@tikoci/centrs 0.1.9-next.23 → 0.1.9-next.27

package/src/explain/args.ts

@@ -78,7 +78,12 @@
 
 import { isScopeBrace, isScopeBraceIn } from "./blocks.ts";
 import { braceSlotAcceptsBrace, braceSlotTakesArray } from "./brace-slots.ts";
-import { braceStartsStatements } from "./scope-brace.ts";
+import {
+	braceBodyIsScriptLike,
+	braceStartsStatements,
+	isScriptBodyName,
+	scopeNameFromMasked,
+} from "./scope-brace.ts";
 import {
 	type MaskedRange,
 	maskComments,
@@ -353,6 +358,34 @@ function braceValueOwner(
 	return ARGUMENT_NAME.test(name) ? name.toLowerCase() : undefined;
 }
 
+/**
+ * The `name` of a `name= {…}` brace: the token before the gap ends in a glued
+ * `name=` run (#554).
+ *
+ * {@link braceValueOwner} only sees the `=` glued to the brace (`down={`). A
+ * space after the `=` starts a new token, so the brace reads as positional
+ * there — but on CHR 7.25 `down= { :beep }` lowers to `down-script=` exactly
+ * like the glued spelling, while `comment= {1;2}` is a `syntax error` at the
+ * `{`. Only spaces and tabs span the gap: a newline there is a statement
+ * boundary, not a gap, and the name run must start its token, so `=down= {`
+ * and `down = {` own nothing.
+ */
+function spacedBraceOwner(text: string, at: number): string | undefined {
+	let j = at - 1;
+	let gap = 0;
+	while (text[j] === " " || text[j] === "\t") {
+		j--;
+		gap++;
+	}
+	if (gap === 0 || text[j] !== "=") return undefined;
+	const nameEnd = j;
+	j--;
+	while (j >= 0 && /[A-Za-z0-9.-]/.test(text[j] as string)) j--;
+	if (j >= 0 && !/[\s([]/.test(text[j] as string)) return undefined;
+	const name = text.slice(j + 1, nameEnd);
+	return ARGUMENT_NAME.test(name) ? name.toLowerCase() : undefined;
+}
+
 /**
  * Whether a `{` at `at` may open an array literal in this statement.
  *
@@ -1715,6 +1748,22 @@ export function comparesNamedValue(
 	return /^[A-Za-z.]/.test(name) && /[\s(]/.test(text[j] as string);
 }
 
