@tikoci/centrs 0.1.9-next.23 → 0.1.9-next.24

package/src/explain/group-faults.ts

@@ -29,8 +29,8 @@
  *   after `<name>=` with the property's own parser: `where (comment=+)`,
  *   `(comment=a-)`, `(comment=@)` and `(.id=*1)` parse, though each is an
  *   expression error elsewhere. So a group in a query gets only the structural
- *   checks (empty, `;`, newline) and #509's brace rule, never the operand or
- *   `@` rules.
+ *   checks (empty, `;`, newline), #509's brace rule and the unquoted-byte
+ *   rule below, never the operand or `@` rules.
  * - **Arrays (#511).** An array that is the whole value of a statement or an
  *   argument must have an element: `:local z {}`, `:put {}`, `:return {}`,
  *   `[:len {}]` and `in={}` are errors, while `{1;{}}`, `{a={}}`, `({})`,
@@ -53,6 +53,21 @@
  *   declared name that is not letters and digits. `gluedAt`, `wordFaults` and
  *   `nameFault` carry the device rules. One token fault is reported per
  *   statement, and the head word is never read.
+ * - **Unquoted bytes (#358, #371).** A `?`, a backtick and a non-ASCII byte
+ *   are never part of a bare word: the device rejects each at its byte in a
+ *   head word, a name, a `$name`, a value, a query, an array and an
+ *   expression (`/systemé`, `print?`, `$café`, `url=http://x/a?b`,
+ *   `where comment=café`, `{a`b}`, `(café)`), but a menu command's argument
+ *   name at the name's first byte (`addré=1`, `a?b=1`). A second `=` in a
+ *   menu command's argument is rejected too (`name=a=b`, a bare base64 key
+ *   ending in `=`). In a query and in an array it is an operator and a key
+ *   (`where comment=a=b`, `{a=b}` parse), and a query group takes the byte
+ *   rule but no other (`where (comment=a?b)` and `in {a?b}` are rejected at
+ *   the `?`, `where (comment=a=b)` parses); a directive's `a=b` is a named
+ *   argument on 7.24.5 and a syntax error on 7.23.8, so it is left alone. No
+ *   property parser was found that takes these bytes (`regexp=a?b`,
+ *   `public-key=…=`, `secret=…==`, `on-event=a=b` are all rejected). Strings
+ *   and comments carry any byte (`"café"`, `$"café"`, `:local "café"`).
  *
  * Deliberately not here: a `$( … )` group (`:put $({})` is rejected and is
  * read as `({})`), the `@` in a later head word (`/ip address@ print`), and
@@ -72,7 +87,9 @@ export type GroupFaultCode =
 	| "named-value-brace"
 	| "glued-token"
 	| "invalid-variable"
-	| "invalid-name";
+	| "invalid-name"
+	| "unquoted-non-ascii"
+	| "unquoted-reserved-byte";
 
 export interface GroupFault {
 	code: GroupFaultCode;
@@ -84,6 +101,12 @@ export interface GroupFault {
 	detail?: string;
 	/** The group the fault sits in, for a message that must say which. */
 	group?: "(" | "{";
+	/**
+	 * Where an unquoted-byte fault sits when it is not in a value: a menu
+	 * command's argument name, or a statement's head word (path, command,
+	 * `$name`). The remedy differs, since neither has a value to quote.
+	 */
+	site?: "argument-name" | "head-word";
 }
 
 interface StatementFrame {
@@ -95,6 +118,8 @@ interface StatementFrame {
 	whereEnd: number | null;
 	/** The head word without its colon, the key into `brace-slots.ts`. */
 	verb: string | null;
+	/** The head word is a `$` call, whose arguments no menu reads (`$f a=1`). */
+	call: boolean;
 	/** Positional operands read after the head. */
 	positionals: number;
 	/** No token of the current statement read yet. */
@@ -116,6 +141,8 @@ interface StatementToken {
 	closedAt: number;
 	/** Just past the token's last bare-word run, or -1. */
 	wordEnd: number;
+	/** The token's first bare `=`, or -1. */
+	eqAt: number;
 }
 
 interface ArrayFrame {
@@ -201,6 +228,31 @@ const STRICT_NAME_DIRECTIVES = new Set(["local", "global", "foreach"]);
 const ALNUM = /[A-Za-z0-9]/;
 const SUB = "\x1a";
 
