From 3dfc80b7828796c983c019387b2b3f7d0d9b46c8 Mon Sep 17 00:00:00 2001
From: admin_rb <admin_rb@desq-gaming.lan>
Date: Tue, 22 Sep 2026 19:23:17 +0200
Subject: [PATCH] aim-web2.1.0rc9

---
 ...ectory.sh.example => .aim-core-deploy.lock |    0
 .gitignore                                    |    4 +-
 README.md                                     |  128 +--
 aim.yml                                       |   12 -
 deploy/README.md                              |  205 ++++
 deploy/deploy.py                              |  593 ++++++++++
 .../desq_gaming/.aim.lock                     |    0
 .../group_vars/linux/.ssh/svc_ansible         |    8 -
 .../group_vars/linux/.ssh/svc_ansible.pub     |    1 -
 .../group_vars/linux/.ssh/svc_bf-ansible      |    8 +
 .../group_vars/linux/.ssh/svc_bf-ansible.pub  |    1 +
 .../desq_gaming/group_vars/linux/main.yml     |    4 +-
 .../desq_gaming/group_vars/windows/main.yml   |    2 +-
 .../DESKTOP-ROBERT.desq-gaming.lan/main.yml   |    3 +
 .../desq_gaming/hosts.aim-session.bak.yml     |   97 +-
 inventories/desq_gaming/hosts.yml             |   10 +-
 playbooks/aim_catalog.yml                     | 1012 +++++++++++++++++
 playbooks/checkmk_cleanup.yml                 |   64 --
 playbooks/checkmk_cleanup_scripts.yml         |   75 ++
 playbooks/checkmk_deploy.yml                  |   10 -
 playbooks/checkmk_install_agent.yml           |  136 +++
 playbooks/checkmk_read_windows_config.yml     |  115 ++
 playbooks/checkmk_update_config.yml           |    8 -
 playbooks/checkmk_update_scripts.yml          |    8 -
 playbooks/checkmk_update_scripts_config.yml   |  135 +++
 .../bluuunit/sophos_apply_customer.yml        |   96 ++
 .../formicon/sophos_apply_customer.yml        |   91 ++
 .../gebhardt_stahl/sophos_apply_customer.yml  |   91 ++
 .../sophos_apply_customer.yml                 |   92 ++
 .../sophos_apply_customer.yml                 |   93 ++
 playbooks/debug_detect_host_roles.yml         |   62 +
 playbooks/debug_disk_usage.yml                |   38 -
 playbooks/debug_ping.yml                      |   13 -
 playbooks/debug_server_role_selection.yml     |   87 --
 playbooks/debug_show_disk_usage.yml           |  185 +++
 playbooks/debug_test_connection.yml           |   61 +
 .../__pycache__/aim_reports.cpython-313.pyc   |  Bin 0 -> 21234 bytes
 playbooks/filter_plugins/aim_reports.py       |  398 +++++++
 playbooks/maintenance_backup_event_log.yml    |   74 --
 playbooks/maintenance_export_event_logs.yml   |   37 +
 playbooks/maintenance_patch_os.yml            |   99 +-
 playbooks/maintenance_reboot.yml              |   15 -
 playbooks/maintenance_reboot_hosts.yml        |   68 ++
 .../maintenance_start_stopped_services.yml    |  115 +-
 playbooks/pfsense_apply_baseline.yml          |   63 +
 playbooks/schemas/checkmk_agent_config_v1.yml |   77 ++
 playbooks/schemas/checkmk_agent_state_v1.yml  |   74 ++
 playbooks/schemas/checkmk_user_config_v1.yml  |   40 +
 playbooks/schemas/event_log_export_v1.yml     |   30 +
 playbooks/schemas/filesystem_usage_v1.yml     |   66 ++
 playbooks/schemas/host_capabilities_v1.yml    |   22 +
 .../schemas/managed_cleanup_preview_v1.yml    |   43 +
 playbooks/schemas/patch_summary_v1.yml        |  190 ++++
 .../schemas/service_start_summary_v1.yml      |  113 ++
 playbooks/sophos_apply_baseline.yml           |   63 +
 requirements-controller.txt                   |    2 +
 requirements.yml                              |   10 +
 roles/checkmk_agent/README.md                 |   23 +
 roles/checkmk_agent/defaults/main.yml         |   16 +-
 roles/checkmk_agent/files/README.md           |    6 +-
 roles/checkmk_agent/handlers/main.yml         |   55 -
 roles/checkmk_agent/meta/main.yml             |    6 -
 roles/checkmk_agent/tasks/debian.yml          |   11 -
 roles/checkmk_agent/tasks/linux_debian.yml    |   25 +
 roles/checkmk_agent/tasks/linux_redhat.yml    |   25 +
 roles/checkmk_agent/tasks/main.yml            |   23 +-
 roles/checkmk_agent/tasks/redhat.yml          |   12 -
 roles/checkmk_agent/tasks/windows.yml         |   31 +-
 roles/checkmk_agent_config/meta/main.yml      |    6 -
 roles/checkmk_agent_config/tasks/main.yml     |   20 -
 .../templates/windows_check_mk.user.yml.j2    |  130 ---
 roles/checkmk_cleanup_scripts/README.md       |   36 +
 .../checkmk_cleanup_scripts/defaults/main.yml |   22 +
 roles/checkmk_cleanup_scripts/tasks/linux.yml |   15 +
 roles/checkmk_cleanup_scripts/tasks/main.yml  |   42 +
 .../checkmk_cleanup_scripts/tasks/windows.yml |   36 +
 roles/checkmk_configure_agent/README.md       |   33 +
 .../defaults/main.yml                         |    5 +-
 roles/checkmk_configure_agent/tasks/main.yml  |  196 ++++
 .../templates/windows_plugins_section.yml.j2  |   72 ++
 roles/checkmk_deploy_scripts/README.md        |   48 +
 .../checkmk_deploy_scripts/defaults/main.yml  |   32 +
 roles/checkmk_deploy_scripts/tasks/linux.yml  |   40 +
 roles/checkmk_deploy_scripts/tasks/main.yml   |   10 +
 .../tasks/preflight.yml                       |   57 +
 .../checkmk_deploy_scripts/tasks/windows.yml  |   68 ++
 .../templates/unifi.cfg.j2                    |   13 +
 roles/checkmk_manage_service/README.md        |   23 +
 .../checkmk_manage_service/defaults/main.yml  |    9 +
 .../checkmk_manage_service/handlers/main.yml  |    9 +
 roles/checkmk_manage_service/tasks/linux.yml  |   42 +
 roles/checkmk_manage_service/tasks/main.yml   |    8 +
 .../checkmk_manage_service/tasks/windows.yml  |   24 +
 roles/checkmk_report/README.md                |    9 +
 roles/checkmk_report/tasks/main.yml           |   79 ++
 roles/checkmk_script_plan/README.md           |   27 +
 roles/checkmk_script_plan/defaults/main.yml   |   21 +
 roles/checkmk_script_plan/tasks/main.yml      |   27 +
 roles/checkmk_script_plan/vars/main.yml       |   49 +
 roles/checkmk_scripts/defaults/main.yml       |   12 -
 roles/checkmk_scripts/files/README.md         |   16 -
 .../local/veeam_o365_status.ps1.example       |    0
 .../local/veeam_surebackup_status.ps1.example |    0
 .../Windows/local/windows-backup.ps1.example  |    0
 roles/checkmk_scripts/meta/main.yml           |    6 -
 roles/checkmk_scripts/tasks/linux.yml         |   36 -
 roles/checkmk_scripts/tasks/main.yml          |    8 -
 roles/checkmk_scripts/tasks/windows.yml       |   47 -
 roles/checkmk_windows_acl/README.md           |   16 +
 roles/checkmk_windows_acl/defaults/main.yml   |   15 +
 roles/checkmk_windows_acl/tasks/main.yml      |   30 +
 roles/maintenance_export_event_logs/README.md |   23 +
 .../defaults/main.yml                         |    9 +
 .../tasks/main.yml                            |   63 +
 roles/maintenance_patch_os/README.md          |   48 +
 roles/maintenance_patch_os/defaults/main.yml  |   16 +
 .../tasks/linux_debian.yml                    |  144 +++
 .../tasks/linux_redhat.yml                    |  167 +++
 roles/maintenance_patch_os/tasks/main.yml     |   33 +
 roles/maintenance_patch_os/tasks/windows.yml  |  162 +++
 .../tasks/windows_cycle.yml                   |  114 ++
 .../tasks/windows_update_one.yml              |   87 ++
 .../tasks/windows_wave.yml                    |  124 ++
 roles/maintenance_reboot_hosts/README.md      |   12 +
 .../defaults/main.yml                         |    6 +
 roles/maintenance_reboot_hosts/tasks/main.yml |   26 +
 .../README.md                                 |   19 +
 .../defaults/main.yml                         |    5 +
 .../tasks/main.yml                            |   55 +
 roles/pfsense_apply_baseline/README.md        |    3 +
 roles/pfsense_apply_baseline/tasks/main.yml   |  153 +++
 roles/pfsense_install_prerequisites/README.md |    3 +
 .../tasks/main.yml                            |    7 +
 roles/server_role_selection/defaults/main.yml |   12 -
 roles/server_role_selection/meta/main.yml     |    6 -
 roles/server_role_selection/tasks/main.yml    |  111 --
 roles/sophos_apply_baseline/README.md         |    3 +
 roles/sophos_apply_baseline/tasks/main.yml    |  500 ++++++++
 roles/sophos_customer_bluuunit/README.md      |    3 +
 roles/sophos_customer_bluuunit/tasks/main.yml |  527 +++++++++
 roles/sophos_customer_formicon/README.md      |    3 +
 roles/sophos_customer_formicon/tasks/main.yml |  231 ++++
 .../sophos_customer_gebhardt_stahl/README.md  |    3 +
 .../tasks/main.yml                            |  195 ++++
 .../README.md                                 |    3 +
 .../tasks/main.yml                            |  268 +++++
 .../README.md                                 |    3 +
 .../tasks/main.yml                            |  407 +++++++
 roles/system_detect_roles/README.md           |   31 +
 roles/system_detect_roles/defaults/main.yml   |   17 +
 roles/system_detect_roles/tasks/main.yml      |  132 +++
 scripts/AIM-WinRM-OneTime.ps1                 |  198 ++++
 scripts/addons/webgui/.aim-web-managed        |    1 +
 scripts/addons/webgui/.credentials            |    1 +
 scripts/addons/webgui/ADDON-INSTALLATION.md   |  688 +++++++++++
 scripts/addons/webgui/AGENTS.md               |   97 ++
 scripts/addons/webgui/CHANGELOG.md            |  556 +++++++++
 scripts/addons/webgui/MANIFEST.sha256         |  160 +++
 scripts/addons/webgui/README.md               |   84 ++
 scripts/addons/webgui/constraints.txt         |   25 +
 scripts/addons/webgui/deploy/deploy.py        |  890 +++++++++++++++
 scripts/addons/webgui/deploy/fetch_assets.py  |   78 ++
 .../addons/webgui/deploy/nginx.example.conf   |   12 +
 .../webgui/deploy/profiles/direct-npm.toml    |   65 ++
 .../addons/webgui/deploy/webgui.example.toml  |   75 ++
 scripts/addons/webgui/docs/API.md             |   31 +
 scripts/addons/webgui/docs/ARCHITECTURE.md    |   17 +
 .../addons/webgui/docs/CONTROLLER-PILOT.md    |   37 +
 scripts/addons/webgui/docs/CORE-3.1-REVIEW.md |   90 ++
 .../webgui/docs/CORE-3.2.1RC1-REVIEW.md       |   20 +
 .../webgui/docs/CORE-3.2.1RC2-REVIEW.md       |   16 +
 scripts/addons/webgui/docs/CORE-3.3-REVIEW.md |   15 +
 .../webgui/docs/CORE-3.3.0RC3-REVIEW.md       |   84 ++
 .../webgui/docs/CORE-3.3.0RC8-REVIEW.md       |   50 +
 scripts/addons/webgui/docs/CREDENTIALS.md     |   66 ++
 scripts/addons/webgui/docs/DEPLOYMENT.md      |  131 +++
 scripts/addons/webgui/docs/EXECUTION.md       |   21 +
 scripts/addons/webgui/docs/JOURNAL.md         |   43 +
 scripts/addons/webgui/docs/MIGRATION-3.1.md   |  105 ++
 scripts/addons/webgui/docs/PATCH-WAVES.md     |   72 ++
 .../addons/webgui/docs/PERMISSIONS-ROLLOUT.md |   42 +
 .../addons/webgui/docs/PRODUCT-COMPARISON.md  |   96 ++
 .../webgui/docs/READ-ONLY-EXPERIENCE.md       |   46 +
 scripts/addons/webgui/docs/REPORTS.md         |   62 +
 scripts/addons/webgui/docs/ROADMAP.md         |    7 +
 scripts/addons/webgui/docs/RUN-COMFORT.md     |   43 +
 scripts/addons/webgui/docs/SECURITY.md        |   23 +
 scripts/addons/webgui/docs/VERIFICATION.md    |   57 +
 .../webgui/docs/verification-results.json     |   64 ++
 scripts/addons/webgui/pyproject.toml          |   40 +
 scripts/addons/webgui/requirements-test.txt   |    3 +
 .../addons/webgui/src/aim_webgui/__init__.py  |    4 +
 .../addons/webgui/src/aim_webgui/__main__.py  |    2 +
 .../addons/webgui/src/aim_webgui/activity.py  |  193 ++++
 .../src/aim_webgui/adapters/__init__.py       |    0
 .../webgui/src/aim_webgui/adapters/core_v1.py |  160 +++
 scripts/addons/webgui/src/aim_webgui/app.py   |  406 +++++++
 .../addons/webgui/src/aim_webgui/assets.py    |   19 +
 .../webgui/src/aim_webgui/auth/__init__.py    |    0
 .../webgui/src/aim_webgui/auth/service.py     |  277 +++++
 scripts/addons/webgui/src/aim_webgui/cli.py   |  199 ++++
 .../addons/webgui/src/aim_webgui/config.py    |  221 ++++
 .../addons/webgui/src/aim_webgui/console.py   |  175 +++
 .../webgui/src/aim_webgui/core/__init__.py    |    1 +
 .../webgui/src/aim_webgui/core/client.py      |   66 ++
 .../webgui/src/aim_webgui/core/executor.py    |  119 ++
 .../webgui/src/aim_webgui/core/jsonio.py      |   26 +
 .../webgui/src/aim_webgui/core/limits.py      |   11 +
 .../webgui/src/aim_webgui/core/process.py     |  139 +++
 .../webgui/src/aim_webgui/core/protocol.py    |  279 +++++
 .../webgui/src/aim_webgui/core/reports.py     |  171 +++
 .../src/aim_webgui/credentials/__init__.py    |    1 +
 .../aim_webgui/credentials/presentation.py    |   77 ++
 .../src/aim_webgui/credentials/service.py     |   67 ++
 .../webgui/src/aim_webgui/credentials/wire.py |   78 ++
 .../webgui/src/aim_webgui/db/__init__.py      |    0
 .../aim_webgui/db/migrations/0001_initial.sql |   27 +
 .../db/migrations/0002_workflows.sql          |   54 +
 .../db/migrations/0003_credentials.sql        |    3 +
 .../aim_webgui/db/migrations/0004_core_v1.sql |   19 +
 .../db/migrations/0005_job_evidence.sql       |   36 +
 .../addons/webgui/src/aim_webgui/db/store.py  |  149 +++
 .../webgui/src/aim_webgui/diagnostics.py      |   45 +
 .../addons/webgui/src/aim_webgui/errors.py    |    5 +
 .../webgui/src/aim_webgui/evidence_views.py   |  102 ++
 .../addons/webgui/src/aim_webgui/explorer.py  |  130 +++
 .../addons/webgui/src/aim_webgui/journal.py   |  235 ++++
 scripts/addons/webgui/src/aim_webgui/names.py |   10 +
 .../webgui/src/aim_webgui/patch_view.py       |   90 ++
 .../webgui/src/aim_webgui/read_views.py       |   68 ++
 .../addons/webgui/src/aim_webgui/reports.py   |  197 ++++
 .../webgui/src/aim_webgui/routes/__init__.py  |    0
 .../webgui/src/aim_webgui/routes/workflows.py |  280 +++++
 .../addons/webgui/src/aim_webgui/security.py  |   61 +
 .../webgui/src/aim_webgui/static/css/aim.css  |  200 ++++
 .../static/css/bootstrap-overrides.css        |   65 ++
 .../src/aim_webgui/static/css/credentials.css |   88 ++
 .../src/aim_webgui/static/css/evidence.css    |   49 +
 .../src/aim_webgui/static/css/experience.css  |  162 +++
 .../src/aim_webgui/static/css/tokens.css      |   92 ++
 .../webgui/src/aim_webgui/static/js/aim.js    |  227 ++++
 .../src/aim_webgui/static/js/credentials.js   |  348 ++++++
 .../src/aim_webgui/static/js/evidence.js      |  123 ++
 .../src/aim_webgui/static/js/experience.js    |   47 +
 .../webgui/src/aim_webgui/static/js/theme.js  |   45 +
 .../aim_webgui/static/vendor/THIRD-PARTY.txt  |   38 +
 .../static/vendor/bootstrap.min.css           |    6 +
 .../src/aim_webgui/static/vendor/htmx.min.js  |    1 +
 .../aim_webgui/templates/layouts/base.html    |   59 +
 .../aim_webgui/templates/pages/activity.html  |   23 +
 .../src/aim_webgui/templates/pages/audit.html |    5 +
 .../templates/pages/credentials.html          |    7 +
 .../aim_webgui/templates/pages/customers.html |    3 +
 .../src/aim_webgui/templates/pages/error.html |    1 +
 .../aim_webgui/templates/pages/explorer.html  |   27 +
 .../src/aim_webgui/templates/pages/hosts.html |    9 +
 .../aim_webgui/templates/pages/insights.html  |   15 +
 .../src/aim_webgui/templates/pages/job.html   |    7 +
 .../src/aim_webgui/templates/pages/jobs.html  |    8 +
 .../src/aim_webgui/templates/pages/login.html |   12 +
 .../aim_webgui/templates/pages/overview.html  |    9 +
 .../aim_webgui/templates/pages/password.html  |    8 +
 .../src/aim_webgui/templates/pages/plan.html  |   98 ++
 .../templates/pages/plan_detail.html          |    7 +
 .../src/aim_webgui/templates/pages/plans.html |    7 +
 .../aim_webgui/templates/pages/playbooks.html |    3 +
 .../aim_webgui/templates/pages/preflight.html |    1 +
 .../aim_webgui/templates/pages/progress.html  |    7 +
 .../aim_webgui/templates/pages/report.html    |   31 +
 .../src/aim_webgui/templates/pages/setup.html |   13 +
 .../aim_webgui/templates/pages/system.html    |    5 +
 .../src/aim_webgui/templates/pages/users.html |   10 +
 .../templates/partials/activity_macros.html   |   35 +
 .../templates/partials/attention.html         |    8 +
 .../templates/partials/credential_dialog.html |    4 +
 .../templates/partials/credential_panel.html  |   48 +
 .../templates/partials/customers.html         |    4 +
 .../aim_webgui/templates/partials/error.html  |    1 +
 .../templates/partials/grant_fields.html      |   23 +
 .../aim_webgui/templates/partials/hosts.html  |    5 +
 .../aim_webgui/templates/partials/job.html    |   15 +
 .../templates/partials/navigation.html        |   17 +
 .../templates/partials/patch_report.html      |   14 +
 .../templates/partials/preflight.html         |   25 +
 .../templates/partials/progress.html          |   21 +
 .../templates/partials/reports.html           |    9 +
 .../addons/webgui/src/aim_webgui/worker.py    |  340 ++++++
 .../addons/webgui/src/aim_webgui/workflows.py |  448 ++++++++
 .../addons/webgui/tests/benchmark_journal.py  |   46 +
 .../webgui/tests/benchmark_read_history.py    |   65 ++
 .../webgui/tests/browser_credentials_qa.py    |  200 ++++
 .../webgui/tests/browser_evidence_qa.py       |  136 +++
 .../addons/webgui/tests/browser_patch_qa.py   |  137 +++
 scripts/addons/webgui/tests/browser_qa.py     |  191 ++++
 scripts/addons/webgui/tests/conftest.py       |   57 +
 .../addons/webgui/tests/evidence_fixtures.py  |   68 ++
 .../tests/fixtures/patch-summary-rc1.json     |  214 ++++
 scripts/addons/webgui/tests/patch_fixtures.py |   24 +
 .../addons/webgui/tests/run_release_tests.py  |   53 +
 scripts/addons/webgui/tests/test_auth.py      |  178 +++
 .../addons/webgui/tests/test_core_contract.py |  134 +++
 .../webgui/tests/test_core_execution.py       |   76 ++
 .../webgui/tests/test_core_rc8_patch.py       |  236 ++++
 .../addons/webgui/tests/test_core_reports.py  |   39 +
 .../addons/webgui/tests/test_credential_ux.py |  289 +++++
 .../addons/webgui/tests/test_deployment_v2.py |  131 +++
 .../addons/webgui/tests/test_executor_unix.py |   75 ++
 .../addons/webgui/tests/test_journal_v5.py    |  138 +++
 .../addons/webgui/tests/test_migration_v4.py  |   41 +
 .../addons/webgui/tests/test_migration_v5.py  |   30 +
 .../webgui/tests/test_read_experience.py      |  228 ++++
 .../webgui/tests/test_report_transport.py     |   88 ++
 .../addons/webgui/tests/test_reports_v33.py   |  130 +++
 scripts/addons/webgui/tests/test_routes_v2.py |   91 ++
 scripts/addons/webgui/tests/test_transport.py |   84 ++
 scripts/addons/webgui/tests/test_worker_v2.py |   27 +
 .../addons/webgui/tests/test_workflows_v2.py  |  104 ++
 scripts/aim.yml                               |   33 +
 scripts/aimctl.py                             |    8 +
 scripts/config/webgui.toml                    |   75 ++
 scripts/config/webgui.toml.valid              |   54 +
 scripts/docs/ADDON_AGENTS.md                  |  105 ++
 scripts/docs/ADDON_API.md                     |  153 +++
 scripts/docs/ADDON_SUPPORT.md                 |   49 +
 scripts/docs/AGENTS.md                        |   99 ++
 scripts/docs/CHANGELOG.md                     |  268 +++++
 scripts/docs/CHECKMK.md                       |  247 ++++
 scripts/docs/DETAILED_PROGRESS.md             |  284 +++++
 scripts/docs/EXECUTOR_STAGING.md              |  176 +++
 scripts/docs/INSTALLATION.md                  |  484 ++++++++
 scripts/docs/INVENTORY_HIERARCHY.md           |   69 ++
 scripts/docs/OPERATION_RESULTS.md             |  276 +++++
 scripts/docs/PLAYBOOKS.md                     |   83 ++
 scripts/docs/README.md                        |   34 +
 scripts/docs/RELEASE_HANDOFF.md               |   91 ++
 scripts/docs/RELEASE_NOTES.md                 |   72 ++
 scripts/docs/SANITY.md                        |  105 ++
 scripts/docs/TARGET_OUTCOMES.md               |  108 ++
 scripts/docs/VALIDATION.md                    |   64 ++
 scripts/docs/addon-support-v1.json            |  135 +++
 scripts/pyproject.toml                        |    6 +-
 scripts/src/aim/__init__.py                   |    2 +-
 scripts/src/aim/__main__.py                   |    2 +-
 .../aim/__pycache__/__init__.cpython-313.pyc  |  Bin 163 -> 0 bytes
 .../aim/__pycache__/__main__.cpython-313.pyc  |  Bin 2629 -> 0 bytes
 .../src/aim/__pycache__/auth.cpython-313.pyc  |  Bin 2050 -> 0 bytes
 .../aim/__pycache__/config.cpython-313.pyc    |  Bin 9174 -> 0 bytes
 .../__pycache__/exceptions.cpython-313.pyc    |  Bin 2358 -> 0 bytes
 .../aim/__pycache__/external.cpython-313.pyc  |  Bin 5730 -> 0 bytes
 .../aim/__pycache__/locking.cpython-313.pyc   |  Bin 4953 -> 0 bytes
 .../__pycache__/permissions.cpython-313.pyc   |  Bin 1606 -> 0 bytes
 .../aim/__pycache__/structure.cpython-313.pyc |  Bin 10677 -> 0 bytes
 .../aim/__pycache__/templates.cpython-313.pyc |  Bin 2219 -> 0 bytes
 .../__pycache__/__init__.cpython-313.pyc      |  Bin 144 -> 0 bytes
 .../__pycache__/session.cpython-313.pyc       |  Bin 3744 -> 0 bytes
 scripts/src/aim/backup/session.py             |   14 +-
 scripts/src/aim/config.py                     |  131 ++-
 scripts/src/aim/ctl.py                        |  135 +++
 .../__pycache__/__init__.cpython-313.pyc      |  Bin 147 -> 0 bytes
 .../__pycache__/manager.cpython-313.pyc       |  Bin 20499 -> 0 bytes
 scripts/src/aim/customers/manager.py          |  108 +-
 scripts/src/aim/exceptions.py                 |   12 +
 scripts/src/aim/integrations/__init__.py      |    1 +
 scripts/src/aim/integrations/ansible.cfg      |    3 +
 .../aim/integrations/callbacks/__init__.py    |    1 +
 .../integrations/callbacks/aim_safe_events.py |  359 ++++++
 scripts/src/aim/integrations/event_policy.py  |   90 ++
 scripts/src/aim/integrations/output_policy.py |  136 +++
 .../__pycache__/__init__.cpython-313.pyc      |  Bin 147 -> 0 bytes
 .../__pycache__/hosts.cpython-313.pyc         |  Bin 14499 -> 0 bytes
 .../__pycache__/loader.cpython-313.pyc        |  Bin 4773 -> 0 bytes
 .../__pycache__/model.cpython-313.pyc         |  Bin 3205 -> 0 bytes
 .../__pycache__/validator.cpython-313.pyc     |  Bin 3607 -> 0 bytes
 .../__pycache__/writer.cpython-313.pyc        |  Bin 3506 -> 0 bytes
 scripts/src/aim/inventory/hierarchy.py        |   69 ++
 scripts/src/aim/inventory/writer.py           |    4 +-
 scripts/src/aim/locking.py                    |  107 +-
 .../__pycache__/__init__.cpython-313.pyc      |  Bin 201 -> 0 bytes
 .../__pycache__/checkmk.cpython-313.pyc       |  Bin 8108 -> 0 bytes
 .../__pycache__/repository.cpython-313.pyc    |  Bin 5183 -> 0 bytes
 scripts/src/aim/permissions.py                |  103 +-
 .../__pycache__/__init__.cpython-313.pyc      |  Bin 147 -> 0 bytes
 .../__pycache__/manager.cpython-313.pyc       |  Bin 6262 -> 0 bytes
 scripts/src/aim/playbooks/catalog.py          |  224 ++++
 scripts/src/aim/playbooks/manager.py          |  286 +++--
 scripts/src/aim/playbooks/planning.py         |   33 +
 scripts/src/aim/runtime/__init__.py           |    1 +
 scripts/src/aim/runtime/agent.py              |   81 ++
 scripts/src/aim/runtime/ansible.py            |  129 +++
 scripts/src/aim/runtime/events.py             |  235 ++++
 scripts/src/aim/runtime/outputs.py            |   97 ++
 scripts/src/aim/runtime/process.py            |   96 ++
 scripts/src/aim/runtime/secrets.py            |  120 ++
 scripts/src/aim/runtime/staging.py            |  270 +++++
 scripts/src/aim/services/__init__.py          |    1 +
 scripts/src/aim/services/v1/__init__.py       |   16 +
 scripts/src/aim/services/v1/credentials.py    |   95 ++
 scripts/src/aim/services/v1/models.py         |  129 +++
 scripts/src/aim/services/v1/service.py        |  447 ++++++++
 .../__pycache__/__init__.cpython-313.pyc      |  Bin 197 -> 0 bytes
 .../sophos/__pycache__/config.cpython-313.pyc |  Bin 8218 -> 0 bytes
 scripts/src/aim/sophos/config.py              |    5 +-
 .../ssh/__pycache__/__init__.cpython-313.pyc  |  Bin 141 -> 0 bytes
 .../aim/ssh/__pycache__/keys.cpython-313.pyc  |  Bin 14117 -> 0 bytes
 scripts/src/aim/ssh/keys.py                   |  111 +-
 scripts/src/aim/structure.py                  |  102 +-
 scripts/src/aim/templates.py                  |    1 +
 .../ui/__pycache__/__init__.cpython-313.pyc   |  Bin 140 -> 0 bytes
 .../aim/ui/__pycache__/access.cpython-313.pyc |  Bin 26873 -> 0 bytes
 .../administration.cpython-313.pyc            |  Bin 27362 -> 0 bytes
 .../aim/ui/__pycache__/app.cpython-313.pyc    |  Bin 22523 -> 0 bytes
 .../ui/__pycache__/components.cpython-313.pyc |  Bin 11765 -> 0 bytes
 .../ui/__pycache__/customers.cpython-313.pyc  |  Bin 16650 -> 0 bytes
 .../ui/__pycache__/execution.cpython-313.pyc  |  Bin 8081 -> 0 bytes
 .../aim/ui/__pycache__/hosts.cpython-313.pyc  |  Bin 19679 -> 0 bytes
 .../__pycache__/maintenance.cpython-313.pyc   |  Bin 7471 -> 0 bytes
 .../ui/__pycache__/playbooks.cpython-313.pyc  |  Bin 10993 -> 0 bytes
 .../ui/__pycache__/selection.cpython-313.pyc  |  Bin 5967 -> 0 bytes
 .../ui/__pycache__/targets.cpython-313.pyc    |  Bin 7294 -> 0 bytes
 scripts/src/aim/ui/access.py                  |  129 ++-
 scripts/src/aim/ui/administration.py          |   95 +-
 scripts/src/aim/ui/app.py                     |   32 +-
 scripts/src/aim/ui/components.py              |    2 +-
 scripts/src/aim/ui/hosts.py                   |   25 +-
 scripts/src/aim/ui/maintenance.py             |   49 +-
 scripts/src/aim/ui/playbooks.py               |  558 +++++++--
 scripts/src/aim/ui/selection.py               |   10 +
 scripts/src/aim/ui/targets.py                 |   27 +-
 scripts/src/aim/ui/vault_credentials.py       |   19 +
 .../__pycache__/__init__.cpython-313.pyc      |  Bin 147 -> 0 bytes
 .../__pycache__/viewer.cpython-313.pyc        |  Bin 1770 -> 0 bytes
 .../__pycache__/__init__.cpython-313.pyc      |  Bin 143 -> 0 bytes
 .../vault/__pycache__/manager.cpython-313.pyc |  Bin 12543 -> 0 bytes
 scripts/src/aim/vault/manager.py              |   69 +-
 scripts/src/aim/vault/session.py              |  122 ++
 .../__pycache__/__init__.cpython-313.pyc      |  Bin 190 -> 0 bytes
 .../winrm/__pycache__/manager.cpython-313.pyc |  Bin 32034 -> 0 bytes
 scripts/src/aim/winrm/manager.py              |   38 +-
 438 files changed, 31613 insertions(+), 1510 deletions(-)
 rename roles/checkmk_scripts/files/Linux/local/check_certificate_directory.sh.example => .aim-core-deploy.lock (100%)
 delete mode 100644 aim.yml
 create mode 100644 deploy/README.md
 create mode 100644 deploy/deploy.py
 rename roles/checkmk_scripts/files/Linux/local/check_unifi-controller.sh.example => inventories/desq_gaming/.aim.lock (100%)
 delete mode 100644 inventories/desq_gaming/group_vars/linux/.ssh/svc_ansible
 delete mode 100644 inventories/desq_gaming/group_vars/linux/.ssh/svc_ansible.pub
 create mode 100644 inventories/desq_gaming/group_vars/linux/.ssh/svc_bf-ansible
 create mode 100644 inventories/desq_gaming/group_vars/linux/.ssh/svc_bf-ansible.pub
 create mode 100644 inventories/desq_gaming/host_vars/DESKTOP-ROBERT.desq-gaming.lan/main.yml
 create mode 100644 playbooks/aim_catalog.yml
 delete mode 100644 playbooks/checkmk_cleanup.yml
 create mode 100644 playbooks/checkmk_cleanup_scripts.yml
 delete mode 100644 playbooks/checkmk_deploy.yml
 create mode 100644 playbooks/checkmk_install_agent.yml
 create mode 100644 playbooks/checkmk_read_windows_config.yml
 delete mode 100644 playbooks/checkmk_update_config.yml
 delete mode 100644 playbooks/checkmk_update_scripts.yml
 create mode 100644 playbooks/checkmk_update_scripts_config.yml
 create mode 100644 playbooks/customers/bluuunit/sophos_apply_customer.yml
 create mode 100644 playbooks/customers/formicon/sophos_apply_customer.yml
 create mode 100644 playbooks/customers/gebhardt_stahl/sophos_apply_customer.yml
 create mode 100644 playbooks/customers/hungeling_und_toechter/sophos_apply_customer.yml
 create mode 100644 playbooks/customers/koenig_holding_gmbh/sophos_apply_customer.yml
 create mode 100644 playbooks/debug_detect_host_roles.yml
 delete mode 100644 playbooks/debug_disk_usage.yml
 delete mode 100644 playbooks/debug_ping.yml
 delete mode 100644 playbooks/debug_server_role_selection.yml
 create mode 100644 playbooks/debug_show_disk_usage.yml
 create mode 100644 playbooks/debug_test_connection.yml
 create mode 100644 playbooks/filter_plugins/__pycache__/aim_reports.cpython-313.pyc
 create mode 100644 playbooks/filter_plugins/aim_reports.py
 delete mode 100644 playbooks/maintenance_backup_event_log.yml
 create mode 100644 playbooks/maintenance_export_event_logs.yml
 delete mode 100644 playbooks/maintenance_reboot.yml
 create mode 100644 playbooks/maintenance_reboot_hosts.yml
 create mode 100644 playbooks/pfsense_apply_baseline.yml
 create mode 100644 playbooks/schemas/checkmk_agent_config_v1.yml
 create mode 100644 playbooks/schemas/checkmk_agent_state_v1.yml
 create mode 100644 playbooks/schemas/checkmk_user_config_v1.yml
 create mode 100644 playbooks/schemas/event_log_export_v1.yml
 create mode 100644 playbooks/schemas/filesystem_usage_v1.yml
 create mode 100644 playbooks/schemas/host_capabilities_v1.yml
 create mode 100644 playbooks/schemas/managed_cleanup_preview_v1.yml
 create mode 100644 playbooks/schemas/patch_summary_v1.yml
 create mode 100644 playbooks/schemas/service_start_summary_v1.yml
 create mode 100644 playbooks/sophos_apply_baseline.yml
 create mode 100644 requirements-controller.txt
 create mode 100644 requirements.yml
 create mode 100644 roles/checkmk_agent/README.md
 delete mode 100644 roles/checkmk_agent/handlers/main.yml
 delete mode 100644 roles/checkmk_agent/meta/main.yml
 delete mode 100644 roles/checkmk_agent/tasks/debian.yml
 create mode 100644 roles/checkmk_agent/tasks/linux_debian.yml
 create mode 100644 roles/checkmk_agent/tasks/linux_redhat.yml
 delete mode 100644 roles/checkmk_agent/tasks/redhat.yml
 delete mode 100644 roles/checkmk_agent_config/meta/main.yml
 delete mode 100644 roles/checkmk_agent_config/tasks/main.yml
 delete mode 100644 roles/checkmk_agent_config/templates/windows_check_mk.user.yml.j2
 create mode 100644 roles/checkmk_cleanup_scripts/README.md
 create mode 100644 roles/checkmk_cleanup_scripts/defaults/main.yml
 create mode 100644 roles/checkmk_cleanup_scripts/tasks/linux.yml
 create mode 100644 roles/checkmk_cleanup_scripts/tasks/main.yml
 create mode 100644 roles/checkmk_cleanup_scripts/tasks/windows.yml
 create mode 100644 roles/checkmk_configure_agent/README.md
 rename roles/{checkmk_agent_config => checkmk_configure_agent}/defaults/main.yml (50%)
 create mode 100644 roles/checkmk_configure_agent/tasks/main.yml
 create mode 100644 roles/checkmk_configure_agent/templates/windows_plugins_section.yml.j2
 create mode 100644 roles/checkmk_deploy_scripts/README.md
 create mode 100644 roles/checkmk_deploy_scripts/defaults/main.yml
 create mode 100644 roles/checkmk_deploy_scripts/tasks/linux.yml
 create mode 100644 roles/checkmk_deploy_scripts/tasks/main.yml
 create mode 100644 roles/checkmk_deploy_scripts/tasks/preflight.yml
 create mode 100644 roles/checkmk_deploy_scripts/tasks/windows.yml
 create mode 100644 roles/checkmk_deploy_scripts/templates/unifi.cfg.j2
 create mode 100644 roles/checkmk_manage_service/README.md
 create mode 100644 roles/checkmk_manage_service/defaults/main.yml
 create mode 100644 roles/checkmk_manage_service/handlers/main.yml
 create mode 100644 roles/checkmk_manage_service/tasks/linux.yml
 create mode 100644 roles/checkmk_manage_service/tasks/main.yml
 create mode 100644 roles/checkmk_manage_service/tasks/windows.yml
 create mode 100644 roles/checkmk_report/README.md
 create mode 100644 roles/checkmk_report/tasks/main.yml
 create mode 100644 roles/checkmk_script_plan/README.md
 create mode 100644 roles/checkmk_script_plan/defaults/main.yml
 create mode 100644 roles/checkmk_script_plan/tasks/main.yml
 create mode 100644 roles/checkmk_script_plan/vars/main.yml
 delete mode 100644 roles/checkmk_scripts/defaults/main.yml
 delete mode 100644 roles/checkmk_scripts/files/README.md
 delete mode 100644 roles/checkmk_scripts/files/Windows/local/veeam_o365_status.ps1.example
 delete mode 100644 roles/checkmk_scripts/files/Windows/local/veeam_surebackup_status.ps1.example
 delete mode 100644 roles/checkmk_scripts/files/Windows/local/windows-backup.ps1.example
 delete mode 100644 roles/checkmk_scripts/meta/main.yml
 delete mode 100644 roles/checkmk_scripts/tasks/linux.yml
 delete mode 100644 roles/checkmk_scripts/tasks/main.yml
 delete mode 100644 roles/checkmk_scripts/tasks/windows.yml
 create mode 100644 roles/checkmk_windows_acl/README.md
 create mode 100644 roles/checkmk_windows_acl/defaults/main.yml
 create mode 100644 roles/checkmk_windows_acl/tasks/main.yml
 create mode 100644 roles/maintenance_export_event_logs/README.md
 create mode 100644 roles/maintenance_export_event_logs/defaults/main.yml
 create mode 100644 roles/maintenance_export_event_logs/tasks/main.yml
 create mode 100644 roles/maintenance_patch_os/README.md
 create mode 100644 roles/maintenance_patch_os/defaults/main.yml
 create mode 100644 roles/maintenance_patch_os/tasks/linux_debian.yml
 create mode 100644 roles/maintenance_patch_os/tasks/linux_redhat.yml
 create mode 100644 roles/maintenance_patch_os/tasks/main.yml
 create mode 100644 roles/maintenance_patch_os/tasks/windows.yml
 create mode 100644 roles/maintenance_patch_os/tasks/windows_cycle.yml
 create mode 100644 roles/maintenance_patch_os/tasks/windows_update_one.yml
 create mode 100644 roles/maintenance_patch_os/tasks/windows_wave.yml
 create mode 100644 roles/maintenance_reboot_hosts/README.md
 create mode 100644 roles/maintenance_reboot_hosts/defaults/main.yml
 create mode 100644 roles/maintenance_reboot_hosts/tasks/main.yml
 create mode 100644 roles/maintenance_start_stopped_services/README.md
 create mode 100644 roles/maintenance_start_stopped_services/defaults/main.yml
 create mode 100644 roles/maintenance_start_stopped_services/tasks/main.yml
 create mode 100644 roles/pfsense_apply_baseline/README.md
 create mode 100644 roles/pfsense_apply_baseline/tasks/main.yml
 create mode 100644 roles/pfsense_install_prerequisites/README.md
 create mode 100644 roles/pfsense_install_prerequisites/tasks/main.yml
 delete mode 100644 roles/server_role_selection/defaults/main.yml
 delete mode 100644 roles/server_role_selection/meta/main.yml
 delete mode 100644 roles/server_role_selection/tasks/main.yml
 create mode 100644 roles/sophos_apply_baseline/README.md
 create mode 100644 roles/sophos_apply_baseline/tasks/main.yml
 create mode 100644 roles/sophos_customer_bluuunit/README.md
 create mode 100644 roles/sophos_customer_bluuunit/tasks/main.yml
 create mode 100644 roles/sophos_customer_formicon/README.md
 create mode 100644 roles/sophos_customer_formicon/tasks/main.yml
 create mode 100644 roles/sophos_customer_gebhardt_stahl/README.md
 create mode 100644 roles/sophos_customer_gebhardt_stahl/tasks/main.yml
 create mode 100644 roles/sophos_customer_hungeling_und_toechter/README.md
 create mode 100644 roles/sophos_customer_hungeling_und_toechter/tasks/main.yml
 create mode 100644 roles/sophos_customer_koenig_holding_gmbh/README.md
 create mode 100644 roles/sophos_customer_koenig_holding_gmbh/tasks/main.yml
 create mode 100644 roles/system_detect_roles/README.md
 create mode 100644 roles/system_detect_roles/defaults/main.yml
 create mode 100644 roles/system_detect_roles/tasks/main.yml
 create mode 100644 scripts/AIM-WinRM-OneTime.ps1
 create mode 100644 scripts/addons/webgui/.aim-web-managed
 create mode 120000 scripts/addons/webgui/.credentials
 create mode 100644 scripts/addons/webgui/ADDON-INSTALLATION.md
 create mode 100644 scripts/addons/webgui/AGENTS.md
 create mode 100644 scripts/addons/webgui/CHANGELOG.md
 create mode 100644 scripts/addons/webgui/MANIFEST.sha256
 create mode 100644 scripts/addons/webgui/README.md
 create mode 100644 scripts/addons/webgui/constraints.txt
 create mode 100644 scripts/addons/webgui/deploy/deploy.py
 create mode 100644 scripts/addons/webgui/deploy/fetch_assets.py
 create mode 100644 scripts/addons/webgui/deploy/nginx.example.conf
 create mode 100644 scripts/addons/webgui/deploy/profiles/direct-npm.toml
 create mode 100644 scripts/addons/webgui/deploy/webgui.example.toml
 create mode 100644 scripts/addons/webgui/docs/API.md
 create mode 100644 scripts/addons/webgui/docs/ARCHITECTURE.md
 create mode 100644 scripts/addons/webgui/docs/CONTROLLER-PILOT.md
 create mode 100644 scripts/addons/webgui/docs/CORE-3.1-REVIEW.md
 create mode 100644 scripts/addons/webgui/docs/CORE-3.2.1RC1-REVIEW.md
 create mode 100644 scripts/addons/webgui/docs/CORE-3.2.1RC2-REVIEW.md
 create mode 100644 scripts/addons/webgui/docs/CORE-3.3-REVIEW.md
 create mode 100644 scripts/addons/webgui/docs/CORE-3.3.0RC3-REVIEW.md
 create mode 100644 scripts/addons/webgui/docs/CORE-3.3.0RC8-REVIEW.md
 create mode 100644 scripts/addons/webgui/docs/CREDENTIALS.md
 create mode 100644 scripts/addons/webgui/docs/DEPLOYMENT.md
 create mode 100644 scripts/addons/webgui/docs/EXECUTION.md
 create mode 100644 scripts/addons/webgui/docs/JOURNAL.md
 create mode 100644 scripts/addons/webgui/docs/MIGRATION-3.1.md
 create mode 100644 scripts/addons/webgui/docs/PATCH-WAVES.md
 create mode 100644 scripts/addons/webgui/docs/PERMISSIONS-ROLLOUT.md
 create mode 100644 scripts/addons/webgui/docs/PRODUCT-COMPARISON.md
 create mode 100644 scripts/addons/webgui/docs/READ-ONLY-EXPERIENCE.md
 create mode 100644 scripts/addons/webgui/docs/REPORTS.md
 create mode 100644 scripts/addons/webgui/docs/ROADMAP.md
 create mode 100644 scripts/addons/webgui/docs/RUN-COMFORT.md
 create mode 100644 scripts/addons/webgui/docs/SECURITY.md
 create mode 100644 scripts/addons/webgui/docs/VERIFICATION.md
 create mode 100644 scripts/addons/webgui/docs/verification-results.json
 create mode 100644 scripts/addons/webgui/pyproject.toml
 create mode 100644 scripts/addons/webgui/requirements-test.txt
 create mode 100644 scripts/addons/webgui/src/aim_webgui/__init__.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/__main__.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/activity.py
 rename roles/checkmk_scripts/files/Linux/local/unifi.cfg.example => scripts/addons/webgui/src/aim_webgui/adapters/__init__.py (100%)
 create mode 100644 scripts/addons/webgui/src/aim_webgui/adapters/core_v1.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/app.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/assets.py
 rename roles/checkmk_scripts/files/Windows/local/check-ping.ps1.example => scripts/addons/webgui/src/aim_webgui/auth/__init__.py (100%)
 create mode 100644 scripts/addons/webgui/src/aim_webgui/auth/service.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/cli.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/config.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/console.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/core/__init__.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/core/client.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/core/executor.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/core/jsonio.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/core/limits.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/core/process.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/core/protocol.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/core/reports.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/credentials/__init__.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/credentials/presentation.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/credentials/service.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/credentials/wire.py
 rename roles/checkmk_scripts/files/Windows/local/citrix_sessions_customized.ps1.example => scripts/addons/webgui/src/aim_webgui/db/__init__.py (100%)
 create mode 100644 scripts/addons/webgui/src/aim_webgui/db/migrations/0001_initial.sql
 create mode 100644 scripts/addons/webgui/src/aim_webgui/db/migrations/0002_workflows.sql
 create mode 100644 scripts/addons/webgui/src/aim_webgui/db/migrations/0003_credentials.sql
 create mode 100644 scripts/addons/webgui/src/aim_webgui/db/migrations/0004_core_v1.sql
 create mode 100644 scripts/addons/webgui/src/aim_webgui/db/migrations/0005_job_evidence.sql
 create mode 100644 scripts/addons/webgui/src/aim_webgui/db/store.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/diagnostics.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/errors.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/evidence_views.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/explorer.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/journal.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/names.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/patch_view.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/read_views.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/reports.py
 rename roles/checkmk_scripts/files/Windows/local/veeam_config_backup_status.ps1.example => scripts/addons/webgui/src/aim_webgui/routes/__init__.py (100%)
 create mode 100644 scripts/addons/webgui/src/aim_webgui/routes/workflows.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/security.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/static/css/aim.css
 create mode 100644 scripts/addons/webgui/src/aim_webgui/static/css/bootstrap-overrides.css
 create mode 100644 scripts/addons/webgui/src/aim_webgui/static/css/credentials.css
 create mode 100644 scripts/addons/webgui/src/aim_webgui/static/css/evidence.css
 create mode 100644 scripts/addons/webgui/src/aim_webgui/static/css/experience.css
 create mode 100644 scripts/addons/webgui/src/aim_webgui/static/css/tokens.css
 create mode 100644 scripts/addons/webgui/src/aim_webgui/static/js/aim.js
 create mode 100644 scripts/addons/webgui/src/aim_webgui/static/js/credentials.js
 create mode 100644 scripts/addons/webgui/src/aim_webgui/static/js/evidence.js
 create mode 100644 scripts/addons/webgui/src/aim_webgui/static/js/experience.js
 create mode 100644 scripts/addons/webgui/src/aim_webgui/static/js/theme.js
 create mode 100644 scripts/addons/webgui/src/aim_webgui/static/vendor/THIRD-PARTY.txt
 create mode 100644 scripts/addons/webgui/src/aim_webgui/static/vendor/bootstrap.min.css
 create mode 100644 scripts/addons/webgui/src/aim_webgui/static/vendor/htmx.min.js
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/layouts/base.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/pages/activity.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/pages/audit.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/pages/credentials.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/pages/customers.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/pages/error.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/pages/explorer.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/pages/hosts.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/pages/insights.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/pages/job.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/pages/jobs.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/pages/login.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/pages/overview.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/pages/password.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/pages/plan.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/pages/plan_detail.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/pages/plans.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/pages/playbooks.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/pages/preflight.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/pages/progress.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/pages/report.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/pages/setup.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/pages/system.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/pages/users.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/partials/activity_macros.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/partials/attention.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/partials/credential_dialog.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/partials/credential_panel.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/partials/customers.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/partials/error.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/partials/grant_fields.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/partials/hosts.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/partials/job.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/partials/navigation.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/partials/patch_report.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/partials/preflight.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/partials/progress.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/templates/partials/reports.html
 create mode 100644 scripts/addons/webgui/src/aim_webgui/worker.py
 create mode 100644 scripts/addons/webgui/src/aim_webgui/workflows.py
 create mode 100644 scripts/addons/webgui/tests/benchmark_journal.py
 create mode 100644 scripts/addons/webgui/tests/benchmark_read_history.py
 create mode 100644 scripts/addons/webgui/tests/browser_credentials_qa.py
 create mode 100644 scripts/addons/webgui/tests/browser_evidence_qa.py
 create mode 100644 scripts/addons/webgui/tests/browser_patch_qa.py
 create mode 100644 scripts/addons/webgui/tests/browser_qa.py
 create mode 100644 scripts/addons/webgui/tests/conftest.py
 create mode 100644 scripts/addons/webgui/tests/evidence_fixtures.py
 create mode 100644 scripts/addons/webgui/tests/fixtures/patch-summary-rc1.json
 create mode 100644 scripts/addons/webgui/tests/patch_fixtures.py
 create mode 100644 scripts/addons/webgui/tests/run_release_tests.py
 create mode 100644 scripts/addons/webgui/tests/test_auth.py
 create mode 100644 scripts/addons/webgui/tests/test_core_contract.py
 create mode 100644 scripts/addons/webgui/tests/test_core_execution.py
 create mode 100644 scripts/addons/webgui/tests/test_core_rc8_patch.py
 create mode 100644 scripts/addons/webgui/tests/test_core_reports.py
 create mode 100644 scripts/addons/webgui/tests/test_credential_ux.py
 create mode 100644 scripts/addons/webgui/tests/test_deployment_v2.py
 create mode 100644 scripts/addons/webgui/tests/test_executor_unix.py
 create mode 100644 scripts/addons/webgui/tests/test_journal_v5.py
 create mode 100644 scripts/addons/webgui/tests/test_migration_v4.py
 create mode 100644 scripts/addons/webgui/tests/test_migration_v5.py
 create mode 100644 scripts/addons/webgui/tests/test_read_experience.py
 create mode 100644 scripts/addons/webgui/tests/test_report_transport.py
 create mode 100644 scripts/addons/webgui/tests/test_reports_v33.py
 create mode 100644 scripts/addons/webgui/tests/test_routes_v2.py
 create mode 100644 scripts/addons/webgui/tests/test_transport.py
 create mode 100644 scripts/addons/webgui/tests/test_worker_v2.py
 create mode 100644 scripts/addons/webgui/tests/test_workflows_v2.py
 create mode 100644 scripts/aim.yml
 create mode 100644 scripts/aimctl.py
 create mode 100644 scripts/config/webgui.toml
 create mode 100644 scripts/config/webgui.toml.valid
 create mode 100644 scripts/docs/ADDON_AGENTS.md
 create mode 100644 scripts/docs/ADDON_API.md
 create mode 100644 scripts/docs/ADDON_SUPPORT.md
 create mode 100644 scripts/docs/AGENTS.md
 create mode 100644 scripts/docs/CHANGELOG.md
 create mode 100644 scripts/docs/CHECKMK.md
 create mode 100644 scripts/docs/DETAILED_PROGRESS.md
 create mode 100644 scripts/docs/EXECUTOR_STAGING.md
 create mode 100644 scripts/docs/INSTALLATION.md
 create mode 100644 scripts/docs/INVENTORY_HIERARCHY.md
 create mode 100644 scripts/docs/OPERATION_RESULTS.md
 create mode 100644 scripts/docs/PLAYBOOKS.md
 create mode 100644 scripts/docs/README.md
 create mode 100644 scripts/docs/RELEASE_HANDOFF.md
 create mode 100644 scripts/docs/RELEASE_NOTES.md
 create mode 100644 scripts/docs/SANITY.md
 create mode 100644 scripts/docs/TARGET_OUTCOMES.md
 create mode 100644 scripts/docs/VALIDATION.md
 create mode 100644 scripts/docs/addon-support-v1.json
 delete mode 100644 scripts/src/aim/__pycache__/__init__.cpython-313.pyc
 delete mode 100644 scripts/src/aim/__pycache__/__main__.cpython-313.pyc
 delete mode 100644 scripts/src/aim/__pycache__/auth.cpython-313.pyc
 delete mode 100644 scripts/src/aim/__pycache__/config.cpython-313.pyc
 delete mode 100644 scripts/src/aim/__pycache__/exceptions.cpython-313.pyc
 delete mode 100644 scripts/src/aim/__pycache__/external.cpython-313.pyc
 delete mode 100644 scripts/src/aim/__pycache__/locking.cpython-313.pyc
 delete mode 100644 scripts/src/aim/__pycache__/permissions.cpython-313.pyc
 delete mode 100644 scripts/src/aim/__pycache__/structure.cpython-313.pyc
 delete mode 100644 scripts/src/aim/__pycache__/templates.cpython-313.pyc
 delete mode 100644 scripts/src/aim/backup/__pycache__/__init__.cpython-313.pyc
 delete mode 100644 scripts/src/aim/backup/__pycache__/session.cpython-313.pyc
 create mode 100644 scripts/src/aim/ctl.py
 delete mode 100644 scripts/src/aim/customers/__pycache__/__init__.cpython-313.pyc
 delete mode 100644 scripts/src/aim/customers/__pycache__/manager.cpython-313.pyc
 create mode 100644 scripts/src/aim/integrations/__init__.py
 create mode 100644 scripts/src/aim/integrations/ansible.cfg
 create mode 100644 scripts/src/aim/integrations/callbacks/__init__.py
 create mode 100644 scripts/src/aim/integrations/callbacks/aim_safe_events.py
 create mode 100644 scripts/src/aim/integrations/event_policy.py
 create mode 100644 scripts/src/aim/integrations/output_policy.py
 delete mode 100644 scripts/src/aim/inventory/__pycache__/__init__.cpython-313.pyc
 delete mode 100644 scripts/src/aim/inventory/__pycache__/hosts.cpython-313.pyc
 delete mode 100644 scripts/src/aim/inventory/__pycache__/loader.cpython-313.pyc
 delete mode 100644 scripts/src/aim/inventory/__pycache__/model.cpython-313.pyc
 delete mode 100644 scripts/src/aim/inventory/__pycache__/validator.cpython-313.pyc
 delete mode 100644 scripts/src/aim/inventory/__pycache__/writer.cpython-313.pyc
 create mode 100644 scripts/src/aim/inventory/hierarchy.py
 delete mode 100644 scripts/src/aim/maintenance/__pycache__/__init__.cpython-313.pyc
 delete mode 100644 scripts/src/aim/maintenance/__pycache__/checkmk.cpython-313.pyc
 delete mode 100644 scripts/src/aim/maintenance/__pycache__/repository.cpython-313.pyc
 delete mode 100644 scripts/src/aim/playbooks/__pycache__/__init__.cpython-313.pyc
 delete mode 100644 scripts/src/aim/playbooks/__pycache__/manager.cpython-313.pyc
 create mode 100644 scripts/src/aim/playbooks/catalog.py
 create mode 100644 scripts/src/aim/playbooks/planning.py
 create mode 100644 scripts/src/aim/runtime/__init__.py
 create mode 100644 scripts/src/aim/runtime/agent.py
 create mode 100644 scripts/src/aim/runtime/ansible.py
 create mode 100644 scripts/src/aim/runtime/events.py
 create mode 100644 scripts/src/aim/runtime/outputs.py
 create mode 100644 scripts/src/aim/runtime/process.py
 create mode 100644 scripts/src/aim/runtime/secrets.py
 create mode 100644 scripts/src/aim/runtime/staging.py
 create mode 100644 scripts/src/aim/services/__init__.py
 create mode 100644 scripts/src/aim/services/v1/__init__.py
 create mode 100644 scripts/src/aim/services/v1/credentials.py
 create mode 100644 scripts/src/aim/services/v1/models.py
 create mode 100644 scripts/src/aim/services/v1/service.py
 delete mode 100644 scripts/src/aim/sophos/__pycache__/__init__.cpython-313.pyc
 delete mode 100644 scripts/src/aim/sophos/__pycache__/config.cpython-313.pyc
 delete mode 100644 scripts/src/aim/ssh/__pycache__/__init__.cpython-313.pyc
 delete mode 100644 scripts/src/aim/ssh/__pycache__/keys.cpython-313.pyc
 delete mode 100644 scripts/src/aim/ui/__pycache__/__init__.cpython-313.pyc
 delete mode 100644 scripts/src/aim/ui/__pycache__/access.cpython-313.pyc
 delete mode 100644 scripts/src/aim/ui/__pycache__/administration.cpython-313.pyc
 delete mode 100644 scripts/src/aim/ui/__pycache__/app.cpython-313.pyc
 delete mode 100644 scripts/src/aim/ui/__pycache__/components.cpython-313.pyc
 delete mode 100644 scripts/src/aim/ui/__pycache__/customers.cpython-313.pyc
 delete mode 100644 scripts/src/aim/ui/__pycache__/execution.cpython-313.pyc
 delete mode 100644 scripts/src/aim/ui/__pycache__/hosts.cpython-313.pyc
 delete mode 100644 scripts/src/aim/ui/__pycache__/maintenance.cpython-313.pyc
 delete mode 100644 scripts/src/aim/ui/__pycache__/playbooks.cpython-313.pyc
 delete mode 100644 scripts/src/aim/ui/__pycache__/selection.cpython-313.pyc
 delete mode 100644 scripts/src/aim/ui/__pycache__/targets.cpython-313.pyc
 create mode 100644 scripts/src/aim/ui/vault_credentials.py
 delete mode 100644 scripts/src/aim/variables/__pycache__/__init__.cpython-313.pyc
 delete mode 100644 scripts/src/aim/variables/__pycache__/viewer.cpython-313.pyc
 delete mode 100644 scripts/src/aim/vault/__pycache__/__init__.cpython-313.pyc
 delete mode 100644 scripts/src/aim/vault/__pycache__/manager.cpython-313.pyc
 create mode 100644 scripts/src/aim/vault/session.py
 delete mode 100644 scripts/src/aim/winrm/__pycache__/__init__.cpython-313.pyc
 delete mode 100644 scripts/src/aim/winrm/__pycache__/manager.cpython-313.pyc

diff --git a/roles/checkmk_scripts/files/Linux/local/check_certificate_directory.sh.example b/.aim-core-deploy.lock
similarity index 100%
rename from roles/checkmk_scripts/files/Linux/local/check_certificate_directory.sh.example
rename to .aim-core-deploy.lock
diff --git a/.gitignore b/.gitignore
index 359d707..76bfb02 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,4 @@
 **/bak.yml
-**/vault.yml
\ No newline at end of file
+**/vault.yml
+**/__pycache__
+**/tests
\ No newline at end of file
diff --git a/README.md b/README.md
index f29215c..81896f9 100644
--- a/README.md
+++ b/README.md
@@ -1,76 +1,72 @@
-# AIM --- Ansible Inventory Manager
+# AIM: Ansible Inventory Manager
 
-AIM is an operator-focused Python application for managing Ansible
-customer inventories, access configuration, Vaults and curated playbook
-execution.
+**Current candidate: 3.3.0rc4. Canonical Ansible Core: 2.19.11. Service/wire/event API: 1.0.**
 
-## Source layout
+AIM is an independent controller product with a built-in terminal (`aim`), a machine
+interface (`aimctl`) and an additive Python facade (`aim.services.v1`). Add-ons consume
+Core contracts; they do not patch Core, emulate its console or own execution semantics.
 
-``` text
-/etc/ansible/scripts/
-├── README.md
-├── install.md
-├── CHANGELOG.md
-├── docs/
-├── pyproject.toml
-└── src/
-    └── aim/
+## This release
+
+The new `aim_output_v1` publisher convention and catalog-owned schemas expose purposeful
+operation data independently of task progress and per-target outcomes. Nine operations
+now publish reports: role detection, disk usage, event exports, service recovery, OS
+patching, Checkmk cleanup, user-config reading, agent installation and config updating.
+
+Results are finite typed data, not raw Ansible stdout/debug/module dictionaries. Existing
+nonreporting operations keep `operation_result: null`. Both summary and detail clients
+receive final reports. The terminal retains native output; native Ansible retains its
+own execution behavior and does not become a Core API consumer.
+
+3.3.0rc4 makes Windows patching wave-based around the native `ansible.windows.win_updates`
+orchestration. AIM submits the currently selected category set as one Windows Update wave
+with `reboot: false`, lets the module/WUA process that wave, and evaluates reboot policy only
+after the wave returns. A reboot ends the run by default; another post-reboot wave requires
+explicit `os_patching_rescan_after_reboot: true`. AIM no longer implements a per-update
+scheduler. Per-update result/HRESULT evidence is still normalized into `patch_summary_v1`.
+
+## Install or update
+
+Distribute the complete `AIM-Ansible-3.3.0rc4.zip` and matching `.zip.sha256` from a trusted
+channel. A checksum checks integrity, not publisher authenticity. No Git or patch workflow.
+
+```bash
+cd /var/tmp
+sha256sum -c AIM-Ansible-3.3.0rc4.zip.sha256
+unzip AIM-Ansible-3.3.0rc4.zip
+cd aim-core-3.3.0rc4
+sudo python3 deploy/deploy.py update --dry-run
+# Review the plan, then stop active jobs and source writers before applying.
+sudo python3 deploy/deploy.py update --apply --quiesced
+hash -r
+aim --version
+aimctl --version
+aimctl capabilities
 ```
 
-AIM uses `/etc/ansible/inventories/<customer>/hosts.yml` as the
-inventory source of truth.
+The deployer discovers the existing AIM interpreter from its recognized launcher. Only
+supply `--aim-python /absolute/venv/bin/python` when discovery needs an explicit known path;
+never pass an empty shell variable. Provision AIM's declared dependencies separately for
+fresh installation, then use `install` instead of `update`. The deployer does not install
+packages, modify services or enable external execution.
 
-## Supported platform groups
+Existing `scripts/aim.yml`, inventories, Vaults, keys, environments, add-ons and customer
+assets stay. The six explicitly retired Core documents listed in the deployment guide
+are removed with recovery copies; unknown operator documents are not purged.
 
--   `linux`
--   `windows`
--   `sophosxgs`
--   `pfsense`
+## Canonical documentation
 
-A host can belong to multiple groups/subgroups. Platform groups remain
-the top-level groups because they define Ansible connection semantics.
+Start at [the documentation index](scripts/docs/README.md). There is one current document
+per topic, one current validation record and one current sanity checklist. Historical
+changes remain only in [CHANGELOG](scripts/CHANGELOG.md), not competing release guides.
 
-## Quick start
+- [Release notes](scripts/docs/RELEASE_NOTES.md) and [validation](scripts/docs/VALIDATION.md)
+- [Fresh installation](scripts/docs/INSTALLATION.md), [deployment/recovery](deploy/README.md), and [controller sanity tests](scripts/docs/SANITY.md)
+- [Authoritative Core guide](AGENTS.md) and [add-on guide](ADDON_AGENTS.md)
+- [API contract](scripts/docs/ADDON_API.md), [operation results](scripts/docs/OPERATION_RESULTS.md), [handoff](scripts/docs/RELEASE_HANDOFF.md)
+- [Playbooks](scripts/docs/PLAYBOOKS.md), [Checkmk settings](scripts/docs/CHECKMK.md), [executor staging](scripts/docs/EXECUTOR_STAGING.md)
 
-See [install.md](install.md) for installation, virtual-environment
-setup, authorization-group configuration and recovery of Git-ignored
-runtime data.
-
-Start AIM with:
-
-``` bash
-aim
-```
-
-Useful UI troubleshooting modes:
-
-``` bash
-aim --no-clear
-aim --plain
-aim --live-output
-```
-
-## Documentation
-
--   [Installation](install.md)
--   [Operations](docs/OPERATIONS.md)
--   [Inventory](docs/INVENTORY.md)
--   [Windows / WinRM / AD](docs/WINDOWS.md)
--   [Recovery](docs/RECOVERY.md)
--   [Security and sensitive data](docs/SECURITY.md)
--   [Development](docs/DEVELOPMENT.md)
--   [Changelog](CHANGELOG.md)
-
-## Important operational rules
-
-AIM does not use `.hosts.tsv` as inventory state. `hosts.yml` is
-authoritative.
-
-Routine host changes use local YAML validation and do not unnecessarily
-prompt for the Vault password. Explicit inventory validation may invoke
-`ansible-inventory` and request the customer Vault password when a Vault
-exists.
-
-Existing customer-specific values and arbitrary valid YAML structures
-should be preserved unless an operator explicitly requests an operation
-that changes them.
+**Acceptance:** implementation/local tests do not certify this candidate on Windows,
+Linux package managers or a deployed service sandbox. Previous controller successes
+are historical evidence, not new test passes. External execution is still opt-in and
+requires the authorized execution account, collection access and writable staging.
diff --git a/aim.yml b/aim.yml
deleted file mode 100644
index 2df302f..0000000
--- a/aim.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-root_dir: /etc/ansible
-service_user: svc_ansible
-required_group: root
-platform_groups:
-- linux
-- windows
-- sophosxgs
-- pfsense
-ui:
-  clear_screen: true
-  ascii: false
-  output: compact
diff --git a/deploy/README.md b/deploy/README.md
new file mode 100644
index 0000000..d74d9a4
--- /dev/null
+++ b/deploy/README.md
@@ -0,0 +1,205 @@
+# AIM core ZIP deployment - 3.3.0rc8
+
+This standard-library operational helper installs a complete source release and
+its two source-bound command launchers. No Git, patch files, release manifest,
+package installation, add-on inspection or account/group migration is used.
+Python 3.11+ on Linux is required. Development validators are not distributed.
+
+## Verify and preview
+
+Obtain the ZIP and its SHA-256 sidecar through a trusted channel. The sidecar is an
+integrity check, not a publisher signature. Stage outside the installation tree:
+
+```bash
+cd /var/tmp
+sha256sum -c AIM-Ansible-3.3.0rc8.zip.sha256
+unzip AIM-Ansible-3.3.0rc8.zip
+cd aim-core-3.3.0rc8
+sudo python3 deploy/deploy.py update --dry-run
+```
+
+The target defaults to `/etc/ansible`. `update` requires existing core source;
+`install` is for a fresh tree. Preview is the default without `--apply`.
+Do not extract over the live installation. Source and target must not overlap;
+symlink paths and unexpected source files are rejected.
+
+3.3.0rc8 checks the existing **AIM** Python interpreter before making changes. It can
+infer it only from an unambiguous installed `aim` Python shebang. It does not assume
+that `sudo python3`, the Ansible interpreter or an add-on environment contains AIM's
+dependencies. It preserves a virtual environment's Python path without resolving
+its symlink to the system Python.
+
+When discovery is unavailable (for example sudo has a different PATH), provide the
+already identified AIM interpreter explicitly. In the operator test session,
+`AIM_PYTHON` is the interpreter that successfully ran `scripts/aimctl.py`:
+
+```bash
+test -x "$AIM_PYTHON" || { echo 'Set AIM_PYTHON to the existing AIM interpreter first.'; exit 1; }
+sudo python3 deploy/deploy.py update --aim-python "$AIM_PYTHON" --dry-run
+```
+
+Shell wrappers and `#!/usr/bin/env ...` shebangs are not guessed. The interpreter
+must be an absolute executable Python 3.11+ path with no spaces (up to 120 characters),
+and must already contain the dependencies from `scripts/pyproject.toml`.
+
+## Command directory and multiple installations
+
+The preview prints the chosen interpreter, command directory, source operations
+and `@launchers/aim` / `@launchers/aimctl` operations. `@launchers` is a journal
+identifier, not a directory shipped in the source archive.
+
+By default the command directory is the existing `aim` command's parent directory,
+or `/usr/local/bin` when no command exists and an interpreter was supplied. Override
+with `--bin-dir /absolute/command/directory`. A nondefault `--target` **requires** its
+own explicit `--bin-dir` so development deployment cannot silently replace production
+commands. Use the same chosen interpreter/directory on preview and apply.
+
+Only recognized AIM Python entry scripts or AIM-managed launchers for this target
+may be replaced. Unrelated programs, unsafe symlink command destinations and launchers for
+another installation are refused. There is no automatic force-overwrite escape hatch.
+Choose a reviewed unused command directory when the existing layout is nonstandard.
+Ensure the selected directory is on the intended operator's PATH; aliases and another
+installation earlier on PATH remain the operator's responsibility.
+
+## Apply while quiesced
+
+Stop new jobs and exit active AIM/Ansible sessions. `--quiesced` acknowledges that
+source writers/runners have been stopped; it does not discover, kill or pause jobs.
+
+```bash
+sudo python3 deploy/deploy.py update --apply --quiesced
+# Include the same --aim-python and --bin-dir options used in the preview, if any.
+hash -r
+command -v aim
+command -v aimctl
+aim --version
+aimctl --version
+aimctl capabilities
+```
+
+The helper verifies the installed `aim --version` and `aimctl capabilities` against
+the source release before reporting success. It uses an explicit installed config
+path for its capability check. It does not invoke Ansible or contact managed hosts.
+Both launchers import the deployed `scripts/src/aim` source with the selected AIM
+Python. Old launchers and core source are included in protected recovery data.
+
+A stable deployment lock prevents another cooperating deployment. Each source file
+is replaced atomically, preserving existing UID/GID/mode/extended attributes.
+New source files use 0644; new launchers use 0755, and recognized existing launchers
+retain their metadata with executable bits enabled. Directories use normal caller
+ownership/inheritance. This is not a recursive ownership-policy migration.
+
+Recovery defaults to `/var/backups/aim-core`; the helper prints the exact private
+0700 recovery directory. `--backup-dir /private/path` selects another root outside
+source and installation. Keep sufficient space and apply your retention policy.
+
+Obsolete files inside `scripts/src/aim/` and the explicitly retired Core documents below are pruned. Unknown customer files in
+other locations are retained. Add-on code must use its own namespace, not the core
+Python namespace.
+
+**Preserved when present:** operator `scripts/aim.yml`, customer `.aim.yml`, inventories,
+Vaults, SSH keys, add-ons and their state/configuration, environments, external assets,
+unknown playbooks/roles and staged agent files. No dependencies, services, accounts,
+LDAP/local group memberships, remote credentials or add-on version gates are modified.
+Missing new settings are not automatically inserted into an operator's existing YAML.
+
+## Python package and runtime scope
+
+These launchers are source-bound entry points, not a pip reinstall. The helper does
+not change installed wheel/distribution metadata or upgrade packages. Machine clients
+calling the installed `aimctl` reach the deployed source. In-process Python clients
+must also resolve `aim` to this source (for example an existing editable installation
+or an explicitly configured source import path), not an old separately installed
+wheel. Verify `aim.__file__` and `aim.__version__` in that client's own environment.
+No add-on's Python environment is changed by core deployment.
+
+For a fresh installation, provision an AIM Python 3.11+ environment and its declared
+`ruamel.yaml`/`rich` dependencies first, then pass that interpreter to `install`.
+Provide the separate canonical Ansible Core **2.19.11** runtime and approved collections
+from `requirements-controller.txt` / `requirements.yml` explicitly. The helper does
+not install from the network or mutate a system-managed Ansible installation.
+
+For a nondefault controller root, maintain that installation's operator configuration
+and use `aimctl --config /absolute/root/scripts/aim.yml ...` when necessary. Existing
+terminal configuration discovery is unchanged; creating another launcher does not
+silently redirect a terminal's global configuration.
+
+## Opt-in API execution
+
+Follow `scripts/docs/SANITY.md` (historical evidence is in
+`scripts/docs/VALIDATION.md`). External execution remains disabled by
+default and is not enabled by deployment, readiness or the launcher smoke test.
+Preserve the existing YAML and merge only deliberately approved settings:
+
+```yaml
+addons:
+  execution_enabled: true
+runtime:
+  ansible_playbook: /usr/bin/ansible-playbook
+```
+
+The executable path is the operator's approved native runtime, not an assumption
+for every installation. Worker authorization, filesystem/key access, collections,
+connection dependencies and same-UID execution still apply. Do not make private keys
+group-readable to bypass an unsupported cross-user deployment.
+
+## Recovery and interruption
+
+Ordinary application/launcher-check failures attempt to restore touched source and
+launchers. The update is not a whole-tree atomic transaction: power loss or SIGKILL
+can leave partial source. Keep jobs stopped until recovery/version checks complete.
+Recovery journals contain intent, hashes and original metadata; they are local
+recovery records, not a distributed release manifest or inventory backup.
+
+Use this 3.3.0rc8 deployer and the printed recovery directory; include the same target
+for a nondefault installation. Launcher paths are recorded in the journal.
+
+```bash
+sudo python3 deploy/deploy.py rollback --from-backup /var/backups/aim-core/RECOVERY-DIRECTORY --dry-run
+sudo python3 deploy/deploy.py rollback --from-backup /var/backups/aim-core/RECOVERY-DIRECTORY --apply --quiesced
+hash -r
+aim --version
+```
+
+Rollback validates installed/recovery hashes and refuses to overwrite subsequently
+modified source or launchers. Existing aim.yml is never rolled back or removed,
+even after a fresh install. Empty directories may remain. A newly created aimctl
+launcher is removed when restoring a previous release that had no such launcher.
+
+No remote Ansible action, dependency installation, account/group change or add-on
+state is reversed. Keep independent backups of runtime/customer data.
+
+## Required executor staging (independently provisioned units)
+
+Read `scripts/docs/EXECUTOR_STAGING.md` in the installed tree. New add-on executor
+installers should provision owner-only staging and a narrow directory write
+exception by default, then run `aimctl staging-check` inside the actual unit at
+startup. Ordinary `sudo -u` success does not reproduce mount/syscall restrictions.
+
+The source deployer does not inspect/edit/restart services. It preserves the
+working exception already applied by the operator. The automatic Core preflight
+is on by default, but cannot make a read-only mount writable. Do not remove the
+exception, broaden home write access or recursively chown anything during this
+update. The new startup command is available after the normal launcher refresh.
+
+## Documentation consolidation in 3.3.0rc8
+
+Current docs have stable topic names with one validation record and one acceptance
+checklist. Upgrade removes only these explicitly retired Core filenames (with
+protected rollback copies), including locally modified versions of those exact files:
+
+- scripts/docs/RC19_HANDOFF.md
+- scripts/docs/SANITY_3.2.0.md
+- scripts/docs/SANITY_3.2.1rc2.md
+- scripts/docs/VERIFICATION.md
+- scripts/docs/LOCAL_VALIDATION.md
+- scripts/docs/CONTROLLER_ACCEPTANCE.md
+
+Review REMOVE entries before applying. Move any operator notes out of these retired
+Core-owned names before deployment. Unknown Markdown files and other operator
+documents are preserved. Rollback restores retired document bytes/metadata through
+the existing recovery journal. No recursive docs purge or runtime deletion occurs.
