confgraph 0.3.7__tar.gz → 0.3.9__tar.gz

{confgraph-0.3.7 → confgraph-0.3.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: confgraph
-Version: 0.3.7
+Version: 0.3.9
 Summary: Local-first network config dependency mapper — parse, visualize, and lint vendor configs
 Project-URL: Homepage, https://github.com/verigraphs/confgraph
 Project-URL: Repository, https://github.com/verigraphs/confgraph
@@ -131,6 +131,19 @@ See [`docs/CLI_USAGE.md`](docs/CLI_USAGE.md) for all commands, options, and exam
 
 Contributions welcome — new parsers, bug fixes, additional protocol coverage. See [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) to get started.
 
+### Running the tests
+
+```bash
+uv run --extra dev pytest
+```
+
+**The `--extra dev` is not optional.** `pytest` is an optional dependency (see
+`[project.optional-dependencies]`), so a bare `uv run pytest` falls back to
+whatever `pytest` is on your `PATH` — which runs the suite against a different
+environment and fails well over a thousand tests for reasons that have nothing
+to do with your change. There is no error message saying so; it just looks like
+you broke everything.
+
 ## License
 
 Apache 2.0

{confgraph-0.3.7 → confgraph-0.3.9}/README.md

@@ -101,6 +101,19 @@ See [`docs/CLI_USAGE.md`](docs/CLI_USAGE.md) for all commands, options, and exam
 
 Contributions welcome — new parsers, bug fixes, additional protocol coverage. See [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) to get started.
 
+### Running the tests
+
+```bash
+uv run --extra dev pytest
+```
+
+**The `--extra dev` is not optional.** `pytest` is an optional dependency (see
+`[project.optional-dependencies]`), so a bare `uv run pytest` falls back to
+whatever `pytest` is on your `PATH` — which runs the suite against a different
+environment and fails well over a thousand tests for reasons that have nothing
+to do with your change. There is no error message saying so; it just looks like
+you broke everything.
+
 ## License
 
 Apache 2.0

{confgraph-0.3.7 → confgraph-0.3.9}/confgraph/models/interface.py

@@ -2,8 +2,9 @@
 
 from enum import Enum
 from ipaddress import IPv4Address, IPv4Interface, IPv6Interface
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, field_validator
 from confgraph.models.base import BaseConfigObject
+from confgraph.utils.ospf import canonical_area_id
 
 
 class InterfaceType(str, Enum):
@@ -355,7 +356,11 @@ class InterfaceConfig(BaseConfigObject):
     )
     ospf_area: str | None = Field(
         default=None,
-        description="OSPF area ID",
+        description=(
+            "OSPF area ID, CANONICALIZED to the decimal spelling (CCR-0227) "
+            "so a '0.0.0.0' interface and a '0' interface are in the same "
+            "area here, as they are on hardware."
+        ),
     )
     ospf_cost: int | None = Field(
         default=None,
@@ -377,9 +382,22 @@ class InterfaceConfig(BaseConfigObject):
         default=None,
         description="OSPF network type ('point-to-point', 'broadcast', etc.)",
     )
-    ospf_passive: bool = Field(
-        default=False,
-        description="OSPF passive interface",
+    ospf_passive: bool | None = Field(
+        default=None,
+        description=(
+            "OSPF passive interface. TRI-STATE (CCR-0222, the CCR-0165 "
+            "``activate`` precedent): True = this interface is passive "
+            "(an interface-level ``ip ospf passive-interface``, or the "
+            "process-level passive config back-filled by the M3 walk); "
+            "False = EXPLICITLY non-passive (``no ip ospf passive-interface`` "
+            "— the per-interface override of a process-level "
+            "``passive-interface default``); None = NOT STATED on the "
+            "interface, so the consumer falls back to the process-level "
+            "passive config. A bool default of False could not express the "
+            "override at all: the M3 back-fill clobbered it, a field-level "
+            "merge could never overlay it (the CCR-0211 disease), and no "
+            "Change-IR SET op was emitted for it."
+        ),
     )
     ospf_authentication: str | None = Field(
         default=None,
@@ -646,6 +664,11 @@ class InterfaceConfig(BaseConfigObject):
             or self.dynamic_address
         )
 
+    # CCR-0227: area-ID storage point 4 of 4.
+    _canonical_area = field_validator("ospf_area", mode="before")(
+        canonical_area_id
+    )
+
     class Config:
         """Pydantic model configuration."""
         use_enum_values = True