+/** One top-level `{` in command arguments that is not a proven body. */
+export interface CommandBraceFinding {
+	/** Offset of the `{` in the text passed to the lexer. */
+	at: number;
+	/**
+	 * True when `name={` with a script-like body on a non-root command outside
+	 * `where`, where `name` is not a proven script-body slot (#525). The brace
+	 * may abbreviate one (`down=` for `down-script=`), but telling it from
+	 * `comment=` needs the command's argument list, which is schema — so the
+	 * caller warns instead of rejecting, and the device decides.
+	 */
+	ambiguous: boolean;
+	/** The `name` of `name=`, lower-cased, when `ambiguous` is true. */
+	name?: string;
+}
+
 /**
  * Locate top-level `{...}` values that RouterOS rejects in command arguments.
  *
@@ -1724,15 +1773,21 @@ export function comparesNamedValue(
  * excluded: their brace is a script body, not an array. The caller applies
  * this only to non-root commands; root scripting directives use the
  * `(verb, slot)` table instead.
+ *
+ * A `name={` with a script-like body that is not a proven slot is returned
+ * with `ambiguous: true` rather than as an error (#525), and so is the spaced
+ * `name= {…}` spelling (`down= { :beep }` lowers to `down-script=` on CHR
+ * 7.25). Array-content braces (`comment={1;2}`), positional braces, `where`
+ * comparisons and root slots keep their rejection.
  */
 export function invalidCommandBraceOffsets(
 	text: string,
 	from: number,
 	directiveVerb?: string,
 	range?: MaskedRange,
-): number[] {
+): CommandBraceFinding[] {
 	const structural = maskOf(range) ?? maskComments(text);
-	const offsets: number[] = [];
+	const offsets: CommandBraceFinding[] = [];
 	const stack: string[] = [];
 	let i = Math.max(0, from);
 	let tokenStart: number | null = null;
@@ -1783,7 +1838,54 @@ export function invalidCommandBraceOffsets(
 			tokenStart === null
 				? undefined
 				: braceValueOwner(structural, tokenStart, i);
-		const slot = owner === null ? `#${positionals}` : owner;
+		// A space after the `=` owns the brace the same way the glued `=`
+		// does (#554), so the slot attributes the spaced owner before
+		// falling back to positional: `:put x= { :beep }` reads slot `x`,
+		// not `#0` (which `put` accepts, swallowing the error).
+		const spacedOwner =
+			typeof owner === "string" ? undefined : spacedBraceOwner(structural, i);
+		const slot = owner === null ? (spacedOwner ?? `#${positionals}`) : owner;
+		// A `where` named comparison reads the brace with the property's own
+		// parser and rejects it (`expected <name> value`), so the #525 body
+		// guess must not shield it below — `gateway={ :beep }` included.
+		const inWhereComparison =
+			directiveVerb === undefined &&
+			whereAt !== null &&
+			comparesNamedValue(structural, i, whereAt);
+		// The ambiguity check comes first: `braceStartsStatements` reads an
+		// unproven `name={` with a script-like body as a body too (#525), so
+		// reaching that skip would swallow the warning that marks the guess.
+		// Control scopes (`do={` on a monitor, `:retry … command={`) are not
+		// guesses — the scope table already proves them — so they stay out.
+		// A space after the `=` owns the brace the same way the glued `=`
+		// does (`down= { :beep }` lowers to `down-script=` on CHR 7.25), so
+		// the spaced owner warns under the same gates.
+		const scopeName =
+			directiveVerb === undefined && whereAt === null
+				? range === undefined
+					? scopeNameFromMasked(structural, i)
+					: scopeNameFromMasked(range.masked, range.start + i, range.start)
+				: null;
+		const ambiguousOwner = typeof owner === "string" ? owner : spacedOwner;
+		if (
+			directiveVerb === undefined &&
+			whereAt === null &&
+			scopeName === null &&
+			typeof ambiguousOwner === "string" &&
+			!isScriptBodyName(ambiguousOwner) &&
+			braceBodyIsScriptLike(structural, i, end ?? structural.length)
+		) {
+			offsets.push({ at: i, ambiguous: true, name: ambiguousOwner });
+			i = end ?? i + 1;
+			continue;
+		}
+		// A root directive's slots and a `where` named comparison never take
+		// a script body through an unproven name: `:put x={ :beep }` and
+		// `where gateway={ :beep }` are device rejections, so the brace reads
+		// as a VALUE for the body check and the error below stands (#554).
+		// Proven slots still skip — the gate is only the unproven disjunct.
+		const unprovenName =
+			directiveVerb !== undefined || inWhereComparison ? "value" : "body";
 		if (
 			// Asked of the DOCUMENT when the caller anchored this statement, so the
 			// statement index behind it is the document's one index rather than a
@@ -1791,19 +1893,22 @@ export function invalidCommandBraceOffsets(
 			// subtree, and so was rebuilt once per enclosing level (#322). The floor
 			// makes the two readings the same answer (`scope-brace.ts`).
 			(range === undefined
-				? braceStartsStatements(structural, i)
-				: braceStartsStatements(range.masked, range.start + i, range.start)) ||
+				? braceStartsStatements(structural, i, 0, unprovenName)
+				: braceStartsStatements(
+						range.masked,
+						range.start + i,
+						range.start,
+						unprovenName,
+					)) ||
 			(directiveVerb !== undefined &&
 				slot !== undefined &&
 				braceSlotAcceptsBrace(directiveVerb, slot)) ||
-			(directiveVerb === undefined &&
-				whereAt !== null &&
-				!comparesNamedValue(structural, i, whereAt))
+			(directiveVerb === undefined && whereAt !== null && !inWhereComparison)
 		) {
 			i = end ?? structural.length;
 			continue;
 		}
-		offsets.push(i);
+		offsets.push({ at: i, ambiguous: false });
 		i = end ?? i + 1;
 	}
 	return offsets;

