fix(firmware,ssh,logs): five reported bugs (v0.24.1-beta)

Closes #136. Also fixes #133, #137, #138, #139 (GitHub closes only the first).

None of these came from multi-site; two came from me.

#136 — waves failed on the second device. A regression from v0.23.31, the
firmware rewrite that replaced fire-and-forget `install` with `download` plus
polling. `/system/package/update/download` blocks for a minute or more, and
the client's read timeout is 30 seconds. The timeout path was the real damage:
it nulled the pending read but left the socket open, so when the reply finally
arrived processBuffer() queued it and the *next* command took it as its own
answer. Every later call on that connection returned the previous one's data,
which is why the status polls could never see "Downloaded".

  - a timed-out read now abandons the connection instead of silently
    desynchronising it, so the failure is loud rather than wrong
  - long-running commands can state their own budget; check-for-updates,
    download and /log/print now do
  - a download whose command times out is re-checked on a fresh connection
    rather than assumed failed, because the image may well have landed

#133 — the SSH terminal could not use a deployed key. It read only
ssh_password_encrypted and refused to connect without one, so retiring the
password after deploying a key -- the workflow the feature exists for -- broke
the console. It now uses the same resolver as every other SSH consumer.
preferredAuth(), written to make exactly this decision, had never run outside
its own tests, and disagreed with the resolver that did: it accepted a
'deployed' key where the live path required 'verified'. Unified on the
stricter rule and wired in.

#139 — the rollout was written before start() was attempted, so a rejected
start left the rows behind: "already running", press again, another rollout
banked each time. Devices already in an unfinished rollout are now refused by
name, before anything is persisted.

#138 — cancel worked but the API's explanation that the in-flight device is
never interrupted was discarded, so the button looked dead. It is shown.

#137 — log overfetching. /log/print returns the whole ring buffer, and the
count was incremented per attempted insert rather than per accepted row, so a
poll that stored nothing still reported "Collected 1000 new log entries" after
a thousand round trips. Inserts are batched and counted by RETURNING, and the
id watermark is the maximum over recent rows rather than the last one
inserted, which could move backwards and make the whole buffer look new.

One self-inflicted wound worth recording. The first cut of the desync guard
discarded sentences whenever `connected` was false -- but `connected` is only
set *after* login succeeds, so it threw away every login reply and took the
whole fleet offline until it was caught. "Not yet connected" and "abandoned"
are different states and now have different flags. Every existing test pre-set
connected = true, so none of them could see it; the test added for it fails
against the bad version.

Verified on hardware: devices back online, check-update 5.2s (was a 30s
failure), full sync completes, and log collection now reports 298 / 22 / 12 /
12 across successive polls -- real decreasing counts rather than a constant
1000 -- with no failures.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/src/services/mikrotik/RouterOSClient.ts

@@ -40,6 +40,8 @@ export class RouterOSClient extends EventEmitter {
     timeout: ReturnType<typeof setTimeout>;
   } | null = null;
   private sentenceQueue: RouterOSSentence[] = [];
+  /** Set when a reply stream can no longer be trusted; distinct from `connected`. */
+  private poisoned = false;
 
   private tagCounter = 0;
 
@@ -62,6 +64,10 @@ export class RouterOSClient extends EventEmitter {
 
   async connect(): Promise<void> {
     if (this.connected) return;
+    // A fresh connection starts trusted, so a client that was abandoned earlier
+    // can be reconnected and used again.
+    this.poisoned = false;
+    this.sentenceQueue = [];
 
     await new Promise<void>((resolve, reject) => {
       const timer = setTimeout(() => {
@@ -124,10 +130,18 @@ export class RouterOSClient extends EventEmitter {
   }
 