{confgraph-0.3.7 → confgraph-0.3.9}/confgraph/models/ospf.py

@@ -2,8 +2,9 @@
 
 from enum import Enum
 from ipaddress import IPv4Address, IPv4Network
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, field_validator
 from confgraph.models.base import BaseConfigObject
+from confgraph.utils.ospf import canonical_area_id
 
 
 class OSPFAreaType(str, Enum):
@@ -159,12 +160,24 @@ class OSPFInterfaceConfig(BaseModel):
         default=None, description="BFD detection multiplier"
     )
 
+    # CCR-0227: area-ID storage point 1 of 4.
+    _canonical_area = field_validator("area_id", mode="before")(
+        canonical_area_id
+    )
+
 
 class OSPFArea(BaseModel):
     """OSPF area configuration."""
 
     area_id: str = Field(
-        ..., description="Area ID (e.g., '0', '0.0.0.1', '10')"
+        ...,
+        description=(
+            "Area ID, CANONICALIZED to the decimal spelling (CCR-0227): the "
+            "NX-OS/JunOS '0.0.0.0' and the IOS/IOS-XR '0' are the same area on "
+            "hardware and are the same key here. Dotted quads convert to their "
+            "32-bit decimal ('0.0.0.51' -> '51'); anything else is stored as "
+            "written."
+        ),
     )
     area_type: OSPFAreaType = Field(
         default=OSPFAreaType.NORMAL, description="Area type"
@@ -220,6 +233,11 @@ class OSPFArea(BaseModel):
         description="Prefix-list name filtering Type-3 LSAs sent out of this area (outbound from area)",
     )
 
+    # CCR-0227: area-ID storage point 2 of 4.
+    _canonical_area = field_validator("area_id", mode="before")(
+        canonical_area_id
+    )
+
     class Config:
         """Pydantic model configuration."""
         use_enum_values = True
@@ -326,7 +344,11 @@ class OSPFConfig(BaseConfigObject):
     )
     network_statements: list[tuple[IPv4Network, str]] = Field(
         default_factory=list,
-        description="Network statements (network, wildcard, area) - IOS style",
+        description=(
+            "Network statements (network, area) - IOS style. The area half is "
+            "canonicalized exactly like every other area-ID storage point "
+            "(CCR-0227)."
+        ),
     )
     shutdown: bool = Field(
         default=False, description="OSPF process shutdown"
@@ -341,6 +363,14 @@ class OSPFConfig(BaseConfigObject):
         default=False, description="BFD enabled on all OSPF interfaces"
     )
 
+    # CCR-0227: area-ID storage point 3 of 4 — the area half of each
+    # statement. ``mode="after"`` so the tuples are already built; the
+    # network half is untouched.
+    @field_validator("network_statements", mode="after")
+    @classmethod
+    def _canonical_statement_areas(cls, value):
+        return [(net, canonical_area_id(area)) for net, area in value]
+
     class Config:
         """Pydantic model configuration."""
         use_enum_values = True

{confgraph-0.3.7 → confgraph-0.3.9}/confgraph/models/topology.py

@@ -28,13 +28,24 @@ class PhysicalLink:
       "cdp"             — from CDP neighbor data
       "lldp"            — from LLDP neighbor data
       "mac-arp"         — validated via MAC-ARP correlation (supplementary only)
+      "upload"          — supplied by the operator (an export from their source
+                          of truth / NMS / IPAM, or a topology file)
+      "synth"           — INFERRED, not observed: synthesized from two devices
+                          having interfaces on a shared L3 subnet
+
+    The "synth" value is load-bearing rather than merely informative, so a
+    producer must label an inferred link honestly.  Consumers distinguish
+    supplied cabling from inference on this field alone — the simulator's
+    link-vs-config consistency checks deliberately say nothing about a "synth"
+    link, because a warning citing one would be the engine disputing its own
+    inference rather than disclosing an input it cannot trust.
     """
 
     device_a: str
     port_a: str           # canonical long-form logical interface on device_a
     device_b: str
     port_b: str           # canonical long-form logical interface on device_b
-    source: str           # "cdp" | "lldp" | "mac-arp"
+    source: str           # "cdp" | "lldp" | "mac-arp" | "upload" | "synth"
     member_count: int = 1
 
 