package/src/explain/blocks.ts

@@ -1,8 +1,8 @@
 /**
  * Block / scope-brace classification for `explain` (centrs canonicalizer).
  *
- * Ratified by the phase-0 lab, question Q2 (#185) and promoted from the
- * throwaway probe `.scratch/explain-lab-blocktree.ts`. Q2 asks: can an offline,
+ * Ratified by the phase-0 lab, question Q2 (#185); the lab probe it was
+ * promoted from is history (see #185), not a runnable method. Q2 asks: can an offline,
  * schema-free brace tracker tell a `{…}` SCOPE (`do=`/`else=`/`on-error=`, which
  * IL lowers to `name=;(evl …)`) from a `name={…}` LITERAL value (braces
  * stripped, body kept as RAW text, never lowered)? Descending into a literal

package/src/explain/catalog.ts

@@ -9,7 +9,7 @@
  * Union of two first-order sources (#228):
  *
  * 1. MikroTik's published CLI Reference (`https://manual.mikrotik.com/docs/cli-reference/`),
- *    1,099 pages, 1,106 entries — first-order about the definition
+ *    1,109 pages, 1,116 entries — first-order about the definition
  *    structs and their build-time gates. Since #285 every page is a leaf whose
  *    slug is the CLI path, so no spelling has to be rewritten to be looked up.
  * 2. 8 pinned restraml `/console/inspect` trees
@@ -28,9 +28,9 @@
  *
  * | Kind | Total | `both` | `inspect` | `published` |
  * | ---- | ----- | ------ | --------- | ----------- |
- * | `menu` | 568 | 457 | 67 | 44 |
- * | `command` | 477 | 436 | 0 | 41 |
- * | `settings` | 121 | 112 | 0 | 9 |
+ * | `menu` | 571 | 457 | 67 | 47 |
+ * | `command` | 483 | 436 | 0 | 47 |
+ * | `settings` | 122 | 112 | 0 | 10 |
  *
  * Zero navigation-vs-command contradictions between the two sources. Generation
  * aborts if that ever stops holding, rather than picking a winner. Where a path
@@ -49,9 +49,9 @@
  *
  * **Gates conjoin down a path, so read them with {@link effectiveGates}, not
  * row by row.** A row states only what the publication stated at that entry.
- * Read row-wise, 1 published-only path looks ungated; read with
+ * Read row-wise, 7 published-only paths look ungated; read with
  * ancestry, the residue carrying no published explanation for its absence at
- * all is 1.
+ * all is 7.
  *
  * Tree COMMANDS are not enumerated — those are the generic CRUD leaves
  * `verbs.ts` already owns. The command rows here are the published,
@@ -91,7 +91,7 @@ export interface CatalogEntry {
  * `path|kind|provenance|package|conditions|syscap` — with trailing empty
  * columns trimmed. Lower-cased, slash-led and sorted by path.
  *
- * Text rather than ~1,166 object literals so that one path is one line in a
+ * Text rather than ~1,176 object literals so that one path is one line in a
  * review diff, and so the formatter has nothing to re-wrap.
  */
 const ROWS = `
@@ -101,6 +101,7 @@ const ROWS = `
 /app/remove|command|both|container||app
 /app/restart|command|both|container||app
 /app/settings|settings|both|container||app
+/app/settings/remove-certificate|command|published|container||app
 /app/setup|command|both|container||app
 /app/update|command|both|container||app
 /beep|command|both
@@ -160,9 +161,9 @@ const ROWS = `
 /cmr/alert|menu|both|cmr
 /cmr/alert/show-devices|command|both|cmr
 /cmr/alert/test|command|both|cmr
-/cmr/client|settings|both||!smips, !powerpc
-/cmr/client/forget|command|both||!smips, !powerpc
-/cmr/client/pair|command|both||!smips, !powerpc
+/cmr/client|settings|both||!smips
+/cmr/client/forget|command|both||!smips
+/cmr/client/pair|command|both||!smips
 /cmr/client/push-button|command|both
 /cmr/device|menu|both|cmr
 /cmr/device/apptraffic|command|both|cmr
@@ -485,6 +486,12 @@ const ROWS = `
 /interface/wifi/dashboard/show-logs|command|both
 /interface/wifi/datapath|menu|both
 /interface/wifi/devel|command|both
+/interface/wifi/easymesh|settings|published
+/interface/wifi/easymesh/bss|menu|published
+/interface/wifi/easymesh/dpp-trigger|command|published
+/interface/wifi/easymesh/sta|menu|published
+/interface/wifi/easymesh/topology|menu|published
+/interface/wifi/easymesh/wps-push-button|command|published
 /interface/wifi/flat-snoop|command|both
 /interface/wifi/frequency-scan|command|both
 /interface/wifi/interworking|menu|both
@@ -1095,6 +1102,9 @@ const ROWS = `
 /system/resource/cpu|menu|both
 /system/resource/hardware|menu|both||!powerpc, !smips
 /system/resource/hardware/authorize|command|both||!powerpc, !smips
+/system/resource/hardware/power-cycle|command|published||!powerpc, !smips|usb-hub
+/system/resource/hardware/power-reset|command|published||!powerpc, !smips, !i386
+/system/resource/hardware/reset-overcurrent|command|published||!powerpc, !smips|usb-hub
 /system/resource/hardware/usb-power-reset|command|both||!powerpc, !smips, i386
 /system/resource/hardware/usb-settings|settings|both||!powerpc, !smips
 /system/resource/irq|menu|both
@@ -1373,8 +1383,8 @@ export interface CatalogGate {
  * parent's `syscap` applies even though the child entry states none: the gates
  * up a path CONJOIN, they do not override.
  *
- * Read row-wise, 1 published-only path looks ungated; read with
- * ancestry the residue is 1. The gap between the two is the
+ * Read row-wise, 7 published-only paths look ungated; read with
+ * ancestry the residue is 7. The gap between the two is the
  * conjunction, and it is what a caller has to reproduce: a child's silence about
  * a gate is not the absence of one. #228's finding — that a published-only path
  * almost always explains its own absence — is about the ancestry-aware number.