+
+The new playbooks/filter_plugins/*.py files and playbooks/schemas/*.yml files are
+Core-owned reporting source. They are deployed with the playbooks; no add-on Python
+environment or collection is modified.
diff --git a/deploy/deploy.py b/deploy/deploy.py
new file mode 100644
index 0000000..7970469
--- /dev/null
+++ b/deploy/deploy.py
@@ -0,0 +1,593 @@
+#!/usr/bin/env python3
+"""Operational full-source install/update, not a Git patcher or release validator.
+
+Python 3.11+, standard library only. Does not install dependencies, change groups,
+start services, touch inventory/add-on data, or replace operator configuration.
+"""
+from __future__ import annotations
+import argparse
+from dataclasses import dataclass
+import base64
+from contextlib import contextmanager
+from datetime import datetime, timezone
+import fcntl
+import hashlib
+import json
+import os
+from pathlib import Path
+import shutil
+import stat
+import subprocess
+import tomllib
+import sys
+import tempfile
+
+
+class DeploymentError(Exception):
+    pass
+
+
+def no_symlink(path: Path):
+    for part in (path, *path.parents):
+        if part.is_symlink():
+            raise DeploymentError('Refusing a symlink in a deployment path: ' + str(part))
+
+
+def no_symlink_parents(path: Path):
+    for part in path.parents:
+        if part.is_symlink():
+            raise DeploymentError('Refusing a symlink in a deployment parent path: ' + str(part))
+
+
+def canonical(path: Path) -> Path:
+    # Check before normalization so an intermediate symlink cannot disappear.
+    no_symlink(path.absolute())
+    return Path(os.path.abspath(path))
+
+
+@contextmanager
+def deployment_lock(target: Path):
+    lock = target / '.aim-core-deploy.lock'
+    fd = os.open(lock, os.O_WRONLY | os.O_NONBLOCK | os.O_CREAT | os.O_CLOEXEC | getattr(os, 'O_NOFOLLOW', 0), 0o600)
+    try:
+        if not stat.S_ISREG(os.fstat(fd).st_mode):
+            raise DeploymentError('Deployment lock is not a regular file.')
+        fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        yield
+    finally:
+        os.close(fd)
+
+
+def allowed(relative: Path) -> bool:
+    parts = relative.parts
+    if relative.as_posix() in {'requirements.yml', 'requirements-controller.txt', 'deploy/deploy.py', 'deploy/README.md'}:
+        return True
+    if len(parts) >= 3 and parts[:3] == ('scripts', 'src', 'aim'):
+        return relative.suffix == '.py' or relative.as_posix() == 'scripts/src/aim/integrations/ansible.cfg'
+    if len(parts) >= 3 and parts[:2] == ('scripts', 'docs'):
+        return relative.suffix in ('.md', '.json')
+    if len(parts) == 2 and parts[0] == 'scripts':
+        return parts[1] in {'pyproject.toml', 'aim.yml', 'AIM-WinRM-OneTime.ps1', 'aimctl.py'}
+    if len(parts) == 3 and parts[:2] == ('playbooks', 'filter_plugins'):
+        return relative.suffix == '.py'
+    if len(parts) >= 2 and parts[0] == 'playbooks':
+        return relative.suffix in ('.yml', '.yaml', '.md')
+    if len(parts) >= 3 and parts[0] == 'roles':
+        if relative.name == 'README.md':
+            return True
+        return len(parts) >= 4 and parts[2] in ('tasks', 'defaults', 'handlers', 'meta', 'vars', 'templates') and relative.suffix in ('.yml', '.yaml', '.j2')
+    return False
+
+
+def source_files(source: Path) -> dict[str, Path]:
+    result = {}
+    for parent, dirs, files in os.walk(source, followlinks=False):
+        dirs[:] = sorted(d for d in dirs if d != '__pycache__')
+        for d in dirs:
+            no_symlink(Path(parent) / d)
+        for name in sorted(files):
+            path = Path(parent) / name
+            relative = path.relative_to(source)
+            if path.suffix == '.pyc':
+                continue
+            if path.is_symlink() or not path.is_file() or not allowed(relative):
+                raise DeploymentError('Unexpected source entry; refusing deployment: ' + str(relative))
+            result[relative.as_posix()] = path
+    required = {'scripts/src/aim/__init__.py', 'scripts/pyproject.toml', 'scripts/docs/AGENTS.md', 'scripts/docs/ADDON_AGENTS.md', 'playbooks/aim_catalog.yml'}
+    if not required.issubset(result):
+        raise DeploymentError('Not a complete AIM replacement source tree.')
+    return result
+
+
+def digest(path: Path | bytes) -> str:
+    if isinstance(path, bytes):
+        return hashlib.sha256(path).hexdigest()
+    with path.open('rb') as stream:
+        return hashlib.file_digest(stream, 'sha256').hexdigest()
+
+
+LAUNCHER_MARKER = '# AIM core managed launcher v1'
+
+
+def _launcher_digest(path: Path) -> str | None:
+    if path.is_symlink():
+        return digest(('symlink:' + os.readlink(path)).encode('utf-8'))
+    if path.exists():
+        return digest(path)
+    return None
+
+
+def _read_launcher_text(path: Path) -> str:
+    candidate = path.resolve(strict=True) if path.is_symlink() else path
+    if not candidate.is_file() or candidate.stat().st_size > 65536:
+        raise DeploymentError('A non-launcher occupies ' + str(path))
+    try:
+        return candidate.read_text(encoding='utf-8')
+    except UnicodeDecodeError:
+        raise DeploymentError('Refusing to replace an unrecognized launcher: ' + str(path)) from None
+
+
+def _restore_symlink(destination: Path, target: str):
+    no_symlink_parents(destination)
+    temporary = destination.parent / ('.aim-link-' + next(tempfile._get_candidate_names()))
+    try:
+        os.symlink(target, temporary)
+        os.replace(temporary, destination)
+        dfd = os.open(destination.parent, os.O_RDONLY | os.O_DIRECTORY)
+        try:
+            os.fsync(dfd)
+        finally:
+            os.close(dfd)
+    finally:
+        temporary.unlink(missing_ok=True)
+
+
+def _launcher_path(item, target: Path, launcher_dir: Path | None = None):
+    relative = Path(item['path'])
+    if item.get('kind') == 'launcher':
+        if launcher_dir is None or relative.parts not in (('@launchers', 'aim'), ('@launchers', 'aimctl')):
+            raise DeploymentError('Invalid launcher recovery path.')
+        directory = canonical(launcher_dir)
+        if not directory.is_absolute() or directory == Path('/'):
+            raise DeploymentError('Invalid launcher directory.')
+        destination = directory / relative.name
+    else:
+        if relative.is_absolute() or '..' in relative.parts or relative.parts[:1] == ('@launchers',):
+            raise DeploymentError('Invalid core source path.')
+        destination = target / relative
+    if item.get('kind') == 'launcher':
+        no_symlink_parents(destination)
+    else:
+        no_symlink(destination)
+    return destination
+
+
+def _command(args, *, timeout=20):
+    env = os.environ.copy()
+    for name in ('PYTHONPATH', 'PYTHONHOME', 'PYTHONSTARTUP', 'PYTHONINSPECT'):
+        env.pop(name, None)
+    env['PYTHONDONTWRITEBYTECODE'] = '1'
+    try:
+        result = subprocess.run(args, stdin=subprocess.DEVNULL, capture_output=True,
+                                text=True, timeout=timeout, env=env, cwd='/')
+    except (OSError, subprocess.TimeoutExpired):
+        raise DeploymentError('AIM interpreter/launcher check could not complete; no dependency installation is attempted.') from None
+    if result.returncode:
+        raise DeploymentError('AIM interpreter/launcher check failed. Supply the existing AIM environment with --aim-python; ensure its Python 3.11+, ruamel.yaml and rich dependencies and operator configuration are usable.')
+    return result.stdout
+
+
+@dataclass(frozen=True)
+class EntryPoints:
+    python: Path
+    directory: Path
+    target: Path
+
+    def contents(self):
+        result = {}
+        for name, module in (('aim', 'aim.__main__'), ('aimctl', 'aim.ctl')):
+            metadata = json.dumps({'target': str(self.target), 'python': str(self.python), 'command': name}, sort_keys=True)
+            content = (f'#!{self.python}\n{LAUNCHER_MARKER}\n# {metadata}\n'
+                       'import sys\n'
+                       'sys.dont_write_bytecode = True\n'
+                       f'sys.path.insert(0, {str(self.target / "scripts/src")!r})\n'
+                       f'from {module} import main\n'
+                       'if __name__ == "__main__":\n    raise SystemExit(main())\n')
+            result['@launchers/' + name] = content.encode('utf-8')
+        return result
+
+    def verify_python(self, source):
+        # An explicit interpreter is an administrator-selected executable, not
+        # user-controlled input to an elevated web wrapper. Preserve venv symlinks.
+        expected = tomllib.loads((source / 'scripts/pyproject.toml').read_text())['project']['version']
+        code = ('import sys,json; assert sys.version_info >= (3,11); '
+                f'sys.path.insert(0, {str(source / "scripts/src")!r}); '
+                'import ruamel.yaml,rich,aim; from aim.ui.app import App; '
+                'from aim.services.v1 import AimService; from aim.ctl import main; '
+                'print(json.dumps({"version":aim.__version__}))')
+        value = json.loads(_command([str(self.python), '-I', '-B', '-c', code]))
+        if value.get('version') != expected:
+            raise DeploymentError('Extracted source/package versions disagree.')
+        return expected
+
+    def verify_installed(self, version):
+        got = _command([str(self.directory / 'aim'), '--version']).strip()
+        value = json.loads(_command([str(self.directory / 'aimctl'), '--config',
+                                     str(self.target / 'scripts/aim.yml'), 'capabilities']))
+        if got != 'AIM ' + version or not value.get('ok') or value.get('result', {}).get('core_version') != version:
+            raise DeploymentError('Installed AIM/aimctl launchers do not report the deployed core version.')
+        print('PASS installed aim --version and aimctl capabilities (' + version + ').')
+
+
+def entry_points(target: Path, python: Path | None, directory: Path | None) -> EntryPoints:
+    existing = shutil.which('aim')
+    if target != Path('/etc/ansible') and directory is None:
+        raise DeploymentError('A nondefault --target requires an explicit --bin-dir to avoid replacing another installation\'s commands.')
+    if python is None:
+        if not existing:
+            raise DeploymentError('Cannot discover the AIM interpreter. Supply --aim-python /absolute/path/to/the/existing/AIM/bin/python.')
+        with Path(existing).open(encoding='utf-8') as stream:
+            first = stream.readline().strip()
+        if not first.startswith('#!/') or len(first[2:].split()) != 1 or Path(first[2:]).name not in ('python', 'python3', 'python3.11', 'python3.12', 'python3.13', 'python3.14'):
+            raise DeploymentError('The existing aim launcher has no unambiguous Python shebang. Supply --aim-python explicitly; shell/env wrappers are not guessed.')
+        python = Path(first[2:])
+    if not python.is_absolute() or not python.is_file() or not os.access(python, os.X_OK) or any(c.isspace() for c in str(python)) or len(str(python)) > 120:
+        raise DeploymentError('--aim-python must be an executable absolute, space-free Python path (maximum 120 characters). Venv symlinks are supported.')
+    python = Path(os.path.abspath(python))  # do NOT resolve a venv symlink to the system Python
+    directory = directory if directory is not None else (Path(existing).parent if existing else Path('/usr/local/bin'))
+    if not directory.is_absolute():
+        raise DeploymentError('--bin-dir must be absolute.')
+    directory = canonical(directory)
+    if directory == Path('/') or directory == target or directory.is_relative_to(target / 'scripts/src'):
+        raise DeploymentError('Use a dedicated command directory, not the root or core source namespace.')
+    if directory.exists() and not directory.is_dir():
+        raise DeploymentError('The command directory is not a directory.')
+    for name, module in (('aim', 'aim.__main__'), ('aimctl', 'aim.ctl')):
+        dest = directory / name
+        no_symlink_parents(dest)
+        if dest.exists() or dest.is_symlink():
+            if dest.is_symlink():
+                try:
+                    resolved = dest.resolve(strict=True)
+                except (OSError, RuntimeError):
+                    raise DeploymentError('Refusing a broken launcher symlink: ' + str(dest)) from None
+                if not resolved.is_file():
+                    raise DeploymentError('Launcher symlink does not resolve to a regular file: ' + str(dest))
+            text = _read_launcher_text(dest)
+            if LAUNCHER_MARKER in text:
+                try:
+                    info = json.loads(text.splitlines()[2][2:])
+                except (ValueError, IndexError):
+                    raise DeploymentError('Invalid AIM launcher metadata: ' + str(dest)) from None
+                if info.get('target') != str(target):
+                    raise DeploymentError('AIM launcher belongs to another installation; choose its own --bin-dir.')
+            elif f'from {module} import main' not in text:
+                raise DeploymentError('Refusing to replace an unrecognized launcher. Choose a reviewed --bin-dir: ' + str(dest))
+    return EntryPoints(python, directory, target)
+
+
+def plan(source, target, mode, *, entrypoints=None):
+    source, target = canonical(source), canonical(target)
+    no_symlink(source)
+    no_symlink(target)
+    if target == Path('/') or source == target or source.is_relative_to(target) or target.is_relative_to(source):
+        raise DeploymentError('Use separate extracted-source and installation directories; never / as target.')
+    if mode == 'update' and not (target / 'scripts/src/aim/__init__.py').is_file():
+        raise DeploymentError('Existing AIM source was not found; use install for a fresh tree.')
+    files = source_files(source)
+    operations = []
+    for relative, src in sorted(files.items()):
+        dest = target / relative
+        no_symlink(dest)
+        if dest.exists() and not dest.is_file():
+            raise DeploymentError('A non-file occupies a core destination: ' + relative)
+        if relative == 'scripts/aim.yml' and dest.exists():
+            continue  # operator-owned, always preserved, even on first install
+        if dest.exists() and digest(src) == digest(dest):
+            continue
+        operations.append({'path': relative, 'action': 'replace' if dest.exists() else 'create',
+                           'old_sha256': digest(dest) if dest.exists() else None,
+                           'new_sha256': digest(src)})
+    # Only the Python core namespace is an authoritative replaceable directory.
+    # Other unlisted playbooks/roles/files remain operator-owned additions.
+    core = target / 'scripts/src/aim'
+    if core.exists():
+        for parent, dirs, names in os.walk(core, followlinks=False):
+            for d in dirs:
+                no_symlink(Path(parent) / d)
+            for name in names:
+                existing = Path(parent) / name
+                no_symlink(existing)
+                relative = existing.relative_to(target).as_posix()
+                if relative not in files:
+                    if not existing.is_file():
+                        raise DeploymentError('Unsupported core namespace entry: ' + relative)
+                    operations.append({'path': relative, 'action': 'remove', 'old_sha256': digest(existing), 'new_sha256': None})
+    # Explicitly retired Core document names only; unknown operator documents stay.
+    # Removal is previewed and recorded in the same protected rollback journal.
+    retired_docs = (
+        # Root/scripts-root AIM-owned docs moved into scripts/docs.
+        # Component-local docs (deploy/README.md, role READMEs, playbook docs) stay beside their code.
+        'AGENTS.md', 'ADDON_AGENTS.md', 'scripts/CHANGELOG.md',
+        'scripts/docs/RC19_HANDOFF.md', 'scripts/docs/SANITY_3.2.0.md',
+        'scripts/docs/SANITY_3.2.1rc2.md', 'scripts/docs/VERIFICATION.md',
+        'scripts/docs/LOCAL_VALIDATION.md', 'scripts/docs/CONTROLLER_ACCEPTANCE.md',
+    )
+    for relative in retired_docs:
+        existing = target / relative
+        no_symlink(existing)
+        if existing.exists() and relative not in files:
+            if not existing.is_file():
+                raise DeploymentError('Non-file occupies a retired document: ' + relative)
+            operations.append({'path': relative, 'action': 'remove',
+                               'old_sha256': digest(existing), 'new_sha256': None})
+    if entrypoints is not None:
+        if entrypoints.target != target or entrypoints.directory == source or entrypoints.directory.is_relative_to(source):
+            raise DeploymentError('Launcher target/directory conflicts with the extracted source.')
+        for relative, content in entrypoints.contents().items():
+            dest = _launcher_path({'path': relative, 'kind': 'launcher'}, target, entrypoints.directory)
+            files[relative] = content
+            current = _launcher_digest(dest)
+            if not dest.is_symlink() and dest.exists() and current == digest(content) and os.access(dest, os.X_OK):
+                continue
+            operations.append({'path': relative, 'kind': 'launcher', 'action': 'replace' if (dest.exists() or dest.is_symlink()) else 'create',
+                               'old_sha256': current, 'new_sha256': digest(content)})
+    return files, operations
+
+
+def atomic_file(source: Path | bytes, destination: Path, *, metadata=None, executable=False, allow_replace_symlink=False):
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    if allow_replace_symlink:
+        no_symlink_parents(destination)
+    else:
+        no_symlink(destination)
+    fd, filename = tempfile.mkstemp(prefix='.aim-install-', dir=destination.parent)
+    staged = Path(filename)
+    try:
+        with os.fdopen(fd, 'wb') as stream:
+            if isinstance(source, bytes):
+                stream.write(source)
+            else:
+                with source.open('rb') as incoming:
+                    shutil.copyfileobj(incoming, stream)
+            stream.flush()
+            os.fsync(stream.fileno())
+        if metadata is None and destination.exists() and not destination.is_symlink():
+            old = destination.stat()
+            os.chown(staged, old.st_uid, old.st_gid)
+            # Preserve ACLs/attributes, not the old file timestamp.
+            for key in os.listxattr(destination):
+                os.setxattr(staged, key, os.getxattr(destination, key))
+            staged.chmod(stat.S_IMODE(old.st_mode) | (0o111 if executable else 0))
+        elif metadata is not None:
+            os.chown(staged, metadata['uid'], metadata['gid'])
+            for key, value in metadata.get('xattrs', {}).items():
+                os.setxattr(staged, key, base64.b64decode(value, validate=True))
+            staged.chmod(metadata['mode'])
+        else:
+            staged.chmod(0o755 if executable else 0o644)
+        os.replace(staged, destination)
+        dfd = os.open(destination.parent, os.O_RDONLY | os.O_DIRECTORY)
+        try:
+            os.fsync(dfd)
+        finally:
+            os.close(dfd)
+    finally:
+        staged.unlink(missing_ok=True)
+
+
+def apply(source, target, mode, backup_root, *, entrypoints=None):
+    source, target, backup_root = canonical(source), canonical(target), canonical(backup_root)
+    files, operations = plan(source, target, mode, entrypoints=entrypoints)
+    version = entrypoints.verify_python(source) if entrypoints else None
+    launcher_dir = entrypoints.directory if entrypoints else None
+    if not operations:
+        if entrypoints:
+            entrypoints.verify_installed(version)
+        print('AIM source and selected entry points are already current; operator configuration was preserved.')
+        return None
+    no_symlink(backup_root)
+    if backup_root == target or backup_root.is_relative_to(target) or backup_root == source or backup_root.is_relative_to(source):
+        raise DeploymentError('Backups must be outside the installation and extracted source trees.')
+    backup_root.mkdir(parents=True, exist_ok=True)
+    backup = Path(tempfile.mkdtemp(prefix=datetime.now(timezone.utc).strftime('%Y%m%dT%H%M%SZ-'), dir=backup_root))
+    backup.chmod(0o700)
+    record = {'target': str(target), 'state': 'preparing', 'entries': [], 'created_directories': [],
+              'format': 2, 'launcher_dir': str(launcher_dir) if launcher_dir else None}
+    for operation in operations:
+        dest = _launcher_path(operation, target, launcher_dir)
+        item = dict(operation)
+        if dest.is_symlink():
+            item['old_kind'] = 'symlink'
+            item['link_target'] = os.readlink(dest)
+        elif dest.exists():
+            st = dest.stat()
+            item['old_kind'] = 'file'
+            item['metadata'] = dict(uid=st.st_uid, gid=st.st_gid, mode=stat.S_IMODE(st.st_mode),
+                                    xattrs={key: base64.b64encode(os.getxattr(dest, key)).decode('ascii') for key in os.listxattr(dest)})
+            recovery = backup / 'files' / operation['path']
+            recovery.parent.mkdir(parents=True, exist_ok=True)
+            shutil.copy2(dest, recovery)
+            recovery.chmod(0o600)
+        record['entries'].append(item)
+    def save_record():
+        fd, temporary = tempfile.mkstemp(prefix='.recovery-', dir=backup)
+        try:
+            with os.fdopen(fd, 'w', encoding='utf-8') as stream:
+                json.dump(record, stream, indent=2)
+                stream.flush()
+                os.fsync(stream.fileno())
+            os.replace(temporary, backup / 'recovery.json')
+            dfd = os.open(backup, os.O_RDONLY | os.O_DIRECTORY)
+            try:
+                os.fsync(dfd)
+            finally:
+                os.close(dfd)
+        finally:
+            Path(temporary).unlink(missing_ok=True)
+    save_record()
+    try:
+        record['state'] = 'applying'
+        save_record()
+        for item in record['entries']:
+            dest = _launcher_path(item, target, launcher_dir)
+            current = _launcher_digest(dest) if item.get('kind') == 'launcher' else (digest(dest) if dest.exists() else None)
+            if current != item['old_sha256']:
+                raise DeploymentError('Source changed during installation; stop writers and retry.')
+            item['started'] = True
+            save_record()  # persist intent before changing any installed file
+            if item['action'] == 'remove':
+                dest.unlink()
+            else:
+                if digest(files[item['path']]) != item['new_sha256']:
+                    raise DeploymentError('Extracted release source changed during installation.')
+                missing_dirs = []
+                parent = dest.parent
+                while not parent.exists():
+                    missing_dirs.append(str(parent))
+                    parent = parent.parent
+                record['created_directories'].extend(missing_dirs)
+                atomic_file(files[item['path']], dest, executable=item.get('kind') == 'launcher',
+                            allow_replace_symlink=item.get('kind') == 'launcher')
+            item['applied'] = True
+            save_record()
+        if entrypoints:
+            entrypoints.verify_installed(version)
+        record['state'] = 'completed'
+        save_record()
+        print('AIM core source installed. Recovery directory: ' + str(backup))
+        print('Preserved existing scripts/aim.yml, inventories, Vaults, keys, add-ons, virtual environments and unlisted customer files.')
+        print('No dependencies, OS identities, permissions policy or services were provisioned.')
+        if entrypoints:
+            print('AIM and aimctl launchers: ' + str(entrypoints.directory))
+            print('Ensure this directory is in the operator PATH; use hash -r in existing shells.')
+        return backup
+    except BaseException:
+        # Ordinary failures can restore the source files already touched. A power
+        # loss/kill -9 is not an atomic whole-tree transaction: retain recovery data.
+        for item in reversed(record['entries']):
+            if not item.get('started') or item['path'] == 'scripts/aim.yml':
+                continue
+            dest = _launcher_path(item, target, launcher_dir)
+            now = _launcher_digest(dest) if item.get('kind') == 'launcher' else (digest(dest) if dest.exists() else None)
+            if now == item['old_sha256'] and not (item.get('kind') == 'launcher' and dest.exists() and
+                    stat.S_IMODE(dest.stat().st_mode) != item.get('metadata', {}).get('mode')):
+                continue
+            if now != item['new_sha256']:
+                raise DeploymentError('A concurrently modified file prevented rollback; use the protected recovery directory.')
+            if item['old_sha256'] is None:
+                dest.unlink(missing_ok=True)
+            elif item.get('old_kind') == 'symlink':
+                _restore_symlink(dest, item['link_target'])
+            else:
+                atomic_file(backup / 'files' / item['path'], dest, metadata=item['metadata'])
+        record['state'] = 'rolled_back_after_error'
+        save_record()
+        raise
+
+
+def rollback(backup: Path, target: Path, *, execute: bool):
+    backup, target = canonical(backup), canonical(target)
+    path = backup / 'recovery.json'
+    if path.is_symlink() or not path.is_file():
+        raise DeploymentError('Recovery metadata is missing or unsafe.')
+    record = json.loads(path.read_text(encoding='utf-8'))
+    if record.get('target') != str(target) or record.get('state') not in ('completed', 'applying'):
+        raise DeploymentError('Recovery target/state does not match this installation.')
+    actions = []
+    launcher_dir = Path(record['launcher_dir']) if record.get('launcher_dir') else None
+    for item in record['entries']:
+        if not (item.get('started') or item.get('applied')):
+            continue
+        relative = Path(item['path'])
+        if relative.is_absolute() or '..' in relative.parts or relative.as_posix() == 'scripts/aim.yml':
+            # Initial install may have created aim.yml: never delete an operator's
+            # subsequent configuration through rollback. Always preserve this file.
+            if relative.as_posix() == 'scripts/aim.yml':
+                continue
+            raise DeploymentError('Unsafe recovery path.')
+        if item.get('kind') != 'launcher' and not allowed(relative) and relative.parts[:3] != ('scripts', 'src', 'aim'):
+            raise DeploymentError('Recovery may only address the core source namespace.')
+        dest = _launcher_path(item, target, launcher_dir)
+        now = _launcher_digest(dest) if item.get('kind') == 'launcher' else (digest(dest) if dest.exists() else None)
+        if now == item['old_sha256'] and not (item.get('kind') == 'launcher' and dest.exists() and
+                stat.S_IMODE(dest.stat().st_mode) != item.get('metadata', {}).get('mode')):
+            continue  # interruption before publication, or an already restored entry
+        if now != item['new_sha256']:
+            raise DeploymentError('Installed core source changed since deployment; refusing to overwrite it during rollback: ' + str(relative))
+        if item['old_sha256'] is not None and item.get('old_kind') != 'symlink':
+            recovered = backup / 'files' / relative
+            no_symlink(recovered)
+            if digest(recovered) != item['old_sha256']:
+                raise DeploymentError('Recovery file checksum mismatch.')
+        actions.append(item)
+    print('Rollback source files: ' + str(len(actions)))
+    if not execute:
+        print('Dry run only. Use --apply --quiesced to restore these source files.')
+        return
+    for item in reversed(actions):
+        dest = _launcher_path(item, target, launcher_dir)
+        if item['old_sha256'] is None:
+            dest.unlink(missing_ok=True)
+        elif item.get('old_kind') == 'symlink':
+            _restore_symlink(dest, item['link_target'])
+        else:
+            atomic_file(backup / 'files' / item['path'], dest, metadata=item['metadata'])
+    print('Core source and recorded launchers restored; no remote Ansible work was reversed. Use hash -r and verify aim/aimctl for the restored release.')
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('operation', choices=('install', 'update', 'rollback'))
+    parser.add_argument('--target', type=Path, default=Path('/etc/ansible'))
+    parser.add_argument('--backup-dir', type=Path, default=Path('/var/backups/aim-core'))
+    parser.add_argument('--from-backup', type=Path)
+    parser.add_argument('--aim-python', type=Path, help='Existing AIM interpreter; inferred only from an unambiguous installed aim Python shebang')
+    parser.add_argument('--bin-dir', type=Path, help='Install aim and aimctl here; defaults to the existing aim command directory or /usr/local/bin')
+    group = parser.add_mutually_exclusive_group()
+    group.add_argument('--apply', action='store_true', help='Apply the planned core-source replacement')
+    group.add_argument('--dry-run', action='store_true', help='Preview only (the default)')
+    parser.add_argument('--quiesced', action='store_true', help='Confirm CLI/add-on jobs and other source writers have been stopped')
+    args = parser.parse_args(argv)
+    try:
+        if not args.target.is_absolute():
+            raise DeploymentError('An absolute non-root installation directory is required.')
+        args.target = canonical(args.target)
+        if args.target == Path('/'):
+            raise DeploymentError('An absolute non-root installation directory is required.')
+        if args.apply and not args.quiesced:
+            raise DeploymentError('Stop active CLI/add-on jobs and retry with --apply --quiesced.')
+        if args.operation == 'rollback':
+            if not args.from_backup:
+                raise DeploymentError('rollback requires --from-backup.')
+            if args.apply:
+                with deployment_lock(args.target):
+                    rollback(args.from_backup, args.target, execute=True)
+            else:
+                rollback(args.from_backup, args.target, execute=False)
+            return 0
+        source = Path(__file__).absolute().parents[1]
+        entrypoints = entry_points(args.target, args.aim_python, args.bin_dir)
+        entrypoints.verify_python(source)
+        _, operations = plan(source, args.target, args.operation, entrypoints=entrypoints)
+        print('Target: ' + str(args.target))
+        print('AIM interpreter: ' + str(entrypoints.python))
+        print('Command directory: ' + str(entrypoints.directory))
+        for operation in operations:
+            print(operation['action'].upper() + ' ' + operation['path'])
+        print('Planned file operations: ' + str(len(operations)))
+        print('KEEP existing scripts/aim.yml and all unlisted runtime/add-on/customer files.')
+        if not args.apply:
+            print('Dry run only. Apply from this extracted archive with --apply --quiesced.')
+            return 0
+        args.target.mkdir(parents=True, exist_ok=True)
+        with deployment_lock(args.target):
+            apply(source, args.target, args.operation, args.backup_dir.absolute(), entrypoints=entrypoints)
+        return 0
+    except (DeploymentError, OSError, ValueError, KeyError, TypeError) as exc:
+        print('AIM deployment stopped: ' + str(exc), file=sys.stderr)
+        return 1
+
+
+if __name__ == '__main__':
+    raise SystemExit(main())
diff --git a/roles/checkmk_scripts/files/Linux/local/check_unifi-controller.sh.example b/inventories/desq_gaming/.aim.lock
similarity index 100%
rename from roles/checkmk_scripts/files/Linux/local/check_unifi-controller.sh.example
rename to inventories/desq_gaming/.aim.lock
diff --git a/inventories/desq_gaming/group_vars/linux/.ssh/svc_ansible b/inventories/desq_gaming/group_vars/linux/.ssh/svc_ansible
deleted file mode 100644
index 3111a57..0000000
--- a/inventories/desq_gaming/group_vars/linux/.ssh/svc_ansible
+++ /dev/null
@@ -1,8 +0,0 @@
------BEGIN OPENSSH PRIVATE KEY-----
-b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABCzzsHfog
-Wv9erYAv5gNSMrAAAAGAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIFEjnIIVsyXXaoqd
-VGOGwSPXthf8vzZ7L//SZP3OuJjxAAAAoPoC23Ps5HmvCpJrlOsubdcAjq0Ol65xhOb8VQ
-OolhyCPFPj/eH1z21w/PvXhL1S8tDsBut27qW8+5dSwT2gqjtt/x2SiOQYMHt6EjGGAISu
-NNy9L+vRcOFIB4Lo1IE/BMeZRUpgW2GXRFcQH9KgZXh/IWMDqcS5q8GbIT69OUxVUeBg3x
-Wa5f3MyCUMEmIMkBcdbJrebWXLjDvVYDI3myE=
------END OPENSSH PRIVATE KEY-----
diff --git a/inventories/desq_gaming/group_vars/linux/.ssh/svc_ansible.pub b/inventories/desq_gaming/group_vars/linux/.ssh/svc_ansible.pub
deleted file mode 100644
index 7b6b399..0000000
--- a/inventories/desq_gaming/group_vars/linux/.ssh/svc_ansible.pub
+++ /dev/null
@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFEjnIIVsyXXaoqdVGOGwSPXthf8vzZ7L//SZP3OuJjx svc_ansible@desq_gaming
diff --git a/inventories/desq_gaming/group_vars/linux/.ssh/svc_bf-ansible b/inventories/desq_gaming/group_vars/linux/.ssh/svc_bf-ansible
new file mode 100644
index 0000000..deec246
--- /dev/null
+++ b/inventories/desq_gaming/group_vars/linux/.ssh/svc_bf-ansible
@@ -0,0 +1,8 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABDCE2LLoV
+73yy1kzqzlRMRAAAAAGAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIFdQAWVjarXDVETr
+Lk4DepHUkaDNVJl41IZuCUCDKLM9AAAAoJwWeclw1w1YC5uWBbb1JaMH2q9fa1YDSvg4Gs
+bNuZM8UEmh2pYkOBBPmL3mbTkcq2igF5IbJarhTzfebKCj9hMI3tXPyK9c6torPwA5uOiy
+NuQ1jUcAuAJ+wN9jzKwYpE54GaOAJiGEVippJREkF1X49iGwtB51zWJ9qFXotJmHOO55ap
+cjwWPtAwuqHIO9b2gfikiFlF4IJqKHFBz7m/Q=
+-----END OPENSSH PRIVATE KEY-----
diff --git a/inventories/desq_gaming/group_vars/linux/.ssh/svc_bf-ansible.pub b/inventories/desq_gaming/group_vars/linux/.ssh/svc_bf-ansible.pub
new file mode 100644
index 0000000..74ed2df
--- /dev/null
+++ b/inventories/desq_gaming/group_vars/linux/.ssh/svc_bf-ansible.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdQAWVjarXDVETrLk4DepHUkaDNVJl41IZuCUCDKLM9 svc_bf-ansible@desq_gaming
diff --git a/inventories/desq_gaming/group_vars/linux/main.yml b/inventories/desq_gaming/group_vars/linux/main.yml
index 90f94ab..90c473f 100644
--- a/inventories/desq_gaming/group_vars/linux/main.yml
+++ b/inventories/desq_gaming/group_vars/linux/main.yml
@@ -1,7 +1,7 @@
 # Linux / SSH variables
 ansible_connection: ssh
-ansible_user: svc_ansible
+ansible_user: svc_bf-ansible
 ansible_private_key_file: 
-  /etc/ansible/inventories/desq_gaming/group_vars/linux/.ssh/svc_ansible
+  /etc/ansible/inventories/desq_gaming/group_vars/linux/.ssh/svc_bf-ansible
 ansible_ssh_pass: '{{ ansible_vault_linux_ssh_pass }}'
 ansible_become_method: sudo
diff --git a/inventories/desq_gaming/group_vars/windows/main.yml b/inventories/desq_gaming/group_vars/windows/main.yml
index a8bfa4b..67f18ff 100644
--- a/inventories/desq_gaming/group_vars/windows/main.yml
+++ b/inventories/desq_gaming/group_vars/windows/main.yml
@@ -3,5 +3,5 @@ ansible_connection: winrm
 ansible_port: 5986
 ansible_winrm_transport: ntlm
 ansible_winrm_server_cert_validation: ignore
-ansible_user: svc_ansible
+ansible_user: svc_bf-ansible
 ansible_password: '{{ vault_windows_ansible_password }}'
diff --git a/inventories/desq_gaming/host_vars/DESKTOP-ROBERT.desq-gaming.lan/main.yml b/inventories/desq_gaming/host_vars/DESKTOP-ROBERT.desq-gaming.lan/main.yml
new file mode 100644
index 0000000..4f8fcb1
--- /dev/null
+++ b/inventories/desq_gaming/host_vars/DESKTOP-ROBERT.desq-gaming.lan/main.yml
@@ -0,0 +1,3 @@
+# AIM-managed host-specific Windows local service account credentials.
+ansible_user: svc_bf-ansible
+ansible_password: '{{ vault_ansible_password_desktop_robert_desq_gaming_lan }}'
diff --git a/inventories/desq_gaming/hosts.aim-session.bak.yml b/inventories/desq_gaming/hosts.aim-session.bak.yml
index dc1aef2..3dd7983 100644
--- a/inventories/desq_gaming/hosts.aim-session.bak.yml
+++ b/inventories/desq_gaming/hosts.aim-session.bak.yml
@@ -1,4 +1,99 @@
 all:
   children:
     desq_gaming:
-      children: {}
+      children:
+        linux:
+          children:
+            networking:
+              hosts:
+                dewenpm01.desq-gaming.lan:
+                  ansible_host: 192.168.20.3
+                dewedns02.desq-gaming.lan:
+                  ansible_host: 192.168.20.2
+                dewesrv-unifi02.desq-gaming.lan:
+                  ansible_host: 192.168.99.5
+
+            backup:
+              hosts:
+                dewepbs01.desq-gaming.lan:
+                  ansible_host: 192.168.99.32
+
+            proxmox:
+              hosts:
+                dewepbs01.desq-gaming.lan:
+                  ansible_host: 192.168.99.32
+                dewepve01.desq-gaming.lan:
+                  ansible_host: 192.168.99.31
+
+            hosting:
+              hosts:
+                dewepve01.desq-gaming.lan:
+                  ansible_host: 192.168.99.31
+                  
+            management:
+              hosts:
+                dewesrv-ansible01.desq-gaming.lan:
+                  ansible_host: 192.168.20.46
+                dewesrv-patch01.desq-gaming.lan:
+                  ansible_host: 192.168.20.45
+
+            applications:
+              hosts:
+                dewesrv-budget02.desq-gaming.lan:
+                  ansible_host: 192.168.20.44
+                dewesrv-cache02.desq-gaming.lan:
+                  ansible_host: 192.168.20.24
+                dewesrv-cloud01.desq-gaming.lan:
+                  ansible_host: 192.168.20.14
+                dewesrv-crafty02.desq-gaming.lan:
+                  ansible_host: 192.168.20.19
+                dewesrv-db01.desq-gaming.lan:
+                  ansible_host: 192.168.20.21
+                dewesrv-db02.desq-gaming.lan:
+                  ansible_host: 192.168.20.23
+                dewesrv-docker02.desq-gaming.lan:
+                  ansible_host: 192.168.20.30
+                dewesrv-git01.desq-gaming.lan:
+                  ansible_host: 192.168.20.38
+                dewesrv-grafana01.desq-gaming.lan:
+                  ansible_host: 192.168.20.22
+                dewesrv-ha01.desq-gaming.lan:
+                  ansible_host: 192.168.30.10
+                dewesrv-homarr01.desq-gaming.lan:
+                  ansible_host: 192.168.20.35
+                dewesrv-mail01.desq-gaming.lan:
+                  ansible_host: 192.168.20.40
+                dewesrv-nodejs01.desq-gaming.lan:
+                  ansible_host: 192.168.20.20
+                dewesrv-omv01.desq-gaming.lan:
+                  ansible_host: 192.168.20.15
+                dewesrv-overseerr01.desq-gaming.lan:
+                  ansible_host: 192.168.20.18
+                dewesrv-plex02.desq-gaming.lan:
+                  ansible_host: 192.168.20.39
+                dewesrv-puppet01.desq-gaming.lan:
+                  ansible_host: 192.168.20.25
+                dewesrv-recipe01.desq-gaming.lan:
+                  ansible_host: 192.168.20.37
+                dewesrv-rust02.desq-gaming.lan:
+                  ansible_host: 192.168.20.27
+                dewesrv-speed01.desq-gaming.lan:
+                  ansible_host: 192.168.20.16
+                dewesrv-steam01.desq-gaming.lan:
+                  ansible_host: 192.168.20.12
+                dewesrv-support01.desq-gaming.lan:
+                  ansible_host: 192.168.20.28
+                dewesrv-tautulli01.desq-gaming.lan:
+                  ansible_host: 192.168.20.17
+                dewesrv-tv01.desq-gaming.lan:
+                  ansible_host: 192.168.20.43
+                dewesrv-uptime01.desq-gaming.lan:
+                  ansible_host: 192.168.20.11
+                dewesrv-vault01.desq-gaming.lan:
+                  ansible_host: 192.168.20.34
+                dewesrv-wallos01.desq-gaming.lan:
+                  ansible_host: 192.168.20.29
+                dewesrv-wazuh01.desq-gaming.lan:
+                  ansible_host: 192.168.20.13
+                dewesrv-wiki01.desq-gaming.lan:
+                  ansible_host: 192.168.20.36
\ No newline at end of file
diff --git a/inventories/desq_gaming/hosts.yml b/inventories/desq_gaming/hosts.yml
index 3dd7983..b4c7e91 100644
--- a/inventories/desq_gaming/hosts.yml
+++ b/inventories/desq_gaming/hosts.yml
@@ -29,7 +29,7 @@ all:
               hosts:
                 dewepve01.desq-gaming.lan:
                   ansible_host: 192.168.99.31
-                  
+
             management:
               hosts:
                 dewesrv-ansible01.desq-gaming.lan:
@@ -96,4 +96,10 @@ all:
                 dewesrv-wazuh01.desq-gaming.lan:
                   ansible_host: 192.168.20.13
                 dewesrv-wiki01.desq-gaming.lan:
-                  ansible_host: 192.168.20.36
\ No newline at end of file
+                  ansible_host: 192.168.20.36
+        windows:
+          children:
+            client:
+              hosts:
+                DESKTOP-ROBERT.desq-gaming.lan:
+                  ansible_host: 192.168.10.11
diff --git a/playbooks/aim_catalog.yml b/playbooks/aim_catalog.yml
new file mode 100644
index 0000000..090d3a8
--- /dev/null
+++ b/playbooks/aim_catalog.yml
@@ -0,0 +1,1012 @@
+# AIM playbook catalog, not an executable playbook. No credentials belong in this file.
+# Only explicit run-time overrides are passed by AIM; inventory and role defaults remain authoritative.
+schema_version: 1
+release: 3.3.0rc8
+categories:
+- Checkmk
+- Debug
+- Maintenance
+- Sophos XGS
+- pfSense
+playbooks:
+- key: checkmk_install_agent
+  name: Install Checkmk agent
+  filename: checkmk_install_agent.yml
+  category: Checkmk
+  platforms:
+  - linux
+  - windows
+  description: Install staged agent packages, deploy selected checks, render 
+    Windows settings and ensure the agent is running.
+  inputs:
+  - name: aim_debug
+    label: Safe diagnostics
+    type: bool
+    default_hint: 'false'
+    help: Only selected non-secret diagnostics; normal outcomes stay visible.
+  - name: checkmk_unifi_mode
+    label: UniFi application
+    type: choice
+    default_hint: auto
+    help: Automatic detection prefers UniFi OS when present; only one local 
+      check/config is deployed.
+    platforms:
+    - linux
+    choices:
+    - auto
+    - network
+    - os
+    - disabled
+  - name: checkmk_unifi_username
+    label: UniFi monitoring username
+    type: text
+    default_hint: bf-monitoring
+    help: ''
+    platforms:
+    - linux
+  - name: checkmk_unifi_password
+    label: UniFi password variable
+    type: secret_ref
+    default_hint: vault_checkmk_unifi_password
+    help: Enter a Vault variable name, never its password. Required when a UniFi
+      check is selected.
+    platforms:
+    - linux
+  - name: checkmk_unifi_baseurl
+    label: UniFi controller URL
+    type: url
+    default_hint: 'network: https://127.0.0.1:8443; os: https://127.0.0.1:11443'
+    help: An explicit URL overrides the mode-specific default.
+    platforms:
+    - linux
+  - name: checkmk_unifi_curl_options
+    label: UniFi curl options
+    type: text
+    default_hint: ' --insecure --tlsv1.2'
+    help: Preserves the supplied TLS options. The shell configuration is safely 
+      quoted.
+    platforms:
+    - linux
+  - name: want_linux_check_certificate
+    label: Certificate directory check
+    type: bool
+    default_hint: 'false'
+    help: Optional check. Script-specific setup remains in the maintained script
+      repository.
+    platforms:
+    - linux
+  - name: want_windows_citrix
+    label: Citrix sessions check
+    type: bool
+    default_hint: 'false'
+    help: Optional check. Script-specific setup remains in the maintained script
+      repository.
+    platforms:
+    - windows
+  - name: want_windows_surebackup
+    label: Veeam SureBackup check
+    type: bool
+    default_hint: 'false'
+    help: Optional check. Script-specific setup remains in the maintained script
+      repository.
+    platforms:
+    - windows
+  - name: want_windows_backup
+    label: Windows Backup check
+    type: bool
+    default_hint: 'false'
+    help: Optional check. Script-specific setup remains in the maintained script
+      repository.
+    platforms:
+    - windows
+  - name: want_windows_nsp_mailqueue
+    label: NSP mail queue check
+    type: bool
+    default_hint: 'false'
+    help: Optional check. Script-specific setup remains in the maintained script
+      repository.
+    platforms:
+    - windows
+  - name: want_windows_certificate
+    label: Windows certificate check
+    type: bool
+    default_hint: 'false'
+    help: Optional check. Script-specific setup remains in the maintained script
+      repository.
+    platforms:
+    - windows
+  - name: want_windows_veeam_cloud_connect
+    label: Veeam Cloud Connect check
+    type: bool
+    default_hint: 'false'
+    help: Optional check. Script-specific setup remains in the maintained script
+      repository.
+    platforms:
+    - windows
+  - name: want_windows_veeam_backup
+    label: Repository Veeam backup plugin
+    type: bool
+    default_hint: 'false'
+    help: Optional check. Script-specific setup remains in the maintained script
+      repository.
+    platforms:
+    - windows
+  - name: checkmk_unifi_status_provisioning
+    label: 'UniFi status: provisioning'
+    type: int
+    default_hint: '1'
+    help: 0 OK, 1 WARN, 2 CRIT, 3 UNKNOWN.
+    platforms:
+    - linux
+    minimum: 0
+    maximum: 3
+  - name: checkmk_unifi_status_upgrading
+    label: 'UniFi status: upgrading'
+    type: int
+    default_hint: '1'
+    help: 0 OK, 1 WARN, 2 CRIT, 3 UNKNOWN.
+    platforms:
+    - linux
+    minimum: 0
+    maximum: 3
+  - name: checkmk_unifi_status_upgradable
+    label: 'UniFi status: upgradable'
+    type: int
+    default_hint: '0'
+    help: 0 OK, 1 WARN, 2 CRIT, 3 UNKNOWN.
+    platforms:
+    - linux
+    minimum: 0
+    maximum: 3
+  - name: checkmk_unifi_status_heartbeat_missed
+    label: 'UniFi status: heartbeat_missed'
+    type: int
+    default_hint: '1'
+    help: 0 OK, 1 WARN, 2 CRIT, 3 UNKNOWN.
+    platforms:
+    - linux
+    minimum: 0
+    maximum: 3
+  - name: checkmk_unifi_status_noautobackup
+    label: 'UniFi status: noautobackup'
+    type: int
+    default_hint: '0'
+    help: 0 OK, 1 WARN, 2 CRIT, 3 UNKNOWN.
+    platforms:
+    - linux
+    minimum: 0
+    maximum: 3
+  - name: checkmk_windows_updates_timeout
+    label: Windows Updates timeout
+    type: int
+    default_hint: '3600'
+    help: Seconds. Unchanged options continue to inherit inventory/defaults.
+    platforms:
+    - windows
+    minimum: 0
+  - name: checkmk_windows_updates_cache
+    label: Windows Updates cache
+    type: int
+    default_hint: '43200'
+    help: Seconds. Unchanged options continue to inherit inventory/defaults.
+    platforms:
+    - windows
+    minimum: 0
+  - name: checkmk_mk_inventory_timeout
+    label: Inventory plugin timeout
+    type: int
+    default_hint: '120'
+    help: Seconds. Unchanged options continue to inherit inventory/defaults.
+    platforms:
+    - windows
+    minimum: 0
+  - name: checkmk_plugins_default_timeout
+    label: Plugin default timeout
+    type: int
+    default_hint: '120'
+    help: Seconds. Unchanged options continue to inherit inventory/defaults.
+    platforms:
+    - windows
+    minimum: 0
+  - name: checkmk_plugins_default_cache
+    label: Plugin default cache
+    type: int
+    default_hint: '600'
+    help: Seconds. Unchanged options continue to inherit inventory/defaults.
+    platforms:
+    - windows
+    minimum: 0
+  - name: checkmk_extra_plugin_patterns
+    label: Extra Windows plugin rules
+    type: sequence
+    default_hint: '[]'
+    help: YAML/JSON list of rule mappings; see role documentation.
+    platforms:
+    - windows
+  become_platforms:
+  - linux
+  warning: Installs packages and replaces AIM-managed script files. On Windows, 
+    AIM replaces only the marked plugins section in check_mk.user.yml; other 
+    user-config sections are preserved. UniFi deployment also removes the 
+    alternative UniFi local check; no other cleanup is performed.
+  requirements:
+  - ansible.windows
+  result:
+    protocol: aim_output_v1
+    schema: checkmk_agent_state_v1
+    scope: per_host
+    required: true
+    sensitivity: safe
+    max_bytes_per_host: 1048576
+    schema_file: checkmk_agent_state_v1.yml
+- key: checkmk_update_scripts_config
+  name: Update Checkmk scripts and configuration
+  filename: checkmk_update_scripts_config.yml
+  category: Checkmk
+  platforms:
+  - linux
+  - windows
+  description: Deploy selected checks and Windows configuration without 
+    installing agent packages.
+  inputs:
+  - name: aim_debug
+    label: Safe diagnostics
+    type: bool
+    default_hint: 'false'
+    help: Only selected non-secret diagnostics; normal outcomes stay visible.
+  - name: checkmk_unifi_mode
+    label: UniFi application
+    type: choice
+    default_hint: auto
+    help: Automatic detection prefers UniFi OS when present; only one local 
+      check/config is deployed.
+    platforms:
+    - linux
+    choices:
+    - auto
+    - network
+    - os
+    - disabled
+  - name: checkmk_unifi_username
+    label: UniFi monitoring username
+    type: text
+    default_hint: bf-monitoring
+    help: ''
+    platforms:
+    - linux
+  - name: checkmk_unifi_password
+    label: UniFi password variable
+    type: secret_ref
+    default_hint: vault_checkmk_unifi_password
+    help: Enter a Vault variable name, never its password. Required when a UniFi
+      check is selected.
+    platforms:
+    - linux
+  - name: checkmk_unifi_baseurl
+    label: UniFi controller URL
+    type: url
+    default_hint: 'network: https://127.0.0.1:8443; os: https://127.0.0.1:11443'
+    help: An explicit URL overrides the mode-specific default.
+    platforms:
+    - linux
+  - name: checkmk_unifi_curl_options
+    label: UniFi curl options
+    type: text
+    default_hint: ' --insecure --tlsv1.2'
+    help: Preserves the supplied TLS options. The shell configuration is safely 
+      quoted.
+    platforms:
+    - linux
+  - name: want_linux_check_certificate
+    label: Certificate directory check
+    type: bool
+    default_hint: 'false'
+    help: Optional check. Script-specific setup remains in the maintained script
+      repository.
+    platforms:
+    - linux
+  - name: want_windows_citrix
+    label: Citrix sessions check
+    type: bool
+    default_hint: 'false'
+    help: Optional check. Script-specific setup remains in the maintained script
+      repository.
+    platforms:
+    - windows
+  - name: want_windows_surebackup
+    label: Veeam SureBackup check
+    type: bool
+    default_hint: 'false'
+    help: Optional check. Script-specific setup remains in the maintained script
+      repository.
+    platforms:
+    - windows
+  - name: want_windows_backup
+    label: Windows Backup check
+    type: bool
+    default_hint: 'false'
+    help: Optional check. Script-specific setup remains in the maintained script
+      repository.
+    platforms:
+    - windows
+  - name: want_windows_nsp_mailqueue
+    label: NSP mail queue check
+    type: bool
+    default_hint: 'false'
+    help: Optional check. Script-specific setup remains in the maintained script
+      repository.
+    platforms:
+    - windows
+  - name: want_windows_certificate
+    label: Windows certificate check
+    type: bool
+    default_hint: 'false'
+    help: Optional check. Script-specific setup remains in the maintained script
+      repository.
+    platforms:
+    - windows
+  - name: want_windows_veeam_cloud_connect
+    label: Veeam Cloud Connect check
+    type: bool
+    default_hint: 'false'
+    help: Optional check. Script-specific setup remains in the maintained script
+      repository.
+    platforms:
+    - windows
+  - name: want_windows_veeam_backup
+    label: Repository Veeam backup plugin
+    type: bool
+    default_hint: 'false'
+    help: Optional check. Script-specific setup remains in the maintained script
+      repository.
+    platforms:
+    - windows
+  - name: checkmk_unifi_status_provisioning
+    label: 'UniFi status: provisioning'
+    type: int
+    default_hint: '1'
+    help: 0 OK, 1 WARN, 2 CRIT, 3 UNKNOWN.
+    platforms:
+    - linux
+    minimum: 0
+    maximum: 3
+  - name: checkmk_unifi_status_upgrading
+    label: 'UniFi status: upgrading'
+    type: int
+    default_hint: '1'
+    help: 0 OK, 1 WARN, 2 CRIT, 3 UNKNOWN.
+    platforms:
+    - linux
+    minimum: 0
+    maximum: 3
+  - name: checkmk_unifi_status_upgradable
+    label: 'UniFi status: upgradable'
+    type: int
+    default_hint: '0'
+    help: 0 OK, 1 WARN, 2 CRIT, 3 UNKNOWN.
+    platforms:
+    - linux
+    minimum: 0
+    maximum: 3
+  - name: checkmk_unifi_status_heartbeat_missed
+    label: 'UniFi status: heartbeat_missed'
+    type: int
+    default_hint: '1'
+    help: 0 OK, 1 WARN, 2 CRIT, 3 UNKNOWN.
+    platforms:
+    - linux
+    minimum: 0
+    maximum: 3
+  - name: checkmk_unifi_status_noautobackup
+    label: 'UniFi status: noautobackup'
+    type: int
+    default_hint: '0'
+    help: 0 OK, 1 WARN, 2 CRIT, 3 UNKNOWN.
+    platforms:
+    - linux
+    minimum: 0
+    maximum: 3
+  - name: checkmk_windows_updates_timeout
+    label: Windows Updates timeout
+    type: int
+    default_hint: '3600'
+    help: Seconds. Unchanged options continue to inherit inventory/defaults.
+    platforms:
+    - windows
+    minimum: 0
+  - name: checkmk_windows_updates_cache
+    label: Windows Updates cache
+    type: int
+    default_hint: '43200'
+    help: Seconds. Unchanged options continue to inherit inventory/defaults.
+    platforms:
+    - windows
+    minimum: 0
+  - name: checkmk_mk_inventory_timeout
+    label: Inventory plugin timeout
+    type: int
+    default_hint: '120'
+    help: Seconds. Unchanged options continue to inherit inventory/defaults.
+    platforms:
+    - windows
+    minimum: 0
+  - name: checkmk_plugins_default_timeout
+    label: Plugin default timeout
+    type: int
+    default_hint: '120'
+    help: Seconds. Unchanged options continue to inherit inventory/defaults.
+    platforms:
+    - windows
+    minimum: 0
+  - name: checkmk_plugins_default_cache
+    label: Plugin default cache
+    type: int
+    default_hint: '600'
+    help: Seconds. Unchanged options continue to inherit inventory/defaults.
+    platforms:
+    - windows
+    minimum: 0
+  - name: checkmk_extra_plugin_patterns
+    label: Extra Windows plugin rules
+    type: sequence
+    default_hint: '[]'
+    help: YAML/JSON list of rule mappings; see role documentation.
+    platforms:
+    - windows
+  become_platforms:
+  - linux
+  warning: Deploys AIM-managed script files and, on Windows, replaces only the 
+    marked plugins section in check_mk.user.yml. Other user-config sections are 
+    preserved. Only the opposite UniFi check is removed during a UniFi mode 
+    transition.
+  requirements:
+  - ansible.windows
+  result:
+    protocol: aim_output_v1
+    schema: checkmk_agent_config_v1
+    scope: per_host
+    required: true
+    sensitivity: safe
+    max_bytes_per_host: 1048576
+    schema_file: checkmk_agent_config_v1.yml
+- key: checkmk_read_windows_config
+  name: Read Windows Checkmk config
+  filename: checkmk_read_windows_config.yml
+  category: Checkmk
+  platforms:
+  - windows
+  description: Display the current Windows check_mk.user.yml, including its path
+    and file metadata, without modifying the host.
+  inputs:
+  - name: aim_debug
+    label: Safe diagnostics
+    type: bool
+    default_hint: 'false'
+    help: Only selected non-secret diagnostics; normal outcomes stay visible.
+  - name: checkmk_windows_user_cfg
+    label: Checkmk user config path
+    type: text
+    default_hint: C:\ProgramData\checkmk\agent\check_mk.user.yml
+    help: Override only when the Windows agent uses a nonstandard 
+      user-configuration path.
+    platforms:
+    - windows
+  requirements:
+  - ansible.windows
+  result:
+    protocol: aim_output_v1
+    schema: checkmk_user_config_v1
+    scope: per_host
+    required: true
+    sensitivity: safe
+    max_bytes_per_host: 1048576
+    schema_file: checkmk_user_config_v1.yml
+- key: checkmk_cleanup_scripts
+  name: Preview / clean up Checkmk scripts
+  filename: checkmk_cleanup_scripts.yml
+  category: Checkmk
+  platforms:
+  - linux
+  - windows
+  description: List obsolete managed script paths; remove them only with 
+    explicit deletion approval.
+  inputs:
+  - name: aim_debug
+    label: Safe diagnostics
+    type: bool
+    default_hint: 'false'
+    help: Only selected non-secret diagnostics; normal outcomes stay visible.
+  - name: checkmk_cleanup_enabled
+    label: Permit managed-script deletion
+    type: bool
+    default_hint: 'false'
+    help: Required for cleanup execution. False previews candidate paths without
+      deleting them.
+  - name: checkmk_unifi_mode
+    label: UniFi application
+    type: choice
+    default_hint: auto
+    help: Automatic detection prefers UniFi OS when present; only one local 
+      check/config is deployed.
+    platforms:
+    - linux
+    choices:
+    - auto
+    - network
+    - os
+    - disabled
+  - name: want_linux_check_certificate
+    label: Certificate directory check
+    type: bool
+    default_hint: 'false'
+    help: Optional check. Script-specific setup remains in the maintained script
+      repository.
+    platforms:
+    - linux
+  - name: want_windows_citrix
+    label: Citrix sessions check
+    type: bool
+    default_hint: 'false'
+    help: Optional check. Script-specific setup remains in the maintained script
+      repository.
+    platforms:
+    - windows
+  - name: want_windows_surebackup
+    label: Veeam SureBackup check
+    type: bool
+    default_hint: 'false'
+    help: Optional check. Script-specific setup remains in the maintained script
+      repository.
+    platforms:
+    - windows
+  - name: want_windows_backup
+    label: Windows Backup check
+    type: bool
+    default_hint: 'false'
+    help: Optional check. Script-specific setup remains in the maintained script
+      repository.
+    platforms:
+    - windows
+  - name: want_windows_nsp_mailqueue
+    label: NSP mail queue check
+    type: bool
+    default_hint: 'false'
+    help: Optional check. Script-specific setup remains in the maintained script
+      repository.
+    platforms:
+    - windows
+  - name: want_windows_certificate
+    label: Windows certificate check
+    type: bool
+    default_hint: 'false'
+    help: Optional check. Script-specific setup remains in the maintained script
+      repository.
+    platforms:
+    - windows
+  - name: want_windows_veeam_cloud_connect
+    label: Veeam Cloud Connect check
+    type: bool
+    default_hint: 'false'
+    help: Optional check. Script-specific setup remains in the maintained script
+      repository.
+    platforms:
+    - windows
+  - name: want_windows_veeam_backup
+    label: Repository Veeam backup plugin
+    type: bool
+    default_hint: 'false'
+    help: Optional check. Script-specific setup remains in the maintained script
+      repository.
+    platforms:
+    - windows
+  become_platforms:
+  - linux
+  warning: Cleanup only touches the documented managed filenames. Preview is the
+    default; enabling deletion requires another confirmation.
+  requirements:
+  - ansible.windows
+  result:
+    protocol: aim_output_v1
+    schema: managed_cleanup_preview_v1
+    scope: per_host
+    required: true
+    sensitivity: safe
+    max_bytes_per_host: 1048576
+    schema_file: managed_cleanup_preview_v1.yml
+- key: debug_test_connection
+  name: Test Ansible connection
+  filename: debug_test_connection.yml
+  category: Debug
+  platforms:
+  - linux
+  - windows
+  description: Check Ansible manageability using ping or win_ping; this is not 
+    an ICMP ping.
+  inputs:
+  - name: aim_debug
+    label: Safe diagnostics
+    type: bool
+    default_hint: 'false'
+    help: Only selected non-secret diagnostics; normal outcomes stay visible.
+  requirements:
+  - ansible.windows
+- key: debug_show_disk_usage
+  name: Show disk usage
+  filename: debug_show_disk_usage.yml
+  category: Debug
+  platforms:
+  - linux
+  - windows
+  description: Report attached Windows storage volumes and common operational Linux mounts, including network/storage filesystems.
+  inputs:
+  - name: aim_debug
+    label: Safe diagnostics
+    type: bool
+    default_hint: 'false'
+    help: Only selected non-secret diagnostics; normal outcomes stay visible.
+  requirements:
+  - ansible.windows
+  - community.windows
+  result:
+    protocol: aim_output_v1
+    schema: filesystem_usage_v1
+    scope: per_host
+    required: true
+    sensitivity: safe
+    max_bytes_per_host: 1048576
+    schema_file: filesystem_usage_v1.yml
+- key: debug_detect_host_roles
+  name: Detect host roles
+  filename: debug_detect_host_roles.yml
+  category: Debug
+  platforms:
+  - linux
+  - windows
+  description: Report detected AD, DHCP, Hyper-V, Veeam and UniFi capabilities 
+    without changing inventory memberships.
+  inputs:
+  - name: aim_debug
+    label: Safe diagnostics
+    type: bool
+    default_hint: 'false'
+    help: Only selected non-secret diagnostics; normal outcomes stay visible.
+  requirements:
+  - ansible.windows
+  result:
+    protocol: aim_output_v1
+    schema: host_capabilities_v1
+    scope: per_host
+    required: true
+    sensitivity: safe
+    max_bytes_per_host: 1048576
+    schema_file: host_capabilities_v1.yml
+- key: maintenance_export_event_logs
+  name: Export Windows event logs
+  filename: maintenance_export_event_logs.yml
+  category: Maintenance
+  platforms:
+  - windows
+  description: Export selected event channels to EVTX files on the target; 
+    existing event logs are not cleared.
+  inputs:
+  - name: aim_debug
+    label: Safe diagnostics
+    type: bool
+    default_hint: 'false'
+    help: Only selected non-secret diagnostics; normal outcomes stay visible.
+  - name: event_age_days
+    label: Event age in days
+    type: int
+    default_hint: '45'
+    help: Export events from the last N days, without clearing the logs.
+    minimum: 1
+    maximum: 36500
+  - name: export_folder
+    label: Target export folder
+    type: text
+    default_hint: C:\Logs
+    help: Directory on each Windows target, not on the Ansible controller.
+  - name: event_log_channels
+    label: Event channels
+    type: list
+    default_hint: Application, Security, System, Setup
+    help: Event channels to export.
+  requirements:
+  - ansible.windows
+  result:
+    protocol: aim_output_v1
+    schema: event_log_export_v1
+    scope: per_host
+    required: true
+    sensitivity: safe
+    max_bytes_per_host: 1048576
+    schema_file: event_log_export_v1.yml
+- key: maintenance_start_stopped_services
+  name: Start stopped automatic services
+  filename: maintenance_start_stopped_services.yml
+  category: Maintenance
+  platforms:
+  - windows
+  description: Start eligible stopped services, apply optional include/exclude 
+    lists and report partial failures.
+  inputs:
+  - name: aim_debug
+    label: Safe diagnostics
+    type: bool
+    default_hint: 'false'
+    help: Only selected non-secret diagnostics; normal outcomes stay visible.
+  - name: maintenance_service_include
+    label: Service allowlist
+    type: list
+    default_hint: '[]'
+    help: Empty list selects all stopped automatic/delayed-start services; use 
+      internal service names.
+  - name: maintenance_service_exclude
+    label: Service exclusions
+    type: list
+    default_hint: '[]'
+    help: Excluded internal service names are never started.
+  - name: maintenance_service_fail_on_error
+    label: Fail after partial failure
+    type: bool
+    default_hint: 'true'
+    help: Always reports individual failures; true makes the final task fail 
+      when any start failed.
+  requirements:
+  - ansible.windows
+  result:
+    protocol: aim_output_v1
+    schema: service_start_summary_v1
+    scope: per_host
+    required: true
+    sensitivity: safe
+    max_bytes_per_host: 1048576
+    schema_file: service_start_summary_v1.yml
+- key: maintenance_patch_os
+  name: Patch operating systems
+  filename: maintenance_patch_os.yml
+  category: Maintenance
+  platforms:
+  - linux
+  - windows
+  description: Apply updates on Windows, Debian and RedHat-family systems; 
+    optionally notify users and reboot when required.
+  inputs:
+  - name: aim_debug
+    label: Safe diagnostics
+    type: bool
+    default_hint: 'false'
+    help: Only selected non-secret diagnostics; normal outcomes stay visible.
+  - name: os_patching_reboot
+    label: Reboot when required
+    type: bool
+    default_hint: 'true'
+    help: Patching may reboot each selected host. False installs without an 
+      automatic reboot.
+  - name: os_patching_windows_categories
+    label: Windows update categories
+    type: list
+    default_hint: SecurityUpdates, CriticalUpdates, UpdateRollups, 
+      DefinitionUpdates, Updates
+    help: Enter a YAML/JSON list or comma-separated category names.
+    platforms:
+    - windows
+    choices:
+    - SecurityUpdates
+    - CriticalUpdates
+    - UpdateRollups
+    - DefinitionUpdates
+    - Updates
+    - Drivers
+    - FeaturePacks
+    - ServicePacks
+    - Tools
+    - Upgrades
+    - '*'
+  - name: os_patching_serial
+    label: Batch size
+    type: serial
+    default_hint: 100%
+    help: Positive host count or percentage. Applies independently to each 
+      platform play.
+  - name: os_patching_reboot_timeout
+    label: Reboot timeout
+    type: int
+    default_hint: '600'
+    help: Seconds to wait for a Windows/Linux host to reboot and become 
+      manageable again.
+    minimum: 1
+  - name: os_patching_reboot_delay_minutes
+    label: Reboot delay (minutes)
+    type: int
+    default_hint: '0'
+    help: Delay before an AIM-initiated reboot. Linux scheduling is 
+      minute-granular; 0 requests immediate/platform-minimum reboot.
+    minimum: 0
+    maximum: 1440
+  - name: os_patching_reboot_message
+    label: Reboot message
+    type: text
+    default_hint: 'AIM maintenance: operating system patching requires a reboot.'
+    help: Message shown to logged-in users before an AIM-initiated Windows/Linux
+      reboot.
+  - name: os_patching_rescan_after_reboot
+    label: Continue patching after reboot
+    type: bool
+    default_hint: 'false'
+    help: Windows only. False stops after the first patch-triggered reboot so the next
+      patch wave requires a new operator-approved run. True rediscovers applicable
+      updates after reboot and starts another native Windows Update wave.
+    platforms:
+    - windows
+  become_platforms:
+  - linux
+  warning: Updates production operating systems. Windows uses the native win_updates wave behavior with AIM-controlled reboots. A reboot boundary stops the run by default; continuing into a newly discovered post-reboot wave requires explicit opt-in. If automatic reboot is disabled, a newly required reboot is reported as deferred.
+  requirements:
+  - ansible.windows
+  result:
+    protocol: aim_output_v1
+    schema: patch_summary_v1
+    scope: per_host
+    required: true
+    sensitivity: safe
+    max_bytes_per_host: 1048576
+    schema_file: patch_summary_v1.yml
+- key: maintenance_reboot_hosts
+  name: Reboot hosts
+  filename: maintenance_reboot_hosts.yml
+  category: Maintenance
+  platforms:
+  - linux
+  - windows
+  description: Reboot selected hosts in batches and wait for management 
+    connectivity.
+  inputs:
+  - name: aim_debug
+    label: Safe diagnostics
+    type: bool
+    default_hint: 'false'
+    help: Only selected non-secret diagnostics; normal outcomes stay visible.
+  - name: maintenance_reboot_serial
+    label: Batch size
+    type: serial
+    default_hint: '10'
+    help: Positive host count or percentage.
+  - name: maintenance_reboot_timeout
+    label: Reboot timeout
+    type: int
+    default_hint: '1800'
+    help: Seconds.
+    minimum: 1
+  - name: maintenance_reboot_message
+    label: Reboot message
+    type: text
+    default_hint: Reboot initiated by debsansible01.bfmiglabor.lan (Ansible)
+    help: ''
+  - name: maintenance_reboot_pre_delay
+    label: Delay before reboot
+    type: int
+    default_hint: '0'
+    help: Seconds; Windows enforces a minimum of two seconds.
+    minimum: 0
+  - name: maintenance_reboot_post_delay
+    label: Delay after reboot
+    type: int
+    default_hint: '15'
+    help: Seconds.
+    minimum: 0
+  become_platforms:
+  - linux
+  warning: Every selected host will be rebooted. No reboot occurs before final 
+    confirmation.
+  requirements:
+  - ansible.windows
+- key: sophos_apply_baseline
+  name: Apply bitformer Sophos baseline
+  filename: sophos_apply_baseline.yml
+  category: Sophos XGS
+  platforms:
+  - sophosxgs
+  description: Apply the supplied bitformer firewall baseline. Existing policy 
+    values and action order are preserved.
+  inputs:
+  - name: aim_debug
+    label: Safe diagnostics
+    type: bool
+    default_hint: 'false'
+    help: Only selected non-secret diagnostics; normal outcomes stay visible.
+  ask_pass: true
+  require_vault: true
+  warning: Changes firewall management access, objects and rules, including rule
+    removal and a final drop rule. Policy values have NOT been redesigned.
+  requirements:
+  - ansible.netcommon
+  - sophos.sophos_firewall
+- key: sophos_apply_customer
+  name: Apply customer Sophos configuration
+  filename: sophos_apply_customer.yml
+  category: Sophos XGS
+  platforms:
+  - sophosxgs
+  description: Apply this customer profile using hostname, network_objects and 
+    vlan_interfaces from inventory.
+  inputs:
+  - name: aim_debug
+    label: Safe diagnostics
+    type: bool
+    default_hint: 'false'
+    help: Only selected non-secret diagnostics; normal outcomes stay visible.
+  ask_pass: true
+  require_vault: true
+  customer_specific: true
+  warning: Changes customer firewall configuration. VLAN parent remains Port1 as
+    in the supplied playbooks. Only this customer profile is selected.
+  requirements:
+  - ansible.netcommon
+  - sophos.sophos_firewall
+- key: pfsense_apply_baseline
+  name: Apply bitformer pfSense baseline
+  filename: pfsense_apply_baseline.yml
+  category: pfSense
+  platforms:
+  - pfsense
+  description: Apply the supplied pfSense baseline without changing its 
+    firewall/VPN policy.
+  inputs:
+  - name: aim_debug
+    label: Safe diagnostics
+    type: bool
+    default_hint: 'false'
+    help: Only selected non-secret diagnostics; normal outcomes stay visible.
+  become_platforms:
+  - pfsense
+  warning: Contains the original any-source WAN management rule for ports 
+    22/80/443. The original CA, VPN endpoint and client certificate reference 
+    are unchanged; verify them before execution. Requires separately approved 
+    pfsensible.core installation.
+  requirements:
+  - pfsensible.core
+sophos_profiles:
+  bluuunit:
+    required_network_keys:
+    - derz_lan
+    - derz_sslvpn
+    - facility
+    - guest
+    - lan_old
+    - management
+    - office
+    - server
+    - voip
+    vlan_parent: Port1
+  formicon:
+    required_network_keys:
+    - azuregwc_lan
+    - lan_old
+    - management
+    - office
+    vlan_parent: Port1
+  gebhardt_stahl:
+    required_network_keys:
+    - drucker
+    - guest
+    - office
+    - wlan
+    vlan_parent: Port1
+  hungeling_und_toechter:
+    required_network_keys:
+    - facility
+    - guest
+    - management
+    - office
+    - voip
+    vlan_parent: Port1
+  koenig_holding_gmbh:
+    required_network_keys:
+    - facility
+    - guest
+    - management
+    - office
+    - server
+    - voip
+    vlan_parent: Port1
diff --git a/playbooks/checkmk_cleanup.yml b/playbooks/checkmk_cleanup.yml
deleted file mode 100644
index 5a322e3..0000000
--- a/playbooks/checkmk_cleanup.yml
+++ /dev/null
@@ -1,64 +0,0 @@
----
-- name: "Checkmk | Cleanup agent"
-  hosts: all
-  gather_facts: true
-
-  tasks:
-    - name: "Windows | Remove installed Checkmk agent"
-      when: ansible_facts['os_family'] == 'Windows'
-      ansible.windows.win_powershell:
-        script: |
-          $Ansible.Changed = $false
-          $uninstallRoots = @(
-            'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall',
-            'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall'
-          )
-
-          $products = foreach ($root in $uninstallRoots) {
-            if (Test-Path -LiteralPath $root) {
-              Get-ChildItem -LiteralPath $root -ErrorAction SilentlyContinue |
-                ForEach-Object {
-                  $product = Get-ItemProperty -LiteralPath $_.PSPath -ErrorAction SilentlyContinue
-                  if ($product.DisplayName -like 'Check MK Agent*' -or
-                      $product.DisplayName -like 'Checkmk Agent*') {
-                    [PSCustomObject]@{
-                      ProductCode = $_.PSChildName
-                      DisplayName = $product.DisplayName
-                    }
-                  }
-                }
-            }
-          }
-
-          foreach ($product in $products) {
-            if ($product.ProductCode -match '^\{[0-9A-Fa-f-]+\}$') {
-              $process = Start-Process -FilePath 'msiexec.exe' `
-                -ArgumentList "/x $($product.ProductCode) /qn /norestart" `
-                -Wait -PassThru
-
-              if ($process.ExitCode -notin @(0, 1605, 1614, 3010)) {
-                throw "Failed to uninstall $($product.DisplayName). MSI exit code: $($process.ExitCode)"
-              }
-
-              if ($process.ExitCode -in @(0, 3010)) {
-                $Ansible.Changed = $true
-              }
-            }
-          }
-
-          $Ansible.Result = @{
-            removed_products = @($products.DisplayName)
-          }
-
-    - name: "Debian | Remove Checkmk agent"
-      when: ansible_facts['os_family'] == 'Debian'
-      ansible.builtin.apt:
-        name: check-mk-agent
-        state: absent
-        purge: true
-
-    - name: "RedHat | Remove Checkmk agent"
-      when: ansible_facts['os_family'] == 'RedHat'
-      ansible.builtin.dnf:
-        name: check-mk-agent
-        state: absent
diff --git a/playbooks/checkmk_cleanup_scripts.yml b/playbooks/checkmk_cleanup_scripts.yml
new file mode 100644
index 0000000..e81b62f
--- /dev/null
+++ b/playbooks/checkmk_cleanup_scripts.yml
@@ -0,0 +1,75 @@
+---
+# PURPOSE: Preview / clean up Checkmk scripts
+# DESCRIPTION: List obsolete managed script paths; remove them only with explicit deletion approval.
