Allow authenticated LoRa admins to read paged ACLs

docs/cli_command_availability.md

@@ -177,7 +177,7 @@ should use command `0x42`. See [Companion radio binary protocol](companion_proto
 | Routing | [`get/set outpath`](halo_keymind_settings.md#direct-path-overrides) | Repeater remote-client context | Yes | Yes | Yes |
 | Routing | [`get/set altpath`](halo_keymind_settings.md#direct-path-overrides) | Repeater remote-client context | Yes | Yes | Yes |
 | ACL | [`setperm <pubkey> <permissions>`](cli_commands.md#add-update-or-remove-permissions-for-a-companion) | Repeater, room server, or sensor | Yes | Yes | Yes |
-| ACL | [`get acl`](cli_commands.md#view-the-current-acl) | Local connection | Local | Local | Local |
+| ACL | [`get acl [page]`](cli_commands.md#view-the-current-acl) | Repeater, room server, or sensor; admin over LoRa | Yes | Yes | Yes |
 | ACL | [`get/set allow.read.only`](cli_commands.md#view-or-change-this-room-servers-read-only-flag) | Room server | Yes | Yes | No |
 | Regions | [`region load`](cli_commands.md#bulk-load-region-lists); [`region save`](cli_commands.md#save-any-changes-to-regions-made-since-reboot) | Role with region storage | Yes | Yes | Yes |
 | Regions | [`region allowf`](cli_commands.md#allow-a-region); [`region denyf`](cli_commands.md#block-a-region) | Role with region storage | Yes | Yes | Yes |
@@ -344,7 +344,7 @@ should use command `0x42`. See [Companion radio binary protocol](companion_proto
 | Routing | [`get/set outpath`](halo_keymind_settings.md#direct-path-overrides) | Repeater remote-client context | Yes | Yes | Yes | Yes | Yes |
 | Routing | [`get/set altpath`](halo_keymind_settings.md#direct-path-overrides) | Repeater remote-client context | Yes | Yes | Yes | Yes | Yes |
 | ACL | [`setperm <pubkey> <permissions>`](cli_commands.md#add-update-or-remove-permissions-for-a-companion) | Repeater, room server, or sensor | Yes | Yes | Yes | Yes | Yes |
-| ACL | [`get acl`](cli_commands.md#view-the-current-acl) | Local connection | Local | Local | Local | Local | Local |
+| ACL | [`get acl [page]`](cli_commands.md#view-the-current-acl) | Repeater, room server, or sensor; admin over LoRa | Yes | Yes | Yes | Yes | Yes |
 | ACL | [`get/set allow.read.only`](cli_commands.md#view-or-change-this-room-servers-read-only-flag) | Room server | Yes | Yes | No | Yes | Yes |
 | Regions | [`region load`](cli_commands.md#bulk-load-region-lists); [`region save`](cli_commands.md#save-any-changes-to-regions-made-since-reboot) | Role with region storage | Yes | Yes | Yes | Yes | Yes |
 | Regions | [`region allowf`](cli_commands.md#allow-a-region); [`region denyf`](cli_commands.md#block-a-region) | Role with region storage | Yes | Yes | Yes | Yes | Yes |

docs/cli_commands.md

@@ -2900,11 +2900,27 @@ eviction like administrators.
 ---
 
 #### View the current ACL
-**Usage:** 
-- `get acl`
 
-**Local connection only:** USB, direct network CLI, or Companion binary
-command `0x42` where the role supports the command; unavailable over LoRa.
+**Usage:**
+
+- `get acl` - full listing locally; first page over LoRa
+- `get acl <page>` - a numbered page, starting at 1, locally or over LoRa
+
+Available on repeaters, room servers, and sensors. Over LoRa, an authenticated
+admin session is required; guests, read-only/read-write clients, and delegated
+region/filter managers cannot read the ACL.
+
+Each page starts with `ACL <page>/<pages>` and contains up to two entries.
+Each entry is a two-digit hexadecimal permission byte followed by the full
+64-character public key. For example, use `get acl 2` for the second page.
+An empty list returns `ACL: empty`. Deleted/guest entries with permission byte
+`00` are omitted, matching the local listing. Pages reflect the current live
+ACL, so entries can move between pages if permissions or clients change.
+
+Bare `get acl` keeps the full streamed listing on USB and direct network CLI,
+or via Companion binary command `0x42` where the role supports the command.
+The listing contains public keys and permissions, not passwords or shared
+secrets, and does not change the ACL.
 
 ---