuteCommand): boolean {
 		if (Object.keys(command.attributes).some(isFileOutputAttribute)) {
 			return true;
 		}
+		if (isBareMenuNavigation(command)) {
+			return false;
+		}
 		return !READ_ONLY_EXECUTE_VERBS.has(command.verb.toLowerCase());
 	}
 	return scriptContainsWriteShapedCommand(command.input);
 }
 
+/**
+ * A truly bare known-menu path (`/system/identity`, no attributes or queries)
+ * is console navigation — a no-op read, not a command — so it needs no write
+ * confirmation. The APIs refuse it (`no such command`) and the consoles
+ * navigate silently; neither mutates.
+ *
+ * This is narrower than the script branch on purpose. There, `/ip firewall
+ * filter` stays write-shaped (#387): a later line may carry a relative verb,
+ * so navigation fails closed. Here structured mode proves the input is a
+ * single path token (any second word without `=` — including a second line —
+ * falls back to script), so no follow-up is possible. The carve-out still
+ * fails closed three ways: anything the menu table does not carry stays gated,
+ * a verb in the known-mutator list stays gated even if the table ever
+ * mis-tags its path, and any attribute or query (including `;`-smuggled text,
+ * which lands in the verb or an attribute, never in a clean menu reading)
+ * keeps the gate shut. The gate is shared, so bare menus also stop tripping
+ * `cdb/write-not-permitted` on `mcp=ro` targets (and stop needing
+ * `confirm:true` on `mcp=rw` ones), and `explain`'s `writeShaped` flips to
+ * false for these inputs — harmless in all three, since the input is a
+ * no-op read either way.
+ */
+function isBareMenuNavigation(command: CanonicalExecuteCommand): boolean {
+	if (
+		Object.keys(command.attributes).length > 0 ||
+		command.queries.length > 0
+	) {
+		return false;
+	}
+	if (KNOWN_WRITE_EXECUTE_VERBS.has(command.verb.toLowerCase())) {
+		return false;
+	}
+	const segments = `${command.path}/${command.verb}`.split("/").filter(Boolean);
+	if (segments.length < 2) {
+		return false;
+	}
+	return isKnownMenuPath(segments);
+}
+
+/**
+ * Whether `execute` was asked to run a bare menu path (see
+ * {@link isBareMenuNavigation}). The envelope carries a steering tip for it:
+ * navigation runs — the gate no longer stops it — but it answers nothing, so
+ * the tip names the read that does.
+ */
+export function isBareMenuPathCommand(
+	command: CanonicalExecuteCommand,
+): boolean {
+	return command.mode === "structured" && isBareMenuNavigation(command);
+}
+
 /**
  * The attributes that turn an otherwise read-only command into a device write.
  *

package/src/core/fanout.ts

@@ -94,6 +94,7 @@ export const NOT_SENT_TRANSPORT_CODES: readonly string[] = [
 	"transport/auth-failed",
 	"transport/connection-refused",
 	"transport/dns",
+	"transport/edge-auth-failed",
 	"transport/host-key-mismatch",
 	"transport/insecure-trust",
 	"transport/local-tool-missing",
@@ -106,15 +107,24 @@ export const NOT_SENT_TRANSPORT_CODES: readonly string[] = [
  * #448: a write whose request was already sent when a transport failure ended
  * it may have run on the router. It is never retried, and its error envelope
  * says the outcome is unknown rather than implying nothing happened.
+ *
+ * #549: the same warning covers a dispatched multi-statement write refused
+ * with `routeros/permission-denied`, which can be partly applied — statements
+ * before the refused one already ran. A single refused statement did not run
+ * (#541), so it stays silent; the caller passes whether the dispatch carried
+ * more than one statement.
  */
 export function sentWriteWarnings(
 	write: boolean,
 	error: unknown,
 	trace: ValidationTrace | undefined,
+	multiStatement = false,
 ): Warning[] {
 	if (!write || !trace?.dispatched) return [];
-	if (
-		!(error instanceof CentrsError) ||
+	if (!(error instanceof CentrsError)) return [];
+	if (error.code === "routeros/permission-denied") {
+		if (!multiStatement) return [];
+	} else if (
 		!error.code.startsWith("transport/") ||
 		NOT_SENT_TRANSPORT_CODES.includes(error.code)
 	) {

