segments the web interface will actually list

[salatmaster]

A bridge with an address, NAT and a Wi-Fi binding gives an isolated network that carries traffic perfectly and never appears in the web interface. It gets reported as "it works but I cannot see it", which is much harder to diagnose after the fact than before.

What the router calls a segment is VLAN-backed. Three steps are missing from the obvious sequence: a GigabitEthernet0/VlanN subinterface, that VLAN trunked over every switch port, and the subinterface bridged in. The router then computes iseg itself, and that block is what the web interface reads.

What is here

keenetic-segments carries the whole sequence: the discovery reads that find free identifiers, the build, the verification, and the teardown.

create_segment does it in one call. It allocates a free bridge, VLAN id, subnet, DHCP pool and Wi-Fi key, applies every step, and verifies against iseg rather than against the return value, because the router answers a wrong field name with {} and no error. A failure anywhere rolls the whole thing back and names anything it could not undo. list_segments reports uiVisible per bridge; delete_segment removes the VLAN from every port, which is the step that gets forgotten by hand.

Verified on hardware

Built and torn down on a KN-1811 running 5.1.3, driven through the built server over stdio rather than around it.

create_segment { name: "probe", ssid: "…", psk: "…" }
  uiVisible: true
  verifiedBy: iseg.vlan=3, iseg.vlan-port=1,2,3,4,5
  include:    GigabitEthernet0/Vlan3, WifiMaster0/AccessPoint2, WifiMaster1/AccessPoint2

ports before  access=1 trunk=[2]
ports during  access=1 trunk=[2,3]
ports after   access=1 trunk=[2]

switchport trunk vlan really is additive: the home network and the existing guest segment on those same ports were never disturbed. That was the one step with real risk to a router someone is using, and it is measured now rather than assumed. The teardown left no subinterface, pool or Wi-Fi entry behind.

Three things the live run corrected:

• Bridge0 carries an address and an empty iseg, because the home network is untagged rather than a VLAN. The check that correctly finds every other invisible bridge called the home segment invisible. It is reported as home now.
• A segment with no Wi-Fi does not appear under /access-points, and that is not a fault: the page lists Wi-Fi networks, and the include WifiMaster*/AccessPoint lines only appear once mws wlan binds to the bridge. The skill shows the two config blocks side by side, because the first thing anyone will report is that the segment is missing from a page it was never going to be on.
• The leak detector caught a DHCP range copied out of the real router into a fixture, and then the address written into its own comment while explaining the exemption.

Deliberately not done

Nothing is ever saved: a segment is gone on reboot until save_config runs, which makes it cheap to build one, look at it and change your mind. delete_segment leaves any routing policy alone, because policies are shared and removing one with its segment can break another.

245 tests, typecheck and build clean.