@tikoci/centrs 0.1.9-next.24 → 0.1.9

package/commands/devices/README.md

@@ -89,6 +89,17 @@ or a duplicated `identity=`):
   lists all matching entries (by `cdbRecordIndex`, `target`, `user`, and
   `recordType`). The caller pins the choice with `--match` by `user`
   (`--match user=admin`), by record-type (`--match ipUser`), or by exact target.
+  `--match` takes the same selector on `devices show`/`set`/`remove` and on
+  every command that resolves a `<router>` from the CDB: `retrieve`,
+  `execute`, `api`, `transfer`, `terminal` and `btest client` (#583). It is a
+  single-target flag: with a fan-out selection or `--quickchr` it is
+  `usage/conflicting-flags`, and when no CDB record is in play (no CDB, an
+  unregistered literal host, a `__default__`-only fallback, or `--host`
+  without `<router>`) it fails `identity/no-match` rather than being ignored.
+  With no target at all (no `<router>`, no `--host`) the CLI still reports
+  the missing-target usage error first.
+  An ambiguous positional inside a fan-out names the single-target
+  `--match` re-run, since the fan-out itself refuses the flag.
 
 `--prefer-family=ipv4|ipv6` is a non-interactive way to break v4/v6 ties
 deterministically; with it set, no prompt is raised. It emits a warning
@@ -141,6 +152,15 @@ Rules:
 - An **empty value removes** the token: `devices set <t> via=` deletes the `via`
   override (matching the internal upsert/remove model in `comment-kv.ts`). There
   is no current need to store a literally-empty value; revisit if one arises.
+  Removing a token that is already absent is a no-op success — the comment is
+  left byte-for-byte identical.
+- First-class fields have their own empty-value rules, distinct from token
+  removal: `--password ""` clears the stored password (and its saved-password
+  flag); `--user ""` writes an empty user. Bare `user=` / `password=` /
+  `group=` / `profile=` / `session=` positionals never reach those fields —
+  they are refused with `cdb/reserved-key` — so comment-token removal (`key=`
+  deletes the token) and credential clearing (`--password ""` empties the
+  password) are deliberately different operations.
 - `commentMirror` is kept in sync with `comment` on every write.
 
 Precedence (lowest → highest): built-in defaults → user config file
@@ -290,32 +310,27 @@ is no group-definition record. A group is the set of all entries whose
 `group` value matches by exact, case-sensitive string compare. An entry with
 `group=""` belongs to no group.
 
-`--group <G>` on any command resolves to the membership set and fans out.
+`--group <G>` on a router-facing fan-out command resolves to the membership set.
 `discover --save` writes MNDP records with `group=discovered`
 unless the caller supplies another group.
 
 ### Promotion (discovered → managed)
 
 There is no `promote` verb. Moving one device out of `group=discovered` and
-giving it credentials is `devices set <t> --new-group prod --user … --password
-…`. A **bulk** promotion (a whole discovered class at once) is the same call with
-a target selector picking the records:
+giving it credentials uses `set` on that target:
 
 ```bash
-devices set --group discovered --new-group prod \
-  --user admin --password … --force
+centrs devices set <target> --group prod --user admin --password …
 ```
 
-`--group` (and `--where`/`--all`/positionals) always **selects** which records to
-modify; `--new-group` always **writes** the group field. The two are distinct
-flags, so there is no select-vs-set overload — this resolves the former wrinkle.
-(Code follow-up: the CLI still overloads `--group` as the `add`/`set` field
-setter today; `examples.md` reflects that current flag until the `--new-group`
-split lands.)
+On `devices add`/`set`, `--group` writes the first-class group field; on
+`devices list` it filters. Bulk `set`/`remove` selection and a separate
+`--new-group` flag remain designed, not implemented. Both mutations currently
+require one target, with `--match` to disambiguate saved records.
 
