SySS follows Linksys Intelligent Mesh from BLE setup credentials into TLS-SRP, `syscfg`, cron `eval`, and a WAN rule that trusts traffic with source port 5222. The useful friction is that the terrain keeps changing, from physical USB labels to line-oriented `grep` to router firewall policy, so the root claim has a real source-to-sink path instead of one dramatic blob. I would still want exact firmware and patch notes before generalizing beyond MR9600 and MX4200.