+/** A byte no bare word holds: `?`, a backtick, a non-ASCII stand-in (#358, #371). */
+function isUnquotedFaultByte(c: string | undefined): boolean {
+	return c === "?" || c === "`" || c === SUB;
+}
+
+/** The first such byte in `[from, end)`, or -1. */
+function unquotedFaultByteAt(masked: string, from: number, end: number) {
+	for (let j = from; j < end; j++) if (isUnquotedFaultByte(masked[j])) return j;
+	return -1;
+}
+
+/** The fault for the byte at `at`; a non-ASCII run is reported whole. */
+function unquotedByteFault(masked: string, at: number): GroupFault {
+	if (masked[at] !== SUB)
+		return {
+			code: "unquoted-reserved-byte",
+			start: at,
+			end: at + 1,
+			detail: masked[at],
+		};
+	let end = at;
+	while (masked[end] === SUB) end++;
+	return { code: "unquoted-non-ascii", start: at, end };
+}
+
 function statementFrame(char: StatementFrame["char"]): StatementFrame {
 	return {
 		kind: "statement",
@@ -208,6 +260,7 @@ function statementFrame(char: StatementFrame["char"]): StatementFrame {
 		query: false,
 		whereEnd: null,
 		verb: null,
+		call: false,
 		positionals: 0,
 		lead: true,
 		token: null,
@@ -245,6 +298,7 @@ function openToken(frame: StatementFrame, at: number) {
 			equals: false,
 			closedAt: -1,
 			wordEnd: -1,
+			eqAt: -1,
 		};
 	frame.lead = false;
 	return frame.token;
@@ -287,12 +341,10 @@ function gluedAt(
 			(frame.verb !== null || ALNUM.test(before ?? "")));
 	if (!glued) return null;
 	const c = masked[at];
-	// A stray `\` is `symbols.ts`'s, and a non-ASCII stand-in is #371's.
-	if (c === "\\" || c === SUB) {
-		frame.settled = true;
-		return null;
-	}
 	frame.settled = true;
+	// A stray `\` is `symbols.ts`'s; a non-ASCII byte is its own fault (`"x"é`).
+	if (c === "\\") return null;
+	if (c === SUB) return unquotedByteFault(masked, at);
 	return { code: "glued-token", start: at, end: at + 1 };
 }
 
@@ -343,7 +395,21 @@ function wordFaults(
 		if (named !== undefined) return named;
 	}
 	while (j < end) {
-		if (masked[j] !== "$") {
+		const c = masked[j];
+		if (isUnquotedFaultByte(c)) {
+			frame.settled = true;
+			return (
+				argumentNameFault(masked, frame, j, end) ?? unquotedByteFault(masked, j)
+			);
+		}
+		if (c === "=") {
+			if (token.eqAt < 0) token.eqAt = j;
+			else if (frame.verb === null && !frame.call) {
+				frame.settled = true;
+				return unquotedByteFault(masked, j);
+			}
+		}
+		if (c !== "$") {
 			j++;
 			continue;
 		}
@@ -367,14 +433,12 @@ function wordFaults(
 			token.wordEnd = -1;
 			return null;
 		}
+		if (next === SUB) {
+			frame.settled = true;
+			return unquotedByteFault(masked, j + 1);
+		}
 		// `$$v` is rejected after the name, not at the second `$`.
-		if (
-			next === "(" ||
-			next === "[" ||
-			next === "{" ||
-			next === "$" ||
-			next === SUB
-		) {
+		if (next === "(" || next === "[" || next === "{" || next === "$") {
 			frame.settled = true;
 			return null;
 		}
@@ -390,6 +454,26 @@ function wordFaults(
 	return null;
 }
 