 ## Fanout (multi-target invocations)
 
-Any command may receive multiple positional targets, one or more `--group`
+Router-facing fan-out commands may receive multiple positional targets, one or more `--group`
 flags, `--all`, `--default`, `--where <attr>=<value>` (device-class), and/or the
 geo selectors `--near <lat>,<lon>,<radius>` / `--bbox <south>,<west>,<north>,<east>`
 (see "Geo query" above) — see `docs/CONSTITUTION.md` (Target selection grammar).
@@ -340,25 +355,29 @@ runs produce stable diffs.
 ## Subcommands
 
 ```text
-centrs devices init                     # create an empty CDB at the resolved path
+centrs devices init [--encrypt]         # create an empty CDB at the resolved path
+centrs devices encrypt [--no-backup]    # explicitly encrypt an existing open CDB
 centrs devices list [--group G] [--where attr=value]
                     [--near lat,lon,radius] [--bbox south,west,north,east]
                     [--format json|yaml|text]
-centrs devices show <target> [--explain] [--via <protocol>] [--match <type>]
+centrs devices show <target> [--explain] [--via <protocol>] [--match <selector>]
+                    [--show-password]
 centrs devices groups [--members]
-centrs devices discover [--timeout 15s] [--group G]      # = discover --save (save implied)
-centrs devices add <target> [--user U] [--password P] [--new-group G]
+centrs devices discover [--timeout 15s] [--group G]      # designed, not implemented; use `centrs discover --save`
+centrs devices add <target> [--user U] [--password P|--password-stdin] [--group G]
                              [--profile P|--profile-none|--profile-own]
                              [--session S] [--comment "text k=v"]
                              [--record-type ipAdmin|ipUser|macTarget|...]
                              [--gps lat,lon[,altitude[,altitude-type]]]
                              [--lat D] [--lon D] [--altitude M] [--altitude-type MSL|AGL]
-centrs devices set  <selector…> [--user U] [--password P] [--new-group G]
+                             [--show-password]
+centrs devices set  <target> [--match <selector>] [--user U] [--password P|--password-stdin] [--group G]
                              [--profile P|--profile-none|--profile-own]
                              [--session S] [k=v ...]
                              [--gps lat,lon[,altitude[,altitude-type]]]
                              [--lat D] [--lon D] [--altitude M] [--altitude-type MSL|AGL]
-centrs devices remove <selector…>
+                             [--show-password]
+centrs devices remove <target> [--match <selector>]
 centrs devices edit <target>            # future: clack/TUI wizard
 ```
 
@@ -370,9 +389,11 @@ clack-style prompt used by `@tikoci/quickchr`); it is **not** a separate
 field-editing verb, and invoking it today returns `usage/not-implemented`. There
 is no `update`.
 