+# TARGETS: linux, windows
+# INPUTS (omitted values inherit inventory / role defaults):
+#   aim_debug [bool]: false
+#   checkmk_cleanup_enabled [bool]: false
+#   checkmk_unifi_mode [choice]: auto
+#   want_linux_check_certificate [bool]: false
+#   want_windows_citrix [bool]: false
+#   want_windows_surebackup [bool]: false
+#   want_windows_backup [bool]: false
+#   want_windows_nsp_mailqueue [bool]: false
+#   want_windows_certificate [bool]: false
+#   want_windows_veeam_cloud_connect [bool]: false
+#   want_windows_veeam_backup [bool]: false
+# AUTH: existing inventory / Vault credentials; no embedded passwords.
+# CHANGES: Cleanup only touches the documented managed filenames. Preview is the default; enabling deletion requires another confirmation.
+# EXAMPLE: ansible-playbook -i inventories/<customer>/hosts.yml
+#          playbooks/checkmk_cleanup_scripts.yml --limit <host> --vault-id <customer>@prompt
+- name: Checkmk | Preview or clean up linux
+  hosts: linux
+  gather_facts: true
+  pre_tasks:
+    - name: AIM | Validate diagnostics option
+      ansible.builtin.assert:
+        that:
+          - (aim_debug | default(false)) is boolean or (aim_debug | default(false) | string | lower) in ['true',
+            'false']
+        fail_msg: aim_debug must be a YAML/JSON boolean.
+        quiet: true
+    - name: AIM | Reject mixed platform membership
+      ansible.builtin.assert:
+        that:
+          - (group_names | intersect(['linux', 'windows', 'sophosxgs', 'pfsense']) | length) <= 1
+        fail_msg: This host belongs to incompatible platform groups. Use globally unique subgroups.
+        quiet: true
+    - name: AIM | Execution context
+      ansible.builtin.debug:
+        msg:
+          host: '{{ inventory_hostname }}'
+          diagnostics: Enabled; secret values are never included by this task.
+      when: aim_debug | default(false) | bool
+  become: true
+  roles:
+    - role: system_detect_roles
+    - role: checkmk_script_plan
+    - role: checkmk_cleanup_scripts
+- name: Checkmk | Preview or clean up windows
+  hosts: windows
+  gather_facts: true
+  pre_tasks:
+    - name: AIM | Validate diagnostics option
+      ansible.builtin.assert:
+        that:
+          - (aim_debug | default(false)) is boolean or (aim_debug | default(false) | string | lower) in ['true',
+            'false']
+        fail_msg: aim_debug must be a YAML/JSON boolean.
+        quiet: true
+    - name: AIM | Reject mixed platform membership
+      ansible.builtin.assert:
+        that:
+          - (group_names | intersect(['linux', 'windows', 'sophosxgs', 'pfsense']) | length) <= 1
+        fail_msg: This host belongs to incompatible platform groups. Use globally unique subgroups.
+        quiet: true
+    - name: AIM | Execution context
+      ansible.builtin.debug:
+        msg:
+          host: '{{ inventory_hostname }}'
+          diagnostics: Enabled; secret values are never included by this task.
+      when: aim_debug | default(false) | bool
+  roles:
+    - role: system_detect_roles
+    - role: checkmk_script_plan
+    - role: checkmk_cleanup_scripts
diff --git a/playbooks/checkmk_deploy.yml b/playbooks/checkmk_deploy.yml
deleted file mode 100644
index 2224998..0000000
--- a/playbooks/checkmk_deploy.yml
+++ /dev/null
@@ -1,10 +0,0 @@
----
-- name: "Checkmk | Deploy agent, scripts and configuration"
-  hosts: all
-  gather_facts: true
-
-  roles:
-    - checkmk_agent
-    - server_role_selection
-    - checkmk_scripts
-    - checkmk_agent_config
diff --git a/playbooks/checkmk_install_agent.yml b/playbooks/checkmk_install_agent.yml
new file mode 100644
index 0000000..4836aa3
--- /dev/null
+++ b/playbooks/checkmk_install_agent.yml
@@ -0,0 +1,136 @@
+# PURPOSE: Install Checkmk agent
+# DESCRIPTION: Install staged agent packages, deploy selected checks, render Windows settings and ensure the agent is running.
+# TARGETS: linux, windows
+# INPUTS (omitted values inherit inventory / role defaults):
+#   aim_debug [bool]: false
+#   checkmk_unifi_mode [choice]: auto
+#   checkmk_unifi_username [text]: bf-monitoring
+#   checkmk_unifi_password [secret_ref]: vault_checkmk_unifi_password
+#   checkmk_unifi_baseurl [url]: network: https://127.0.0.1:8443; os: https://127.0.0.1:11443
+#   checkmk_unifi_curl_options [text]:  --insecure --tlsv1.2
+#   want_linux_check_certificate [bool]: false
+#   want_windows_citrix [bool]: false
+#   want_windows_surebackup [bool]: false
+#   want_windows_backup [bool]: false
+#   want_windows_nsp_mailqueue [bool]: false
+#   want_windows_certificate [bool]: false
+#   want_windows_veeam_cloud_connect [bool]: false
+#   want_windows_veeam_backup [bool]: false
+#   checkmk_unifi_status_provisioning [int]: 1
+#   checkmk_unifi_status_upgrading [int]: 1
+#   checkmk_unifi_status_upgradable [int]: 0
+#   checkmk_unifi_status_heartbeat_missed [int]: 1
+#   checkmk_unifi_status_noautobackup [int]: 0
+#   checkmk_windows_updates_timeout [int]: 3600
+#   checkmk_windows_updates_cache [int]: 43200
+#   checkmk_mk_inventory_timeout [int]: 120
+#   checkmk_plugins_default_timeout [int]: 120
+#   checkmk_plugins_default_cache [int]: 600
+#   checkmk_extra_plugin_patterns [sequence]: []
+# AUTH: existing inventory / Vault credentials; no embedded passwords.
+# CHANGES: Installs packages and AIM-managed script files. On Windows only the marked plugins section in check_mk.user.yml is replaced; all other user-config sections are preserved. UniFi deployment also removes the alternative UniFi local check; no other cleanup is performed.
+# EXAMPLE: ansible-playbook -i inventories/<customer>/hosts.yml
+#          playbooks/checkmk_install_agent.yml --limit <host> --vault-id <customer>@prompt
+  - name: Checkmk | Install linux
+    hosts: linux
+    gather_facts: true
+    pre_tasks:
+      - name: AIM | Validate diagnostics option
+        ansible.builtin.assert:
+          that:
+            - (aim_debug | default(false)) is boolean or (aim_debug | default(false) | string | lower) in 
+              ['true', 'false']
+          fail_msg: aim_debug must be a YAML/JSON boolean.
+          quiet: true
+      - name: AIM | Reject mixed platform membership
+        ansible.builtin.assert:
+          that:
+            - (group_names | intersect(['linux', 'windows', 'sophosxgs', 'pfsense']) | length) <= 1
+          fail_msg: This host belongs to incompatible platform groups. Use globally unique subgroups.
+          quiet: true
+      - name: AIM | Execution context
+        ansible.builtin.debug:
+          msg:
+            host: '{{ inventory_hostname }}'
+            diagnostics: Enabled; secret values are never included by this task.
+        when: aim_debug | default(false) | bool
+      - name: Load system detect roles
+        ansible.builtin.include_role:
+          name: system_detect_roles
+      - name: Load checkmk script plan
+        ansible.builtin.include_role:
+          name: checkmk_script_plan
+      - name: Checkmk | Preflight scripts and credentials
+        ansible.builtin.include_role:
+          name: checkmk_deploy_scripts
+          tasks_from: preflight
+    become: true
+    roles:
+      - role: checkmk_agent
+      - role: checkmk_deploy_scripts
+      - role: checkmk_configure_agent
+      - role: checkmk_manage_service
+    post_tasks:
+      - name: Checkmk | Observe installed agent
+        ansible.builtin.include_role:
+          name: checkmk_report
+      - name: AIM | Publish operation result
+        ansible.builtin.set_stats:
+          per_host: true
+          aggregate: false
+          data:
+            aim_output:
+              protocol: aim_output_v1
+              schema: checkmk_agent_state_v1
+              data: '{{ _aim_checkmk_state }}'
+  - name: Checkmk | Install windows
+    hosts: windows
+    gather_facts: true
+    pre_tasks:
+      - name: AIM | Validate diagnostics option
+        ansible.builtin.assert:
+          that:
+            - (aim_debug | default(false)) is boolean or (aim_debug | default(false) | string | lower) in 
+              ['true', 'false']
+          fail_msg: aim_debug must be a YAML/JSON boolean.
+          quiet: true
+      - name: AIM | Reject mixed platform membership
+        ansible.builtin.assert:
+          that:
+            - (group_names | intersect(['linux', 'windows', 'sophosxgs', 'pfsense']) | length) <= 1
+          fail_msg: This host belongs to incompatible platform groups. Use globally unique subgroups.
+          quiet: true
+      - name: AIM | Execution context
+        ansible.builtin.debug:
+          msg:
+            host: '{{ inventory_hostname }}'
+            diagnostics: Enabled; secret values are never included by this task.
+        when: aim_debug | default(false) | bool
+      - name: Load system detect roles
+        ansible.builtin.include_role:
+          name: system_detect_roles
+      - name: Load checkmk script plan
+        ansible.builtin.include_role:
+          name: checkmk_script_plan
+      - name: Checkmk | Preflight scripts and credentials
+        ansible.builtin.include_role:
+          name: checkmk_deploy_scripts
+          tasks_from: preflight
+    roles:
+      - role: checkmk_agent
+      - role: checkmk_deploy_scripts
+      - role: checkmk_configure_agent
+      - role: checkmk_manage_service
+    post_tasks:
+      - name: Checkmk | Observe installed agent
+        ansible.builtin.include_role:
+          name: checkmk_report
+      - name: AIM | Publish operation result
+        ansible.builtin.set_stats:
+          per_host: true
+          aggregate: false
+          data:
+            aim_output:
+              protocol: aim_output_v1
+              schema: checkmk_agent_state_v1
+              data: '{{ _aim_checkmk_state }}'
diff --git a/playbooks/checkmk_read_windows_config.yml b/playbooks/checkmk_read_windows_config.yml
new file mode 100644
index 0000000..dfbe8d0
--- /dev/null
+++ b/playbooks/checkmk_read_windows_config.yml
@@ -0,0 +1,115 @@
+# PURPOSE: Read current Windows Checkmk user configuration
+# DESCRIPTION: Display the current check_mk.user.yml from Windows without modifying the host.
+# TARGETS: windows
+# INPUTS (omitted values inherit inventory / playbook defaults):
+#   aim_debug [bool]: false
+#   checkmk_windows_user_cfg [text]: C:\ProgramData\checkmk\agent\check_mk.user.yml
+# AUTH: existing inventory / Vault credentials; no embedded passwords.
+# CHANGES: none; this playbook is read-only.
+# EXAMPLE: ansible-playbook -i inventories/<customer>/hosts.yml
+#          playbooks/checkmk_read_windows_config.yml --limit <host> --vault-id <customer>@prompt
+
+  - name: Checkmk | Read Windows user configuration
+    hosts: windows
+    gather_facts: false
+    tasks:
+      - name: AIM | Validate diagnostics option
+        ansible.builtin.assert:
+          that:
+            - (aim_debug | default(false)) is boolean or (aim_debug | default(false) | string | lower) in 
+              ['true', 'false']
+          fail_msg: aim_debug must be a YAML/JSON boolean.
+          quiet: true
+
+      - name: AIM | Reject mixed platform membership
+        ansible.builtin.assert:
+          that:
+            - (group_names | intersect(['linux', 'windows', 'sophosxgs', 'pfsense']) | length) <= 1
+          fail_msg: This host belongs to incompatible platform groups. Use globally unique subgroups.
+          quiet: true
+
+      - name: AIM | Validate Checkmk configuration path
+        ansible.builtin.assert:
+          that:
+            - (checkmk_windows_user_cfg | default('C:\\ProgramData\\checkmk\\agent\\check_mk.user.yml')) is 
+              string
+            - (checkmk_windows_user_cfg | default('C:\\ProgramData\\checkmk\\agent\\check_mk.user.yml') | trim
+              | length) > 0
+          fail_msg: checkmk_windows_user_cfg must be a non-empty Windows path.
+          quiet: true
+
+      - name: AIM | Execution context
+        ansible.builtin.debug:
+          msg:
+            host: '{{ inventory_hostname }}'
+            configuration: "{{ checkmk_windows_user_cfg | default('C:\\\\ProgramData\\\\checkmk\\\\agent\\\\check_mk.user.yml')
+              }}"
+            mode: Read-only; no Checkmk configuration is modified.
+        when: aim_debug | default(false) | bool
+
+      - name: Windows | Inspect current Checkmk user configuration
+        ansible.windows.win_stat:
+          path: "{{ checkmk_windows_user_cfg | default('C:\\ProgramData\\checkmk\\agent\\check_mk.user.yml') }}"
+          get_checksum: false
+        register: _checkmk_windows_user_config_stat
+        changed_when: false
+
+      - name: Windows | Require the approved Checkmk user filename
+        ansible.builtin.assert:
+          that:
+            - not (_checkmk_windows_user_config_stat.stat.exists | default(false)) or (_checkmk_windows_user_config_stat.stat.filename | lower) == 'check_mk.user.yml'
+            - not (_checkmk_windows_user_config_stat.stat.exists | default(false)) or (_checkmk_windows_user_config_stat.stat.isreg | default(false))
+            - (_checkmk_windows_user_config_stat.stat.size | default(0) | int) <= 524288
+          fail_msg: Only a regular check_mk.user.yml file up to 512 KiB may be read.
+          quiet: true
+
+      - name: Windows | Read current Checkmk user configuration
+        ansible.windows.slurp:
+          src: "{{ checkmk_windows_user_cfg | default('C:\\ProgramData\\checkmk\\agent\\check_mk.user.yml') }}"
+        register: _checkmk_windows_user_config_slurp
+        when: _checkmk_windows_user_config_stat.stat.exists | default(false)
+        no_log: true
+
+      - name: Windows | Build Checkmk user configuration result
+        ansible.builtin.set_fact:
+          _checkmk_windows_user_config:
+            exists: '{{ _checkmk_windows_user_config_stat.stat.exists | default(false) | bool }}'
+            path: "{{ _checkmk_windows_user_config_stat.stat.path | default(checkmk_windows_user_cfg | default('C:\\ProgramData\\checkmk\\agent\\check_mk.user.yml')) }}"
+            size_bytes: '{{ _checkmk_windows_user_config_stat.stat.size | default(0) | int }}'
+            last_write_time_utc: >-
+              {{ (_checkmk_windows_user_config_stat.stat.lastwritetime | aim_epoch_iso_utc)
+                 if (_checkmk_windows_user_config_stat.stat.exists | default(false)) else none }}
+            content: >-
+              {{ (_checkmk_windows_user_config_slurp.content | b64decode)
+                 if (_checkmk_windows_user_config_stat.stat.exists | default(false)) else '' }}
+        changed_when: false
+        no_log: true
+
+      - name: Windows | Report missing Checkmk user configuration
+        ansible.builtin.debug:
+          msg: |-
+            {{ inventory_hostname }}
+            Checkmk user configuration was not found.
+            Path: {{ _checkmk_windows_user_config.path }}
+        when: not (_checkmk_windows_user_config.exists | bool)
+
+      - name: Windows | Print current Checkmk user configuration
+        ansible.builtin.debug:
+          msg: |-
+            {{ inventory_hostname }}
+            Path: {{ _checkmk_windows_user_config.path }}
+            Size: {{ _checkmk_windows_user_config.size_bytes }} bytes
+            Last write (UTC): {{ _checkmk_windows_user_config.last_write_time_utc }}
+            ----- BEGIN check_mk.user.yml -----
+            {{ _checkmk_windows_user_config.content }}
+            ----- END check_mk.user.yml -----
+        when: _checkmk_windows_user_config.exists | bool
+      - name: AIM | Publish operation result
+        ansible.builtin.set_stats:
+          per_host: true
+          aggregate: false
+          data:
+            aim_output:
+              protocol: aim_output_v1
+              schema: checkmk_user_config_v1
+              data: '{{ _checkmk_windows_user_config | aim_report_checkmk_config }}'
diff --git a/playbooks/checkmk_update_config.yml b/playbooks/checkmk_update_config.yml
deleted file mode 100644
index 5efbb02..0000000
--- a/playbooks/checkmk_update_config.yml
+++ /dev/null
@@ -1,8 +0,0 @@
----
-- name: "Checkmk | Update agent configuration"
-  hosts: all
-  gather_facts: true
-
-  roles:
-    - server_role_selection
-    - checkmk_agent_config
diff --git a/playbooks/checkmk_update_scripts.yml b/playbooks/checkmk_update_scripts.yml
deleted file mode 100644
index 0992f22..0000000
--- a/playbooks/checkmk_update_scripts.yml
+++ /dev/null
@@ -1,8 +0,0 @@
----
-- name: "Checkmk | Update monitoring scripts"
-  hosts: all
-  gather_facts: true
-
-  roles:
-    - server_role_selection
-    - checkmk_scripts
diff --git a/playbooks/checkmk_update_scripts_config.yml b/playbooks/checkmk_update_scripts_config.yml
new file mode 100644
index 0000000..5ce99f3
--- /dev/null
+++ b/playbooks/checkmk_update_scripts_config.yml
@@ -0,0 +1,135 @@
+# PURPOSE: Update Checkmk scripts and configuration
+# DESCRIPTION: Deploy selected checks and Windows configuration without installing agent packages.
+# TARGETS: linux, windows
+# INPUTS (omitted values inherit inventory / role defaults):
+#   aim_debug [bool]: false
+#   checkmk_unifi_mode [choice]: auto
+#   checkmk_unifi_username [text]: bf-monitoring
+#   checkmk_unifi_password [secret_ref]: vault_checkmk_unifi_password
+#   checkmk_unifi_baseurl [url]: network: https://127.0.0.1:8443; os: https://127.0.0.1:11443
+#   checkmk_unifi_curl_options [text]:  --insecure --tlsv1.2
+#   want_linux_check_certificate [bool]: false
+#   want_windows_citrix [bool]: false
+#   want_windows_surebackup [bool]: false
+#   want_windows_backup [bool]: false
+#   want_windows_nsp_mailqueue [bool]: false
+#   want_windows_certificate [bool]: false
+#   want_windows_veeam_cloud_connect [bool]: false
+#   want_windows_veeam_backup [bool]: false
+#   checkmk_unifi_status_provisioning [int]: 1
+#   checkmk_unifi_status_upgrading [int]: 1
+#   checkmk_unifi_status_upgradable [int]: 0
+#   checkmk_unifi_status_heartbeat_missed [int]: 1
+#   checkmk_unifi_status_noautobackup [int]: 0
+#   checkmk_windows_updates_timeout [int]: 3600
+#   checkmk_windows_updates_cache [int]: 43200
+#   checkmk_mk_inventory_timeout [int]: 120
+#   checkmk_plugins_default_timeout [int]: 120
+#   checkmk_plugins_default_cache [int]: 600
+#   checkmk_extra_plugin_patterns [sequence]: []
+# AUTH: existing inventory / Vault credentials; no embedded passwords.
+# CHANGES: AIM-managed script files are updated. On Windows only the marked plugins section in check_mk.user.yml is replaced; all other user-config sections are preserved. Only the opposite UniFi check is removed during a UniFi mode transition.
+# EXAMPLE: ansible-playbook -i inventories/<customer>/hosts.yml
+#          playbooks/checkmk_update_scripts_config.yml --limit <host> --vault-id <customer>@prompt
+  - name: Checkmk | Update linux
+    hosts: linux
+    gather_facts: true
+    pre_tasks:
+      - name: AIM | Validate diagnostics option
+        ansible.builtin.assert:
+          that:
+            - (aim_debug | default(false)) is boolean or (aim_debug | default(false) | string | lower) in 
+              ['true', 'false']
+          fail_msg: aim_debug must be a YAML/JSON boolean.
+          quiet: true
+      - name: AIM | Reject mixed platform membership
+        ansible.builtin.assert:
+          that:
+            - (group_names | intersect(['linux', 'windows', 'sophosxgs', 'pfsense']) | length) <= 1
+          fail_msg: This host belongs to incompatible platform groups. Use globally unique subgroups.
+          quiet: true
+      - name: AIM | Execution context
+        ansible.builtin.debug:
+          msg:
+            host: '{{ inventory_hostname }}'
+            diagnostics: Enabled; secret values are never included by this task.
+        when: aim_debug | default(false) | bool
+      - name: Load system detect roles
+        ansible.builtin.include_role:
+          name: system_detect_roles
+      - name: Load checkmk script plan
+        ansible.builtin.include_role:
+          name: checkmk_script_plan
+      - name: Checkmk | Preflight scripts and credentials
+        ansible.builtin.include_role:
+          name: checkmk_deploy_scripts
+          tasks_from: preflight
+    become: true
+    roles:
+      - role: checkmk_deploy_scripts
+      - role: checkmk_configure_agent
+      - role: checkmk_manage_service
+    post_tasks:
+      - &id001
+        name: Checkmk | Collect managed change summary
+        ansible.builtin.set_fact:
+          _aim_checkmk_changes: '{{ _aim_check_copies | default({}) | aim_report_checkmk_changes(_checkmk_selected_scripts,
+            _checkmk_plugins_update | default({}), _aim_unifi_write | default({}), _aim_opposite_remove | default({}),
+            _checkmk_unifi_effective, ansible_check_mode) }}'
+      - name: AIM | Publish operation result
+        ansible.builtin.set_stats:
+          per_host: true
+          aggregate: false
+          data:
+            aim_output:
+              protocol: aim_output_v1
+              schema: checkmk_agent_config_v1
+              data: '{{ _aim_checkmk_changes }}'
+  - name: Checkmk | Update windows
+    hosts: windows
+    gather_facts: true
+    pre_tasks:
+      - name: AIM | Validate diagnostics option
+        ansible.builtin.assert:
+          that:
+            - (aim_debug | default(false)) is boolean or (aim_debug | default(false) | string | lower) in 
+              ['true', 'false']
+          fail_msg: aim_debug must be a YAML/JSON boolean.
+          quiet: true
+      - name: AIM | Reject mixed platform membership
+        ansible.builtin.assert:
+          that:
+            - (group_names | intersect(['linux', 'windows', 'sophosxgs', 'pfsense']) | length) <= 1
+          fail_msg: This host belongs to incompatible platform groups. Use globally unique subgroups.
+          quiet: true
+      - name: AIM | Execution context
+        ansible.builtin.debug:
+          msg:
+            host: '{{ inventory_hostname }}'
+            diagnostics: Enabled; secret values are never included by this task.
+        when: aim_debug | default(false) | bool
+      - name: Load system detect roles
+        ansible.builtin.include_role:
+          name: system_detect_roles
+      - name: Load checkmk script plan
+        ansible.builtin.include_role:
+          name: checkmk_script_plan
+      - name: Checkmk | Preflight scripts and credentials
+        ansible.builtin.include_role:
+          name: checkmk_deploy_scripts
+          tasks_from: preflight
+    roles:
+      - role: checkmk_deploy_scripts
+      - role: checkmk_configure_agent
+      - role: checkmk_manage_service
+    post_tasks:
+      - *id001
+      - name: AIM | Publish operation result
+        ansible.builtin.set_stats:
+          per_host: true
+          aggregate: false
+          data:
+            aim_output:
+              protocol: aim_output_v1
+              schema: checkmk_agent_config_v1
+              data: '{{ _aim_checkmk_changes }}'
diff --git a/playbooks/customers/bluuunit/sophos_apply_customer.yml b/playbooks/customers/bluuunit/sophos_apply_customer.yml
new file mode 100644
index 0000000..d8fe02b
--- /dev/null
+++ b/playbooks/customers/bluuunit/sophos_apply_customer.yml
@@ -0,0 +1,96 @@
+---
+# PURPOSE: Apply customer Sophos configuration
+# DESCRIPTION: Apply this customer profile using hostname, network_objects and vlan_interfaces from inventory.
+# TARGETS: sophosxgs
+# REQUIRED NETWORK KEYS: derz_lan, derz_sslvpn, facility, guest, lan_old, management, office, server, voip
+# INPUTS (omitted values inherit inventory / role defaults):
+#   aim_debug [bool]: false
+# AUTH: existing inventory / Vault credentials; no embedded passwords.
+# CHANGES: Changes customer firewall configuration. VLAN parent remains Port1 as in the supplied playbooks. Only this customer profile is selected.
+# EXAMPLE: ansible-playbook -i inventories/<customer>/hosts.yml
+#          playbooks/customers/bluuunit/sophos_apply_customer.yml --limit <host> --vault-id <customer>@prompt --ask-pass
+- name: Sophos | Apply customer configuration | bluuunit
+  hosts: sophosxgs
+  gather_facts: false
+  any_errors_fatal: false
+  tasks:
+    - name: Apply customer firewall policy
+      ansible.builtin.import_role:
+        name: sophos_customer_bluuunit
+  pre_tasks:
+    - name: AIM | Validate diagnostics option
+      ansible.builtin.assert:
+        that:
+          - (aim_debug | default(false)) is boolean or (aim_debug | default(false) | string | lower) in ['true',
+            'false']
+        fail_msg: aim_debug must be a YAML/JSON boolean.
+        quiet: true
+    - name: AIM | Reject mixed platform membership
+      ansible.builtin.assert:
+        that:
+          - (group_names | intersect(['linux', 'windows', 'sophosxgs', 'pfsense']) | length) <= 1
+        fail_msg: This host belongs to incompatible platform groups. Use globally unique subgroups.
+        quiet: true
+    - name: AIM | Execution context
+      ansible.builtin.debug:
+        msg:
+          host: '{{ inventory_hostname }}'
+          diagnostics: Enabled; secret values are never included by this task.
+      when: aim_debug | default(false) | bool
+    - name: Sophos | Require customer host configuration
+      ansible.builtin.assert:
+        that:
+          - hostname is defined
+          - hostname is string
+          - hostname | length > 0
+          - network_objects is defined
+          - network_objects is mapping
+          - vlan_interfaces is defined
+          - vlan_interfaces is mapping
+        fail_msg: Set hostname, network_objects and vlan_interfaces in this host inventory. AIM can prepare
+          these fields.
+        quiet: true
+    - name: Sophos | Require profile network keys
+      ansible.builtin.assert:
+        that:
+          - item in network_objects
+        fail_msg: A customer-required network_objects key is missing. See the loop item.
+        quiet: true
+      loop:
+        - derz_lan
+        - derz_sslvpn
+        - facility
+        - guest
+        - lan_old
+        - management
+        - office
+        - server
+        - voip
+    - name: Sophos | Validate network object shape
+      ansible.builtin.assert:
+        that:
+          - item.value is mapping
+          - item.value.name is defined
+          - item.value.network is defined
+          - item.value.subnetmask is defined
+        fail_msg: Every network object requires name, network and subnetmask.
+        quiet: true
+      loop: '{{ network_objects | dict2items }}'
+      loop_control:
+        label: '{{ item.key }}'
+    - name: Sophos | Validate VLAN shape
+      ansible.builtin.assert:
+        that:
+          - item.value is mapping
+          - item.value.name is defined
+          - item.value.ip_address is defined
+          - item.value.subnetmask is defined
+          - item.value.vlan_id is defined
+          - item.value.zone_name is defined
+          - item.value.zone_type is defined
+          - item.value.zone_description is defined
+        fail_msg: Each VLAN requires its full interface and zone mapping.
+        quiet: true
+      loop: '{{ vlan_interfaces | dict2items }}'
+      loop_control:
+        label: '{{ item.key }}'
diff --git a/playbooks/customers/formicon/sophos_apply_customer.yml b/playbooks/customers/formicon/sophos_apply_customer.yml
new file mode 100644
index 0000000..6275b1a
--- /dev/null
+++ b/playbooks/customers/formicon/sophos_apply_customer.yml
@@ -0,0 +1,91 @@
+---
+# PURPOSE: Apply customer Sophos configuration
+# DESCRIPTION: Apply this customer profile using hostname, network_objects and vlan_interfaces from inventory.
+# TARGETS: sophosxgs
+# REQUIRED NETWORK KEYS: azuregwc_lan, lan_old, management, office
+# INPUTS (omitted values inherit inventory / role defaults):
+#   aim_debug [bool]: false
+# AUTH: existing inventory / Vault credentials; no embedded passwords.
+# CHANGES: Changes customer firewall configuration. VLAN parent remains Port1 as in the supplied playbooks. Only this customer profile is selected.
+# EXAMPLE: ansible-playbook -i inventories/<customer>/hosts.yml
+#          playbooks/customers/formicon/sophos_apply_customer.yml --limit <host> --vault-id <customer>@prompt --ask-pass
+- name: Sophos | Apply customer configuration | formicon
+  hosts: sophosxgs
+  gather_facts: false
+  any_errors_fatal: false
+  tasks:
+    - name: Apply customer firewall policy
+      ansible.builtin.import_role:
+        name: sophos_customer_formicon
+  pre_tasks:
+    - name: AIM | Validate diagnostics option
+      ansible.builtin.assert:
+        that:
+          - (aim_debug | default(false)) is boolean or (aim_debug | default(false) | string | lower) in ['true',
+            'false']
+        fail_msg: aim_debug must be a YAML/JSON boolean.
+        quiet: true
+    - name: AIM | Reject mixed platform membership
+      ansible.builtin.assert:
+        that:
+          - (group_names | intersect(['linux', 'windows', 'sophosxgs', 'pfsense']) | length) <= 1
+        fail_msg: This host belongs to incompatible platform groups. Use globally unique subgroups.
+        quiet: true
+    - name: AIM | Execution context
+      ansible.builtin.debug:
+        msg:
+          host: '{{ inventory_hostname }}'
+          diagnostics: Enabled; secret values are never included by this task.
+      when: aim_debug | default(false) | bool
+    - name: Sophos | Require customer host configuration
+      ansible.builtin.assert:
+        that:
+          - hostname is defined
+          - hostname is string
+          - hostname | length > 0
+          - network_objects is defined
+          - network_objects is mapping
+          - vlan_interfaces is defined
+          - vlan_interfaces is mapping
+        fail_msg: Set hostname, network_objects and vlan_interfaces in this host inventory. AIM can prepare
+          these fields.
+        quiet: true
+    - name: Sophos | Require profile network keys
+      ansible.builtin.assert:
+        that:
+          - item in network_objects
+        fail_msg: A customer-required network_objects key is missing. See the loop item.
+        quiet: true
+      loop:
+        - azuregwc_lan
+        - lan_old
+        - management
+        - office
+    - name: Sophos | Validate network object shape
+      ansible.builtin.assert:
+        that:
+          - item.value is mapping
+          - item.value.name is defined
+          - item.value.network is defined
+          - item.value.subnetmask is defined
+        fail_msg: Every network object requires name, network and subnetmask.
+        quiet: true
+      loop: '{{ network_objects | dict2items }}'
+      loop_control:
+        label: '{{ item.key }}'
+    - name: Sophos | Validate VLAN shape
+      ansible.builtin.assert:
+        that:
+          - item.value is mapping
+          - item.value.name is defined
+          - item.value.ip_address is defined
+          - item.value.subnetmask is defined
+          - item.value.vlan_id is defined
+          - item.value.zone_name is defined
+          - item.value.zone_type is defined
+          - item.value.zone_description is defined
+        fail_msg: Each VLAN requires its full interface and zone mapping.
+        quiet: true
+      loop: '{{ vlan_interfaces | dict2items }}'
+      loop_control:
+        label: '{{ item.key }}'
diff --git a/playbooks/customers/gebhardt_stahl/sophos_apply_customer.yml b/playbooks/customers/gebhardt_stahl/sophos_apply_customer.yml
new file mode 100644
index 0000000..2fd8564
--- /dev/null
+++ b/playbooks/customers/gebhardt_stahl/sophos_apply_customer.yml
@@ -0,0 +1,91 @@
+---
+# PURPOSE: Apply customer Sophos configuration
+# DESCRIPTION: Apply this customer profile using hostname, network_objects and vlan_interfaces from inventory.
+# TARGETS: sophosxgs
+# REQUIRED NETWORK KEYS: drucker, guest, office, wlan
+# INPUTS (omitted values inherit inventory / role defaults):
+#   aim_debug [bool]: false
+# AUTH: existing inventory / Vault credentials; no embedded passwords.
+# CHANGES: Changes customer firewall configuration. VLAN parent remains Port1 as in the supplied playbooks. Only this customer profile is selected.
+# EXAMPLE: ansible-playbook -i inventories/<customer>/hosts.yml
+#          playbooks/customers/gebhardt_stahl/sophos_apply_customer.yml --limit <host> --vault-id <customer>@prompt --ask-pass
+- name: Sophos | Apply customer configuration | gebhardt_stahl
+  hosts: sophosxgs
+  gather_facts: false
+  any_errors_fatal: false
+  tasks:
+    - name: Apply customer firewall policy
+      ansible.builtin.import_role:
+        name: sophos_customer_gebhardt_stahl
+  pre_tasks:
+    - name: AIM | Validate diagnostics option
+      ansible.builtin.assert:
+        that:
+          - (aim_debug | default(false)) is boolean or (aim_debug | default(false) | string | lower) in ['true',
+            'false']
+        fail_msg: aim_debug must be a YAML/JSON boolean.
+        quiet: true
+    - name: AIM | Reject mixed platform membership
+      ansible.builtin.assert:
+        that:
+          - (group_names | intersect(['linux', 'windows', 'sophosxgs', 'pfsense']) | length) <= 1
+        fail_msg: This host belongs to incompatible platform groups. Use globally unique subgroups.
+        quiet: true
+    - name: AIM | Execution context
+      ansible.builtin.debug:
+        msg:
+          host: '{{ inventory_hostname }}'
+          diagnostics: Enabled; secret values are never included by this task.
+      when: aim_debug | default(false) | bool
+    - name: Sophos | Require customer host configuration
+      ansible.builtin.assert:
+        that:
+          - hostname is defined
+          - hostname is string
+          - hostname | length > 0
+          - network_objects is defined
+          - network_objects is mapping
+          - vlan_interfaces is defined
+          - vlan_interfaces is mapping
+        fail_msg: Set hostname, network_objects and vlan_interfaces in this host inventory. AIM can prepare
+          these fields.
+        quiet: true
+    - name: Sophos | Require profile network keys
+      ansible.builtin.assert:
+        that:
+          - item in network_objects
+        fail_msg: A customer-required network_objects key is missing. See the loop item.
+        quiet: true
+      loop:
+        - drucker
+        - guest
+        - office
+        - wlan
+    - name: Sophos | Validate network object shape
+      ansible.builtin.assert:
+        that:
+          - item.value is mapping
+          - item.value.name is defined
+          - item.value.network is defined
+          - item.value.subnetmask is defined
+        fail_msg: Every network object requires name, network and subnetmask.
+        quiet: true
+      loop: '{{ network_objects | dict2items }}'
+      loop_control:
+        label: '{{ item.key }}'
+    - name: Sophos | Validate VLAN shape
+      ansible.builtin.assert:
+        that:
+          - item.value is mapping
+          - item.value.name is defined
+          - item.value.ip_address is defined
+          - item.value.subnetmask is defined
+          - item.value.vlan_id is defined
+          - item.value.zone_name is defined
+          - item.value.zone_type is defined
+          - item.value.zone_description is defined
+        fail_msg: Each VLAN requires its full interface and zone mapping.
+        quiet: true
+      loop: '{{ vlan_interfaces | dict2items }}'
+      loop_control:
+        label: '{{ item.key }}'
diff --git a/playbooks/customers/hungeling_und_toechter/sophos_apply_customer.yml b/playbooks/customers/hungeling_und_toechter/sophos_apply_customer.yml
new file mode 100644
index 0000000..90997d3
--- /dev/null
+++ b/playbooks/customers/hungeling_und_toechter/sophos_apply_customer.yml
@@ -0,0 +1,92 @@
+---
+# PURPOSE: Apply customer Sophos configuration
+# DESCRIPTION: Apply this customer profile using hostname, network_objects and vlan_interfaces from inventory.
+# TARGETS: sophosxgs
+# REQUIRED NETWORK KEYS: facility, guest, management, office, voip
+# INPUTS (omitted values inherit inventory / role defaults):
+#   aim_debug [bool]: false
+# AUTH: existing inventory / Vault credentials; no embedded passwords.
+# CHANGES: Changes customer firewall configuration. VLAN parent remains Port1 as in the supplied playbooks. Only this customer profile is selected.
+# EXAMPLE: ansible-playbook -i inventories/<customer>/hosts.yml
+#          playbooks/customers/hungeling_und_toechter/sophos_apply_customer.yml --limit <host> --vault-id <customer>@prompt --ask-pass
+- name: Sophos | Apply customer configuration | hungeling_und_toechter
+  hosts: sophosxgs
+  gather_facts: false
+  any_errors_fatal: false
+  tasks:
+    - name: Apply customer firewall policy
+      ansible.builtin.import_role:
+        name: sophos_customer_hungeling_und_toechter
+  pre_tasks:
+    - name: AIM | Validate diagnostics option
+      ansible.builtin.assert:
+        that:
+          - (aim_debug | default(false)) is boolean or (aim_debug | default(false) | string | lower) in ['true',
+            'false']
+        fail_msg: aim_debug must be a YAML/JSON boolean.
+        quiet: true
+    - name: AIM | Reject mixed platform membership
+      ansible.builtin.assert:
+        that:
+          - (group_names | intersect(['linux', 'windows', 'sophosxgs', 'pfsense']) | length) <= 1
+        fail_msg: This host belongs to incompatible platform groups. Use globally unique subgroups.
+        quiet: true
+    - name: AIM | Execution context
+      ansible.builtin.debug:
+        msg:
+          host: '{{ inventory_hostname }}'
+          diagnostics: Enabled; secret values are never included by this task.
+      when: aim_debug | default(false) | bool
+    - name: Sophos | Require customer host configuration
+      ansible.builtin.assert:
+        that:
+          - hostname is defined
+          - hostname is string
+          - hostname | length > 0
+          - network_objects is defined
+          - network_objects is mapping
+          - vlan_interfaces is defined
+          - vlan_interfaces is mapping
+        fail_msg: Set hostname, network_objects and vlan_interfaces in this host inventory. AIM can prepare
+          these fields.
+        quiet: true
+    - name: Sophos | Require profile network keys
+      ansible.builtin.assert:
+        that:
+          - item in network_objects
+        fail_msg: A customer-required network_objects key is missing. See the loop item.
+        quiet: true
+      loop:
+        - facility
+        - guest
+        - management
+        - office
+        - voip
+    - name: Sophos | Validate network object shape
+      ansible.builtin.assert:
+        that:
+          - item.value is mapping
+          - item.value.name is defined
+          - item.value.network is defined
+          - item.value.subnetmask is defined
+        fail_msg: Every network object requires name, network and subnetmask.
+        quiet: true
+      loop: '{{ network_objects | dict2items }}'
+      loop_control:
+        label: '{{ item.key }}'
+    - name: Sophos | Validate VLAN shape
+      ansible.builtin.assert:
+        that:
+          - item.value is mapping
+          - item.value.name is defined
+          - item.value.ip_address is defined
+          - item.value.subnetmask is defined
+          - item.value.vlan_id is defined
+          - item.value.zone_name is defined
+          - item.value.zone_type is defined
+          - item.value.zone_description is defined
+        fail_msg: Each VLAN requires its full interface and zone mapping.
+        quiet: true
+      loop: '{{ vlan_interfaces | dict2items }}'
+      loop_control:
+        label: '{{ item.key }}'
diff --git a/playbooks/customers/koenig_holding_gmbh/sophos_apply_customer.yml b/playbooks/customers/koenig_holding_gmbh/sophos_apply_customer.yml
new file mode 100644
index 0000000..27fb2d8
--- /dev/null
+++ b/playbooks/customers/koenig_holding_gmbh/sophos_apply_customer.yml
@@ -0,0 +1,93 @@
+---
+# PURPOSE: Apply customer Sophos configuration
+# DESCRIPTION: Apply this customer profile using hostname, network_objects and vlan_interfaces from inventory.
+# TARGETS: sophosxgs
+# REQUIRED NETWORK KEYS: facility, guest, management, office, server, voip
+# INPUTS (omitted values inherit inventory / role defaults):
+#   aim_debug [bool]: false
+# AUTH: existing inventory / Vault credentials; no embedded passwords.
+# CHANGES: Changes customer firewall configuration. VLAN parent remains Port1 as in the supplied playbooks. Only this customer profile is selected.
+# EXAMPLE: ansible-playbook -i inventories/<customer>/hosts.yml
+#          playbooks/customers/koenig_holding_gmbh/sophos_apply_customer.yml --limit <host> --vault-id <customer>@prompt --ask-pass
+- name: Sophos | Apply customer configuration | koenig_holding_gmbh
+  hosts: sophosxgs
+  gather_facts: false
+  any_errors_fatal: false
+  tasks:
+    - name: Apply customer firewall policy
+      ansible.builtin.import_role:
+        name: sophos_customer_koenig_holding_gmbh
+  pre_tasks:
+    - name: AIM | Validate diagnostics option
+      ansible.builtin.assert:
+        that:
+          - (aim_debug | default(false)) is boolean or (aim_debug | default(false) | string | lower) in ['true',
+            'false']
+        fail_msg: aim_debug must be a YAML/JSON boolean.
+        quiet: true
+    - name: AIM | Reject mixed platform membership
+      ansible.builtin.assert:
+        that:
+          - (group_names | intersect(['linux', 'windows', 'sophosxgs', 'pfsense']) | length) <= 1
+        fail_msg: This host belongs to incompatible platform groups. Use globally unique subgroups.
+        quiet: true
+    - name: AIM | Execution context
+      ansible.builtin.debug:
+        msg:
+          host: '{{ inventory_hostname }}'
+          diagnostics: Enabled; secret values are never included by this task.
+      when: aim_debug | default(false) | bool
+    - name: Sophos | Require customer host configuration
+      ansible.builtin.assert:
+        that:
+          - hostname is defined
+          - hostname is string
+          - hostname | length > 0
+          - network_objects is defined
+          - network_objects is mapping
+          - vlan_interfaces is defined
+          - vlan_interfaces is mapping
+        fail_msg: Set hostname, network_objects and vlan_interfaces in this host inventory. AIM can prepare
+          these fields.
+        quiet: true
+    - name: Sophos | Require profile network keys
+      ansible.builtin.assert:
+        that:
+          - item in network_objects
+        fail_msg: A customer-required network_objects key is missing. See the loop item.
+        quiet: true
+      loop:
+        - facility
+        - guest
+        - management
+        - office
+        - server
+        - voip
+    - name: Sophos | Validate network object shape
+      ansible.builtin.assert:
+        that:
+          - item.value is mapping
+          - item.value.name is defined
+          - item.value.network is defined
+          - item.value.subnetmask is defined
+        fail_msg: Every network object requires name, network and subnetmask.
+        quiet: true
+      loop: '{{ network_objects | dict2items }}'
+      loop_control:
+        label: '{{ item.key }}'
+    - name: Sophos | Validate VLAN shape
+      ansible.builtin.assert:
+        that:
+          - item.value is mapping
+          - item.value.name is defined
+          - item.value.ip_address is defined
+          - item.value.subnetmask is defined
+          - item.value.vlan_id is defined
+          - item.value.zone_name is defined
+          - item.value.zone_type is defined
+          - item.value.zone_description is defined
+        fail_msg: Each VLAN requires its full interface and zone mapping.
+        quiet: true
+      loop: '{{ vlan_interfaces | dict2items }}'
+      loop_control:
+        label: '{{ item.key }}'
diff --git a/playbooks/debug_detect_host_roles.yml b/playbooks/debug_detect_host_roles.yml
new file mode 100644
index 0000000..b6e6173
--- /dev/null
+++ b/playbooks/debug_detect_host_roles.yml
@@ -0,0 +1,62 @@
+# PURPOSE: Detect host roles
+# DESCRIPTION: Report detected AD, DHCP, Hyper-V, Veeam and UniFi capabilities without changing inventory memberships.
+# TARGETS: linux, windows
+# INPUTS (omitted values inherit inventory / role defaults):
+#   aim_debug [bool]: false
+# AUTH: existing inventory / Vault credentials; no embedded passwords.
+# EXAMPLE: ansible-playbook -i inventories/<customer>/hosts.yml
+#          playbooks/debug_detect_host_roles.yml --limit <host> --vault-id <customer>@prompt
+  - name: Debug | Detected host roles
+    hosts: linux:windows
+    gather_facts: true
+    pre_tasks:
+      - name: AIM | Validate diagnostics option
+        ansible.builtin.assert:
+          that:
+            - (aim_debug | default(false)) is boolean or (aim_debug | default(false) | string | lower) in 
+              ['true', 'false']
+          fail_msg: aim_debug must be a YAML/JSON boolean.
+          quiet: true
+      - name: AIM | Reject mixed platform membership
+        ansible.builtin.assert:
+          that:
+            - (group_names | intersect(['linux', 'windows', 'sophosxgs', 'pfsense']) | length) <= 1
+          fail_msg: This host belongs to incompatible platform groups. Use globally unique subgroups.
+          quiet: true
+      - name: AIM | Execution context
+        ansible.builtin.debug:
+          msg:
+            host: '{{ inventory_hostname }}'
+            diagnostics: Enabled; secret values are never included by this task.
+        when: aim_debug | default(false) | bool
+    roles:
+      - role: system_detect_roles
+    tasks:
+      - name: Detection summary
+        ansible.builtin.debug:
+          msg:
+            is_dc: '{{ is_dc | default(false) }}'
+            is_dhcp_server: '{{ is_dhcp_server | default(false) }}'
+            is_hyperv_host: '{{ is_hyperv_host | default(false) }}'
+            has_veeam_vbr: '{{ has_veeam_vbr | default(false) }}'
+            has_veeam_vbo: '{{ has_veeam_vbo | default(false) }}'
+            has_veeam_em: '{{ has_veeam_em | default(false) }}'
+            is_unifi_controller: '{{ is_unifi_controller | default(false) }}'
+            is_unifi_os_server: '{{ is_unifi_os_server | default(false) }}'
+      - name: AIM | Publish operation result
+        ansible.builtin.set_stats:
+          per_host: true
+          aggregate: false
+          data:
+            aim_output:
+              protocol: aim_output_v1
+              schema: host_capabilities_v1
+              data:
+                is_dc: '{{ is_dc | default(false) | bool }}'
+                is_dhcp_server: '{{ is_dhcp_server | default(false) | bool }}'
+                is_hyperv_host: '{{ is_hyperv_host | default(false) | bool }}'
+                has_veeam_vbr: '{{ has_veeam_vbr | default(false) | bool }}'
+                has_veeam_vbo: '{{ has_veeam_vbo | default(false) | bool }}'
+                has_veeam_em: '{{ has_veeam_em | default(false) | bool }}'
+                is_unifi_controller: '{{ is_unifi_controller | default(false) | bool }}'
+                is_unifi_os_server: '{{ is_unifi_os_server | default(false) | bool }}'
diff --git a/playbooks/debug_disk_usage.yml b/playbooks/debug_disk_usage.yml
deleted file mode 100644
index a1c0e55..0000000
--- a/playbooks/debug_disk_usage.yml
+++ /dev/null
@@ -1,38 +0,0 @@
----
-- name: "Debug | Disk usage"
-  hosts: all
-  gather_facts: true
-
-  tasks:
-    - name: "Linux | Collect filesystem usage"
-      when: ansible_facts['os_family'] != 'Windows'
-      ansible.builtin.command:
-        cmd: df -hP -x tmpfs -x devtmpfs
-      register: disk_usage_linux
-      changed_when: false
-
-    - name: "Linux | Show filesystem usage"
-      when: ansible_facts['os_family'] != 'Windows'
-      ansible.builtin.debug:
-        var: disk_usage_linux.stdout_lines
-
-    - name: "Windows | Collect filesystem drive usage"
-      when: ansible_facts['os_family'] == 'Windows'
-      ansible.windows.win_powershell:
-        script: |
-          Get-CimInstance Win32_LogicalDisk -Filter "DriveType=3" |
-            Select-Object DeviceID,
-              @{Name='SizeGB';Expression={[math]::Round($_.Size / 1GB, 2)}},
-              @{Name='FreeGB';Expression={[math]::Round($_.FreeSpace / 1GB, 2)}},
-              @{Name='UsedPercent';Expression={
-                if ($_.Size -gt 0) {
-                  [math]::Round((($_.Size - $_.FreeSpace) / $_.Size) * 100, 1)
-                } else { 0 }
-              }}
-      register: disk_usage_windows
-      changed_when: false
-
-    - name: "Windows | Show filesystem drive usage"
-      when: ansible_facts['os_family'] == 'Windows'
-      ansible.builtin.debug:
-        var: disk_usage_windows.output
diff --git a/playbooks/debug_ping.yml b/playbooks/debug_ping.yml
deleted file mode 100644
index 310489d..0000000
--- a/playbooks/debug_ping.yml
+++ /dev/null
@@ -1,13 +0,0 @@
----
-- name: "Debug | Ping hosts"
-  hosts: all
-  gather_facts: false
-
-  tasks:
-    - name: "Windows | WinRM ping"
-      when: ansible_connection | default('') == 'winrm'
-      ansible.windows.win_ping:
-
-    - name: "Linux | Ansible ping"
-      when: ansible_connection | default('ssh') != 'winrm'
-      ansible.builtin.ping:
diff --git a/playbooks/debug_server_role_selection.yml b/playbooks/debug_server_role_selection.yml
deleted file mode 100644
index 0a28f59..0000000
--- a/playbooks/debug_server_role_selection.yml
+++ /dev/null
@@ -1,87 +0,0 @@
----
-- name: "Debug | Server Role Selection"
-  hosts: all
-  gather_facts: true
-
-  roles:
-    - server_role_selection
-
-  tasks:
-    - name: "Debug | Display detected server roles"
-      ansible.builtin.debug:
-        msg:
-          host: "{{ inventory_hostname }}"
-          os_family: "{{ ansible_facts['os_family'] | default('unknown') }}"
-
-          windows_roles:
-            domain_controller: "{{ is_dc | default(false) | bool }}"
-            dhcp_server: "{{ is_dhcp_server | default(false) | bool }}"
-            hyperv_host: "{{ is_hyperv_host | default(false) | bool }}"
-
-          veeam:
-            vbr: "{{ has_veeam_vbr | default(false) | bool }}"
-            vbo: "{{ has_veeam_vbo | default(false) | bool }}"
-            enterprise_manager: "{{ has_veeam_em | default(false) | bool }}"
-
-          linux_roles:
-            unifi_controller: "{{ is_unifi_controller | default(false) | bool }}"
-
-          optional_features:
-            linux_certificate_check: "{{ want_linux_check_certificate | default(false) | bool }}"
-            windows_citrix: "{{ want_windows_citrix | default(false) | bool }}"
-            windows_surebackup: "{{ want_windows_surebackup | default(false) | bool }}"
-            windows_backup: "{{ want_windows_backup | default(false) | bool }}"
-
-    - name: "Debug | Display Checkmk script deployment decisions"
-      ansible.builtin.debug:
-        msg:
-          linux:
-            unifi_controller:
-              deploy: "{{ is_unifi_controller | default(false) | bool }}"
-              reason: "UniFi Controller detected"
-              scripts:
-                - "check_unifi-controller.sh"
-                - "unifi.cfg"
-
-            certificate_directory:
-              deploy: "{{ want_linux_check_certificate | default(false) | bool }}"
-              reason: "Certificate directory monitoring explicitly enabled"
-              scripts:
-                - "check_certificate_directory.sh"
-
-          windows:
-            check_ping:
-              deploy: "{{ is_dc | default(false) | bool }}"
-              reason: "Domain Controller"
-              scripts:
-                - "check-ping.ps1"
-
-            veeam_config_backup:
-              deploy: "{{ has_veeam_vbr | default(false) | bool }}"
-              reason: "Veeam Backup & Replication detected"
-              scripts:
-                - "veeam_config_backup_status.ps1"
-
-            veeam_o365:
-              deploy: "{{ has_veeam_vbo | default(false) | bool }}"
-              reason: "Veeam Backup for Microsoft 365 detected"
-              scripts:
-                - "veeam_o365_status.ps1"
-
-            citrix_sessions:
-              deploy: "{{ want_windows_citrix | default(false) | bool }}"
-              reason: "Citrix monitoring explicitly enabled"
-              scripts:
-                - "citrix_sessions_customized.ps1"
-
-            veeam_surebackup:
-              deploy: "{{ want_windows_surebackup | default(false) | bool }}"
-              reason: "Veeam SureBackup monitoring explicitly enabled"
-              scripts:
-                - "veeam_surebackup_status.ps1"
-
-            windows_backup:
-              deploy: "{{ want_windows_backup | default(false) | bool }}"
-              reason: "Windows Backup monitoring explicitly enabled"
-              scripts:
-                - "windows-backup.ps1"
\ No newline at end of file
diff --git a/playbooks/debug_show_disk_usage.yml b/playbooks/debug_show_disk_usage.yml
new file mode 100644
index 0000000..4b89a32
--- /dev/null
+++ b/playbooks/debug_show_disk_usage.yml
@@ -0,0 +1,185 @@
+# PURPOSE: Show disk usage
+# DESCRIPTION: Report attached Windows volumes and common operational Linux mounts.
+# TARGETS: windows, linux
+# INPUTS (omitted values inherit inventory / role defaults):
+#   aim_debug [bool]: false
+# AUTH: existing inventory / Vault credentials; no embedded passwords.
+# NOTES:
+#   Windows reports attached storage volumes from community.windows.win_disk_facts; mapped/network drives are excluded.
+#   Linux excludes pseudo/system mounts and reports common operational paths plus network/storage filesystems.
+# EXAMPLE: ansible-playbook -i inventories/<customer>/hosts.yml
+#          playbooks/debug_show_disk_usage.yml --limit <host> --vault-id <customer>@prompt
+
+  - name: Debug | Windows disk usage
+    hosts: windows
+    gather_facts: false
+    tasks:
+      - name: AIM | Validate diagnostics option
+        ansible.builtin.assert:
+          that:
+            - (aim_debug | default(false)) is boolean or (aim_debug | default(false) | string | lower) in 
+              ['true', 'false']
+          fail_msg: aim_debug must be a YAML/JSON boolean.
+          quiet: true
+
+      - name: AIM | Reject mixed platform membership
+        ansible.builtin.assert:
+          that:
+            - (group_names | intersect(['linux', 'windows', 'sophosxgs', 'pfsense']) | length) <= 1
+          fail_msg: This host belongs to incompatible platform groups. Use globally unique subgroups.
+          quiet: true
+
+      - name: AIM | Execution context
+        ansible.builtin.debug:
+          msg:
+            host: '{{ inventory_hostname }}'
+            diagnostics: Enabled; secret values are never included by this task.
+        when: aim_debug | default(false) | bool
+
+      - name: Windows | Gather attached disk and volume facts
+        community.windows.win_disk_facts:
+          filter:
+            - partitions
+            - volumes
+        changed_when: false
+
+      - name: Windows | Normalize attached volume usage
+        ansible.builtin.set_fact:
+          _windows_disk_report: "{{ ansible_facts.disks | default([]) | aim_report_disks('windows') }}"
+
+      - name: Windows | Print disk usage
+        ansible.builtin.debug:
+          msg: |-
+            {{ inventory_hostname }}
+            {% for d in _windows_disk_report.filesystems | default([]) %}
+            {% if d.status == 'available' %}
+            {{ '%-18s' | format(d.name) }} {{ (d.used_bytes / 1073741824) | round(2) }} GB / {{ (d.total_bytes / 1073741824) | round(2) }} GB | {{ d.used_percent | round(1) }}% used | {{ (d.available_bytes / 1073741824) | round(2) }} GB free | {{ d.filesystem_type | default('unknown', true) }} | {{ d.mount }}
+            {% else %}
+            {{ '%-18s' | format(d.name) }} unavailable | {{ d.mount }}
+            {% endif %}
+            {% endfor %}
+
+      - name: AIM | Publish operation result
+        ansible.builtin.set_stats:
+          per_host: true
+          aggregate: false
+          data:
+            aim_output:
+              protocol: aim_output_v1
+              schema: filesystem_usage_v1
+              data: "{{ _windows_disk_report }}"
+  - name: Debug | Linux disk usage
+    hosts: linux
+    gather_facts: false
+    become: false
+    vars:
+      _disk_common_mounts:
+        - /
+        - /boot
+        - /boot/efi
+        - /home
+        - /var
+        - /var/log
+        - /tmp
+        - /opt
+        - /srv
+      _disk_network_storage_fstypes:
+        - nfs
+        - nfs4
+        - cifs
+        - smb3
+        - ceph
+        - glusterfs
+        - fuse.sshfs
+        - fuse.glusterfs
+      _disk_excluded_fstypes:
+        - proc
+        - sysfs
+        - devtmpfs
+        - tmpfs
+        - cgroup
+        - cgroup2
+        - overlay
+        - squashfs
+        - nsfs
+        - tracefs
+        - debugfs
+        - securityfs
+        - pstore
+        - configfs
+        - hugetlbfs
+        - mqueue
+        - rpc_pipefs
+        - autofs
+        - fusectl
+        - binfmt_misc
+    tasks:
+      - name: AIM | Validate diagnostics option
+        ansible.builtin.assert:
+          that:
+            - (aim_debug | default(false)) is boolean or (aim_debug | default(false) | string | lower) in 
+              ['true', 'false']
+          fail_msg: aim_debug must be a YAML/JSON boolean.
+          quiet: true
+
+      - name: AIM | Reject mixed platform membership
+        ansible.builtin.assert:
+          that:
+            - (group_names | intersect(['linux', 'windows', 'sophosxgs', 'pfsense']) | length) <= 1
+          fail_msg: This host belongs to incompatible platform groups. Use globally unique subgroups.
+          quiet: true
+
+      - name: Linux | Collect mount facts
+        ansible.builtin.setup:
+          filter:
+            - ansible_mounts
+          gather_subset:
+            - '!all'
+            - '!min'
+        changed_when: false
+
+      - name: Linux | Reset selected mount report
+        ansible.builtin.set_fact:
+          _linux_disk_mounts: []
+      - name: Linux | Select common operational mounts
+        ansible.builtin.set_fact:
+          _linux_disk_mounts: '{{ (_linux_disk_mounts | default([])) + [item] }}'
+        loop: '{{ ansible_facts.mounts | default(ansible_mounts | default([])) }}'
+        loop_control:
+          label: "{{ item.mount | default('?') }}"
+        when:
+          - item.fstype | default('') not in _disk_excluded_fstypes
+          - >-
+            (item.mount | default('')) in _disk_common_mounts
+            or (item.mount | default('')).startswith('/mnt/')
+            or (item.mount | default('')).startswith('/media/')
+            or (item.fstype | default('')) in _disk_network_storage_fstypes
+
+      - name: Linux | Execution context
+        ansible.builtin.debug:
+          msg:
+            host: '{{ inventory_hostname }}'
+            selected_mounts: "{{ (_linux_disk_mounts | default([])) | map(attribute='mount') | list }}"
+            diagnostics: Enabled; pseudo/system mounts are excluded.
+        when: aim_debug | default(false) | bool
+
+      - name: Linux | Print disk usage
+        ansible.builtin.debug:
+          msg: |-
+            {{ inventory_hostname }}
+            {% for m in (_linux_disk_mounts | default([]) | sort(attribute='mount')) %}
+            {% set total = m.size_total | default(0) | float %}
+            {% set free = m.size_available | default(0) | float %}
+            {% set used = total - free %}
+            {% set pct = ((used / total) * 100) if total > 0 else 0 %}
+            {{ '%-18s' | format(m.mount) }} {{ (used / 1073741824) | round(2) }} GB / {{ (total / 1073741824) | round(2) }} GB | {{ pct | round(1) }}% used | {{ (free / 1073741824) | round(2) }} GB free | {{ m.fstype }}
+            {% endfor %}
+      - name: AIM | Publish operation result
+        ansible.builtin.set_stats:
+          per_host: true
+          aggregate: false
+          data:
+            aim_output:
+              protocol: aim_output_v1
+              schema: filesystem_usage_v1
+              data: "{{ _linux_disk_mounts | aim_report_disks('linux') }}"
diff --git a/playbooks/debug_test_connection.yml b/playbooks/debug_test_connection.yml
new file mode 100644
index 0000000..0aa24f8
--- /dev/null
+++ b/playbooks/debug_test_connection.yml
@@ -0,0 +1,61 @@
+---
+# PURPOSE: Test Ansible connection
+# DESCRIPTION: Check Ansible manageability using ping or win_ping; this is not an ICMP ping.
+# TARGETS: linux, windows
+# INPUTS (omitted values inherit inventory / role defaults):
+#   aim_debug [bool]: false
+# AUTH: existing inventory / Vault credentials; no embedded passwords.
+# EXAMPLE: ansible-playbook -i inventories/<customer>/hosts.yml
+#          playbooks/debug_test_connection.yml --limit <host> --vault-id <customer>@prompt
+- name: Debug | Windows manageability
+  hosts: windows
+  gather_facts: false
+  pre_tasks:
+    - name: AIM | Validate diagnostics option
+      ansible.builtin.assert:
+        that:
+          - (aim_debug | default(false)) is boolean or (aim_debug | default(false) | string | lower) in ['true',
+            'false']
+        fail_msg: aim_debug must be a YAML/JSON boolean.
+        quiet: true
+    - name: AIM | Reject mixed platform membership
+      ansible.builtin.assert:
+        that:
+          - (group_names | intersect(['linux', 'windows', 'sophosxgs', 'pfsense']) | length) <= 1
+        fail_msg: This host belongs to incompatible platform groups. Use globally unique subgroups.
+        quiet: true
+    - name: AIM | Execution context
+      ansible.builtin.debug:
+        msg:
+          host: '{{ inventory_hostname }}'
+          diagnostics: Enabled; secret values are never included by this task.
+      when: aim_debug | default(false) | bool
+  tasks:
+    - name: Windows | Test WinRM
+      ansible.windows.win_ping: {}
+- name: Debug | Linux manageability
+  hosts: linux
+  gather_facts: false
+  pre_tasks:
+    - name: AIM | Validate diagnostics option
+      ansible.builtin.assert:
+        that:
+          - (aim_debug | default(false)) is boolean or (aim_debug | default(false) | string | lower) in ['true',
+            'false']
+        fail_msg: aim_debug must be a YAML/JSON boolean.
+        quiet: true
+    - name: AIM | Reject mixed platform membership
+      ansible.builtin.assert:
+        that:
+          - (group_names | intersect(['linux', 'windows', 'sophosxgs', 'pfsense']) | length) <= 1
+        fail_msg: This host belongs to incompatible platform groups. Use globally unique subgroups.
+        quiet: true
+    - name: AIM | Execution context
+      ansible.builtin.debug:
+        msg:
+          host: '{{ inventory_hostname }}'
+          diagnostics: Enabled; secret values are never included by this task.
+      when: aim_debug | default(false) | bool
+  tasks:
+    - name: Linux | Test SSH and Python
+      ansible.builtin.ping: {}
diff --git a/playbooks/filter_plugins/__pycache__/aim_reports.cpython-313.pyc b/playbooks/filter_plugins/__pycache__/aim_reports.cpython-313.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..52caacef9c4986b87cf0aff637457b1bb291a9ee
GIT binary patch
literal 21234
zcmcJ1dvp}nnP*i$)K5v>dLRh|v_L$Xhr~k!gl!B)5-%f+N-YEenpSs7YSij(S9MEB
zCK)B3oxnJ|NXK?)GM-q(>{?8G5;@5xIQE_hCo{pB>`phOpq?6yH#3v{!+Xx2!^4?`
z*>iUHcW*tq1tLy%XYY}2-M)3-_q*Tw)`P-AJA<%j?AvFhEe!Kd<cAh4N`igBunhA$
z!!ZKGv7F%$d(a>lJS1&AWE70_X%bBIX%@_Qnhq5lv<McIF)wBWD_4Nn##s>CIV)%5
z?3{yha)n$`U4h`>ijnW+syWwU<}51|a&G)C;+AqH^mj40j4P!n7q^@%qbc`Eb6c%8
z%-nMY!<FOB>RgVN+GbEvLfK}9Thz}A<y-}NS%kJLX^RzTyNaeND;c!2crn8*(Q8%p
z8oi#8U$yb^n2_*9W5Pfn5*`U8!m+3)HWcMUp6+2!qL258ec^Z<KZRtpI~MB~H=uAr
zd$~6z@SZ&{9H_I~k3=KGo)8}ick@CZ!Q+R>NBCd@RpZI-NI2-}3G<PV=!x)wL7p@%
z@}8b#G)TG>>pX3NA&<cKhQ$Og@FBavi^)g=z47OQe4Gv|!JkWP@C5Oek0!!_i0BDK
zL!Mx4V1PU$;V6$Bj3>$u@&ejQBn8Z)&i)BmC@(8J0#OW|PEl;dZ_D98JRXkr1_29t
zFd~J2_Q4G#UT3=WcRpsDn(k6po?)J60!aIqTBggawU8^<rb3(chCH{aKREU&qylKM
z*YF3|HR^RuT{g8rz@;`mp7j>AdX2IvAtZU(ILwPOySd$Kmd!m_G+s7DV=}u*HbrAm
zUS?WGyebf2d$BiBPgtZ|9Po(AIDroAU?hxP2}IC_DKQ-9WfLhY8^wemn<KFyUXbk_
zfk={X7KE69r8N(dUm{sBkK9ntCxZ2Xs2J{!@b&RXV3-0@eNQ-oR{ilvvNs$R>jU8d
zzd*rJtcwrJW<TjeC`S{8_!nCdjWTl<$A#vXUwSQc+p>6KTk82ai~Yj3mq%tT6&Xu~
zWT{Fot(PqIH%yP`H%gYq=~Z*~vUK@w$-XCT+VcP{GV?Z{AP&0ueMkU3uu;~>mNFd%
z(XfdT4W-QfWegKrkq;DY1YjNsJ_Bda4w|+pe#2o8!#EfZ+KC!!5i6-4#%pZ#T4i%s
z^oN3S5qb0l<9?AB0LAooA68r#^!LTYgk0Dc5dDKZ9~kftb_?@=#$;#iEk7WaqOD{!
z+!OW(W6^{Vi$u_1iJln~)lOQx2D;3$v6oMHjY27=Bb%dv0RlMvBAKAa;}Ob8wlf%r
z2fD+6hcGV+E0IOAMFQ5N%v}RpxSt(u{)a8wCC85MteQOf6@IMw@`3RKslY_JRJKMc
zT6^2M_T5z($BwjV$HUu>9ij;}zr3p66x0tDGK%nzZrKN$kbBzkI#bU?4L+un*~jh&
zzz;ZlEXVHb!~v>jn07~-dN5H-57+@Umox6%&oEJ=&(Q!h4uojs%%%E4OroE7bF`q{
z!4;4*jHiV>IVPTpT8_NfMW#=~6Z!%2e{`=uvyT1oI&nUS1~^-1$40=S)^4nsv+ew2
zGKVLO!GTdb$*8p&+V3ZnFVxnC%+Y6DtIjZFCG&oUjhgUpeuj;oJ+huFTFi7d`wAM2
zkFS}}tknzv3Vfz+H^X%4NUyVbqXX>~Z^Xbjmo~B^EXPFcK0}+1xYW+^=t6lVbe`*c
z&1ddBn;RQJw458YOSsZTt2TZQAmXr7Iai$}Tv;7XmbbiBwhV=%q1ccp7jQuMNl~`#
z84QFY0U)4x2cAIRRsv`(NbF));&{Fee2#;@2+Pg38x{gBAFFjg$h>a$Fo!FZ0rWE4
zjXmsjw)HwIc+ehDu%T{~umVZhC}1=MlsukM<s{jj?&YKWxwx=Pt_+36ezET9NGu2h
zy{k@tvm6z~rHFp}2{X#1t2=LRJ~p{0#l3m#%CU)~Z=Oh<K*mFQhF)G)!=gi*Pvk?-
z4JUAP?d>3T5hZPF5qMrnnwy01ATW4aES8Y%Vt9o2CrCko96-5<W(2gwk_$roU^vLj
z=7Cr;nve^6M1ubpUc=pJAa4Z$5;1o-wloi2>MKXUKwUkoG(n5X>Iq&n0s>+TM-$f#
z!g?|$_MAw@rlKHWBho@0qBZ!ZtD`K=iQD^+Pj9~Z`8T);_ZuBIYG;=2LXNUJU#ecl
zeiB0YPv|Udxd}RwQT+$du!*2OVLM97#h_2TI1GMdz)y*uJ&CpTchkjn&^1$k6zeUh
z8BSUfSUU(#MJ^C240;W+6~r&m171sZ<Qf;f1r%I_oupUeK;WEg7O>hOxd8kLkEbaV
z4ko-#ikJo9GDa>?*dy808;jvR=}tD&A<3p5Y_+flrIcwHdPLb64<>{S$P#f@2r}2g
zZUq+26aWPuUM?o3HUM@0c9h9F3P)S!ipwq-vyRfSVaegiy2~zCj8~*8CHIPn{)~I`
zg{Hac&dlaxQg!FWBNv*+64}K|Q@vL<Oo)@8yZX{p!<c|f;a3%lQ(NEMer5Z_(^IUp
zWQ$a>^?Q477=L7W&ywE#Li%W%w1blx+Q(|=++|}&$CBeCX#Yaf<crrUCYsRVn`^GD
znOHlyb#mzX)6(J{H%f0Dd#`#r_|x8-y|?<LmSd!skBdtuLEATuwIfQcLNsBT;Qpcd
z#I3S)duL|<ajE)*GQ^M9Z<=b)Y-@haJQf;1J5f3woj5w<T63%6!rrX4=u+Xu!q-9*
zrs<OO89uwd{?4(kj~wYh^q!Heh_k<8Slf&2y(NsR{O&TQ(vxv)OPjU{fMEvv>&BK3
zghde?tshKkm=BF?*b@x$qUae4h~SP%mS?Dsk9q(TLITXE!efKJ<CN8*i9-6qp9l}|
zv1DSTv7NBs%4<(39HN{VHa{K%%bSQPwMkRpcV7g@mGFe49#WaK<x(s9vAqQKg+?m#
zn**Pxy&$FCT4^xJ{vHB=BTMs(M`NByEZPg!nm-3FU8HqFJb_R?8XWfb0KuY*t$XND
z!eG-eVePFxhhQujQD)JNiII_mMMv+>NURsDrZ%!FzvDm<m7)o7`dU?#^~9oe-hxjE
z(fed6(D)}SNK{Lr4J6u#Xdap>KuO9|Gy%8?l3xh5bL<oHb#6kVV^KCo<#Pm~3%x4g
zd6rTv5Rop@GYt#%2u{YRwV4ERim%ME^iLRz39LRrV+a}{;ux;L#I))3Q+Z2EsL80w
z#|CQ{a8jJ*D5$#+Jkb6MhM|4-c7}*Z5kjkkn&w9Aqr8wZE)R3WKoE83N*~)`1f8|E
z%8n?+sX-nLW{8*VJmLOnnrx^7$m)jH<Zmc_qXVo`q7Il(>=g*BA7)%QO%|_V#D%RV
zhlfBaJv+ilyvK_|^~Jng*`9+p;S4P(TQvw5PAfHS<Zy&MI9tLgC8sD9gWyPnS_;>K
zU&$_{0O=v4O9~KvNUn;g345ww>mshXt>eJnW`A>A+mSX-z`z*+To4uqBtI}Do9M~_
zT?fQiRJMSn76ZMYzC@NK)VCK4h~`C-1F~R@CI>`tVT^{L75rSN9ZkBzf`9^qM2TNV
z1T<}PUaGiQF}5@%zBzPdXyUxIyg{;U8*L)OQq#*LZ<OA)R8KUdLUW}xv!$ytrK=`F
z>Ggi8^voAqM_Ybnb6(&s9lLmJ%$M3C6)ux(%O}heWog^$S=)w;ZG&X18*R#39A7+t
z-@ulI*$ei6s$6k#|AnS(ap}K3Kev42WH7UQ%XraP!Mn}(%uLnFy9JE1BvqSsEK8e~
zQOp?BPXNYCR)?O$`-o2)Pn%Ac=8M@JyO=UynxL#fc(fpojWGF)4Un-2FHe}Y$I4nZ
zF;Od#-1ff!HqPd=EhMGk+yN7ipmVVV{+EE0UAVkylg?i+*q$zcN9~<&>*r}N+RO3D
zq=)AjrZeTU6ZYkBo5K9~AX|1gbSV=IW$b;<Opu$;v0z^XoJGR{kSsy8RmsvZP@1<+
zrI2{6bd?GgSS9BpC2dbES@=jv`x8qRK~gLBS=-3a9|_tnVORQ9ymP(1bfMY#?Ap$7
z4l3o5RjYpDzBskg`aa?q=Hw8cO?yvdy{Iedj+PuL_1W7?pThnJAg^$Rd2b51qTDZE
z@j`Nn&+c>i+`ba7xXz@t?O_fND7%o8V&?BV=K|B~?(EH5OI?o1<#iDZNQ19HYdbH`
zqUBNfP=#Ngv-4wLaaXZcGq1e9HhFn^uNzTcYcE&ZSG+)8ZY<>d(%{o+;xnwa@*%9I
z2j^G&y`JGp8Vhx8hXdM<($;xonGj4WfkB$jmmWMsdRT~Ha{7=J6#yk#RR9j?aS7C^
zQpE~YsxT6n%xjX(AUX+Nwup%sQD;&Hxm8$)3ebKiVutvbm?1Aw5${66**?@2S0bX~
zN6Eo&^h~&aV1Cy;)%)F|X<KH~fma*HHjj0DwecH04=GOnQsp}K>&|uT!t?(SE$uSo
z$xrQn_zEnzUivn1RBuSvYZDY5y4W88+kn+Gk=1L@m3b~N*FcU6t$8??tFCm1y3%I4
z(gi{i%?N{tK;H;|=N|xb0EWO6NG4*k1uEje@ca!h(G3uWNF59Gy^$oi2}?Li6I8l|
z)U1fjiu895CHLcB>_$Xo<GYNZZ1pz=Cu)9B{%-ly(07+jS7kOIeDy%qS$L`WV)NJr
z$+<kea$Cl^?SYXgU-t2{Ew^fJwS44FA3L2nc$((@(ph++=i-6Xv5d3!ff<Fy_Kfv>
z^}sg<ABvy}%*&N~ma}h`BKm$2qMKF=iA$Y`0ag7}NiLh9Cmm3PFR~1>B^m9HLY=<w
zmSg4SD;=O+{A{HI#}J%IHv@Rz$Ew@lQMZAm+h8D&PMK>3$gdk!Adf2IDEJT{L$Dc-
zF6&X`KEUBoRSvG*U)wkK;>6(FBUeYJYTo+%R5-Kd*~{*6_t*A4d|*Yfm#e(&gw6W|
zp#J|kLkeTc?1VqYNS-huP*_IzGKnrAnzs>T1t{+M91`=iKj83U?)DtiLm8(pG>FS1
z`ikq!?-~Gy#zk=2>WaE|eC=3@omzCg_;Ss7&DWs5q04BiV#n|=yo`cSvrt(I`W!b!