+/**
+ * A bad byte at `at` inside a menu command's argument name: the device
+ * reports it at the name's first byte (`/ip/address/add addré=1` and
+ * `a?b=1` at the `a`), and the span is the name. A directive (`:put café=1`)
+ * and a `$` call (`$f café=1`) report at the byte, so this is `null` there.
+ */
+function argumentNameFault(
+	masked: string,
+	frame: StatementFrame & { token: StatementToken },
+	at: number,
+	end: number,
+): GroupFault | null {
+	const { token } = frame;
+	if (frame.verb !== null || frame.call || token.eqAt >= 0) return null;
+	const eq = masked.indexOf("=", at);
+	if (eq < 0 || eq >= end) return null;
+	const fault = unquotedByteFault(masked, at);
+	return { ...fault, start: token.start, end: eq, site: "argument-name" };
+}
+
 /**
  * The declared-name fault in the word at `at`, `null` when the name is
  * well formed, or `undefined` when the word is not a bare name at all (a
@@ -473,9 +557,15 @@ const CLOSER = { "(": ")", "[": "]", "{": "}" } as const;
 
 /**
  * Find every group fault in an analyzed document. `masked` is its comment
- * mask; `text` is read only to tell a masked comment line from spaces.
+ * mask; `text` is read only to tell a masked comment line from spaces. The
+ * walk starts at `from`, past a leading BOM, which is a positional fact and
+ * not a byte of the first word.
  */
-export function findGroupFaults(text: string, masked: string): GroupFault[] {
+export function findGroupFaults(
+	text: string,
+	masked: string,
+	from = 0,
+): GroupFault[] {
 	const faults: GroupFault[] = [];
 	const frames: Frame[] = [statementFrame("")];
 	const top = (): Frame => frames[frames.length - 1] as Frame;
@@ -502,7 +592,7 @@ export function findGroupFaults(text: string, masked: string): GroupFault[] {
 	// `(1 +\⏎⏎2)`, and reject `(1 +\⏎# c⏎⏎2)` at the blank line.
 	let cont: "none" | "escape" | "comment" = "none";
 	let contLineStart = false;
-	let i = 0;
+	let i = from;
 	while (i < masked.length) {
 		const c = masked[i] as string;
 		const frame = top();
@@ -597,20 +687,27 @@ export function findGroupFaults(text: string, masked: string): GroupFault[] {
 				(frame.kind === "statement" && frame.char === "[")
 					? whereEnd
 					: null;
+			// A `where` named comparison never takes a script body through an
+			// unproven name — `[find where comment={ :beep }]` is `expected
+			// comment value` on CHR 7.25 — so the brace reads as a VALUE for
+			// the role below and the fault stands (#554). Proven slots still
+			// read as bodies; the gate is only the unproven disjunct.
+			const inWhereComparison =
+				c === "{" && floor !== null && comparesNamedValue(masked, i, floor);
 			const role =
 				c === "{" && frame.kind === "statement"
-					? braceStartsStatements(masked, i)
+					? braceStartsStatements(
+							masked,
+							i,
+							0,
+							inWhereComparison ? "value" : "body",
+						)
 						? "program"
 						: directiveSlotRole(masked, i, frame)
 					: null;
 			// A body (`do={`) is never a comparison, though `where` is still open:
 			// corpus `eworm/hotspot-to-wpa.template.rsc` interleaves two `:if`s.
-			if (
-				c === "{" &&
-				role !== "program" &&
-				floor !== null &&
-				comparesNamedValue(masked, i, floor)
-			) {
+			if (c === "{" && role !== "program" && inWhereComparison) {
 				// The device stops at this brace, so neither its contents nor the
 				// rest of the enclosing group are read.
 				faults.push({ code: "named-value-brace", start: i, end: i + 1 });
@@ -738,10 +835,26 @@ export function findGroupFaults(text: string, masked: string): GroupFault[] {
 					: BARE_DECLARATIONS.has(word)
 						? word
 						: null;
+				frame.call = word.startsWith("$");
+				// `[/ip/address/find comment=a=b]` is a query, as `[find …]` is.
+				if (frame.verb === null && /(^|\/)find$/i.test(word))
+					frame.query = true;
+				const bad = unquotedFaultByteAt(masked, i, end);
+				if (bad >= 0 && (at < 0 || i + at > bad)) {
+					frame.settled = true;
+					faults.push({ ...unquotedByteFault(masked, bad), site: "head-word" });
+				}
 			}
 			if (readsTokens(frame)) {
 				const fault = wordFaults(masked, frame, i, end);
 				if (fault !== null) faults.push(fault);
+			} else if (frame.query && !frame.settled && !token.head) {
+				// A query keeps `=` as an operator, but not these bytes.
+				const bad = unquotedFaultByteAt(masked, i, end);
+				if (bad >= 0) {
+					frame.settled = true;
+					faults.push(unquotedByteFault(masked, bad));
+				}
 			}
 			if (word.includes("=")) token.equals = true;
 			const lower = word.toLowerCase();
@@ -760,6 +873,12 @@ export function findGroupFaults(text: string, masked: string): GroupFault[] {
 		}
 