-- `init` creates an empty open CDB at the resolved path (`--cdb-file`,
+- `init` creates an empty CDB (open by default, encrypted with `--encrypt`)
+  at the resolved path (`--cdb-file`,
   `CENTRS_CDB_FILE`, or the default), with parent directories and mode `0600`.
-  It never overwrites: on an existing, readable CDB it succeeds with a
+  It never overwrites: on an existing, readable CDB matching the encryption
+  requirement it succeeds with a
   `cdb/file-exists` warning and writes nothing. An explicit path is created only
   by `init`; every other subcommand reports `cdb/not-found` for it (typo
   protection), and that error names `init`.
@@ -400,18 +421,79 @@ is no `update`.
   existing `(target, user)` it errors `cdb/already-exists` unless `--force`
   overwrites; the same `target` under a *different* `--user` is a new record,
   not a collision.
-- `set` modifies existing record(s). First-class fields change via flags
-  (`--user`, `--password`, `--new-group`, `--profile[-none|-own]`, `--session`);
-  comment lookup/override keys change via `k=v` positionals. **Which** records to
-  modify is the target selector — positionals, `--group`, `--where`, `--all`
-  (constitution: target selection) — so `--group` here *selects* and
-  `--new-group` *writes* the group field (no overload). Against a missing target
-  it errors `cdb/not-found-target`; a multi-record `set` needs `--force`. Writing
+- `set` modifies one matched record. First-class fields change via flags
+  (`--user`, `--password`, `--group`, `--profile[-none|-own]`, `--session`);
+  comment lookup/override keys change via `k=v` positionals. The positional
+  target and optional `--match` select the record. Against a missing target
+  it errors `cdb/not-found-target`. Writing
   a first-class field name as a `k=v` positional (e.g. `user=x`) stays refused
   with `cdb/reserved-key` — the flag is the only path. Unknown comment keys warn
   (`cdb/unknown-option`), or error under `--strict`.
-- `remove` (aliases `rm`, `delete`) removes a single entry. Group-wide deletes
-  (`--group G`) require `--force` (writes are large).
+- `remove` (aliases `rm`, `delete`) removes one matched entry. The positional
+  target and optional `--match` select the record; group-wide deletion is not
+  implemented.
+
+### Record password channels
+
+`add` and `set` take the record password one of two ways:
+
+- `--password <secret>` — argv. Simple, but `ps` can show the value while the
+  process runs, and shell history can keep the command after it exits.
+- `--password-stdin` — read from stdin, so the value never appears in argv. For
+  automation and harnesses that spawn centrs (`printf '%s' "$PW" | centrs
+  devices set <t> --password-stdin`, or `centrs devices set <t>
+  --password-stdin < pw.txt`).
+
+`--password-stdin` rules:
+
+- Exactly one trailing newline (`\n` or `\r\n`) is stripped, so `echo pw |`
+  works. Any other whitespace is part of the password.
+- The rest must be valid UTF-8 with no leading byte-order mark; otherwise it
+  is `input/invalid-stdin`. The CDB stores record strings as UTF-8 and drops a
+  leading BOM on read, so either would store a different credential than the
+  bytes piped in.
+- Empty input (nothing, or only that one newline) is `input/empty-stdin`.
+  Clearing a stored password stays a deliberate `--password ""`, never an empty
+  pipe.
+- A terminal on stdin is refused with `usage/stdin-is-tty`; centrs does not
+  prompt.
+- `--password` together with `--password-stdin` is `usage/conflicting-flags`.
+  There is no precedence order between them.
+- Only `add` and `set` accept it; every other subcommand refuses it with
+  `input/invalid-command`.
+- The value is never echoed in errors. Success envelopes are the same as with
+  `--password`.
+
+There is no environment-variable channel for the record password:
+`CENTRS_PASSWORD` is the dial credential, not a CDB field.
+
+### Record password in output
+
+`show`, `add` and `set` withhold the stored record password by default, in text
+and JSON (#551). Each entry always carries `passwordSet: boolean` (true when a
+non-empty password is stored); text prints `password: (set, hidden)` or
+`(not set)`. `--show-password` returns the cleartext `password` on those three
+subcommands; every other subcommand refuses it with `input/invalid-command`.
+The `--explain` record's password field reads `<redacted>` without the flag.
+When an unknown-tcode `rawTail` comes before any decoded password field, the
+tail may hold the password, so without the flag its `value` reads
+`<redacted: N bytes, may contain password>` instead of the bytes. Such a
+record decodes to an empty password, so `passwordSet` is `false` (it reports
+the password centrs decoded and would dial with); the `cdb/unknown-field`
+warning then carries `context.mayContainPassword: true`.
+There is no encryption gate: the opt-in works the same on an open or encrypted
+CDB. `passwordSet` is not the WinBox `savedPassword` ("keep password") flag.
+
+The library matches the CLI: exported `showDevice` / `addDevice` / `setDevice`
+redact by default and take `showPassword?: boolean` (default `false`); with
+`showPassword: true` the entry type is `DevicesShowItemWithPassword`. MCP
+(`centrs_devices`) never passes it, so MCP output never carries the password.
+
+Dialing does not read this envelope. The resolver and the MCP allowlist gate
+read the raw record through an internal lookup (`lookupDeviceRecord`, not
+exported from the package root), so a CDB-credentialed dial still sends the
+stored password. The public entry type has no `password` field, so a caller
+that reached for the envelope instead fails to type-check.
 
 `--profile <name>` sets a named WinBox profile; `--profile-none` /
 `--profile-own` write the WinBox sentinels `<none>` / `<own>`. `profile` and
@@ -437,6 +519,54 @@ can edit it too. Precedence is per-field: args → env → device record →
   **MCP** it never widens the allowlist — an unregistered target is still
   rejected; `__default__` only fills missing creds for a registered device.
 