zTTtT$G?mOq{R>b8Z=}1cOI5T~o`3||D%MSK7lbQf3aB759V|FeNSyva4^g|*2Ik9`
zs^VWQ=LsaJcp1-ir?g2eC}`HC0D1%?7C`$LAxOq<4)*cEe%TD&MP%4pD4WRfm)+qg
zRK|fwWEdS&3@lq=E9xaC0ofKv;Ml|=2_jQD{vo+A$`7HmIv64sha(ZavOO8qCJ03h
zT`j1wlu4;FG;}poZj_zsd-Yd04-E_vS%^ZbNLdW6Ew2s7gPJ_3N(Nea3{0d9w*a<{
z5rF=nqY?RpY>e<xfskBpnOvZ>DO=Tvh?qWEWZ?^>&gV&Vi9`e|3a=u9YA2XTLg}`F
z<m@34#eQZwX+o?pSroz^Vvtr<2oZ(cT7!jRgg-$f5(PZOg)?Um<pou>W7Q~_@E0i8
zLMr?SxcpyWN^zECN)BG_kxC9q&V!@-<_b%HO|a<I!3X4lsA%=*e!|Tcjkf$<aRt!=
z6<ykXar;=~tYc}$vGmHhY@v%v4jrlIq{8L1g)1|KD<@i{!u1zSSx50N982DAo@l;d
zoT~li)AuZltMZ<eY1}0_cKy&iwVB}BvA|`1oKNkWI3O*myX~xd&zy1Wg38J6nsM#E
zvQKisQnP!s`LW*)_l$eTm1B~72kZ=^E!o22(f!%-C6`Z*pZx0Si#F1``_j&fJI6wj
zV@c|`<XC;(stta}tfM;PsGjpcaFIM)GS1}}TE@0tX~-73Q;RT*tmmwr_e;-+noc!j
zt*%SO7mFuMlRY<v(!S%F$`g02UH9C~qS{YO7^mw$n8%MzZl69jS5lc;^lIHZtG`z|
zb?m#<9|Wh@zCV!Jd`MdNe7fsQcF~d>eRGSd-dLI9|7_hgZgSCEU75w3q(z%Q5T|#%
z|M{5{r_!f+=|s<5#gbI>t1rz~Y?@qs?d(09$+_h&V=`}fcz-G5d{!h9)rZ#Q`x@pO
zPDnPe8vDSCJ${{m7zDG)LR`UoW*o*5<3fx$r|WB@rkr`gr!&2rVJE<r@DDk5J1180
ztk0ALe;4nFpCkMQW#xhFd@#V!dIqrdfc=Gy0i7KUh8!!cjaL(T+H^J<GggC7XO45s
zxQ`eF3PujU5D;K)1_#m?6T-v>3=?!b5bTFA?rD0?1J#)@yulNPBu;c~P|Lw038gp`
zS||p~XM~S<V2>l3J+V$^ZJ!Xnb!7R0C=8v@%4to70*OF(06htOFeX5Q8{)gefv9ZL
zoAX-07R6ydqxNc?bdnaXqBWre5nl3%5Z@Dk@mrW68OA^;<h2QBNs0X=Y9+ZQQeCzL
zW0B-QRHPUL43-e=lP&5n1<IciD~pa46lH=-9jsrB2I690EFs)LAs+uC!BnHnFNxYW
z>ngomG+uPa<-uukm0h-v+fxk^ep%)mMHhx%c{=5O<=JcN(i>Z)6-Uz5N3u0*Ggg!x
zTSIikoswhe#OlfQ(u!^Go`X_#)>@UZR;3zJ>#qgh;w9^bS?i{Zb<<SE9c$w~2ji}}
z>x9x^^su5XfDoYvP+J9}iG3npQP8QISaZTtXNd+M@h?LVwdKr5p>F|33B9Kw50-V9
z$;-<LNEnGG3_)!DQ&nvJrq8mFZNKxIfLOvr)9@(7LMYCkms;v~*NM+{{%2hPCMU(V
zkT{w<B|bX`g+XqfzMS}{&)ugR|9sB1>L>yL6JMeJ3oFgBN9>Q}7$CkHp*}P<>T8B`
z_7#O2%8j9O<-B&xs0C$3p7^O_51%b3bP_d%&-S>IBCiD06Q5B6YKetP)I;g%Gv|#!
z7iM#UD^UY@m>j%7aCI~~fjgWqCMM%J*AQ90jpdRp0zVJ~Uv=H0oH~0LO2`DP>@co7
z$q59@0NO6_vNIM5!B(#z4cQ6Op8G}UKX8d`=<ilogE7*!`_ZE*F3hh&e9M=WorGKE
z7y^2biGd_kkpNsQ<x~w+Brpm$Q9$@1qE_J*k|a8+$7SAS@jxQj=LdpGo?E~s`4Xu_
z*jXy}dfR@sX8P#l{_E?fhVQJ~{j)U>9}vv=rLslyB?1C|l-2%!89G`2-!*jMFHzt;
z{&VA7((=RJ8}3x!l|z$D?o>DYu=k<xS19nWzpU^7-eV&cPO^4)8Rj_qoZ&v`2)oCS
zP9)P^!OZbcx+iw$cudVzMtj|<VE%E`1cy9GAPzQJD_o!A5uRu@6bKdNLKRe1?zUJb
zJ8DLu3cTu13o*}t+Q~&Ki>$R%Eb#EYfye-(60zjSE;R!NE@HprLtZN-8v;>5Q$j@<
z<{XnuSz~a@$pLSX@C{Pv8i@d$Dlh!kBy}5+Y*pGuFGidg=)n0Q;pgNnFdid(pA=yO
zGTSWzo^!;EQZ<F5Ir1P@kWuJG{EN$2>M-Q2PIXAmjWcz-ZX~6;R&cT4XZL;VaLrXM
zzh<1+`<C^c(n;={l^M_GJ5^gQ9)MySq|Y*LNtLA>*Y>{EEV<TAZvFQ5>)WTArk?sh
zd_O6zZ@v)77Q0?ajCW?8rI%VSw!YCY(LU8aotQc9PoD`$$Gd0ZgXy7jQhfO1+Ew4G
z86W;D_T44Z!|C=8m=UWx*?(r(!s9G>;>BA(wS##~RsP3SSBGvKOScAQ`eW(%IjMg*
z>#DdG%y`>AS|fSeq}6S6l}j>9THfoGmb6HfEi=B(dkO&IK>+B1@(Yg+KvmXNGO=RH
zKhtpnP$hMQW;=xRfG`sl?pch^1bde;niH%-ZGr9eP>K}gAI~FJ+-^Wef%RcNT9A+A
z*x#)b*Qg+<=ijT;vm-|%eFY2grkug|n1L%cxL`?)Or!Wvpj$;lJrElD0;EK(dHv`V
z{RP8emx2|eHkb$&?q8=+oEaW|t3Vrb3QnkKz^^Vq$#Z7A&Ljtl14>!ogNJB7wLDS<
zKKnE3qK>uEsBs-0hO_w!2%@G6ADkgy0cRta9!@l-&uS}2m2)cfE>H_4U~X2lXXorY
zKL8gGIPlp)twH%XXQRFbpz;4zrSU}CrQr#%pmP@5=rvAYJ)DZPbO02<gB8u?gw~Lp
zF1OyguCaVVKSc|b)!=|SdpUBu!4>CrkD6qu8lEfhIednN+JPspy|dv7J(p@T%kd>o
zC|SmpYa`O?<YugL8~U1n+gL=n4bkAif7A*!c||M5f$-{psK5&!VsR+{(M}1tfDMCx
zk%A%r6M07p$YrXcz~86%hXBooc*U_tr3|WpUDMsrszFjeLZYvbMi%9WhC&V$Vj<uh
zsHl646f0L<to&*rrALa<g<qgRi|`R*NG={cgf~fqlgH#y2!hV38I{rsDg$XwE>v4W
zX+WA3qT@1CMk`Na@-%rx7ltZB2tj$&zr~~4PZa{8j#&6dlpH0c|D2KtN)S?pG0Vi3
zR7<ve@#W*=$5X?TB~tl@+43!!@-27D8=zD$&lS4HN~!xx1-u#EYox-p7fe6ueXn;q
zbZg7Zu2yN|k=wgkZ@AwHPSt#?C$p<{az%RM5l!##l;l`G(Qw<b=KJP6qH)WVK5;UA
zHj++!{w~8jXJ|42omV#-ehshJ7DKkE{8IE{^o{n3#Izx^bni@2Q`S*4!TrLq7M?ii
z^7R?_2GA>K$)&>=55G}6(e(3BnmhK_XJ=0OZ@2o>p}zFleks&{Gn9TYiRQn+9wyB%
zX*K*anm=N=SIjKh_Nj|0Sv1C94v&W?tkNQ{<X$&ZxNf%a+?08C)6fTSwRyjKI{DM#
zo5Sg&;hD1o>1a|qJ1FfN$}|p*?w@lMr>efc?YiYgZ~90N2p6SVlWX3JOm9we?demY
zY~|87ZC7mR6<ejshM$CPZTp+Xj~dfH&`Dl8)FZX@&bB1e@#IV-dCzQc4uLco%tP$M
z`);Q01(xbLZZ0lwX)Fll<4q#gQaaUx9fUK-f_{1&JC8b8bn4ImetBp?dZJ?<4O{7I
z_5v-3;E=;Bfh#QwwxDBfP#UO}3I83n!pU-8ea-~wYMxP;qjFLd^a6O@$XTh>w+_AJ
zN@4zwv|<B2F)cWX$L2vXAHnX9s68hic8=%KNL|wPSwRzUm!Yvh$4C}nq#{T{${`n_
zc<2kj6(}T-W0WVrSfD`}4D&;Tr%ME&q6i6nC?VT|aM2GFDM}!WvTTFjztTcGoGQj?
zRtSt{FcA}mWxHNlREn4CZp=O5-XyLUKy(twc?Syg;Gw8xp%W1kUWaVPY3~z-|4v@e
z-psVR>{MD&<^V%el=?)`(aWqrEmL5oLv%RQiX}SGgswf&T%avM;w7Jq3!mcc82-ht
zB7z%6?fSP5T|G2qyRl-X_8G}}=63BfsTY4*ezSafcy`axS5D2G@V|2E!qH2<i@veX
z{kv0{+Gj@hrJZL!E~~m&@vSvihNgz$XkjlKZO&Sp7tTtS%8zT-eyjOn|Mc^-P3@Vc
z_O$QxY?D9J<bQWK&BuX{9K~bpAC%qT-(Pa;Shm(X)d1$w*?5;>&5aN5JD9=%D-x3Z
zdew7vrtg>$y<d)K<XAi)ibGIOou>)q5$_YAw>mHKxL=VtpNRGI(et^h7U$z|8pZC_
zJ=@O@pI6mr%59PJ<N^j(HZi=*iq2#s9~~sBs9pjk%H0e|Dgz-RP!d(Y(3>29zzqLX
z(!0{F>_DZk5Q~yG@G)1a(Hiq4H9I<>$NoGH;c4^fg434MR^q3RD?G5A`54YfStCR4
zibk6Wbsh=03}b@z8f}oE_*pE(N@>h1SD>po3F4sv{ue+!BtXr%pyw627NqqNHRh=w
zjBPq2rL;g|PWO4x+J*1KYpQZJ*Q>73d19|R6Q(09FjhXc4e_JFrz5K)VB^8!Q)Mzq
zbrC^;2A`>m7#L{KW}~$n!uiN!w2HKm^FX`<1zki*pwv^J0~VlUcEHS)`OLlopT%cw
zFp;ZLXRT-10c%&eS`6sC3kH29JYjA1S!#WDE%}TZE-16r9oOnSp>4PJzTLV4UhO#|
z(q2Hl&n?8qeB@{wAAlbjx%HHQk0$XO4td~+E5HmF1)6#aI^YnrJh0J`BUP^gwRQ_i
zu^6dWqZEr8Wz<?_6G2}i=B|?`>rZ|1zY#{<)THJg=&vK~*9{LuM%K{lR*&U-fH^%d
z{?Qv(Vjo0moWW=Ur;2*kjhK^(o{c-g3}a<R>h}^u-9Uf-pjF&TFJ1AttEJq>!S$bk
zF#MPmzt531T191|TAhI;yid`0z%!uUtHM#$13{$#D)vDuPUtSv>rA_iW1lfRLwz<l
z!$#=yMWbkdD1hz9l?{M?2w+c2ks}T3fp!?wV@D3Iwo!b(GbWRB!pu1`Ht5G)1KxdX
z09<Acd~^4<+8spRqE?MuU%JkaXK|^5%;u4>P)pkQJj}8@?Xxe>!BPWBZB&7y7?W<>
z$c+iot+B%-Lf#dLd<!Ww31E&lv^!TYoqO`65&cNlvl}r&tfhfGx2bypuEe8oC89BE
zq8CaQKn%ZoF15t2WX9pqkwk7OG?a-keyEPIH^*=I3c3i>Ps5`#r^rM{j5+70XhG*9
zWiF8DbyU=*BNweb!X0Vrt*vJ0Ajxghkx8zsHqI`%P$+@yd1wpD>rxrn3)rnF{Qa&r
zI1A<0c79f0oRz}WYCtY7_z*~Mx3?`-yU%-Y_BL|y<B{Ogbr{+#A(?*<Z4d}J_vk(=
z?H~S$ve!N{VD|rFpYwK(dGgK$`T?^ZZMbcVv{dd1g6ja(=gO?ez0*<}glc;isQCle
zN4Hhx)~DCTITu_@rj1Cmj|2@SwEDGhWb4LB>mpl4L+(6wX~Sf?z@;mpYlD_*P;O}A
zgwngAIjGioY?ZU7XRwE<A(z<x;Qi@go-r<G;N4c(N=e5j1Y3Plf++mLkD(M?wU-hi
z4L{?uW|A5vbnH&i`bd2nA56kX0gLE-gbvFlSVHAaZ8EA~28Bn55GM{@1xj(kNhbtc
z2OP0?wKX^G+1uXSbV_FHM%s7Q*LR(+KPjGCzf*ngKEL+aosY7g3bUz@N$*K<UDq=^
zPo3XL!gJ004zzme*1gbnpkq&av*%FrahdgaD^ycySfr{7=)$Q0Ap8$ZT{eV6!goo+
z#>1JK-bJR02XbeI7;dO4Lbmw1=Dlsr?Qr+tiP1(Nt1nyqdygDGyr;E^YAIyX*;p7R
z8klm}1Hu#v2vlW3wo`HcHupqgfrPhE5rh60X~GO2^hBS`h6SRYfJQqBR}nDHvJsYI
z+0=*2&2Se<hH%wV#wBOMArPCgY!Z1sDw~D^k$#cje_iYtMW9*?fhe@)YD)75`k|B|
zTt?17Lu&p7DvHYhcE5!<VlBGx;w!eX%@>`o*s>1SSjj6p#s*V?@!^T`SO4gpv+2e&
zQe7auHZbQX9}B(FbgeA))U0C-6clsC?y=fe&cWPUy!_fodP`7R6H3>FvQF2f{TKJY
z)|N88+BxG~cGqApTsK#`G!?qmFk8AdQ@VDhE0pHLGhJtAHuvA|I-6-fmTvdGTRZh4
zd>b~uKX{|>y`|I1TSspW-Pv*^({=Xt=Ki}SOnKGiL*s|8873Ouvi_pXd)LjBSBx36
z%U8ZRa%JS}=g0Sr?VVe)Y9jc~%Go7#nI(1P;?Q^ZPZ_gSOH=%n#bZr#70WJvVf+gd
z!P$y+nTmCj!EcAJhrikXL8nyL{9kIJ4@q|(&u}MZxicB=jKp=PLuV!KY&s^)#?ED8
z=cL#OR3m=`5#j*|DjwOIjVa?5>*UC6{q9Wt?&;E>R^F_<Rr}**GxaZI+D`oK(wd2t
zliQ};*SAYcw~p<7bw3Q)o((WyS1!qxRnD7?vb0-g9m_M0<-aO+UmE_?;dE6T+L)Qa
zbF+gZnZc3S;+HbTFJ)beXI(WJ7n**1?bWrD4R6)WxHjL|@XOLgmv@ZsNHx8A<jN7L
zdZScYmv+{{x8~y0Fgck1Z09?*?}*>qmi9JEOB$zZZ#*?uTr$@1%5d6R`S8I?W=n+q
z?c+=QFCsyHH+QZ)Xk|WJy6T{z;Kv3d(m(d>t-|AHh5`~>s}I&1$rS}$5LE8Gl|}+$
z!aoH630xV(Eed}!5tJ*5XIVH3&np$Xg!};ccrxL&2;@KrETC5Kkf?^hFZ_{Ih%Zv0
zA8uMyUYE-VhYVEWSG_POQ|x6aYV#J!rs2RqL?|H*y-V692bSUi!9!A45rIRE()$)R
zG0?;NaW+GOom4nXN=%SQKf6#&681${P2SUiGDzX79XvRMB_y+&L`z9T4xUJ4FnTC=
zBPeRcqWNc0Sch_dj$$II`aegRe=-$kZABLbFD@l_F>GHx_oZ`V)>N5fS(XwqmKC#>
zwHeD=$+9lJ;aSP@>|9Z0y6QQpXm8rOH|um?IspHu@Pt8fu7qzEuDNf&wCm!o)EddL
zLb9x!*e_W&&>9D&qC;uxA;|x4AGms8vTwF_d!}~#g|bV_E-p)1W^A4tZBQ$a`x~hh
zW9<q=Hq1J3bItRPJ-zj$wDweb#i?wud-UKN#y>NUHB7uX5ljvK#!zXly3Zi`bPEhr
zW9`?<Ciu6*SHn|QX?3Giv-2mxTdV%Y3lG}%GwDFLbTBBjgtFB&ZyvaEAier2sru=g
zp<4~<7utS2kgcdmZ$C=3dmPp7ajM}73N1Ylh8ip?`@o6#$+xp|vKScRoI-E^AFj~L
zV{JY|k(U!E9%EU7X%FuPk+&#%2gQXNEH>CqP4P$FP<~$}9bnpL=FFP-fpmf9{=r$G
zytCG`aB8t)?si?7Nlab#JohUbG3dZ~!I)?2g3_<^z0a)WoL>uu2s;tWqA-;Fo=V2W
z7{6md7ZrW4$tO~j@o8+92W}VtitQJ3u1DL?t<GZ#RNTnOGm<&9G5HJ{e-{8eaz*v*
z5$H5J-^Cg_^_9n*Vn5gS9Qc9kIabXH1*)#@4MBQ^Nsr!IuO&u7HKm$*pjcH?_61T-
zs9noig<s)t2>*>lqln-Rii?&+-vA!W5QCa6$|s=C>les<j*%*gl#~xYYy^{_e)yqI
z?9=oJR1LZ@CL&8w-Tn}*lDp$Tz_?dRxVb%~vzsJ(pY&)^k+y76Kh_}^&SMovpwEQ|
zOkJ?2S0EZuxe~s$u_Q(k@)P=?b7I78V4O5dW+S`s;TAaHh438;l_scqWl=5$8x@J+
zo`9cDN0fnUsm59Vt$Q*MEruwUsh;+Jda>FckKv0m!`g*CN(6`^P@x3RlN6x@a8Cvk
z8wc-7=#uia8o5xJqiWX@z#L%7;j$bPLHLx>Um^{_MFUr?vE+1(gnvVR68NE>yz_ZD
zLN^qWQLK{;Ivr8ig&Ma|Rs0GP;M%q}{$S_3J8y(<8D_Q~0!LD|&v1L|p~=ACBtJ?L
z1@IBSROX!tMbokPY%Gz9CDO^4q}cgSiFK#h@Ef9zY%!n+xx9eyZk(Md^Jcal8g0ci
z&=fUwWi7>DKL5q@V+Up}%QBW_6AkJ0Pf07E%5G|y3VqiOlTvy&mv*&Zu>5UHyX5qJ
z7@c;1r9HK8(mmy!DSY~7lxVGeS(D>dg;ad>XBE?XUNfbJCihGopK(3=QAMWsXvTDO
zbYIp|HfyQOSSnLhvzC<^kgR=gw_a`iUc<CEee^`SyFarvGE+N{wUjC!Z%Nr^Eh|73
zC$_)6>*}uW)lM%@cLdU5A+trCS($*YTXC@cpkdnb{xf&NgXykN<^-QU{{>i_rmfQ2
z10Py%Y@Xct&eEIK%-RF#<GmlRUOzUJJ`f~?ho^*xXMeeQ>mxbD(1e9~c;CttcCZiS
z;-e(#J;;hgMt!}id5h^gD-hkRbRzz+w7hw{>BGA6=BEq((pA*Lx`H_0dT=2{sn~98
zX1=qc&!poM&<qaP1Wpdjf-bkZ0_O?ub;JA<-h*anbc)=7>@e&2$^%?(&N)khy3pIb
zKJ$X($kSeP_C^D!2^K`faOOO-kv`rWmgO99#4{*gBzfGW4{r*|qTyMjK8wkdb2Zv^
zgOeGU&)u4{EK%FH@B<W+i&U37zZgs60}H}#WGV<NNm5@#gezTpNSb8KGaz7dKHCkA
zkl!bG(A8sK(fB4jge`~^Z#4Y|S@3ahI*)eX=@pHfxTb&OLq=~R(J-h!Vf)$R#3yXG
zq0^8adFj^rkBZVKl6Uqe)jY)`OhGiCBg3E=Xa^aWT|rLYMq6~H1OkQB?O!g|91B$}
zDwog0-zu&P$qIVHCx}$+o7cKY!JQt`I>DWAOpXG<0yU}^O>pB|`A&hKeCq@hf?_!J
zlTHG;b+2sa5Gqr<F6E{*3;n!h5)PsC9a8Qu5#g$WcKUC0{^;a;CvUBnp6N*YduRRq
z8GnB|l9c>|*^1?t&ySx^*EUR@k}CH8?U63Yee!4LZ`Hh3o7$7=xpH7~&$pYeH&3m(
z;gvQt&6G5MbUx!gIagVo@=KK)f3o);Zj@o=fhKnw4wFZ#;h44$K*Qu69?f`UD_5mg
zZ_iZjxK)_$=*jHwMd5S6y?C@3I*5V&9DB?_JoY=0XEJvh9{!{Iq+-c7uX%2XD~LJi
z0TU&GeE{AGDB~mqCVZ9703O*$E;!>GbVkA4Yr>beoGtWwS%+hxWQ70ZV-%kU+ID16
z+|x}P>O!o9oGmQJ$>tQ}T~@suX@Q2Ei%?GK*X7dQa%`Oq77#-#F3VKpKHBBa|1y;9
z%6maSE+Uua<*0xn%8T+c6(0@ib}Cmsmal!#rzG!<YKWDq^79m<hN>Qs7ccZmA-(fD
znFoH54Oe2e^m{1u{7|Pt;U7sJ2rWYeJxaMLpyG2i(B4FPl+T?hblw6s1l$7nlKfq(
zQ*+@^rJQ+y_PWpgeAP@(bk5r_^TMgQRU3Z3Y;NPzGo3sf^<2FmTSi;2A}>*&-Bxnq
z{C>jy`TerpPcByi9FTVU{V(E1k@}|C4@O83=`Dk3%<mUY0MO)eKe-{52nYSRs3e5D
zllV>$-n~NRMAWv5p6M_-sw5&XMsKJ63G-`%$*hfoyn^AK)*?}h*VNM9+TvyLA+eSg
z?_wy|{GnJ-8DCG5_(G!-f_kA*BcDMq4Zy-hMR_0`@>w#4`>P9d2L;Ndm6NgLwgC1j
zM!ADU6kLkmDM6dL9igV?IM`yLlnlOzL@p8$kvz9kbXJc{SGGQ_tl=)97lrZ1i2okZ
zT_ek~_Y5Z1^lLlAuKYX3LH}%j&#b&(U}B$R?-v=_#`{h;`?<U87|S6xYwO6`c4Te4
zvbOfDZO^?zi_0)tbic&OF8_2{HM`~hE*o3&X{D1*u%9j~WQW*KJr=g{ZW&{9T(bYE
zJzWadn)qx~$V3InDvnxYTlc8-zG*Ei5TACi4wh#>tv0irhTpi%Y%hDCAu-*x{{xEd
Bk|F>A

literal 0
HcmV?d00001

diff --git a/playbooks/filter_plugins/aim_reports.py b/playbooks/filter_plugins/aim_reports.py
new file mode 100644
index 0000000..3756c42
--- /dev/null
+++ b/playbooks/filter_plugins/aim_reports.py
@@ -0,0 +1,398 @@
+"""Report normalization owned by the shipped runbooks, not by the Core API.
+
+Only deliberately selected public fields leave these functions. Raw registered
+results, exception text, credentials and command lines are never returned.
+"""
+from __future__ import annotations
+import json
+import math
+import re
+from datetime import datetime, timezone
+from collections.abc import Mapping
+
+
+def _bool(value):
+    if type(value) is bool: return value
+    if str(value).lower() in ('true','yes','1'): return True
+    if str(value).lower() in ('false','no','0','none',''): return False
+    raise ValueError('Report boolean is not a supported literal')
+
+
+def epoch_iso_utc(value):
+    return datetime.fromtimestamp(float(value), tz=timezone.utc).isoformat().replace('+00:00','Z')
+
+def capabilities(value):
+    names = ('is_dc','is_dhcp_server','is_hyperv_host','has_veeam_vbr','has_veeam_vbo',
+             'has_veeam_em','is_unifi_controller','is_unifi_os_server')
+    return {k:_bool(value.get(k, False)) for k in names}
+
+
+def disks(value, platform):
+    result=[]
+    if platform == 'windows':
+        # community.windows.win_disk_facts returns disks -> partitions -> volumes.
+        # Report attached volumes rather than PowerShell-session/mapped drives.
+        for disk in value or []:
+            for partition in disk.get('partitions', []) or []:
+                drive_letter=partition.get('drive_letter')
+                for volume in partition.get('volumes', []) or []:
+                    total=volume.get('size')
+                    free=volume.get('size_remaining')
+                    good=isinstance(total, (int, float)) and isinstance(free, (int, float)) and total >= 0 and free >= 0
+                    if good:
+                        total=int(total); free=int(free); used=max(0,total-free)
+                        pct=round(used/total*100,2) if total else 0.0
+                    else:
+                        used=total=free=pct=None
+                    native_path=volume.get('path') or volume.get('object_id') or ''
+                    if drive_letter:
+                        name=f'{drive_letter}:'
+                        mount=f'{drive_letter}:\\'
+                    else:
+                        name=volume.get('label') or native_path or f"volume-disk{disk.get('number','?')}-part{partition.get('number','?')}"
+                        mount=native_path or name
+                    result.append(dict(name=str(name),mount=str(mount),filesystem_type=volume.get('type'),
+                                       used_bytes=used,total_bytes=total,available_bytes=free,used_percent=pct,
+                                       status='available' if good else 'unavailable'))
+    else:
+        for row in value:
+            total,free=int(row.get('size_total',0)),int(row.get('size_available',0))
+            used=max(0,total-free); good=total>0
+            name,mount,fs=row.get('device',row['mount']),row['mount'],row.get('fstype')
+            if not good: used=total=free=pct=None
+            else:
+                used,total,free=(int(x) if x is not None else None for x in (used,total,free))
+                pct=round(used/total*100,2) if total and used is not None else None
+            result.append(dict(name=name,mount=mount,filesystem_type=fs,used_bytes=used,total_bytes=total,
+                               available_bytes=free,used_percent=pct,status='available' if good else 'unavailable'))
+    return {'platform':platform,'filesystems':result}
+
+
+SERVICE_ERRORS={
+    5:('permission_denied','Access was denied when starting the service.'),
+    1053:('start_timeout','The service did not respond to the start request in time.'),
+    1058:('service_disabled','The service is disabled.'),
+    1060:('service_not_found','The service no longer exists.'),
+    1068:('dependency_failed','A required dependency service could not be started.'),
+    1069:('logon_failed','The service account could not log on.'),
+}
+
+def service_error(raw):
+    code=raw.get('native_code',raw.get('error_code'))
+    if type(code) is not int: code=None
+    reason,message=SERVICE_ERRORS.get(code,('start_failed','The service start request failed.'))
+    # A bounded fallback for the existing win_service module; no raw text export.
+    text=str(raw.get('msg',''))[:4096].lower()
+    if code is None:
+        signatures=[('access is denied',5),('access denied',5),('dependency',1068),
+                    ('disabled',1058),('timed out',1053),('does not exist',1060),('logon failure',1069)]
+        for term,num in signatures:
+            if term in text:
+                reason,message=SERVICE_ERRORS[num]; break
+    return reason,message,code
+
+
+def services(before, attempts, after, include=(), exclude=(), check=False):
+    stopped=sorted(s['name'] for s in before if s.get('state')=='stopped')
+    eligible=sorted(s['name'] for s in before if s.get('state')=='stopped'
+        and s.get('start_mode') in ('auto','delayed') and (not include or s['name'] in include)
+        and s['name'] not in exclude)
+    actual={}
+    for row in attempts:
+        if row.get('skipped'): continue
+        name=row.get('item',{}).get('name')
+        if name in eligible and not check: actual[name]=row
+    states={s['name']:s.get('state','unknown') for s in after}
+    newly=sorted(n for n in stopped if states.get(n)=='started')
+    still=sorted(n for n in stopped if states.get(n)=='stopped')
+    absent=sorted(n for n in stopped if n not in states)
+    failures=[]
+    for name, row in actual.items():
+        if states.get(name)=='started': continue
+        if row.get('failed'):
+            reason,message,code=service_error(row)
+        elif name not in states:
+            reason,message,code='state_unavailable','Post-start service state could not be observed.',None
+        else:
+            reason,message,code='not_running_after_start','The service is not running at the post-start observation.',None
+        failures.append({'name':name,'reason':reason,'message':message,'native_code':code})
+    return dict(mode='check' if check else 'apply',initially_stopped=stopped,eligible=eligible,
+        attempted=sorted(actual),excluded=sorted(set(stopped)-set(eligible)),newly_running=newly,
+        still_stopped=still,unobserved=absent,failed_to_start=failures,
+        started_count=len(set(newly)&set(actual)),failed_count=len(failures),before_count=len(stopped),
+        after_observed=bool(after) or not before)
+
+
+def package_snapshot(raw, platform):
+    """Normalize package_facts (preferred) or legacy textual snapshots."""
+    result={}
+    if isinstance(raw, Mapping):
+        for name, rows in raw.items():
+            if not isinstance(rows, list): continue
+            for row in rows:
+                if not isinstance(row, Mapping): continue
+                arch=str(row.get('arch') or 'unknown')
+                version=str(row.get('version') or '')
+                release=row.get('release')
+                epoch=row.get('epoch')
+                if release not in (None,''):
+                    version=f'{version}-{release}'
+                if epoch not in (None,'','0',0):
+                    version=f'{epoch}:{version}'
+                result.setdefault((str(name),arch),set()).add(version)
+        return result
+    for line in str(raw).splitlines():
+        columns=line.split('\t')
+        if len(columns)!=4: raise ValueError('Invalid package database record')
+        name,arch,version,status=columns
+        if platform=='debian' and status!='installed': continue
+        result.setdefault((name,arch),set()).add(version)
+    return result
+
+
+def _patch_reboot_fields(reboot_required, rebooted, preexisting, reboot_enabled, delay_minutes, blocked_reason=None):
+    observed = None if reboot_required is None else bool(reboot_required)
+    performed = bool(rebooted)
+    final_required = False if performed else observed
+    deferred = bool(final_required) and not bool(reboot_enabled)
+    return dict(
+        reboot_required=final_required,
+        reboot_required_before=bool(preexisting),
+        reboot_required_after=final_required,
+        reboot_performed=performed,
+        reboot_deferred=deferred,
+        reboot_delay_minutes=int(delay_minutes),
+        blocked_reason=blocked_reason,
+    )
+
+
+def _reboot_reasons(value):
+    rows=value if isinstance(value,list) else []
+    out=[]
+    for row in rows:
+        if not isinstance(row,Mapping): continue
+        source=str(row.get('source','unknown'))[:128]
+        desc=str(row.get('description',''))[:512]
+        out.append(dict(source=source,description=desc))
+    return out[:32]
+
+
+def patch_blocked(platform, check=False, delay_minutes=0, rescan_after_reboot=False, reboot_reasons=()):
+    result=dict(platform=str(platform), mode='check' if check else 'apply',
+        evidence='preflight_reboot_state', complete=False, updates=[], updated_count=0,
+        installed_count=0, removed_count=0, pending=[], failed_updates=[])
+    result.update(_patch_reboot_fields(True, False, True, False, delay_minutes,
+        'preexisting_reboot_required'))
+    if str(platform) == 'windows':
+        result.update(rescan_after_reboot=bool(rescan_after_reboot), patch_cycles=0,
+            continuation_required=True, remaining_updates_known=False,
+            reboot_reasons_before=_reboot_reasons(reboot_reasons))
+    return result
+
+
+def patch_linux(before, after, platform, check=False, complete=True, reboot_required=None, rebooted=False,
+                preexisting=False, reboot_enabled=True, delay_minutes=0):
+    old,new=package_snapshot(before,platform),package_snapshot(after,platform)
+    updates=[]
+    if not check:
+        for name,arch in sorted(set(old)|set(new)):
+            a,b=old.get((name,arch),set()),new.get((name,arch),set())
+            if a==b: continue
+            updates.append(dict(name=name,identifier=None,architecture=arch,old_versions=sorted(a),new_versions=sorted(b),
+                action='updated' if a and b else 'installed' if b else 'removed',kb=[]))
+    result=dict(platform=platform,mode='check' if check else 'apply',evidence='package_snapshots',complete=bool(complete),
+        updates=updates,updated_count=sum(x['action']=='updated' for x in updates),
+        installed_count=sum(x['action']=='installed' for x in updates),removed_count=sum(x['action']=='removed' for x in updates),
+        pending=[],failed_updates=[])
+    result.update(_patch_reboot_fields(reboot_required, rebooted, preexisting, reboot_enabled, delay_minutes))
+    return result
+
+
+
+def _hresult_u32(code):
+    if type(code) is not int: return None
+    return code & 0xffffffff
+
+
+WINDOWS_UPDATE_FAILURES={
+    0x80240009:('operation_in_progress','Another conflicting Windows Update operation is in progress.'),
+    0x80240016:('install_not_allowed','Windows Update could not install this update because another installation was active or a mandatory reboot was pending.'),
+    0x80240017:('not_applicable','The update is no longer applicable to this host.'),
+    0x80240019:('exclusive_install_conflict','Windows Update reported an exclusive-install conflict.'),
+    0x8024001B:('self_update_in_progress','The Windows Update Agent is updating itself.'),
+    0x8024001F:('no_connection','Windows Update could not complete because its network connection was unavailable.'),
+    0x80240021:('timeout','Windows Update did not complete before its operation timeout.'),
+}
+
+
+def _windows_failure(code):
+    normalized=_hresult_u32(code)
+    reason,message=WINDOWS_UPDATE_FAILURES.get(normalized,('update_failed','Windows Update failed to install this update.'))
+    return normalized,reason,message
+
+
+def windows_update_result_failed(value):
+    value=value if isinstance(value,Mapping) else {}
+    if value.get('failed') is True: return True
+    if int(value.get('failed_update_count',0) or 0)>0: return True
+    return any(isinstance(row,Mapping) and 'failure_hresult_code' in row for row in value.get('updates',{}).values())
+
+
+def windows_update_block_reason(value):
+    value=value if isinstance(value,Mapping) else {}
+    for row in value.get('updates',{}).values():
+        if isinstance(row,Mapping) and 'failure_hresult_code' in row:
+            return _windows_failure(row.get('failure_hresult_code'))[1]
+    # ansible_failed_result can carry only a generic module failure. Keep this bounded.
+    return 'update_failed'
+
+
+def _windows_pending_from_search(value):
+    value=value if isinstance(value,Mapping) else {}
+    pending=[]
+    for ident,row in value.get('updates',{}).items():
+        if not isinstance(row,Mapping): continue
+        pending.append(dict(name=str(row.get('title',ident)),identifier=str(ident),
+                            kb=[str(x) for x in row.get('kb',[])]))
+    return pending
+
+
+def patch_windows_runs(runs, searches=(), check=False, preexisting=False, rebooted=False,
+                       reboot_enabled=True, delay_minutes=0, rescan_after_reboot=False,
+                       patch_cycles=0, continuation_required=False, remaining_updates_known=False,
+                       reboot_deferred=False, reboot_required_after=False, blocked_reason=None,
+                       complete_override=True, reboot_reasons_before=()):
+    runs=runs if isinstance(runs,list) else []
+    searches=searches if isinstance(searches,list) else []
+    installed={}; failed={}
+    for entry in runs:
+        if not isinstance(entry,Mapping): continue
+        requested=entry.get('requested',{}) if isinstance(entry.get('requested'),Mapping) else {}
+        value=entry.get('result',{}) if isinstance(entry.get('result'),Mapping) else {}
+        rows=value.get('updates',{}) if isinstance(value.get('updates'),Mapping) else {}
+        if not rows and entry.get('task_failed'):
+            wave=int(entry.get('wave',0) or 0)
+            ident=str(requested.get('identifier') or ('wave-%s' % wave if wave else 'windows-update-wave'))
+            failed[ident]=dict(name=str(requested.get('title') or 'Windows Update patch wave'),identifier=ident,
+                               native_code=None,native_code_hex=None,reason='update_failed',
+                               message='Windows Update failed before per-update failure details were available.')
+        for ident,row in rows.items():
+            if not isinstance(row,Mapping): continue
+            ident=str(ident); name=str(row.get('title',requested.get('title',ident)))
+            kb=[str(x) for x in row.get('kb',requested.get('kb',[]))]
+            if row.get('installed') is True and not check:
+                installed[ident]=dict(name=name,identifier=ident,architecture=None,old_versions=[],new_versions=[],
+                                      action='updated',kb=kb)
+                failed.pop(ident,None)
+            if 'failure_hresult_code' in row:
+                code,reason,message=_windows_failure(row.get('failure_hresult_code'))
+                failed[ident]=dict(name=name,identifier=ident,native_code=code,
+                                   native_code_hex=(f'0x{code:08X}' if code is not None else None),
+                                   reason=reason,message=message)
+    pending=[]
+    if remaining_updates_known and searches:
+        pending=_windows_pending_from_search(searches[-1])
+        # A final search is authoritative for remaining applicability; do not duplicate
+        # updates that it says are no longer pending.
+    final_required=bool(reboot_required_after)
+    performed=bool(rebooted)
+    deferred=bool(reboot_deferred) or (final_required and not bool(reboot_enabled))
+    complete=bool(complete_override) and not bool(failed)
+    result=dict(platform='windows',mode='check' if check else 'apply',evidence='windows_update_result',
+        complete=complete,updates=list(installed.values()),updated_count=len(installed),installed_count=0,
+        removed_count=0,pending=pending,failed_updates=list(failed.values()),
+        reboot_required=final_required,reboot_required_before=bool(preexisting),
+        reboot_required_after=final_required,reboot_performed=performed,reboot_deferred=deferred,
+        reboot_delay_minutes=int(delay_minutes),blocked_reason=blocked_reason,
+        rescan_after_reboot=bool(rescan_after_reboot),patch_cycles=int(patch_cycles),
+        continuation_required=bool(continuation_required),remaining_updates_known=bool(remaining_updates_known),
+        reboot_reasons_before=_reboot_reasons(reboot_reasons_before))
+    return result
+
+def cleanup(paths, directory, removed, unifi, unifi_result, enabled=False, check=False):
+    deleted=[r.get('item') for r in removed.get('results',[]) if r.get('changed') and not check]
+    mode='check' if check else 'apply' if enabled else 'preview'
+    state='retained'
+    if unifi=='disabled':
+        state='candidate' if not enabled or check else 'removed' if unifi_result.get('changed') else 'unchanged'
+    return dict(mode=mode,directory=directory,candidates=list(paths),removed=deleted,
+                unifi_configuration=state,complete=True)
+
+
+_SECRET=re.compile(r'password|passwd|passphrase|secret|token|credential|private.?key|authorization|community',re.I)
+_COMMAND={'cmd_line','command','command_line','arguments','args','environment','env','passphrase'}
+
+def checkmk_config(value):
+    """Read only the named user config; redact secret/command fields before publication."""
+    import yaml
+    path=value['path']
+    if re.split(r'[\\/]',path)[-1].lower()!='check_mk.user.yml':
+        raise ValueError('Only check_mk.user.yml can be published')
+    content=value.get('content','')
+    if len(content.encode('utf-8'))>512*1024:
+        raise ValueError('Checkmk user configuration exceeds report limit')
+    data=yaml.safe_load(content) if value.get('exists') else {}
+    if data is None: data={}
+    if not isinstance(data,dict): raise ValueError('Checkmk configuration must be a mapping')
+    redactions=[]; seen=set(); budget=[0]
+    def walk(item,path,depth=0):
+        budget[0]+=1
+        if depth>18 or budget[0]>50000: raise ValueError('Configuration structure exceeds limit')
+        if isinstance(item,(dict,list)):
+            if id(item) in seen: raise ValueError('Recursive configuration aliases are unsupported')
+            seen.add(id(item))
+            try:
+                if isinstance(item,list): return [walk(x,path+[str(i)],depth+1) for i,x in enumerate(item)]
+                out={}
+                for key,val in item.items():
+                    if not isinstance(key,str): key=str(key)
+                    here=path+[key]
+                    if _SECRET.search(key) or key.lower() in _COMMAND or (path and path[0].lower()=='mrpe' and key.lower() in ('config','entries')):
+                        out[key]='[REDACTED]'; redactions.append('.'.join(here)); continue
+                    out[key]=walk(val,here,depth+1)
+                return out
+            finally:seen.remove(id(item))
+        if isinstance(item,str):
+            # Do not expose URL userinfo, inline password assignment, PEM key bodies.
+            if re.search(r'://[^/\s]+:[^/\s]+@|(?:password|passwd|token|secret)\s*[=:]|-----BEGIN .*PRIVATE KEY',item,re.I):
+                redactions.append('.'.join(path)); return '[REDACTED]'
+            # Multiline operational strings are represented by spaces, not terminal controls.
+            return ' '.join(item.splitlines())
+        if item is None or type(item) in (bool,int,float): return item
+        return str(item)
+    return dict(path=path,exists=bool(value.get('exists')),size_bytes=int(value.get('size_bytes',0)),
+        last_write_time_utc=value.get('last_write_time_utc'),sections=walk(data,[]),
+        redacted_paths=redactions,comment_preservation='not_in_structured_output')
+
+
+def checkmk_changes(copies, selected, plugin_update, unifi_result, opposite, mode, check=False):
+    changed_checks=[r['item']['filename'] for r in copies.get('results',[]) if r.get('changed') and isinstance(r.get('item'),Mapping)]
+    removed=[]
+    if opposite.get('changed') and mode in ('os','network'):
+        removed=['check_unifi-controller.sh' if mode=='os' else 'check_unifi-os.sh']
+    changes=[dict(component='check',name=n,action='updated') for n in changed_checks]
+    changes += [dict(component='check',name=n,action='removed') for n in removed]
+    if plugin_update.get('changed'):changes.append(dict(component='section',name='plugins',action='updated'))
+    if unifi_result.get('changed'):changes.append(dict(component='configuration',name='unifi.cfg',action='updated'))
+    return dict(mode='check' if check else 'apply',changed=bool(changes),managed_sections=['plugins'] if plugin_update else [],
+        changes=changes,deployed_checks=[s['filename'] for s in selected],changed_checks=changed_checks,
+        removed_checks=removed if not check else [],unknown_files_policy='untouched_not_enumerated')
+
+
+def checkmk_state(observed, service_rows, change_report, package_changed=False, check=False):
+    return dict(mode='check' if check else 'apply',installed=observed.get('installed'),version=observed.get('version'),
+        version_source=observed.get('version_source','unavailable'),
+        services=[dict(name=s['name'],state=s.get('state','unknown')) for s in service_rows],
+        package_changed=bool(package_changed),configuration_updated=any(c['component'] in ('section','configuration') for c in change_report['changes']),
+        checks_deployed=change_report['deployed_checks'],changed_checks=change_report['changed_checks'],removed_checks=change_report['removed_checks'])
+
+
+class FilterModule:
+    def filters(self):
+        return {'aim_epoch_iso_utc':epoch_iso_utc,'aim_report_capabilities':capabilities,'aim_report_disks':disks,'aim_report_services':services,
+                'aim_report_patch_linux':patch_linux,'aim_report_patch_windows_runs':patch_windows_runs,
+                'aim_report_patch_blocked':patch_blocked,
+                'aim_windows_update_result_failed':windows_update_result_failed,
+                'aim_windows_update_block_reason':windows_update_block_reason,
+                'aim_report_cleanup':cleanup,'aim_report_checkmk_config':checkmk_config,
+                'aim_report_checkmk_changes':checkmk_changes,'aim_report_checkmk_state':checkmk_state}
diff --git a/playbooks/maintenance_backup_event_log.yml b/playbooks/maintenance_backup_event_log.yml
deleted file mode 100644
index 3f4f3ff..0000000
--- a/playbooks/maintenance_backup_event_log.yml
+++ /dev/null
@@ -1,74 +0,0 @@
----
-- name: "Maintenance | Backup system logs"
-  hosts: all
-  gather_facts: true
-
-  vars:
-    windows_event_log_backup_dir: 'C:\\Windows\\Temp\\EventLogBackup'
-    windows_event_logs_to_backup:
-      - Application
-      - System
-      - Security
-
-    linux_log_backup_dir: /var/backups/system-logs
-    linux_journal_since: "-24h"
-
-  tasks:
-    - name: "Windows | Ensure event log backup directory exists"
-      when: ansible_facts['os_family'] == 'Windows'
-      ansible.windows.win_file:
-        path: "{{ windows_event_log_backup_dir }}"
-        state: directory
-
-    - name: "Windows | Export event logs"
-      when: ansible_facts['os_family'] == 'Windows'
-      ansible.windows.win_command: >-
-        wevtutil epl {{ item }} "{{ windows_event_log_backup_dir }}\\{{ item }}.evtx" /ow:true
-      loop: "{{ windows_event_logs_to_backup }}"
-      changed_when: true
-
-    - name: "Linux | Ensure system log backup directory exists"
-      when: ansible_facts['os_family'] != 'Windows'
-      become: true
-      ansible.builtin.file:
-        path: "{{ linux_log_backup_dir }}"
-        state: directory
-        owner: root
-        group: root
-        mode: "0750"
-
-    - name: "Linux | Check whether systemd journal is available"
-      when: ansible_facts['os_family'] != 'Windows'
-      ansible.builtin.command:
-        cmd: journalctl --version
-      register: journalctl_available
-      changed_when: false
-      failed_when: false
-
-    - name: "Linux | Export systemd journal"
-      when:
-        - ansible_facts['os_family'] != 'Windows'
-        - journalctl_available.rc == 0
-      become: true
-      ansible.builtin.shell: >-
-        journalctl --since {{ linux_journal_since | quote }} --no-pager
-        > {{ (linux_log_backup_dir ~ '/journal.log') | quote }}
-      args:
-        executable: /bin/sh
-      changed_when: true
-
-    - name: "Linux | Backup traditional system logs"
-      when:
-        - ansible_facts['os_family'] != 'Windows'
-        - journalctl_available.rc != 0
-      become: true
-      ansible.builtin.shell: |
-        set -e
-        for file in /var/log/syslog /var/log/messages /var/log/auth.log /var/log/secure; do
-          if [ -f "$file" ]; then
-            cp -p "$file" "{{ linux_log_backup_dir }}/$(basename "$file")"
-          fi
-        done
-      args:
-        executable: /bin/sh
-      changed_when: true
diff --git a/playbooks/maintenance_export_event_logs.yml b/playbooks/maintenance_export_event_logs.yml
new file mode 100644
index 0000000..f2262dc
--- /dev/null
+++ b/playbooks/maintenance_export_event_logs.yml
@@ -0,0 +1,37 @@
+---
+# PURPOSE: Export Windows event logs
+# DESCRIPTION: Export selected event channels to EVTX files on the target; existing event logs are not cleared.
+# TARGETS: windows
+# INPUTS (omitted values inherit inventory / role defaults):
+#   aim_debug [bool]: false
+#   event_age_days [int]: 45
+#   export_folder [text]: C:\Logs
+#   event_log_channels [list]: Application, Security, System, Setup
+# AUTH: existing inventory / Vault credentials; no embedded passwords.
+# EXAMPLE: ansible-playbook -i inventories/<customer>/hosts.yml
+#          playbooks/maintenance_export_event_logs.yml --limit <host> --vault-id <customer>@prompt
+- name: Maintenance | Export Windows event logs
+  hosts: windows
+  gather_facts: false
+  pre_tasks:
+    - name: AIM | Validate diagnostics option
+      ansible.builtin.assert:
+        that:
+          - (aim_debug | default(false)) is boolean or (aim_debug | default(false) | string | lower) in ['true',
+            'false']
+        fail_msg: aim_debug must be a YAML/JSON boolean.
+        quiet: true
+    - name: AIM | Reject mixed platform membership
+      ansible.builtin.assert:
+        that:
+          - (group_names | intersect(['linux', 'windows', 'sophosxgs', 'pfsense']) | length) <= 1
+        fail_msg: This host belongs to incompatible platform groups. Use globally unique subgroups.
+        quiet: true
+    - name: AIM | Execution context
+      ansible.builtin.debug:
+        msg:
+          host: '{{ inventory_hostname }}'
+          diagnostics: Enabled; secret values are never included by this task.
+      when: aim_debug | default(false) | bool
+  roles:
+    - role: maintenance_export_event_logs
diff --git a/playbooks/maintenance_patch_os.yml b/playbooks/maintenance_patch_os.yml
index faf9ab7..25a1517 100644
--- a/playbooks/maintenance_patch_os.yml
+++ b/playbooks/maintenance_patch_os.yml
@@ -1,35 +1,70 @@
 ---
-- name: "Maintenance | Patch operating system"
-  hosts: all
+# PURPOSE: Patch operating systems
+# DESCRIPTION: Apply updates on Windows, Debian and RedHat-family systems; optionally reboot when required.
+# TARGETS: linux, windows
+# INPUTS (omitted values inherit inventory / role defaults):
+#   aim_debug [bool]: false
+#   os_patching_reboot [bool]: true
+#   os_patching_windows_categories [list]: SecurityUpdates, CriticalUpdates, UpdateRollups, DefinitionUpdates, Updates
+#   os_patching_serial [serial]: 100%
+#   os_patching_reboot_timeout [int]: 600
+#   os_patching_reboot_delay_minutes [int]: 0
+#   os_patching_reboot_message [text]: AIM maintenance: operating system patching requires a reboot.
+#   os_patching_rescan_after_reboot [bool]: false (Windows only; continue with a newly discovered patch wave after reboot)
+# AUTH: existing inventory / Vault credentials; no embedded passwords.
+# CHANGES: Updates production operating systems. Optional AIM-initiated reboots notify logged-in users and honor the configured delay.
+# EXAMPLE: ansible-playbook -i inventories/<customer>/hosts.yml
+#          playbooks/maintenance_patch_os.yml --limit <host> --vault-id <customer>@prompt
+- name: Maintenance | Patch Linux
+  hosts: linux
   gather_facts: true
-
-  tasks:
-    - name: "Debian | Update package cache and upgrade packages"
-      when: ansible_facts['os_family'] == 'Debian'
-      ansible.builtin.apt:
-        update_cache: true
-        upgrade: dist
-
-    - name: "RedHat | Upgrade installed packages"
-      when: ansible_facts['os_family'] == 'RedHat'
-      ansible.builtin.dnf:
-        name: '*'
-        state: latest
-
-    - name: "Windows | Install available updates"
-      when: ansible_facts['os_family'] == 'Windows'
-      ansible.windows.win_updates:
-        category_names:
-          - CriticalUpdates
-          - SecurityUpdates
-          - UpdateRollups
-          - Updates
-        reboot: false
-      register: windows_updates
-
-    - name: "Windows | Report reboot requirement"
-      when:
-        - ansible_facts['os_family'] == 'Windows'
-        - windows_updates.reboot_required | default(false)
+  pre_tasks:
+    - name: AIM | Validate diagnostics option
+      ansible.builtin.assert:
+        that:
+          - (aim_debug | default(false)) is boolean or (aim_debug | default(false) | string | lower) in ['true',
+            'false']
+        fail_msg: aim_debug must be a YAML/JSON boolean.
+        quiet: true
+    - name: AIM | Reject mixed platform membership
+      ansible.builtin.assert:
+        that:
+          - (group_names | intersect(['linux', 'windows', 'sophosxgs', 'pfsense']) | length) <= 1
+        fail_msg: This host belongs to incompatible platform groups. Use globally unique subgroups.
+        quiet: true
+    - name: AIM | Execution context
       ansible.builtin.debug:
-        msg: "Windows updates were installed and a reboot is required. No reboot was performed."
+        msg:
+          host: '{{ inventory_hostname }}'
+          diagnostics: Enabled; secret values are never included by this task.
+      when: aim_debug | default(false) | bool
+  become: true
+  serial: '{{ os_patching_serial | default(''100%'') }}'
+  roles:
+    - role: maintenance_patch_os
+- name: Maintenance | Patch Windows
+  hosts: windows
+  gather_facts: true
+  pre_tasks:
+    - name: AIM | Validate diagnostics option
+      ansible.builtin.assert:
+        that:
+          - (aim_debug | default(false)) is boolean or (aim_debug | default(false) | string | lower) in ['true',
+            'false']
+        fail_msg: aim_debug must be a YAML/JSON boolean.
+        quiet: true
+    - name: AIM | Reject mixed platform membership
+      ansible.builtin.assert:
+        that:
+          - (group_names | intersect(['linux', 'windows', 'sophosxgs', 'pfsense']) | length) <= 1
+        fail_msg: This host belongs to incompatible platform groups. Use globally unique subgroups.
+        quiet: true
+    - name: AIM | Execution context
+      ansible.builtin.debug:
+        msg:
+          host: '{{ inventory_hostname }}'
+          diagnostics: Enabled; secret values are never included by this task.
+      when: aim_debug | default(false) | bool
+  serial: '{{ os_patching_serial | default(''100%'') }}'
+  roles:
+    - role: maintenance_patch_os
diff --git a/playbooks/maintenance_reboot.yml b/playbooks/maintenance_reboot.yml
deleted file mode 100644
index 303958e..0000000
--- a/playbooks/maintenance_reboot.yml
+++ /dev/null
@@ -1,15 +0,0 @@
----
-- name: "Maintenance | Reboot systems"
-  hosts: all
-  gather_facts: true
-
-  tasks:
-    - name: "Windows | Reboot system"
-      when: ansible_facts['os_family'] == 'Windows'
-      ansible.windows.win_reboot:
-        reboot_timeout: 1800
-
-    - name: "Linux | Reboot system"
-      when: ansible_facts['os_family'] != 'Windows'
-      ansible.builtin.reboot:
-        reboot_timeout: 1800
diff --git a/playbooks/maintenance_reboot_hosts.yml b/playbooks/maintenance_reboot_hosts.yml
new file mode 100644
index 0000000..3db551b
--- /dev/null
+++ b/playbooks/maintenance_reboot_hosts.yml
@@ -0,0 +1,68 @@
+---
+# PURPOSE: Reboot hosts
+# DESCRIPTION: Reboot selected hosts in batches and wait for management connectivity.
+# TARGETS: linux, windows
+# INPUTS (omitted values inherit inventory / role defaults):
+#   aim_debug [bool]: false
+#   maintenance_reboot_serial [serial]: 10
+#   maintenance_reboot_timeout [int]: 1800
+#   maintenance_reboot_message [text]: Reboot initiated by debsansible01.bfmiglabor.lan (Ansible)
+#   maintenance_reboot_pre_delay [int]: 0
+#   maintenance_reboot_post_delay [int]: 15
+# AUTH: existing inventory / Vault credentials; no embedded passwords.
+# CHANGES: Every selected host will be rebooted. No reboot occurs before final confirmation.
+# EXAMPLE: ansible-playbook -i inventories/<customer>/hosts.yml
+#          playbooks/maintenance_reboot_hosts.yml --limit <host> --vault-id <customer>@prompt
+- name: Maintenance | Reboot Linux
+  hosts: linux
+  gather_facts: true
+  pre_tasks:
+    - name: AIM | Validate diagnostics option
+      ansible.builtin.assert:
+        that:
+          - (aim_debug | default(false)) is boolean or (aim_debug | default(false) | string | lower) in ['true',
+            'false']
+        fail_msg: aim_debug must be a YAML/JSON boolean.
+        quiet: true
+    - name: AIM | Reject mixed platform membership
+      ansible.builtin.assert:
+        that:
+          - (group_names | intersect(['linux', 'windows', 'sophosxgs', 'pfsense']) | length) <= 1
+        fail_msg: This host belongs to incompatible platform groups. Use globally unique subgroups.
+        quiet: true
+    - name: AIM | Execution context
+      ansible.builtin.debug:
+        msg:
+          host: '{{ inventory_hostname }}'
+          diagnostics: Enabled; secret values are never included by this task.
+      when: aim_debug | default(false) | bool
+  become: true
+  serial: '{{ maintenance_reboot_serial | default(10) }}'
+  roles:
+    - role: maintenance_reboot_hosts
+- name: Maintenance | Reboot Windows
+  hosts: windows
+  gather_facts: false
+  pre_tasks:
+    - name: AIM | Validate diagnostics option
+      ansible.builtin.assert:
+        that:
+          - (aim_debug | default(false)) is boolean or (aim_debug | default(false) | string | lower) in ['true',
+            'false']
+        fail_msg: aim_debug must be a YAML/JSON boolean.
+        quiet: true
+    - name: AIM | Reject mixed platform membership
+      ansible.builtin.assert:
+        that:
+          - (group_names | intersect(['linux', 'windows', 'sophosxgs', 'pfsense']) | length) <= 1
+        fail_msg: This host belongs to incompatible platform groups. Use globally unique subgroups.
+        quiet: true
+    - name: AIM | Execution context
+      ansible.builtin.debug:
+        msg:
+          host: '{{ inventory_hostname }}'
+          diagnostics: Enabled; secret values are never included by this task.
+      when: aim_debug | default(false) | bool
+  serial: '{{ maintenance_reboot_serial | default(10) }}'
+  roles:
+    - role: maintenance_reboot_hosts
diff --git a/playbooks/maintenance_start_stopped_services.yml b/playbooks/maintenance_start_stopped_services.yml
index 7b75660..5dbc1af 100644
--- a/playbooks/maintenance_start_stopped_services.yml
+++ b/playbooks/maintenance_start_stopped_services.yml
@@ -1,82 +1,37 @@
 ---
-- name: "Maintenance | Start stopped automatic services"
-  hosts: all
-  gather_facts: true
-
-  tasks:
-    - name: "Windows | Start stopped automatic services"
-      when: ansible_facts['os_family'] == 'Windows'
-      ansible.windows.win_powershell:
-        script: |
-          $Ansible.Changed = $false
-          $started = @()
-
-          Get-CimInstance Win32_Service |
-            Where-Object {
-              $_.StartMode -eq 'Auto' -and
-              $_.State -ne 'Running'
-            } |
-            ForEach-Object {
-              try {
-                Start-Service -Name $_.Name -ErrorAction Stop
-                $started += $_.Name
-                $Ansible.Changed = $true
-              }
-              catch {
-                Write-Warning "Could not start service $($_.Name): $($_.Exception.Message)"
-              }
-            }
-
-          $Ansible.Result = @{
-            started_services = $started
-          }
-      register: started_services_windows
-
-    - name: "Windows | Show started services"
-      when: ansible_facts['os_family'] == 'Windows'
+# PURPOSE: Start stopped automatic services
+# DESCRIPTION: Start eligible stopped services, apply optional include/exclude lists and report partial failures.
+# TARGETS: windows
+# INPUTS (omitted values inherit inventory / role defaults):
+#   aim_debug [bool]: false
+#   maintenance_service_include [list]: []
+#   maintenance_service_exclude [list]: []
+#   maintenance_service_fail_on_error [bool]: true
+# AUTH: existing inventory / Vault credentials; no embedded passwords.
+# EXAMPLE: ansible-playbook -i inventories/<customer>/hosts.yml
+#          playbooks/maintenance_start_stopped_services.yml --limit <host> --vault-id <customer>@prompt
+- name: Maintenance | Start automatic services
+  hosts: windows
+  gather_facts: false
+  pre_tasks:
+    - name: AIM | Validate diagnostics option
+      ansible.builtin.assert:
+        that:
+          - (aim_debug | default(false)) is boolean or (aim_debug | default(false) | string | lower) in ['true',
+            'false']
+        fail_msg: aim_debug must be a YAML/JSON boolean.
+        quiet: true
+    - name: AIM | Reject mixed platform membership
+      ansible.builtin.assert:
+        that:
+          - (group_names | intersect(['linux', 'windows', 'sophosxgs', 'pfsense']) | length) <= 1
+        fail_msg: This host belongs to incompatible platform groups. Use globally unique subgroups.
+        quiet: true
+    - name: AIM | Execution context
       ansible.builtin.debug:
-        var: started_services_windows.result.started_services
-
-    - name: "Linux | Collect service facts"
-      when: ansible_facts['os_family'] != 'Windows'
-      ansible.builtin.service_facts:
-
-    - name: "Linux | Start stopped enabled systemd services"
-      when:
-        - ansible_facts['os_family'] != 'Windows'
-        - ansible_facts['service_mgr'] == 'systemd'
-        - item.value.status | default('') == 'enabled'
-        - item.value.state | default('') != 'running'
-      become: true
-      ansible.builtin.systemd:
-        name: "{{ item.key }}"
-        state: started
-      loop: "{{ ansible_facts.services | dict2items }}"
-      loop_control:
-        label: "{{ item.key }}"
-      register: started_services_linux
-      failed_when: false
-
-    - name: "Linux | Show services that were started"
-      when:
-        - ansible_facts['os_family'] != 'Windows'
-        - ansible_facts['service_mgr'] == 'systemd'
-      ansible.builtin.debug:
-        msg: >-
-          {{
-            started_services_linux.results
-            | default([])
-            | selectattr('changed', 'defined')
-            | selectattr('changed')
-            | map(attribute='item.key')
-            | list
-          }}
-
-    - name: "Linux | Report unsupported service manager"
-      when:
-        - ansible_facts['os_family'] != 'Windows'
-        - ansible_facts['service_mgr'] != 'systemd'
-      ansible.builtin.debug:
-        msg: >-
-          Automatic stopped-service recovery currently supports systemd hosts only.
-          Detected service manager: {{ ansible_facts['service_mgr'] }}
+        msg:
+          host: '{{ inventory_hostname }}'
+          diagnostics: Enabled; secret values are never included by this task.
+      when: aim_debug | default(false) | bool
+  roles:
+    - role: maintenance_start_stopped_services
diff --git a/playbooks/pfsense_apply_baseline.yml b/playbooks/pfsense_apply_baseline.yml
new file mode 100644
index 0000000..11cf711
--- /dev/null
+++ b/playbooks/pfsense_apply_baseline.yml
@@ -0,0 +1,63 @@
+---
+# PURPOSE: Apply bitformer pfSense baseline
+# DESCRIPTION: Apply the supplied pfSense baseline without changing its firewall/VPN policy.
+# TARGETS: pfsense
+# INPUTS (omitted values inherit inventory / role defaults):
+#   aim_debug [bool]: false
+# AUTH: existing inventory / Vault credentials; no embedded passwords.
+# CHANGES: Contains the original any-source WAN management rule for ports 22/80/443. The original CA, VPN endpoint and client certificate reference are unchanged; verify them before execution. Requires separately approved pfsensible.core installation.
+# EXAMPLE: ansible-playbook -i inventories/<customer>/hosts.yml
+#          playbooks/pfsense_apply_baseline.yml --limit <host> --vault-id <customer>@prompt
+- name: Install pfSense sudo package
+  hosts: pfsense
+  tasks:
+    - name: Apply supplied firewall policy
+      ansible.builtin.import_role:
+        name: pfsense_install_prerequisites
+  pre_tasks:
+    - name: AIM | Validate diagnostics option
+      ansible.builtin.assert:
+        that:
+          - (aim_debug | default(false)) is boolean or (aim_debug | default(false) | string | lower) in ['true',
+            'false']
+        fail_msg: aim_debug must be a YAML/JSON boolean.
+        quiet: true
+    - name: AIM | Reject mixed platform membership
+      ansible.builtin.assert:
+        that:
+          - (group_names | intersect(['linux', 'windows', 'sophosxgs', 'pfsense']) | length) <= 1
+        fail_msg: This host belongs to incompatible platform groups. Use globally unique subgroups.
+        quiet: true
+    - name: AIM | Execution context
+      ansible.builtin.debug:
+        msg:
+          host: '{{ inventory_hostname }}'
+          diagnostics: Enabled; secret values are never included by this task.
+      when: aim_debug | default(false) | bool
+- name: Initial pfSense bitformer config
+  hosts: pfsense
+  become: true
+  tasks:
+    - name: Apply supplied firewall policy
+      ansible.builtin.import_role:
+        name: pfsense_apply_baseline
+  pre_tasks:
+    - name: AIM | Validate diagnostics option
+      ansible.builtin.assert:
+        that:
+          - (aim_debug | default(false)) is boolean or (aim_debug | default(false) | string | lower) in ['true',
+            'false']
+        fail_msg: aim_debug must be a YAML/JSON boolean.
+        quiet: true
+    - name: AIM | Reject mixed platform membership
+      ansible.builtin.assert:
+        that:
+          - (group_names | intersect(['linux', 'windows', 'sophosxgs', 'pfsense']) | length) <= 1
+        fail_msg: This host belongs to incompatible platform groups. Use globally unique subgroups.
+        quiet: true
+    - name: AIM | Execution context
+      ansible.builtin.debug:
+        msg:
+          host: '{{ inventory_hostname }}'
+          diagnostics: Enabled; secret values are never included by this task.
+      when: aim_debug | default(false) | bool
diff --git a/playbooks/schemas/checkmk_agent_config_v1.yml b/playbooks/schemas/checkmk_agent_config_v1.yml
new file mode 100644
index 0000000..8152db9
--- /dev/null
+++ b/playbooks/schemas/checkmk_agent_config_v1.yml
@@ -0,0 +1,77 @@
+# AIM public operation-data schema. Closed fields except explicitly redacted configuration sections.
+type: object
+properties:
+  mode:
+    type: string
+    maxLength: 128
+    enum:
+    - apply
+    - check
+  changed:
+    type: boolean
+  managed_sections:
+    type: array
+    items:
+      type: string
+      maxLength: 1024
+    maxItems: 20000
+  changes:
+    type: array
+    items:
+      type: object
+      properties:
+        component:
+          type: string
+          maxLength: 128
+          enum:
+          - section
+          - check
+          - configuration
+        name:
+          type: string
+          maxLength: 1024
+        action:
+          type: string
+          maxLength: 128
+          enum:
+          - updated
+          - removed
+      required:
+      - component
+      - name
+      - action
+      additionalProperties: false
+    maxItems: 20000
+  deployed_checks:
+    type: array
+    items:
+      type: string
+      maxLength: 1024
+    maxItems: 20000
+  changed_checks:
+    type: array
+    items:
+      type: string
+      maxLength: 1024
+    maxItems: 20000
+  removed_checks:
+    type: array
+    items:
+      type: string
+      maxLength: 1024
+    maxItems: 20000
+  unknown_files_policy:
+    type: string
+    maxLength: 128
+    enum:
+    - untouched_not_enumerated
+required:
+- mode
+- changed
+- managed_sections
+- changes
+- deployed_checks
+- changed_checks
+- removed_checks
+- unknown_files_policy
+additionalProperties: false
diff --git a/playbooks/schemas/checkmk_agent_state_v1.yml b/playbooks/schemas/checkmk_agent_state_v1.yml
new file mode 100644
index 0000000..88c2ac8
--- /dev/null
+++ b/playbooks/schemas/checkmk_agent_state_v1.yml
@@ -0,0 +1,74 @@
+# AIM public operation-data schema. Closed fields except explicitly redacted configuration sections.
+type: object
+properties:
+  mode:
+    type: string
+    maxLength: 128
+    enum:
+    - apply
+    - check
+  installed:
+    type:
+    - boolean
+    - 'null'
+  version:
+    type:
+    - string
+    - 'null'
+    maxLength: 1024
+  version_source:
+    type: string
+    maxLength: 128
+    enum:
+    - registry
+    - package_database
+    - unavailable
+  services:
+    type: array
+    items:
+      type: object
+      properties:
+        name:
+          type: string
+          maxLength: 1024
+        state:
+          type: string
+          maxLength: 1024
+      required:
+      - name
+      - state
+      additionalProperties: false
+    maxItems: 20000
+  package_changed: &id001
+    type: boolean
+  configuration_updated: *id001
+  checks_deployed:
+    type: array
+    items:
+      type: string
+      maxLength: 1024
+    maxItems: 20000
+  changed_checks:
+    type: array
+    items:
+      type: string
+      maxLength: 1024
+    maxItems: 20000
+  removed_checks:
+    type: array
+    items:
+      type: string
+      maxLength: 1024
+    maxItems: 20000
+required:
+- mode
+- installed
+- version
+- version_source
+- services
+- package_changed
+- configuration_updated
+- checks_deployed
+- changed_checks
+- removed_checks
+additionalProperties: false
diff --git a/playbooks/schemas/checkmk_user_config_v1.yml b/playbooks/schemas/checkmk_user_config_v1.yml
new file mode 100644
index 0000000..9dc0991
--- /dev/null
+++ b/playbooks/schemas/checkmk_user_config_v1.yml
@@ -0,0 +1,40 @@
+# AIM public operation-data schema. Closed fields except explicitly redacted configuration sections.
+type: object
+properties:
+  path:
+    type: string
+    maxLength: 1024
+  exists:
+    type: boolean
+  size_bytes:
+    type: integer
+    minimum: 0
+  last_write_time_utc:
+    type:
+    - string
+    - 'null'
+    maxLength: 1024
+  sections:
+    type: object
+    properties: {}
+    additionalProperties: true
+  redacted_paths:
+    type: array
+    items:
+      type: string
+      maxLength: 1024
+    maxItems: 20000
+  comment_preservation:
+    type: string
+    maxLength: 128
+    enum:
+    - not_in_structured_output
+required:
+- path
+- exists
+- size_bytes
+- last_write_time_utc
+- sections
+- redacted_paths
+- comment_preservation
+additionalProperties: false
diff --git a/playbooks/schemas/event_log_export_v1.yml b/playbooks/schemas/event_log_export_v1.yml
new file mode 100644
index 0000000..4f75569
--- /dev/null
+++ b/playbooks/schemas/event_log_export_v1.yml
@@ -0,0 +1,30 @@
+# AIM public operation-data schema. Closed fields except explicitly redacted configuration sections.
+type: object
+properties:
+  mode:
+    type: string
+    maxLength: 128
+    enum:
+    - apply
+    - check
+  days:
+    type: integer
+    minimum: 0
+  files:
+    type: array
+    items:
+      type: string
+      maxLength: 1024
+    maxItems: 20000
+  channels:
+    type: array
+    items:
+      type: string
+      maxLength: 1024
+    maxItems: 20000
+required:
+- mode
+- days
+- files
+- channels
+additionalProperties: false
diff --git a/playbooks/schemas/filesystem_usage_v1.yml b/playbooks/schemas/filesystem_usage_v1.yml
new file mode 100644
index 0000000..9f2be0a
--- /dev/null
+++ b/playbooks/schemas/filesystem_usage_v1.yml
@@ -0,0 +1,66 @@
+# AIM public operation-data schema. Closed fields except explicitly redacted configuration sections.
+type: object
+properties:
+  platform:
+    type: string
+    maxLength: 128
+    enum:
+    - windows
+    - linux
+  filesystems:
+    type: array
+    items:
+      type: object
+      properties:
+        name:
+          type: string
+          maxLength: 1024
+        mount:
+          type: string
+          maxLength: 1024
+        filesystem_type:
+          type:
+          - string
+          - 'null'
+          maxLength: 1024
+        used_bytes:
+          type:
+          - integer
+          - 'null'
+          minimum: 0
+        total_bytes:
+          type:
+          - integer
+          - 'null'
+          minimum: 0
+        available_bytes:
+          type:
+          - integer
+          - 'null'
+          minimum: 0
+        used_percent:
+          type:
+          - number
+          - 'null'
+          minimum: 0
+        status:
+          type: string
+          maxLength: 128
+          enum:
+          - available
+          - unavailable
+      required:
+      - name
+      - mount
+      - filesystem_type
+      - used_bytes
+      - total_bytes
+      - available_bytes
+      - used_percent
+      - status
+      additionalProperties: false
+    maxItems: 20000
+required:
+- platform
+- filesystems
+additionalProperties: false
diff --git a/playbooks/schemas/host_capabilities_v1.yml b/playbooks/schemas/host_capabilities_v1.yml
new file mode 100644
index 0000000..f0b28b4
--- /dev/null
+++ b/playbooks/schemas/host_capabilities_v1.yml
@@ -0,0 +1,22 @@
+# AIM public operation-data schema. Closed fields except explicitly redacted configuration sections.
+type: object
+properties:
+  is_dc: &id001
+    type: boolean
+  is_dhcp_server: *id001
+  is_hyperv_host: *id001
+  has_veeam_vbr: *id001
+  has_veeam_vbo: *id001
+  has_veeam_em: *id001
+  is_unifi_controller: *id001
+  is_unifi_os_server: *id001
+required:
+- is_dc
+- is_dhcp_server
+- is_hyperv_host
+- has_veeam_vbr
+- has_veeam_vbo
+- has_veeam_em
+- is_unifi_controller
+- is_unifi_os_server
+additionalProperties: false
diff --git a/playbooks/schemas/managed_cleanup_preview_v1.yml b/playbooks/schemas/managed_cleanup_preview_v1.yml
new file mode 100644
index 0000000..9227385
--- /dev/null
+++ b/playbooks/schemas/managed_cleanup_preview_v1.yml
@@ -0,0 +1,43 @@
+# AIM public operation-data schema. Closed fields except explicitly redacted configuration sections.
+type: object
+properties:
+  mode:
+    type: string
+    maxLength: 128
+    enum:
+    - preview
+    - apply
+    - check
+  directory:
+    type: string
+    maxLength: 1024
+  candidates:
+    type: array
+    items:
+      type: string
+      maxLength: 1024
+    maxItems: 20000
+  removed:
+    type: array
+    items:
+      type: string
+      maxLength: 1024
+    maxItems: 20000
+  unifi_configuration:
+    type: string
+    maxLength: 128
+    enum:
+    - retained
+    - candidate
+    - removed
+    - unchanged
+  complete:
+    type: boolean
+required:
+- mode
+- directory
+- candidates
+- removed
+- unifi_configuration
+- complete
+additionalProperties: false
diff --git a/playbooks/schemas/patch_summary_v1.yml b/playbooks/schemas/patch_summary_v1.yml
new file mode 100644
index 0000000..8d79f24
--- /dev/null
+++ b/playbooks/schemas/patch_summary_v1.yml
@@ -0,0 +1,190 @@
+# AIM public operation-data schema. Closed fields; no raw package-manager/module output.