 		if (frame.kind === "opaque") {
+			// A query's `in {…}` is read as opaque, so `where … in {}` keeps
+			// parsing; its bytes are still rejected (`in {a?b}` at the `?`).
+			if (frame.query && !frame.muted && isUnquotedFaultByte(c)) {
+				faults.push(unquotedByteFault(masked, i));
+				frame.muted = true;
+			}
 			i++;
 			continue;
 		}
@@ -824,6 +943,12 @@ export function findGroupFaults(text: string, masked: string): GroupFault[] {
 				i++;
 				continue;
 			}
+			// Unlike `@`, these bytes are rejected in a query too (`in {a?b}`).
+			if (isUnquotedFaultByte(c)) {
+				report(unquotedByteFault(masked, i), frame);
+				i++;
+				continue;
+			}
 			frame.element = true;
 			frame.last = "element";
 			i++;
@@ -849,8 +974,16 @@ export function findGroupFaults(text: string, masked: string): GroupFault[] {
 			i++;
 			continue;
 		}
+		// A query group keeps its operators, but not these bytes:
+		// `where (comment=a?b)` is a `syntax error` at the `?`.
+		if (isUnquotedFaultByte(c)) {
+			report(unquotedByteFault(masked, i), frame);
+			i++;
+			continue;
+		}
 		if (frame.query) {
-			// Structural checks only (module header): any other byte is content.
+			// Structural and byte checks only (module header): any other byte is
+			// content.
 			frame.empty = false;
 			frame.wantOperand = false;
 			i++;
@@ -918,8 +1051,8 @@ export function findGroupFaults(text: string, masked: string): GroupFault[] {
 			i += spelling.length;
 			continue;
 		}
-		// `#`, `?`, a backtick, `'`, a stray `\`, a non-ASCII placeholder: another
-		// rule's byte, and nothing here can say what the group means after it.
+		// `#`, `'`, a stray `\`: another rule's byte, and nothing here can say
+		// what the group means after it.
 		frame.done = true;
 		i++;
 	}

package/src/explain/operators.ts

@@ -143,7 +143,8 @@ const OPERATORS: readonly RouterosOperator[] = [
 	// different operator, and arity is the only thing that separates them.
 	// Offline value-shape hints abstain on every such form: identical
 	// `(> …)` syntax can be `op` or `array` at runtime and `:parse` IL cannot
-	// distinguish them, so `op` lives only as a live `observedType` (#288).
+	// distinguish them; only `:typeof` can, and live explain never sends it,
+	// so `op` has no producer at all (#288, #225).
 	op(">", [1, 2], 5, "left", "relational", ">"),
 	op("=", [2], 5, "left", "relational", "="),
 	op("<=", [2], 5, "left", "relational", "<="),

package/src/explain/scope-brace.ts

@@ -7,8 +7,11 @@
  * gives comment masking, segmentation, and symbol resolution one rule.
  */
 
