@tikoci/centrs 0.1.9-next.24 → 0.1.9

package/CHANGELOG.md

@@ -10,13 +10,36 @@ Each stable version has one section. Work in progress goes under
 `## X.Y.Z — next`, which is what `@next` installs (`X.Y.Z-next.N`); the stable
 release dates that heading. A `-next.N` build has no section of its own.
 
-## 0.1.9 — next
+## 0.1.9 — 2026-11-03
 
-In progress on npm tag `next`. The `0.1.9-next.0` cut (2026-10-13) carried
-part of this section.
+The `0.1.9-next.0` preview cut (2026-10-13) carried part of this section.
 
 ### Added
 
+- `explain` publishes a syntactic statement tree (#497, #522): statement
+  `id`/`parent`, substitution `owner`, and block ownership/index links let
+  consumers locate nested source without inferring ancestry from spans.
+  Stored script and callback bodies remain opaque; ownership does not claim
+  execution or lexical inheritance.
+- `devices add`/`set --password-stdin` reads the record password from stdin,
+  so automation can write a credential without it showing in argv or `ps`
+  (#582). One trailing `\n` or `\r\n` is stripped. Empty input is
+  `input/empty-stdin`, non-UTF-8 bytes or a leading byte-order mark are
+  `input/invalid-stdin`, a terminal on stdin is `usage/stdin-is-tty`, and
+  combining it with `--password` is `usage/conflicting-flags`. Other `devices`
+  subcommands refuse the flag.
+- `explain` offers a non-applied repair tip for pasted console prompts
+  (#370, #567, #578), including `[user@host] /menu>` and HotLock `>>` forms.
+  The candidate preserves command separators and names the menu context;
+  multiline repairs render as fenced code. The original analysis stays intact.
+- `--match user=<name>|target=<addr>|<record-type>` on `retrieve`, `execute`,
+  `api`, `transfer`, `terminal` and `btest client` picks one of several CDB
+  records saved for the same `<router>` (#583), as `devices show --match`
+  does. One address saved under two users was `identity/ambiguous` on every
+  command, and the error named a `--match` they rejected. The flag is
+  single-target: with a fan-out selection or `--quickchr` it is
+  `usage/conflicting-flags`, and with no CDB record in play it is
+  `identity/no-match` rather than ignored.
 - **Live `explain` over rest-api + native-api is `CHR-passed`** (#236).
   Examples 7–16, 19, 24, 48 and 52–53 pass on both transports on stable
   7.24.5 and long-term 7.23.8. `runtimeAcceptance` stays `not-proven`.
@@ -92,9 +115,33 @@ part of this section.
   client, its controller.
 - `execute --cmr` accepts a command that opens with a relative menu change
   (`/system; identity/print`); its `:parse` return was read as incomplete.
+- CDB encryption lifecycle (#558). `devices init --encrypt` creates an
+  encrypted empty CDB; `devices encrypt` converts an existing open CDB in place
+  with a fresh salt, keeping its records, unknown fields, and file mode. Both
+  need a non-empty `--cdb-password` / `CENTRS_CDB_PASSWORD`; a password alone
+  still never converts. Conversion keeps every backup and writes a plaintext
+  snapshot unless `--no-backup` is passed. It warns with `cdb/plaintext-backups`.
+  An already-encrypted file is verified and left unchanged. Library:
+  `initCdb({ encrypt })`, `encryptCdb({ skipBackup })`. `init` results now
+  include `encrypted`. `init` and `encrypt` refuse flags they would otherwise
+  ignore (`--user`, `--group`, `--via`, …) with `input/invalid-command`.
 