{confgraph-0.3.7 → confgraph-0.3.9}/confgraph/parsers/__init__.py

@@ -108,7 +108,105 @@ from confgraph.parsers.panos_parser import PANOSParser
 # Persisted baseline snapshots are invalidated by the pbv move itself (it is a
 # digest-key component), which subsumes the Tier-A digest shift these fields
 # cause.
-PARSER_BEHAVIOR_VERSION: int = 10
+# 11 (CCR-0222): ``InterfaceConfig.ospf_passive`` becomes tri-state
+# (``bool | None``, default None) and the shared interface walk extracts BOTH
+# polarities of the per-interface ``[no] ip ospf passive-interface`` override
+# (NX-OS/EOS inherit it).  Observable parse output moves three ways: every
+# interface that says nothing now reads None rather than False; an interface
+# exempted from a process-level ``passive-interface default`` reads an explicit
+# False and gains a native SET op for it (False != the new default); and the
+# ``no`` line it was emitting as an UnrecognizedBlock disappears, claimed by
+# that op's line provenance (CCR-0203 ledger).  No ParsedConfig JSON-schema
+# change beyond the field's own type, so pbv is what invalidates the platform
+# parse cache and entrp's digest keys.
+# 12 (CCR-0227): OSPF area IDs are CANONICALIZED at parse to the decimal
+# spelling, by one shared ``canonical_area_id`` applied via model validators on
+# all four storage points (OSPFArea.area_id, OSPFInterfaceConfig.area_id,
+# InterfaceConfig.ospf_area, the area half of OSPFConfig.network_statements).
+# `0.0.0.0` and `0` are the same area on hardware; stored raw they were two
+# keys, so every mixed-vendor estate (NX-OS/JunOS dotted, IOS/IOS-XR decimal)
+# modelled one real area as two — no adjacency across the spellings and wrong
+# ABR/inter-area computation. Observable parse output moves for every config
+# that spells an area as a dotted quad, with NO ParsedConfig JSON-schema
+# change — the sharp case this constant exists for. Decimal is canonical
+# precisely so the existing tombstone/golden keys (`ospf:1:area:0:...`) do not
+# move.
+# 13 (CCR-0227 completion): the two OPS-ONLY area-scoped removals —
+# ``no network A W area <aid>`` (and the EOS ``no network A/M area <aid>``
+# twin) and ``no area <aid> range A M`` — build their LIST_REMOVE key
+# directly in the parser rather than through the tombstone registry, and were
+# left spelling the area as the proposal wrote it while 12 made storage
+# canonical. A dotted withdrawal therefore addressed an area that no longer
+# existed under that spelling and removed NOTHING, silently — including the
+# dotted-baseline/dotted-proposal pair that worked before 12. The removal key
+# and the refresh-suppression map on both sides of each walk are now
+# canonical. Observable parse output moves (those op paths) with no schema
+# change. Bumped rather than riding 12 — unreleased though 12 is, the rule in
+# this module's header is per-commit and not optional for a qualifying
+# change, and deciding otherwise would mean re-deriving "was the predecessor
+# released?" at every review.
+# 14 (CCR-0217): the JunOS brace branch of ``unsupported_lines`` is fail-closed
+# on the parse OUTCOME — a document routed to the brace tokenizer that yields
+# an EMPTY canonical tree while carrying at least one non-blank
+# comment-stripped line discloses those lines as UnrecognizedBlocks instead of
+# returning silence. The hole was the document with no JunOS idiom in it at all
+# (Cisco ``no`` commands, an IOS ``interface`` block): zero set-family lines
+# routes it brace-ward, every statement is discarded at EOF for want of a ``;``
+# or ``{``, and the result read "no recognized configuration change" for text
+# that plainly requested one — the last silent arm of CCR-0210's fail-closed
+# story, modulo the CCR-0236 mixed-document residual. Observable parse output
+# moves for every such document, with NO ParsedConfig JSON-schema change — the
+# sharp case this constant exists for. Comment-only and whitespace-only
+# documents carry no content and stay silent; ``inactive:``-only documents
+# parse non-empty and keep their existing tag disclosure.
+# 15 (CCR-0214): JunOS ``delete`` / ``deactivate`` statements on MODELLED
+# paths compile to native change ops instead of being disclosed. JunOS emitted
+# no deletion artifact of any kind before this — no tombstones (the grammar is
+# Cisco syntax throughout) and no ops — so a withdrawal, the most outage-prone
+# change class on the OS, could only ever be reported as content the engine
+# could not read. The modelled set is one declarative table
+# (``parsers/junos_deletions.py``): a BGP neighbour, a whole BGP group, a
+# static route, an interface unit. Every path outside it stays on the CCR-0210
+# disclosure channel, so nothing became silent and nothing is half-applied;
+# ``deactivate`` compiles to the same op as ``delete`` because an inactive
+# subtree makes no contribution to the running configuration, which is the
+# only configuration the model holds. Observable parse output moves for any
+# JunOS document carrying one of those statements —
+# ``native_change_ops`` gains entries and ``unrecognized_blocks`` loses the
+# matching lines — with NO ParsedConfig JSON-schema change. No BASELINE moves:
+# a saved configuration states no deletion verb (the brace idiom has none),
+# and the ``inactive:`` statement tag is untouched and still disclosed.
+# 16 (CCR-0214, validation round 1 finding R1): a JunOS removal that the SAME
+# document later re-states no longer compiles — it falls back to the CCR-0210
+# disclosure channel. JunOS applies candidate statements in order, so
+# ``delete protocols bgp group RR`` followed by ``set protocols bgp group RR …``
+# rebuilds the group rather than removing it, and the same idiom moves a static
+# route to a new next-hop. Those are the two commonest JunOS rewrite idioms, and
+# compiling the deletion alone reported a confident teardown of something the
+# device would still have — measured in validation as a CRITICAL full-teardown
+# verdict on a group rebuild. The guard is order-aware (``set`` strictly AFTER
+# the deletion line, at an equal or deeper path): the reverse order really is a
+# removal on a device, so it still compiles. Observable parse output moves for
+# any JunOS document mixing a removal with a later restatement of the same
+# path — ``native_change_ops`` loses that op and ``unrecognized_blocks`` gains
+# the line back — with NO ParsedConfig JSON-schema change, and no baseline
+# motion (a saved configuration states no deletion verb).
+# 17 (CCR-0239 + CCR-0240, bump landed late — caught at the v0.3.9 release
+# audit, 2026-11-06): both landings changed parse output without moving this
+# constant, so PBV-16 parse-cache blobs minted before them could be served as
+# hits carrying the pre-fix models. CCR-0239: NX-OS named OSPF instance tags
+# (``ip router ospf CORE area …``) enroll their interfaces — previously the
+# named-instance spelling bound nothing, so those interfaces were
+# OSPF-invisible. CCR-0240: IOS-XR OSPF passive resolves at all four scopes
+# (process default, area, interface ``passive enable`` AND ``passive
+# disable``) — previously the process-scope default was hardwired False and
+# ``passive disable`` was not in the vocabulary, so suppressed interfaces
+# formed phantom adjacencies while exempted uplinks read as suppressed.
+# Observable parse output moves for any NX-OS config using named instance
+# tags and any IOS-XR config using process/area-scope passive — BASELINES
+# included (both spellings exist in saved configurations). No ParsedConfig
+# JSON-schema change.
+PARSER_BEHAVIOR_VERSION: int = 17
 