package/src/explain/group-faults.ts

@@ -29,8 +29,8 @@
  *   after `<name>=` with the property's own parser: `where (comment=+)`,
  *   `(comment=a-)`, `(comment=@)` and `(.id=*1)` parse, though each is an
  *   expression error elsewhere. So a group in a query gets only the structural
- *   checks (empty, `;`, newline) and #509's brace rule, never the operand or
- *   `@` rules.
+ *   checks (empty, `;`, newline), #509's brace rule and the unquoted-byte
+ *   rule below, never the operand or `@` rules.
  * - **Arrays (#511).** An array that is the whole value of a statement or an
  *   argument must have an element: `:local z {}`, `:put {}`, `:return {}`,
  *   `[:len {}]` and `in={}` are errors, while `{1;{}}`, `{a={}}`, `({})`,
@@ -53,6 +53,21 @@
  *   declared name that is not letters and digits. `gluedAt`, `wordFaults` and
  *   `nameFault` carry the device rules. One token fault is reported per
  *   statement, and the head word is never read.
+ * - **Unquoted bytes (#358, #371).** A `?`, a backtick and a non-ASCII byte
+ *   are never part of a bare word: the device rejects each at its byte in a
+ *   head word, a name, a `$name`, a value, a query, an array and an
+ *   expression (`/systemé`, `print?`, `$café`, `url=http://x/a?b`,
+ *   `where comment=café`, `{a`b}`, `(café)`), but a menu command's argument
+ *   name at the name's first byte (`addré=1`, `a?b=1`). A second `=` in a
+ *   menu command's argument is rejected too (`name=a=b`, a bare base64 key
+ *   ending in `=`). In a query and in an array it is an operator and a key
+ *   (`where comment=a=b`, `{a=b}` parse), and a query group takes the byte
+ *   rule but no other (`where (comment=a?b)` and `in {a?b}` are rejected at
+ *   the `?`, `where (comment=a=b)` parses); a directive's `a=b` is a named
+ *   argument on 7.24.5 and a syntax error on 7.23.8, so it is left alone. No
+ *   property parser was found that takes these bytes (`regexp=a?b`,
+ *   `public-key=…=`, `secret=…==`, `on-event=a=b` are all rejected). Strings
+ *   and comments carry any byte (`"café"`, `$"café"`, `:local "café"`).
  *
  * Deliberately not here: a `$( … )` group (`:put $({})` is rejected and is
  * read as `({})`), the `@` in a later head word (`/ip address@ print`), and
@@ -72,7 +87,9 @@ export type GroupFaultCode =
 	| "named-value-brace"
 	| "glued-token"
 	| "invalid-variable"
-	| "invalid-name";
+	| "invalid-name"
+	| "unquoted-non-ascii"
+	| "unquoted-reserved-byte";
 