 ### Changed
 
+- Bun 1.4.4 is the minimum supported version (`engines.bun: >=1.4.4 <2`, was
+  `>=1.3.11 <2`). The CI/release/Pages `packageManager` pin, Docker image and
+  `@types/bun` now use 1.4.4 together (0.1.8 shipped on 1.3.14; #438).
+- **Breaking:** `devices show`, `add` and `set` no longer print the record password
+  (#551). Text and JSON carry `passwordSet: boolean` instead, and
+  `--show-password` on those three subcommands opts back in; other subcommands
+  refuse the flag. The `--explain` record's password field reads `<redacted>`
+  unless the flag is given, as does an unknown-tcode tail that may hold the
+  password. **Library consumers:** exported `showDevice`,
+  `addDevice` and `setDevice` now redact too. `DevicesShowItem` has no
+  `password` field; pass `showPassword: true` to get
+  `DevicesShowItemWithPassword`. MCP output is unchanged (it already redacted)
+  and now uses the same core redaction. Dialing with CDB credentials is
+  unaffected: the resolver and MCP allowlist read the raw record.
 - **Breaking:** permission and edge-auth failures get their own error codes
   (#541). Three codes change for `--json` and library readers:
   - A REST policy refusal (HTTP 500 `not enough permissions (9)` or `std
@@ -181,9 +228,7 @@ part of this section.
   `/cmr/upgrade/trigger`, `/cmr/upgrade/job/run-next`) are pinned as writes in
   every spelling, over `execute`, `api` and MCP `mcp=ro`. On 7.26beta1 a
   controller login with only `read` + `api` can run them (#456).
-- CI, release, Pages and the Docker image run Bun 1.4.2 (was 1.3.14), the
-  version local development already used; `@types/bun` moves with it (#438).
-  `engines.bun` stays `>=1.3.11 <2`. The `typescript` peer stays `^6.0.3`:
+- The `typescript` peer stays `^6.0.3`:
   the source passes `tsc --noEmit` under TypeScript 7.0.2, but typedoc 0.28 (the
   API reference build) supports TypeScript up to 6.0.x only.
 - QA records a CHR leg in `qa-history` only when its test step passed or
@@ -201,6 +246,60 @@ part of this section.
 
 ### Fixed
 
+- Help now lists SSH for `execute --via`, the offline analyzer before device
+  validation for `execute` and `api /execute`, and `devices --match` on
+  `show`/`set`/`remove`. `devices --group` names `add`/`set`, and
+  `devices init --help` / `encrypt --help` show only the flags they accept.
+  The generated CLI reference includes both file-command help sections.
+- Offline `explain` withdraws unsupported readings of unlisted bare paths
+  and space-for-`=` arguments (#211, #350), distinguishes command operands
+  from menu blocks (#496), and correctly reads `where` arrays, column-0
+  array comments and nested relative submenu blocks (#502, #503, #351).
+- Offline `explain` rejects CHR-grounded group, operator, escape, variable,
+  name and glued-token faults (#505, #511, #506, #518), including unquoted
+  `?`, backticks, second argument `=` and non-ASCII bytes (#358, #371).
+  Quoted values and accepted controls retain their supported readings.
+  A stray top-level `}` or `]` warns `discarded-close` and marks the
+  unread tail; the execution gate refuses it because RouterOS would discard
+  part of the submitted script (#504).
+- `explain` block spans use analyzed UTF-8 byte offsets, matching statements
+  and tokens even after Unicode text (#523, #524).
+- `settings get <attr>` works in text mode (#587). It crashed reading
+  `typed.source` because the text renderer treated `get`'s single entry as
+  `print`'s key-to-entry map; `--json` was unaffected. It now prints one
+  `key: value [source: …]` line in `print`'s format, under the canonical attr
+  name, and the JSON envelope names that key in `meta.operation.attr`. A fault
+  after the arguments parse is now `internal/settings-failed` (exit 1), not
+  `input/invalid-command` with `--help` advice.
+- **`retrieve` and `api` can no longer send a non-read** (#586). A `#` or
+  `?` in the path cut the appended `/print` off the REST URL, so
+  `retrieve '/system/reboot#' --no-validate --attribute uptime` posted
+  `/rest/system/reboot` and rebooted CHR 7.24.5 without `--yes`; `api` with a
+  projection did the same. Both now require every path segment to be a
+  RouterOS menu name (letters, digits, hyphens; case folds) on every
+  transport, even with `--validate=false`, failing
+  `input/invalid-routeros-path` before resolution. The REST adapter also
+  refuses any request path containing `?`, `#`, `\`, control characters or a
+  dot segment (including `%2e%2e`), for every command. Reported by
+  routeros-muse.
+- `devices set <target> key=` removes the comment token instead of storing an
+  empty value, as documented (#590). Removing an absent token is a no-op;
+  `--password ""` still clears the password, and bare `password=`/`user=`
+  stay `cdb/reserved-key`.
+- `transfer` honors a CDB record's `via=` preference (#591). A record with
+  `via=ssh` drove `execute` over SSH but transfer ignored it and needed
+  `--via sftp`. Transfer now maps the record's transport to a method
+  (`ssh`→`sftp`, `rest-api`→`rest`, `native-api`→`native`) after `--via` and
+  `CENTRS_TRANSFER_VIA`, and accepts `--via ssh` as an alias of `sftp`. A
+  record transport that cannot carry files fails `settings/invalid-via`
+  naming the record; a record-pinned REST upload over 60 KB names the record
+  in its `transport/unsupported-operation` remediation.
+- The `explain` catalog generator skips the CLI Reference's new
+  `compare-versions` widget page (2026-10-30). The page carries no command
+  entry, and it aborted the catalog drift report. The refreshed catalog adds
+  10 published paths (`/interface/wifi/easymesh/*`,
+  `/app/settings/remove-certificate`, three `/system/resource/hardware`
+  commands), and the `/cmr/client` gates drop `!powerpc`.
 - `retrieve --sample`, `--follow` and `--wait` no longer report a validation
   verdict the gate never gave (#537). A cancellation before the gate ran now
   reports the device stage `not reached` (`interrupted` for `--sample` and
@@ -277,6 +376,12 @@ part of this section.
   `:for from=1 counter=i to=2` binds `i`, so later `$` references link;
   previously the argument name was declared and a reordered `counter=` left
   `$i` unbound.
+- EC-SRP5 hashes shared `z` and the REDP1 loop seed minimal-length, as
+  RouterOS does (#565). centrs padded both to 32 bytes, following `mtwei.c`.
+  As a result, about 1 in 256 MAC-Telnet logins failed on a short `z`. On
+  both MAC-Telnet and btest, every login failed for an account whose salt hit
+  the REDP1 edge, about 1 in 317 password changes. btest's `z`-only workaround
+  (#516) is replaced by the shared fix.
 - mac-telnet with an explicit directed-broadcast `--host` (`192.168.74.255`)
   sends the owning interface's real MAC (#546, #547). On Linux, `connect()` to
   a broadcast reports `0.0.0.0`, so the session fell back to a synthetic
@@ -286,6 +391,16 @@ part of this section.
 