 __all__ = [
     "BaseParser",

{confgraph-0.3.7 → confgraph-0.3.9}/confgraph/parsers/base.py

@@ -956,16 +956,23 @@ class BaseParser(ABC):
         # (explicitly named in passive_interfaces or non_passive_interfaces,
         # or whose ospf_process_id matches). Never infer passive for L2 ports
         # or interfaces not in any OSPF process — correctness over coverage.
+        #
+        # CCR-0222: every stamp here is guarded on ``ospf_passive is None``.
+        # The field is tri-state, and a non-None value means the INTERFACE
+        # block itself spoke (`[no] ip ospf passive-interface`) — which on
+        # hardware overrides anything the process says. Without the guard
+        # this walk clobbers the explicit False and the override vanishes
+        # again, one layer down.
         if pc.ospf_instances and pc.interfaces:
             intf_by_name = {i.name: i for i in pc.interfaces}
             for ospf in pc.ospf_instances:
                 for name in ospf.passive_interfaces:
                     intf = intf_by_name.get(name)
-                    if intf:
+                    if intf and intf.ospf_passive is None:
                         intf.ospf_passive = True
                 for name in ospf.non_passive_interfaces:
                     intf = intf_by_name.get(name)
-                    if intf:
+                    if intf and intf.ospf_passive is None:
                         intf.ospf_passive = False
                 # For default-passive, only mark interfaces that belong to
                 # this process (ospf_process_id matches or listed in an area)
@@ -975,6 +982,8 @@ class BaseParser(ABC):
                         area_intfs.update(area.interfaces)
                     non_passive_set = set(ospf.non_passive_interfaces)
                     for intf in pc.interfaces:
+                        if intf.ospf_passive is not None:
+                            continue  # the interface block already decided
                         if intf.name in non_passive_set:
                             continue  # already handled above
                         if intf.name in area_intfs or intf.ospf_process_id == ospf.process_id:
@@ -1036,6 +1045,27 @@ class BaseParser(ABC):
         ("bfd_multiplier",     "bfd_multiplier"),
     )
 