+import { commandVerbIndex } from "./catalog.ts";
+import { isKnownMenuPath } from "./is-known-menu.ts";
 import { scanQuotedString } from "./quoted-string.ts";
-import { runNamesCommand } from "./run-tokens.ts";
+import { runNamesCommand, runTokens } from "./run-tokens.ts";
+import { VERBS } from "./verbs.ts";
 
 /** Error-variable shape for `:onerror V { … }` — a bare/`$`-prefixed name. */
 const ERROR_VAR = /^\$?[A-Za-z][A-Za-z0-9._-]*$/;
@@ -96,17 +99,82 @@ const SCRIPT_BODY_ARG = /^(?:source|script|.+-script|on-.+)$/;
  * offline misses it.
  *
  * Abbreviating the FIRST segment (`down={ :beep }` for `down-script`, also
- * accepted on device) stays outside. Every word is a prefix of `<word>-script`,
- * so admitting it would admit `comment={ :beep }`. Telling them apart needs the
- * command's argument list, which is schema.
+ * accepted on device) stays outside the PROVEN shape. Every word is a prefix
+ * of `<word>-script`, so admitting it here would admit `comment={ :beep }` as
+ * a confident body. Telling them apart needs the command's argument list,
+ * which is schema — so a `name={` with a script-like body that reaches this
+ * far reads as a body for every reader (comments inside are comments) but is
+ * warned as a possible abbreviation instead of passing silently (#525,
+ * `args.ts` → `invalidCommandBraceOffsets`).
  */
 const SCRIPT_BODY_ABBREVIATION =
 	/^(?:s(?:o(?:u(?:r(?:c)?)?)?)?|sc(?:r(?:i(?:p)?)?)?|on?|.+-(?:s(?:c(?:r(?:i(?:p)?)?)?)?)?)$/;
 
-function isScriptBodyName(name: string): boolean {
+/** Whether `name` is a proven script-body slot (full or pinned abbreviation). */
+export function isScriptBodyName(name: string): boolean {
 	return SCRIPT_BODY_ARG.test(name) || SCRIPT_BODY_ABBREVIATION.test(name);
 }
 