 ### Maintenance
 
+- QA allows 50 minutes per CHR leg so the full integration suite can finish
+  (#611).
+- The explain corpus uses schema 5 and one reader, with pinned channel
+  sessions, a regenerated highlight slice and a wiresage conformance gate
+  (#498, #514, #515). Bounded-execution tests use deterministic structural
+  work guards instead of depth-cap timing (#521).
+- The explain contract records proposed topic checks and related live reads
+  (#493), the CHR-grounded context submission matrix (#574), and import
+  verbose dry-run behavior (#520). These are design/grounding evidence;
+  `--context`, topic checks and contextual reads are not shipped CLI options.
 - Releases are one dispatch from `main` (#484, #485). `@next` publishes
   `X.Y.Z-next.<run_number>` with no commit, PR or tag, and reuses main's QA
   run on the commit instead of sweeping every channel again. `@latest` creates

package/GLOSSARY.txt

@@ -94,6 +94,7 @@ cwd
 datagram
 davidanson
 DDNS
+dsv # `:serialize to=dsv` delimiter-separated-values format (RouterOS 7.x); the #374 comma-value control pins offline acceptance of a `delimiter=,` value
 dialable # an endpoint a client can actually connect to (advertised AND reachable)
 defconf
 demux
@@ -116,6 +117,7 @@ fat-chr
 figcaption
 FlaUI
 frontends
+frontmatter # YAML metadata block at the top of a Markdown file (e.g. instruction applyTo headers)
 haakonnessjoen
 Hammerspoon
 HMAC
@@ -373,6 +375,8 @@ underflows
 Werror
 