+    @staticmethod
+    def _is_model_default(obj, field_name: str, value) -> bool:
+        """True when *value* is still *field_name*'s model-declared default.
+
+        The single "has this field been set?" test for the back-fill walks
+        (CCR-0222). Identity first so the singletons (``None``, ``False``)
+        match exactly; equality only within the same type, so an explicitly
+        parsed ``0`` is never read as a default ``False``.
+        """
+        field_info = type(obj).model_fields.get(field_name)
+        if field_info is None:
+            return value is None
+        default = (
+            field_info.default_factory()
+            if field_info.default_factory is not None
+            else field_info.default
+        )
+        if value is default:
+            return True
+        return type(value) is type(default) and value == default
+
     def _backfill_ospf_interface_settings(self, pc: ParsedConfig) -> None:
         """Carry ``area > interface`` OSPF settings out to ``InterfaceConfig``.
 
@@ -1077,14 +1107,25 @@ class BaseParser(ABC):
                             continue
                         # Never clobber a value the interface block itself set.
                         #
-                        # Compared with `is`, not `in (None, False)`: in Python
-                        # `0 == False`, so a membership test would read an
-                        # explicitly parsed ZERO as "unset" and overwrite it.
-                        # `ip ospf priority 0` is a real, meaningful value — it
-                        # says "never become DR" — and silently promoting it to a
-                        # back-filled 33 would invert the operator's intent.
+                        # "Unset" means "still holds the field's MODEL-DECLARED
+                        # default", read off the model rather than hard-coded as
+                        # None-or-False (CCR-0222): `ospf_passive` is tri-state
+                        # with default None, so a False there is an EXPLICIT
+                        # `no ip ospf passive-interface` and must survive, while
+                        # a False in a default-False field (`ospf_mtu_ignore`)
+                        # is still unset. Behaviour-identical for every other
+                        # row — no default-None field in the table can hold
+                        # False, and no default-False field can hold None.
+                        #
+                        # Compared with `is` before `==`, not `in (None, False)`:
+                        # in Python `0 == False`, so a plain equality test would
+                        # read an explicitly parsed ZERO as "unset" and overwrite
+                        # it. `ip ospf priority 0` is a real, meaningful value —
+                        # it says "never become DR" — and silently promoting it
+                        # to a back-filled 33 would invert the operator's intent.
+                        # The type check keeps `0` distinct from `False`.
                         current = getattr(intf, dst_field, None)
-                        if current is not None and current is not False:
+                        if not self._is_model_default(intf, dst_field, current):
                             continue
                         setattr(intf, dst_field, value)
 

{confgraph-0.3.7 → confgraph-0.3.9}/confgraph/parsers/eos_parser.py

@@ -14,6 +14,7 @@ from confgraph.parsers.base import (
 from confgraph.models.base import OSType, UnrecognizedBlock
 from confgraph.models.line import LineType
 from confgraph.models.ospf import OSPFConfig
+from confgraph.utils.ospf import canonical_area_id
 from confgraph.models.bgp import BGPConfig, BGPNeighborAF
 from confgraph.models.prefix_list import PrefixListConfig, PrefixListEntry
 from confgraph.models.static_route import StaticRoute
@@ -306,7 +307,10 @@ class EOSParser(IOSParser):
                     ospf_area_children[0].text,
                 )
                 if am:
-                    intf_cfg.ospf_area = am.group(1)
+                    # CCR-0227: assignment to an already-built model skips
+                    # pydantic validation — canonicalize as the field
+                    # validator would.
+                    intf_cfg.ospf_area = canonical_area_id(am.group(1))
 