   // Enqueue a command so concurrent calls don't interleave
+  /**
+   * @param opts.timeoutMs  How long to wait for each reply sentence. The 30s
+   *   default suits ordinary reads, but some RouterOS commands legitimately run
+   *   far longer -- `/system/package/update/download` takes a minute or more on
+   *   an ordinary link -- and timing those out corrupted the connection (#136).
+   *   Callers issuing a long-running command must say so.
+   */
   async execute(
     command: string,
     params: Record<string, string> = {},
-    queries: string[] = []
+    queries: string[] = [],
+    opts: { timeoutMs?: number } = {}
   ): Promise<Record<string, string>[]> {
     let result!: Record<string, string>[];
     let error!: Error;
@@ -135,7 +149,7 @@ export class RouterOSClient extends EventEmitter {
     await new Promise<void>((resolve) => {
       this.operationChain = this.operationChain.then(async () => {
         try {
-          result = await this._executeRaw(command, params, queries);
+          result = await this._executeRaw(command, params, queries, opts.timeoutMs);
         } catch (err) {
           error = err as Error;
         }
@@ -150,7 +164,8 @@ export class RouterOSClient extends EventEmitter {
   private async _executeRaw(
     command: string,
     params: Record<string, string>,
-    queries: string[]
+    queries: string[],
+    timeoutMs?: number
   ): Promise<Record<string, string>[]> {
     if (!this.socket || !this.connected) {
       throw new RouterOSError('Not connected');
@@ -168,7 +183,7 @@ export class RouterOSClient extends EventEmitter {
 
     const results: Record<string, string>[] = [];
     while (true) {
-      const sentence = await this.readNextSentence();
+      const sentence = await this.readNextSentence(timeoutMs);
       if (sentence.type === '!done') break;
       if (sentence.type === '!re') {
         results.push(sentence.words);
@@ -341,6 +356,17 @@ export class RouterOSClient extends EventEmitter {
       const sentence = this.tryParseSentence();
       if (!sentence) break;
 
+      // Once a connection is abandoned, anything still arriving belongs to the
+      // command that gave up. Queueing it would hand it to the next caller as
+      // that caller's own reply, which is the desynchronisation poison() exists
+      // to prevent -- destroying the socket usually stops this, but data already
+      // buffered can still surface.
+      //
+      // This must test `poisoned`, not `connected`: `connected` is only set once
+      // login has *finished*, so testing it here discarded the login exchange
+      // itself and every connection timed out.
+      if (this.poisoned) continue;
+
       if (this.pendingRead) {
         clearTimeout(this.pendingRead.timeout);
         const { resolve } = this.pendingRead;
@@ -425,6 +451,19 @@ export class RouterOSClient extends EventEmitter {
     return new Promise((resolve, reject) => {
       const timer = setTimeout(() => {
         this.pendingRead = null;
+        // A timed-out read leaves a reply in flight. Previously the socket was
+        // left open, so when that reply finally arrived processBuffer() found no
+        // pending read and queued it -- and the *next* command took it as its
+        // own answer. Every later command on that connection then returned the
+        // previous one's data.
+        //
+        // That is how a slow `/system/package/update/download` turned into
+        // "did not finish downloading within 10 minutes" (#136): the status
+        // polls afterwards were reading shifted replies and could never see
+        // "Downloaded". A desynchronised connection can also make an unrelated
+        // command look like it succeeded, so the only safe response is to stop
+        // using it.
+        this.poison('Read timeout waiting for API response');
         reject(new RouterOSError('Read timeout waiting for API response'));
       }, timeoutMs);
 
@@ -436,6 +475,22 @@ export class RouterOSClient extends EventEmitter {
     });
   }
 
+  /**
+   * Abandon a connection whose reply stream can no longer be trusted.
+   *
+   * Anything already queued belongs to a command that gave up, so it is
+   * discarded rather than handed to the next caller.
+   */
+  private poison(reason: string): void {
+    this.poisoned = true;
+    this.connected = false;
+    this.sentenceQueue = [];
+    this.buffer = Buffer.alloc(0);
+    try { this.socket?.destroy(); } catch { /* already gone */ }
+    this.socket = null;
+    this.emit('poisoned', reason);
+  }
+
   // Execute a streaming/generator command (one that never sends !done on its own,
   // e.g. /tool/ip-scan). Collects !re rows until maxDurationMs elapses, then
   // sends /cancel to terminate the command and drains the cleanup response.