 export interface GroupFault {
 	code: GroupFaultCode;
@@ -84,6 +101,12 @@ export interface GroupFault {
 	detail?: string;
 	/** The group the fault sits in, for a message that must say which. */
 	group?: "(" | "{";
+	/**
+	 * Where an unquoted-byte fault sits when it is not in a value: a menu
+	 * command's argument name, or a statement's head word (path, command,
+	 * `$name`). The remedy differs, since neither has a value to quote.
+	 */
+	site?: "argument-name" | "head-word";
 }
 
 interface StatementFrame {
@@ -95,6 +118,8 @@ interface StatementFrame {
 	whereEnd: number | null;
 	/** The head word without its colon, the key into `brace-slots.ts`. */
 	verb: string | null;
+	/** The head word is a `$` call, whose arguments no menu reads (`$f a=1`). */
+	call: boolean;
 	/** Positional operands read after the head. */
 	positionals: number;
 	/** No token of the current statement read yet. */
@@ -116,6 +141,8 @@ interface StatementToken {
 	closedAt: number;
 	/** Just past the token's last bare-word run, or -1. */
 	wordEnd: number;
+	/** The token's first bare `=`, or -1. */
+	eqAt: number;
 }
 
 interface ArrayFrame {
@@ -201,6 +228,31 @@ const STRICT_NAME_DIRECTIVES = new Set(["local", "global", "foreach"]);
 const ALNUM = /[A-Za-z0-9]/;
 const SUB = "\x1a";
 
+/** A byte no bare word holds: `?`, a backtick, a non-ASCII stand-in (#358, #371). */
+function isUnquotedFaultByte(c: string | undefined): boolean {
+	return c === "?" || c === "`" || c === SUB;
+}
+
+/** The first such byte in `[from, end)`, or -1. */
+function unquotedFaultByteAt(masked: string, from: number, end: number) {
+	for (let j = from; j < end; j++) if (isUnquotedFaultByte(masked[j])) return j;
+	return -1;
+}
+
+/** The fault for the byte at `at`; a non-ASCII run is reported whole. */
+function unquotedByteFault(masked: string, at: number): GroupFault {
+	if (masked[at] !== SUB)
+		return {
+			code: "unquoted-reserved-byte",
+			start: at,
+			end: at + 1,
+			detail: masked[at],
+		};
+	let end = at;
+	while (masked[end] === SUB) end++;
+	return { code: "unquoted-non-ascii", start: at, end };
+}
+
 function statementFrame(char: StatementFrame["char"]): StatementFrame {
 	return {
 		kind: "statement",
@@ -208,6 +260,7 @@ function statementFrame(char: StatementFrame["char"]): StatementFrame {
 		query: false,
 		whereEnd: null,
 		verb: null,
+		call: false,
 		positionals: 0,
 		lead: true,
 		token: null,
@@ -245,6 +298,7 @@ function openToken(frame: StatementFrame, at: number) {
 			equals: false,
 			closedAt: -1,
 			wordEnd: -1,
+			eqAt: -1,
 		};
 	frame.lead = false;
 	return frame.token;
@@ -287,12 +341,10 @@ function gluedAt(
 			(frame.verb !== null || ALNUM.test(before ?? "")));
 	if (!glued) return null;
 	const c = masked[at];
-	// A stray `\` is `symbols.ts`'s, and a non-ASCII stand-in is #371's.
-	if (c === "\\" || c === SUB) {
-		frame.settled = true;
-		return null;
-	}
 	frame.settled = true;
+	// A stray `\` is `symbols.ts`'s; a non-ASCII byte is its own fault (`"x"é`).
+	if (c === "\\") return null;
+	if (c === SUB) return unquotedByteFault(masked, at);
 	return { code: "glued-token", start: at, end: at + 1 };
 }
 