             # VARP: "ip virtual-router address <ip>". A device emits ONE LINE
             # PER ADDRESS, so accumulate rather than overwrite
@@ -397,7 +401,10 @@ class EOSParser(IOSParser):
                 m = re.match(r"^\s+network\s+(\S+)\s+area\s+(\S+)\s*$", nc.text)
                 if not m:
                     continue
-                prefix_str, area_id = m.group(1), m.group(2)
+                # CCR-0227: this appends into a LIVE model's list, which runs
+                # no field validator — canonicalize here as the validator on
+                # OSPFConfig.network_statements would.
+                prefix_str, area_id = m.group(1), canonical_area_id(m.group(2))
                 try:
                     net = IPv4Network(prefix_str, strict=False)
                 except ValueError:

{confgraph-0.3.7 → confgraph-0.3.9}/confgraph/parsers/ios_parser.py

@@ -10,6 +10,7 @@ from confgraph.utils.interface import normalize_interface_name
 # confgraph imports, so this cannot cycle (the other change_ir names in this file
 # stay lazily imported at their call sites, unchanged).
 from confgraph.change_ir import _native_deletion_path
+from confgraph.utils.ospf import canonical_area_id
 from confgraph.models.base import OSType
 from confgraph.models.vrf import VRFConfig
 from confgraph.models.interface import (
@@ -1266,7 +1267,7 @@ class IOSParser(BaseParser):
             ospf_hello_interval = None
             ospf_dead_interval = None
             ospf_network_type = None
-            ospf_passive = False
+            ospf_passive = None
             ospf_authentication = None
             ospf_authentication_key = None
             ospf_message_digest_keys = {}
@@ -1380,6 +1381,28 @@ class IOSParser(BaseParser):
             if intf_obj.find_child_objects(r"^\s+ip\s+ospf\s+mtu-ignore"):
                 ospf_mtu_ignore = True
 
+            # ip ospf passive-interface / no ip ospf passive-interface
+            #
+            # CCR-0222: BOTH polarities are value-bearing state, so the
+            # negation parses to an explicit False — it is the per-interface
+            # override of a process-level `passive-interface default`, the
+            # NX-OS hardening pattern, and on hardware the interface-level
+            # word is final.  Hence the tri-state field: None means the
+            # interface said nothing and the process-level config decides.
+            # `$`-anchored both ways (disjoint from any operand-bearing
+            # spelling) with last-line-wins, exactly like every sibling
+            # `ip ospf *` scalar above.  This is the SHARED walk — NX-OS and
+            # EOS inherit it through super().parse_interfaces(); the
+            # process-level `passive-interface` spelling is parsed by the
+            # OSPF-process walks and is untouched by this.
+            ospf_passive_children = intf_obj.find_child_objects(
+                r"^\s+(?:no\s+)?ip\s+ospf\s+passive-interface\s*$"
+            )
+            if ospf_passive_children:
+                ospf_passive = not re.match(
+                    r"^\s*no\s+", ospf_passive_children[-1].text
+                )
+
             # Tunnel attributes
             tunnel_source = None
             tunnel_destination = None
@@ -1893,6 +1916,11 @@ class IOSParser(BaseParser):
         "ospf_dead_interval": r"^\s+ip\s+ospf\s+dead-interval\s+",
         "ospf_network_type": r"^\s+ip\s+ospf\s+network\s+",
         "ospf_mtu_ignore": r"^\s+ip\s+ospf\s+mtu-ignore\s*$",
+        # CCR-0222: both polarities — the SET op for an explicit False must
+        # carry the `no ip ospf passive-interface` line, which is also what
+        # claims that negation for the CCR-0203 ledger (consumed, not
+        # disclosed).
+        "ospf_passive": r"^\s+(?:no\s+)?ip\s+ospf\s+passive-interface\s*$",
         "cdp_enabled": r"^\s+(?:no\s+)?cdp\s+enable\s*$",
         "lldp_transmit": r"^\s+(?:no\s+)?lldp\s+transmit\s*$",
         "lldp_receive": r"^\s+(?:no\s+)?lldp\s+receive\s*$",
@@ -4952,6 +4980,18 @@ class IOSParser(BaseParser):
         """
         from confgraph.change_ir import ChangeOp, Verb
 