+## CDB encryption lifecycle (#558)
+
+Start encrypted with `devices init --encrypt`, or start open for a lab and run
+`devices encrypt` when moving to production. Both require a non-empty
+`--cdb-password` / `CENTRS_CDB_PASSWORD`. A password alone does not change the
+mode of initialization or ordinary writes. The library exports
+`initCdb({ encrypt: true, cdbPassword, cdbFile })` and
+`encryptCdb({ cdbPassword, cdbFile })`; both use the shared settings precedence.
+
+Encrypted initialization keeps atomic no-clobber creation and mode `0600`.
+Initialization returns `data.encrypted` for both newly created and existing
+files. Competing encrypted initializers with different passwords fail closed:
+the loser gets `cdb/decrypt-failed` when it cannot unlock the winner's file.
+An existing open CDB refuses `init --encrypt`; conversion must be explicit.
+An existing encrypted CDB is verified with the supplied password and left alone.
+Conversion requires an existing readable CDB, preserves its records and unknown
+fields, uses a fresh salt and atomic replacement, and keeps its file mode.
+`data` reports `cdbFile`, `encrypted: true`, `changed`, `recordCount`, and the
+new `backupPath` when conversion occurred. Default text output reports
+`encrypted` or `verified encrypted ... (unchanged)`, the record count, and
+the backup path when created, followed by the plaintext-backup warning.
+Already-encrypted conversion verifies
+the password and returns `changed: false` without rewriting or rotating it.
+
+**Backups remain sensitive.** Conversion retains every existing backup and
+creates a plaintext snapshot of the original; it does not run backup retention.
+The `cdb/plaintext-backups` warning accompanies conversion, including no-op runs:
+only the active file is protected. Handle backups according to your own retention
+policy; centrs neither encrypts nor deletes them during conversion. Subsequent
+ordinary writes still use the normal five-backup retention below.
+`--no-backup` (library: `skipBackup: true`) skips the new plaintext snapshot, so
+no fresh plaintext copy is written; earlier backups are still retained and the
+warning still applies to them. Without the snapshot, a forgotten password cannot
+be recovered.
+
+`init` and `encrypt` act on the CDB file, not on records: they accept only
+`--cdb-file`, `--cdb-password`, `--format`/`--json`, plus `--encrypt` (`init`)
+or `--no-backup` (`encrypt`). Any other flag is `input/invalid-command`
+instead of being silently ignored. `devices init --help` and
+`devices encrypt --help` show only those accepted flags; the same metadata
+generates their sections in [`docs/CLI.md`](../../docs/CLI.md).
+
+Close WinBox and other CDB writers before conversion. If they share this path,
+they must reopen it using the CDB password; a stale writer can overwrite the
+conversion. Atomic replacement does not provide concurrent-writer transactions
+(#581). Password rotation and decryption are outside this slice. WinBox manual
+interoperability verification remains open (see Residual risks).
+
 ## CDB write strategy
 
 All writes go through one helper (`writeWinBoxCdb`) that:

package/commands/devices/examples.md

@@ -94,7 +94,8 @@ centrs devices show 192.0.2.5 --cdb-file $CDB --explain
 ```
 
 `data.record` is the raw `WinBoxCdbRecord` (tag/marker/tcode/value). Useful
-for diagnosing unknown-field preservation.
+for diagnosing unknown-field preservation. The password field value reads
+`<redacted>` unless `--show-password` is passed (example 60).
 
 ## groups
 
@@ -651,7 +652,7 @@ centrs devices add 192.0.2.1 --user robot-reader --cdb-file ./lab/winbox.cdb --j
 ```
 
 Creates missing parent directories and an empty open CDB with mode `0600`.
-`data` is `{ cdbFile, created: true, recordCount: 0 }`. The `add` then succeeds.
+`data` is `{ cdbFile, created: true, encrypted: false, recordCount: 0 }`. The `add` then succeeds.
 