 # MTWEI / EC-SRP vocabulary (src/protocols/mtwei.ts, mac-telnet auth)
+# libucrypto: RouterOS's shared cryptography library; EC-SRP5 encoding source.
+libucrypto
 # docrypto: mtwei.c's client EC-SRP proof function (mtwei_docrypto), ported to TS.
 docrypto
 # redp: REDP1 (IEEE P1363.2) random-point derivation used in the MTWEI tangle.
@@ -721,8 +725,11 @@ remoteap # caps-man definition module for `/caps-man/remote-cap`
 seccfg # caps-man definition module for `/caps-man/security`
 ifaces # CLI-Reference definition module for `/tool/graphing/interface`
 datapath # `/caps-man/datapath` — the real CLI menu behind `dpathcfg`
-easymesh # `/interface/wifi/easymesh` — the doc spelling of `/interface/wifi/wps-push-button`
+easymesh # `/interface/wifi/easymesh` — once a doc spelling of `/interface/wifi/wps-push-button`; published as its own ungated menu since 2026-10-30, in no CHR tree through 7.26beta3
 wps # Wi-Fi Protected Setup — `/interface/wifi/wps-push-button`
+bss # Wi-Fi basic service set — `/interface/wifi/easymesh/bss`
+dpp # Wi-Fi Device Provisioning Protocol — `/interface/wifi/easymesh/dpp-trigger`
+overcurrent # `/system/resource/hardware/reset-overcurrent`, gated by syscap `usb-hub`
 qos # switch-chip quality of service — `/interface/ethernet/switch/qos`, a real menu segment R1 must never drop
 qca # Qualcomm Atheros — the `wireless-qca` package gate
 multiswitch # syscap gate: more than one switch chip
@@ -807,6 +814,7 @@ zzznotamenu # a menu name no RouterOS build has — `/ip { zzznotamenu { print }
 # #361 absent-menu controls. Deliberate NON-words: each names a path no RouterOS
 # build has, or quotes a published gate verbatim, so the spelling is load-bearing.
 nosuch # a top-level menu no RouterOS build has — `/nosuch` is `bad command name nosuch` on CHR 7.23.7, the `validation/unknown-path` control (#361)
+nosuchcmd # a root command no RouterOS build has — `:local varID [nosuchcmd where name=x]` is `bad command name nosuchcmd (line 1 column 15)` on CHR 7.25 and 7.23.8, the #374 unknown-command control
 nosuchmenu # a submenu no RouterOS build has — `/ip/nosuchmenu/print` is `syntax error (line 1 column 15)` on CHR 7.23.7, pointing at the `/` after it (#361)
 nosuchverb # a command no RouterOS build has under a real menu — `/ip/address/nosuchverb` is `bad command name nosuchverb` on CHR 7.23.7 (#361)
 qqq # the second segment of the parse-oracle row `/zzz qqq print`, captured on CHR 7.23.3 (GH#230)

package/README.md

@@ -4,21 +4,21 @@
 CLI (with an MCP server; TUI and HTTP proxy frontends planned) for talking to
 MikroTik RouterOS devices through a regularized, validated interface.
 
-Preview builds are published on npm. To try the current offline analyzer without
-installing centrs or connecting to a router:
+Stable releases are published on npm under `latest`. To try the offline
+analyzer without installing centrs or connecting to a router:
 
 ```bash
-bunx @tikoci/centrs@next explain '/ip/address print' --json
+bunx @tikoci/centrs@latest explain '/ip/address print' --json
 ```
 
-Use `bunx @tikoci/centrs@next --help` to inspect the full preview CLI, and
-`bunx @tikoci/centrs@next --version` (`-V`; `--json` for an envelope) to print
+Use `bunx @tikoci/centrs@latest --help` to inspect the release CLI, and
+`bunx @tikoci/centrs@latest --version` (`-V`; `--json` for an envelope) to print
 the exact version for scripts and field reports. The dist-tag follows standard
-SemVer semantics: a plain version (`0.1.8`) publishes to `latest` and carries
-`next` forward with it, while a `next` build (`0.1.9-next.23`) publishes to
+SemVer semantics: a plain version (`0.1.9`) publishes to `latest` and carries
+`next` forward with it, while a `next` build (`0.1.10-next.23`) publishes to
 `next` only and never moves `latest`. A `next` build is described by the
-`## 0.1.9 — next` section of [`CHANGELOG.md`](CHANGELOG.md). So `@next` is the
-leading edge and can equal `@latest` between cuts —
+next version's `## X.Y.Z — next` section of [`CHANGELOG.md`](CHANGELOG.md).
+So `@next` is the leading edge and can equal `@latest` between cuts —
 `npm view @tikoci/centrs dist-tags` is the authority.
 