+type: object
+properties:
+  platform:
+    type: string
+    maxLength: 128
+    enum:
+      - windows
+      - debian
+      - redhat
+  mode:
+    type: string
+    maxLength: 128
+    enum:
+      - apply
+      - check
+  evidence:
+    type: string
+    maxLength: 128
+    enum:
+      - package_snapshots
+      - windows_update_result
+      - preflight_reboot_state
+  complete:
+    type: boolean
+  updates:
+    type: array
+    items:
+      type: object
+      properties:
+        name:
+          type: string
+          maxLength: 1024
+        identifier:
+          type: [string, 'null']
+          maxLength: 1024
+        architecture:
+          type: [string, 'null']
+          maxLength: 1024
+        old_versions:
+          type: array
+          items:
+            type: string
+            maxLength: 1024
+          maxItems: 100
+        new_versions:
+          type: array
+          items:
+            type: string
+            maxLength: 1024
+          maxItems: 100
+        action:
+          type: string
+          maxLength: 128
+          enum: [updated, installed, removed]
+        kb:
+          type: array
+          items:
+            type: string
+            maxLength: 1024
+          maxItems: 100
+      required: [name, identifier, architecture, old_versions, new_versions, action, kb]
+      additionalProperties: false
+    maxItems: 20000
+  updated_count:
+    type: integer
+    minimum: 0
+  installed_count:
+    type: integer
+    minimum: 0
+  removed_count:
+    type: integer
+    minimum: 0
+  pending:
+    type: array
+    items:
+      type: object
+      properties:
+        name:
+          type: string
+          maxLength: 1024
+        identifier:
+          type: [string, 'null']
+          maxLength: 1024
+        kb:
+          type: array
+          items:
+            type: string
+            maxLength: 1024
+          maxItems: 100
+      required: [name, identifier, kb]
+      additionalProperties: false
+    maxItems: 20000
+  failed_updates:
+    type: array
+    items:
+      type: object
+      properties:
+        name:
+          type: string
+          maxLength: 1024
+        identifier:
+          type: [string, 'null']
+          maxLength: 1024
+        native_code:
+          type: [integer, 'null']
+          minimum: 0
+        native_code_hex:
+          type: [string, 'null']
+          maxLength: 32
+        reason:
+          type: string
+          maxLength: 128
+          enum: [update_failed, operation_in_progress, install_not_allowed, not_applicable, exclusive_install_conflict, self_update_in_progress, no_connection, timeout]
+        message:
+          type: string
+          maxLength: 512
+      required: [name, identifier, native_code, native_code_hex, reason, message]
+      additionalProperties: false
+    maxItems: 20000
+  reboot_required:
+    type: [boolean, 'null']
+    description: Final observed/predicted pending reboot state after this run.
+  reboot_required_before:
+    type: boolean
+    description: A pending reboot was detected before patching began.
+  reboot_reasons_before:
+    type: array
+    description: Windows only. Native reboot sources reported by ansible.windows.win_reboot_info before patching.
+    items:
+      type: object
+      properties:
+        source:
+          type: string
+          maxLength: 128
+        description:
+          type: string
+          maxLength: 512
+      required: [source, description]
+      additionalProperties: false
+    maxItems: 32
+  reboot_required_after:
+    type: [boolean, 'null']
+    description: Final pending reboot state; false after an AIM-performed successful reboot.
+  reboot_performed:
+    type: boolean
+  reboot_deferred:
+    type: boolean
+    description: A reboot remains required because automatic reboot was disabled.
+  reboot_delay_minutes:
+    type: integer
+    minimum: 0
+    maximum: 1440
+  blocked_reason:
+    type: [string, 'null']
+    maxLength: 128
+    enum: [preexisting_reboot_required, update_failed, operation_in_progress, install_not_allowed, not_applicable, exclusive_install_conflict, self_update_in_progress, no_connection, timeout, cycle_limit_reached, null]
+  rescan_after_reboot:
+    type: boolean
+    description: Windows only. True permits a newly discovered patch wave after an AIM-performed reboot.
+  patch_cycles:
+    type: integer
+    minimum: 0
+    maximum: 12
+    description: Windows discovery/install cycles entered by this run.
+  continuation_required:
+    type: boolean
+    description: Another operator-approved patch run is recommended or required to continue patching.
+  remaining_updates_known:
+    type: boolean
+    description: True only when the report contains an authoritative post-wave discovery in pending.
+required:
+  - platform
+  - mode
+  - evidence
+  - complete
+  - updates
+  - updated_count
+  - installed_count
+  - removed_count
+  - pending
+  - failed_updates
+  - reboot_required
+  - reboot_required_before
+  - reboot_required_after
+  - reboot_performed
+  - reboot_deferred
+  - reboot_delay_minutes
+  - blocked_reason
+additionalProperties: false
diff --git a/playbooks/schemas/service_start_summary_v1.yml b/playbooks/schemas/service_start_summary_v1.yml
new file mode 100644
index 0000000..5ab2b1b
--- /dev/null
+++ b/playbooks/schemas/service_start_summary_v1.yml
@@ -0,0 +1,113 @@
+# AIM public operation-data schema. Closed fields except explicitly redacted configuration sections.
+type: object
+properties:
+  mode:
+    type: string
+    maxLength: 128
+    enum:
+    - apply
+    - check
+  initially_stopped:
+    type: array
+    items:
+      type: string
+      maxLength: 1024
+    maxItems: 20000
+  eligible:
+    type: array
+    items:
+      type: string
+      maxLength: 1024
+    maxItems: 20000
+  attempted:
+    type: array
+    items:
+      type: string
+      maxLength: 1024
+    maxItems: 20000
+  excluded:
+    type: array
+    items:
+      type: string
+      maxLength: 1024
+    maxItems: 20000
+  newly_running:
+    type: array
+    items:
+      type: string
+      maxLength: 1024
+    maxItems: 20000
+  still_stopped:
+    type: array
+    items:
+      type: string
+      maxLength: 1024
+    maxItems: 20000
+  unobserved:
+    type: array
+    items:
+      type: string
+      maxLength: 1024
+    maxItems: 20000
+  failed_to_start:
+    type: array
+    items:
+      type: object
+      properties:
+        name:
+          type: string
+          maxLength: 1024
+        reason:
+          type: string
+          maxLength: 128
+          enum:
+          - dependency_failed
+          - permission_denied
+          - service_disabled
+          - start_timeout
+          - service_not_found
+          - logon_failed
+          - start_failed
+          - not_running_after_start
+          - state_unavailable
+        message:
+          type: string
+          maxLength: 1024
+        native_code:
+          type:
+          - integer
+          - 'null'
+          minimum: 0
+      required:
+      - name
+      - reason
+      - message
+      - native_code
+      additionalProperties: false
+    maxItems: 20000
+  started_count:
+    type: integer
+    minimum: 0
+  failed_count:
+    type: integer
+    minimum: 0
+  before_count:
+    type: integer
+    minimum: 0
+  after_observed:
+    type: boolean
+required:
+- mode
+- initially_stopped
+- eligible
+- attempted
+- excluded
+- newly_running
+- still_stopped
+- unobserved
+- failed_to_start
+- started_count
+- failed_count
+- before_count
+- after_observed
+additionalProperties: false
diff --git a/playbooks/sophos_apply_baseline.yml b/playbooks/sophos_apply_baseline.yml
new file mode 100644
index 0000000..2701f74
--- /dev/null
+++ b/playbooks/sophos_apply_baseline.yml
@@ -0,0 +1,63 @@
+---
+# PURPOSE: Apply bitformer Sophos baseline
+# DESCRIPTION: Apply the supplied bitformer firewall baseline. Existing policy values and action order are preserved.
+# TARGETS: sophosxgs
+# INPUTS (omitted values inherit inventory / role defaults):
+#   aim_debug [bool]: false
+# AUTH: existing inventory / Vault credentials; no embedded passwords.
+# CHANGES: Changes firewall management access, objects and rules, including rule removal and a final drop rule. Policy values have NOT been redesigned.
+# EXAMPLE: ansible-playbook -i inventories/<customer>/hosts.yml
+#          playbooks/sophos_apply_baseline.yml --limit <host> --vault-id <customer>@prompt --ask-pass
+- name: Grundkonfiguration der Sophos-Firewall nach bitformer Standard
+  hosts: sophosxgs
+  gather_facts: false
+  any_errors_fatal: false
+  vars:
+    network_hosts:
+      - name: bf_spn_network
+        network: 10.242.176.0
+        subnetmask: 255.255.255.0
+      - name: rfc_1918_a
+        network: 10.0.0.0
+        subnetmask: 255.0.0.0
+      - name: rfc_1918_b
+        network: 172.16.0.0
+        subnetmask: 255.240.0.0
+      - name: rfc_1918_c
+        network: 192.168.0.0
+        subnetmask: 255.255.0.0
+      - name: rfc_5735
+        network: 169.254.0.0
+        subnetmask: 255.255.0.0
+    firewall_rules_to_remove:
+      - '[example] Traffic to Internal Zones'
+      - '[example] Traffic to WAN'
+      - '[example] Traffic to DMZ'
+    wireless_networks_to_remove:
+      - GuestAP
+      - Sophos
+  tasks:
+    - name: Apply supplied firewall policy
+      ansible.builtin.import_role:
+        name: sophos_apply_baseline
+        tasks_from: main
+  pre_tasks:
+    - name: AIM | Validate diagnostics option
+      ansible.builtin.assert:
+        that:
+          - (aim_debug | default(false)) is boolean or (aim_debug | default(false) | string | lower) in ['true',
+            'false']
+        fail_msg: aim_debug must be a YAML/JSON boolean.
+        quiet: true
+    - name: AIM | Reject mixed platform membership
+      ansible.builtin.assert:
+        that:
+          - (group_names | intersect(['linux', 'windows', 'sophosxgs', 'pfsense']) | length) <= 1
+        fail_msg: This host belongs to incompatible platform groups. Use globally unique subgroups.
+        quiet: true
+    - name: AIM | Execution context
+      ansible.builtin.debug:
+        msg:
+          host: '{{ inventory_hostname }}'
+          diagnostics: Enabled; secret values are never included by this task.
+      when: aim_debug | default(false) | bool
diff --git a/requirements-controller.txt b/requirements-controller.txt
new file mode 100644
index 0000000..74648cc
--- /dev/null
+++ b/requirements-controller.txt
@@ -0,0 +1,2 @@
+# AIM canonical Ansible runtime. Separate from the AIM/add-on environments.
+ansible-core==2.19.11
diff --git a/requirements.yml b/requirements.yml
new file mode 100644
index 0000000..3eaf21b
--- /dev/null
+++ b/requirements.yml
@@ -0,0 +1,10 @@
+# requirements.yml
+collections:
+  - name: ansible.netcommon
+  - name: ansible.windows
+    version: ">=3.8.0,<4.0.0"   # win_reboot_info baseline; compatible with ansible-core 2.19.11
+  - name: ansible.posix
+  - name: community.windows
+  - name: community.general
+  - name: sophos.sophos_firewall
+  - name: pfsensible.core
diff --git a/roles/checkmk_agent/README.md b/roles/checkmk_agent/README.md
new file mode 100644
index 0000000..fdb400d
--- /dev/null
+++ b/roles/checkmk_agent/README.md
@@ -0,0 +1,23 @@
+# checkmk_agent
+
+Operator defaults are intentionally low-precedence; inventory and explicit run options may override them.
+
+```yaml
+---
+
+checkmk_linux_tmp_path: /tmp
+checkmk_windows_tmp_path: C:\Windows\Temp
+checkmk_deb_filename: check-mk-agent.deb
+checkmk_rpm_filename: check-mk-agent.rpm
+checkmk_msi_filename: check_mk_agent.msi
+checkmk_agent_files_dir: '{{ lookup(''ansible.builtin.env'', ''AIM_CHECKMK_AGENT_FILES_DIR'') | default(role_path
+  ~ ''/files'', true) }}'
+```
+
+## Structured result integration
+
+Current reporting behavior and field semantics are specified in
+[scripts/docs/OPERATION_RESULTS.md](../../scripts/docs/OPERATION_RESULTS.md).
+The calling catalog playbook owns publication; helper roles do not implicitly export
+arbitrary facts, module results or debug data. Existing defaults above retain their
+precedence. See the current validation/sanity documents before using the new candidate.
diff --git a/roles/checkmk_agent/defaults/main.yml b/roles/checkmk_agent/defaults/main.yml
index 5b80a83..ddca2bb 100644
--- a/roles/checkmk_agent/defaults/main.yml
+++ b/roles/checkmk_agent/defaults/main.yml
@@ -1,9 +1,9 @@
 ---
-checkmk_linux_tmp_path: "/tmp"
-checkmk_windows_tmp_path: "C:\\Windows\\Temp"
-checkmk_deb_filename: "check-mk-agent.deb"
-checkmk_rpm_filename: "check-mk-agent.rpm"
-checkmk_msi_filename: "check_mk_agent.msi"
-checkmk_linux_socket_name: "check-mk-agent.socket"
-checkmk_linux_service_name: "check-mk-agent"
-checkmk_windows_service_name: "CheckMkService"
+
+checkmk_linux_tmp_path: /tmp
+checkmk_windows_tmp_path: C:\Windows\Temp
+checkmk_deb_filename: check-mk-agent.deb
+checkmk_rpm_filename: check-mk-agent.rpm
+checkmk_msi_filename: check_mk_agent.msi
+checkmk_agent_files_dir: '{{ lookup(''ansible.builtin.env'', ''AIM_CHECKMK_AGENT_FILES_DIR'') | default(role_path
+  ~ ''/files'', true) }}'
diff --git a/roles/checkmk_agent/files/README.md b/roles/checkmk_agent/files/README.md
index e8b926b..4e1b11f 100644
--- a/roles/checkmk_agent/files/README.md
+++ b/roles/checkmk_agent/files/README.md
@@ -1,5 +1,3 @@
-Place the Checkmk agent packages here:
+# Staged agent packages
 
-- `check-mk-agent.deb`
-- `check-mk-agent.rpm`
-- `check_mk_agent.msi`
+AIM Maintenance populates `check_mk_agent.msi`, `check-mk-agent.deb` and `check-mk-agent.rpm` here by default. Binaries are not included or replaced by this source bundle. Existing package files must be retained.
diff --git a/roles/checkmk_agent/handlers/main.yml b/roles/checkmk_agent/handlers/main.yml
deleted file mode 100644
index fd756b1..0000000
--- a/roles/checkmk_agent/handlers/main.yml
+++ /dev/null
@@ -1,55 +0,0 @@
----
-- name: "Enable & start Checkmk socket (if present)"
-  listen: "checkmk | linux | agent-ensure-running"
-  when: ansible_facts['os_family'] != "Windows"
-  ansible.builtin.systemd:
-    name: "{{ checkmk_linux_socket_name }}"
-    enabled: true
-    state: started
-    daemon_reload: true
-  failed_when: false
-
-- name: "Enable & start Checkmk service (fallback/if present)"
-  listen: "checkmk | linux | agent-ensure-running"
-  when: ansible_facts['os_family'] != "Windows"
-  ansible.builtin.systemd:
-    name: "{{ checkmk_linux_service_name }}"
-    enabled: true
-    state: started
-    daemon_reload: true
-  failed_when: false
-
-- name: "Windows | Detect Checkmk service name"
-  listen: "checkmk | windows | agent-ensure-running"
-  when: ansible_facts['os_family'] == "Windows"
-  ansible.windows.win_powershell:
-    script: |
-      $candidates = @('CheckMkService','Check_MK_Agent')
-      foreach ($n in $candidates) {
-        $svc = Get-Service -Name $n -ErrorAction SilentlyContinue
-        if ($svc) { $svc.Name; break }
-      }
-  register: cmk_detect
-  failed_when: false
-
-- name: "Windows | Set detected service name"
-  listen: "checkmk | windows | agent-ensure-running"
-  when: ansible_facts['os_family'] == "Windows"
-  ansible.builtin.set_fact:
-    cmk_service_name: >-
-      {{
-        (cmk_detect.output[0] | default('') | trim)
-        if (cmk_detect.output | default([]) | length > 0)
-        else (checkmk_windows_service_name | default('CheckMkService'))
-      }}
-
-- name: "Windows | Ensure Checkmk agent service running"
-  listen: "checkmk | windows | agent-ensure-running"
-  when:
-    - ansible_facts['os_family'] == "Windows"
-    - (cmk_service_name | default('')) | length > 0
-  ansible.windows.win_service:
-    name: "{{ cmk_service_name }}"
-    start_mode: auto
-    state: started
-  failed_when: false
diff --git a/roles/checkmk_agent/meta/main.yml b/roles/checkmk_agent/meta/main.yml
deleted file mode 100644
index a8400e1..0000000
--- a/roles/checkmk_agent/meta/main.yml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-galaxy_info:
-  role_name: checkmk_agent
-  description: Install Checkmk agent from local packages
-  min_ansible_version: "2.18"
-dependencies: []
diff --git a/roles/checkmk_agent/tasks/debian.yml b/roles/checkmk_agent/tasks/debian.yml
deleted file mode 100644
index 5cfe19e..0000000
--- a/roles/checkmk_agent/tasks/debian.yml
+++ /dev/null
@@ -1,11 +0,0 @@
----
-- name: "Debian | Copy Checkmk agent package"
-  ansible.builtin.copy:
-    src: "{{ checkmk_deb_filename }}"
-    dest: "{{ checkmk_linux_tmp_path }}/{{ checkmk_deb_filename }}"
-    mode: "0644"
-
-- name: "Debian | Install Checkmk agent"
-  ansible.builtin.apt:
-    deb: "{{ checkmk_linux_tmp_path }}/{{ checkmk_deb_filename }}"
-  notify: "checkmk | linux | agent-ensure-running"
diff --git a/roles/checkmk_agent/tasks/linux_debian.yml b/roles/checkmk_agent/tasks/linux_debian.yml
new file mode 100644
index 0000000..8876591
--- /dev/null
+++ b/roles/checkmk_agent/tasks/linux_debian.yml
@@ -0,0 +1,25 @@
+---
+
+- name: Checkmk | Verify staged package on controller
+  ansible.builtin.stat:
+    path: '{{ checkmk_agent_files_dir }}/{{ checkmk_deb_filename }}'
+  delegate_to: localhost
+  become: false
+  register: _checkmk_package
+- name: Checkmk | Require staged package
+  ansible.builtin.assert:
+    that:
+      - _checkmk_package.stat.isreg | default(false)
+      - _checkmk_package.stat.size | default(0) | int > 0
+    fail_msg: Required agent package is absent/empty. Use AIM Maintenance to download packages first.
+    quiet: true
+- name: Debian | Copy Checkmk agent package from role files
+  ansible.builtin.copy:
+    src: '{{ checkmk_agent_files_dir }}/{{ checkmk_deb_filename }}'
+    dest: '{{ checkmk_linux_tmp_path }}/{{ checkmk_deb_filename }}'
+    mode: '0644'
+- name: Debian | Install Checkmk agent from local .deb
+  ansible.builtin.apt:
+    deb: '{{ checkmk_linux_tmp_path }}/{{ checkmk_deb_filename }}'
+    state: present
+  register: _checkmk_package_install
diff --git a/roles/checkmk_agent/tasks/linux_redhat.yml b/roles/checkmk_agent/tasks/linux_redhat.yml
new file mode 100644
index 0000000..f03c7e4
--- /dev/null
+++ b/roles/checkmk_agent/tasks/linux_redhat.yml
@@ -0,0 +1,25 @@
+---
+
+- name: Checkmk | Verify staged package on controller
+  ansible.builtin.stat:
+    path: '{{ checkmk_agent_files_dir }}/{{ checkmk_rpm_filename }}'
+  delegate_to: localhost
+  become: false
+  register: _checkmk_package
+- name: Checkmk | Require staged package
+  ansible.builtin.assert:
+    that:
+      - _checkmk_package.stat.isreg | default(false)
+      - _checkmk_package.stat.size | default(0) | int > 0
+    fail_msg: Required agent package is absent/empty. Use AIM Maintenance to download packages first.
+    quiet: true
+- name: RedHat | Copy Checkmk agent package from role files
+  ansible.builtin.copy:
+    src: '{{ checkmk_agent_files_dir }}/{{ checkmk_rpm_filename }}'
+    dest: '{{ checkmk_linux_tmp_path }}/{{ checkmk_rpm_filename }}'
+    mode: '0644'
+- name: RedHat | Install Checkmk agent from local .rpm
+  ansible.builtin.dnf:
+    name: '{{ checkmk_linux_tmp_path }}/{{ checkmk_rpm_filename }}'
+    state: present
+  register: _checkmk_package_install
diff --git a/roles/checkmk_agent/tasks/main.yml b/roles/checkmk_agent/tasks/main.yml
index cd5e8fc..26b616f 100644
--- a/roles/checkmk_agent/tasks/main.yml
+++ b/roles/checkmk_agent/tasks/main.yml
@@ -1,12 +1,17 @@
 ---
-- name: Include Debian installation
-  ansible.builtin.include_tasks: debian.yml
-  when: ansible_facts['os_family'] == 'Debian'
 
-- name: Include RedHat installation
-  ansible.builtin.include_tasks: redhat.yml
-  when: ansible_facts['os_family'] == 'RedHat'
-
-- name: Include Windows installation
+- name: Checkmk | Supported installer
+  ansible.builtin.assert:
+    that:
+      - ansible_facts.os_family in ['Debian','RedHat','Windows']
+    fail_msg: Unsupported installer platform. No Python/package-manager bootstrap is performed.
+    quiet: true
+- name: Include Debian tasks
+  ansible.builtin.include_tasks: linux_debian.yml
+  when: ansible_facts['os_family']  == "Debian"
+- name: Include RedHat tasks
+  ansible.builtin.include_tasks: linux_redhat.yml
+  when: ansible_facts['os_family']  == "RedHat"
+- name: Include Windows tasks
   ansible.builtin.include_tasks: windows.yml
-  when: ansible_facts['os_family'] == 'Windows'
+  when: ansible_facts['os_family'] == "Windows"
diff --git a/roles/checkmk_agent/tasks/redhat.yml b/roles/checkmk_agent/tasks/redhat.yml
deleted file mode 100644
index bba0eb4..0000000
--- a/roles/checkmk_agent/tasks/redhat.yml
+++ /dev/null
@@ -1,12 +0,0 @@
----
-- name: "RedHat | Copy Checkmk agent package"
-  ansible.builtin.copy:
-    src: "{{ checkmk_rpm_filename }}"
-    dest: "{{ checkmk_linux_tmp_path }}/{{ checkmk_rpm_filename }}"
-    mode: "0644"
-
-- name: "RedHat | Install Checkmk agent"
-  ansible.builtin.package:
-    name: "{{ checkmk_linux_tmp_path }}/{{ checkmk_rpm_filename }}"
-    state: present
-  notify: "checkmk | linux | agent-ensure-running"
diff --git a/roles/checkmk_agent/tasks/windows.yml b/roles/checkmk_agent/tasks/windows.yml
index ee72015..f408c2d 100644
--- a/roles/checkmk_agent/tasks/windows.yml
+++ b/roles/checkmk_agent/tasks/windows.yml
@@ -1,11 +1,28 @@
 ---
-- name: "Windows | Copy Checkmk agent MSI"
-  ansible.windows.win_copy:
-    src: "{{ checkmk_msi_filename }}"
-    dest: "{{ checkmk_windows_tmp_path }}\\{{ checkmk_msi_filename }}"
 
-- name: "Windows | Install Checkmk agent from local MSI"
+- name: Checkmk | Verify staged package on controller
+  ansible.builtin.stat:
+    path: '{{ checkmk_agent_files_dir }}/{{ checkmk_msi_filename }}'
+  delegate_to: localhost
+  become: false
+  register: _checkmk_package
+- name: Checkmk | Require staged package
+  ansible.builtin.assert:
+    that:
+      - _checkmk_package.stat.isreg | default(false)
+      - _checkmk_package.stat.size | default(0) | int > 0
+    fail_msg: Required agent package is absent/empty. Use AIM Maintenance to download packages first.
+    quiet: true
+- name: Windows | Ensure temp dir exists
+  ansible.windows.win_file:
+    path: '{{ checkmk_windows_tmp_path }}'
+    state: directory
+- name: Windows | Copy Checkmk agent MSI from role files
+  ansible.windows.win_copy:
+    src: '{{ checkmk_agent_files_dir }}/{{ checkmk_msi_filename }}'
+    dest: '{{ checkmk_windows_tmp_path }}\{{ checkmk_msi_filename }}'
+- name: Windows | Install Checkmk agent from local MSI
   ansible.windows.win_package:
-    path: "{{ checkmk_windows_tmp_path }}\\{{ checkmk_msi_filename }}"
+    path: '{{ checkmk_windows_tmp_path }}\{{ checkmk_msi_filename }}'
     state: present
-  notify: "checkmk | windows | agent-ensure-running"
+  register: _checkmk_package_install
diff --git a/roles/checkmk_agent_config/meta/main.yml b/roles/checkmk_agent_config/meta/main.yml
deleted file mode 100644
index cbb0724..0000000
--- a/roles/checkmk_agent_config/meta/main.yml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-galaxy_info:
-  role_name: checkmk_agent_config
-  description: Render Windows Checkmk agent configuration from detected server roles
-  min_ansible_version: "2.18"
-dependencies: []
diff --git a/roles/checkmk_agent_config/tasks/main.yml b/roles/checkmk_agent_config/tasks/main.yml
deleted file mode 100644
index ba50c40..0000000
--- a/roles/checkmk_agent_config/tasks/main.yml
+++ /dev/null
@@ -1,20 +0,0 @@
----
-- name: "Debug detected role flags"
-  when: ansible_facts['os_family'] == "Windows"
-  ansible.builtin.debug:
-    msg:
-      dc: "{{ is_dc | default(false) }}"
-      dhcp: "{{ is_dhcp_server | default(false) }}"
-      vbr: "{{ has_veeam_vbr | default(false) }}"
-      vbo: "{{ has_veeam_vbo | default(false) }}"
-      em: "{{ has_veeam_em | default(false) }}"
-      hv: "{{ is_hyperv_host | default(false) }}"
-      timeout_updates: "{{ checkmk_windows_updates_timeout }}"
-
-- name: "Windows | Render check_mk.user.yml"
-  when: ansible_facts['os_family'] == "Windows"
-  ansible.windows.win_template:
-    src: "windows_check_mk.user.yml.j2"
-    dest: "{{ checkmk_windows_user_cfg }}"
-    backup: true
-  notify: "checkmk | windows | agent-ensure-running"
diff --git a/roles/checkmk_agent_config/templates/windows_check_mk.user.yml.j2 b/roles/checkmk_agent_config/templates/windows_check_mk.user.yml.j2
deleted file mode 100644
index e90d70c..0000000
--- a/roles/checkmk_agent_config/templates/windows_check_mk.user.yml.j2
+++ /dev/null
@@ -1,130 +0,0 @@
-# Managed by Ansible (checkmk_agent_config)
-# Windows Checkmk Agent user configuration built from detected roles.
-
-# $CUSTOM_PLUGINS_PATH$  -> ProgramData\checkmk\agent\plugins
-# $BUILTIN_PLUGINS_PATH$ -> Program Files (x86)\checkmk\service\plugins
-# $CUSTOM_AGENT_PATH$    -> ProgramData\checkmk\agent
-# $CUSTOM_LOCAL_PATH$    -> ProgramData\checkmk\agent\local
-
-global:
-  _only_from:
-  _realtime:
-    enabled: yes
-    timeout: 90
-    port: 6559
-    encrypted: no
-    passphrase: this is my password
-    run:
-      - mem
-      - df
-      - winperf_processor
-
-winperf:
-  counters:
-    - MSExchangeTransport Queues: msx_queues
-
-_logfiles:
-  enabled: no
-
-fileinfo:
-  path: []
-
-logwatch:
-  logfile: []
-
-plugins:
-  execution:
-    # --- Built-in defaults ---
-    - pattern: '$BUILTIN_PLUGINS_PATH$\windows_updates.vbs'
-      run: yes
-      async: yes
-      timeout: {{ checkmk_windows_updates_timeout }}
-      cache_age: {{ checkmk_windows_updates_cache }}
-      retry_count: 0
-
-    - pattern: '$BUILTIN_PLUGINS_PATH$\mk_inventory.vbs'
-      run: yes
-      async: yes
-      timeout: {{ checkmk_mk_inventory_timeout }}
-      cache_age: 3600
-
-    - pattern: '$BUILTIN_PLUGINS_PATH$\mssql.vbs'
-      run: yes
-      timeout: {{ checkmk_plugins_default_timeout }}
-
-{% if has_veeam_vbr | default(false) %}
-    # --- Veeam Backup & Replication ---
-    - pattern: '$BUILTIN_PLUGINS_PATH$\veeam_backup_status.ps1'
-      run: yes
-      async: yes
-      timeout: {{ checkmk_plugins_default_timeout }}
-      cache_age: {{ checkmk_plugins_default_cache }}
-{% endif %}
-
-{% if is_dc | default(false) %}
-    # --- Domain Controller ---
-    - pattern: '$BUILTIN_PLUGINS_PATH$\ad_replication.bat'
-      run: yes
-      timeout: {{ checkmk_plugins_default_timeout }}
-{% endif %}
-
-{% if is_dhcp_server | default(false) %}
-    # --- DHCP Server ---
-    - pattern: '$BUILTIN_PLUGINS_PATH$\win_dhcp_pools.bat'
-      run: yes
-      timeout: {{ checkmk_plugins_default_timeout }}
-{% endif %}
-
-    # --- Generic patterns / precedence ---
-    - pattern: '$CUSTOM_PLUGINS_PATH$\*.ps1'
-      run: yes
-      async: yes
-      timeout: {{ checkmk_plugins_default_timeout }}
-      cache_age: {{ checkmk_plugins_default_cache }}
-
-    - pattern: '$CUSTOM_PLUGINS_PATH$\*.*'
-      run: yes
-      timeout: {{ checkmk_plugins_default_timeout }}
-
-    - pattern: '$BUILTIN_PLUGINS_PATH$\*.*'
-      run: no
-      timeout: {{ checkmk_plugins_default_timeout }}
-
-    - pattern: '*'
-      run: no
-
-{% for p in (checkmk_extra_plugin_patterns | default([])) %}
-    - pattern: '{{ p.pattern }}'
-{% if p.run is defined %}
-      run: {{ p.run | bool }}
-{% endif %}
-{% if p.async is defined %}
-      async: {{ p.async | bool }}
-{% endif %}
-{% if p.timeout is defined %}
-      timeout: {{ p.timeout }}
-{% endif %}
-{% if p.cache_age is defined %}
-      cache_age: {{ p.cache_age }}
-{% endif %}
-{% endfor %}
-
-local:
-  _execution:
-    - pattern: '*.*'
-      run: yes
-{% for l in (checkmk_extra_local_patterns | default([])) %}
-    - pattern: '{{ l.pattern }}'
-{% if l.run is defined %}
-      run: {{ l.run | bool }}
-{% endif %}
-{% if l.async is defined %}
-      async: {{ l.async | bool }}
-{% endif %}
-{% if l.timeout is defined %}
-      timeout: {{ l.timeout }}
-{% endif %}
-{% endfor %}
-
-mrpe:
-  config: []
diff --git a/roles/checkmk_cleanup_scripts/README.md b/roles/checkmk_cleanup_scripts/README.md
new file mode 100644
index 0000000..ffe4b94
--- /dev/null
+++ b/roles/checkmk_cleanup_scripts/README.md
@@ -0,0 +1,36 @@
+# checkmk_cleanup_scripts
+
+Operator defaults are intentionally low-precedence; inventory and explicit run options may override them.
+
+```yaml
+---
+
+checkmk_linux_plugin_dir: /usr/lib/check_mk_agent/plugins
+checkmk_linux_local_dir: /usr/lib/check_mk_agent/local
+checkmk_linux_config_dir: /etc/check_mk
+checkmk_windows_plugin_dir: C:\ProgramData\checkmk\agent\plugins
+checkmk_windows_builtin_plugin_dir: C:\Program Files (x86)\checkmk\service\plugins
+checkmk_windows_local_dir: C:\ProgramData\checkmk\agent\local
+checkmk_monitoring_scripts_dir: '{{ lookup(''ansible.builtin.env'', ''AIM_CHECKMK_MONITORING_SCRIPTS_DIR'')
+  | default(''/etc/checkmk_monitoring_scripts'', true) }}'
+checkmk_windows_scripts_dir: '{{ checkmk_monitoring_scripts_dir }}/Scripts Windows'
+checkmk_linux_scripts_dir: '{{ checkmk_monitoring_scripts_dir }}/Scripts Linux'
+checkmk_unifi_mode: auto
+want_linux_check_certificate: false
+want_windows_citrix: false
+want_windows_surebackup: false
+want_windows_backup: false
+want_windows_nsp_mailqueue: false
+want_windows_certificate: false
+want_windows_veeam_cloud_connect: false
+want_windows_veeam_backup: false
+checkmk_cleanup_enabled: false
+```
+
+## Structured result integration
+
+Current reporting behavior and field semantics are specified in
+[scripts/docs/OPERATION_RESULTS.md](../../scripts/docs/OPERATION_RESULTS.md).
+The calling catalog playbook owns publication; helper roles do not implicitly export
+arbitrary facts, module results or debug data. Existing defaults above retain their
+precedence. See the current validation/sanity documents before using the new candidate.
diff --git a/roles/checkmk_cleanup_scripts/defaults/main.yml b/roles/checkmk_cleanup_scripts/defaults/main.yml
new file mode 100644
index 0000000..eae3d43
--- /dev/null
+++ b/roles/checkmk_cleanup_scripts/defaults/main.yml
@@ -0,0 +1,22 @@
+---
+
+checkmk_linux_plugin_dir: /usr/lib/check_mk_agent/plugins
+checkmk_linux_local_dir: /usr/lib/check_mk_agent/local
+checkmk_linux_config_dir: /etc/check_mk
+checkmk_windows_plugin_dir: C:\ProgramData\checkmk\agent\plugins
+checkmk_windows_builtin_plugin_dir: C:\Program Files (x86)\checkmk\service\plugins
+checkmk_windows_local_dir: C:\ProgramData\checkmk\agent\local
+checkmk_monitoring_scripts_dir: '{{ lookup(''ansible.builtin.env'', ''AIM_CHECKMK_MONITORING_SCRIPTS_DIR'')
+  | default(''/etc/checkmk_monitoring_scripts'', true) }}'
+checkmk_windows_scripts_dir: '{{ checkmk_monitoring_scripts_dir }}/Scripts Windows'
+checkmk_linux_scripts_dir: '{{ checkmk_monitoring_scripts_dir }}/Scripts Linux'
+checkmk_unifi_mode: auto
+want_linux_check_certificate: false
+want_windows_citrix: false
+want_windows_surebackup: false
+want_windows_backup: false
+want_windows_nsp_mailqueue: false
+want_windows_certificate: false
+want_windows_veeam_cloud_connect: false
+want_windows_veeam_backup: false
+checkmk_cleanup_enabled: false
diff --git a/roles/checkmk_cleanup_scripts/tasks/linux.yml b/roles/checkmk_cleanup_scripts/tasks/linux.yml
new file mode 100644
index 0000000..298cbbf
--- /dev/null
+++ b/roles/checkmk_cleanup_scripts/tasks/linux.yml
@@ -0,0 +1,15 @@
+
+  - name: Cleanup | Remove obsolete managed local check
+    ansible.builtin.file:
+      path: '{{ checkmk_linux_local_dir }}/{{ item }}'
+      state: absent
+    loop: '{{ _checkmk_remove_paths }}'
+    register: _aim_cleanup_files
+  - name: Cleanup | Remove UniFi configuration only when UniFi is disabled
+    ansible.builtin.file:
+      path: '{{ checkmk_linux_config_dir }}/unifi.cfg'
+      state: absent
+    when: _checkmk_unifi_effective == 'disabled'
+    diff: false
+    no_log: true
+    register: _aim_cleanup_unifi
diff --git a/roles/checkmk_cleanup_scripts/tasks/main.yml b/roles/checkmk_cleanup_scripts/tasks/main.yml
new file mode 100644
index 0000000..dab72a7
--- /dev/null
+++ b/roles/checkmk_cleanup_scripts/tasks/main.yml
@@ -0,0 +1,42 @@
+
+  - name: Cleanup | Validate opt-in
+    ansible.builtin.assert:
+      that:
+        - (checkmk_cleanup_enabled) is boolean or (checkmk_cleanup_enabled | string | lower) in ['true', 
+          'false']
+      fail_msg: checkmk_cleanup_enabled must be boolean.
+      quiet: true
+  - name: Cleanup | Build obsolete paths
+    ansible.builtin.set_fact:
+      _checkmk_remove_paths: "{{ _checkmk_obsolete_scripts | map(attribute='filename') | list }}"
+  - name: Cleanup | Candidate files
+    ansible.builtin.debug:
+      msg:
+        directory: "{{ checkmk_windows_local_dir if ansible_facts.os_family == 'Windows' else checkmk_linux_local_dir
+          }}"
+        files: '{{ _checkmk_remove_paths }}'
+        unifi_config: "{{ 'remove only when disabled' if ansible_facts.os_family != 'Windows' and _checkmk_unifi_effective
+          == 'disabled' else 'retained' }}"
+        mode: "{{ 'DELETE APPROVED' if checkmk_cleanup_enabled | bool else 'PREVIEW ONLY' }}"
+  - name: Cleanup | linux
+    ansible.builtin.include_tasks: linux.yml
+    when:
+      - checkmk_cleanup_enabled | bool
+      - ansible_facts.os_family != 'Windows'
+  - name: Cleanup | windows
+    ansible.builtin.include_tasks: windows.yml
+    when:
+      - checkmk_cleanup_enabled | bool
+      - ansible_facts.os_family == 'Windows'
+  - name: AIM | Publish operation result
+    ansible.builtin.set_stats:
+      per_host: true
+      aggregate: false
+      data:
+        aim_output:
+          protocol: aim_output_v1
+          schema: managed_cleanup_preview_v1
+          data: "{{ _checkmk_remove_paths | aim_report_cleanup(checkmk_windows_local_dir if ansible_facts.os_family
+            == 'Windows' else checkmk_linux_local_dir, _aim_cleanup_files | default({}), _checkmk_unifi_effective
+            if ansible_facts.os_family != 'Windows' else 'not_applicable', _aim_cleanup_unifi | default({}), checkmk_cleanup_enabled
+            | bool, ansible_check_mode) }}"
diff --git a/roles/checkmk_cleanup_scripts/tasks/windows.yml b/roles/checkmk_cleanup_scripts/tasks/windows.yml
new file mode 100644
index 0000000..743e3d3
--- /dev/null
+++ b/roles/checkmk_cleanup_scripts/tasks/windows.yml
@@ -0,0 +1,36 @@
+---
+- name: Cleanup | Remove obsolete managed local check or legacy local plugin copy
+  ansible.windows.win_file:
+    path: '{{ checkmk_windows_local_dir }}\{{ item }}'
+    state: absent
+  loop: '{{ _checkmk_remove_paths }}'
+  register: _aim_cleanup_local_files
+
+- name: Cleanup | Remove obsolete managed custom plugin
+  ansible.windows.win_file:
+    path: '{{ checkmk_windows_plugin_dir }}\{{ item }}'
+    state: absent
+  loop: >-
+    {{ _checkmk_obsolete_scripts
+       | selectattr('destination', 'defined')
+       | selectattr('destination', 'equalto', 'custom_plugin')
+       | map(attribute='filename') | list }}
+  register: _aim_cleanup_custom_plugin_files
+
+- name: Cleanup | Remove obsolete known legacy built-in plugin copy
+  ansible.windows.win_file:
+    path: '{{ checkmk_windows_builtin_plugin_dir }}\{{ item }}'
+    state: absent
+  loop: >-
+    {{ _checkmk_remove_paths
+       | select('in', ['veeam_o365_status.ps1', 'veeam_backup_status.ps1'])
+       | list }}
+  register: _aim_cleanup_builtin_files
+
+- name: Cleanup | Combine Windows cleanup results
+  ansible.builtin.set_fact:
+    _aim_cleanup_files:
+      results: >-
+        {{ (_aim_cleanup_local_files.results | default([]))
+           + (_aim_cleanup_custom_plugin_files.results | default([]))
+           + (_aim_cleanup_builtin_files.results | default([])) }}
diff --git a/roles/checkmk_configure_agent/README.md b/roles/checkmk_configure_agent/README.md
new file mode 100644
index 0000000..d787cda
--- /dev/null
+++ b/roles/checkmk_configure_agent/README.md
@@ -0,0 +1,33 @@
+# checkmk_configure_agent
+
+On Windows, AIM owns only the top-level `plugins:` section of `check_mk.user.yml`.
+The role preserves all other top-level sections and comments, including `global`,
+`winperf`, `fileinfo`, `logwatch`, `local`, and `mrpe`.
+
+The first line is an AIM ownership notice. The managed `plugins:` section also gets
+its own ownership comment so operators can see the exact management boundary.
+
+Operator defaults are intentionally low-precedence; inventory and explicit run options may override them.
+
+```yaml
+---
+checkmk_windows_user_cfg: C:\ProgramData\checkmk\agent\check_mk.user.yml
+checkmk_windows_updates_timeout: 3600
+checkmk_windows_updates_cache: 43200
+checkmk_mk_inventory_timeout: 120
+checkmk_plugins_default_timeout: 120
+checkmk_plugins_default_cache: 600
+checkmk_extra_plugin_patterns: []
+```
+
+`checkmk_extra_plugin_patterns` entries are inserted before AIM's standard plugin
+rules. AIM does not manage `local:` or `mrpe:` from this role; existing host-specific
+configuration in those sections is left intact.
+
+## Structured result integration
+
+Current reporting behavior and field semantics are specified in
+[scripts/docs/OPERATION_RESULTS.md](../../scripts/docs/OPERATION_RESULTS.md).
+The calling catalog playbook owns publication; helper roles do not implicitly export
+arbitrary facts, module results or debug data. Existing defaults above retain their
+precedence. See the current validation/sanity documents before using the new candidate.
diff --git a/roles/checkmk_agent_config/defaults/main.yml b/roles/checkmk_configure_agent/defaults/main.yml
similarity index 50%
rename from roles/checkmk_agent_config/defaults/main.yml
rename to roles/checkmk_configure_agent/defaults/main.yml
index 409e815..444a5c5 100644
--- a/roles/checkmk_agent_config/defaults/main.yml
+++ b/roles/checkmk_configure_agent/defaults/main.yml
@@ -1,9 +1,10 @@
 ---
-checkmk_windows_user_cfg: "C:\\ProgramData\\checkmk\\agent\\check_mk.user.yml"
+# AIM owns only the top-level plugins section in the Windows user configuration.
+# All other sections and comments must remain untouched.
+checkmk_windows_user_cfg: C:\ProgramData\checkmk\agent\check_mk.user.yml
 checkmk_windows_updates_timeout: 3600
 checkmk_windows_updates_cache: 43200
 checkmk_mk_inventory_timeout: 120
 checkmk_plugins_default_timeout: 120
 checkmk_plugins_default_cache: 600
 checkmk_extra_plugin_patterns: []
-checkmk_extra_local_patterns: []
diff --git a/roles/checkmk_configure_agent/tasks/main.yml b/roles/checkmk_configure_agent/tasks/main.yml
new file mode 100644
index 0000000..83bf037
--- /dev/null
+++ b/roles/checkmk_configure_agent/tasks/main.yml
@@ -0,0 +1,196 @@
+---
+
+- name: Checkmk | Validate Windows plugin execution settings
+  ansible.builtin.assert:
+    that:
+      - checkmk_extra_plugin_patterns is sequence
+      - checkmk_extra_plugin_patterns is not string
+      - checkmk_windows_updates_timeout | int >= 0
+      - checkmk_windows_updates_cache | int >= 0
+      - checkmk_mk_inventory_timeout | int >= 0
+      - checkmk_plugins_default_timeout | int >= 0
+      - checkmk_plugins_default_cache | int >= 0
+    fail_msg: Invalid Checkmk plugin execution setting type or negative timeout.
+    quiet: true
+  when: ansible_facts.os_family == 'Windows'
+
+- name: Checkmk | Validate custom plugin rule fields
+  ansible.builtin.assert:
+    that:
+      - item is mapping
+      - item.pattern is defined
+      - item.pattern is string
+      - item.run is not defined or item.run is boolean
+      - item['async'] is not defined or item['async'] is boolean
+      - item.timeout is not defined or item.timeout | int >= 0
+      - item.cache_age is not defined or item.cache_age | int >= 0
+      - item.keys() | difference(['pattern','run','async','timeout','cache_age','retry_count']) | length == 0
+    fail_msg: Custom plugin rules require pattern and supported execution fields.
+    quiet: true
+  loop: '{{ checkmk_extra_plugin_patterns }}'
+  loop_control:
+    label: custom plugin execution rule
+  no_log: true
+  when: ansible_facts.os_family == 'Windows'
+
+- name: Windows | Render AIM-managed Checkmk plugins section
+  ansible.windows.win_template:
+    src: windows_plugins_section.yml.j2
+    dest: '{{ checkmk_windows_user_cfg }}.aim-plugins.tmp'
+  when: ansible_facts.os_family == 'Windows'
+  diff: false
+  changed_when: false
+
+- name: Windows | Replace only Checkmk plugins section
+  ansible.windows.win_shell: |
+    $ErrorActionPreference = 'Stop'
+
+    $configPath = '{{ checkmk_windows_user_cfg }}'
+    $fragmentPath = '{{ checkmk_windows_user_cfg }}.aim-plugins.tmp'
+    $header = '# Managed by Ansible (checkmk_configure_agent). Only AIM-marked sections are modified; all other content is preserved.'
+    $legacyHeader = '# Managed by Ansible (checkmk_configure_agent).'
+    $managedMarkerPrefix = '# AIM managed section: plugins (checkmk_configure_agent).'
+
+    if (-not (Test-Path -LiteralPath $fragmentPath)) {
+        throw "AIM Checkmk plugins fragment is missing: $fragmentPath"
+    }
+
+    $fragment = [System.IO.File]::ReadAllText($fragmentPath)
+    $fragment = $fragment.TrimEnd([char[]]"`r`n")
+
+    if (Test-Path -LiteralPath $configPath) {
+        $original = [System.IO.File]::ReadAllText($configPath)
+    }
+    else {
+        $original = ''
+    }
+
+    if ($original.Contains("`r`n")) {
+        $newline = "`r`n"
+    }
+    else {
+        $newline = "`n"
+    }
+
+    $hadFinalNewline = $original.EndsWith("`r`n") -or $original.EndsWith("`n") -or $original.EndsWith("`r")
+    $lines = @()
+    if ($original.Length -gt 0) {
+        $lines = @([regex]::Split($original, "`r`n|`n|`r"))
+        if ($hadFinalNewline -and $lines.Count -gt 0 -and $lines[$lines.Count - 1] -eq '') {
+            if ($lines.Count -eq 1) {
+                $lines = @()
+            }
+            else {
+                $lines = @($lines[0..($lines.Count - 2)])
+            }
+        }
+    }
+
+    # Keep the AIM ownership notice as line 1 without discarding the previous first line.
+    if ($lines.Count -eq 0) {
+        $lines = @($header)
+    }
+    elseif ($lines[0] -eq $legacyHeader -or $lines[0].StartsWith('# Managed by Ansible (checkmk_configure_agent).')) {
+        $lines[0] = $header
+    }
+    else {
+        $lines = @($header) + $lines
+    }
+
+    $pluginIndex = -1
+    for ($i = 0; $i -lt $lines.Count; $i++) {
+        if ($lines[$i] -match '^plugins\s*:\s*(?:#.*)?$') {
+            $pluginIndex = $i
+            break
+        }
+    }
+
+    $fragmentLines = @([regex]::Split($fragment, "`r`n|`n|`r"))
+
+    if ($pluginIndex -ge 0) {
+        $replaceStart = $pluginIndex
+        if ($pluginIndex -gt 0 -and $lines[$pluginIndex - 1].StartsWith($managedMarkerPrefix)) {
+            $replaceStart = $pluginIndex - 1
+        }
+
+        $nextTopLevelKey = $lines.Count
+        for ($i = $pluginIndex + 1; $i -lt $lines.Count; $i++) {
+            if ($lines[$i] -match '^[A-Za-z_][A-Za-z0-9_.-]*\s*:') {
+                $nextTopLevelKey = $i
+                break
+            }
+        }
+
+        # Preserve blank lines and top-level comments immediately before the next untouched section.
+        $replaceEnd = $nextTopLevelKey
+        while ($replaceEnd -gt ($pluginIndex + 1)) {
+            $candidate = $lines[$replaceEnd - 1]
+            if ([string]::IsNullOrWhiteSpace($candidate) -or $candidate.StartsWith('#')) {
+                $replaceEnd--
+            }
+            else {
+                break
+            }
+        }
+
+        $before = @()
+        if ($replaceStart -gt 0) {
+            $before = @($lines[0..($replaceStart - 1)])
+        }
+        $after = @()
+        if ($replaceEnd -lt $lines.Count) {
+            $after = @($lines[$replaceEnd..($lines.Count - 1)])
+        }
+        $lines = @($before + $fragmentLines + $after)
+    }
+    else {
+        if ($lines.Count -gt 0 -and -not [string]::IsNullOrWhiteSpace($lines[$lines.Count - 1])) {
+            $lines += ''
+        }
+        $lines += $fragmentLines
+    }
+
+    $updated = [string]::Join($newline, $lines)
+    if ($hadFinalNewline -or $original.Length -eq 0) {
+        $updated += $newline
+    }
+
+    if ($updated -ne $original) {
+        $utf8NoBom = New-Object System.Text.UTF8Encoding($false)
+        [System.IO.File]::WriteAllText($configPath, $updated, $utf8NoBom)
+        Write-Output 'AIM_CHANGED=true'
+    }
+    else {
+        Write-Output 'AIM_CHANGED=false'
+    }
+  register: _checkmk_plugins_update
+  changed_when: "'AIM_CHANGED=true' in _checkmk_plugins_update.stdout"
+  when: ansible_facts.os_family == 'Windows'
+  notify: checkmk | windows | configuration-changed
+  diff: false
+
+- name: Windows | Normalize ACL on Checkmk user configuration
+  ansible.builtin.include_role:
+    name: checkmk_windows_acl
+  vars:
+    checkmk_windows_acl_paths:
+      - '{{ checkmk_windows_user_cfg }}'
+  when: ansible_facts.os_family == 'Windows'
+
+- name: Windows | Remove temporary Checkmk plugins fragment
+  ansible.windows.win_file:
+    path: '{{ checkmk_windows_user_cfg }}.aim-plugins.tmp'
+    state: absent
+  when: ansible_facts.os_family == 'Windows'
+  changed_when: false
+
+- name: Checkmk | Configuration summary
+  ansible.builtin.debug:
+    msg:
+      destination: '{{ checkmk_windows_user_cfg }}'
+      managed_section: plugins
+      extra_plugin_rules: '{{ checkmk_extra_plugin_patterns | length }}'
+      other_sections: preserved
+  when:
+    - ansible_facts.os_family == 'Windows'
+    - aim_debug | default(false) | bool
diff --git a/roles/checkmk_configure_agent/templates/windows_plugins_section.yml.j2 b/roles/checkmk_configure_agent/templates/windows_plugins_section.yml.j2
new file mode 100644
index 0000000..ac9044f
--- /dev/null
+++ b/roles/checkmk_configure_agent/templates/windows_plugins_section.yml.j2
@@ -0,0 +1,72 @@
+# AIM managed section: plugins (checkmk_configure_agent). Content under plugins: may be replaced by AIM.
+plugins:
+  execution:
+{% if checkmk_extra_plugin_patterns | length %}
+{{ checkmk_extra_plugin_patterns | to_nice_yaml(indent=2, sort_keys=false) | indent(4, true) }}
+{% endif %}
+    - pattern: '$BUILTIN_PLUGINS_PATH$\windows_updates.vbs'
+      run: true
+      async: true
+      timeout: {{ checkmk_windows_updates_timeout | int }}
+      cache_age: {{ checkmk_windows_updates_cache | int }}
+      retry_count: 0
+    - pattern: '$BUILTIN_PLUGINS_PATH$\mk_inventory.vbs'
+      run: true
+      async: true
+      timeout: {{ checkmk_mk_inventory_timeout | int }}
+      cache_age: 3600
+    - pattern: '$BUILTIN_PLUGINS_PATH$\mssql.vbs'
+      run: true
+      timeout: {{ checkmk_plugins_default_timeout | int }}
+{% if has_veeam_vbo | default(false) %}
+    - pattern: '$CUSTOM_PLUGINS_PATH$\veeam_o365_status.ps1'
+      run: true
+      async: true
+      timeout: {{ checkmk_plugins_default_timeout | int }}
+      cache_age: {{ checkmk_plugins_default_cache | int }}
+{% endif %}
+{% if want_windows_citrix | default(false) %}
+    - pattern: '$CUSTOM_PLUGINS_PATH$\citrix_sessions_customized.ps1'
+      run: true
+      async: true
+      timeout: {{ checkmk_plugins_default_timeout | int }}
+      cache_age: {{ checkmk_plugins_default_cache | int }}
+{% endif %}
+{% if want_windows_veeam_backup | default(false) %}
+    - pattern: '$CUSTOM_PLUGINS_PATH$\veeam_backup_status.ps1'
+      run: true
+      async: true
+      timeout: {{ checkmk_plugins_default_timeout | int }}
+      cache_age: {{ checkmk_plugins_default_cache | int }}
+{% endif %}
+{% if is_dc | default(false) %}
+    - pattern: '$BUILTIN_PLUGINS_PATH$\ad_replication.bat'
+      run: true
+      timeout: {{ checkmk_plugins_default_timeout | int }}
+{% endif %}
+{% if is_dhcp_server | default(false) %}
+    - pattern: '$BUILTIN_PLUGINS_PATH$\win_dhcp_pools.bat'
+      run: true
+      timeout: {{ checkmk_plugins_default_timeout | int }}
+{% endif %}
+{% if is_hyperv_host | default(false) %}
+    - pattern: '$BUILTIN_PLUGINS_PATH$\hyperv_vms.ps1'
+      run: true
+      timeout: {{ checkmk_plugins_default_timeout | int }}
+    - pattern: '$BUILTIN_PLUGINS_PATH$\hyperv_vms_guestinfos.ps1'
+      run: true
+      timeout: {{ checkmk_plugins_default_timeout | int }}
+{% endif %}
+    - pattern: '$CUSTOM_PLUGINS_PATH$\*.ps1'
+      run: true
+      async: true
+      timeout: {{ checkmk_plugins_default_timeout | int }}
+      cache_age: {{ checkmk_plugins_default_cache | int }}
+    - pattern: '$CUSTOM_PLUGINS_PATH$\*.*'
+      run: true
+      timeout: {{ checkmk_plugins_default_timeout | int }}
+    - pattern: '$BUILTIN_PLUGINS_PATH$\*.*'
+      run: false
+      timeout: {{ checkmk_plugins_default_timeout | int }}
+    - pattern: '*'
+      run: false
diff --git a/roles/checkmk_deploy_scripts/README.md b/roles/checkmk_deploy_scripts/README.md
new file mode 100644
index 0000000..cc75d5b
--- /dev/null
+++ b/roles/checkmk_deploy_scripts/README.md
@@ -0,0 +1,48 @@
+# checkmk_deploy_scripts
+
+Operator defaults are intentionally low-precedence; inventory and explicit run options may override them.
+
+```yaml
+---
+# unifi.cfg is role-managed and replaced, mode 0600. Password comes from Vault.
+# An absent/CHANGEME password fails before deployment; no credentials are logged.
+checkmk_linux_plugin_dir: /usr/lib/check_mk_agent/plugins
+checkmk_linux_local_dir: /usr/lib/check_mk_agent/local
+checkmk_linux_config_dir: /etc/check_mk
+checkmk_windows_plugin_dir: C:\ProgramData\checkmk\agent\plugins
+checkmk_windows_builtin_plugin_dir: C:\Program Files (x86)\checkmk\service\plugins
+checkmk_windows_local_dir: C:\ProgramData\checkmk\agent\local
+checkmk_monitoring_scripts_dir: '{{ lookup(''ansible.builtin.env'', ''AIM_CHECKMK_MONITORING_SCRIPTS_DIR'')
+  | default(''/etc/checkmk_monitoring_scripts'', true) }}'
+checkmk_windows_scripts_dir: '{{ checkmk_monitoring_scripts_dir }}/Scripts Windows'
+checkmk_linux_scripts_dir: '{{ checkmk_monitoring_scripts_dir }}/Scripts Linux'
+checkmk_unifi_mode: auto
+want_linux_check_certificate: false
+want_windows_citrix: false
+want_windows_surebackup: false
+want_windows_backup: false
+want_windows_nsp_mailqueue: false
+want_windows_certificate: false
+want_windows_veeam_cloud_connect: false
+want_windows_veeam_backup: false
+checkmk_unifi_username: bf-monitoring
+checkmk_unifi_password: '{{ vault_checkmk_unifi_password | default('''') }}'
+checkmk_unifi_baseurl: '{{ ''https://127.0.0.1:11443'' if _checkmk_unifi_effective == ''os'' else ''https://127.0.0.1:8443''
+  }}'
+checkmk_unifi_curl_options: ' --insecure --tlsv1.2'
+checkmk_unifi_status_provisioning: 1
+checkmk_unifi_status_upgrading: 1
+checkmk_unifi_status_upgradable: 0
+checkmk_unifi_status_heartbeat_missed: 1
+checkmk_unifi_status_noautobackup: 0
+```
+
+`unifi.cfg` is generated from the supplied schema, POSIX-shell quoted, mode `0600`, and protected with `no_log` and `diff: false`. Use a Vault reference for the password. `CHANGEME` and empty passwords fail before deployment. The active UniFi mode replaces the alternative local check. Other obsolete scripts are removed only by explicit cleanup.
+
+## Structured result integration
+
+Current reporting behavior and field semantics are specified in
+[scripts/docs/OPERATION_RESULTS.md](../../scripts/docs/OPERATION_RESULTS.md).
+The calling catalog playbook owns publication; helper roles do not implicitly export
+arbitrary facts, module results or debug data. Existing defaults above retain their
+precedence. See the current validation/sanity documents before using the new candidate.
diff --git a/roles/checkmk_deploy_scripts/defaults/main.yml b/roles/checkmk_deploy_scripts/defaults/main.yml
new file mode 100644
index 0000000..49e11da
--- /dev/null
+++ b/roles/checkmk_deploy_scripts/defaults/main.yml
@@ -0,0 +1,32 @@
+---
+# unifi.cfg is role-managed and replaced, mode 0600. Password comes from Vault.
+# An absent/CHANGEME password fails before deployment; no credentials are logged.
+checkmk_linux_plugin_dir: /usr/lib/check_mk_agent/plugins
+checkmk_linux_local_dir: /usr/lib/check_mk_agent/local
+checkmk_linux_config_dir: /etc/check_mk
+checkmk_windows_plugin_dir: C:\ProgramData\checkmk\agent\plugins
+checkmk_windows_builtin_plugin_dir: C:\Program Files (x86)\checkmk\service\plugins
+checkmk_windows_local_dir: C:\ProgramData\checkmk\agent\local
+checkmk_monitoring_scripts_dir: '{{ lookup(''ansible.builtin.env'', ''AIM_CHECKMK_MONITORING_SCRIPTS_DIR'')
+  | default(''/etc/checkmk_monitoring_scripts'', true) }}'
+checkmk_windows_scripts_dir: '{{ checkmk_monitoring_scripts_dir }}/Scripts Windows'
+checkmk_linux_scripts_dir: '{{ checkmk_monitoring_scripts_dir }}/Scripts Linux'
+checkmk_unifi_mode: auto
+want_linux_check_certificate: false
+want_windows_citrix: false
+want_windows_surebackup: false
+want_windows_backup: false
+want_windows_nsp_mailqueue: false
+want_windows_certificate: false
+want_windows_veeam_cloud_connect: false
+want_windows_veeam_backup: false
+checkmk_unifi_username: bf-monitoring
+checkmk_unifi_password: '{{ vault_checkmk_unifi_password | default('''') }}'
+checkmk_unifi_baseurl: '{{ ''https://127.0.0.1:11443'' if _checkmk_unifi_effective == ''os'' else ''https://127.0.0.1:8443''
+  }}'
+checkmk_unifi_curl_options: ' --insecure --tlsv1.2'
+checkmk_unifi_status_provisioning: 1
+checkmk_unifi_status_upgrading: 1
+checkmk_unifi_status_upgradable: 0
+checkmk_unifi_status_heartbeat_missed: 1
+checkmk_unifi_status_noautobackup: 0
diff --git a/roles/checkmk_deploy_scripts/tasks/linux.yml b/roles/checkmk_deploy_scripts/tasks/linux.yml
new file mode 100644
index 0000000..1518956
--- /dev/null
+++ b/roles/checkmk_deploy_scripts/tasks/linux.yml
@@ -0,0 +1,40 @@
+# UniFi mode replacement is the explicitly approved exception to separate cleanup.
+# Unknown files and the active UniFi check are never removed here.
+  - name: Linux | Ensure local check directory
+    ansible.builtin.file:
+      path: '{{ checkmk_linux_local_dir }}'
+      state: directory
+      mode: '0755'
+  - name: Linux | Ensure configuration directory
+    ansible.builtin.file:
+      path: '{{ checkmk_linux_config_dir }}'
+      state: directory
+      mode: '0755'
+  - name: Linux | Write the single UniFi configuration
+    ansible.builtin.template:
+      src: unifi.cfg.j2
+      dest: '{{ checkmk_linux_config_dir }}/unifi.cfg'
+      owner: root
+      group: root
+      mode: '0600'
+      validate: /bin/sh -n %s
+    when: _checkmk_unifi_effective in ['network','os']
+    no_log: true
+    diff: false
+    register: _aim_unifi_write
+  - name: Linux | Deploy selected monitoring checks
+    ansible.builtin.copy:
+      src: '{{ item.source }}'
+      dest: '{{ checkmk_linux_local_dir }}/{{ item.filename }}'
+      mode: '0755'
+    loop: '{{ _checkmk_selected_scripts }}'
+    loop_control:
+      label: '{{ item.filename }}'
+    register: _aim_check_copies
+  - name: Linux | Remove only the opposite UniFi local check
+    ansible.builtin.file:
+      path: "{{ checkmk_linux_local_dir }}/{{ 'check_unifi-controller.sh' if _checkmk_unifi_effective == 'os' else
+        'check_unifi-os.sh' }}"
+      state: absent
+    when: _checkmk_unifi_effective in ['network','os']
+    register: _aim_opposite_remove
diff --git a/roles/checkmk_deploy_scripts/tasks/main.yml b/roles/checkmk_deploy_scripts/tasks/main.yml
new file mode 100644
index 0000000..e845010
--- /dev/null
+++ b/roles/checkmk_deploy_scripts/tasks/main.yml
@@ -0,0 +1,10 @@
+---
+
+- name: Checkmk | Validate controller sources and required parameters
+  ansible.builtin.import_tasks: preflight.yml
+- name: Checkmk | Deploy linux checks
+  ansible.builtin.include_tasks: linux.yml
+  when: ansible_facts.os_family != 'Windows'
+- name: Checkmk | Deploy windows checks
+  ansible.builtin.include_tasks: windows.yml
+  when: ansible_facts.os_family == 'Windows'
diff --git a/roles/checkmk_deploy_scripts/tasks/preflight.yml b/roles/checkmk_deploy_scripts/tasks/preflight.yml
new file mode 100644
index 0000000..6f394b6
--- /dev/null
+++ b/roles/checkmk_deploy_scripts/tasks/preflight.yml
@@ -0,0 +1,57 @@
+---
+
+- name: Checkmk | Inspect selected controller script sources
+  ansible.builtin.stat:
+    path: '{{ item.source }}'
+  delegate_to: localhost
+  become: false
+  loop: '{{ _checkmk_selected_scripts }}'
+  loop_control:
+    label: '{{ item.filename }}'
+  register: _checkmk_sources
+- name: Checkmk | Require selected controller files
+  ansible.builtin.assert:
+    that:
+      - item.stat.exists | default(false)
+      - item.stat.isreg | default(false)
+    fail_msg: A selected monitoring script is missing on the controller. Sync the monitoring repository first.
+    quiet: true
+  loop: '{{ _checkmk_sources.results }}'
+  loop_control:
+    label: '{{ item.item.filename }}'
+- name: Checkmk | Validate UniFi public settings
+  ansible.builtin.assert:
+    that:
+      - checkmk_unifi_username is string
+      - checkmk_unifi_username | length > 0
+      - checkmk_unifi_baseurl is match('^https?://[^\s]+$')
+      - checkmk_unifi_curl_options is string
+      - checkmk_unifi_status_provisioning | int in [0,1,2,3]
+      - checkmk_unifi_status_upgrading | int in [0,1,2,3]
+      - checkmk_unifi_status_upgradable | int in [0,1,2,3]
+      - checkmk_unifi_status_heartbeat_missed | int in [0,1,2,3]
+      - checkmk_unifi_status_noautobackup | int in [0,1,2,3]
+    fail_msg: Invalid UniFi username, base URL, curl options or status mapping.
+    quiet: true
+  when:
+    - ansible_facts.os_family != 'Windows'
+    - _checkmk_unifi_effective in ['network','os']
+- name: Checkmk | Require a real UniFi monitoring password
+  when:
+    - ansible_facts.os_family != 'Windows'
+    - _checkmk_unifi_effective in ['network','os']
+  block:
+    - name: Checkmk | Validate secret
+      ansible.builtin.assert:
+        that:
+          - checkmk_unifi_password is string
+          - checkmk_unifi_password | length > 0
+          - checkmk_unifi_password != 'CHANGEME'
+        fail_msg: A real UniFi password is required.
+        quiet: true
+      no_log: true
+  rescue:
+    - name: Checkmk | Explain missing UniFi secret
+      ansible.builtin.fail:
+        msg: Set vault_checkmk_unifi_password in the customer Vault, or override checkmk_unifi_password with
+          a host-specific Vault reference. Empty values and CHANGEME are refused. No secret was logged.
diff --git a/roles/checkmk_deploy_scripts/tasks/windows.yml b/roles/checkmk_deploy_scripts/tasks/windows.yml
new file mode 100644
index 0000000..eea030f
--- /dev/null
+++ b/roles/checkmk_deploy_scripts/tasks/windows.yml
@@ -0,0 +1,68 @@
+---
+- name: Windows | Ensure Checkmk local directory
+  ansible.windows.win_file:
+    path: '{{ checkmk_windows_local_dir }}'
+    state: directory
+
+- name: Windows | Ensure Checkmk custom plugin directory
+  ansible.windows.win_file:
+    path: '{{ checkmk_windows_plugin_dir }}'
+    state: directory
+  when: >-
+    {{ _checkmk_selected_scripts
+       | selectattr('destination', 'defined')
+       | selectattr('destination', 'equalto', 'custom_plugin')
+       | list | length > 0 }}
+
+- name: Windows | Deploy selected monitoring checks
+  ansible.windows.win_copy:
+    src: '{{ item.source }}'
+    dest: >-
+      {{ (checkmk_windows_plugin_dir
+          if item.destination | default('local') == 'custom_plugin'
+          else checkmk_windows_local_dir) }}\{{ item.filename }}
+  loop: '{{ _checkmk_selected_scripts }}'
+  loop_control:
+    label: '{{ item.filename }}'
+  register: _aim_check_copies
+
+- name: Windows | Normalize ACL on AIM-managed monitoring checks
+  ansible.builtin.include_role:
+    name: checkmk_windows_acl
+  vars:
+    checkmk_windows_acl_paths:
+      - >-
+        {{ (checkmk_windows_plugin_dir
+            if checkmk_acl_script.destination | default('local') == 'custom_plugin'
+            else checkmk_windows_local_dir) }}\{{ checkmk_acl_script.filename }}
+  loop: '{{ _checkmk_selected_scripts }}'
+  loop_control:
+    loop_var: checkmk_acl_script
+    label: '{{ checkmk_acl_script.filename }}'
+
+- name: Windows | Remove legacy local copies after custom plugin relocation
+  ansible.windows.win_file:
+    path: '{{ checkmk_windows_local_dir }}\{{ item.filename }}'
+    state: absent
+  loop: >-
+    {{ _checkmk_selected_scripts
+       | selectattr('destination', 'defined')
+       | selectattr('destination', 'equalto', 'custom_plugin')
+       | list }}
+  loop_control:
+    label: '{{ item.filename }}'
+  register: _aim_custom_plugin_legacy_local_remove
+
+- name: Windows | Remove known legacy built-in copies after custom plugin relocation
+  ansible.windows.win_file:
+    path: '{{ checkmk_windows_builtin_plugin_dir }}\{{ item.filename }}'
+    state: absent
+  loop: >-
+    {{ _checkmk_selected_scripts
+       | selectattr('destination', 'defined')
+       | selectattr('destination', 'equalto', 'custom_plugin')
+       | selectattr('filename', 'in', ['veeam_o365_status.ps1', 'veeam_backup_status.ps1'])
+       | list }}
+  loop_control:
+    label: '{{ item.filename }}'
+  register: _aim_custom_plugin_legacy_builtin_remove
diff --git a/roles/checkmk_deploy_scripts/templates/unifi.cfg.j2 b/roles/checkmk_deploy_scripts/templates/unifi.cfg.j2
new file mode 100644
index 0000000..4632837
--- /dev/null
+++ b/roles/checkmk_deploy_scripts/templates/unifi.cfg.j2
@@ -0,0 +1,13 @@
+# Managed by Ansible - checkmk_deploy_scripts. One UniFi variant per host.
+# Values are POSIX-shell quoted because the monitoring scripts source this file.
+USERNAME={{ checkmk_unifi_username | quote }}
+PASSWORD={{ checkmk_unifi_password | quote }}
+BASEURL={{ checkmk_unifi_baseurl | quote }}
+CURLOPTS={{ checkmk_unifi_curl_options | quote }}
+
+# 0 OK, 1 WARN, 2 CRIT, 3 UNKNOWN
+STATUS_PROVISIONING={{ checkmk_unifi_status_provisioning | int }}
+STATUS_UPGRADING={{ checkmk_unifi_status_upgrading | int }}
+STATUS_UPGRADABLE={{ checkmk_unifi_status_upgradable | int }}
+STATUS_HEARTBEAT_MISSED={{ checkmk_unifi_status_heartbeat_missed | int }}
+STATUS_NOAUTOBACKUP={{ checkmk_unifi_status_noautobackup | int }}
diff --git a/roles/checkmk_manage_service/README.md b/roles/checkmk_manage_service/README.md
new file mode 100644
index 0000000..e8d2e84
--- /dev/null
+++ b/roles/checkmk_manage_service/README.md
@@ -0,0 +1,23 @@
+# checkmk_manage_service
+
+Operator defaults are intentionally low-precedence; inventory and explicit run options may override them.
+
+```yaml
+---
+
+checkmk_linux_service_name: cmk-agent-ctl-daemon.service
+checkmk_linux_socket_name: check-mk-agent.socket
+checkmk_windows_service_name: ''
+checkmk_windows_service_candidates:
+  - Check_MK_Agent
+  - CheckmkService
+  - Checkmk Service
+```
+
+## Structured result integration
+
+Current reporting behavior and field semantics are specified in
+[scripts/docs/OPERATION_RESULTS.md](../../scripts/docs/OPERATION_RESULTS.md).
+The calling catalog playbook owns publication; helper roles do not implicitly export
+arbitrary facts, module results or debug data. Existing defaults above retain their
+precedence. See the current validation/sanity documents before using the new candidate.
diff --git a/roles/checkmk_manage_service/defaults/main.yml b/roles/checkmk_manage_service/defaults/main.yml
new file mode 100644
index 0000000..d3163cd
--- /dev/null
+++ b/roles/checkmk_manage_service/defaults/main.yml
@@ -0,0 +1,9 @@
+---
+
+checkmk_linux_service_name: cmk-agent-ctl-daemon.service
+checkmk_linux_socket_name: check-mk-agent.socket
+checkmk_windows_service_name: ''
+checkmk_windows_service_candidates:
+  - Check_MK_Agent
+  - CheckmkService
+  - Checkmk Service
diff --git a/roles/checkmk_manage_service/handlers/main.yml b/roles/checkmk_manage_service/handlers/main.yml
new file mode 100644
index 0000000..30f5f81
--- /dev/null
+++ b/roles/checkmk_manage_service/handlers/main.yml
@@ -0,0 +1,9 @@
+---
+
+- name: Checkmk | Restart changed Windows agent configuration
+  ansible.windows.win_service:
+    name: '{{ item }}'
+    state: restarted
+  listen: checkmk | windows | configuration-changed
+  loop: '{{ _checkmk_windows_services | default([]) }}'
+  when: ansible_facts.os_family == 'Windows'
diff --git a/roles/checkmk_manage_service/tasks/linux.yml b/roles/checkmk_manage_service/tasks/linux.yml
new file mode 100644
index 0000000..aa2921f
--- /dev/null
+++ b/roles/checkmk_manage_service/tasks/linux.yml
@@ -0,0 +1,42 @@
+---
+
+- name: Linux | Require systemd service management
+  ansible.builtin.assert:
+    that:
+      - ansible_facts.service_mgr == 'systemd'
+    fail_msg: This Checkmk service policy requires systemd. No alternate service system is configured.
+    quiet: true
+- name: Linux | Refresh systemd after package installation
+  ansible.builtin.systemd_service:
+    daemon_reload: true
+  when: _checkmk_package_install.changed | default(false) | bool
+- name: Linux | Detect configured Checkmk units independently of running state
+  ansible.builtin.command:
+    argv:
+      - systemctl
+      - show
+      - --property=LoadState
+      - --value
+      - '{{ item }}'
+  loop:
+    - '{{ checkmk_linux_socket_name }}'
+    - '{{ checkmk_linux_service_name }}'
+  register: _checkmk_units
+  changed_when: false
+  failed_when: 'false'
+  check_mode: false
+- name: Linux | Select the installed unit, preferring the socket
+  ansible.builtin.set_fact:
+    _checkmk_linux_units: '{{ _checkmk_units.results | selectattr(''stdout'', ''defined'') | selectattr(''stdout'',
+      ''equalto'', ''loaded'') | map(attribute=''item'') | list }}'
+- name: Linux | Require an installed Checkmk unit
+  ansible.builtin.assert:
+    that:
+      - _checkmk_linux_units | length > 0
+    fail_msg: No configured Checkmk socket/service unit was found. Verify installation and the unit names.