package/src/core/inspect.ts

@@ -39,12 +39,11 @@ export interface InspectBackend {
 
 /**
  * The `/console/inspect` request modes (lsp's `InspectRequest`). Only `child`
- * and `completion` are wired today (the two the {@link InspectBackend} seam
+ * and `completion` are wired here (the two the {@link InspectBackend} seam
  * exposes), plus `input` for completion over CLI text
- * ({@link inspectWhereBooleans}); `highlight` (token-level error detection),
- * `syntax` (parse tree) and the `.query`/`.proplist` request fields are the
- * documented extension point for value-level validation — widen the adapter
- * seam when adding them.
+ * ({@link inspectWhereBooleans}). The protocol adapter also supports
+ * `highlight` and `syntax` for live explain, which sends `syntax` for argument
+ * paths only (`src/explain-live-facets.ts`).
  */
 export type InspectRequestKind =
 	| "child"

package/src/core/routeros-errors.ts

@@ -107,6 +107,31 @@ function cleanToken(token: string): string {
  * rules here; keep the most specific patterns above broader ones.
  */
 export const routerOsErrorRules: readonly RouterOsErrorRule[] = [
+	{
+		code: "routeros/permission-denied",
+		description:
+			"RouterOS refused the command because the user's group lacks a policy it needs.",
+		// Grounded on CHR 7.25. REST answers HTTP 500 with this as `detail`:
+		// `not enough permissions (9)` for a write without `write`, and
+		// `std failure: not allowed (9)` for any request (even a GET) when the
+		// group has `rest-api` but not `api` (fixed in 7.26beta3). The native API traps with the
+		// first string; `/execute as-string` returns it as text with a
+		// `(<path>; line N)` suffix. In a multi-statement script the refusal is
+		// the last line, after earlier statements' stdout (#549: `:put
+		// "p5-first"; /system/identity/set …` as a read-only user returns HTTP
+		// 200 with ret `p5-first\r\nnot enough permissions (9)
+		// (/system/identity/set; line 1)`, identical on native-api), so the
+		// trailed form matches too — with the location suffix required, so a
+		// script that merely prints the bare phrase stays ordinary output.
+		test: /not enough permissions|not allowed \(9\)/i,
+		resultTest:
+			/^(?:not enough permissions \(9\)(?: \(\/[^\s();]+; line \d+\))?|[\s\S]*\r?\nnot enough permissions \(9\) \(\/[^\s();]+; line \d+\))$/i,
+		build: (_match, raw) => ({
+			summary: `RouterOS refused the command for lack of permission: ${raw.trim()}`,
+			remediation:
+				"Grant the missing policy to the RouterOS user's group (`/user/group`): `read` for reads, `write` for changes. If every REST request fails with `not allowed (9)`, the group has `rest-api` without `api`; before RouterOS 7.26beta3, REST needs both. Retrying will not help.",
+		}),
+	},
 	{
 		code: "routeros/unknown-path",
 		description:

package/src/execute-cmr.ts

@@ -1002,8 +1002,7 @@ function devicePassed(
 		source: CMR_VALIDATION_SOURCE,
 		result: "passed",
 		syntax: true,
-		semantic:
-			resolved.canonical.mode === "structured" ? true : "not-applicable",
+		...(resolved.canonical.mode === "structured" ? { semantic: true } : {}),
 		stages: passedStages(
 			offline ?? { verdict: "pass", warnings: [] },
 			CMR_VALIDATION_SOURCE,
@@ -1023,12 +1022,7 @@ function deviceRejected(
 		enabled: true,
 		source: CMR_VALIDATION_SOURCE,
 		result: "failed",
-		...(nameRejected
-			? { syntax: true, semantic: false }
-			: {
-					syntax: false,
-					...(structured ? {} : { semantic: "not-applicable" as const }),
-				}),
+		...(nameRejected ? { syntax: true, semantic: false } : { syntax: false }),
 		stages: [
 			offlineStagePassed(offline?.verdict),
 			{ stage: "device", source: CMR_VALIDATION_SOURCE, result: "failed" },