 The full flag reference for every command is generated from the CLI metadata
@@ -40,7 +40,8 @@ product; without them this would just be a worse `curl`.
 > Check current dist-tags with
 > `npm view @tikoci/centrs dist-tags --json`. The library, device registry, and
 > first MCP server phases are CHR-verified; the CLI is wired (`coded`);
-> encrypted-CDB writes are still blocked, and the TUI/proxy frontends are planned.
+> encrypted-CDB reads and writes are supported, and the TUI/proxy frontends
+> are planned.
 > `docs/MATRIX.md` is the single source of truth for what works today — treat
 > anything not green there as not-yet-shipped.
 
@@ -49,9 +50,10 @@ product; without them this would just be a worse `curl`.
 - **Frontends:** TypeScript API, CLI, MCP server (Phase 1 + first Phase 2 CDB
   mutation `CHR-passed` — see `commands/mcp/`), TUI and HTTP proxy/daemon
   (future).
-- **Protocols:** REST API (preferred), native API, and SNMP for reads;
-  SSH / MAC-Telnet / RoMON / WinBox Terminal for interactive and L2 execute;
-  MNDP for discovery. centrs picks the protocol for you (and lets you pin one
+- **Protocols:** REST API and native API for reads and writes; SSH / MAC-Telnet
+  for execution and interactive terminals; SFTP for file transfer; MNDP for
+  discovery; bandwidth test for peer measurement. SNMP, RoMON and WinBox
+  Terminal are planned. centrs picks the protocol for you (and lets you pin one
   with `via=` or `--via`).
 - **Commands:** every router-facing command resolves a *target* — a router you
   name on the CLI — to a real address, credentials, and a protocol, then runs.
@@ -60,12 +62,14 @@ product; without them this would just be a worse `curl`.
 
 | Command    | Purpose |
 | ---------- | ------- |
-| `retrieve` | Read RouterOS state over REST/native API and SNMP OID/MIB values. `--follow` keeps a menu's rows current over native API (snapshot, then a line per change; NDJSON); `--sample <interval>` re-reads it on a timer for counters; `--query` filters on the router with the `print where` grammar; `--wait` retries until a read succeeds (or an optional `--until` condition holds), up to a deadline. |
-| `execute`  | Run RouterOS CLI-shaped read/write commands (add/set/remove) over native API/REST/L2 surfaces. |
+| `retrieve` | Read RouterOS state over REST/native API. `--follow` keeps a menu's rows current over native API (snapshot, then a line per change; NDJSON); `--sample <interval>` re-reads it on a timer for counters; `--query` filters on the router with the `print where` grammar; `--wait` retries until a read succeeds (or an optional `--until` condition holds), up to a deadline. SNMP OID/MIB reads are planned. |
+| `execute`  | Run RouterOS CLI-shaped read/write commands (add/set/remove) over native API, REST, SSH or MAC-Telnet. |
 | `api`      | Structured RouterOS API passthrough (gh-api style): one command per operation, structured in/out, can write, over REST or native API. Follow changes with `api … <menu>/listen`; `--stream` streams any command's replies (native API; NDJSON). |
 | `terminal` | Open an interactive console, primarily SSH or MAC-Telnet. |
+| `transfer` | Upload, download and manage device files over REST/native API or SFTP; `upload` and `download` are shortcuts. |
+| `btest`    | Run a MikroTik bandwidth-test client or server over TCP/UDP. |
 | `check`    | Probe reachability and management protocol availability. **Designed, not implemented** — see `docs/MATRIX.md`. |
-| `explain`  | Analyze a RouterOS command before running it: canonical form, syntax diagnostics, and what is valid at a path. Offline analysis runs today; the live-device probes are designed. |
+| `explain`  | Analyze RouterOS source offline, or add read-only device evidence over REST/native API, including path schemas, completion candidates and value types. Runtime acceptance remains unproven. |
 | `devices`  | View and maintain the CDB-backed device registry (the only writer). |
 | `discover` | Discover MNDP neighbors and optionally save them into the CDB. |
 | `settings` | Manage centrs's own settings (`centrs.env`, `__default__`) and run first-time setup. |
@@ -92,7 +96,9 @@ stores:
   comment carries `identity=edge1`. Every other comment token stays inert prose.
   See `commands/devices/README.md` (Identity model) for the full resolution rules.
 - **`user` / `password`** — the credentials centrs connects with. They stay in
-  the CDB and are redacted from MCP results/resources.
+  the CDB. `devices show` / `add` / `set` withhold the password and report
+  `passwordSet` (`--show-password` reveals it); MCP results/resources always
+  redact it.
 - **`group`, `profile`, `session`, port** — used as-is.
 