+function isAsciiLetter(char: string | undefined): boolean {
+	if (char === undefined) return false;
+	return (char >= "A" && char <= "Z") || (char >= "a" && char <= "z");
+}
+
+/**
+ * Whether the `{` at `open` holds a script-like body (#525). `end` is the
+ * exclusive brace end (or the text length when unclosed).
+ *
+ * A body opens with a directive, an absolute command, or one bare command
+ * word: `{ :beep }`, `{ /ip … }`, `{ beep }` and `{ # comment⏎:beep }` are
+ * all accepted on CHR 7.25. A bare word followed by a top-level `;` is array
+ * members, not commands — `.proplist={name;comment}` is device-rejected —
+ * so it keeps the error, as do `{1;2}`, `{"x"}`, `{}` and `$`-led values,
+ * which cannot open a command at all. The scan touches each byte between
+ * the braces once, skipping strings and `#`-to-end-of-line runs, so it is
+ * linear; it works on masked and unmasked text alike (a masked comment is
+ * already whitespace).
+ */
+export function braceBodyIsScriptLike(
+	text: string,
+	open: number,
+	end: number,
+): boolean {
+	let j = open + 1;
+	for (;;) {
+		if (j >= end) return false;
+		const c = text[j] as string;
+		if (c === " " || c === "\t" || c === "\r" || c === "\n") {
+			j++;
+			continue;
+		}
+		if (c === "#") {
+			while (j < end && text[j] !== "\n") j++;
+			continue;
+		}
+		if (c === ":" || c === "/") return true;
+		if (!isAsciiLetter(c)) return false;
+		break;
+	}
+	let depth = 0;
+	while (j < end) {
+		const c = text[j] as string;
+		if (c === '"') {
+			const scan = scanQuotedString(text, j);
+			j = Math.min(scan.end, end);
+			continue;
+		}
+		if (c === "#") {
+			while (j < end && text[j] !== "\n") j++;
+			continue;
+		}
+		if (c === "{" || c === "[" || c === "(") depth++;
+		else if ((c === "}" || c === "]" || c === ")") && depth > 0) depth--;
+		else if (c === ";" && depth === 0) return false;
+		j++;
+	}
+	return true;
+}
+
 /** Grounded scripting directives whose positional arity makes a later `#` fatal. */
 const DIRECTIVE_POSITIONAL_ARITY: Readonly<Record<string, number>> = {
 	local: 2,
@@ -121,6 +189,12 @@ interface StatementIndex {
 	boundaries: Int32Array;
 	firstContent: Int32Array;
 	lastForbidden: Int32Array;
+	/**
+	 * The innermost open delimiter at each nested `;`/newline boundary. Sparse,
+	 * because a per-offset array pushed a 540 KiB document past
+	 * `BOUNDARY_CACHE_BYTE_LIMIT` and made every probe rebuild the index.
+	 */
+	nestedSeparators: Map<number, number>;
 	matchingBrace: Map<number, number>;
 }
 