@@ -343,7 +395,21 @@ function wordFaults(
 		if (named !== undefined) return named;
 	}
 	while (j < end) {
-		if (masked[j] !== "$") {
+		const c = masked[j];
+		if (isUnquotedFaultByte(c)) {
+			frame.settled = true;
+			return (
+				argumentNameFault(masked, frame, j, end) ?? unquotedByteFault(masked, j)
+			);
+		}
+		if (c === "=") {
+			if (token.eqAt < 0) token.eqAt = j;
+			else if (frame.verb === null && !frame.call) {
+				frame.settled = true;
+				return unquotedByteFault(masked, j);
+			}
+		}
+		if (c !== "$") {
 			j++;
 			continue;
 		}
@@ -367,14 +433,12 @@ function wordFaults(
 			token.wordEnd = -1;
 			return null;
 		}
+		if (next === SUB) {
+			frame.settled = true;
+			return unquotedByteFault(masked, j + 1);
+		}
 		// `$$v` is rejected after the name, not at the second `$`.
-		if (
-			next === "(" ||
-			next === "[" ||
-			next === "{" ||
-			next === "$" ||
-			next === SUB
-		) {
+		if (next === "(" || next === "[" || next === "{" || next === "$") {
 			frame.settled = true;
 			return null;
 		}
@@ -390,6 +454,26 @@ function wordFaults(
 	return null;
 }
 
+/**
+ * A bad byte at `at` inside a menu command's argument name: the device
+ * reports it at the name's first byte (`/ip/address/add addré=1` and
+ * `a?b=1` at the `a`), and the span is the name. A directive (`:put café=1`)
+ * and a `$` call (`$f café=1`) report at the byte, so this is `null` there.
+ */
+function argumentNameFault(
+	masked: string,
+	frame: StatementFrame & { token: StatementToken },
+	at: number,
+	end: number,
+): GroupFault | null {
+	const { token } = frame;
+	if (frame.verb !== null || frame.call || token.eqAt >= 0) return null;
+	const eq = masked.indexOf("=", at);
+	if (eq < 0 || eq >= end) return null;
+	const fault = unquotedByteFault(masked, at);
+	return { ...fault, start: token.start, end: eq, site: "argument-name" };
+}
+
 /**
  * The declared-name fault in the word at `at`, `null` when the name is
  * well formed, or `undefined` when the word is not a bare name at all (a
@@ -473,9 +557,15 @@ const CLOSER = { "(": ")", "[": "]", "{": "}" } as const;
 
 /**
  * Find every group fault in an analyzed document. `masked` is its comment
- * mask; `text` is read only to tell a masked comment line from spaces.
+ * mask; `text` is read only to tell a masked comment line from spaces. The
+ * walk starts at `from`, past a leading BOM, which is a positional fact and
+ * not a byte of the first word.
  */
-export function findGroupFaults(text: string, masked: string): GroupFault[] {
+export function findGroupFaults(
+	text: string,
+	masked: string,
+	from = 0,
+): GroupFault[] {
 	const faults: GroupFault[] = [];
 	const frames: Frame[] = [statementFrame("")];
 	const top = (): Frame => frames[frames.length - 1] as Frame;
@@ -502,7 +592,7 @@ export function findGroupFaults(text: string, masked: string): GroupFault[] {
 	// `(1 +\⏎⏎2)`, and reject `(1 +\⏎# c⏎⏎2)` at the blank line.
 	let cont: "none" | "escape" | "comment" = "none";
 	let contLineStart = false;
-	let i = 0;
+	let i = from;
 	while (i < masked.length) {
 		const c = masked[i] as string;
 		const frame = top();
@@ -597,20 +687,27 @@ export function findGroupFaults(text: string, masked: string): GroupFault[] {
 				(frame.kind === "statement" && frame.char === "[")
 					? whereEnd
 					: null;
+			// A `where` named comparison never takes a script body through an
+			// unproven name — `[find where comment={ :beep }]` is `expected
+			// comment value` on CHR 7.25 — so the brace reads as a VALUE for
+			// the role below and the fault stands (#554). Proven slots still
+			// read as bodies; the gate is only the unproven disjunct.
+			const inWhereComparison =
+				c === "{" && floor !== null && comparesNamedValue(masked, i, floor);
 			const role =
 				c === "{" && frame.kind === "statement"
-					? braceStartsStatements(masked, i)
+					? braceStartsStatements(
+							masked,
+							i,
+							0,
+							inWhereComparison ? "value" : "body",
+						)
 						? "program"
 						: directiveSlotRole(masked, i, frame)
 					: null;
 			// A body (`do={`) is never a comparison, though `where` is still open:
 			// corpus `eworm/hotspot-to-wpa.template.rsc` interleaves two `:if`s.
-			if (
-				c === "{" &&
-				role !== "program" &&
-				floor !== null &&
-				comparesNamedValue(masked, i, floor)
-			) {
+			if (c === "{" && role !== "program" && inWhereComparison) {
 				// The device stops at this brace, so neither its contents nor the
 				// rest of the enclosing group are read.
 				faults.push({ code: "named-value-brace", start: i, end: i + 1 });
@@ -738,10 +835,26 @@ export function findGroupFaults(text: string, masked: string): GroupFault[] {
 					: BARE_DECLARATIONS.has(word)
 						? word
 						: null;
+				frame.call = word.startsWith("$");
+				// `[/ip/address/find comment=a=b]` is a query, as `[find …]` is.
+				if (frame.verb === null && /(^|\/)find$/i.test(word))
+					frame.query = true;
+				const bad = unquotedFaultByteAt(masked, i, end);
+				if (bad >= 0 && (at < 0 || i + at > bad)) {
+					frame.settled = true;
+					faults.push({ ...unquotedByteFault(masked, bad), site: "head-word" });
+				}
 			}
 			if (readsTokens(frame)) {
 				const fault = wordFaults(masked, frame, i, end);
 				if (fault !== null) faults.push(fault);
+			} else if (frame.query && !frame.settled && !token.head) {
+				// A query keeps `=` as an operator, but not these bytes.
+				const bad = unquotedFaultByteAt(masked, i, end);
+				if (bad >= 0) {
+					frame.settled = true;
+					faults.push(unquotedByteFault(masked, bad));
+				}
 			}
 			if (word.includes("=")) token.equals = true;
 			const lower = word.toLowerCase();
@@ -760,6 +873,12 @@ export function findGroupFaults(text: string, masked: string): GroupFault[] {
 		}
 