+    quiet: true
+- name: Linux | Ensure Checkmk is enabled and running
+  ansible.builtin.systemd_service:
+    name: '{{ _checkmk_linux_units | first }}'
+    enabled: true
+    state: started
diff --git a/roles/checkmk_manage_service/tasks/main.yml b/roles/checkmk_manage_service/tasks/main.yml
new file mode 100644
index 0000000..78f64a8
--- /dev/null
+++ b/roles/checkmk_manage_service/tasks/main.yml
@@ -0,0 +1,8 @@
+---
+
+- name: Checkmk | Ensure agent service on linux
+  ansible.builtin.include_tasks: linux.yml
+  when: ansible_facts.os_family != 'Windows'
+- name: Checkmk | Ensure agent service on windows
+  ansible.builtin.include_tasks: windows.yml
+  when: ansible_facts.os_family == 'Windows'
diff --git a/roles/checkmk_manage_service/tasks/windows.yml b/roles/checkmk_manage_service/tasks/windows.yml
new file mode 100644
index 0000000..47338c5
--- /dev/null
+++ b/roles/checkmk_manage_service/tasks/windows.yml
@@ -0,0 +1,24 @@
+---
+
+- name: Windows | Find installed Checkmk service
+  ansible.windows.win_service_info:
+    name: '{{ item }}'
+  loop: '{{ ([checkmk_windows_service_name] if checkmk_windows_service_name | length else checkmk_windows_service_candidates)
+    }}'
+  register: _checkmk_win_service_query
+- name: Windows | Record service names
+  ansible.builtin.set_fact:
+    _checkmk_windows_services: '{{ _checkmk_win_service_query.results | selectattr(''services'', ''defined'')
+      | map(attribute=''services'') | flatten | map(attribute=''name'') | unique | list }}'
+- name: Windows | Require installed Checkmk service
+  ansible.builtin.assert:
+    that:
+      - _checkmk_windows_services | length > 0
+    fail_msg: No Checkmk service was found. Check the installed package or set checkmk_windows_service_name.
+    quiet: true
+- name: Windows | Ensure Checkmk service is running
+  ansible.windows.win_service:
+    name: '{{ item }}'
+    start_mode: auto
+    state: started
+  loop: '{{ _checkmk_windows_services }}'
diff --git a/roles/checkmk_report/README.md b/roles/checkmk_report/README.md
new file mode 100644
index 0000000..d0c7c9c
--- /dev/null
+++ b/roles/checkmk_report/README.md
@@ -0,0 +1,9 @@
+# checkmk_report
+
+Reporting-only helper for the Checkmk installation playbooks. Queries installed version
+from Windows uninstall registry or Debian/RPM package database, and re-reads current
+service/unit state. Does not install packages or restart/configure services. Unknown or
+ambiguous versions are null, never inferred from the staged package filename.
+
+The calling playbook publishes checkmk_agent_state_v1 via set_stats. See
+[OPERATION_RESULTS.md](../../scripts/docs/OPERATION_RESULTS.md).
diff --git a/roles/checkmk_report/tasks/main.yml b/roles/checkmk_report/tasks/main.yml
new file mode 100644
index 0000000..b0dabd3
--- /dev/null
+++ b/roles/checkmk_report/tasks/main.yml
@@ -0,0 +1,79 @@
+  - name: Checkmk | Collect managed change summary
+    ansible.builtin.set_fact:
+      _aim_checkmk_changes: '{{ _aim_check_copies | default({}) | aim_report_checkmk_changes(_checkmk_selected_scripts,
+        _checkmk_plugins_update | default({}), _aim_unifi_write | default({}), _aim_opposite_remove | default({}),
+        _checkmk_unifi_effective, ansible_check_mode) }}'
+
+  # No supported Windows package-inventory module exposes arbitrary installed MSI/registry products.
+  # Keep this bounded read-only registry query until an official module covers that data.
+  - name: Checkmk | Query Windows installed version
+    ansible.windows.win_shell: |
+      $ErrorActionPreference = 'Stop'
+      $roots = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*')
+      $products = @(Get-ItemProperty -Path $roots -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -match '^(Check_MK|Checkmk|Check MK).*Agent' })
+      $versions = @($products | Select-Object -ExpandProperty DisplayVersion -Unique)
+      $version = $null
+      if ($versions.Count -eq 1) { $version = [string]$versions[0] }
+      @{ installed=($products.Count -gt 0); version=$version; version_source='registry' } | ConvertTo-Json -Compress
+    register: _aim_checkmk_version_raw
+    changed_when: false
+    check_mode: false
+    when: ansible_facts.os_family == 'Windows'
+
+  - name: Checkmk | Collect Linux package facts
+    ansible.builtin.package_facts:
+      manager: auto
+    when: ansible_facts.os_family != 'Windows'
+
+  - name: Checkmk | Record Linux installed package rows
+    ansible.builtin.set_fact:
+      _aim_checkmk_linux_package_rows: "{{ ansible_facts.packages.get('check-mk-agent', []) }}"
+    when: ansible_facts.os_family != 'Windows'
+
+  - name: Checkmk | Observe Windows service state
+    ansible.windows.win_service_info:
+      name: '{{ item }}'
+    loop: '{{ _checkmk_windows_services | default([]) }}'
+    register: _aim_checkmk_final_services
+    when: ansible_facts.os_family == 'Windows'
+
+  - name: Checkmk | Collect Linux service facts
+    ansible.builtin.service_facts:
+    when: ansible_facts.os_family != 'Windows'
+
+  - name: Checkmk | Observe Linux unit state
+    ansible.builtin.set_fact:
+      _aim_checkmk_unit_state: >-
+        {{ ansible_facts.services.get(_checkmk_linux_units | first,
+           {'name': _checkmk_linux_units | first, 'state': 'unknown'}) }}
+    when: ansible_facts.os_family != 'Windows'
+
+  - name: Checkmk | Build installed state report
+    ansible.builtin.set_fact:
+      _aim_checkmk_state: >-
+        {{
+          (
+            (_aim_checkmk_version_raw.stdout | from_json)
+            if ansible_facts.os_family == 'Windows'
+            else {
+              'installed': (_aim_checkmk_linux_package_rows | default([]) | length) > 0,
+              'version': (
+                (_aim_checkmk_linux_package_rows | first).version
+                if (_aim_checkmk_linux_package_rows | default([]) | length) == 1
+                else none
+              ),
+              'version_source': 'package_facts'
+            }
+          )
+          | aim_report_checkmk_state(
+              (
+                _aim_checkmk_final_services.results
+                | selectattr('services', 'defined')
+                | map(attribute='services')
+                | flatten
+              ) if ansible_facts.os_family == 'Windows' else [_aim_checkmk_unit_state],
+              _aim_checkmk_changes,
+              _checkmk_package_install.changed | default(false),
+              ansible_check_mode
+            )
+        }}
diff --git a/roles/checkmk_script_plan/README.md b/roles/checkmk_script_plan/README.md
new file mode 100644
index 0000000..568e6e0
--- /dev/null
+++ b/roles/checkmk_script_plan/README.md
@@ -0,0 +1,27 @@
+# checkmk_script_plan
+
+Operator defaults are intentionally low-precedence; inventory and explicit run options may override them.
+
+```yaml
+---
+# Shared deployment and cleanup paths/optional switches. No secrets.
+checkmk_linux_plugin_dir: /usr/lib/check_mk_agent/plugins
+checkmk_linux_local_dir: /usr/lib/check_mk_agent/local
+checkmk_linux_config_dir: /etc/check_mk
+checkmk_windows_plugin_dir: C:\ProgramData\checkmk\agent\plugins
+checkmk_windows_builtin_plugin_dir: C:\Program Files (x86)\checkmk\service\plugins
+checkmk_windows_local_dir: C:\ProgramData\checkmk\agent\local
+checkmk_monitoring_scripts_dir: '{{ lookup(''ansible.builtin.env'', ''AIM_CHECKMK_MONITORING_SCRIPTS_DIR'')
+  | default(''/etc/checkmk_monitoring_scripts'', true) }}'
+checkmk_windows_scripts_dir: '{{ checkmk_monitoring_scripts_dir }}/Scripts Windows'
+checkmk_linux_scripts_dir: '{{ checkmk_monitoring_scripts_dir }}/Scripts Linux'
+checkmk_unifi_mode: auto
+want_linux_check_certificate: false
+want_windows_citrix: false
+want_windows_surebackup: false
+want_windows_backup: false
+want_windows_nsp_mailqueue: false
+want_windows_certificate: false
+want_windows_veeam_cloud_connect: false
+want_windows_veeam_backup: false
+```
diff --git a/roles/checkmk_script_plan/defaults/main.yml b/roles/checkmk_script_plan/defaults/main.yml
new file mode 100644
index 0000000..cbe6e8b
--- /dev/null
+++ b/roles/checkmk_script_plan/defaults/main.yml
@@ -0,0 +1,21 @@
+---
+# Shared deployment and cleanup paths/optional switches. No secrets.
+checkmk_linux_plugin_dir: /usr/lib/check_mk_agent/plugins
+checkmk_linux_local_dir: /usr/lib/check_mk_agent/local
+checkmk_linux_config_dir: /etc/check_mk
+checkmk_windows_plugin_dir: C:\ProgramData\checkmk\agent\plugins
+checkmk_windows_builtin_plugin_dir: C:\Program Files (x86)\checkmk\service\plugins
+checkmk_windows_local_dir: C:\ProgramData\checkmk\agent\local
+checkmk_monitoring_scripts_dir: '{{ lookup(''ansible.builtin.env'', ''AIM_CHECKMK_MONITORING_SCRIPTS_DIR'')
+  | default(''/etc/checkmk_monitoring_scripts'', true) }}'
+checkmk_windows_scripts_dir: '{{ checkmk_monitoring_scripts_dir }}/Scripts Windows'
+checkmk_linux_scripts_dir: '{{ checkmk_monitoring_scripts_dir }}/Scripts Linux'
+checkmk_unifi_mode: auto
+want_linux_check_certificate: false
+want_windows_citrix: false
+want_windows_surebackup: false
+want_windows_backup: false
+want_windows_nsp_mailqueue: false
+want_windows_certificate: false
+want_windows_veeam_cloud_connect: false
+want_windows_veeam_backup: false
diff --git a/roles/checkmk_script_plan/tasks/main.yml b/roles/checkmk_script_plan/tasks/main.yml
new file mode 100644
index 0000000..63cd133
--- /dev/null
+++ b/roles/checkmk_script_plan/tasks/main.yml
@@ -0,0 +1,27 @@
+---
+
+- name: Checkmk | Validate UniFi mode
+  ansible.builtin.assert:
+    that:
+      - checkmk_unifi_mode in ['auto','network','os','disabled']
+    fail_msg: UniFi mode must be auto, network, os or disabled.
+    quiet: true
+- name: Checkmk | Resolve UniFi mode
+  ansible.builtin.set_fact:
+    _checkmk_unifi_effective: '{{ checkmk_unifi_mode if checkmk_unifi_mode != ''auto'' else (''os'' if is_unifi_os_server
+      | default(false) | bool else (''network'' if is_unifi_controller | default(false) | bool else ''disabled''))
+      }}'
+- name: Checkmk | Build managed script plan
+  ansible.builtin.set_fact:
+    _checkmk_script_catalog: '{{ _checkmk_windows_catalog if ansible_facts.os_family == ''Windows'' else _checkmk_linux_catalog
+      }}'
+- name: Checkmk | Resolve selected and obsolete checks
+  ansible.builtin.set_fact:
+    _checkmk_selected_scripts: '{{ _checkmk_script_catalog | selectattr(''enabled'') | list }}'
+    _checkmk_obsolete_scripts: '{{ _checkmk_script_catalog | rejectattr(''enabled'') | list }}'
+- name: Checkmk | Selected check plan
+  ansible.builtin.debug:
+    msg:
+      files: '{{ _checkmk_selected_scripts | map(attribute=''filename'') | list }}'
+      unifi_mode: '{{ _checkmk_unifi_effective }}'
+  when: aim_debug | default(false) | bool
diff --git a/roles/checkmk_script_plan/vars/main.yml b/roles/checkmk_script_plan/vars/main.yml
new file mode 100644
index 0000000..1d8eb5e
--- /dev/null
+++ b/roles/checkmk_script_plan/vars/main.yml
@@ -0,0 +1,49 @@
+---
+# Internal managed filenames. Repository scripts are not embedded or rewritten by AIM.
+_checkmk_windows_catalog:
+  - filename: check-ping.ps1
+    source: '{{ checkmk_windows_scripts_dir }}/check-ping.ps1'
+    enabled: '{{ is_dc | default(false) | bool }}'
+  - filename: veeam_config_backup_status.ps1
+    source: '{{ checkmk_windows_scripts_dir }}/veeam_config_backup_status.ps1'
+    enabled: '{{ has_veeam_vbr | default(false) | bool }}'
+  - filename: veeam_backup_license_status.ps1
+    source: '{{ checkmk_windows_scripts_dir }}/veeam_backup_license_status.ps1'
+    enabled: '{{ has_veeam_vbr | default(false) | bool }}'
+  - filename: veeam_o365_status.ps1
+    source: '{{ checkmk_windows_scripts_dir }}/veeam_o365_status.ps1'
+    destination: custom_plugin
+    enabled: '{{ has_veeam_vbo | default(false) | bool }}'
+  - filename: citrix_sessions_customized.ps1
+    source: '{{ checkmk_windows_scripts_dir }}/citrix_sessions_customized.ps1'
+    destination: custom_plugin
+    enabled: '{{ want_windows_citrix | default(false) | bool }}'
+  - filename: veeam_surebackup_status.ps1
+    source: '{{ checkmk_windows_scripts_dir }}/veeam_surebackup_status.ps1'
+    enabled: '{{ want_windows_surebackup | default(false) | bool }}'
+  - filename: windows-backup.ps1
+    source: '{{ checkmk_windows_scripts_dir }}/windows-backup.ps1'
+    enabled: '{{ want_windows_backup | default(false) | bool }}'
+  - filename: check-nsp-mailqueue.ps1
+    source: '{{ checkmk_windows_scripts_dir }}/check-nsp-mailqueue.ps1'
+    enabled: '{{ want_windows_nsp_mailqueue | default(false) | bool }}'
+  - filename: win_check_cert.ps1
+    source: '{{ checkmk_windows_scripts_dir }}/win_check_cert.ps1'
+    enabled: '{{ want_windows_certificate | default(false) | bool }}'
+  - filename: veeam_cloud_connect_status.ps1
+    source: '{{ checkmk_windows_scripts_dir }}/veeam_cloud_connect_status.ps1'
+    enabled: '{{ want_windows_veeam_cloud_connect | default(false) | bool }}'
+  - filename: veeam_backup_status.ps1
+    source: '{{ checkmk_windows_scripts_dir }}/veeam_backup_status.ps1'
+    destination: custom_plugin
+    enabled: '{{ want_windows_veeam_backup | default(false) | bool }}'
+_checkmk_linux_catalog:
+  - filename: check_unifi-controller.sh
+    source: '{{ checkmk_linux_scripts_dir }}/check_unifi-controller/check_unifi-controller.sh'
+    enabled: '{{ _checkmk_unifi_effective == ''network'' }}'
+  - filename: check_unifi-os.sh
+    source: '{{ checkmk_linux_scripts_dir }}/check_unifi-controller/check_unifi-os.sh'
+    enabled: '{{ _checkmk_unifi_effective == ''os'' }}'
+  - filename: check_certificate_directory.sh
+    source: '{{ checkmk_linux_scripts_dir }}/check_certificate_directory.sh'
+    enabled: '{{ want_linux_check_certificate | default(false) | bool }}'
diff --git a/roles/checkmk_scripts/defaults/main.yml b/roles/checkmk_scripts/defaults/main.yml
deleted file mode 100644
index 8803d80..0000000
--- a/roles/checkmk_scripts/defaults/main.yml
+++ /dev/null
@@ -1,12 +0,0 @@
----
-checkmk_linux_local_dir: "/usr/lib/check_mk_agent/local"
-checkmk_linux_config_dir: "/etc/check_mk"
-checkmk_windows_local_dir: "C:\\ProgramData\\checkmk\\agent\\local"
-checkmk_linux_scripts_dir: "Linux/local"
-checkmk_windows_scripts_dir: "Windows/local"
-
-# Optional checks, disabled until explicitly requested
-want_linux_check_certificate: false
-want_windows_citrix: false
-want_windows_surebackup: false
-want_windows_backup: false
diff --git a/roles/checkmk_scripts/files/README.md b/roles/checkmk_scripts/files/README.md
deleted file mode 100644
index a92fb3c..0000000
--- a/roles/checkmk_scripts/files/README.md
+++ /dev/null
@@ -1,16 +0,0 @@
-Place the actual monitoring scripts in these directories.
-
-Linux/local/
-- check_certificate_directory.sh
-- check_unifi-controller.sh
-- unifi.cfg
-
-Windows/local/
-- check-ping.ps1
-- citrix_sessions_customized.ps1
-- veeam_config_backup_status.ps1
-- veeam_o365_status.ps1
-- veeam_surebackup_status.ps1
-- windows-backup.ps1
-
-The ZIP intentionally does not invent script contents that were not provided.
diff --git a/roles/checkmk_scripts/files/Windows/local/veeam_o365_status.ps1.example b/roles/checkmk_scripts/files/Windows/local/veeam_o365_status.ps1.example
deleted file mode 100644
index e69de29..0000000
diff --git a/roles/checkmk_scripts/files/Windows/local/veeam_surebackup_status.ps1.example b/roles/checkmk_scripts/files/Windows/local/veeam_surebackup_status.ps1.example
deleted file mode 100644
index e69de29..0000000
diff --git a/roles/checkmk_scripts/files/Windows/local/windows-backup.ps1.example b/roles/checkmk_scripts/files/Windows/local/windows-backup.ps1.example
deleted file mode 100644
index e69de29..0000000
diff --git a/roles/checkmk_scripts/meta/main.yml b/roles/checkmk_scripts/meta/main.yml
deleted file mode 100644
index e4e1200..0000000
--- a/roles/checkmk_scripts/meta/main.yml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-galaxy_info:
-  role_name: checkmk_scripts
-  description: Deploy role-specific Checkmk local monitoring scripts
-  min_ansible_version: "2.18"
-dependencies: []
diff --git a/roles/checkmk_scripts/tasks/linux.yml b/roles/checkmk_scripts/tasks/linux.yml
deleted file mode 100644
index 914212c..0000000
--- a/roles/checkmk_scripts/tasks/linux.yml
+++ /dev/null
@@ -1,36 +0,0 @@
----
-- name: "Linux | Ensure local dir exists"
-  ansible.builtin.file:
-    path: "{{ checkmk_linux_local_dir }}"
-    state: directory
-    mode: "0755"
-
-- name: "Linux | Ensure config dir exists"
-  ansible.builtin.file:
-    path: "{{ checkmk_linux_config_dir }}"
-    state: directory
-    mode: "0755"
-
-- name: "Linux | Deploy UniFi local check"
-  when: is_unifi_controller | default(false) | bool
-  ansible.builtin.copy:
-    src: "{{ checkmk_linux_scripts_dir }}/check_unifi-controller.sh"
-    dest: "{{ checkmk_linux_local_dir }}/check_unifi-controller.sh"
-    mode: "0755"
-  notify: "checkmk | linux | agent-ensure-running"
-
-- name: "Linux | Deploy unifi.cfg"
-  when: is_unifi_controller | default(false) | bool
-  ansible.builtin.copy:
-    src: "{{ checkmk_linux_scripts_dir }}/unifi.cfg"
-    dest: "{{ checkmk_linux_config_dir }}/unifi.cfg"
-    mode: "0644"
-  notify: "checkmk | linux | agent-ensure-running"
-
-- name: "Linux | Deploy certificate directory check"
-  when: want_linux_check_certificate | default(false) | bool
-  ansible.builtin.copy:
-    src: "{{ checkmk_linux_scripts_dir }}/check_certificate_directory.sh"
-    dest: "{{ checkmk_linux_local_dir }}/check_certificate_directory.sh"
-    mode: "0755"
-  notify: "checkmk | linux | agent-ensure-running"
diff --git a/roles/checkmk_scripts/tasks/main.yml b/roles/checkmk_scripts/tasks/main.yml
deleted file mode 100644
index 503ef04..0000000
--- a/roles/checkmk_scripts/tasks/main.yml
+++ /dev/null
@@ -1,8 +0,0 @@
----
-- name: Include Linux monitoring scripts
-  ansible.builtin.include_tasks: linux.yml
-  when: ansible_facts['os_family'] != 'Windows'
-
-- name: Include Windows monitoring scripts
-  ansible.builtin.include_tasks: windows.yml
-  when: ansible_facts['os_family'] == 'Windows'
diff --git a/roles/checkmk_scripts/tasks/windows.yml b/roles/checkmk_scripts/tasks/windows.yml
deleted file mode 100644
index d9ebb58..0000000
--- a/roles/checkmk_scripts/tasks/windows.yml
+++ /dev/null
@@ -1,47 +0,0 @@
----
-- name: "Windows | Ensure local dir exists"
-  ansible.windows.win_file:
-    path: "{{ checkmk_windows_local_dir }}"
-    state: directory
-
-- name: "Windows | Deploy check-ping.ps1 (DC only)"
-  when: is_dc | default(false) | bool
-  ansible.windows.win_copy:
-    src: "{{ checkmk_windows_scripts_dir }}/check-ping.ps1"
-    dest: "{{ checkmk_windows_local_dir }}\\check-ping.ps1"
-  notify: "checkmk | windows | agent-ensure-running"
-
-- name: "Windows | Deploy Veeam configuration backup status check (VBR only)"
-  when: has_veeam_vbr | default(false) | bool
-  ansible.windows.win_copy:
-    src: "{{ checkmk_windows_scripts_dir }}/veeam_config_backup_status.ps1"
-    dest: "{{ checkmk_windows_local_dir }}\\veeam_config_backup_status.ps1"
-  notify: "checkmk | windows | agent-ensure-running"
-
-- name: "Windows | Deploy veeam_o365_status.ps1 (VBO only)"
-  when: has_veeam_vbo | default(false) | bool
-  ansible.windows.win_copy:
-    src: "{{ checkmk_windows_scripts_dir }}/veeam_o365_status.ps1"
-    dest: "{{ checkmk_windows_local_dir }}\\veeam_o365_status.ps1"
-  notify: "checkmk | windows | agent-ensure-running"
-
-- name: "Windows | Deploy Citrix sessions check"
-  when: want_windows_citrix | default(false) | bool
-  ansible.windows.win_copy:
-    src: "{{ checkmk_windows_scripts_dir }}/citrix_sessions_customized.ps1"
-    dest: "{{ checkmk_windows_local_dir }}\\citrix_sessions_customized.ps1"
-  notify: "checkmk | windows | agent-ensure-running"
-
-- name: "Windows | Deploy Veeam SureBackup check"
-  when: want_windows_surebackup | default(false) | bool
-  ansible.windows.win_copy:
-    src: "{{ checkmk_windows_scripts_dir }}/veeam_surebackup_status.ps1"
-    dest: "{{ checkmk_windows_local_dir }}\\veeam_surebackup_status.ps1"
-  notify: "checkmk | windows | agent-ensure-running"
-
-- name: "Windows | Deploy Windows Backup check"
-  when: want_windows_backup | default(false) | bool
-  ansible.windows.win_copy:
-    src: "{{ checkmk_windows_scripts_dir }}/windows-backup.ps1"
-    dest: "{{ checkmk_windows_local_dir }}\\windows-backup.ps1"
-  notify: "checkmk | windows | agent-ensure-running"
diff --git a/roles/checkmk_windows_acl/README.md b/roles/checkmk_windows_acl/README.md
new file mode 100644
index 0000000..59f4721
--- /dev/null
+++ b/roles/checkmk_windows_acl/README.md
@@ -0,0 +1,16 @@
+# checkmk_windows_acl
+
+Normalizes access on AIM-managed persistent Windows Checkmk files without recursively
+changing Checkmk directories or unknown/operator files.
+
+The role enables parent ACL inheritance and guarantees locale-independent well-known
+principals by SID:
+
+- SYSTEM (`S-1-5-18`): FullControl
+- local Administrators (`S-1-5-32-544`): FullControl
+- ALL APPLICATION PACKAGES (`S-1-15-2-1`): ReadAndExecute
+- ALL RESTRICTED APPLICATION PACKAGES (`S-1-15-2-2`): ReadAndExecute
+
+AIM does not add customer-specific administrator/user ACEs. Existing intentional parent
+or explicit ACEs are not blindly purged. Pass persistent AIM-owned file paths through
+`checkmk_windows_acl_paths`.
diff --git a/roles/checkmk_windows_acl/defaults/main.yml b/roles/checkmk_windows_acl/defaults/main.yml
new file mode 100644
index 0000000..c3bb3e4
--- /dev/null
+++ b/roles/checkmk_windows_acl/defaults/main.yml
@@ -0,0 +1,15 @@
+---
+# Locale-independent well-known SIDs used by the native Checkmk Windows tree.
+checkmk_windows_managed_acl_entries:
+  - sid: S-1-5-18
+    rights: FullControl
+    description: SYSTEM
+  - sid: S-1-5-32-544
+    rights: FullControl
+    description: Local Administrators
+  - sid: S-1-15-2-1
+    rights: ReadAndExecute
+    description: ALL APPLICATION PACKAGES
+  - sid: S-1-15-2-2
+    rights: ReadAndExecute
+    description: ALL RESTRICTED APPLICATION PACKAGES
diff --git a/roles/checkmk_windows_acl/tasks/main.yml b/roles/checkmk_windows_acl/tasks/main.yml
new file mode 100644
index 0000000..1360ce0
--- /dev/null
+++ b/roles/checkmk_windows_acl/tasks/main.yml
@@ -0,0 +1,30 @@
+---
+- name: Windows ACL | Validate managed paths
+  ansible.builtin.assert:
+    that:
+      - checkmk_windows_acl_paths is defined
+      - checkmk_windows_acl_paths is sequence
+      - checkmk_windows_acl_paths is not string
+      - checkmk_windows_acl_paths | length > 0
+    fail_msg: checkmk_windows_acl_paths must contain one or more AIM-managed Windows files.
+    quiet: true
+
+- name: Windows ACL | Ensure managed files inherit parent permissions
+  ansible.windows.win_acl_inheritance:
+    path: '{{ item }}'
+    state: present
+    reorganize: true
+  loop: '{{ checkmk_windows_acl_paths }}'
+  loop_control:
+    label: '{{ item }}'
+
+- name: Windows ACL | Ensure Checkmk-style administrative and application access
+  ansible.windows.win_acl:
+    path: '{{ item.0 }}'
+    user: '{{ item.1.sid }}'
+    rights: '{{ item.1.rights }}'
+    type: allow
+    state: present
+  loop: '{{ checkmk_windows_acl_paths | product(checkmk_windows_managed_acl_entries) | list }}'
+  loop_control:
+    label: '{{ item.0 }} | {{ item.1.description }}'
diff --git a/roles/maintenance_export_event_logs/README.md b/roles/maintenance_export_event_logs/README.md
new file mode 100644
index 0000000..cbe81de
--- /dev/null
+++ b/roles/maintenance_export_event_logs/README.md
@@ -0,0 +1,23 @@
+# maintenance_export_event_logs
+
+Operator defaults are intentionally low-precedence; inventory and explicit run options may override them.
+
+```yaml
+---
+
+event_age_days: 45
+export_folder: C:\Logs
+event_log_channels:
+  - Application
+  - Security
+  - System
+  - Setup
+```
+
+## Structured result integration
+
+Current reporting behavior and field semantics are specified in
+[scripts/docs/OPERATION_RESULTS.md](../../scripts/docs/OPERATION_RESULTS.md).
+The calling catalog playbook owns publication; helper roles do not implicitly export
+arbitrary facts, module results or debug data. Existing defaults above retain their
+precedence. See the current validation/sanity documents before using the new candidate.
diff --git a/roles/maintenance_export_event_logs/defaults/main.yml b/roles/maintenance_export_event_logs/defaults/main.yml
new file mode 100644
index 0000000..314d203
--- /dev/null
+++ b/roles/maintenance_export_event_logs/defaults/main.yml
@@ -0,0 +1,9 @@
+---
+
+event_age_days: 45
+export_folder: C:\Logs
+event_log_channels:
+  - Application
+  - Security
+  - System
+  - Setup
diff --git a/roles/maintenance_export_event_logs/tasks/main.yml b/roles/maintenance_export_event_logs/tasks/main.yml
new file mode 100644
index 0000000..709c5d6
--- /dev/null
+++ b/roles/maintenance_export_event_logs/tasks/main.yml
@@ -0,0 +1,63 @@
+
+  - name: Event logs | Validate input
+    ansible.builtin.assert:
+      that:
+        - event_age_days | int > 0
+        - event_age_days | int <= 36500
+        - export_folder is string
+        - export_folder | length > 0
+        - event_log_channels is sequence
+        - event_log_channels is not string
+        - event_log_channels | length > 0
+      fail_msg: Supply a positive age, a target folder and at least one event channel.
+      quiet: true
+  - name: Event logs | Ensure export directory
+    ansible.windows.win_file:
+      path: '{{ export_folder }}'
+      state: directory
+  - name: Event logs | Export selected channels
+    ansible.windows.win_powershell:
+      script: |
+        [CmdletBinding(SupportsShouldProcess)]
+        param([int]$EventAgeDays, [string]$ExportFolder, [string[]]$Channels)
+        $ErrorActionPreference = 'Stop'
+        $Ansible.Changed = $false
+        $date = Get-Date -Format 'yyyy-MM-dd_HHmmss'
+        $maxAgeMs = [int64]([timespan]::FromDays($EventAgeDays).TotalMilliseconds)
+        $q = "*[System[TimeCreated[timediff(@SystemTime) <= $maxAgeMs]]]"
+        $map = @{ Application='APP'; Security='SEC'; System='SYS'; Setup='INS' }
+        $files = @()
+        foreach ($log in $Channels) {
+            $suffix = if ($map.ContainsKey($log)) { $map[$log] } else { $log -replace '[^A-Za-z0-9_.-]', '_' }
+            $filename = Join-Path $ExportFolder "$date-$suffix.evtx"
+            if ($PSCmdlet.ShouldProcess($filename, "Export $log")) {
+                & wevtutil.exe epl $log $filename "/q:$q" | Out-Null
+                if ($LASTEXITCODE -ne 0) { throw "Event export failed for channel '$log'. Exit: $LASTEXITCODE" }
+                if (-not (Test-Path -LiteralPath $filename)) { throw "Event export file is missing: $filename" }
+                $Ansible.Changed = $true
+            }
+            $files += $filename
+        }
+        $Ansible.Result = @{ files=$files; channels=$Channels; days=$EventAgeDays }
+      parameters:
+        EventAgeDays: '{{ event_age_days | int }}'
+        ExportFolder: '{{ export_folder }}'
+        Channels: '{{ event_log_channels }}'
+      error_action: stop
+    register: _aim_event_exports
+  - name: Event logs | Export summary
+    ansible.builtin.debug:
+      msg: '{{ _aim_event_exports.result }}'
+  - name: AIM | Publish operation result
+    ansible.builtin.set_stats:
+      per_host: true
+      aggregate: false
+      data:
+        aim_output:
+          protocol: aim_output_v1
+          schema: event_log_export_v1
+          data:
+            mode: "{{ 'check' if ansible_check_mode else 'apply' }}"
+            days: '{{ event_age_days | int }}'
+            channels: '{{ event_log_channels }}'
+            files: '{{ [] if ansible_check_mode else _aim_event_exports.result.files | default([]) }}'
diff --git a/roles/maintenance_patch_os/README.md b/roles/maintenance_patch_os/README.md
new file mode 100644
index 0000000..2c586a0
--- /dev/null
+++ b/roles/maintenance_patch_os/README.md
@@ -0,0 +1,48 @@
+# maintenance_patch_os
+
+Operator defaults are intentionally low-precedence; inventory and explicit run options
+may override them.
+
+```yaml
+---
+os_patching_reboot: true
+os_patching_windows_categories:
+  - SecurityUpdates
+  - CriticalUpdates
+  - UpdateRollups
+  - DefinitionUpdates
+  - Updates
+os_patching_reboot_timeout: 600
+os_patching_reboot_delay_minutes: 0
+os_patching_reboot_message: 'AIM maintenance: operating system patching requires a reboot.'
+os_patching_rescan_after_reboot: false
+```
+
+`os_patching_reboot_delay_minutes` is shared across Windows/Linux so the public setting
+has one meaning. Linux reboot scheduling is minute-granular. Windows converts the value
+to seconds; a zero-minute reboot still observes the Windows reboot module's minimum delay.
+The message is displayed by the native reboot module when AIM actually initiates a reboot.
+
+When automatic reboot is disabled, newly installed updates can legitimately leave
+`reboot_deferred: true` while the patch run itself succeeds. A later run that detects the
+already-pending reboot fails before starting new patch work and tells the operator to
+reboot manually or enable the reboot option.
+
+## Structured result integration
+
+Current reporting behavior and field semantics are specified in
+[scripts/docs/OPERATION_RESULTS.md](../../scripts/docs/OPERATION_RESULTS.md).
+Runbook-owned filters normalize only reviewed fields; arbitrary package-manager/module
+results are not exported.
+
+## Windows patch waves
+
+Windows uses the native `ansible.windows.win_updates` batch/orchestration path for the
+currently selected categories. AIM calls it with `reboot: false`, so Windows Update may
+process all updates in that current wave while AIM retains control over the reviewed reboot
+message, delay and continuation policy. AIM does not create a per-update install queue.
+
+The default `os_patching_rescan_after_reboot: false` stops the run after any AIM-performed
+reboot boundary; a new operator-approved run discovers the next wave. Set it to true only
+when the operator explicitly wants AIM to start another wave after reboot. A deferred reboot
+always stops the run.
diff --git a/roles/maintenance_patch_os/defaults/main.yml b/roles/maintenance_patch_os/defaults/main.yml
new file mode 100644
index 0000000..5be2673
--- /dev/null
+++ b/roles/maintenance_patch_os/defaults/main.yml
@@ -0,0 +1,16 @@
+---
+# Operator defaults. Existing os_patching_* variable names are intentionally retained.
+os_patching_reboot: true
+os_patching_windows_categories:
+  - SecurityUpdates
+  - CriticalUpdates
+  - UpdateRollups
+  - DefinitionUpdates
+  - Updates
+os_patching_reboot_timeout: 600
+# Cross-platform delay before an AIM-initiated reboot. Linux reboot scheduling is
+# minute-granular, so this public setting is intentionally expressed in minutes.
+os_patching_reboot_delay_minutes: 0
+os_patching_reboot_message: 'AIM maintenance: operating system patching requires a reboot.'
+# Windows only. False preserves one operator-approved patch wave per run.
+os_patching_rescan_after_reboot: false
diff --git a/roles/maintenance_patch_os/tasks/linux_debian.yml b/roles/maintenance_patch_os/tasks/linux_debian.yml
new file mode 100644
index 0000000..3e5d963
--- /dev/null
+++ b/roles/maintenance_patch_os/tasks/linux_debian.yml
@@ -0,0 +1,144 @@
+- name: Patching | Initialize Debian report state
+  ansible.builtin.set_fact:
+    _aim_patch_action_failed: false
+    _aim_patch_pre_reboot_performed: false
+    _aim_patch_post_reboot_performed: false
+
+- name: Patching | Detect pending Debian reboot before patching
+  become: true
+  ansible.builtin.stat:
+    path: /var/run/reboot-required
+  register: _aim_patch_pre_reboot_probe
+
+- name: Patching | Record pre-existing Debian reboot state
+  ansible.builtin.set_fact:
+    _aim_patch_preexisting_reboot_required: '{{ _aim_patch_pre_reboot_probe.stat.exists | default(false) | bool }}'
+
+- name: Patching | Publish blocked Debian result when reboot is deferred
+  when:
+    - _aim_patch_preexisting_reboot_required | bool
+    - not (os_patching_reboot | bool)
+  block:
+    - name: Patching | Build blocked Debian patch report
+      ansible.builtin.set_fact:
+        _aim_patch_report: >-
+          {{ 'debian' | aim_report_patch_blocked(ansible_check_mode,
+             os_patching_reboot_delay_minutes | int) }}
+    - name: AIM | Publish blocked operation result
+      ansible.builtin.set_stats:
+        per_host: true
+        aggregate: false
+        data:
+          aim_output:
+            protocol: aim_output_v1
+            schema: patch_summary_v1
+            data: '{{ _aim_patch_report }}'
+    - name: Patching | Require reboot before continuing Debian patching
+      ansible.builtin.fail:
+        msg: >-
+          A reboot is already pending from a previous update or installation. Reboot the host first,
+          or rerun with "Reboot when required" enabled. No new package upgrade was started by this run.
+
+- name: Patching | Clear pre-existing Debian reboot before patching
+  become: true
+  ansible.builtin.reboot:
+    msg: '{{ os_patching_reboot_message }}'
+    pre_reboot_delay: '{{ (os_patching_reboot_delay_minutes | int) * 60 }}'
+    reboot_timeout: '{{ os_patching_reboot_timeout | int }}'
+  register: _aim_patch_pre_reboot
+  when:
+    - _aim_patch_preexisting_reboot_required | bool
+    - os_patching_reboot | bool
+    - not ansible_check_mode
+
+- name: Patching | Record pre-patch Debian reboot
+  ansible.builtin.set_fact:
+    _aim_patch_pre_reboot_performed: '{{ _aim_patch_pre_reboot.rebooted | default(false) | bool }}'
+
+- name: Patching | Collect installed package facts before operation
+  ansible.builtin.package_facts:
+    manager: auto
+
+- name: Patching | Snapshot installed package facts before operation
+  ansible.builtin.set_fact:
+    _aim_packages_before: '{{ ansible_facts.packages | default({}) }}'
+
+- name: Patching | Apply native Debian updates
+  block:
+    - name: Update Debian-based host
+      become: true
+      ansible.builtin.apt:
+        upgrade: safe
+        update_cache: true
+        cache_valid_time: 3600
+        autoremove: true
+    - name: Check if Debian-based host requires reboot
+      become: true
+      ansible.builtin.stat:
+        path: /var/run/reboot-required
+      register: os_patching_reboot_required
+  rescue:
+    - name: Patching | Retain failed action for reporting
+      ansible.builtin.set_fact:
+        _aim_patch_action_failed: true
+
+- name: Patching | Reboot Debian host after updates when required
+  become: true
+  ansible.builtin.reboot:
+    msg: '{{ os_patching_reboot_message }}'
+    pre_reboot_delay: '{{ (os_patching_reboot_delay_minutes | int) * 60 }}'
+    reboot_timeout: '{{ os_patching_reboot_timeout | int }}'
+  register: _aim_patch_post_reboot
+  when:
+    - os_patching_reboot | bool
+    - not ansible_check_mode
+    - os_patching_reboot_required.stat.exists | default(false) | bool
+
+- name: Patching | Record post-update Debian reboot
+  ansible.builtin.set_fact:
+    _aim_patch_post_reboot_performed: '{{ _aim_patch_post_reboot.rebooted | default(false) | bool }}'
+
+- name: Patching | Collect installed package facts after operation
+  ansible.builtin.package_facts:
+    manager: auto
+
+- name: Patching | Snapshot installed package facts after operation
+  ansible.builtin.set_fact:
+    _aim_packages_after: '{{ ansible_facts.packages | default({}) }}'
+
+- name: Patching | Compare package database snapshots
+  ansible.builtin.set_fact:
+    _aim_patch_report: >-
+      {{ _aim_packages_before |
+         aim_report_patch_linux(
+           _aim_packages_after,
+           'debian',
+           ansible_check_mode,
+           not _aim_patch_action_failed,
+           os_patching_reboot_required.stat.exists | default(none),
+           (_aim_patch_pre_reboot_performed | bool) or (_aim_patch_post_reboot_performed | bool),
+           _aim_patch_preexisting_reboot_required | bool,
+           os_patching_reboot | bool,
+           os_patching_reboot_delay_minutes | int
+         ) }}
+
+- name: Patching | Package change summary
+  ansible.builtin.debug:
+    msg: '{{ _aim_patch_report }}'
+
+- name: AIM | Publish operation result
+  ansible.builtin.set_stats:
+    per_host: true
+    aggregate: false
+    data:
+      aim_output:
+        protocol: aim_output_v1
+        schema: patch_summary_v1
+        data: '{{ _aim_patch_report }}'
+
+- name: Patching | Preserve native operation failure
+  ansible.builtin.fail:
+    msg: >-
+      The native Debian patch operation failed. Available observed package changes and reboot state
+      are in the structured result. If a reboot is reported as required, reboot before retrying.
+  when: _aim_patch_action_failed | bool
diff --git a/roles/maintenance_patch_os/tasks/linux_redhat.yml b/roles/maintenance_patch_os/tasks/linux_redhat.yml
new file mode 100644
index 0000000..3ea9476
--- /dev/null
+++ b/roles/maintenance_patch_os/tasks/linux_redhat.yml
@@ -0,0 +1,167 @@
+- name: Patching | Initialize RedHat report state
+  ansible.builtin.set_fact:
+    _aim_patch_action_failed: false
+    _aim_patch_pre_reboot_performed: false
+    _aim_patch_post_reboot_performed: false
+    _aim_patch_preexisting_reboot_required: false
+
+- name: Patching | Detect existing needs-restarting command
+  ansible.builtin.command:
+    argv:
+      - /bin/sh
+      - -c
+      - command -v needs-restarting
+  register: _aim_needs_restarting_available
+  changed_when: false
+  failed_when: false
+  check_mode: false
+
+- name: Patching | Detect pending RedHat reboot before patching
+  become: true
+  ansible.builtin.command:
+    cmd: needs-restarting -r
+  register: _aim_patch_pre_reboot_probe
+  changed_when: false
+  failed_when: _aim_patch_pre_reboot_probe.rc not in [0, 1]
+  when: _aim_needs_restarting_available.rc == 0
+
+- name: Patching | Record pre-existing RedHat reboot state
+  ansible.builtin.set_fact:
+    _aim_patch_preexisting_reboot_required: >-
+      {{ (_aim_needs_restarting_available.rc == 0) and
+         (_aim_patch_pre_reboot_probe.rc | default(0) == 1) }}
+
+- name: Patching | Publish blocked RedHat result when reboot is deferred
+  when:
+    - _aim_patch_preexisting_reboot_required | bool
+    - not (os_patching_reboot | bool)
+  block:
+    - name: Patching | Build blocked RedHat patch report
+      ansible.builtin.set_fact:
+        _aim_patch_report: >-
+          {{ 'redhat' | aim_report_patch_blocked(ansible_check_mode,
+             os_patching_reboot_delay_minutes | int) }}
+    - name: AIM | Publish blocked operation result
+      ansible.builtin.set_stats:
+        per_host: true
+        aggregate: false
+        data:
+          aim_output:
+            protocol: aim_output_v1
+            schema: patch_summary_v1
+            data: '{{ _aim_patch_report }}'
+    - name: Patching | Require reboot before continuing RedHat patching
+      ansible.builtin.fail:
+        msg: >-
+          A reboot is already pending from a previous update or installation. Reboot the host first,
+          or rerun with "Reboot when required" enabled. No new package upgrade was started by this run.
+
+- name: Patching | Clear pre-existing RedHat reboot before patching
+  become: true
+  ansible.builtin.reboot:
+    msg: '{{ os_patching_reboot_message }}'
+    pre_reboot_delay: '{{ (os_patching_reboot_delay_minutes | int) * 60 }}'
+    reboot_timeout: '{{ os_patching_reboot_timeout | int }}'
+  register: _aim_patch_pre_reboot
+  when:
+    - _aim_patch_preexisting_reboot_required | bool
+    - os_patching_reboot | bool
+    - not ansible_check_mode
+
+- name: Patching | Record pre-patch RedHat reboot
+  ansible.builtin.set_fact:
+    _aim_patch_pre_reboot_performed: '{{ _aim_patch_pre_reboot.rebooted | default(false) | bool }}'
+
+- name: Patching | Collect installed package facts before operation
+  ansible.builtin.package_facts:
+    manager: auto
+
+- name: Patching | Snapshot installed package facts before operation
+  ansible.builtin.set_fact:
+    _aim_packages_before: '{{ ansible_facts.packages | default({}) }}'
+
+- name: Patching | Apply native RedHat updates
+  block:
+    - name: Update RHEL-based host
+      become: true
+      ansible.builtin.dnf:
+        name: '*'
+        state: latest
+        update_only: true
+    - name: Ensure needs-restarting binary is present (yum-utils)
+      become: true
+      ansible.builtin.dnf:
+        name: yum-utils
+        state: present
+    - name: Check if RHEL-based host requires reboot
+      become: true
+      ansible.builtin.command:
+        cmd: needs-restarting -r
+      register: os_patching_reboot_required
+      changed_when: false
+      failed_when: os_patching_reboot_required.rc not in [0, 1]
+  rescue:
+    - name: Patching | Retain failed action for reporting
+      ansible.builtin.set_fact:
+        _aim_patch_action_failed: true
+
+- name: Patching | Reboot RedHat host after updates when required
+  become: true
+  ansible.builtin.reboot:
+    msg: '{{ os_patching_reboot_message }}'
+    pre_reboot_delay: '{{ (os_patching_reboot_delay_minutes | int) * 60 }}'
+    reboot_timeout: '{{ os_patching_reboot_timeout | int }}'
+  register: _aim_patch_post_reboot
+  when:
+    - os_patching_reboot | bool
+    - not ansible_check_mode
+    - os_patching_reboot_required.rc | default(0) == 1
+
+- name: Patching | Record post-update RedHat reboot
+  ansible.builtin.set_fact:
+    _aim_patch_post_reboot_performed: '{{ _aim_patch_post_reboot.rebooted | default(false) | bool }}'
+
+- name: Patching | Collect installed package facts after operation
+  ansible.builtin.package_facts:
+    manager: auto
+
+- name: Patching | Snapshot installed package facts after operation
+  ansible.builtin.set_fact:
+    _aim_packages_after: '{{ ansible_facts.packages | default({}) }}'
+
+- name: Patching | Compare package database snapshots
+  ansible.builtin.set_fact:
+    _aim_patch_report: >-
+      {{ _aim_packages_before |
+         aim_report_patch_linux(
+           _aim_packages_after,
+           'redhat',
+           ansible_check_mode,
+           not _aim_patch_action_failed,
+           (os_patching_reboot_required.rc == 1) if os_patching_reboot_required.rc is defined else none,
+           (_aim_patch_pre_reboot_performed | bool) or (_aim_patch_post_reboot_performed | bool),
+           _aim_patch_preexisting_reboot_required | bool,
+           os_patching_reboot | bool,
+           os_patching_reboot_delay_minutes | int
+         ) }}
+
+- name: Patching | Package change summary
+  ansible.builtin.debug:
+    msg: '{{ _aim_patch_report }}'
+
+- name: AIM | Publish operation result
+  ansible.builtin.set_stats:
+    per_host: true
+    aggregate: false
+    data:
+      aim_output:
+        protocol: aim_output_v1
+        schema: patch_summary_v1
+        data: '{{ _aim_patch_report }}'
+
+- name: Patching | Preserve native operation failure
+  ansible.builtin.fail:
+    msg: >-
+      The native RedHat patch operation failed. Available observed package changes and reboot state
+      are in the structured result. If a reboot is reported as required, reboot before retrying.
+  when: _aim_patch_action_failed | bool
diff --git a/roles/maintenance_patch_os/tasks/main.yml b/roles/maintenance_patch_os/tasks/main.yml
new file mode 100644
index 0000000..cb376da
--- /dev/null
+++ b/roles/maintenance_patch_os/tasks/main.yml
@@ -0,0 +1,33 @@
+---
+
+- name: Patching | Supported platform
+  ansible.builtin.assert:
+    that:
+      - ansible_facts.os_family in ['Windows', 'Debian', 'RedHat']
+    fail_msg: 'Supported patching families: Windows, Debian, RedHat. No legacy Python bootstrap is performed.'
+    quiet: true
+- name: Patching | Validate options
+  ansible.builtin.assert:
+    that:
+      - (os_patching_reboot) is boolean or (os_patching_reboot | string | lower) in ['true', 'false']
+      - (os_patching_rescan_after_reboot) is boolean or (os_patching_rescan_after_reboot | string | lower) in ['true', 'false']
+      - os_patching_reboot_timeout | int > 0
+      - os_patching_reboot_delay_minutes | int >= 0
+      - os_patching_reboot_delay_minutes | int <= 1440
+      - os_patching_reboot_message is string
+      - os_patching_reboot_message | length > 0
+      - os_patching_reboot_message | length <= 512
+      - os_patching_windows_categories is sequence
+      - os_patching_windows_categories is not string
+      - os_patching_windows_categories | length > 0
+    fail_msg: Invalid patching settings. Reboot/rescan flags must be boolean, reboot delay must be 0-1440 minutes and the reboot message must be 1-512 characters.
+    quiet: true
+- name: Patching | Windows
+  ansible.builtin.include_tasks: windows.yml
+  when: ansible_facts.os_family == 'Windows'
+- name: Patching | Debian
+  ansible.builtin.include_tasks: linux_debian.yml
+  when: ansible_facts.os_family == 'Debian'
+- name: Patching | RedHat
+  ansible.builtin.include_tasks: linux_redhat.yml
+  when: ansible_facts.os_family == 'RedHat'
diff --git a/roles/maintenance_patch_os/tasks/windows.yml b/roles/maintenance_patch_os/tasks/windows.yml
new file mode 100644
index 0000000..9be46c5
--- /dev/null
+++ b/roles/maintenance_patch_os/tasks/windows.yml
@@ -0,0 +1,162 @@
+---
+- name: Patching | Initialize Windows report state
+  ansible.builtin.set_fact:
+    _aim_patch_action_failed: false
+    _aim_patch_pre_reboot_performed: false
+    _aim_patch_any_reboot_performed: false
+    _aim_patch_preexisting_reboot_required: false
+    _aim_patch_preexisting_reboot_reasons: []
+    _aim_patch_reboot_deferred: false
+    _aim_patch_reboot_required_after: false
+    _aim_patch_blocked_reason: null
+    _aim_patch_continuation_required: false
+    _aim_patch_remaining_updates_known: false
+    _aim_patch_done: false
+    _aim_patch_cycles: 0
+    _aim_windows_update_runs: []
+    _aim_windows_searches: []
+
+- name: Patching | Detect pending Windows reboot before patching
+  ansible.windows.win_reboot_info:
+  register: _aim_patch_pre_reboot_probe
+
+- name: Patching | Record pre-existing Windows reboot state
+  ansible.builtin.set_fact:
+    _aim_patch_preexisting_reboot_required: '{{ _aim_patch_pre_reboot_probe.reboot_required | default(false) | bool }}'
+    _aim_patch_preexisting_reboot_reasons: '{{ _aim_patch_pre_reboot_probe.reboot_required_reasons | default([]) }}'
+
+- name: Patching | Publish blocked Windows result when reboot is deferred
+  when:
+    - _aim_patch_preexisting_reboot_required | bool
+    - not (os_patching_reboot | bool)
+  block:
+    - name: Patching | Build blocked Windows patch report
+      ansible.builtin.set_fact:
+        _aim_patch_report: >-
+          {{ 'windows' | aim_report_patch_blocked(ansible_check_mode,
+             os_patching_reboot_delay_minutes | int,
+             os_patching_rescan_after_reboot | bool,
+             _aim_patch_preexisting_reboot_reasons) }}
+    - name: AIM | Publish blocked operation result
+      ansible.builtin.set_stats:
+        per_host: true
+        aggregate: false
+        data:
+          aim_output:
+            protocol: aim_output_v1
+            schema: patch_summary_v1
+            data: '{{ _aim_patch_report }}'
+    - name: Patching | Require reboot before continuing Windows patching
+      ansible.builtin.fail:
+        msg: >-
+          A reboot is already pending from a previous update or installation. Reboot the host first,
+          or rerun with "Reboot when required" enabled. No new Windows updates were started by this run.
+
+- name: Patching | Clear pre-existing Windows reboot before patching
+  ansible.windows.win_reboot:
+    msg: '{{ os_patching_reboot_message }}'
+    pre_reboot_delay: '{{ [2, (os_patching_reboot_delay_minutes | int) * 60] | max }}'
+    reboot_timeout: '{{ os_patching_reboot_timeout | int }}'
+  register: _aim_patch_pre_reboot
+  when:
+    - _aim_patch_preexisting_reboot_required | bool
+    - os_patching_reboot | bool
+    - not ansible_check_mode
+
+- name: Patching | Record pre-patch Windows reboot
+  ansible.builtin.set_fact:
+    _aim_patch_pre_reboot_performed: '{{ _aim_patch_pre_reboot.rebooted | default(false) | bool }}'
+    _aim_patch_any_reboot_performed: '{{ _aim_patch_pre_reboot.rebooted | default(false) | bool }}'
+    _aim_patch_done: >-
+      {{ (_aim_patch_pre_reboot.rebooted | default(false) | bool) and
+         not (os_patching_rescan_after_reboot | bool) }}
+    _aim_patch_continuation_required: >-
+      {{ (_aim_patch_pre_reboot.rebooted | default(false) | bool) and
+         not (os_patching_rescan_after_reboot | bool) }}
+    _aim_patch_remaining_updates_known: false
+
+- name: Patching | Search Windows updates in check mode
+  ansible.windows.win_updates:
+    category_names: '{{ os_patching_windows_categories }}'
+    state: searched
+    reboot: false
+  register: _aim_windows_check_search
+  when:
+    - ansible_check_mode
+    - not (_aim_patch_done | bool)
+
+- name: Patching | Record Windows check-mode search
+  ansible.builtin.set_fact:
+    _aim_windows_searches: '{{ [_aim_windows_check_search] }}'
+    _aim_patch_remaining_updates_known: true
+    _aim_patch_continuation_required: '{{ (_aim_windows_check_search.found_update_count | default(0) | int) > 0 }}'
+    _aim_patch_done: true
+  when:
+    - ansible_check_mode
+    - _aim_windows_check_search is defined
+    - not (_aim_windows_check_search.skipped | default(false) | bool)
+
+- name: Patching | Process Windows patch waves
+  ansible.builtin.include_tasks: windows_wave.yml
+  loop: >-
+    {{ (range(1, 13) | list) if (os_patching_rescan_after_reboot | bool) else [1] }}
+  loop_control:
+    loop_var: _aim_patch_wave_number
+    label: 'Windows patch wave {{ _aim_patch_wave_number }}'
+  when:
+    - not ansible_check_mode
+    - not (_aim_patch_done | bool)
+
+- name: Patching | Guard automatic continuation wave limit
+  ansible.builtin.set_fact:
+    _aim_patch_action_failed: true
+    _aim_patch_blocked_reason: cycle_limit_reached
+    _aim_patch_continuation_required: true
+  when:
+    - not ansible_check_mode
+    - os_patching_rescan_after_reboot | bool
+    - not (_aim_patch_done | bool)
+
+- name: Patching | Normalize Windows update results
+  ansible.builtin.set_fact:
+    _aim_patch_report: >-
+      {{ _aim_windows_update_runs |
+         aim_report_patch_windows_runs(
+           _aim_windows_searches,
+           ansible_check_mode,
+           _aim_patch_preexisting_reboot_required | bool,
+           _aim_patch_any_reboot_performed | bool,
+           os_patching_reboot | bool,
+           os_patching_reboot_delay_minutes | int,
+           os_patching_rescan_after_reboot | bool,
+           _aim_patch_cycles | int,
+           _aim_patch_continuation_required | bool,
+           _aim_patch_remaining_updates_known | bool,
+           _aim_patch_reboot_deferred | bool,
+           _aim_patch_reboot_required_after,
+           _aim_patch_blocked_reason,
+           not (_aim_patch_action_failed | bool),
+           _aim_patch_preexisting_reboot_reasons
+         ) }}
+
+- name: Patching | Update summary
+  ansible.builtin.debug:
+    msg: '{{ _aim_patch_report }}'
+
+- name: AIM | Publish operation result
+  ansible.builtin.set_stats:
+    per_host: true
+    aggregate: false
+    data:
+      aim_output:
+        protocol: aim_output_v1
+        schema: patch_summary_v1
+        data: '{{ _aim_patch_report }}'
+
+- name: Patching | Preserve Windows update failure
+  ansible.builtin.fail:
+    msg: >-
+      Windows patching stopped before the approved patch wave completed. The structured result contains
+      successfully installed updates, bounded failed-update reasons when available, and whether another
+      operator-approved run is required. AIM did not replay the patch job automatically.
+  when: _aim_patch_action_failed | bool
diff --git a/roles/maintenance_patch_os/tasks/windows_cycle.yml b/roles/maintenance_patch_os/tasks/windows_cycle.yml
new file mode 100644
index 0000000..87a544a
--- /dev/null
+++ b/roles/maintenance_patch_os/tasks/windows_cycle.yml
@@ -0,0 +1,114 @@
+---
+- name: Patching | Start Windows patch cycle
+  ansible.builtin.set_fact:
+    _aim_patch_cycles: '{{ _aim_patch_cycle_number | int }}'
+    _aim_patch_cycle_stop: false
+    _aim_patch_cycle_reboot_performed: false
+
+- name: Patching | Search available Windows updates for this wave
+  ansible.windows.win_updates:
+    category_names: '{{ os_patching_windows_categories }}'
+    state: searched
+    reboot: false
+  register: _aim_windows_cycle_search
+
+- name: Patching | Record Windows update discovery
+  ansible.builtin.set_fact:
+    _aim_windows_searches: '{{ _aim_windows_searches + [_aim_windows_cycle_search] }}'
+    _aim_windows_update_queue: '{{ _aim_windows_cycle_search | aim_windows_update_queue }}'
+
+- name: Patching | Reboot when discovery itself reports a required reboot
+  ansible.windows.win_reboot:
+    msg: '{{ os_patching_reboot_message }}'
+    pre_reboot_delay: '{{ [2, (os_patching_reboot_delay_minutes | int) * 60] | max }}'
+    reboot_timeout: '{{ os_patching_reboot_timeout | int }}'
+  register: _aim_windows_search_reboot
+  when:
+    - _aim_windows_cycle_search.reboot_required | default(false) | bool
+    - os_patching_reboot | bool
+
+- name: Patching | Record discovery-time reboot boundary
+  ansible.builtin.set_fact:
+    _aim_patch_cycle_stop: true
+    _aim_patch_cycle_reboot_performed: '{{ _aim_windows_search_reboot.rebooted | default(false) | bool }}'
+    _aim_patch_any_reboot_performed: >-
+      {{ (_aim_patch_any_reboot_performed | bool) or
+         (_aim_windows_search_reboot.rebooted | default(false) | bool) }}
+    _aim_patch_reboot_required_after: >-
+      {{ false if (_aim_windows_search_reboot.rebooted | default(false) | bool) else true }}
+  when:
+    - _aim_windows_search_reboot is defined
+    - not (_aim_windows_search_reboot.skipped | default(false) | bool)
+
+- name: Patching | Defer discovery-time required reboot
+  ansible.builtin.set_fact:
+    _aim_patch_cycle_stop: true
+    _aim_patch_done: true
+    _aim_patch_reboot_deferred: true
+    _aim_patch_reboot_required_after: true
+    _aim_patch_continuation_required: true
+    _aim_patch_remaining_updates_known: true
+  when:
+    - _aim_windows_cycle_search.reboot_required | default(false) | bool
+    - not (os_patching_reboot | bool)
+
+- name: Patching | Finish when no updates are available
+  ansible.builtin.set_fact:
+    _aim_patch_done: true
+    _aim_patch_remaining_updates_known: true
+    _aim_patch_continuation_required: '{{ _aim_windows_cycle_search.reboot_required | default(false) | bool }}'
+    _aim_patch_reboot_required_after: '{{ _aim_windows_cycle_search.reboot_required | default(false) | bool }}'
+  when:
+    - (_aim_windows_update_queue | length) == 0
+    - not (_aim_patch_cycle_stop | bool)
+
+- name: Patching | Install discovered Windows updates sequentially
+  ansible.builtin.include_tasks: windows_update_one.yml
+  loop: '{{ _aim_windows_update_queue }}'
+  loop_control:
+    loop_var: _aim_windows_update
+    label: '{{ _aim_windows_update.title }}'
+  when:
+    - not (_aim_patch_done | bool)
+    - not (_aim_patch_cycle_stop | bool)
+
+- name: Patching | Final read-only discovery after completed non-reboot wave
+  ansible.windows.win_updates:
+    category_names: '{{ os_patching_windows_categories }}'
+    state: searched
+    reboot: false
+  register: _aim_windows_cycle_final_search
+  when:
+    - not (_aim_patch_done | bool)
+    - not (_aim_patch_cycle_stop | bool)
+    - not (_aim_patch_action_failed | bool)
+
+- name: Patching | Record final non-reboot wave state
+  ansible.builtin.set_fact:
+    _aim_windows_searches: '{{ _aim_windows_searches + [_aim_windows_cycle_final_search] }}'
+    _aim_patch_remaining_updates_known: true
+    _aim_patch_continuation_required: '{{ (_aim_windows_cycle_final_search.found_update_count | default(0) | int) > 0 }}'
+    _aim_patch_reboot_required_after: '{{ _aim_windows_cycle_final_search.reboot_required | default(false) | bool }}'
+    _aim_patch_done: true
+  when:
+    - _aim_windows_cycle_final_search is defined
+    - not (_aim_windows_cycle_final_search.skipped | default(false) | bool)
+
+- name: Patching | Stop after operator-approved reboot boundary by default
+  ansible.builtin.set_fact:
+    _aim_patch_done: true
+    _aim_patch_continuation_required: true
+    _aim_patch_remaining_updates_known: false
+  when:
+    - _aim_patch_cycle_reboot_performed | bool
+    - not (os_patching_rescan_after_reboot | bool)
+
+- name: Patching | Continue only when post-reboot rescan was explicitly enabled
+  ansible.builtin.debug:
+    msg: >-
+      AIM completed a reboot boundary and will start another Windows patch cycle because
+      os_patching_rescan_after_reboot is explicitly enabled.
+  when:
+    - _aim_patch_cycle_reboot_performed | bool
+    - os_patching_rescan_after_reboot | bool
+    - not (_aim_patch_action_failed | bool)
diff --git a/roles/maintenance_patch_os/tasks/windows_update_one.yml b/roles/maintenance_patch_os/tasks/windows_update_one.yml
new file mode 100644
index 0000000..44676c8
--- /dev/null
+++ b/roles/maintenance_patch_os/tasks/windows_update_one.yml
@@ -0,0 +1,87 @@
+---
+- name: Patching | Initialize single Windows update result
+  ansible.builtin.set_fact:
+    _aim_windows_single_result: {}
+    _aim_windows_single_task_failed: false
+
+- name: Patching | Install one Windows update
+  block:
+    - name: 'Patching | Install {{ _aim_windows_update.title }}'
+      ansible.windows.win_updates:
+        category_names: '{{ os_patching_windows_categories }}'
+        state: installed
+        reboot: false
+        accept_list:
+          - '{{ _aim_windows_update.selector }}'
+      register: _aim_windows_single_result
+  rescue:
+    - name: Patching | Retain failed single-update result
+      ansible.builtin.set_fact:
+        _aim_windows_single_result: '{{ ansible_failed_result | default({}) }}'
+        _aim_windows_single_task_failed: true
+
+- name: Patching | Append single-update evidence
+  ansible.builtin.set_fact:
+    _aim_windows_update_runs: >-
+      {{ _aim_windows_update_runs + [
+           {
+             'requested': _aim_windows_update,
+             'result': _aim_windows_single_result,
+             'task_failed': _aim_windows_single_task_failed | bool
+           }
+         ] }}
+
+- name: Patching | Classify single-update execution state
+  ansible.builtin.set_fact:
+    _aim_windows_single_failed: >-
+      {{ (_aim_windows_single_task_failed | bool) or
+         (_aim_windows_single_result | aim_windows_update_result_failed) }}
+    _aim_patch_reboot_required_after: '{{ _aim_windows_single_result.reboot_required | default(false) | bool }}'
+
+- name: Patching | Stop this patch wave after an update failure
+  ansible.builtin.set_fact:
+    _aim_patch_action_failed: true
+    _aim_patch_cycle_stop: true
+    _aim_patch_done: true
+    _aim_patch_continuation_required: true
+    _aim_patch_remaining_updates_known: false
+    _aim_patch_blocked_reason: '{{ _aim_windows_single_result | aim_windows_update_block_reason }}'
+  when: _aim_windows_single_failed | bool
+
+- name: Patching | Reboot Windows at a sequential update boundary
+  ansible.windows.win_reboot:
+    msg: '{{ os_patching_reboot_message }}'
+    pre_reboot_delay: '{{ [2, (os_patching_reboot_delay_minutes | int) * 60] | max }}'
+    reboot_timeout: '{{ os_patching_reboot_timeout | int }}'
+  register: _aim_windows_single_reboot
+  when:
+    - not (_aim_windows_single_failed | bool)
+    - _aim_windows_single_result.reboot_required | default(false) | bool
+    - os_patching_reboot | bool
+
+- name: Patching | Record completed sequential reboot boundary
+  ansible.builtin.set_fact:
+    _aim_patch_cycle_stop: true
+    _aim_patch_cycle_reboot_performed: '{{ _aim_windows_single_reboot.rebooted | default(false) | bool }}'
+    _aim_patch_any_reboot_performed: >-
+      {{ (_aim_patch_any_reboot_performed | bool) or
+         (_aim_windows_single_reboot.rebooted | default(false) | bool) }}
+    _aim_patch_reboot_required_after: >-
+      {{ false if (_aim_windows_single_reboot.rebooted | default(false) | bool)
+         else (_aim_windows_single_result.reboot_required | default(false) | bool) }}
+  when:
+    - _aim_windows_single_reboot is defined
+    - not (_aim_windows_single_reboot.skipped | default(false) | bool)
+
+- name: Patching | Defer required reboot and stop the current patch wave
+  ansible.builtin.set_fact:
+    _aim_patch_cycle_stop: true
+    _aim_patch_done: true
+    _aim_patch_reboot_deferred: true
+    _aim_patch_reboot_required_after: true
+    _aim_patch_continuation_required: true
+    _aim_patch_remaining_updates_known: false
+  when:
+    - not (_aim_windows_single_failed | bool)
+    - _aim_windows_single_result.reboot_required | default(false) | bool
+    - not (os_patching_reboot | bool)
diff --git a/roles/maintenance_patch_os/tasks/windows_wave.yml b/roles/maintenance_patch_os/tasks/windows_wave.yml
new file mode 100644
index 0000000..aafdff3
--- /dev/null
+++ b/roles/maintenance_patch_os/tasks/windows_wave.yml
@@ -0,0 +1,124 @@
+---
+- name: Patching | Start Windows patch wave
+  ansible.builtin.set_fact:
+    _aim_patch_cycles: '{{ _aim_patch_wave_number | int }}'
+    _aim_patch_wave_task_failed: false
+    _aim_patch_wave_result: {}
+    _aim_patch_wave_failed: false
+    _aim_patch_wave_reboot_performed: false
+
+- name: Patching | Install current Windows update wave
+  block:
+    - name: Patching | Install all currently selected Windows updates
+      ansible.windows.win_updates:
+        category_names: '{{ os_patching_windows_categories }}'
+        state: installed
+        reboot: false
+      register: _aim_patch_wave_result
+  rescue:
+    - name: Patching | Retain failed Windows update wave result
+      ansible.builtin.set_fact:
+        _aim_patch_wave_result: '{{ ansible_failed_result | default({}) }}'
+        _aim_patch_wave_task_failed: true
+
+- name: Patching | Append Windows update wave evidence
+  ansible.builtin.set_fact:
+    _aim_windows_update_runs: >-
+      {{ _aim_windows_update_runs + [
+           {
+             'result': _aim_patch_wave_result,
+             'task_failed': _aim_patch_wave_task_failed | bool,
+             'wave': _aim_patch_wave_number | int
+           }
+         ] }}
+
+- name: Patching | Classify Windows update wave
+  ansible.builtin.set_fact:
+    _aim_patch_wave_failed: >-
+      {{ (_aim_patch_wave_task_failed | bool) or
+         (_aim_patch_wave_result | aim_windows_update_result_failed) }}
+    _aim_patch_reboot_required_after: '{{ _aim_patch_wave_result.reboot_required | default(false) | bool }}'
+
+- name: Patching | Record Windows update wave failure
+  ansible.builtin.set_fact:
+    _aim_patch_action_failed: true
+    _aim_patch_done: true
+    _aim_patch_continuation_required: true
+    _aim_patch_remaining_updates_known: false
+    _aim_patch_blocked_reason: '{{ _aim_patch_wave_result | aim_windows_update_block_reason }}'
+  when: _aim_patch_wave_failed | bool
+
+- name: Patching | Reboot after the completed Windows update wave
+  ansible.windows.win_reboot:
+    msg: '{{ os_patching_reboot_message }}'
+    pre_reboot_delay: '{{ [2, (os_patching_reboot_delay_minutes | int) * 60] | max }}'
+    reboot_timeout: '{{ os_patching_reboot_timeout | int }}'
+  register: _aim_patch_wave_reboot
+  when:
+    - _aim_patch_wave_result.reboot_required | default(false) | bool
+    - os_patching_reboot | bool
+
+- name: Patching | Record completed Windows wave reboot boundary
+  ansible.builtin.set_fact:
+    _aim_patch_wave_reboot_performed: '{{ _aim_patch_wave_reboot.rebooted | default(false) | bool }}'
+    _aim_patch_any_reboot_performed: >-
+      {{ (_aim_patch_any_reboot_performed | bool) or
+         (_aim_patch_wave_reboot.rebooted | default(false) | bool) }}
+    _aim_patch_reboot_required_after: >-
+      {{ false if (_aim_patch_wave_reboot.rebooted | default(false) | bool)
+         else (_aim_patch_wave_result.reboot_required | default(false) | bool) }}
+  when:
+    - _aim_patch_wave_reboot is defined
+    - not (_aim_patch_wave_reboot.skipped | default(false) | bool)
+
+- name: Patching | Defer required reboot after Windows update wave
+  ansible.builtin.set_fact:
+    _aim_patch_done: true
+    _aim_patch_reboot_deferred: true
+    _aim_patch_reboot_required_after: true
+    _aim_patch_continuation_required: true
+    _aim_patch_remaining_updates_known: false
+  when:
+    - not (_aim_patch_wave_failed | bool)
+    - _aim_patch_wave_result.reboot_required | default(false) | bool
+    - not (os_patching_reboot | bool)
+
+- name: Patching | Stop after approved Windows reboot boundary by default
+  ansible.builtin.set_fact:
+    _aim_patch_done: true
+    _aim_patch_continuation_required: true
+    _aim_patch_remaining_updates_known: false
+  when:
+    - _aim_patch_wave_reboot_performed | bool
+    - not (os_patching_rescan_after_reboot | bool)
+
+- name: Patching | Stop automatic continuation after a failed Windows wave
+  ansible.builtin.set_fact:
+    _aim_patch_done: true
+    _aim_patch_continuation_required: true
+    _aim_patch_remaining_updates_known: false
+  when:
+    - _aim_patch_wave_failed | bool
+
+- name: Patching | Final read-only discovery after completed non-reboot Windows wave
+  ansible.windows.win_updates:
+    category_names: '{{ os_patching_windows_categories }}'
+    state: searched
+    reboot: false
+  register: _aim_windows_wave_final_search
+  when:
+    - not (_aim_patch_done | bool)
+    - not (_aim_patch_wave_reboot_performed | bool)
+    - not (_aim_patch_wave_result.reboot_required | default(false) | bool)
+    - not (_aim_patch_wave_failed | bool)
+
+- name: Patching | Record completed non-reboot Windows wave state
+  ansible.builtin.set_fact:
+    _aim_windows_searches: '{{ _aim_windows_searches + [_aim_windows_wave_final_search] }}'
+    _aim_patch_remaining_updates_known: true
+    _aim_patch_continuation_required: '{{ (_aim_windows_wave_final_search.found_update_count | default(0) | int) > 0 }}'
+    _aim_patch_reboot_required_after: '{{ _aim_windows_wave_final_search.reboot_required | default(false) | bool }}'
+    _aim_patch_done: true
+  when:
+    - _aim_windows_wave_final_search is defined
+    - not (_aim_windows_wave_final_search.skipped | default(false) | bool)
diff --git a/roles/maintenance_reboot_hosts/README.md b/roles/maintenance_reboot_hosts/README.md
new file mode 100644
index 0000000..86284d7
--- /dev/null
+++ b/roles/maintenance_reboot_hosts/README.md
@@ -0,0 +1,12 @@
+# maintenance_reboot_hosts
+
+Operator defaults are intentionally low-precedence; inventory and explicit run options may override them.
+
+```yaml
+---
+
+maintenance_reboot_timeout: 1800
+maintenance_reboot_message: Reboot initiated by debsansible01.bfmiglabor.lan (Ansible)
+maintenance_reboot_pre_delay: 0
+maintenance_reboot_post_delay: 15
+```
diff --git a/roles/maintenance_reboot_hosts/defaults/main.yml b/roles/maintenance_reboot_hosts/defaults/main.yml
new file mode 100644
index 0000000..4438a45
--- /dev/null
+++ b/roles/maintenance_reboot_hosts/defaults/main.yml
@@ -0,0 +1,6 @@
+---
+
+maintenance_reboot_timeout: 1800
+maintenance_reboot_message: Reboot initiated by debsansible01.bfmiglabor.lan (Ansible)
+maintenance_reboot_pre_delay: 0
+maintenance_reboot_post_delay: 15
diff --git a/roles/maintenance_reboot_hosts/tasks/main.yml b/roles/maintenance_reboot_hosts/tasks/main.yml
new file mode 100644
index 0000000..1caff95
--- /dev/null
+++ b/roles/maintenance_reboot_hosts/tasks/main.yml
@@ -0,0 +1,26 @@
+---
+
+- name: Reboot | Validate timing
+  ansible.builtin.assert:
+    that:
+      - maintenance_reboot_timeout | int > 0
+      - maintenance_reboot_pre_delay | int >= 0
+      - maintenance_reboot_post_delay | int >= 0
+    fail_msg: Reboot timeout must be positive; delays must be non-negative.
+    quiet: true
+- name: Reboot | linux
+  ansible.builtin.reboot:
+    msg: '{{ maintenance_reboot_message }}'
+    reboot_timeout: '{{ maintenance_reboot_timeout | int }}'
+    pre_reboot_delay: '{{ maintenance_reboot_pre_delay | int }}'
+    post_reboot_delay: '{{ maintenance_reboot_post_delay | int }}'
+    test_command: whoami
+  when: '''linux'' in group_names'
+- name: Reboot | windows
+  ansible.windows.win_reboot:
+    msg: '{{ maintenance_reboot_message }}'
+    reboot_timeout: '{{ maintenance_reboot_timeout | int }}'
+    pre_reboot_delay: '{{ [maintenance_reboot_pre_delay | int, 2] | max }}'
+    post_reboot_delay: '{{ maintenance_reboot_post_delay | int }}'
+    connect_timeout: 30
+  when: '''windows'' in group_names'
diff --git a/roles/maintenance_start_stopped_services/README.md b/roles/maintenance_start_stopped_services/README.md
new file mode 100644
index 0000000..af0c9b8
--- /dev/null
+++ b/roles/maintenance_start_stopped_services/README.md
@@ -0,0 +1,19 @@
+# maintenance_start_stopped_services
+
+Operator defaults are intentionally low-precedence; inventory and explicit run options may override them.