 So `centrs retrieve edge1 /ip/address` works with no flags: `edge1` is looked
@@ -168,18 +174,24 @@ so you can always see *why* a given port or transport was chosen.
 
 `devices` is the only command that writes the CDB, and it does so safely
 (timestamped backup, atomic rename, unknown WinBox fields preserved verbatim).
-Encrypted-CDB **reads** work with `--cdb-password` / `CENTRS_CDB_PASSWORD`;
-encrypted **writes** are currently blocked pending a verified WinBox round-trip.
+Encrypted-CDB reads and writes work with `--cdb-password` /
+`CENTRS_CDB_PASSWORD`; writes decrypt, mutate and re-encrypt with a fresh salt.
+`devices init --encrypt` creates an encrypted registry, and `devices encrypt`
+explicitly converts an existing open CDB. Conversion retains existing backups
+and warns that plaintext copies remain. The manual WinBox round-trip is still
+pending; see the per-command contract for the current evidence and limits.
 The full contract — identity resolution, ambiguity handling, write strategy,
 and the comment grammar — lives in `commands/devices/README.md` and
 `docs/CONSTITUTION.md` (Identity and CDB).
 
 ## The result envelope, validation, and errors
 
-- **Validation is on by default** (`validate=true`). Reads are checked through
-  `/console/inspect`; CLI-shaped `execute` commands through `[:parse]`. Set
-  `validate=false` (per device or per call) only as a deliberate escape hatch.
-- **Every call returns one envelope:** `{ ok, data?, warnings?, error?, meta }`,
+- **Validation is on by default** (`validate=true`). CLI-shaped `execute` and
+  `api /execute` scripts pass the offline analyzer before device validation.
+  Reads are checked through `/console/inspect`; CLI-shaped commands through
+  `[:parse]`. Set `validate=false` (per device or per call) only as a deliberate
+  escape hatch.
+- **Every call returns one envelope:** `{ ok, data?, warnings, tips, error?, meta }`,
   with provenance and source-of-truth reporting in `meta`.
 - **Errors are typed values**, not thrown strings, with slash-namespaced codes
   (`routeros/…`, `transport/…`, `validation/…`, `cdb/…`) and a `details_url`
@@ -213,8 +225,8 @@ GitHub issues it links are the roadmap.
 
 Requirements:
 
-- Bun 1.3.11 or newer (CI runs the `packageManager` version in `package.json`;
-  Bun 2.x not yet validated).
+- Bun 1.4.4 or newer within 1.x (`engines.bun`: `>=1.4.4 <2`; CI runs the
+  `packageManager` version in `package.json`; Bun 2.x not yet validated).
 - Git.
 - `uv`, only for `bun run lint:actions` (zizmor workflow audit).
 - For integration tests: QEMU plus `@tikoci/quickchr` (handles CHR image
@@ -250,7 +262,9 @@ bun run explain:value-census  # value-surface census (#225)
 
 ## Done definition (short version)
 
-A feature is done when every line in `commands/<name>/examples.md` is green on
-real CHR via `bun run test:integration`. Code existing is not done. Unit tests
-passing is not done. Full rule:
-`.github/instructions/done-definition.instructions.md`.
+Live capabilities require every applicable example in `commands/<name>/examples.md`
+green on real CHR via `bun run test:integration`. Offline analysis requires its
+command README's full baseline acceptance criteria, including committed
+CHR-grounded semantic evidence. The fixture-backed `devices` and `settings`
+integration suites retain their command-specific contracts. Full rule:
+[`docs/CONSTITUTION.md` → Done definition](docs/CONSTITUTION.md#done-definition).

package/commands/api/AGENTS.md

@@ -87,8 +87,9 @@ stack-language access without centrs modelling the whole query grammar.
 
