Closes#105.
RouterOS narrates the whole life of an association in its log — association, every
band or AP change, and the disconnect — each line carrying the signal at that
moment. Nothing else in the platform can see any of it: roaming happens between
polls, so a poll only ever observes where a client ended up, never that it moved.
Sessions are now rebuilt from those lines and shown on the client detail page: the
path across radios, signal at each step, duration, and RouterOS's own disconnect
reason. Sessions averaging six or more roams an hour are flagged, since a client
bouncing between radios is usually a roaming-threshold problem rather than a faulty
client.
No new collection and no new storage. It reads the events already gathered, so it
works retroactively over whatever log history exists.
Two things came out of testing against real logs rather than the samples in the
issue, and both were wrong in ways the samples could not have shown:
Ordering. RouterOS log timestamps are second-granular, so a reassociation emits
its disconnect and reconnect inside the same logged second, and collection
assigns sub-second values in whichever order they were read — observed on a live
AP as both `.849/.849` and `.096/.097` for the same kind of pair. Sorting on the
raw timestamp attached the disconnect to the session the connect had just opened,
so every reassociation reconstructed as a 0-second session while the real one
disappeared. On one IoT client that was 255 phantom sessions out of 422. Events
are now ordered by whole second and ties broken by meaning: a disconnect closes
what came before, a connect opens what comes after. The same client now shows its
real behaviour — 900s, 840s and 930s sessions, reassociating every 15 minutes.
Signal sanity. Real logs contain `signal strength 91`. dBm is negative, so a
positive reading is not a measurement; recording it would draw a client with an
impossibly perfect signal. Treated as unknown.
21 tests, including the full ping-pong trace quoted in the issue — which the
reconstruction correctly identifies as flapping — plus both timestamp-collision
shapes seen in production.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Documentation only — no functional change.
The README was carrying two jobs for two different readers. Its Reference section was
the single largest block at 154 lines, and nobody deciding whether to try the project
reads an InfluxDB environment variable table — while the people who need it were
scrolling past the pitch to reach it.
Split along that seam: anything you would read before installing stays in the README,
anything you would read after installing moves to docs/.
README.md 430 lines sell, prove, install, feature overview
docs/change-guard.md 193 safety system, settings, guard states
docs/architecture.md 116 data stores, polling model, module layout
docs/capsman.md 84 role model, radio matching, current limits
docs/alerting.md 81 rules, channels, webhooks, maintenance windows
docs/api.md 77 scoped tokens, preflight, scripting
docs/configuration.md 76 environment, secrets, rotation, TLS
docs/sso-oidc.md 71 identity provider setup and behaviour
docs/README.md 20 index
In-repo rather than a documentation site, deliberately. A change to Change Guard's
semantics can edit its documentation in the same commit as the code — which, given how
often that behaviour has been refined recently, is the property that actually matters.
A static site generator can point at docs/ later without moving a file.
The Change Guard pitch stays on the front page: the problem framing, the verified
recovery timeline and the quoted prediction warning are what make someone care, and a
reference page is the wrong home for them.
Three sections are new rather than relocated, written because the split exposed the gaps:
- architecture.md did not exist. It now records why there are three data stores, the
polling cadences, and which modules are pure functions over a snapshot and why.
- Scoped API tokens shipped without usage documentation. api.md shows preflighting a
change from a script and reading the guard block afterwards.
- change-guard.md records why ip-on-bridge-port is informational rather than critical
on RouterOS 7 — reasoning that previously existed only in a commit message.
Every internal anchor and cross-file link verified to resolve, including anchors into
other documents. No content dropped, checked by keyword comparison against the previous
single file.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2GT-RichandClaude Opus 5