+        # CCR-0227: areas are STORED canonical, so both sides of this walk must
+        # speak the canonical spelling — the removal key, which the merger
+        # compares against stored ``network_statements``, and the caller's
+        # positive map, whose keys come from its own walk (IOS builds them raw
+        # from the regex, EOS canonical). Normalizing both HERE, where
+        # everything the two spellings must never disagree on already lives,
+        # keeps suppression and removal from splitting on the spelling.
+        positive_net_last_line = {
+            (net, canonical_area_id(area)): line
+            for (net, area), line in positive_net_last_line.items()
+        }
+
         for nnc in ospf_obj.find_child_objects(r"^\s+no\s+network\s+"):
             nnm = re.match(child_pattern, nnc.text)
             if not nnm:
@@ -4960,7 +5000,7 @@ class IOSParser(BaseParser):
             if extracted is None:
                 continue
             rem_net, rem_area = extracted
-            rem_key = (str(rem_net), rem_area)
+            rem_key = (str(rem_net), canonical_area_id(rem_area))
             if positive_net_last_line.get(rem_key, -1) > nnc.linenum:
                 # CCR-0203: suppressed-by-refresh is CONSUMED (understood and
                 # deliberately dropped), not blind — claim it or the fallback
@@ -5186,16 +5226,28 @@ class IOSParser(BaseParser):
             # (area_id, prefix) reappears as a positive range line LATER in
             # the block (refresh → re-add wins → device truth and legacy
             # parity).
+            #
+            # ONE key builder for both walks (CCR-0227): the area half is
+            # canonicalized, because the merger looks the area up by its
+            # STORED id, and the suppression map and the removal must agree
+            # on the spelling or a refresh stops suppressing its own removal.
+            # Returns None on an unparseable mask — dropped on BOTH walks, as
+            # before.
+            def _range_key(m) -> "tuple[str, str] | None":
+                try:
+                    prefix = IPv4Network(f"{m.group(2)}/{m.group(3)}")
+                except ValueError:
+                    return None
+                return canonical_area_id(m.group(1)), str(prefix)
+
             positive_range_last_line: dict[tuple[str, str], int] = {}
             for rc in ospf_obj.find_child_objects(r"^\s+area\s+\S+\s+range\s+"):
                 rm = re.match(r"^\s+area\s+(\S+)\s+range\s+(\S+)\s+(\S+)", rc.text)
                 if not rm:
                     continue
-                try:
-                    rng_pfx = IPv4Network(f"{rm.group(2)}/{rm.group(3)}")
-                except ValueError:
+                rkey = _range_key(rm)
+                if rkey is None:
                     continue
-                rkey = (rm.group(1), str(rng_pfx))
                 positive_range_last_line[rkey] = max(
                     positive_range_last_line.get(rkey, -1), rc.linenum
                 )
@@ -5205,11 +5257,9 @@ class IOSParser(BaseParser):
                 )
                 if not nrm:
                     continue
-                try:
-                    rng_pfx = IPv4Network(f"{nrm.group(2)}/{nrm.group(3)}")
-                except ValueError:
+                rkey = _range_key(nrm)
+                if rkey is None:
                     continue
-                rkey = (nrm.group(1), str(rng_pfx))
                 if positive_range_last_line.get(rkey, -1) > nrc.linenum:
                     self._claim_negation(nrc)  # CCR-0203: suppressed == consumed
                     continue  # re-added later in the block — removal suppressed
@@ -5383,6 +5433,19 @@ class IOSParser(BaseParser):
             def _queue_ospf_negation(verb, path_tail, child):
                 # CCR-0110 Phase E4/E5: queue the native op only; op-primary
                 # parsers no longer persist the deprecated no_commands string.
+                #
+                # CCR-0227: the area segment of an area-scoped path comes from
+                # the proposal TEXT, while the positive member ops key off the
+                # stored (canonical) ``area.area_id`` — so canonicalize it
+                # here, at the one point every OSPF negation op is built. A
+                # `no area 0.0.0.1 stub` must address the same area a
+                # `no area 1 stub` does, because the device does.
+                if len(path_tail) > 1 and path_tail[0] == "area":
+                    path_tail = (
+                        "area",
+                        canonical_area_id(path_tail[1]),
+                        *path_tail[2:],
+                    )
                 self._pending_native_ospf_ops.append(
                     ChangeOp(
                         verb=verb,