 ## CONFIRMED ON CHR (Phase 0 grounding spikes — CHR 7.23.1, 2026-06-29)
 
-Probes: scratchpad `api-grounding-spike.ts` (listen/CRUD/execute) and
-`api-grounding-spike2.ts` (duration/monitor + query forms + inspect path). Raw
+Probes (phase-0 lab history, not runnable methods): `api-grounding-spike.ts`
+(listen/CRUD/execute) and `api-grounding-spike2.ts` (duration/monitor + query
+forms + inspect path). Raw
 native codec for the listen probe; `fetch` for REST; `connectNativeApi().talk()`
 for native.
 

package/commands/api/README.md

@@ -51,7 +51,14 @@ centrs api <router> <endpoint> [flags]
   segment (`ip/address/*1`) addresses one row for GET/PATCH/DELETE; PUT and
   POST reject it with `input/invalid-path`. A trailing `/listen` segment is
   the menu's `listen` command, which implies `--stream` + `--via native-api`
-  and requires GET (`ip/address/*1/listen` follows one row).
+  and requires GET (`ip/address/*1/listen` follows one row). After that
+  normalization every menu segment must be a RouterOS menu name (letters,
+  digits, hyphens; case folds), or the request fails with
+  `input/invalid-routeros-path` before any transport is chosen, whatever
+  `--validate` says. A `#` or `?` once cut `/print` off a projected GET's
+  REST URL and posted the bare command (`/system/reboot#` rebooted CHR 7.24.5,
+  #586); the grammar and retrieve's REST guard are described in
+  [retrieve → Validation](../retrieve/README.md#validation).
 
 The HTTP method (`-X`, default `GET`) is honored **literally** against RouterOS's
 REST mapping — `GET`→print/get, **`PUT`→add**, `PATCH`→set, `DELETE`→remove,

package/commands/btest/README.md

@@ -139,6 +139,15 @@ is net-new — `mtwei.ts` only implements the client. A bad proof (or a client t
 will not offer EC-SRP5 against an `authenticate=yes` server) maps to
 `transport/auth-failed`. Legacy pre-6.43 double-MD5 is out of scope for v1.
 
+The shared core hashes minimal-length big-endian integers in the REDP1 loop
+and for shared-point `z`; public keys and the REDP1 input keep their fixed
+32-byte X encoding (#565). The distinction is grounded in RouterOS
+`libucrypto.so` 6.49.23/7.25 and `tikoci/m2ir`'s live WinBox discriminators.
+`test/fixtures/ec-srp5.json` pins calculated regression transcripts;
+`test/integration/ec-srp5.test.ts` forces the encoding edges against a real
+CHR btest client, including a short `z` and a leading-zero REDP1 input
+(confirmed on CHR 7.23.8 and 7.25).
+
 ## Output
 
 btest runs over time, so it emits **live records** during the run plus a final

package/commands/btest/examples.md

@@ -99,6 +99,13 @@ and non-zero throughput. This is the example that exercises the net-new
 server-side EC-SRP5 verifier against real RouterOS (TCP keeps the gated path off
 the SLIRP UDP-reverse-NAT question).
 
+`test/integration/ec-srp5.test.ts` also exercises this exchange with chosen
+test salts and ephemeral scalars, one edge per pass: a short REDP1 loop hash
+input, a REDP1 input whose leading zero must stay, and that input again with a
+forced short shared `z`. RouterOS's client proof must match the minimal-length
+derivation. This discriminator stops at the
+proof; the normal btest suites cover completed sessions and throughput (#565).
+
 ### 4. Wrong credentials are rejected
 
 > *Designed, not yet gated* — the auth-reject path is asserted by the loopback