+
+```yaml
+---
+
+maintenance_service_include: []
+maintenance_service_exclude: []
+maintenance_service_fail_on_error: true
+```
+
+## Structured result integration
+
+Current reporting behavior and field semantics are specified in
+[scripts/docs/OPERATION_RESULTS.md](../../scripts/docs/OPERATION_RESULTS.md).
+The calling catalog playbook owns publication; helper roles do not implicitly export
+arbitrary facts, module results or debug data. Existing defaults above retain their
+precedence. See the current validation/sanity documents before using the new candidate.
diff --git a/roles/maintenance_start_stopped_services/defaults/main.yml b/roles/maintenance_start_stopped_services/defaults/main.yml
new file mode 100644
index 0000000..489b194
--- /dev/null
+++ b/roles/maintenance_start_stopped_services/defaults/main.yml
@@ -0,0 +1,5 @@
+---
+
+maintenance_service_include: []
+maintenance_service_exclude: []
+maintenance_service_fail_on_error: true
diff --git a/roles/maintenance_start_stopped_services/tasks/main.yml b/roles/maintenance_start_stopped_services/tasks/main.yml
new file mode 100644
index 0000000..31885f9
--- /dev/null
+++ b/roles/maintenance_start_stopped_services/tasks/main.yml
@@ -0,0 +1,55 @@
+  - name: Services | Validate selections
+    ansible.builtin.assert:
+      that:
+        - maintenance_service_include is sequence
+        - maintenance_service_include is not string
+        - maintenance_service_exclude is sequence
+        - maintenance_service_exclude is not string
+        - (maintenance_service_fail_on_error) is boolean or (maintenance_service_fail_on_error | string | 
+          lower) in ['true', 'false']
+      fail_msg: Service selections must be lists of internal names; failure policy must be boolean.
+      quiet: true
+  - name: Services | Read current state
+    ansible.windows.win_service_info: {}
+    register: _aim_services
+  - name: Services | Start eligible stopped services
+    ansible.windows.win_service:
+      name: '{{ item.name }}'
+      state: started
+    loop: '{{ _aim_services.services }}'
+    loop_control:
+      label: '{{ item.name }}'
+    when:
+      - item.state == 'stopped'
+      - item.start_mode in ['auto', 'delayed']
+      - maintenance_service_include | length == 0 or item.name in maintenance_service_include
+      - item.name not in maintenance_service_exclude
+    register: _aim_service_starts
+    ignore_errors: true
+  - name: Services | Observe states after start attempts
+    ansible.windows.win_service_info: {}
+    register: _aim_services_after
+  - name: Services | Build before and after report
+    ansible.builtin.set_fact:
+      _aim_service_report: '{{ _aim_services.services | aim_report_services(_aim_service_starts.results | default([]),
+        _aim_services_after.services, maintenance_service_include, maintenance_service_exclude, ansible_check_mode)
+        }}'
+  - name: Services | Summary
+    ansible.builtin.debug:
+      msg: '{{ _aim_service_report }}'
+  - name: AIM | Publish operation result
+    ansible.builtin.set_stats:
+      per_host: true
+      aggregate: false
+      data:
+        aim_output:
+          protocol: aim_output_v1
+          schema: service_start_summary_v1
+          data: '{{ _aim_service_report }}'
+  - name: Services | Report partial failure
+    ansible.builtin.fail:
+      msg: One or more attempted services are not running. See failed_to_start in the structured report.
+    when:
+      - maintenance_service_fail_on_error | bool
+      - _aim_service_report.failed_count | int > 0
+      - not ansible_check_mode
diff --git a/roles/pfsense_apply_baseline/README.md b/roles/pfsense_apply_baseline/README.md
new file mode 100644
index 0000000..e92b90e
--- /dev/null
+++ b/roles/pfsense_apply_baseline/README.md
@@ -0,0 +1,3 @@
+# pfsense_apply_baseline
+
+Policy-preserving extraction from the uploaded production playbooks. Arguments, conditions, operation order, rule names and values were not changed. Invoke through the matching playbook.
diff --git a/roles/pfsense_apply_baseline/tasks/main.yml b/roles/pfsense_apply_baseline/tasks/main.yml
new file mode 100644
index 0000000..66fa555
--- /dev/null
+++ b/roles/pfsense_apply_baseline/tasks/main.yml
@@ -0,0 +1,153 @@
+---
+# Policy-preserving extraction from configure_pfsense_initial.yml. Do not change rule values without separate approval.
+- name: Check current bell state
+  ansible.builtin.raw: sysctl -n hw.syscons.bell
+  register: bell_state
+  changed_when: false
+- name: Disable startup/shutdown beep
+  ansible.builtin.raw: sysctl hw.syscons.bell=0
+  when: bell_state.stdout.strip() == "1"
+  changed_when: true
+- name: Create alias bf_wan_extern
+  pfsensible.core.pfsense_alias:
+    name: bf_wan_extern
+    descr: bitformer WAN IP Adressen
+    address: 217.13.70.132 87.138.207.238 80.152.155.27 217.13.174.202
+    type: host
+    state: present
+- name: Create alias bf_wartung
+  pfsensible.core.pfsense_alias:
+    name: bf_wartung
+    descr: bitformer Wartungs-IP
+    address: 10.240.0.1
+    type: host
+    state: present
+- name: Create alias rfc_1918_5735
+  pfsensible.core.pfsense_alias:
+    name: rfc_1918_5735
+    descr: RFC1918, RFC5735 (private IPs)
+    address: 10.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.168.0.0/16
+    type: network
+    state: present
+- name: 'Add NAT outbound traffic rule (Port: 500)'
+  pfsensible.core.pfsense_nat_outbound:
+    descr: 'Outbound NAT for private IP space (Port: 500)'
+    interface: wan
+    address: null
+    source: rfc_1918_5735
+    destination: any:500
+    staticnatport: true
+    state: present
+- name: Add NAT outbound traffic rule
+  pfsensible.core.pfsense_nat_outbound:
+    descr: Outbound NAT for private IP space
+    interface: wan
+    address: null
+    source: rfc_1918_5735
+    destination: any
+    state: present
+- name: 'Add firewall rule: Allow Ping'
+  pfsensible.core.pfsense_rule:
+    name: Allow Ping
+    action: pass
+    interface: wan
+    ipprotocol: inet
+    protocol: icmp
+    icmptype: echoreq
+    source: any
+    destination: IP:wan
+    log: true
+    state: present
+- name: 'Add firewall rule: Allow Webinterface access'
+  pfsensible.core.pfsense_rule:
+    name: bitformer Webinterface access rule
+    action: pass
+    interface: wan
+    ipprotocol: inet
+    protocol: tcp
+    destination_port: 443
+    source: bf_wan_extern
+    destination: IP:wan
+    log: true
+    state: present
+- name: Create Anti-Lockout ports alias
+  pfsensible.core.pfsense_alias:
+    name: anti_lockout_ports
+    type: port
+    address: 22 80 443
+    descr: Ports for Anti-Lockout access
+- name: Add custom Anti-Lockout Rule
+  pfsensible.core.pfsense_rule:
+    name: Custom Anti-Lockout Rule
+    action: pass
+    interface: wan
+    ipprotocol: inet
+    protocol: tcp
+    destination_port: anti_lockout_ports
+    source: any
+    destination: IP:wan
+    log: true
+    state: present
+- name: Add bitconnect VPN CA 2021
+  pfsensible.core.pfsense_ca:
+    name: bitconnect VPN CA 2021
+    certificate: |
+      -----BEGIN CERTIFICATE-----
+      MIIFbDCCA1SgAwIBAgIUWV573JfAztSareWb4jnkNIdlEt8wDQYJKoZIhvcNAQEL
+      BQAwITEfMB0GA1UEAwwWYml0Y29ubmVjdCBWUE4gQ0EgMjAyMTAeFw0yMTEwMDgx
+      NjA1MzNaFw0zMTEwMDYxNjA1MzNaMCExHzAdBgNVBAMMFmJpdGNvbm5lY3QgVlBO
+      IENBIDIwMjEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDjjoWk81zG
+      vmdKCICW27cnQV6kmDwwXezC7cdmk8nVKnlcJAnVPExYV1M1wa9OYDgjb+Jc7vEV
+      UKKc7h/JtWt5OSg7aLq5eh6ZZminYG+lrKC7CFhyPnKuLPW4D6ye6iTVpwlhMMbv
+      fCiinuA2shniQtX21QYc8jxKdJnmfgv7/JJ0BxnWCyE8yn1xy6DyjPH9ystzKFGO
+      C3HH2wH2+sgKuiyk+8yxEF3hktMIDZ/D1gTyw8wsL4PgOs78EBSf0UKjAaBBjem8
+      rICxBo4yh7YvVJ+MMLc+2IMcyM3wpYPbMpA/0hXoWsAeYEOvrZR+MYQ08cQw8QEk
+      MHetIjbksd9D1OSdMfghr+A+dxVpQWTOnUnG48L84E/6RD0STyz/uJjNDJ5Qn4uV
+      8e6ELHbbPiWVQWw+kg8tVetH6+WELXf/7pUnV9uYr7DvijEROP6l1IX/r92qC270
+      /QFiadYX0lroqaWdwk5z7DFnVVcCHqchygS97exzDg68LkSJ5pOZ6spIr9WfaGxD
+      3dva4ekC/HEZUdau+NnBPnOCLD6EqOnh3RAJosgX6/eb5LHhk5agruM+1PZcWPiL
+      5D0HvNjKOCGXW2yVd1fAdOy0onP4OQHK3gJPNFJ9m/LXnn5+CHvYct+3qDlxZcCR
+      qH9QBE7kC/8pRmHZqC1g0rn8yiQ012eCpwIDAQABo4GbMIGYMB0GA1UdDgQWBBQ4
+      pYw9Df2Ln2pUE/xRDjhebugWpTBcBgNVHSMEVTBTgBQ4pYw9Df2Ln2pUE/xRDjhe
+      bugWpaElpCMwITEfMB0GA1UEAwwWYml0Y29ubmVjdCBWUE4gQ0EgMjAyMYIUWV57
+      3JfAztSareWb4jnkNIdlEt8wDAYDVR0TBAUwAwEB/zALBgNVHQ8EBAMCAQYwDQYJ
+      KoZIhvcNAQELBQADggIBAN1OOdv5rDgtBhYnmnId4iifvjzKQEQF5go4cJDueUo4
+      86u6xJrv83sC53FKxaAcNZUxJEcFFBHKlCUTNADsKDdQxIPA2Ow6goIx914VbFO/
+      OmkFWS+53o4V8zRrwTxJi3Ps0R3sgp3pok5fQNL30tMZIf1Ug05jOqSCT8GBzIS8
+      wwSw6aNi/Zcs9sBuaEEap47faTowk53EJykUd8htzH/3E5ioi3hE8TsZYPKb4Frk
+      mMqRbX6N78fZ0xOIewh58S4eeGlRCGlRs45ciVxuryTaloFfDDBFFBR3V4q4Y/y9
+      dvjiRmDs4fod1ZGEFUfVyDPXjzWCUUQiMHxUoh9s06i5zO3YCB/mkh+11ohyE109
+      ciN495vhpTONQ8GzXLc87GjVUow7btn3lfaMf1sTfLhAueHNNbDHTnhRFkUtrdCx
+      73+MYpiSlLpBxnyLkTM4umYXeYNN5Od0UjYZZqlLK9MNZrM5CwVxjRxJjgV6Nbap
+      4Apnfqi+d3Ulnc6Zk8w0tiVcRfrLR6EVA3JEHqFQLuXbU1+K8C0N9YNFHy2iGAxF
+      Ysx7aJVvmzyoiB06/qQrHcjeizVJaqR7w6+1cuTKo+fdvp2KtyK8+pFtQt4n+unw
+      3eLC1NdcEyWBtlKqG6sjSXCBCgc1z2wAOfR+sQsH64uVHqxND4rPo8X4uo28Jgv9
+      -----END CERTIFICATE-----
+    state: present
+- name: Add bitconnect VPN-Client
+  pfsensible.core.pfsense_openvpn_client:
+    name: bitformer Wartungs-VPN
+    ca: bitconnect VPN CA 2021
+    cert: bf-customers-vpn01
+    create_gw: both
+    data_ciphers:
+      - AES-256-GCM
+      - AES-256-CBC
+      - AES-128-GCM
+      - CHACHA20-POLY1305
+    data_ciphers_fallback: AES-256-CBC
+    dev_mode: tun
+    digest: SHA384
+    interface: any
+    mode: p2p_tls
+    protocol: UDP4
+    server_addr: vpngw01.bitformer.net
+    server_port: 42030
+    state: present
+- name: Print left over manual settings to configure
+  ansible.builtin.debug:
+    msg:
+      - 'Manuelle Einstellungen müssen vorgenommen werden:'
+      - 'Firewall Max Table Entries: 500000'
+      - Disable startup/shutdown beep
+      - Password protect the console
diff --git a/roles/pfsense_install_prerequisites/README.md b/roles/pfsense_install_prerequisites/README.md
new file mode 100644
index 0000000..6719746
--- /dev/null
+++ b/roles/pfsense_install_prerequisites/README.md
@@ -0,0 +1,3 @@
+# pfsense_install_prerequisites
+
+Policy-preserving extraction from the uploaded production playbooks. Arguments, conditions, operation order, rule names and values were not changed. Invoke through the matching playbook.
diff --git a/roles/pfsense_install_prerequisites/tasks/main.yml b/roles/pfsense_install_prerequisites/tasks/main.yml
new file mode 100644
index 0000000..028b897
--- /dev/null
+++ b/roles/pfsense_install_prerequisites/tasks/main.yml
@@ -0,0 +1,7 @@
+---
+# Policy-preserving extraction from configure_pfsense_initial.yml. Do not change rule values without separate approval.
+- name: Install package
+  ansible.builtin.package:
+    name:
+      - pfSense-pkg-sudo
+    state: present
diff --git a/roles/server_role_selection/defaults/main.yml b/roles/server_role_selection/defaults/main.yml
deleted file mode 100644
index 0dbd25c..0000000
--- a/roles/server_role_selection/defaults/main.yml
+++ /dev/null
@@ -1,12 +0,0 @@
----
-ad_ds_feature_name: "AD-Domain-Services"
-dhcp_windows_service_name: "DHCPServer"
-veeam_services:
-  vbr: "VeeamBackupSvc"
-  vbo: "Veeam.Archiver.Service"
-  em: "VeeamEnterpriseManagerSvc"
-unifi_linux_services:
-  - unifi
-  - unifi.service
-unifi_linux_packages:
-  - unifi
diff --git a/roles/server_role_selection/meta/main.yml b/roles/server_role_selection/meta/main.yml
deleted file mode 100644
index c5d1af7..0000000
--- a/roles/server_role_selection/meta/main.yml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-galaxy_info:
-  role_name: server_role_selection
-  description: Detect server roles used for Checkmk deployment decisions
-  min_ansible_version: "2.18"
-dependencies: []
diff --git a/roles/server_role_selection/tasks/main.yml b/roles/server_role_selection/tasks/main.yml
deleted file mode 100644
index 4c67e66..0000000
--- a/roles/server_role_selection/tasks/main.yml
+++ /dev/null
@@ -1,111 +0,0 @@
----
-# ==========================
-# WINDOWS DETECTION
-# ==========================
-- name: "Windows | Detect AD DS feature (DC)"
-  when: ansible_facts['os_family'] == "Windows"
-  ansible.windows.win_feature_info:
-    name: "{{ ad_ds_feature_name }}"
-  register: _win_dc_feature
-  failed_when: false
-
-- name: "Windows | Fallback: check NTDS service (DC)"
-  when: ansible_facts['os_family'] == "Windows"
-  ansible.windows.win_service_info:
-    name: "NTDS"
-  register: _win_ntds_svc
-  failed_when: false
-
-- name: "Windows | Check DHCP service"
-  when: ansible_facts['os_family'] == "Windows"
-  ansible.windows.win_service_info:
-    name: "{{ dhcp_windows_service_name }}"
-  register: _win_dhcp_svc
-  failed_when: false
-
-- name: "Windows | Check Veeam VBR service"
-  when: ansible_facts['os_family'] == "Windows"
-  ansible.windows.win_service_info:
-    name: "{{ veeam_services.vbr }}"
-  register: _veeam_vbr
-  failed_when: false
-
-- name: "Windows | Check Veeam VBO service"
-  when: ansible_facts['os_family'] == "Windows"
-  ansible.windows.win_service_info:
-    name: "{{ veeam_services.vbo }}"
-  register: _veeam_vbo
-  failed_when: false
-
-- name: "Windows | Check Veeam Enterprise Manager service"
-  when: ansible_facts['os_family'] == "Windows"
-  ansible.windows.win_service_info:
-    name: "{{ veeam_services.em }}"
-  register: _veeam_em
-  failed_when: false
-
-- name: "Windows | Check Hyper-V service"
-  when: ansible_facts['os_family'] == "Windows"
-  ansible.windows.win_service_info:
-    name: "vmms"
-  register: _win_hyperv_svc
-  failed_when: false
-
-- name: "Windows | Set detection booleans"
-  when: ansible_facts['os_family'] == "Windows"
-  ansible.builtin.set_fact:
-    is_dc: >-
-      {{
-        (((_win_dc_feature.features | default([])) | selectattr('installed') | list | length) > 0)
-        or (_win_ntds_svc.exists | default(false))
-      }}
-    is_dhcp_server: "{{ _win_dhcp_svc.exists | default(false) }}"
-    has_veeam_vbr: "{{ _veeam_vbr.exists | default(false) }}"
-    has_veeam_vbo: "{{ _veeam_vbo.exists | default(false) }}"
-    has_veeam_em: "{{ _veeam_em.exists | default(false) }}"
-    is_hyperv_host: "{{ _win_hyperv_svc.exists | default(false) }}"
-
-- name: "Windows | Debug summary"
-  when: ansible_facts['os_family'] == "Windows"
-  ansible.builtin.debug:
-    msg:
-      is_dc: "{{ is_dc }}"
-      is_dhcp_server: "{{ is_dhcp_server }}"
-      has_veeam_vbr: "{{ has_veeam_vbr }}"
-      has_veeam_vbo: "{{ has_veeam_vbo }}"
-      has_veeam_em: "{{ has_veeam_em }}"
-      is_hyperv_host: "{{ is_hyperv_host }}"
-
-# ==========================
-# LINUX DETECTION
-# ==========================
-- name: "Linux | Collect service facts"
-  when: ansible_facts['os_family'] != "Windows"
-  ansible.builtin.service_facts:
-
-- name: "Linux | Collect package facts"
-  when: ansible_facts['os_family'] != "Windows"
-  ansible.builtin.package_facts:
-    manager: auto
-
-- name: "Linux | Set UniFi flag"
-  when: ansible_facts['os_family'] != "Windows"
-  vars:
-    svcs: "{{ ansible_facts.services | default({}) }}"
-    pkgs: "{{ ansible_facts.packages | default({}) | list }}"
-  ansible.builtin.set_fact:
-    is_unifi_controller: >-
-      {{
-        (unifi_linux_services | select('in', svcs.keys()) | list | length > 0)
-        or (pkgs | intersect(unifi_linux_packages) | length > 0)
-      }}
-
-- name: "Normalize detection booleans"
-  ansible.builtin.set_fact:
-    is_dc: "{{ is_dc | default(false) }}"
-    is_dhcp_server: "{{ is_dhcp_server | default(false) }}"
-    has_veeam_vbr: "{{ has_veeam_vbr | default(false) }}"
-    has_veeam_vbo: "{{ has_veeam_vbo | default(false) }}"
-    has_veeam_em: "{{ has_veeam_em | default(false) }}"
-    is_hyperv_host: "{{ is_hyperv_host | default(false) }}"
-    is_unifi_controller: "{{ is_unifi_controller | default(false) }}"
diff --git a/roles/sophos_apply_baseline/README.md b/roles/sophos_apply_baseline/README.md
new file mode 100644
index 0000000..ffa7112
--- /dev/null
+++ b/roles/sophos_apply_baseline/README.md
@@ -0,0 +1,3 @@
+# sophos_apply_baseline
+
+Policy-preserving extraction from the uploaded production playbooks. Arguments, conditions, operation order, rule names and values were not changed. Invoke through the matching playbook.
diff --git a/roles/sophos_apply_baseline/tasks/main.yml b/roles/sophos_apply_baseline/tasks/main.yml
new file mode 100644
index 0000000..1de131a
--- /dev/null
+++ b/roles/sophos_apply_baseline/tasks/main.yml
@@ -0,0 +1,500 @@
+---
+# Policy-preserving extraction from configure_sophos_initial_bitformer_config.yml. Do not change rule values without separate approval.
+- name: Erstelle 'bf_wan' IP Liste
+  sophos.sophos_firewall.sfos_xmlapi:
+    xml_tag: IPHost
+    data: |
+      <IPHost>
+          <Name>bf_wan</Name>
+          <Description>WAN-IPs von bitformer</Description>
+          <HostType>IPList</HostType>
+          <ListOfIPAddresses>217.13.70.132,87.138.207.238,80.152.155.27,217.13.174.202</ListOfIPAddresses>
+      </IPHost>
+    state: present
+- name: Erstelle 'bf_wartung' IP-Host
+  sophos.sophos_firewall.sfos_ip_host:
+    name: bf_wartung
+    ip_address: 10.240.0.1
+    state: present
+- name: Netzwerke als IP-Hosts in der Firewall anlegen
+  sophos.sophos_firewall.sfos_ip_host:
+    name: '{{ item.name }}'
+    network: '{{ item.network }}'
+    mask: '{{ item.subnetmask }}'
+    host_type: network
+    state: present
+  loop: '{{ network_hosts }}'
+- name: Erstelle 'rfc_1918_5735' Gruppe
+  sophos.sophos_firewall.sfos_ip_hostgroup:
+    name: rfc_1918_5735
+    description: rfc_1918_5735
+    host_list:
+      - rfc_1918_a
+      - rfc_1918_b
+      - rfc_1918_c
+      - rfc_5735
+    state: present
+- name: Erstelle 'OpenVPN' Service
+  sophos.sophos_firewall.sfos_service:
+    name: OpenVPN
+    type: tcporudp
+    service_list:
+      - protocol: udp
+        src_port: 1:65535
+        dst_port: 1194
+    state: present
+- name: Erstelle 'dgrp_wan_access_guests' Service Group
+  sophos.sophos_firewall.sfos_servicegroup:
+    name: dgrp_wan_access_guests
+    description: WAN Access Guests
+    service_list:
+      - PING
+      - HTTP
+      - HTTPS
+      - SMTPS_465
+      - SMTPS
+      - IMAP
+      - IMAPS
+      - POP3S
+      - IKE
+      - OpenVPN
+    state: present
+- name: Erstelle 'dgrp_wan_access_office' Service Group
+  sophos.sophos_firewall.sfos_servicegroup:
+    name: dgrp_wan_access_office
+    description: WAN Access Office
+    service_list:
+      - PING
+      - SSH
+      - HTTP
+      - HTTPS
+    state: present
+- name: Erstelle bitformer Management Access ACL Ausnahmeregel
+  sophos.sophos_firewall.sfos_service_acl_exception:
+    name: bitformer Management Access
+    description: Allow Management-Access to Webinterface, PING and SSH
+    position: bottom
+    source_zone: WAN
+    source_list:
+      - bf_wan
+    service_list:
+      - HTTPS
+      - SSH
+      - PING
+    action: accept
+    state: present
+- name: Erstelle bitformer Monitoring ACL Ausnahmeregel
+  sophos.sophos_firewall.sfos_service_acl_exception:
+    name: bitformer Monitoring
+    description: Allow Monitoring-Access
+    position: bottom
+    source_zone: VPN
+    source_list:
+      - bf_wartung
+    service_list:
+      - DNS
+      - HTTPS
+      - SSH
+      - PING
+    action: accept
+    state: present
+- name: Erstelle UserPortal Country-Restricted ACL Ausnahmeregel
+  sophos.sophos_firewall.sfos_service_acl_exception:
+    name: UserPortal Country-Restricted
+    description: Allow UserPort from Selected Countries
+    position: bottom
+    source_zone: WAN
+    source_list:
+      - Germany
+      - Austria
+      - Switzerland
+    service_list:
+      - UserPortal
+    action: accept
+    state: present
+- name: Erstelle 'bitformer' IPSec Profile
+  sophos.sophos_firewall.sfos_xmlapi:
+    xml_tag: VPNProfile
+    data: |
+      <VPNProfile>
+        <Name>bitformer</Name>
+        <Description>IPSec Policy bitformer Wartungszugang</Description>
+        <KeyingMethod>Automatic</KeyingMethod>
+        <AllowReKeying>Enable</AllowReKeying>
+        <KeyNegotiationTries>0</KeyNegotiationTries>
+        <AuthenticationMode>MainMode</AuthenticationMode>
+        <PassDataInCompressedFormat>Disable</PassDataInCompressedFormat>
+        <UseStrictProfile>Disable</UseStrictProfile>
+        <Phase1>
+          <EncryptionAlgorithm1>AES256</EncryptionAlgorithm1>
+          <AuthenticationAlgorithm1>SHA2_256</AuthenticationAlgorithm1>
+          <EncryptionAlgorithm2/>
+          <AuthenticationAlgorithm2/>
+          <EncryptionAlgorithm3/>
+          <AuthenticationAlgorithm3/>
+          <SupportedDHGroups>
+            <DHGroup>16(DH4096)</DHGroup>
+          </SupportedDHGroups>
+          <KeyLife>28800</KeyLife>
+          <ReKeyMargin>360</ReKeyMargin>
+          <RandomizeRe-KeyingMarginBy>50</RandomizeRe-KeyingMarginBy>
+          <DeadPeerDetection>Enable</DeadPeerDetection>
+          <CheckPeerAfterEvery>10</CheckPeerAfterEvery>
+          <WaitForResponseUpto>25</WaitForResponseUpto>
+          <ActionWhenPeerUnreachable>ReInitiate</ActionWhenPeerUnreachable>
+        </Phase1>
+        <Phase2>
+          <EncryptionAlgorithm1>AES256</EncryptionAlgorithm1>
+          <AuthenticationAlgorithm1>SHA2_256</AuthenticationAlgorithm1>
+          <EncryptionAlgorithm2/>
+          <AuthenticationAlgorithm2/>
+          <EncryptionAlgorithm3/>
+          <AuthenticationAlgorithm3/>
+          <PFSGroup>SameasPhase-I</PFSGroup>
+          <KeyLife>3600</KeyLife>
+        </Phase2>
+        <sha2_96_truncate>no</sha2_96_truncate>
+        <keyexchange>ikev2</keyexchange>
+      </VPNProfile>
+    state: present
+- name: Erstelle 'Mitarbeiter IPSec VPN' IPSec Profile
+  sophos.sophos_firewall.sfos_xmlapi:
+    xml_tag: VPNProfile
+    data: |
+      <VPNProfile transactionid="">
+        <Name>Mitarbeiter IPSec VPN</Name>
+        <Description>IPSec VPN für Mitarbeiter</Description>
+        <KeyingMethod>Automatic</KeyingMethod>
+        <AllowReKeying>Enable</AllowReKeying>
+        <KeyNegotiationTries>0</KeyNegotiationTries>
+        <AuthenticationMode>MainMode</AuthenticationMode>
+        <PassDataInCompressedFormat>Disable</PassDataInCompressedFormat>
+        <Phase1>
+          <EncryptionAlgorithm1>AES256</EncryptionAlgorithm1>
+          <AuthenticationAlgorithm1>SHA2_256</AuthenticationAlgorithm1>
+          <EncryptionAlgorithm2>AES256</EncryptionAlgorithm2>
+          <AuthenticationAlgorithm2>SHA2_384</AuthenticationAlgorithm2>
+          <EncryptionAlgorithm3/>
+          <AuthenticationAlgorithm3/>
+          <SupportedDHGroups>
+            <DHGroup>14(DH2048)</DHGroup>
+            <DHGroup>16(DH4096)</DHGroup>
+            <DHGroup>18(DH8192)</DHGroup>
+            <DHGroup>19(ecp256)</DHGroup>
+            <DHGroup>21(ecp521)</DHGroup>
+            <DHGroup>31(curve25519)</DHGroup>
+          </SupportedDHGroups>
+          <KeyLife>36000</KeyLife>
+          <ReKeyMargin>360</ReKeyMargin>
+          <RandomizeRe-KeyingMarginBy>100</RandomizeRe-KeyingMarginBy>
+          <DeadPeerDetection>Enable</DeadPeerDetection>
+          <CheckPeerAfterEvery>60</CheckPeerAfterEvery>
+          <WaitForResponseUpto>240</WaitForResponseUpto>
+          <ActionWhenPeerUnreachable>Disconnect</ActionWhenPeerUnreachable>
+        </Phase1>
+        <Phase2>
+          <EncryptionAlgorithm1>AES256</EncryptionAlgorithm1>
+          <AuthenticationAlgorithm1>SHA2_256</AuthenticationAlgorithm1>
+          <EncryptionAlgorithm2>AES256</EncryptionAlgorithm2>
+          <AuthenticationAlgorithm2>SHA2_384</AuthenticationAlgorithm2>
+          <EncryptionAlgorithm3/>
+          <AuthenticationAlgorithm3/>
+          <PFSGroup>SameasPhase-I</PFSGroup>
+          <KeyLife>32400</KeyLife>
+        </Phase2>
+        <sha2_96_truncate>no</sha2_96_truncate>
+        <keyexchange>ikev1</keyexchange>
+      </VPNProfile>
+    state: present
+- name: Update LAN Zone Admin Services
+  sophos.sophos_firewall.sfos_zone:
+    name: LAN
+    https: Enable
+    ssh: Enable
+    ad_sso: Enable
+    captive_portal: Enable
+    radius_sso: Disable
+    client_authen: Enable
+    chromebook_sso: Disable
+    ping: Enable
+    dns: Enable
+    ipsec: Disable
+    sslvpn: Disable
+    vpn_portal: Enable
+    red: Disable
+    wireless_protection: Disable
+    web_proxy: Disable
+    user_portal: Enable
+    smtp_relay: Disable
+    snmp: Disable
+    state: updated
+- name: Update WAN Zone Admin Services
+  sophos.sophos_firewall.sfos_zone:
+    name: WAN
+    https: Disable
+    ssh: Disable
+    ad_sso: Disable
+    captive_portal: Disable
+    radius_sso: Disable
+    client_authen: Disable
+    chromebook_sso: Disable
+    ping: Enable
+    dns: Disable
+    ipsec: Enable
+    sslvpn: Disable
+    vpn_portal: Disable
+    red: Disable
+    wireless_protection: Disable
+    web_proxy: Disable
+    user_portal: Disable
+    smtp_relay: Disable
+    snmp: Disable
+    state: updated
+- name: Update DMZ Zone Admin Services
+  sophos.sophos_firewall.sfos_zone:
+    name: DMZ
+    https: Disable
+    ssh: Enable
+    ad_sso: Disable
+    captive_portal: Disable
+    radius_sso: Disable
+    client_authen: Disable
+    chromebook_sso: Disable
+    ping: Enable
+    dns: Disable
+    ipsec: Disable
+    sslvpn: Disable
+    vpn_portal: Disable
+    red: Disable
+    wireless_protection: Disable
+    web_proxy: Disable
+    user_portal: Disable
+    smtp_relay: Disable
+    snmp: Disable
+    state: updated
+- name: Update VPN Zone Admin Services
+  sophos.sophos_firewall.sfos_zone:
+    name: VPN
+    https: Enable
+    ssh: Enable
+    ad_sso: Disable
+    captive_portal: Enable
+    radius_sso: Disable
+    client_authen: Disable
+    chromebook_sso: Disable
+    ping: Enable
+    dns: Enable
+    ipsec: Disable
+    sslvpn: Disable
+    vpn_portal: Enable
+    red: Disable
+    wireless_protection: Disable
+    web_proxy: Disable
+    user_portal: Enable
+    smtp_relay: Disable
+    snmp: Enable
+    state: updated
+- name: Update WiFi Zone Admin Services
+  sophos.sophos_firewall.sfos_zone:
+    name: WiFi
+    https: Disable
+    ssh: Disable
+    ad_sso: Disable
+    captive_portal: Disable
+    radius_sso: Disable
+    client_authen: Disable
+    chromebook_sso: Disable
+    ping: Disable
+    dns: Disable
+    ipsec: Disable
+    sslvpn: Disable
+    vpn_portal: Disable
+    red: Disable
+    wireless_protection: Disable
+    web_proxy: Disable
+    user_portal: Disable
+    smtp_relay: Disable
+    snmp: Disable
+    state: updated
+- name: Entferne 'Auto added firewall policy for MTA' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: Auto added firewall policy for MTA
+    state: absent
+- name: Erstelle 'LAN_to_WAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: LAN_to_WAN
+    action: accept
+    description: Lan > WAN Regel
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - LAN
+    dst_zones:
+      - Any
+    src_networks:
+      - Any
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'LAN > WAN' Firewall-Regel Gruppe
+  sophos.sophos_firewall.sfos_firewall_rulegroup:
+    name: LAN > WAN
+    description: Lan to WAN group
+    policy_list:
+      - LAN_to_WAN
+    policy_type: Any
+    source_zones:
+      - LAN
+    dest_zones:
+      - WAN
+    state: present
+- name: Erstelle 'bitformer Wartungszugang' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: bitformer Wartungszugang
+    action: accept
+    description: bitconnect Zugriff
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - VPN
+    dst_zones:
+      - Any
+    src_networks:
+      - bf_wartung
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'bitformer SPN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: bitformer SPN
+    action: accept
+    description: Zugriff auf bitformer SPN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - VPN
+    dst_zones:
+      - Any
+    src_networks:
+      - bf_spn_network
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'LAN_to_bitformer_SPN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: LAN_to_bitformer_SPN
+    action: accept
+    description: Zugriff auf bitformer SPN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - LAN
+    dst_zones:
+      - VPN
+    src_networks:
+      - Any
+    dst_networks:
+      - bf_spn_network
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'bitformer' Firewall Regel Gruppe
+  sophos.sophos_firewall.sfos_firewall_rulegroup:
+    name: bitformer
+    description: bitformer group
+    policy_list:
+      - bitformer Wartungszugang
+      - bitformer SPN
+      - LAN_to_bitformer_SPN
+    policy_type: Any
+    source_zones:
+      - Any
+    dest_zones:
+      - Any
+    state: present
+- name: Erstelle 'VPN_to_WAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: VPN_to_WAN
+    action: accept
+    description: Zugriff von VPN
+    log: enable
+    status: disable
+    position: bottom
+    src_zones:
+      - VPN
+    dst_zones:
+      - LAN
+    src_networks:
+      - Any
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'VPN' Firewall Regel Gruppe
+  sophos.sophos_firewall.sfos_firewall_rulegroup:
+    name: VPN
+    description: VPN group
+    policy_list:
+      - VPN_to_WAN
+    policy_type: Any
+    source_zones:
+      - Any
+    dest_zones:
+      - Any
+    state: present
+- name: Entferne [example] Firewallregeln
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: '{{ item }}'
+    state: absent
+  loop: '{{ firewall_rules_to_remove }}'
+- name: Erstelle 'DROP_ALL_LOG' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: DROP_ALL_LOG
+    action: drop
+    description: Verwirft alle Pakete mit Log
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - Any
+    dst_zones:
+      - Any
+    src_networks:
+      - Any
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Aktiviere 'Vordefinierten NTP-Server verwenden'
+  sophos.sophos_firewall.sfos_xmlapi:
+    xml_tag: Time
+    data: |
+      <Time>
+        <TimeZone>Europe/Berlin</TimeZone>
+        <SetDateTime>
+          <Date>
+            <Year/>
+            <Month/>
+            <Day/>
+          </Date>
+          <Time>
+            <HH/>
+            <MM/>
+            <SS>0</SS>
+          </Time>
+        </SetDateTime>
+        <PredefinedNTPServer>Enable</PredefinedNTPServer>
+      </Time>
+    state: updated
diff --git a/roles/sophos_customer_bluuunit/README.md b/roles/sophos_customer_bluuunit/README.md
new file mode 100644
index 0000000..dc9f715
--- /dev/null
+++ b/roles/sophos_customer_bluuunit/README.md
@@ -0,0 +1,3 @@
+# sophos_customer_bluuunit
+
+Policy-preserving extraction from the uploaded production playbooks. Arguments, conditions, operation order, rule names and values were not changed. Invoke through the matching playbook.
diff --git a/roles/sophos_customer_bluuunit/tasks/main.yml b/roles/sophos_customer_bluuunit/tasks/main.yml
new file mode 100644
index 0000000..314ad5f
--- /dev/null
+++ b/roles/sophos_customer_bluuunit/tasks/main.yml
@@ -0,0 +1,527 @@
+---
+# Customer-specific firewall policy preserved from the uploaded source.
+- name: Update hostname settings
+  sophos.sophos_firewall.sfos_admin_settings:
+    hostname_settings:
+      hostname: '{{ hostname }}'
+    state: updated
+- name: Netzwerke als IP-Hosts in der Firewall anlegen
+  sophos.sophos_firewall.sfos_ip_host:
+    name: '{{ item.value.name }}'
+    network: '{{ item.value.network }}'
+    mask: '{{ item.value.subnetmask }}'
+    host_type: network
+    state: present
+  loop: '{{ network_objects | dict2items }}'
+- name: Zonen erstellen
+  sophos.sophos_firewall.sfos_zone:
+    name: '{{ item.value.zone_name }}'
+    description: '{{  item.value.zone_description }}'
+    zone_type: '{{ item.value.zone_type }}'
+    state: present
+  loop: '{{ vlan_interfaces | dict2items }}'
+  when: item.value.name != "LAN"
+- name: Update Management Zone Admin Services
+  sophos.sophos_firewall.sfos_zone:
+    name: Management
+    https: Enable
+    ssh: Enable
+    ad_sso: Disable
+    captive_portal: Disable
+    radius_sso: Disable
+    client_authen: Disable
+    chromebook_sso: Disable
+    ping: Enable
+    dns: Enable
+    ipsec: Disable
+    sslvpn: Disable
+    vpn_portal: Disable
+    red: Disable
+    wireless_protection: Disable
+    web_proxy: Disable
+    user_portal: Disable
+    smtp_relay: Disable
+    snmp: Disable
+    state: updated
+- name: Update Server Zone Admin Services
+  sophos.sophos_firewall.sfos_zone:
+    name: Server
+    https: Enable
+    ssh: Disable
+    ad_sso: Disable
+    captive_portal: Disable
+    radius_sso: Disable
+    client_authen: Disable
+    chromebook_sso: Disable
+    ping: Enable
+    dns: Enable
+    ipsec: Disable
+    sslvpn: Disable
+    vpn_portal: Disable
+    red: Disable
+    wireless_protection: Disable
+    web_proxy: Disable
+    user_portal: Disable
+    smtp_relay: Disable
+    snmp: Disable
+    state: updated
+- name: Update Guest Zone Admin Services
+  sophos.sophos_firewall.sfos_zone:
+    name: Guest
+    https: Disable
+    ssh: Disable
+    ad_sso: Disable
+    captive_portal: Disable
+    radius_sso: Disable
+    client_authen: Disable
+    chromebook_sso: Disable
+    ping: Enable
+    dns: Enable
+    ipsec: Disable
+    sslvpn: Disable
+    vpn_portal: Disable
+    red: Disable
+    wireless_protection: Disable
+    web_proxy: Disable
+    user_portal: Disable
+    smtp_relay: Disable
+    snmp: Disable
+    state: updated
+- name: Update Facility Zone Admin Services
+  sophos.sophos_firewall.sfos_zone:
+    name: Facility
+    https: Disable
+    ssh: Disable
+    ad_sso: Disable
+    captive_portal: Disable
+    radius_sso: Disable
+    client_authen: Disable
+    chromebook_sso: Disable
+    ping: Enable
+    dns: Enable
+    ipsec: Disable
+    sslvpn: Disable
+    vpn_portal: Disable
+    red: Disable
+    wireless_protection: Disable
+    web_proxy: Disable
+    user_portal: Disable
+    smtp_relay: Disable
+    snmp: Disable
+    state: updated
+- name: Update VOIP Zone Admin Services
+  sophos.sophos_firewall.sfos_zone:
+    name: VOIP
+    https: Disable
+    ssh: Disable
+    ad_sso: Disable
+    captive_portal: Disable
+    radius_sso: Disable
+    client_authen: Disable
+    chromebook_sso: Disable
+    ping: Enable
+    dns: Enable
+    ipsec: Disable
+    sslvpn: Disable
+    vpn_portal: Disable
+    red: Disable
+    wireless_protection: Disable
+    web_proxy: Disable
+    user_portal: Disable
+    smtp_relay: Disable
+    snmp: Disable
+    state: updated
+- name: Add VLAN Interfaces
+  sophos.sophos_firewall.sfos_xmlapi:
+    xml_tag: VLAN
+    data: |
+      <VLAN>
+          <Name>{{ item.value.name }}</Name>
+          <Hardware>Port1</Hardware>
+          <Interface>Port1</Interface>
+          <Zone>{{ item.value.zone_name }}</Zone>
+          <VLANID>{{ item.value.vlan_id }}</VLANID>
+          <IPv4Configuration>Enable</IPv4Configuration>
+          <IPv4Assignment>Static</IPv4Assignment>
+          <IPAddress>{{ item.value.ip_address }}</IPAddress>
+          <Netmask>{{ item.value.subnetmask }}</Netmask>
+      </VLAN>
+    state: present
+  loop: '{{ vlan_interfaces | dict2items }}'
+  loop_control:
+    label: '{{ item.key }} -> VLAN {{ item.value.vlan_id }}'
+- name: Erstelle 'LAN_to_LAN_old' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: LAN_to_LAN_old
+    action: accept
+    description: Erlaubt Zugriff von LAN auf Bestandsnetz
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - LAN
+    dst_zones:
+      - LAN
+    src_networks:
+      - '{{ network_objects.office.name }}'
+    dst_networks:
+      - '{{ network_objects.lan_old.name }}'
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'INTERNAL_to_bu_RZ' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: INTERNAL_to_bu_RZ
+    action: accept
+    description: Erlaubt Zugriff von internen Netzen auf bluu unit Rechenzentrum
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - Facility
+      - Guest
+      - LAN
+      - Management
+      - Server
+      - VOIP
+    dst_zones:
+      - VPN
+    src_networks:
+      - '{{ network_objects.facility.name }}'
+      - '{{ network_objects.guest.name }}'
+      - '{{ network_objects.lan_old.name }}'
+      - '{{ network_objects.management.name }}'
+      - '{{ network_objects.office.name }}'
+      - '{{ network_objects.server.name }}'
+      - '{{ network_objects.voip.name }}'
+    dst_networks:
+      - '{{ network_objects.derz_lan.name }}'
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'SSLVPN_to_INTERNAL' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: SSLVPN_to_INTERNAL
+    action: accept
+    description: Erlaubt Zugriff von DERZ SSLVPN auf internen Netzen
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - VPN
+    dst_zones:
+      - Facility
+      - LAN
+      - Server
+      - VOIP
+    src_networks:
+      - '{{ network_objects.derz_sslvpn.name }}'
+    dst_networks:
+      - '{{ network_objects.facility.name }}'
+      - '{{ network_objects.lan_old.name }}'
+      - '{{ network_objects.office.name }}'
+      - '{{ network_objects.server.name }}'
+      - '{{ network_objects.voip.name }}'
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'LAN_to_WAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: LAN_to_WAN
+    action: accept
+    description: Erlaubt Zugriff von LAN auf WAN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - LAN
+    dst_zones:
+      - WAN
+    src_networks:
+      - '{{ network_objects.office.name }}'
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'LAN_old_to_WAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: LAN_old_to_WAN
+    action: accept
+    description: Erlaubt Zugriff von old LAN auf WAN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - LAN
+    dst_zones:
+      - WAN
+    src_networks:
+      - '{{ network_objects.lan_old.name }}'
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'Server_to_WAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: Server_to_WAN
+    action: accept
+    description: Erlaubt Zugriff von Server auf WAN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - Server
+    dst_zones:
+      - WAN
+    src_networks:
+      - '{{ network_objects.server.name }}'
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'Management_to_WAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: Management_to_WAN
+    action: accept
+    description: Erlaubt Zugriff von Management auf WAN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - Management
+    dst_zones:
+      - WAN
+    src_networks:
+      - '{{ network_objects.management.name }}'
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'Guest_to_WAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: Guest_to_WAN
+    action: accept
+    description: Erlaubt Zugriff von Guest auf WAN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - Guest
+    dst_zones:
+      - WAN
+    src_networks:
+      - '{{ network_objects.guest.name }}'
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'Facility_to_WAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: Facility_to_WAN
+    action: accept
+    description: Erlaubt Zugriff von Facility auf WAN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - Facility
+    dst_zones:
+      - WAN
+    src_networks:
+      - '{{ network_objects.facility.name }}'
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'VOIP_to_WAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: VOIP_to_WAN
+    action: accept
+    description: Erlaubt Zugriff von VOIP auf WAN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - VOIP
+    dst_zones:
+      - WAN
+    src_networks:
+      - '{{ network_objects.voip.name }}'
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'LAN_to_Management' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: LAN_to_Management
+    action: accept
+    description: Erlaubt Zugriff von LAN auf Management
+    log: enable
+    status: disable
+    position: bottom
+    src_zones:
+      - LAN
+    dst_zones:
+      - Management
+    src_networks:
+      - '{{ network_objects.office.name }}'
+    dst_networks:
+      - '{{ network_objects.management.name }}'
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'LAN_to_Server' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: LAN_to_Server
+    action: accept
+    description: Erlaubt Zugriff von LAN auf Server
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - LAN
+    dst_zones:
+      - Server
+    src_networks:
+      - '{{ network_objects.office.name }}'
+    dst_networks:
+      - '{{ network_objects.server.name }}'
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'LAN_to_Facility' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: LAN_to_Facility
+    action: accept
+    description: Erlaubt Zugriff von LAN auf Facility
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - LAN
+    dst_zones:
+      - Facility
+    src_networks:
+      - '{{ network_objects.office.name }}'
+    dst_networks:
+      - '{{ network_objects.facility.name }}'
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'LAN_to_VOIP' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: LAN_to_VOIP
+    action: accept
+    description: Erlaubt Zugriff von LAN auf VOIP
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - LAN
+    dst_zones:
+      - VOIP
+    src_networks:
+      - '{{ network_objects.office.name }}'
+    dst_networks:
+      - '{{ network_objects.voip.name }}'
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'VPN' Firewall-Regel Gruppe
+  sophos.sophos_firewall.sfos_firewall_rulegroup:
+    name: VPN
+    description: VPN
+    policy_list:
+      - INTERNAL_to_bu_RZ
+      - SSLVPN_to_INTERNAL
+    policy_type: Any
+    source_zones:
+      - VPN
+    dest_zones:
+      - Any
+    state: present
+- name: Erstelle 'X to Management' Firewall-Regel Gruppe
+  sophos.sophos_firewall.sfos_firewall_rulegroup:
+    name: X to Management
+    description: Zugriff auf Management-Netz
+    policy_list:
+      - LAN_to_Management
+    policy_type: Any
+    source_zones:
+      - Any
+    dest_zones:
+      - Management
+    state: present
+- name: Erstelle 'X to Server' Firewall-Regel Gruppe
+  sophos.sophos_firewall.sfos_firewall_rulegroup:
+    name: X to Server
+    description: Zugriff auf Server-Netz
+    policy_list:
+      - LAN_to_Server
+    policy_type: Any
+    source_zones:
+      - Any
+    dest_zones:
+      - Server
+    state: present
+- name: Erstelle 'X to LAN' Firewall-Regel Gruppe
+  sophos.sophos_firewall.sfos_firewall_rulegroup:
+    name: X to LAN
+    description: Zugriff auf LAN-Netz
+    policy_list:
+      - LAN_to_LAN_old
+    policy_type: Any
+    source_zones:
+      - Any
+    dest_zones:
+      - LAN
+    state: present
+- name: Erstelle 'X to Facility' Firewall-Regel Gruppe
+  sophos.sophos_firewall.sfos_firewall_rulegroup:
+    name: X to Facility
+    description: Zugriff auf Facility-Netz
+    policy_list:
+      - LAN_to_Facility
+    policy_type: Any
+    source_zones:
+      - Any
+    dest_zones:
+      - Facility
+    state: present
+- name: Erstelle 'X to VOIP' Firewall-Regel Gruppe
+  sophos.sophos_firewall.sfos_firewall_rulegroup:
+    name: X to VOIP
+    description: Zugriff auf VOIP-Netz
+    policy_list:
+      - LAN_to_VOIP
+    policy_type: Any
+    source_zones:
+      - Any
+    dest_zones:
+      - VOIP
+    state: present
+- name: Erstelle 'X to WAN' Firewall-Regel Gruppe
+  sophos.sophos_firewall.sfos_firewall_rulegroup:
+    name: X to WAN
+    description: X to WAN group
+    policy_list:
+      - LAN_to_WAN
+      - Server_to_WAN
+      - Management_to_WAN
+      - LAN_old_to_WAN
+      - Guest_to_WAN
+      - Facility_to_WAN
+      - VOIP_to_WAN
+    policy_type: Any
+    source_zones:
+      - Any
+    dest_zones:
+      - WAN
+    state: present
diff --git a/roles/sophos_customer_formicon/README.md b/roles/sophos_customer_formicon/README.md
new file mode 100644
index 0000000..b60b7bf
--- /dev/null
+++ b/roles/sophos_customer_formicon/README.md
@@ -0,0 +1,3 @@
+# sophos_customer_formicon
+
+Policy-preserving extraction from the uploaded production playbooks. Arguments, conditions, operation order, rule names and values were not changed. Invoke through the matching playbook.
diff --git a/roles/sophos_customer_formicon/tasks/main.yml b/roles/sophos_customer_formicon/tasks/main.yml
new file mode 100644
index 0000000..5473f88
--- /dev/null
+++ b/roles/sophos_customer_formicon/tasks/main.yml
@@ -0,0 +1,231 @@
+---
+# Customer-specific firewall policy preserved from the uploaded source.
+- name: Update hostname settings
+  sophos.sophos_firewall.sfos_admin_settings:
+    hostname_settings:
+      hostname: '{{ hostname }}'
+    state: updated
+- name: Netzwerke als IP-Hosts in der Firewall anlegen
+  sophos.sophos_firewall.sfos_ip_host:
+    name: '{{ item.value.name }}'
+    network: '{{ item.value.network }}'
+    mask: '{{ item.value.subnetmask }}'
+    host_type: network
+    state: present
+  loop: '{{ network_objects | dict2items }}'
+- name: Zonen erstellen
+  sophos.sophos_firewall.sfos_zone:
+    name: '{{ item.value.zone_name }}'
+    description: '{{  item.value.zone_description }}'
+    zone_type: '{{ item.value.zone_type }}'
+    state: present
+  loop: '{{ vlan_interfaces | dict2items }}'
+  when: item.value.name != "LAN"
+- name: Update Management Zone Admin Services
+  sophos.sophos_firewall.sfos_zone:
+    name: Management
+    https: Enable
+    ssh: Enable
+    ad_sso: Disable
+    captive_portal: Disable
+    radius_sso: Disable
+    client_authen: Disable
+    chromebook_sso: Disable
+    ping: Enable
+    dns: Enable
+    ipsec: Disable
+    sslvpn: Disable
+    vpn_portal: Disable
+    red: Disable
+    wireless_protection: Disable
+    web_proxy: Disable
+    user_portal: Disable
+    smtp_relay: Disable
+    snmp: Disable
+    state: updated
+- name: Add VLAN Interfaces
+  sophos.sophos_firewall.sfos_xmlapi:
+    xml_tag: VLAN
+    data: |
+      <VLAN>
+          <Name>{{ item.value.name }}</Name>
+          <Hardware>Port1</Hardware>
+          <Interface>Port1</Interface>
+          <Zone>{{ item.value.zone_name }}</Zone>
+          <VLANID>{{ item.value.vlan_id }}</VLANID>
+          <IPv4Configuration>Enable</IPv4Configuration>
+          <IPv4Assignment>Static</IPv4Assignment>
+          <IPAddress>{{ item.value.ip_address }}</IPAddress>
+          <Netmask>{{ item.value.subnetmask }}</Netmask>
+      </VLAN>
+    state: present
+  loop: '{{ vlan_interfaces | dict2items }}'
+  loop_control:
+    label: '{{ item.key }} -> VLAN {{ item.value.vlan_id }}'
+- name: Erstelle 'LAN_to_LAN_old' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: LAN_to_LAN_old
+    action: accept
+    description: Erlaubt Zugriff von LAN auf Bestandsnetz
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - LAN
+    dst_zones:
+      - LAN
+    src_networks:
+      - '{{ network_objects.office.name }}'
+    dst_networks:
+      - '{{ network_objects.lan_old.name }}'
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'INTERNAL_to_FHAZUREGWC_LAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: INTERNAL_to_FHAZUREGWC_LAN
+    action: accept
+    description: Erlaubt Zugriff von internen Netzen auf Formicon Holding Azure Germany West Central LAN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - LAN
+      - Management
+    dst_zones:
+      - VPN
+    src_networks:
+      - '{{ network_objects.lan_old.name }}'
+      - '{{ network_objects.management.name }}'
+      - '{{ network_objects.office.name }}'
+    dst_networks:
+      - '{{ network_objects.azuregwc_lan.name }}'
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'LAN_to_WAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: LAN_to_WAN
+    action: accept
+    description: Erlaubt Zugriff von LAN auf WAN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - LAN
+    dst_zones:
+      - WAN
+    src_networks:
+      - '{{ network_objects.office.name }}'
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'LAN_old_to_WAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: LAN_old_to_WAN
+    action: accept
+    description: Erlaubt Zugriff von old LAN auf WAN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - LAN
+    dst_zones:
+      - WAN
+    src_networks:
+      - '{{ network_objects.lan_old.name }}'
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'Management_to_WAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: Management_to_WAN
+    action: accept
+    description: Erlaubt Zugriff von Management auf WAN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - Management
+    dst_zones:
+      - WAN
+    src_networks:
+      - '{{ network_objects.management.name }}'
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'LAN_to_Management' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: LAN_to_Management
+    action: accept
+    description: Erlaubt Zugriff von LAN auf Management
+    log: enable
+    status: disable
+    position: bottom
+    src_zones:
+      - LAN
+    dst_zones:
+      - Management
+    src_networks:
+      - '{{ network_objects.office.name }}'
+    dst_networks:
+      - '{{ network_objects.management.name }}'
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'VPN' Firewall-Regel Gruppe
+  sophos.sophos_firewall.sfos_firewall_rulegroup:
+    name: VPN
+    description: VPN
+    policy_list:
+      - INTERNAL_to_FHAZUREGWC_LAN
+    policy_type: Any
+    source_zones:
+      - VPN
+    dest_zones:
+      - Any
+    state: present
+- name: Erstelle 'X to Management' Firewall-Regel Gruppe
+  sophos.sophos_firewall.sfos_firewall_rulegroup:
+    name: X to Management
+    description: Zugriff auf Management-Netz
+    policy_list:
+      - LAN_to_Management
+    policy_type: Any
+    source_zones:
+      - Any
+    dest_zones:
+      - Management
+    state: present
+- name: Erstelle 'X to LAN' Firewall-Regel Gruppe
+  sophos.sophos_firewall.sfos_firewall_rulegroup:
+    name: X to LAN
+    description: Zugriff auf LAN-Netz
+    policy_list:
+      - LAN_to_LAN_old
+    policy_type: Any
+    source_zones:
+      - Any
+    dest_zones:
+      - LAN
+    state: present
+- name: Erstelle 'X to WAN' Firewall-Regel Gruppe
+  sophos.sophos_firewall.sfos_firewall_rulegroup:
+    name: X to WAN
+    description: X to WAN group
+    policy_list:
+      - LAN_to_WAN
+      - Management_to_WAN
+      - LAN_old_to_WAN
+    policy_type: Any
+    source_zones:
+      - Any
+    dest_zones:
+      - WAN
+    state: present
diff --git a/roles/sophos_customer_gebhardt_stahl/README.md b/roles/sophos_customer_gebhardt_stahl/README.md
new file mode 100644
index 0000000..0de8dfa
--- /dev/null
+++ b/roles/sophos_customer_gebhardt_stahl/README.md
@@ -0,0 +1,3 @@
+# sophos_customer_gebhardt_stahl
+
+Policy-preserving extraction from the uploaded production playbooks. Arguments, conditions, operation order, rule names and values were not changed. Invoke through the matching playbook.
diff --git a/roles/sophos_customer_gebhardt_stahl/tasks/main.yml b/roles/sophos_customer_gebhardt_stahl/tasks/main.yml
new file mode 100644
index 0000000..46b80ca
--- /dev/null
+++ b/roles/sophos_customer_gebhardt_stahl/tasks/main.yml
@@ -0,0 +1,195 @@
+---
+# Customer-specific firewall policy preserved from the uploaded source.
+- name: Update hostname settings
+  sophos.sophos_firewall.sfos_admin_settings:
+    hostname_settings:
+      hostname: '{{ hostname }}'
+    state: updated
+- name: Netzwerke als IP-Hosts in der Firewall anlegen
+  sophos.sophos_firewall.sfos_ip_host:
+    name: '{{ item.value.name }}'
+    network: '{{ item.value.network }}'
+    mask: '{{ item.value.subnetmask }}'
+    host_type: network
+    state: present
+  loop: '{{ network_objects | dict2items }}'
+- name: Zonen erstellen
+  sophos.sophos_firewall.sfos_zone:
+    name: '{{ item.value.zone_name }}'
+    description: '{{  item.value.zone_description }}'
+    zone_type: '{{ item.value.zone_type }}'
+    state: present
+  loop: '{{ vlan_interfaces | dict2items }}'
+  when: item.value.name != "LAN"
+- name: Add VLAN Interfaces
+  sophos.sophos_firewall.sfos_xmlapi:
+    xml_tag: VLAN
+    data: |
+      <VLAN>
+          <Name>{{ item.value.name }}</Name>
+          <Hardware>Port1</Hardware>
+          <Interface>Port1</Interface>
+          <Zone>{{ item.value.zone_name }}</Zone>
+          <VLANID>{{ item.value.vlan_id }}</VLANID>
+          <IPv4Configuration>Enable</IPv4Configuration>
+          <IPv4Assignment>Static</IPv4Assignment>
+          <IPAddress>{{ item.value.ip_address }}</IPAddress>
+          <Netmask>{{ item.value.subnetmask }}</Netmask>
+      </VLAN>
+    state: present
+  loop: '{{ vlan_interfaces | dict2items }}'
+  loop_control:
+    label: '{{ item.key }} -> VLAN {{ item.value.vlan_id }}'
+- name: Erstelle 'LAN_to_WAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: LAN_to_WAN
+    action: accept
+    description: Erlaubt Zugriff von LAN auf WAN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - LAN
+    dst_zones:
+      - WAN
+    src_networks:
+      - '{{ network_objects.office.name }}'
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'Guest_to_WAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: Guest_to_WAN
+    action: accept
+    description: Erlaubt Zugriff von Guest auf WAN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - Guest
+    dst_zones:
+      - WAN
+    src_networks:
+      - '{{ network_objects.guest.name }}'
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'Drucker_to_WAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: Drucker_to_WAN
+    action: accept
+    description: Erlaubt Zugriff von Drucker auf WAN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - Drucker
+    dst_zones:
+      - WAN
+    src_networks:
+      - '{{ network_objects.drucker.name }}'
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'WLAN_to_WAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: WLAN_to_WAN
+    action: accept
+    description: Erlaubt Zugriff von WLAN auf WAN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - WLAN
+    dst_zones:
+      - WAN
+    src_networks:
+      - '{{ network_objects.wlan.name }}'
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'LAN_to_Drucker' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: LAN_to_Drucker
+    action: accept
+    description: Erlaubt Zugriff von LAN auf Drucker
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - LAN
+    dst_zones:
+      - Drucker
+    src_networks:
+      - '{{ network_objects.office.name }}'
+    dst_networks:
+      - '{{ network_objects.drucker.name }}'
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'LAN_to_WLAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: LAN_to_WLAN
+    action: accept
+    description: Erlaubt Zugriff von LAN auf WLAN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - LAN
+    dst_zones:
+      - WLAN
+    src_networks:
+      - '{{ network_objects.office.name }}'
+    dst_networks:
+      - '{{ network_objects.wlan.name }}'
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'X to Drucker' Firewall-Regel Gruppe
+  sophos.sophos_firewall.sfos_firewall_rulegroup:
+    name: X to Drucker
+    description: Zugriff auf Drucker-Netz
+    policy_list:
+      - LAN_to_Drucker
+    policy_type: Any
+    source_zones:
+      - Any
+    dest_zones:
+      - Drucker
+    state: present
+- name: Erstelle 'X to WLAN' Firewall-Regel Gruppe
+  sophos.sophos_firewall.sfos_firewall_rulegroup:
+    name: X to WLAN
+    description: Zugriff auf WLAN-Netz
+    policy_list:
+      - LAN_to_WLAN
+    policy_type: Any
+    source_zones:
+      - Any
+    dest_zones:
+      - WLAN
+    state: present
+- name: Erstelle 'X to WAN' Firewall-Regel Gruppe
+  sophos.sophos_firewall.sfos_firewall_rulegroup:
+    name: X to WAN
+    description: X to WAN group
+    policy_list:
+      - LAN_to_WAN
+      - Guest_to_WAN
+      - Drucker_to_WAN
+      - WLAN_to_WAN
+    policy_type: Any
+    source_zones:
+      - Any
+    dest_zones:
+      - WAN
+    state: present
diff --git a/roles/sophos_customer_hungeling_und_toechter/README.md b/roles/sophos_customer_hungeling_und_toechter/README.md
new file mode 100644
index 0000000..1fac111
--- /dev/null
+++ b/roles/sophos_customer_hungeling_und_toechter/README.md
@@ -0,0 +1,3 @@
+# sophos_customer_hungeling_und_toechter
+
+Policy-preserving extraction from the uploaded production playbooks. Arguments, conditions, operation order, rule names and values were not changed. Invoke through the matching playbook.
diff --git a/roles/sophos_customer_hungeling_und_toechter/tasks/main.yml b/roles/sophos_customer_hungeling_und_toechter/tasks/main.yml
new file mode 100644
index 0000000..33c5b07
--- /dev/null
+++ b/roles/sophos_customer_hungeling_und_toechter/tasks/main.yml
@@ -0,0 +1,268 @@
+---
+# Customer-specific firewall policy preserved from the uploaded source.
+- name: Update hostname settings
+  sophos.sophos_firewall.sfos_admin_settings:
+    hostname_settings:
+      hostname: '{{ hostname }}'
+    state: updated
+- name: Netzwerke als IP-Hosts in der Firewall anlegen
+  sophos.sophos_firewall.sfos_ip_host:
+    name: '{{ item.value.name }}'
+    network: '{{ item.value.network }}'
+    mask: '{{ item.value.subnetmask }}'
+    host_type: network
+    state: present
+  loop: '{{ network_objects | dict2items }}'
+- name: Zonen erstellen
+  sophos.sophos_firewall.sfos_zone:
+    name: '{{ item.value.zone_name }}'
+    description: '{{  item.value.zone_description }}'
+    zone_type: '{{ item.value.zone_type }}'
+    state: present
+  loop: '{{ vlan_interfaces | dict2items }}'
+  when: item.value.name != "LAN"
+- name: Update Management Zone Admin Services
+  sophos.sophos_firewall.sfos_zone:
+    name: Management
+    https: Enable
+    ssh: Enable
+    ad_sso: Disable
+    captive_portal: Disable
+    radius_sso: Disable
+    client_authen: Disable
+    chromebook_sso: Disable
+    ping: Enable
+    dns: Enable
+    ipsec: Disable
+    sslvpn: Disable
+    vpn_portal: Disable
+    red: Disable
+    wireless_protection: Disable
+    web_proxy: Disable
+    user_portal: Disable
+    smtp_relay: Disable
+    snmp: Disable
+    state: updated
+- name: Add VLAN Interfaces
+  sophos.sophos_firewall.sfos_xmlapi:
+    xml_tag: VLAN
+    data: |
+      <VLAN>
+          <Name>{{ item.value.name }}</Name>
+          <Hardware>Port1</Hardware>
+          <Interface>Port1</Interface>
+          <Zone>{{ item.value.zone_name }}</Zone>
+          <VLANID>{{ item.value.vlan_id }}</VLANID>
+          <IPv4Configuration>Enable</IPv4Configuration>
+          <IPv4Assignment>Static</IPv4Assignment>
+          <IPAddress>{{ item.value.ip_address }}</IPAddress>
+          <Netmask>{{ item.value.subnetmask }}</Netmask>
+      </VLAN>
+    state: present
+  loop: '{{ vlan_interfaces | dict2items }}'
+  loop_control:
+    label: '{{ item.key }} -> VLAN {{ item.value.vlan_id }}'
+- name: Erstelle 'LAN_to_WAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: LAN_to_WAN
+    action: accept
+    description: Erlaubt Zugriff von LAN auf WAN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - LAN
+    dst_zones:
+      - WAN
+    src_networks:
+      - '{{ network_objects.office.name }}'
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'Management_to_WAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: Management_to_WAN
+    action: accept
+    description: Erlaubt Zugriff von Management auf WAN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - Management
+    dst_zones:
+      - WAN
+    src_networks:
+      - '{{ network_objects.management.name }}'
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'Guest_to_WAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: Guest_to_WAN
+    action: accept
+    description: Erlaubt Zugriff von Guest auf WAN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - Guest
+    dst_zones:
+      - WAN
+    src_networks:
+      - '{{ network_objects.guest.name }}'
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'Facility_to_WAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: Facility_to_WAN
+    action: accept
+    description: Erlaubt Zugriff von Facility auf WAN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - Facility
+    dst_zones:
+      - WAN
+    src_networks:
+      - '{{ network_objects.facility.name }}'
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'VOIP_to_WAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: VOIP_to_WAN
+    action: accept
+    description: Erlaubt Zugriff von VOIP auf WAN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - VOIP
+    dst_zones:
+      - WAN
+    src_networks:
+      - '{{ network_objects.voip.name }}'
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'LAN_to_Management' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: LAN_to_Management
+    action: accept
+    description: Erlaubt Zugriff von LAN auf Management
+    log: enable
+    status: disable
+    position: bottom
+    src_zones:
+      - LAN
+    dst_zones:
+      - Management
+    src_networks:
+      - '{{ network_objects.office.name }}'
+    dst_networks:
+      - '{{ network_objects.management.name }}'
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'LAN_to_Facility' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: LAN_to_Facility
+    action: accept
+    description: Erlaubt Zugriff von LAN auf Facility
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - LAN
+    dst_zones:
+      - Facility
+    src_networks:
+      - '{{ network_objects.office.name }}'
+    dst_networks:
+      - '{{ network_objects.facility.name }}'
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'LAN_to_VOIP' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: LAN_to_VOIP
+    action: accept
+    description: Erlaubt Zugriff von LAN auf VOIP
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - LAN
+    dst_zones:
+      - VOIP
+    src_networks:
+      - '{{ network_objects.office.name }}'
+    dst_networks:
+      - '{{ network_objects.voip.name }}'
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'X to Management' Firewall-Regel Gruppe
+  sophos.sophos_firewall.sfos_firewall_rulegroup:
+    name: X to Management
+    description: Zugriff auf Management-Netz
+    policy_list:
+      - LAN_to_Management
+    policy_type: Any
+    source_zones:
+      - Any
+    dest_zones:
+      - Management
+    state: present
+- name: Erstelle 'X to Facility' Firewall-Regel Gruppe
+  sophos.sophos_firewall.sfos_firewall_rulegroup:
+    name: X to Facility
+    description: Zugriff auf Facility-Netz
+    policy_list:
+      - LAN_to_Facility
+    policy_type: Any
+    source_zones:
+      - Any
+    dest_zones:
+      - Facility
+    state: present
+- name: Erstelle 'X to VOIP' Firewall-Regel Gruppe
+  sophos.sophos_firewall.sfos_firewall_rulegroup:
+    name: X to VOIP
+    description: Zugriff auf VOIP-Netz
+    policy_list:
+      - LAN_to_VOIP
+    policy_type: Any
+    source_zones:
+      - Any
+    dest_zones:
+      - VOIP
+    state: present
+- name: Erstelle 'X to WAN' Firewall-Regel Gruppe
+  sophos.sophos_firewall.sfos_firewall_rulegroup:
+    name: X to WAN
+    description: X to WAN group
+    policy_list:
+      - LAN_to_WAN
+      - Management_to_WAN
+      - Guest_to_WAN
+      - Facility_to_WAN
+      - VOIP_to_WAN
+    policy_type: Any
+    source_zones:
+      - Any
+    dest_zones:
+      - WAN
+    state: present
diff --git a/roles/sophos_customer_koenig_holding_gmbh/README.md b/roles/sophos_customer_koenig_holding_gmbh/README.md
new file mode 100644
index 0000000..466ffc8
--- /dev/null
+++ b/roles/sophos_customer_koenig_holding_gmbh/README.md
@@ -0,0 +1,3 @@
+# sophos_customer_koenig_holding_gmbh
+
+Policy-preserving extraction from the uploaded production playbooks. Arguments, conditions, operation order, rule names and values were not changed. Invoke through the matching playbook.
diff --git a/roles/sophos_customer_koenig_holding_gmbh/tasks/main.yml b/roles/sophos_customer_koenig_holding_gmbh/tasks/main.yml
new file mode 100644
index 0000000..f5a74c5
--- /dev/null
+++ b/roles/sophos_customer_koenig_holding_gmbh/tasks/main.yml
@@ -0,0 +1,407 @@
+---
+# Customer-specific firewall policy preserved from the uploaded source.
+- name: Update hostname settings
+  sophos.sophos_firewall.sfos_admin_settings:
+    hostname_settings:
+      hostname: '{{ hostname }}'
+    state: updated
+- name: Netzwerke als IP-Hosts in der Firewall anlegen
+  sophos.sophos_firewall.sfos_ip_host:
+    name: '{{ item.value.name }}'
+    network: '{{ item.value.network }}'
+    mask: '{{ item.value.subnetmask }}'
+    host_type: network
+    state: present
+  loop: '{{ network_objects | dict2items }}'
+- name: Zonen erstellen
+  sophos.sophos_firewall.sfos_zone:
+    name: '{{ item.value.zone_name }}'
+    description: '{{  item.value.zone_description }}'
+    zone_type: '{{ item.value.zone_type }}'
+    state: present
+  loop: '{{ vlan_interfaces | dict2items }}'
+  when: item.value.name != "LAN"
+- name: Update Management Zone Admin Services
+  sophos.sophos_firewall.sfos_zone:
+    name: Management
+    https: Enable
+    ssh: Enable
+    ad_sso: Disable
+    captive_portal: Disable
+    radius_sso: Disable
+    client_authen: Disable
+    chromebook_sso: Disable
+    ping: Enable
+    dns: Enable
+    ipsec: Disable
+    sslvpn: Disable
+    vpn_portal: Disable
+    red: Disable
+    wireless_protection: Disable
+    web_proxy: Disable
+    user_portal: Disable
+    smtp_relay: Disable
+    snmp: Disable
+    state: updated
+- name: Update Server Zone Admin Services
+  sophos.sophos_firewall.sfos_zone:
+    name: Server
+    https: Enable
+    ssh: Disable
+    ad_sso: Disable
+    captive_portal: Disable
+    radius_sso: Disable
+    client_authen: Disable
+    chromebook_sso: Disable
+    ping: Enable
+    dns: Enable
+    ipsec: Disable
+    sslvpn: Disable
+    vpn_portal: Disable
+    red: Disable
+    wireless_protection: Disable
+    web_proxy: Disable
+    user_portal: Disable
+    smtp_relay: Disable
+    snmp: Disable
+    state: updated
+- name: Update Guest Zone Admin Services
+  sophos.sophos_firewall.sfos_zone:
+    name: Guest
+    https: Disable
+    ssh: Disable
+    ad_sso: Disable
+    captive_portal: Disable
+    radius_sso: Disable
+    client_authen: Disable
+    chromebook_sso: Disable
+    ping: Enable
+    dns: Enable
+    ipsec: Disable
+    sslvpn: Disable
+    vpn_portal: Disable
+    red: Disable
+    wireless_protection: Disable
+    web_proxy: Disable
+    user_portal: Disable
+    smtp_relay: Disable
+    snmp: Disable
+    state: updated
+- name: Update Facility Zone Admin Services
+  sophos.sophos_firewall.sfos_zone:
+    name: Facility
+    https: Disable
+    ssh: Disable
+    ad_sso: Disable
+    captive_portal: Disable
+    radius_sso: Disable
+    client_authen: Disable
+    chromebook_sso: Disable
+    ping: Enable
+    dns: Enable
+    ipsec: Disable
+    sslvpn: Disable
+    vpn_portal: Disable
+    red: Disable
+    wireless_protection: Disable
+    web_proxy: Disable
+    user_portal: Disable
+    smtp_relay: Disable
+    snmp: Disable
+    state: updated
+- name: Update VOIP Zone Admin Services
+  sophos.sophos_firewall.sfos_zone:
+    name: VOIP
+    https: Disable
+    ssh: Disable
+    ad_sso: Disable
+    captive_portal: Disable
+    radius_sso: Disable
+    client_authen: Disable
+    chromebook_sso: Disable
+    ping: Enable
+    dns: Enable
+    ipsec: Disable
+    sslvpn: Disable
+    vpn_portal: Disable
+    red: Disable
+    wireless_protection: Disable
+    web_proxy: Disable
+    user_portal: Disable
+    smtp_relay: Disable
+    snmp: Disable
+    state: updated
+- name: Add VLAN Interfaces
+  sophos.sophos_firewall.sfos_xmlapi:
+    xml_tag: VLAN
+    data: |
+      <VLAN>
+          <Name>{{ item.value.name }}</Name>
+          <Hardware>Port1</Hardware>
+          <Interface>Port1</Interface>
+          <Zone>{{ item.value.zone_name }}</Zone>
+          <VLANID>{{ item.value.vlan_id }}</VLANID>
+          <IPv4Configuration>Enable</IPv4Configuration>
+          <IPv4Assignment>Static</IPv4Assignment>
+          <IPAddress>{{ item.value.ip_address }}</IPAddress>
+          <Netmask>{{ item.value.subnetmask }}</Netmask>
+      </VLAN>
+    state: present
+  loop: '{{ vlan_interfaces | dict2items }}'
+  loop_control:
+    label: '{{ item.key }} -> VLAN {{ item.value.vlan_id }}'
+- name: Erstelle 'LAN_to_WAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: LAN_to_WAN
+    action: accept
+    description: Erlaubt Zugriff von LAN auf WAN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - LAN
+    dst_zones:
+      - WAN
+    src_networks:
+      - '{{ network_objects.office.name }}'
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'Server_to_WAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: Server_to_WAN
+    action: accept
+    description: Erlaubt Zugriff von Server auf WAN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - Server
+    dst_zones:
+      - WAN
+    src_networks:
+      - '{{ network_objects.server.name }}'
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'Management_to_WAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: Management_to_WAN
+    action: accept
+    description: Erlaubt Zugriff von Management auf WAN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - Management
+    dst_zones:
+      - WAN
+    src_networks:
+      - '{{ network_objects.management.name }}'
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'Guest_to_WAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: Guest_to_WAN
+    action: accept
+    description: Erlaubt Zugriff von Guest auf WAN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - Guest
+    dst_zones:
+      - WAN
+    src_networks:
+      - '{{ network_objects.guest.name }}'
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'Facility_to_WAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: Facility_to_WAN
+    action: accept
+    description: Erlaubt Zugriff von Facility auf WAN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - Facility
+    dst_zones:
+      - WAN
+    src_networks:
+      - '{{ network_objects.facility.name }}'
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'VOIP_to_WAN' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: VOIP_to_WAN
+    action: accept
+    description: Erlaubt Zugriff von VOIP auf WAN
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - VOIP
+    dst_zones:
+      - WAN
+    src_networks:
+      - '{{ network_objects.voip.name }}'
+    dst_networks:
+      - Any
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'LAN_to_Management' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: LAN_to_Management
+    action: accept
+    description: Erlaubt Zugriff von LAN auf Management
+    log: enable
+    status: disable
+    position: bottom
+    src_zones:
+      - LAN
+    dst_zones:
+      - Management
+    src_networks:
+      - '{{ network_objects.office.name }}'
+    dst_networks:
+      - '{{ network_objects.management.name }}'
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'LAN_to_Server' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: LAN_to_Server
+    action: accept
+    description: Erlaubt Zugriff von LAN auf Server
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - LAN
+    dst_zones:
+      - Server
+    src_networks:
+      - '{{ network_objects.office.name }}'
+    dst_networks:
+      - '{{ network_objects.server.name }}'
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'LAN_to_Facility' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: LAN_to_Facility
+    action: accept
+    description: Erlaubt Zugriff von LAN auf Facility
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - LAN
+    dst_zones:
+      - Facility
+    src_networks:
+      - '{{ network_objects.office.name }}'
+    dst_networks:
+      - '{{ network_objects.facility.name }}'
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'LAN_to_VOIP' Firewall-Regel
+  sophos.sophos_firewall.sfos_firewall_rule:
+    name: LAN_to_VOIP
+    action: accept
+    description: Erlaubt Zugriff von LAN auf VOIP
+    log: enable
+    status: enable
+    position: bottom
+    src_zones:
+      - LAN
+    dst_zones:
+      - VOIP
+    src_networks:
+      - '{{ network_objects.office.name }}'
+    dst_networks:
+      - '{{ network_objects.voip.name }}'
+    service_list:
+      - Any
+    state: present
+- name: Erstelle 'X to Management' Firewall-Regel Gruppe
+  sophos.sophos_firewall.sfos_firewall_rulegroup:
+    name: X to Management
+    description: Zugriff auf Management-Netz
+    policy_list:
+      - LAN_to_Management
+    policy_type: Any
+    source_zones:
+      - Any
+    dest_zones:
+      - Management
+    state: present
+- name: Erstelle 'X to Server' Firewall-Regel Gruppe
+  sophos.sophos_firewall.sfos_firewall_rulegroup:
+    name: X to Server
+    description: Zugriff auf Server-Netz
+    policy_list:
+      - LAN_to_Server
+    policy_type: Any
+    source_zones:
+      - Any
+    dest_zones:
+      - Server
+    state: present
+- name: Erstelle 'X to Facility' Firewall-Regel Gruppe
+  sophos.sophos_firewall.sfos_firewall_rulegroup:
+    name: X to Facility
+    description: Zugriff auf Facility-Netz
+    policy_list:
+      - LAN_to_Facility
+    policy_type: Any
+    source_zones:
+      - Any
+    dest_zones:
+      - Facility
+    state: present
+- name: Erstelle 'X to VOIP' Firewall-Regel Gruppe
+  sophos.sophos_firewall.sfos_firewall_rulegroup:
+    name: X to VOIP
+    description: Zugriff auf VOIP-Netz
+    policy_list:
+      - LAN_to_VOIP
+    policy_type: Any
+    source_zones:
+      - Any
+    dest_zones:
+      - VOIP
+    state: present
+- name: Erstelle 'X to WAN' Firewall-Regel Gruppe
+  sophos.sophos_firewall.sfos_firewall_rulegroup:
+    name: X to WAN
+    description: X to WAN group
+    policy_list:
+      - LAN_to_WAN
+      - Server_to_WAN
+      - Management_to_WAN
+      - Guest_to_WAN
+      - Facility_to_WAN
+      - VOIP_to_WAN
+    policy_type: Any
+    source_zones:
+      - Any
+    dest_zones:
+      - WAN
+    state: present
diff --git a/roles/system_detect_roles/README.md b/roles/system_detect_roles/README.md
new file mode 100644
index 0000000..4cb6339
--- /dev/null
+++ b/roles/system_detect_roles/README.md
@@ -0,0 +1,31 @@
+# system_detect_roles
+
+Operator defaults are intentionally low-precedence; inventory and explicit run options may override them.