@@ -162,6 +236,7 @@ function boundaryCacheEntryBytes(text: string, index: StatementIndex): number {
 		index.boundaries.byteLength +
 		index.firstContent.byteLength +
 		index.lastForbidden.byteLength +
+		index.nestedSeparators.size * 32 +
 		index.matchingBrace.size * 32
 	);
 }
@@ -223,17 +298,34 @@ function statementIndex(text: string): StatementIndex {
 	firstContent.fill(-1);
 	const lastForbidden = new Int32Array(text.length + 1);
 	lastForbidden.fill(-1);
+	const nestedSeparators = new Map<number, number>();
 	const matchingBrace = new Map<number, number>();
 	const delimiters: { char: string; at: number }[] = [];
 	let boundary = -1;
 	let first = -1;
 	let forbidden = -1;
+	let comment = false;
 	let i = 0;
 	while (i < text.length) {
 		boundaries[i] = boundary;
 		firstContent[i] = first;
 		lastForbidden[i] = forbidden;
 		const c = text[i] as string;
+		// A statement-leading `#` runs to the line end, and a `{`, `}` or `"` in
+		// it is not structure: `/ip { # }⏎address { print {1;2} } }` is rejected
+		// at the inner `{` on CHR 7.24.5 and 7.23.8, so the `}` must not close
+		// `/ip {` (#351). Read raw, the bytes are blank, as `maskComments` makes
+		// them; read masked, they already are.
+		if (comment && c !== "\n") {
+			i++;
+			continue;
+		}
+		comment = false;
+		if (c === "#" && first === -1 && delimiters.at(-1)?.char !== "(") {
+			comment = true;
+			i++;
+			continue;
+		}
 		if (c === '"') {
 			const end = Math.min(scanQuotedString(text, i).end, text.length);
 			boundaries.fill(boundary, i + 1, end + 1);
@@ -255,6 +347,9 @@ function statementIndex(text: string): StatementIndex {
 		if (first === -1 && !isAsciiWhitespace(c)) first = i;
 		if (c === "=" || c === "[" || c === "(" || c === "$") forbidden = i;
 		if (c === "\n" || c === ";" || c === "{" || c === "[") {
+			const open = delimiters.at(-1);
+			if ((c === "\n" || c === ";") && open !== undefined)
+				nestedSeparators.set(i, open.at);
 			boundary = i;
 			first = -1;
 		}
@@ -267,6 +362,7 @@ function statementIndex(text: string): StatementIndex {
 		boundaries,
 		firstContent,
 		lastForbidden,
+		nestedSeparators,
 		matchingBrace,
 	};
 	if (cacheStatementIndex(text, index)) adoptBoundaryText(text, index);
@@ -462,18 +558,41 @@ export function scopeNameFromMasked(
  * Whether this brace begins a context in which statement-leading comments exist.
  *
  * `floor` bounds the lookback exactly as in {@link scopeNameFromMasked}.
+ * `unprovenName` decides the unproven `name={` guess below: `"body"` reads it
+ * as a body, `"value"` as a value. Only the script-like disjunct is gated —
+ * a proven slot stays a body either way. Readers that are themselves deciding
+ * an error AT this brace pass `"value"` where the slot cannot bear a body
+ * (`args.ts` for a root directive's slots and a `where` named comparison,
+ * `group-faults.ts` for the bracketed form), so the guess does not swallow
+ * their error; every other reader keeps `"body"`.
  */
 export function braceStartsStatements(
 	text: string,
 	open: number,
 	floor = 0,
+	unprovenName: "body" | "value" = "body",
 ): boolean {
 	if (scopeNameFromMasked(text, open, floor) !== null) return true;
 	const index = statementIndex(text);
 	const boundary = index.boundaries[open] ?? -1;
 	const start = Math.max(boundary + 1, floor);
 	const named = trailingName(text, start, open);
-	if (named !== null) return isScriptBodyName(named.toLowerCase());
+	if (named !== null) {
+		// A `name={` with a script-like body reads as a body for every
+		// reader, proven slot or not (#525): `down={ beep }` and
+		// `down={ # comment⏎:beep }` are accepted on CHR 7.25, and the `#`
+		// is only a comment when the brace bears statements. The warning
+		// that marks the unproven slot lives in `args.ts`, which checks
+		// ambiguity before this skip.
+		if (isScriptBodyName(named.toLowerCase())) return true;
+		if (unprovenName === "value") return false;
+		const close = matchingBraceEnd(text, open);
+		return braceBodyIsScriptLike(
+			text,
+			open,
+			close === undefined ? text.length : close + 1,
+		);
+	}
 	// `source { :beep }` — the same body with the `=` left out (#350). Every
 	// grounded spelling lowers to the `source=` IL on CHR 7.22.1 and 7.24.5:
 	// `/system/script add name=beep source { :beep }`, `/system/scheduler add
@@ -493,12 +612,108 @@ export function braceStartsStatements(
 	// but a run that already names a command makes the brace its operand (#496).