 ### 55. `init` never clobbers
 
@@ -660,8 +661,173 @@ centrs devices init --cdb-file ./lab/winbox.cdb --json
 ```
 
 On an existing, readable CDB: `ok: true`, `data.created: false`,
+`data.encrypted` reports the actual encryption mode,
 `data.recordCount` is the current count, and a `cdb/file-exists` warning says
 nothing was written. As with `git init`, re-running is safe. An existing file that
 does not load fails with that load error (`cdb/parse-failed`,
 `cdb/password-required`) and is left untouched. A location that cannot be
 written fails with `cdb/create-failed`.
+
+### 56. Initialize encrypted from the start
+
+```bash
+CENTRS_CDB_PASSWORD="$CDB_SECRET" centrs devices init --encrypt --cdb-file ./prod.cdb --json
+```
+
+Creates a complete encrypted empty CDB with mode `0600`; subsequent loads require
+that password. `data.encrypted` is `true`. Re-running verifies the password
+and reports `created: false`, `encrypted: true`.
+Test: `centrs devices encryption (#558)` in `test/integration/devices.test.ts`.
+
+### 57. Convert a lab CDB to encrypted
+
+```bash
+centrs devices init --cdb-file ./lab.cdb
+centrs devices add 192.0.2.1 --user reader --cdb-file ./lab.cdb
+CENTRS_CDB_PASSWORD="$CDB_SECRET" centrs devices encrypt --cdb-file ./lab.cdb --json
+CENTRS_CDB_PASSWORD="$CDB_SECRET" centrs devices list --cdb-file ./lab.cdb --json
+```
+
+Conversion reports `encrypted: true`, `changed: true`, `recordCount: 1`, and
+`backupPath`. Records survive a password-protected reload; loading without a
+password fails. All backups remain, including the plaintext pre-conversion file;
+`cdb/plaintext-backups` warns explicitly. Repeating with the same password returns
+`changed: false`; a wrong password fails without writing. Without `--json`,
+text reports conversion or verified unchanged, the record count, and the
+plaintext snapshot path when created; the warning remains visible.
+Test: `centrs devices encryption (#558)` in `test/integration/devices.test.ts`.
+
+### 58. Encryption intent fails closed
+
+`init --encrypt` and `encrypt` refuse a missing or empty CDB password before
+creating anything. `init --encrypt` refuses an existing open CDB without changing
+it. `--encrypt` on other subcommands and positional targets on `encrypt` are
+invalid commands. Record, selection, and provenance flags (`--user`, `--group`,
+`--password`, `--via`, …) on `init`/`encrypt`, and `--no-backup` on anything but
+`encrypt`, are `input/invalid-command` rather than silently ignored. Test:
+`centrs devices encryption (#558)` in `test/integration/devices.test.ts`.
+
+### 59. Convert without a plaintext snapshot
+
+```bash
+centrs devices init --cdb-file ./lab-fresh.cdb
+centrs devices add 192.0.2.1 --user reader --cdb-file ./lab-fresh.cdb
+CENTRS_CDB_PASSWORD="$CDB_SECRET" centrs devices encrypt --no-backup --cdb-file ./lab-fresh.cdb --json
+```
+
+A fresh path, so it does not depend on example 57 having already converted
+`./lab.cdb`. Conversion reports `changed: true`, `recordCount: 1`, and no
+`backupPath`, and no new `.bak.*` file appears. The backup the `add` wrote
+is retained, so
+`cdb/plaintext-backups` still warns. Test: `centrs devices encryption (#558)`
+in `test/integration/devices.test.ts`.
+
+## Record password in output
+
+`show`, `add` and `set` withhold the stored record password by default, in text
+and JSON and in the library envelopes (#551). Every entry carries
+`passwordSet: boolean`; `--show-password` (library: `showPassword: true`) opts in.
+`passwordSet` is not the WinBox `savedPassword` flag. MCP never returns the
+password and has no opt-in.
+
+### 60. `show` withholds the password and reports `passwordSet`
+
+```bash
+centrs devices show 192.0.2.5 --cdb-file $CDB --explain --json
+centrs devices show 192.0.2.5 --cdb-file $CDB
+```
+
+`data.entry` has `passwordSet: true` and no `password` key. The `--explain`
+record's password field (tag 3) reads `<redacted>`. Text prints
+`password:      (set, hidden)`, or `(not set)` for an empty password.
+
+### 61. `--show-password` returns the password on `show`, `add` and `set`
+
+```bash
+centrs devices show 192.0.2.5 --cdb-file $CDB --show-password --json
+centrs devices add 198.51.100.57 --user writer --password pw57 --cdb-file $CDB --json
+centrs devices set 198.51.100.57 --group lab --cdb-file $CDB --show-password --json
+```
+
+`show` returns `data.entry.password: "secret"`. The `add` without the flag
+returns `passwordSet: true` and no `password`; the `set` with it returns
+`data.entry.password: "pw57"`.
+
+### 62. `--show-password` is refused outside `show` / `add` / `set`
+
+```bash
+centrs devices list --cdb-file $CDB --show-password --json
+```
+
+`input/invalid-command` with `error.context: { subcommand: "list", flag:
+"--show-password" }`, the same refusal other subcommand-scoped flags use.
+
+## Record password on stdin
+
+`--password-stdin` (#582) reads the record password from fd 0 so it never rides
+argv. These run as subprocesses (`test/integration/cli-process.ts`), because
+only a child process can be handed real stdin bytes. The newline, empty and TTY
+rules are also unit-tested in `test/unit/devices-password-stdin.test.ts`.
+
+### 63. `add --password-stdin` stores the piped value
+
+```bash
+printf 'piped pw\n' | centrs devices add 192.0.2.77 --user robot --password-stdin --cdb-file $CDB --json
+```
+
+`ok: true`. The stored password is `piped pw`: one trailing newline is
+stripped, the inner space is kept.
+
+### 64. `set --password-stdin` strips a trailing CRLF
+
+```bash
+printf 'rotated\r\n' | centrs devices set 192.0.2.5 --password-stdin --cdb-file $CDB --json
+```
+
+`ok: true`. The stored password is `rotated`; group and comment are unchanged.
+
+### 65. Empty stdin is refused
+
+```bash
+printf '' | centrs devices set 192.0.2.5 --password-stdin --cdb-file $CDB --json
+```
+
+Errors with `input/empty-stdin` (also for a lone `\n`). The CDB is not written
+and no backup is made.
+
+### 66. `--password` with `--password-stdin` conflicts
+
+```bash
+echo stdin-secret | centrs devices set 192.0.2.5 --password argv-secret --password-stdin --cdb-file $CDB --json
+echo stdin-secret | centrs devices set 192.0.2.5 --password --password-stdin --cdb-file $CDB --json
+```
+
+Both error with `usage/conflicting-flags`. Neither value appears in the error;
+`--password` cannot consume `--password-stdin` as a literal credential.
+
+### 67. Non-UTF-8 or BOM-prefixed stdin is refused
+
+```bash
+printf 'pw\377\n' | centrs devices set 192.0.2.5 --password-stdin --cdb-file $CDB --json
+printf '\357\273\277pw\n' | centrs devices set 192.0.2.5 --password-stdin --cdb-file $CDB --json
+```
+
+Both error with `input/invalid-stdin`: the first is not valid UTF-8, the second
+starts with a byte-order mark. The bytes are not echoed, the CDB is not written
+and no backup is made.
+
+## File-command help
+
+### 68. `init` and `encrypt` show only their accepted flags
+
+```bash
+centrs devices init --help
+centrs devices encrypt --help
+```
+
+Both exit 0 without reading or writing a CDB. Each shows its own usage, the
+CDB path/password and output flags, plus `--encrypt` for `init` or
+`--no-backup` for `encrypt`. Record and selection flags are absent, including
+`--user`, `--password-stdin`, `--show-password`, `--group` and `--match`.
+Test: `devices file-command help is scoped without opening a CDB` in
+`test/integration/cli-smoke.test.ts` (network-free).

package/commands/execute/README.md

@@ -146,8 +146,8 @@ selection**, examples F1–F5). `romon` and `winbox-terminal` remain
   all-strings). Unlike `jo`-style KV builders, there is no per-value
   type-forcing escape, because the device, not centrs, owns value typing.
 - On an empty-CDB resolution failure, execute (like retrieve) emits the
-  `tip/no-devices` tip, steering toward `centrs devices discover` /
-  `centrs settings`.
+  `tip/no-devices` tip, steering toward `centrs discover --save` /
+  `centrs devices add`.
 - Protocol surfaces are native API, REST, mac-telnet, and SSH. RoMON and
   WinBox Terminal are later. SNMP is retrieve-only and must reject execute.
 - For a MAC target not resolved from CDB, auto-selection defaults to
@@ -529,6 +529,17 @@ How it is wired:
   but rejects the MD5 proof, so centrs advertises MTWEI (`src/protocols/mtwei.ts`)
   by default. `END_AUTH` ≠ success (a failed login emits `END_AUTH` then "Login
   failed" + `END`) → `transport/auth-failed`.
+- **MTWEI hash encoding (grounded, #565):** RouterOS hashes shared `z` and the
+  REDP1 loop seed minimal-length; `haakonnessjoen/MAC-Telnet`'s `mtwei.c` pads
+  both to 32 bytes. When they differ, the padded proof fails. On CHR 7.25 over
+  the L2 harness (2026-10-31): short-`z` logins accepted the minimal proof 8 of
+  8 and rejected the padded proof 1 of 1 (about 700 logins). The `z` edge hits
+  about 1 in 256 logins. The REDP1 edge depends on the salt RouterOS generates
+  at each password change, about 1 in 317 changes; it fails every login until
+  the next change. A password-rotation scan over raw handshakes to PASSSALT
+  found divergent salts, and on one the minimal proof was accepted 3 of 3 while
+  the padded proof was rejected 3 of 3, all with a clean 32-byte `z` to isolate
+  the edge. The shared core is `src/protocols/ec-srp5.ts`.
 - **Console quirks to know:** a successful write **prints no output** (no `.id`,
   unlike REST/native — `data.ret` is empty on a successful add); and there is a
   ~10s terminal-negotiation stall on every login (a latency cost, not a