 		if (frame.kind === "opaque") {
+			// A query's `in {…}` is read as opaque, so `where … in {}` keeps
+			// parsing; its bytes are still rejected (`in {a?b}` at the `?`).
+			if (frame.query && !frame.muted && isUnquotedFaultByte(c)) {
+				faults.push(unquotedByteFault(masked, i));
+				frame.muted = true;
+			}
 			i++;
 			continue;
 		}
@@ -824,6 +943,12 @@ export function findGroupFaults(text: string, masked: string): GroupFault[] {
 				i++;
 				continue;
 			}
+			// Unlike `@`, these bytes are rejected in a query too (`in {a?b}`).
+			if (isUnquotedFaultByte(c)) {
+				report(unquotedByteFault(masked, i), frame);
+				i++;
+				continue;
+			}
 			frame.element = true;
 			frame.last = "element";
 			i++;
@@ -849,8 +974,16 @@ export function findGroupFaults(text: string, masked: string): GroupFault[] {
 			i++;
 			continue;
 		}
+		// A query group keeps its operators, but not these bytes:
+		// `where (comment=a?b)` is a `syntax error` at the `?`.
+		if (isUnquotedFaultByte(c)) {
+			report(unquotedByteFault(masked, i), frame);
+			i++;
+			continue;
+		}
 		if (frame.query) {
-			// Structural checks only (module header): any other byte is content.
+			// Structural and byte checks only (module header): any other byte is
+			// content.
 			frame.empty = false;
 			frame.wantOperand = false;
 			i++;
@@ -918,8 +1051,8 @@ export function findGroupFaults(text: string, masked: string): GroupFault[] {
 			i += spelling.length;
 			continue;
 		}
-		// `#`, `?`, a backtick, `'`, a stray `\`, a non-ASCII placeholder: another
-		// rule's byte, and nothing here can say what the group means after it.
+		// `#`, `'`, a stray `\`: another rule's byte, and nothing here can say
+		// what the group means after it.
 		frame.done = true;
 		i++;
 	}

package/src/explain/operators.ts

@@ -143,7 +143,8 @@ const OPERATORS: readonly RouterosOperator[] = [
 	// different operator, and arity is the only thing that separates them.
 	// Offline value-shape hints abstain on every such form: identical
 	// `(> …)` syntax can be `op` or `array` at runtime and `:parse` IL cannot
-	// distinguish them, so `op` lives only as a live `observedType` (#288).
+	// distinguish them; only `:typeof` can, and live explain never sends it,
+	// so `op` has no producer at all (#288, #225).
 	op(">", [1, 2], 5, "left", "relational", ">"),
 	op("=", [2], 5, "left", "relational", "="),
 	op("<=", [2], 5, "left", "relational", "<="),