 	// `start` follows the last `{`, so each brace reads its own run: linear.
 	const first = index.firstContent[open] ?? -1;
-	return (
-		first < start ||
-		(text[first] === "/" &&
+	if (first < start) return true;
+	if (text[first] === "/")
+		return (
 			(index.lastForbidden[open] ?? -1) < start &&
-			!runNamesCommand(text.slice(first, open)))
-	);
+			!runNamesCommand(text.slice(first, open))
+		);
+	return menuBlockPath(text, open, floor) !== null;
+}
+
+/** Nesting a {@link menuBlockPath} lookup follows before it abstains. */
+const MAX_MENU_BLOCK_DEPTH = 64;
+
+/**
+ * A relative run of bare path words, space- or slash-separated. Each word is
+ * `pathresolve`'s `BARE_WORD`: the resolver reads no digit-led word as a path,
+ * so admitting `6to4 {` here would flatten a block whose navigation it then
+ * ignores, resolving the body's `print` against `/interface`.
+ */
+const RELATIVE_MENU_RUN =
+	/^[A-Za-z][A-Za-z0-9._-]*(?:[ \t/]+[A-Za-z][A-Za-z0-9._-]*)*$/;
+
+/**
+ * The menu a `{` opens a statement block over, when the source alone says so
+ * (#351). Null means offline cannot tell, not that the brace is a value.
+ *
+ * On CHR 7.24.5 and 7.23.8 a brace right after a menu word is always a
+ * statement block, at any depth and whatever the body holds:
+ * `/ip { address { 1;2 } }` is `bad command name 1` at the `1`, and
+ * `/ip { address { a;b } }` reads `a` as `add`. A brace after a command word is
+ * always an error at the `{` (`/ip { address { print {1;2} } }`). The `/`-led
+ * spelling was already read as a block; the RELATIVE one (`address {` inside
+ * `/ip { … }`) was read as `/ip address` with a brace operand. That is what
+ * hard-failed the outer brace at depth three and hid every fault in the body.
+ *
+ * A relative run is a block only when the menu it names is known: the
+ * enclosing container's path, read the same way outward, plus the run, named by
+ * a shipped structure table. A miss abstains, so an unknown word keeps today's
+ * reading and the resolver says `unresolved`. The path is lexical: a
+ * navigation statement earlier in the same body (`/ip { firewall; address {`)
+ * is not followed, and the resolver checks the flattened run against the real
+ * context, so that residue can only abstain. Abbreviated menus (`addr {`) are
+ * not expanded, as R13 does not expand them.
+ *
+ * `floor` keeps the ranged-call contract of {@link scopeNameFromMasked}: no
+ * enclosing brace before it is consulted, so a range reads exactly as the same
+ * text taken alone.
+ */
+export function menuBlockPath(
+	text: string,
+	open: number,
+	floor = 0,
+): readonly string[] | null {
+	return blockPathAt(text, statementIndex(text), open, floor, 0);
+}
+
+function blockPathAt(
+	text: string,
+	index: StatementIndex,
+	open: number,
+	floor: number,
+	depth: number,
+): readonly string[] | null {
+	if (depth > MAX_MENU_BLOCK_DEPTH) return null;
+	const start = Math.max((index.boundaries[open] ?? -1) + 1, floor);
+	const first = index.firstContent[open] ?? -1;
+	if (first < start) return enclosingBlockPath(text, index, open, floor, depth);
+	if ((index.lastForbidden[open] ?? -1) >= start) return null;
+	const run = text.slice(first, open);
+	if (text[first] === "/") {
+		if (runNamesCommand(run)) return null;
+		return runTokens(run).map((token) => token.name);
+	}
+	const trimmed = run.trim();
+	if (!RELATIVE_MENU_RUN.test(trimmed)) return null;
+	const names = trimmed.split(/[\s/]+/);
+	if (names.some((name) => VERBS.has(name))) return null;
+	const parent = enclosingBlockPath(text, index, open, floor, depth);
+	if (parent === null) return null;
+	const path = [...parent, ...names];
+	if (commandVerbIndex(path) !== null || !isKnownMenuPath(path)) return null;
+	return path;
+}
+
+/**
+ * The path of the container `{` around the statement that holds `at`, when it
+ * is one. The statement starts after a boundary: an opening `{`/`[` is the
+ * enclosing delimiter itself, and a separator records it.
+ */
+function enclosingBlockPath(
+	text: string,
+	index: StatementIndex,
+	at: number,
+	floor: number,
+	depth: number,
+): readonly string[] | null {
+	const boundary = index.boundaries[at] ?? -1;
+	const outer =
+		boundary < 0 || text[boundary] === "{" || text[boundary] === "["
+			? boundary
+			: (index.nestedSeparators.get(boundary) ?? -1);
+	if (outer < floor || text[outer] !== "{") return null;
+	return blockPathAt(text, index, outer, floor, depth + 1);
 }
 
 /**