+
+```yaml
+---
+# Windows feature & service identifiers
+ad_ds_feature_name: AD-Domain-Services
+dhcp_windows_service_name: DHCPServer
+veeam_services:
+  vbr: VeeamBackupSvc
+  vbo: Veeam.Archiver.Service
+  em: VeeamEnterpriseManagerSvc
+unifi_linux_services:
+  - unifi
+  - unifi.service
+unifi_linux_packages:
+  - unifi
+want_linux_check_certificate: false
+want_windows_citrix: false
+want_windows_surebackup: false
+want_windows_backup: false
+```
+
+## Structured result integration
+
+Current reporting behavior and field semantics are specified in
+[scripts/docs/OPERATION_RESULTS.md](../../scripts/docs/OPERATION_RESULTS.md).
+The calling catalog playbook owns publication; helper roles do not implicitly export
+arbitrary facts, module results or debug data. Existing defaults above retain their
+precedence. See the current validation/sanity documents before using the new candidate.
diff --git a/roles/system_detect_roles/defaults/main.yml b/roles/system_detect_roles/defaults/main.yml
new file mode 100644
index 0000000..d0669ec
--- /dev/null
+++ b/roles/system_detect_roles/defaults/main.yml
@@ -0,0 +1,17 @@
+---
+# Windows feature & service identifiers
+ad_ds_feature_name: AD-Domain-Services
+dhcp_windows_service_name: DHCPServer
+veeam_services:
+  vbr: VeeamBackupSvc
+  vbo: Veeam.Archiver.Service
+  em: VeeamEnterpriseManagerSvc
+unifi_linux_services:
+  - unifi
+  - unifi.service
+unifi_linux_packages:
+  - unifi
+want_linux_check_certificate: false
+want_windows_citrix: false
+want_windows_surebackup: false
+want_windows_backup: false
diff --git a/roles/system_detect_roles/tasks/main.yml b/roles/system_detect_roles/tasks/main.yml
new file mode 100644
index 0000000..bbcd938
--- /dev/null
+++ b/roles/system_detect_roles/tasks/main.yml
@@ -0,0 +1,132 @@
+---
+# Read-only capability discovery. This does not assign inventory groups.
+- name: Windows | Detect AD DS feature (DC)
+  when: ansible_facts['os_family'] == "Windows"
+  ansible.windows.win_feature_info:
+    name: '{{ ad_ds_feature_name | default(''AD-Domain-Services'') }}'
+  register: _win_dc_feature
+  failed_when: false
+- name: 'Windows | Fallback: check NTDS service (DC)'
+  when: ansible_facts['os_family'] == "Windows"
+  ansible.windows.win_service_info:
+    name: NTDS
+  register: _win_ntds_svc
+  failed_when: false
+- name: Windows | Check DHCP service
+  when: ansible_facts['os_family'] == "Windows"
+  ansible.windows.win_service_info:
+    name: '{{ dhcp_windows_service_name | default(''DHCPServer'') }}'
+  register: _win_dhcp_svc
+  failed_when: false
+- name: Windows | Check Veeam VBR service
+  when: ansible_facts['os_family'] == "Windows"
+  ansible.windows.win_service_info:
+    name: '{{ veeam_services.vbr | default(''VeeamBackupSvc'') }}'
+  register: _veeam_vbr
+  failed_when: false
+- name: Windows | Check Veeam VBO service
+  when: ansible_facts['os_family'] == "Windows"
+  ansible.windows.win_service_info:
+    name: '{{ veeam_services.vbo | default(''Veeam.Archiver.Service'') }}'
+  register: _veeam_vbo
+  failed_when: false
+- name: Windows | Check Veeam Enterprise Manager service
+  when: ansible_facts['os_family'] == "Windows"
+  ansible.windows.win_service_info:
+    name: '{{ veeam_services.em | default(''VeeamEnterpriseManagerSvc'') }}'
+  register: _veeam_em
+  failed_when: false
+- name: Windows | Detect Hyper-V feature
+  when: ansible_facts['os_family'] == "Windows"
+  ansible.windows.win_feature_info:
+    name: '{{ hyperv_feature_name | default(''Hyper-V'') }}'
+  register: _win_hyperv_feature
+  failed_when: false
+- name: 'Windows | Fallback: check Hyper-V VMMS service'
+  when: ansible_facts['os_family'] == "Windows"
+  ansible.windows.win_service_info:
+    name: '{{ hyperv_vmms_service_name | default(''vmms'') }}'
+  register: _win_hyperv_vmms_svc
+  failed_when: false
+- name: Windows | Set Veeam/DC/DHCP booleans (base)
+  when: ansible_facts['os_family'] == "Windows"
+  ansible.builtin.set_fact:
+    is_dc: |-
+      {{
+        (
+          (_win_dc_feature.features | default([]))
+          | selectattr('installed')
+          | list
+          | length > 0
+        )
+        or
+        (_win_ntds_svc.exists | default(false))
+      }}
+    is_dhcp_server: '{{ _win_dhcp_svc.exists | default(false) }}'
+    has_veeam_vbr: '{{ _veeam_vbr.exists | default(false) }}'
+    has_veeam_vbo: '{{ _veeam_vbo.exists | default(false) }}'
+    has_veeam_em: '{{ _veeam_em.exists | default(false) }}'
+    is_hyperv_host: |-
+      {{
+        (
+          (_win_hyperv_feature.features | default([]))
+          | selectattr('installed')
+          | list
+          | length > 0
+        )
+        or
+        (_win_hyperv_vmms_svc.exists | default(false))
+      }}
+- name: Windows | Debug summary
+  when:
+    - ansible_facts['os_family'] == "Windows"
+    - aim_debug | default(false) | bool
+  ansible.builtin.debug:
+    msg:
+      is_dc: '{{ is_dc }}'
+      is_dhcp_server: '{{ is_dhcp_server }}'
+      has_veeam_vbr: '{{ has_veeam_vbr }}'
+      has_veeam_vbo: '{{ has_veeam_vbo }}'
+      has_veeam_em: '{{ has_veeam_em }}'
+      is_hyperv_host: '{{ is_hyperv_host }}'
+- name: Linux | Collect service facts
+  when: ansible_facts['os_family'] != "Windows"
+  ansible.builtin.service_facts: null
+- name: Linux | Collect package facts
+  when: ansible_facts['os_family'] != "Windows"
+  ansible.builtin.package_facts:
+    manager: auto
+- name: Linux | Set UniFi flags
+  when: ansible_facts['os_family'] != "Windows"
+  vars:
+    svcs: '{{ ansible_facts.services | default({}) }}'
+    pkgs: '{{ ansible_facts.packages | default({}) | list }}'
+  ansible.builtin.set_fact:
+    is_unifi_controller: |-
+      {{
+        (unifi_linux_services | select('in', svcs.keys()) | list | length > 0)
+        or
+        (pkgs | intersect(unifi_linux_packages) | length > 0)
+      }}
+    is_unifi_os_server: |-
+      {{
+        'uosserver.service' in svcs
+      }}
+- name: Linux | Debug summary
+  when:
+    - ansible_facts['os_family'] != "Windows"
+    - aim_debug | default(false) | bool
+  ansible.builtin.debug:
+    msg:
+      is_unifi_controller: '{{ is_unifi_controller }}'
+      is_unifi_os_server: '{{ is_unifi_os_server }}'
+- name: Normalize detection booleans
+  ansible.builtin.set_fact:
+    is_dc: '{{ is_dc | default(false) }}'
+    is_dhcp_server: '{{ is_dhcp_server | default(false) }}'
+    has_veeam_vbr: '{{ has_veeam_vbr | default(false) }}'
+    has_veeam_vbo: '{{ has_veeam_vbo | default(false) }}'
+    has_veeam_em: '{{ has_veeam_em | default(false) }}'
+    is_unifi_controller: '{{ is_unifi_controller | default(false) }}'
+    is_unifi_os_server: '{{ is_unifi_os_server | default(false) }}'
+    is_hyperv_host: '{{ is_hyperv_host | default(false) }}'
diff --git a/scripts/AIM-WinRM-OneTime.ps1 b/scripts/AIM-WinRM-OneTime.ps1
new file mode 100644
index 0000000..4c3348d
--- /dev/null
+++ b/scripts/AIM-WinRM-OneTime.ps1
@@ -0,0 +1,198 @@
+$ErrorActionPreference = 'Stop'
+
+Write-Host 'Configuring WinRM for Ansible...'
+
+# ---------------------------------------------------------------------------
+# Configuration
+# ---------------------------------------------------------------------------
+
+$certificateFriendlyName = 'WinRM'
+$firewallRuleName = 'Windows Remote Management (HTTPS-In)'
+
+# Optional additional DNS names or IP addresses, e.g. NAT / bitconnect addresses.
+$additionalSANs = @(
+    # '192.168.100.10'
+    # 'server.example.lan'
+)
+
+# ---------------------------------------------------------------------------
+# Enable WinRM
+# ---------------------------------------------------------------------------
+
+Write-Host 'Enabling WinRM...'
+winrm quickconfig -quiet
+Set-Service -Name WinRM -StartupType Automatic
+if ((Get-Service -Name WinRM).Status -ne 'Running') {
+    Start-Service -Name WinRM
+}
+
+# ---------------------------------------------------------------------------
+# Determine host names and IP addresses
+# ---------------------------------------------------------------------------
+
+$hostName = $env:COMPUTERNAME
+$computerSystem = Get-CimInstance Win32_ComputerSystem
+$domain = $computerSystem.Domain
+
+$hostIPs = @(
+    Get-NetIPAddress -AddressFamily IPv4 -ErrorAction SilentlyContinue |
+        Where-Object {
+            $_.IPAddress -notlike '127.*' -and
+            $_.IPAddress -notlike '169.254.*'
+        } |
+        Select-Object -ExpandProperty IPAddress -Unique
+)
+
+if (-not $hostIPs) {
+    throw 'No usable IPv4 address found for WinRM certificate creation.'
+}
+
+$certificateNames = @($hostName)
+if ($computerSystem.PartOfDomain -and -not [string]::IsNullOrWhiteSpace($domain)) {
+    $certificateNames += "$hostName.$domain"
+}
+$certificateNames += $hostIPs
+$certificateNames += $additionalSANs
+$certificateNames = @(
+    $certificateNames |
+        Where-Object { -not [string]::IsNullOrWhiteSpace($_) } |
+        Select-Object -Unique
+)
+
+Write-Host 'Certificate SANs:'
+$certificateNames | ForEach-Object { Write-Host "  - $_" }
+
+# ---------------------------------------------------------------------------
+# Find or create WinRM certificate
+# ---------------------------------------------------------------------------
+
+$cert = Get-ChildItem 'Cert:\LocalMachine\My' |
+    Where-Object {
+        $_.FriendlyName -eq $certificateFriendlyName -and
+        $_.NotAfter -gt (Get-Date).AddDays(30)
+    } |
+    Sort-Object NotAfter -Descending |
+    Select-Object -First 1
+
+if (-not $cert) {
+    Write-Host 'Creating self-signed WinRM certificate...'
+
+    $certCommand = Get-Command New-SelfSignedCertificate -ErrorAction Stop
+    $certParams = @{ DnsName = $certificateNames }
+
+    if ($certCommand.Parameters.ContainsKey('CertStoreLocation')) {
+        $certParams['CertStoreLocation'] = 'Cert:\LocalMachine\My'
+    }
+    if ($certCommand.Parameters.ContainsKey('FriendlyName')) {
+        $certParams['FriendlyName'] = $certificateFriendlyName
+    }
+    if ($certCommand.Parameters.ContainsKey('TextExtension')) {
+        $certParams['TextExtension'] = '2.5.29.37={text}1.3.6.1.5.5.7.3.1'
+    }
+
+    try {
+        $cert = New-SelfSignedCertificate @certParams
+    }
+    catch {
+        if ($_.CategoryInfo.Reason -ne 'InvalidStorePathException' -or -not $certParams.ContainsKey('CertStoreLocation')) {
+            throw
+        }
+
+        # Windows Server 2012 R2 / PowerShell 4 can expose CertStoreLocation but
+        # reject the valid Cert:\LocalMachine\My argument. The compatibility
+        # path is to run the cmdlet while the certificate provider is in that store.
+        Write-Host 'Legacy certificate-store behavior detected; retrying in compatibility mode.'
+        $certParams.Remove('CertStoreLocation')
+        Push-Location 'Cert:\LocalMachine\My'
+        try {
+            $cert = New-SelfSignedCertificate @certParams
+        }
+        finally {
+            Pop-Location
+        }
+    }
+
+    if ($cert.FriendlyName -ne $certificateFriendlyName) {
+        try {
+            $cert.FriendlyName = $certificateFriendlyName
+        }
+        catch {
+            Write-Warning 'Certificate was created, but its friendly name could not be set. Future runs may create a replacement certificate.'
+        }
+    }
+}
+else {
+    Write-Host 'Existing WinRM certificate found.'
+}
+
+if (-not $cert.Thumbprint) {
+    throw 'WinRM certificate does not contain a valid thumbprint.'
+}
+Write-Host "Certificate thumbprint: $($cert.Thumbprint)"
+
+# ---------------------------------------------------------------------------
+# Configure HTTPS listener
+# ---------------------------------------------------------------------------
+
+$httpsListener = Get-ChildItem WSMan:\localhost\Listener |
+    Where-Object { $_.Keys -contains 'Transport=HTTPS' } |
+    Select-Object -First 1
+
+if (-not $httpsListener) {
+    Write-Host 'Creating WinRM HTTPS listener...'
+    New-Item -Path WSMan:\localhost\Listener -Transport HTTPS -Address * -CertificateThumbPrint $cert.Thumbprint -Force | Out-Null
+}
+else {
+    Write-Host 'WinRM HTTPS listener already exists.'
+}
+
+# ---------------------------------------------------------------------------
+# Configure firewall
+# ---------------------------------------------------------------------------
+
+$firewallRule = Get-NetFirewallRule -DisplayName $firewallRuleName -ErrorAction SilentlyContinue
+if (-not $firewallRule) {
+    Write-Host 'Creating WinRM HTTPS firewall rule...'
+    New-NetFirewallRule -DisplayName $firewallRuleName -Direction Inbound -Protocol TCP -LocalPort 5986 -Action Allow -Program System | Out-Null
+}
+else {
+    Write-Host 'WinRM HTTPS firewall rule already exists.'
+    Enable-NetFirewallRule -DisplayName $firewallRuleName | Out-Null
+}
+
+# ---------------------------------------------------------------------------
+# Non-domain systems
+# ---------------------------------------------------------------------------
+
+if (-not $computerSystem.PartOfDomain) {
+    Write-Host 'Non-domain system detected.'
+    Write-Host 'Enabling remote administrative token for local accounts...'
+    New-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'LocalAccountTokenFilterPolicy' -PropertyType DWord -Value 1 -Force | Out-Null
+}
+
+# ---------------------------------------------------------------------------
+# Verification
+# ---------------------------------------------------------------------------
+
+Write-Host ''
+Write-Host 'Verifying WinRM configuration...'
+
+$listener = Get-ChildItem WSMan:\localhost\Listener |
+    Where-Object { $_.Keys -contains 'Transport=HTTPS' } |
+    Select-Object -First 1
+if (-not $listener) {
+    throw 'WinRM HTTPS listener verification failed.'
+}
+
+$firewallRule = Get-NetFirewallRule -DisplayName $firewallRuleName -ErrorAction SilentlyContinue
+if (-not $firewallRule) {
+    throw 'WinRM firewall rule verification failed.'
+}
+if ((Get-Service WinRM).Status -ne 'Running') {
+    throw 'WinRM service is not running.'
+}
+
+Write-Host ''
+Write-Host 'WinRM configuration completed successfully.'
+Write-Host 'HTTPS port: 5986'
+Write-Host "Certificate: $($cert.Thumbprint)"
diff --git a/scripts/addons/webgui/.aim-web-managed b/scripts/addons/webgui/.aim-web-managed
new file mode 100644
index 0000000..0ea0a29
--- /dev/null
+++ b/scripts/addons/webgui/.aim-web-managed
@@ -0,0 +1 @@
+aim-webgui 2.1.0rc9
diff --git a/scripts/addons/webgui/.credentials b/scripts/addons/webgui/.credentials
new file mode 120000
index 0000000..bea50ef
--- /dev/null
+++ b/scripts/addons/webgui/.credentials
@@ -0,0 +1 @@
+/var/lib/aim/webgui/.credentials
\ No newline at end of file
diff --git a/scripts/addons/webgui/ADDON-INSTALLATION.md b/scripts/addons/webgui/ADDON-INSTALLATION.md
new file mode 100644
index 0000000..24b44fa
--- /dev/null
+++ b/scripts/addons/webgui/ADDON-INSTALLATION.md
@@ -0,0 +1,688 @@
+# AIM WebGUI Add-on Installation
+
+**Applies to:** AIM WebGUI 2.1.0rc9  
+**Required AIM Core:** 3.3.0rc8  
+**Core service / wire / event API:** 1.0  
+**Canonical Ansible Core:** 2.19.11, provided by the separately installed Core environment  
+**WebGUI HTTP API / database:** v2 / SQLite schema 5  
+**WebGUI Python:** Python 3.11+ with virtual-environment support  
+**Managed deployment:** Linux with systemd  
+**Prerequisite:** AIM Core 3.3.0rc8 `scripts/docs/INSTALLATION.md` (separately supplied Core guide)
+
+This guide continues after the Core installation guide. It installs a **new AIM WebGUI add-on on an already configured AIM controller**; it does not install AIM Core again. Complete Core installation, establish approved customer data, and accept a controlled terminal run before enabling WebGUI execution. Core remains usable without this add-on. [C1][C2]
+
+For an existing managed WebGUI installation, use [section 15](#15-updating-an-existing-add-on), not the fresh-install command. For a controller already running this exact add-on version, use the verification and acceptance sections; the deployer rejects a same-version reinstall. [W2]
+
+**Reading order:** fresh installations follow sections 1-13; backup, updates and recovery are in sections 14-17. The completion checklist is at the end.
+
+The commands below use `/etc/ansible`, the existing executor account `svc_bf-ansible`, and the default web account `aim-web`. These are the current release profile, not requirements to rename an established controller account. This document describes a release candidate and a source-checked procedure, not evidence that a new controller has passed live acceptance.
+
+## 1. Complete the Core prerequisite first
+
+Use Core's `INSTALLATION.md` for the source installation, dependency environments, canonical Ansible runtime, collections, controller configuration, inventories, Vaults and keys. Do not substitute the WebGUI virtual environment for either the AIM or Ansible environment. [C1, sections 1-12]
+
+Before continuing, establish:
+
+- `aim` and `aimctl` refer to the intended Core 3.3.0rc8 installation.
+- The AIM Python environment contains its declared dependencies, including the documented `rich>=13,<15` range.
+- The separately configured Ansible runtime contains exactly Core 2.19.11 and the approved collection/connection dependencies needed by the selected playbooks.
+- Core 3.3.0rc8 requires `ansible.windows >=3.8.0,<4.0.0` for Windows playbooks. Upgrade that collection deliberately in the canonical Core/Ansible collection path before accepting rc8; WebGUI does not install or upgrade it.
+- At least one approved test customer/host is available for the terminal and add-on acceptance run.
+- The non-root execution account is authorized by Core and has the required filesystem access.
+- Terminal AIM has completed an approved low-risk test independently of WebGUI.
+
+Check the installed commands:
+
+```bash
+command -v aim
+command -v aimctl
+aim --version
+aimctl --version
+```
+
+Both Core commands must report `3.3.0rc8`. A generic API version of `1.0` alone is not enough: this WebGUI candidate also checks its explicitly supported Core product version and capabilities. [W2][W3]
+
+For a fresh setup, leave this existing Core setting disabled while provisioning the add-on:
+
+```yaml
+addons:
+  execution_enabled: false
+```
+
+Merge configuration changes into `/etc/ansible/scripts/aim.yml`; do not replace the entire file. The final opt-in is covered in section 10. Discovery and installation of the add-on do not grant permission to execute jobs. [C1, sections 8 and 13]
+
+## 2. Confirm the two local service identities
+
+The managed topology uses two different non-root accounts: [W2][W4]
+
+| Component | Default account | Responsibility |
+|---|---|---|
+| `aim-web.service` | `aim-web` | HTTP, sessions, UI and private workflow database |
+| `aim-web-worker.service` | `aim-web` | Queue, authorization rechecks, journal/report persistence and credential handoff |
+| `aim-web-executor.service` | `svc_bf-ansible` | Fixed public `aimctl` calls and Core-owned native execution under that same UID |
+
+The WebGUI installer can create the local `aim-web` system account and group when absent. It **does not create the Core executor account or change its persistent group memberships**. The executor must already exist, must not be root, and must differ from the web account. [W2]
+
+Inspect the approved executor:
+
+```bash
+getent passwd svc_bf-ansible
+id svc_bf-ansible
+```
+
+The passwd/NSS home must be a reviewed, usable account home. The installer will create or normalize its `.ansible` and `.ansible/tmp` directories to executor-owned `0700`, in addition to the separate `/var/lib/aim-web-executor` tree. Review pre-existing shared uses or symlinks before applying; do not use installation as a general home-directory repair procedure. [W2][W4]
+
+Review Core's configured `required_group` and the account's active local/NSS memberships. Do not assume the example directory group in the Core installation guide or the local `aim-operators` group exists at every site. Provision authorization through the approved local/directory administration process, not through an add-on workaround. [C1][C2]
+
+The account needs access to the configured Core launcher/runtime, customer inventory and encrypted Vault, required role payloads and collections, and Core's cooperating customer-lock paths. In customer-key mode, the canonical private key must be an owner-only `0600` file owned by the execution UID. A key filename matching the account name does not establish ownership. [C2][C3]
+
+`service_user` is not a local UID switch. `runtime.private_key_owner` controls newly generated keys; it does not migrate an existing root-owned key or grant access. Existing-key migration is a separate, explicit Core/operator decision. Do not recursively change `/etc/ansible`, make private keys group-readable, or add the web account to root/operator groups to bypass this prerequisite. [C1, section 8][C2]
+
+The managed executor preserves its native primary group and receives the `aim-web` group for this service only. A normal interactive `sudo -u svc_bf-ansible` session therefore need not be able to read WebGUI's `root:aim-web 0640` configuration. That is not a reason to make it world-readable. [W4]
+
+## 3. Verify Core access as the executor
+
+First check metadata through the installed public launcher:
+
+```bash
+sudo -u svc_bf-ansible \
+  /usr/local/bin/aimctl \
+  --config /etc/ansible/scripts/aim.yml \
+  capabilities
+```
+
+Then check a protected operation:
+
+```bash
+printf '%s\n' '{"api_version":"1.0","operation":"list_customers"}' \
+  | sudo -u svc_bf-ansible \
+      /usr/local/bin/aimctl \
+      --config /etc/ansible/scripts/aim.yml \
+      request
+```
+
+`capabilities` is unguarded metadata; success there does not prove authorization. The customer-list response must also succeed. An empty list can be a valid discovery result, but it is not a completed managed-host acceptance test. [C3]
+
+The WebGUI integration expects the detailed progress, inventory hierarchy, target outcome, dual-home staging and operation-result contracts described by the current Core documentation. The installer probes live Core capabilities and protected customer discovery; do not edit a support snapshot or disable version checks to make an incompatible pair install. [C2][W2][W3]
+
+### Confirm runtime and collection visibility
+
+Use the executable configured in Core's `runtime.ansible_playbook`. For the separate environment shown in Core's fresh-install guide, the checks are:
+
+```bash
+sudo -u svc_bf-ansible \
+  /opt/ansible/venv/bin/ansible-playbook --version
+
+sudo -u svc_bf-ansible \
+  /opt/ansible/venv/bin/ansible-galaxy collection list
+  /opt/ansible/venv/bin/ansible-galaxy collection list ansible.windows
+```
+
+If Core was accepted with `/usr/bin/ansible-playbook`, use its corresponding runtime instead; do not create a replacement just for WebGUI. Sibling Vault/Galaxy tools and collection discovery must match the approved native runtime. [C1, sections 4-5][C3]
+
+For rc8, confirm the discovered `ansible.windows` version is at least 3.8.0 and below 4.0.0. Core advertises this floor in `capabilities.collection_baselines` and its readiness checks reject older versions before an affected playbook launches. Do not satisfy the check by installing a private collection visible only to root or to the WebGUI virtual environment.
+
+The collection-install command in the Core guide uses `sudo`. Verify discovery under the executor as well as root. Collections available only in root's private home do not establish executor access. Use Core's documented `runtime.ansible_collections_path` when an approved shared/nonstandard collection location is needed; WebGUI does not install collections or expose root's home. [C1, section 5][C3]
+
+These shell checks do not reproduce systemd restrictions. The installed executor's startup preflight and the real one-host test are still required.
+
+## 4. Review HTTPS, SSH trust and the shipped site profile
+
+### HTTPS and reverse proxy are prerequisites
+
+The WebGUI deployer does not install Nginx, Nginx Proxy Manager, certificates, CA trust or DNS. It serves HTTP on its configured backend listener; the approved reverse proxy provides the browser's HTTPS endpoint. [W1][W2]
+
+The bundled `deploy/webgui.example.toml` contains this **controller-specific** profile:
+
+| Setting | Shipped value |
+|---|---|
+| Backend | `127.0.0.1:8080` |
+| Browser origin | `https://aim.desq-gaming.de` |
+| Immediate trusted proxy | `127.0.0.1` |
+| Referenced upstream topology | NPM `192.168.20.3` -> verified HTTPS controller `192.168.20.46:8443` -> local Nginx -> loopback HTTP |
+| WebGUI execution / credential entry | Enabled |
+| Independent approval | Disabled |
+| Eligible playbooks | The 14 explicit catalog keys in the shipped profile |
+| Maximum requested hosts / execution timeout | 25 / 1,800 seconds |
+| `transport_verified` | `true`, representing this site's operator attestation |
+
+An allowlist does not establish that every playbook is executable or appropriate at the site. `transport_verified=true` does not provision or test TLS. Review the actual proxy path and trust before using these values. [W1][W5]
+
+The `public_url` must be the exact browser origin: scheme, hostname and optional port, with no path or trailing slash. The trusted-proxy list identifies the immediate backend proxy, not the browser's remote address. Execution rejects wildcard proxy trust. [W5]
+
+`deploy/nginx.example.conf` is a header reference, not an installable complete TLS server configuration. Preserve the browser Host and forwarded scheme through the approved proxy chain and verify streaming. WebGUI uses authenticated SSE, not WebSockets. No certificate setup or unverified replacement proxy configuration is supplied by this guide. [W1][W5][W9]
+
+### Other sites: an explicit configuration gate
+
+Do not treat the shipped domain, IP addresses or transport attestation as generic defaults.
+
+The current deployer can select the Core launcher/configuration and account names, but **has no `--profile`, `--config-file` or public-origin override argument**. It replaces the whole installed TOML from its release template during install/update and restores the checkpoint's configuration on rollback. Editing the extracted template invalidates its manifest. [W2]
+
+For repeatable release-managed deployment, obtain a reviewed release profile matching the new site. An operator can edit the installed `/etc/ansible/scripts/config/webgui.toml` before exposing it, but that is a **local override, not a durable site-profile mechanism**; the next managed update replaces it. Keep Core execution disabled and public ingress closed during any such adaptation. Preserve the managed state/socket paths and review account/path choices rather than copying a complete unrelated configuration.
+
+If credentials or execution are disabled locally, disable `[credentials].enabled` before or together with `[execution].enabled`. The configuration validator does not allow credential entry without enabled execution and verified HTTPS. Run `sudo aim-web config-check` after editing; it validates settings, not certificates. Configuration is loaded by the service processes: apply edits in a quiesced window and restart the appropriate services before exposing the site. Leave the worker stopped/disabled when execution is intentionally disabled. [W5]
+
+### SSH host trust is a separate prerequisite
+
+For Linux/SSH targets, the executor needs independently verified host trust for the effective connection destination. The inventory's logical hostname may differ from the actual `ansible_host` address.
+
+The existing approved controller-wide `/etc/ssh/ssh_known_hosts` arrangement can be retained. WebGUI does not enroll keys, overwrite that file or automatically copy root's personal trust decisions. Do not infer OpenSSH's effective user known-hosts path solely from the executor's substituted `HOME`. Review the effective SSH configuration and account context instead. [W4]
+
+Windows WinRM connectivity, credentials, transport dependencies and certificate policy remain the independently accepted Core/operator configuration. Do not disable TLS or SSH verification to pass add-on acceptance. [C1][C3]
+
+## 5. Obtain and verify the WebGUI release
+
+Transfer both files through a trusted channel:
+
+```text
+AIM-WebGUI-2.1.0rc9.zip
+AIM-WebGUI-2.1.0rc9.zip.sha256
+```
+
+Stage outside the active add-on and Core source directories:
+
+```bash
+cd /var/tmp
+sha256sum -c AIM-WebGUI-2.1.0rc9.zip.sha256
+unzip AIM-WebGUI-2.1.0rc9.zip
+cd aim-web-2.1.0rc9
+sha256sum -c MANIFEST.sha256
+```
+
+The expected ZIP SHA-256 is:
+
+```text
+bf0a6977d2672477bcb48c78b49085ff79e70195e780813b934d87ad334d7556
+```
+
+Use a new extraction directory, not a directory containing an older release. Never extract over `/etc/ansible/scripts/addons/webgui` or `/opt/aim-web/current`. A checksum verifies integrity, not publisher identity. The deployer additionally verifies manifest hashes, safe paths and required-file coverage. [W1][W2]
+
+Do not edit manifest-covered files, remove integrity checks or regenerate a manifest just to bypass a deployment error. This documentation companion is not an updated release ZIP and should be kept outside the verified extraction.
+
+## 6. Prepare WebGUI dependencies and inspect the deployer
+
+The controller must provide Linux/systemd, Python 3.11+ with `venv` support and administrative permission to perform installation. Inspect the local Python before running the installer:
+
+```bash
+python3 --version
+python3 -m venv --help
+python3 deploy/deploy.py --help
+```
+
+The WebGUI deployer creates its **own versioned virtual environment** and installs the declared WebGUI/build dependencies using the supplied `constraints.txt`. It does not run pip in AIM's environment, install Ansible, or install the test dependency extra. There is no need to pre-install FastAPI or pytest globally. [W2]
+
+If the deployment interpreter is not the Python intended for WebGUI, use the supported `--python /absolute/path/to/python3` option. Do not point it at an interpreter with an unsupported version. Separate environments can use the same Python installation without sharing package environments.
+
+The package is not a complete offline dependency bundle. A new installation needs approved package/asset access or prepared offline artifacts. Browser assets are the exact pinned Bootstrap 5.3.8 CSS and HTMX 2.0.10 JavaScript; the installer verifies their SHA-384 pins and serves them locally. Do not substitute fixture assets or a newer version. [W1][W8]
+
+For an offline installation, prepare wheels compatible with the chosen Python/OS/architecture, including constrained build dependencies, and an asset directory containing:
+
+```text
+bootstrap.min.css
+htmx.min.js
+```
+
+Pass the existing `--wheelhouse` and `--assets-dir` options in section 7. The detailed wheelhouse preparation depends on the operator's build environment; the supplied guide does not establish a universal offline-build recipe. [W1][W2]
+
+### Core and WebGUI deployers have different commands
+
+| Operation | Core guide | WebGUI 2.1.0rc9 |
+|---|---|---|
+| Preview | `install --dry-run` | No equivalent dry-run mode |
+| Fresh apply | `install --apply --quiesced` | `install` performs installation |
+| Existing add-on update | Not applicable | `update` |
+| Rollback selector | `--from-backup /path` | `--backup SNAPSHOT_ID` |
+
+Do **not** append Core's `--dry-run`, `--apply`, `--quiesced` or `--aim-python` options to the WebGUI deployer. Review its help, profile and source/documentation before applying. Its internal checks are not a whole-system no-write preview: preparatory add-on directories, dependencies or the web account may be created before a later failure. [C1][W2]
+
+An existing unrecognized installation, unrelated CLI link or unmanaged systemd drop-in stops deployment. Review and back up such files; do not delete overrides or disable guard checks blindly.
+
+## 7. Apply a fresh add-on installation
+
+Proceed only after the preceding Core, identity, profile and transport gates are satisfied. Do not run a Core source update or change its inventory/configuration concurrently.
+
+From the verified fresh extraction:
+
+```bash
+sudo python3 deploy/deploy.py install \
+  --aim-scripts /etc/ansible/scripts \
+  --service-user aim-web \
+  --executor-user svc_bf-ansible \
+  --aimctl /usr/local/bin/aimctl \
+  --core-config /etc/ansible/scripts/aim.yml
+```
+
+These options make the default binding explicit. The Core account and launcher must already exist. [W2]
+
+For the same installation using prepared offline artifacts, add:
+
+```bash
+sudo python3 deploy/deploy.py install \
+  --aim-scripts /etc/ansible/scripts \
+  --service-user aim-web \
+  --executor-user svc_bf-ansible \
+  --aimctl /usr/local/bin/aimctl \
+  --core-config /etc/ansible/scripts/aim.yml \
+  --wheelhouse /secure/wheelhouse \
+  --assets-dir /secure/aim-assets
+```
+
+The successful fresh-install sequence: [W2]
+
+1. Verify the release, stage dependencies/assets and probe public Core metadata as the executor.
+2. Create the web account if needed; create private WebGUI state and a protected deployment checkpoint.
+3. Install the reviewed TOML and provision the managed executor staging directories.
+4. Initialize schema 5 and the initial local administrator without resetting existing initialized accounts.
+5. Activate the full source/virtualenv and the `aim-web` launcher; write the three managed service units.
+6. Run executor startup checks, wait for its correctly permissioned socket, start HTTP and its local readiness check, and start the worker when the WebGUI execution setting is enabled.
+
+The deployer does not change Core's `addons.execution_enabled`, Core source, customer keys/Vaults, persistent executor group memberships, SSH trust or proxy certificates. The shipped profile starts the queue worker even when Core's independent execution opt-in is still false; that does not bypass the Core gate.
+
+Record the printed add-on source, configuration, checkpoint identifier and initial-credential location. They are needed for verification and recovery.
+
+### Nondefault layouts
+
+`--aim-scripts`, `--aimctl` and `--core-config` can bind the add-on to reviewed locations. They do not create an independent second WebGUI instance: `/opt/aim-web`, state paths, service names and the executor socket are fixed in this managed profile. The executor's inventory write exception also names `/etc/ansible/inventories`. A different inventory root or parallel installation needs a reviewed deployment profile; changing the CLI paths alone is insufficient. [W2]
+
+## 8. Verify the installed services and permissions
+
+Refresh command discovery:
+
+```bash
+hash -r
+command -v aim-web
+aim-web --version
+sudo aim-web config-check
+```
+
+Expected version:
+
+```text
+AIM WebGUI 2.1.0rc9 (AIM compatibility: 3.3.0rc8 / service API 1.0)
+```
+
+The installer supplies `/usr/local/bin/aim-web -> /opt/aim-web/current/bin/aim-web`; do not manually copy a versioned launcher over it. `config-check` validates TOML only and can run as root without opening the workflow database. [W2][W6]
+
+Check services and the actual startup preflight:
+
+```bash
+sudo systemctl status \
+  aim-web-executor.service \
+  aim-web.service \
+  aim-web-worker.service \
+  --no-pager
+
+sudo journalctl -u aim-web-executor.service -n 80 --no-pager
+
+systemctl show aim-web-executor.service \
+  -p User -p Group -p SupplementaryGroups
+```
+
+The intended executor identity is:
+
+```ini
+User=svc_bf-ansible
+Group=svc_bf-ansible
+SupplementaryGroups=aim-web
+```
+
+Numeric group IDs in `systemctl show` are acceptable when they resolve to the intended groups. Systemd may also initialize other account memberships; an empty explicit `SupplementaryGroups` field is not proof that the process has no supplementary groups. [W4]
+
+Inspect the managed paths, substituting the actual passwd/NSS home if different:
+
+```bash
+sudo stat -c '%U:%G %a %n' \
+  /var/lib/aim/webgui \
+  /var/lib/aim/webgui/webgui.sqlite3 \
+  /var/lib/aim-web-executor \
+  /var/lib/aim-web-executor/.ansible \
+  /var/lib/aim-web-executor/.ansible/tmp \
+  /home/svc_bf-ansible/.ansible \
+  /home/svc_bf-ansible/.ansible/tmp \
+  /run/aim-web-executor \
+  /run/aim-web-executor/core.sock \
+  /etc/ansible/scripts/config/webgui.toml
+```
+
+| Resource | Expected owner/group | Mode |
+|---|---|---|
+| WebGUI state directory | `aim-web:aim-web` | `0700` |
+| Workflow database | `aim-web:aim-web` | `0600` |
+| Executor state and process-home `.ansible/tmp` hierarchy | Executor:native primary group | `0700` |
+| Executor passwd-home `.ansible` and `.ansible/tmp` | Executor:native primary group | `0700` |
+| `/run/aim-web-executor` | Executor:native primary group | `0711` |
+| `core.sock` | Executor:`aim-web` | `0660` |
+| `webgui.toml` | `root:aim-web` | `0640` |
+| Managed unit files | `root:root` | `0644` |
+
+The runtime-directory traverse permission does not grant access to the private executor state or database. Socket permissions and peer checks govern IPC. These are checks of installer-managed state, not a recursive repair recipe. [W2][W4]
+
+### Both staging homes matter
+
+The executor sets `HOME=/var/lib/aim-web-executor`, but delegated local Ansible tasks can expand `~svc_bf-ansible` through the account database. The installer provisions both applicable staging paths and only their narrow write exceptions while retaining `ProtectHome=read-only`, `ProtectSystem=strict`, `NoNewPrivileges=true` and empty capabilities. [C1, section 11][W4]
+
+`ExecStartPre` runs `aim-web core-staging-check` inside the actual executor unit. Successful journal output followed by service startup is the relevant staging evidence. A plain interactive `sudo -u svc_bf-ansible aim-web core-staging-check` can fail to read the web-group configuration because it does not reproduce the unit's group context. A root invocation tests the wrong key/staging identity. Do not weaken file permissions to make those commands pass. [W4][W6]
+
+## 9. Open the HTTPS site and initialize administration
+
+Verify the approved proxy endpoint serves the correct installation with trusted HTTPS. For the shipped profile, the browser origin is:
+
+```text
+https://aim.desq-gaming.de
+```
+
+Do not use a raw LAN HTTP address as the browser origin or use disabled certificate validation as acceptance. No operational secret should be entered before transport has been accepted.
+
+Read the generated bootstrap credential file **locally**:
+
+```bash
+sudo cat /var/lib/aim/webgui/.credentials
+```
+
+The fresh administrator username is `admin`. The JSON file contains the generated password and is protected as service-owned private state; it is not served over HTTP. Do not paste it into tickets, chat, deployment logs or this documentation. [W6][W7]
+
+Sign in and perform the mandatory first password change. The application revokes the sessions for that account and invalidates/removes the bootstrap credential file after the password change. Sign in again with the new password as prompted. A later update or `init` command does not regenerate bootstrap credentials or reset an initialized administrator. [W7]
+
+Use User administration to establish named accounts and reviewed execution grants. An eligible administrator or a matching customer/playbook grant is required in addition to the configured allowlist and Core authorization. Job/history/report visibility is owner-or-admin; supplying one-run credentials remains requester-only. [W7][W9]
+
+Do not enable independent approval without providing a suitable separate approver. The shipped single-administrator site profile has `require_approval=false`; that does not bypass review of targets, mode, options or Core revisions.
+
+## 10. Accept local readiness, then enable Core execution deliberately
+
+Through the running add-on's executor:
+
+```bash
+sudo -u aim-web \
+  /opt/aim-web/current/bin/aim-web \
+  --config /etc/ansible/scripts/config/webgui.toml \
+  core-check
+```
+
+Confirm Core product version, live capabilities and authorized customer discovery. An `execution.enabled=false` value at this point is the expected independent Core gate. [C3][W6]
+
+For one existing approved Linux host with customer-key mode, replace the two literal identifiers before running:
+
+```bash
+sudo -u aim-web \
+  /opt/aim-web/current/bin/aim-web \
+  --config /etc/ansible/scripts/config/webgui.toml \
+  core-check \
+  --customer CUSTOMER \
+  --playbook debug_test_connection \
+  --host HOST \
+  --key-mode customer
+```
+
+For a Windows/native-inventory test use `--key-mode none`. This is not forced password authentication. The CLI readiness request uses check mode and performs local preparation/runtime checks; it does not submit a job, unlock Vault, verify remote credentials or prove remote connectivity. [C3][W6]
+
+Once Core terminal, transport, executor identity and local staging/readiness have been accepted, edit **Core's existing** configuration:
+
+```bash
+sudoedit /etc/ansible/scripts/aim.yml
+```
+
+Merge the approved opt-in, without creating a duplicate `addons` block:
+
+```yaml
+addons:
+  execution_enabled: true
+```
+
+Leave Core's accepted `runtime.ansible_playbook`, collection path, key-owner and other controller settings intact. Re-run `aim-web core-check` as `aim-web` and confirm that effective Core execution is now enabled. [C1, section 13][C3]
+
+The gates remain separate:
+
+```text
+Core addons.execution_enabled
+    + WebGUI execution/credential/transport policy
+    + eligible playbook and host limit
+    + enabled account/grant and any required approval
+    + fresh reviewed Core revision
+    + worker readiness and required one-run credentials
+    = an eligible execution request
+```
+
+No single `true` setting proves successful or safe managed-host execution.
+
+## 11. Run the first controlled end-to-end test
+
+Use a small approved scope. For a reporting acceptance test, **Detected host roles** is the Core guide's suggested starting operation. [C1, section 14][C4]
+
+In the browser:
+
+```text
+New run
+  -> Select the test customer and Detected host roles
+  -> Select one approved host
+  -> Review options, Apply/Check mode and key handling
+  -> Review the normalized scope, warnings and report contract
+  -> Confirm and Run once
+  -> Unlock this run when the worker is ready
+```
+
+A saved plan is optional. For an encrypted Linux customer key, choose customer-key loading; the credential modal can use the Vault-stored passphrase where Core permits it. Windows/native-inventory runs do not need a Linux customer key. Only fields requested by Core are offered. A supplied connection password is a native default, not an override of inventory credentials. [C3][W9]
+
+The modal's acceptance message means the handoff was accepted, not that a password was verified. The empty reservation lasts five minutes, followed by the existing bounded handoff/start interval. Each new attempt needs fresh credentials; never put passwords in CLI arguments, URLs, plans, config examples or a queued record. [W9]
+
+Check all three result dimensions:
+
+| Dimension | What to inspect |
+|---|---|
+| Core verdict | Status, stage, native exit and whether remote work may have started |
+| Target outcomes | Each reviewed host's authoritative final outcome and counters |
+| Operation report | Schema, availability, retained content and Apply/Check meaning |
+
+The role report should expose `host_capabilities_v1` with the eight declared booleans. A missing report is not eight false values. A successful native exit can still produce `failed / result_validation` when required output is missing or invalid. Do not rerun automatically: remote changes may already be complete. [C3][C4][W9]
+
+For a longer approved run, close/reopen the job, reload and check from another authorized device. Confirm recorded progress survives and new events continue without replaying execution or requesting the same credentials again. Validate Reports after finalization and verify the host activity link. No total-task percentage or ETA is promised.
+
+After the first success, use Core's `SANITY.md` and WebGUI's `docs/CONTROLLER-PILOT.md` for separately approved Windows/Linux, mixed-result, cancellation, recovery and reporting cases. Updating packages, rebooting, starting services, exporting logs or deleting files needs its own test scope. One successful role query does not qualify every playbook. [C4][W10]
+
+## 12. Review retention and storage capacity
+
+Schema 5 stores accounts/workflows plus job-linked progress and operation reports. The shipped limits are: [W1][W9]
+
+```toml
+[journal]
+max_events = 20000
+max_bytes = 8388608
+
+[reports]
+max_bytes = 16777216
+retain_configuration = false
+```
+
+The progress limit retains a bounded tail, not a complete raw terminal transcript. Omissions and capture gaps are disclosed. Report limits also remain subject to Core/catalog caps. Full parsed Checkmk configuration sections are not retained by default; availability/file/redaction metadata remain with a metadata-only label. Enabling full retention is a separate operator data decision and applies to future captured reports.
+
+Deleting a job removes its journal and report rows and its contribution to the displayed host history. A compact audit deletion event remains. Existing backups have their own retention policy; deleting a job is not physical erasure of backups or storage remnants. Only WebGUI-owned retained runs contribute to Host Activity and Insights. [W9]
+
+Allow space for the database, journals/reports, protected backups and multiple versioned virtual environments. The sources do not specify a universal minimum disk or memory size; capacity depends on retained jobs and report sizes. Monitor it rather than treating per-job limits as a total database cap.
+
+The full `webgui.toml` is release-managed. Local policy edits are overwritten on a later managed update unless incorporated into the next reviewed release profile. [W1]
+
+## 13. Know the managed layout and ownership boundary
+
+```text
+/usr/local/bin/aim-web                  -> /opt/aim-web/current/bin/aim-web
+/opt/aim-web/current                    -> selected versioned virtual environment
+/opt/aim-web/venvs/                     versioned add-on environments
+/opt/aim-web/deployment.json            active deployment metadata
+/opt/aim-web/pending.json               interrupted/in-progress deployment journal
+/etc/ansible/scripts/addons/webgui/     managed add-on source
+/etc/ansible/scripts/config/webgui.toml managed add-on configuration
+/var/lib/aim/webgui/                    private accounts, workflows and evidence DB
+/var/lib/aim-web-executor/              private executor process HOME/staging
+/run/aim-web-executor/core.sock         private group-accessible Core bridge
+/var/backups/aim-web/                   protected add-on deployment checkpoints
+```
+
+The passwd-home `.ansible` staging directories and the three systemd units are also release-managed as described above. An existing account-home `.ansible` parent is normalized to the managed owner-only policy; review shared/custom uses of that directory before installation. The whole home is not made writable inside the service. [W2][W4]
+
+Core source, `aim.yml`, inventories, Vaults, canonical keys, collection installation, global SSH trust and certificates remain outside the add-on installer. Core and add-on recovery data are different directories with different deployer commands. [C1][W1]
+
+### Patch-wave behavior after Core 3.3.0rc8
+
+The public catalog adds the Windows-only Continue patching after reboot option (catalog hint false), plus reboot message/delay. Blank controls inherit native inventory/role policy; the add-on never forces continuation on. A successful Windows wave can require another reviewed run. See [Patch waves](docs/PATCH-WAVES.md) before testing update/reboot behavior. Reports show pending/unknown, reboot-deferred and fixed per-update failure metadata without parsing raw output or creating follow-up jobs. Historical patch reports retain their recorded schema.
+
+## 14. Back up the add-on independently
+
+The deployer creates checkpoints during install/update. Maintain an operator backup policy in addition to those checkpoints, especially now that the database contains retained reports. Keep Core runtime/customer data backups separate. [W1]
+
+The supported database backup command uses SQLite's backup API. Run it as the database-owning web identity, with a **new, nonexisting** destination it can write:
+
+```bash
+BACKUP_FILE="/var/lib/aim/webgui/manual-backup-$(date -u +%Y%m%dT%H%M%SZ).sqlite3"
+
+sudo -u aim-web \
+  /opt/aim-web/current/bin/aim-web \
+  --config /etc/ansible/scripts/config/webgui.toml \
+  db backup "$BACKUP_FILE"
+```
+
+The backup is created as `0600`. Transfer it through the approved protected backup process, preserving confidentiality, and record the matching Core/WebGUI versions and configuration. Database contents include account hashes, session/workflow data and retained operational reports. A database backup alone is not the deployer's full source/configuration recovery checkpoint. [W6][W11]
+
+Do not use an uncoordinated live copy of `webgui.sqlite3` as a replacement for the SQLite backup operation. Do not install pytest into a production environment to perform an installation check.
+
+## 15. Updating an existing add-on
+
+For an existing compatible managed installation, use the **new release's** fresh extraction:
+
+```bash
+cd /var/tmp/aim-web-2.1.0rc9
+sudo python3 deploy/deploy.py update
+```
+
+Use this exact command only when moving from an earlier version to 2.1.0rc9; it is not a same-version refresh. Preserve the previously selected `--aim-scripts` and account options when they differ from defaults. [W2]
+
+When moving to Core 3.3.0rc8 from the older supported Core, finish/cancel work deliberately, stop submissions and quiesce terminal writers. Stop the add-on services before independently updating Core:
+
+```bash
+sudo systemctl stop \
+  aim-web-worker.service \
+  aim-web.service \
+  aim-web-executor.service
+```
+
+Follow Core's own preview/apply procedure, then deploy the compatible WebGUI release. Do not expect the older adapter to accept a newly installed Core automatically. [C1][W1]
+
+From WebGUI 2.1.0rc3, this update keeps SQLite schema 5: no new database migration or historical report rewrite. From a schema-4 baseline, the existing schema-5 migration remains (pending/queued work blocked, running work interrupted, stale reviews removed). Source/schema changes still require fresh review; do not replay an old prepared request. [W1]
+
+Ordinary 2.x updates do not need `--migrate-core`. That flag is reserved for the documented legacy 1.x integration/state migration and recognized key-export/capability retirement. Read `docs/MIGRATION-3.1.md` before using it. Never treat it as a general permission or version-check bypass.
+
+## 16. Recover without changing Core accidentally
+
+### Failed or interrupted installation/update
+
+Record the complete deployment error and printed checkpoint identifier. The deployer attempts recovery where a checkpoint exists; an incomplete recovery leaves `pending.json` to prevent ambiguous repeated installation. Keep services stopped until the failure and recovery state are understood. [W1][W2]
+
+For a recorded interrupted deployment, use the same release's extracted deployer:
+
+```bash
+cd /var/tmp/aim-web-2.1.0rc9
+sudo python3 deploy/deploy.py recover
+```
+
+`recover` is not a generic repair command: it requires the pending deployment journal. Do not delete that journal or switch the `current` symlink manually to bypass recovery.
+
+A failed first install preserves private state for deliberate recovery/retry; it does not automatically wipe accounts or generate another admin. A completed first-install checkpoint is not a prior installed version, and the rollback command rejects it. Inspect and preserve state instead of removing the database to force bootstrap. [W2][W7]
+
+### Roll back to a previous managed add-on
+
+After independently backing up current state and quiescing work, use the exact checkpoint **identifier**, not Core's `--from-backup` syntax:
+
+```bash
+sudo python3 deploy/deploy.py rollback \
+  --backup CHECKPOINT_ID
+```
+
+If the selected previous release requires schema 4, crossing back from schema 5 requires an explicit historical database restore:
+
+```bash
+sudo python3 deploy/deploy.py rollback \
+  --backup CHECKPOINT_ID \
+  --restore-auth-db
+```
+
+That can restore old password hashes and discard newer accounts, plans, jobs, journals and reports. Restored sessions are revoked. The backup ID must be one actually printed by this installation. [W1][W2]
+
+The restored adapter is checked against the installed Core. If incompatible, restored add-on services remain stopped and disabled. Core rollback is separate; after validating a matched Core/WebGUI/database combination, explicitly enable/start the intended services. Neither rollback reverses completed remote changes, dependency installation or independent account/trust decisions.
+
+### Disable the add-on
+
+After active work is finished or deliberately canceled:
+
+```bash
+sudo systemctl disable --now \
+  aim-web-worker.service \
+  aim-web.service \
+  aim-web-executor.service
+```
+
+This disables the three add-on units, not AIM terminal. It is not a data purge. There is no `uninstall` command in this deployer; retain private state and backups until a separately approved removal decision. [W2]
+
+## 17. Troubleshooting at the correct boundary
+
+| Symptom | First check / action |
+|---|---|
+| `No managed add-on installation exists` | Use `install` for a genuinely new add-on, not `update`. |
+| Missing manifest, coverage or hash error | Re-verify the published ZIP and use a fresh extraction. Do not disable the verifier. |
+| Unmanaged unit drop-in blocks deployment | Inspect the exact file and preserve it for review; do not blindly delete or reinstate older capability overrides. |
+| Root command reports unsafe database/staging ownership | Use the correct service identity or real executor startup context. Do not transfer service state to root. |
+| Manual executor command gives `PermissionError` on `webgui.toml`, but startup passed | The plain shell may lack the unit-scoped `aim-web` group. Inspect service journal and active identity. |
+| Web config says execution enabled, Core says disabled | Review Core's independent `addons.execution_enabled` opt-in. |
+| Missing collections or wrong native version | Fix the separately approved Core runtime/discovery as executor; do not pip-install Ansible into WebGUI. |
+| Customer key rejected | Inspect the selected canonical key's owner, `0600` mode and traversal as executor. `private_key_owner` does not migrate existing keys. |
+| Delegated controller task becomes `UNREACHABLE` | Inspect actual task/delegation and both staging paths inside the sandbox before blaming WinRM. |
+| Linux trust failure despite root terminal success | Review effective executor SSH trust and actual destination; retain the approved global trust file. |
+| Browser origin/security-token rejection | Check the exact HTTPS origin, immediate proxy/header chain, current page/session and clock. Do not disable CSRF. |
+| Queued job never asks for credentials | Check worker activity, Core execution policy, approval/schedule and current job state. Only its requester gets the modal. |
+| Native exit 0 but failed at `result_validation` | Inspect report availability/schema. Remote work may have completed; no automatic replay. |
+| Empty old timeline/report | Pre-capture history is not reconstructed. Check the job's version and capture/retention markers. |
+| `pending.json` blocks another deployment | Investigate and use the same deployer's recorded recovery path. |
+
+Start with version/status/configuration checks, the specific job's structured facts and the relevant service journal. Do not share passwords, full inventories/Vault dumps or unrestricted configuration/report bodies in diagnostics. Local Ansible/module logging may contain operational details even though the WebGUI journal excludes raw output. [C4][W1][W9]
+
+## Fresh add-on completion checklist
+
+Before broader operational use confirm:
+
+- Core's prerequisite installation and controlled terminal acceptance are complete.
+- The WebGUI ZIP checksum and release manifest pass, and the current profile fits the site.
+- The existing executor is independently authorized and can discover the intended Core runtime/collections.
+- HTTPS/proxy trust is accepted; no placeholder origin or unverified transport attestation was reused.
+- Fresh installation used `install`, or a real managed upgrade used `update`.
+- All three expected services start, and executor startup checks pass inside their actual sandbox.
+- Account/group, socket, configuration, state and dual-home staging match the managed policy.
+- The bootstrap admin password has been changed and appropriate named accounts/grants reviewed.
+- Core add-on execution was enabled only through the separate operator opt-in.
+- A small approved end-to-end run has accepted credentials, native outcomes and its declared report.
+- Reload/second-device progress and finished-job evidence behave correctly without replaying work.
+- Report retention, protected backups, storage growth and recovery checkpoints have been reviewed.
+- Candidate acceptance is recorded by actual UID/sandbox/runtime/platform; unsupported or untested cases are not claimed as passed.
+- Terminal AIM remains independently usable.
+
+## Related documentation and source basis
+
+This companion preserves the prerequisite boundary and terminology of the supplied Core guide. Add-on-specific commands and paths were checked against the published WebGUI archive. Core's installation guide has not been edited. This companion is updated with the add-on release; it is not a claim of a performed controller installation.
+
+| Reference | Source | What it governs |
+|---|---|---|
+| C1 | Core `scripts/docs/INSTALLATION.md`, AIM 3.3.0rc8 | Prerequisite Core installation, independent environments, opt-in, terminal acceptance and Core recovery |
+| C2 | Core `ADDON_AGENTS.md` | Same-UID public integration, ownership and hardening boundaries |
+| C3 | Core `scripts/docs/ADDON_API.md` | Authorization, discovery, readiness, request/credential/result semantics |
+| C4 | Core `scripts/docs/SANITY.md`, `VALIDATION.md`, `OPERATION_RESULTS.md` | Controller acceptance, candidate evidence and report rules |
+| W1 | WebGUI `docs/DEPLOYMENT.md` | Coordinated migration, retention, backups and rollback |
+| W2 | WebGUI `deploy/deploy.py`, `pyproject.toml`, `constraints.txt` | Actual supported installer flags, initialization, generated units, dependency handling and fixed paths |
+| W3 | WebGUI `adapters/core_v1.py`, `core/executor.py` under `src/aim_webgui/` | Qualified public Core compatibility and executor boundary |
+| W4 | WebGUI `docs/PERMISSIONS-ROLLOUT.md`, `AGENTS.md` | Resource ownership, split-home staging and known-hosts cautions |
+| W5 | WebGUI `deploy/webgui.example.toml`, `deploy/nginx.example.conf`, `src/aim_webgui/config.py` | Actual shipped site profile, reference headers and configuration validation |
+| W6 | WebGUI `src/aim_webgui/cli.py` | Version/configuration/readiness, backup and administration commands |
+| W7 | WebGUI `src/aim_webgui/auth/service.py`, `workflows.py` | Bootstrap, first password change, account/grant and job authorization |
+| W8 | WebGUI `deploy/fetch_assets.py` | Exact browser-asset pins and offline input names |
+| W9 | WebGUI `docs/CREDENTIALS.md`, `RUN-COMFORT.md`, `EXECUTION.md`, `JOURNAL.md`, `REPORTS.md` | Credential modal, execution lifecycle and retained-evidence behavior |
+| W10 | WebGUI `docs/CONTROLLER-PILOT.md`, `docs/VERIFICATION.md` | Operator tests and recorded qualification limits |
+| W11 | WebGUI `src/aim_webgui/db/store.py` | Database ownership and consistent backup behavior |
+
+Core topic files live in the independently installed Core tree. WebGUI topic/source paths above are relative to the verified `aim-web-2.1.0rc9` extraction unless stated otherwise. The current Core archive contains `scripts/docs/INSTALLATION.md`. Read that separately installed prerequisite; no Core source or runtime is copied into this add-on.
+
+**Evidence limit:** this document was produced from the supplied guides and inspected release code. It does not add new installation, dependency-security, proxy, systemd or managed-host test evidence. Use the two products' current validation records and complete the controller acceptance steps for the actual deployment.
diff --git a/scripts/addons/webgui/AGENTS.md b/scripts/addons/webgui/AGENTS.md
new file mode 100644
index 0000000..b8892ac
--- /dev/null
+++ b/scripts/addons/webgui/AGENTS.md
@@ -0,0 +1,97 @@
+# AIM WebGUI global agent standards - 2.1.0rc9
+
+Read this file before changing application, tests, deployment or documentation. Update it in the same release whenever a global convention or security boundary changes.
+
+## Product boundary and compatibility
+
+AIM Core is independently installed and managed. This candidate targets supplied Core **3.3.0rc8**, service/wire/event API **1.0**, `play_task_host_v1`, `inventory_hierarchy_v1`, `target_outcome_summary_v1`, and `native_defaults_preflight_v2`. WebGUI HTTP remains **v2** and SQLite remains **schema 5**. Do not call this production-qualified merely because source tests pass.
+Core rc8 additionally advertises `collection_baselines.ansible.windows` as `>=3.8.0,<4.0.0`. Require that public capability declaration, but do not install, upgrade or privately discover collections from WebGUI; Core readiness and operator acceptance own the actual collection environment.
+
+Read Core's ADDON_AGENTS.md, ADDON_API.md, ADDON_SUPPORT.md and RELEASE_HANDOFF.md. Use only documented fixed `aimctl` JSONL operations via the existing adapter/client. Never import private AIM/Ansible modules, parse Core inventories locally, rewrite Ansible argv, vendor Core, or modify its source/configuration/runtime/roles/Vaults/keys. Additive unknown response fields may be ignored; unsupported capabilities/errors must not become invented successes. Removing or breaking the add-on must not prevent terminal AIM from working.
+
+The executor is an add-on-owned, pre-started non-root same-UID Core caller. Web and queue use aim-web; the executor uses the independently provisioned AIM execution identity. No sudo/setuid/key-export bridge, HTTP-started Ansible command or arbitrary command/path/actor/environment endpoint. Private Unix IPC uses peer checks. Shared local service identities are trusted controller actors, not hostile-tenant isolation.
+
+## Execution, credentials and preserved workflows
+
+A run needs fresh review, not a saved plan. Keep bounded private expiring reviews, explicit targets, frozen scope/options/mode/key handling/revision and current grant/approval checks at dispatch. One-run submissions are idempotent; saved names are optional with transactional NFKC/casefold/strip collision prevention, never upsert by title. Existing plans/jobs/accounts/audit survive normal releases.
+
+Use Core's reported credential requirements and native inventory precedence. No forced Custom/password-only overrides, become-password UI, private-key uploads, prompt automation, credential guessing or secret cache. Secret collection stays authenticated, CSRF/origin-protected HTTPS POST with bounded bodies; credentials travel in a separate private FD, not request JSON, argv, environment, database, logs or files. Preserve literal UTF-8 and existing one-run deadlines. Python cleanup is not physical memory erasure.
+
+Final Core status/exit/counters and target facts remain authoritative. Partially succeeded is a presentation label, not a rewritten Core result or database queue state. Never derive final host success from SSE or task counts. Missing response, cancellation and interruption may leave work unknown; cancellation is not rollback. Manual retry creates a new reviewed job and fresh secrets. Running jobs cannot be deleted. Deletion removes job/lifecycle/idempotency records while retaining a compact audit event, not a hidden transcript archive.
+
+Only documented static labels, logical host names, fixed hints and numeric detail progress are rendered. Do not recover raw module output, decrypted variables or unsafe diagnostics. A bounded allowlisted structured journal is now retained with the job; rendered console strings and raw streams remain prohibited. Final report bodies are separate, declared and validated.
+
+## Read-only experience: explicit data scope
+
+Inventory Explorer consumes the current Core hierarchy and separate host metadata. All new explorer/activity/insights routes are GET-only and must never call prepare/execute, collect secrets or probe managed hosts. Current inventory is not persisted as a competing database. Group identities are full paths; direct/root membership and repeated host membership are preserved. Recursive counts are distinct hosts, not sum-of-appearance counts. The map is membership, not topology or live health.
+
+Host Activity and Playbook Insights use ONLY retained **AIM WebGUI jobs** and final Core per-target facts already stored with those jobs. Do not collect terminal AIM execution history, external/core-wide history, audit-derived reconstructed results or a separate shadow archive. Use a customer plus exact logical hostname identity; never silently merge renamed/recreated machines.
+
+History queries must use the same owner-or-admin visibility as job detail BEFORE aggregation. Saved plans remain owner-only, including for administrators. Inventory visibility does not confer access to another viewer's job history. Aggregate counts, filter choices, matrix cells and links must not leak hidden jobs. Preserve existing read policy rather than inventing tenant isolation.
+
+Stream all matching retained job rows rather than reuse the latest-100 Jobs overview. Page displayed records and bound graph/matrix output; define time range, modes and coverage. Count one requested host participation per job. Apply is the default; Check is explicit and never evidence of installed changes. Success percentage = successful / (successful + failed + unreachable), with denominator visible; not-started/indeterminate/unavailable/outstanding are separate. Changed values count tasks; any derived metric must say so. No per-host duration from job elapsed times. Deleted jobs disappear from statistics; incomplete/legacy target data remains unavailable, never guessed successful.
+
+A Core outage is not empty inventory or an offline host. Authorized retained history remains available when current inventory cannot be retrieved. Historical outcomes include timestamps and do not claim current health/compliance/software versions. No graph click launches a job.
+
+## UI and mobile conventions
+
+Use Jinja2, HTMX and small self-hosted JavaScript with Bootstrap 5. Keep centralized orange accents, charcoal/slate dark surfaces, sun/moon controls, semantic status chips, visible focus, keyboard navigation and reduced-motion behavior. No persistent special orange outline around Jobs/Saved plans. Non-sensitive theme preference may use browser storage; inventory/history/credentials must not.
+
+Desktop above 760px retains the sidebar. Mobile uses a single compact header: **AIM home link left; light/dark controls then hamburger at the far right, vertically aligned**. The native details/summary menu opens below/right with viewport-bounded internal scrolling. Remove horizontal swipe rails, arrow controls and swipe instructions. Keep Escape/focus return, outside-click close, native keyboard/no-JavaScript opening, and account/logout controls reachable. Do not use ARIA menu roles for ordinary site navigation.
+
+Inventory uses a deterministic linked SVG map and equivalent outline. Phone defaults to branch-focused outline; Map remains available with explicit zoom controls and internal scrolling. Breadcrumbs replace unbounded indentation. Host links open a real activity page. Never require hover, drag or pinch to obtain essential information. Direct host/group pages are bounded, searchable and paged.
+
+Use mobile cards for historical results/matrices. Prevent page-level horizontal overflow. Group selectors retain two columns on narrow screens and aligned selection columns; explicit submitted hostnames remain authoritative. Live output autoscroll changes the console scrollTop, never the window; manual upward scrolling pauses follow. Filters, text labels and errors remain legible at 320px and short landscape heights.
+
+Store/transport UTC, render semantic time[datetime] using browser locale, retain inspectable UTC; reformat initial load, HTMX replacements and pageshow. Schedule input stays explicitly UTC unless a separately tested conversion change is approved.
+
+## Permissions and deployment
+
+Preserve rc8's tested intent: executor primary group is its native account group; aim-web is unit-scoped supplementary group. Config root:aim-web0640; private web state aim-web0700; executor state and both process-home/passwd-home temp directories executor0700; runtime directory executor0711; socket executor:aim-web0660. Keep ProtectHome=read-only, narrow temp write exceptions, NoNewPrivileges and empty capabilities. Wait boundedly for socket readiness.
+
+Core authorization groups, inventory/Vault/private-key ownership, system SSH trust, certificates and proxies remain operator/Core managed. Do not repair them from HTTP. Do not infer OpenSSH known_hosts from HOME: effective SSH configuration and passwd expansion are authoritative. No recursive chmod/chown of /etc/ansible.
+
+Whole-release replacements, independent immutable versions, no Git requirement. Overwrite release-managed WebGUI config as requested; preserve private state. Stage dependencies and public Core metadata before downtime; backup matching source/config/units/DB and handle rollback explicitly. Unknown unit overrides require review. Do not modify either production Python environment for tests. Existing 1.x migration needs --migrate-core; ordinary 2.x updates do not.
+
+## Tests and evidence
+
+Test authentication, request boundaries, Core contract/FD transport, different-UID executor, migrations, existing workflow guards, read-only authorization/aggregates/deletion, >100 retained jobs, repeated membership, same hostnames across customers, outages/empty states, and escaped output. Browser QA covers mobile hamburger/alignment/focus, graph links/zoom, cards, themes, short heights, local timestamps and internal console scrolling. Distinguish real Core metadata from fake native execution and fixture browser assets.
+
+Verify the actual final extracted ZIP through deploy.verify_release, canonical manifest paths and required-file coverage, compile/templates/JS, wheel resources and pristine Core hashes. Never claim skips as passes, fake native tests as SSH/WinRM qualification, fixture events as live HTMX/SSE, or static unit tests as systemd deployment. Keep VERIFICATION.md and machine-readable results aligned with observed evidence.
+
+
+## Credential dialog and attention - 2.1.0rc9
+
+Use a progressively enhanced native dialog for deliberate owner-initiated credential entry; keep the authenticated full-page form as the no-JavaScript/unsupported-dialog fallback. Use Bootstrap 5 native radio/label button groups, never Bootstrap 4 JavaScript or jQuery. A key-passphrase source choice is allowed only for the exact Core requirement `ssh_key_passphrase_or_customer_vault_value` alongside `vault_password`; an explicit `ssh_key_passphrase` requirement remains required. This is not a Vault/Custom authentication override.
+
+Keep dialog contents outside HTMX-polled fragments. Load the form lazily for the current reservation, never pre-populate secrets or automatically open/focus a password field. Show the reviewed customer, playbook, target count and mode. Preserve focus containment, Escape and explicit Close, focus return after replaced triggers, short-viewport internal scrolling, persistent labels, paste, Show/Hide and Caps Lock hints. A backdrop tap must not accidentally discard typing. Close dismisses the form, not the job.
+
+Clear all marked secret inputs on submission, closure, expiry/revocation and pagehide, including revealed text inputs. Keep submitted secrets out of URLs, storage, logs, titles, status responses and history snapshots. Do not claim clearing DOM/references erases all browser/runtime memory. Preserve five-per-minute submission throttling, existing worker single-claim semantics, five-minute empty reservation and 60-second handoff/start deadline. Do not extend a reservation on a GET or while typing.
+
+Use a monotonic client countdown synchronized to server timestamps for display only. The server remains authoritative. An accepted handoff is not a verified password or completed execution. On an uncertain/lost POST response, clear inputs, lock submission and poll owner-only status; never automatically resend credentials. Reopening an uncertain job in the same page must not offer another POST. Terminal status, cancellation or lost eligibility must close the input opportunity without manufacturing a retry.
+
+Needs your attention is a non-secret, read-only view: your own live credential reservations and, for eligible administrators, other requesters' jobs pending independent approval. It does not reveal other owners' credential forms, automatically approve/execute jobs or use the latest-100 history limit as its population. Existing policy and grants still apply. Keep ordinary execution failures separate from jobs currently waiting on user input.
+
+The canonical credential POST is `/api/v2/runs/{id}/credentials`; retain the shipped `/api/v2/jobs/{id}/credentials` alias. New reservation-status GETs must not return secrets, override scope, renew a deadline, or invoke Core. Tests must exercise the shared rate limit, missing required keys, revoked sessions/grants, expiry, cancellation, duplicate submission, literal passwords, ambiguous acknowledgements and the real existing worker handoff socket. Browser fixtures are not live pinned-asset/CSP/HTTPS/HTMX qualification.
+
+
+## Core3.3 reports and persistent evidence
+
+The approved contract is Core3.3.0rc8/service-event1.0, aim_output_v1 publisher and aim_operation_result_v1 final result. Negotiate live capabilities; preserve validated result_contract with review. Do not add request output flags, read schemas from Core files or invoke private validators. Revalidate final mode/host/schema/scope/data against the recorded contract. Reports arrive only at finalization. A final event is not a final response; persist one report, never duplicate samples.
+
+Keep execution verdict, native target outcome, report availability and local retention distinct. Native exit0/result_validation stays failed even when all targets succeeded. An unavailable report is not empty/zero/false. Unknown versions stay unknown; pending updates are not installed; excluded services are not failed starts; ignored/rescued native semantics stay intact. Generic supported schemas may render safely, never execute custom code or external references.
+
+Progress is captured worker-side with no viewers, via bounded nonblocking queue/batched committed rows. IDs correlate interleaved tasks; no invented future task list/ETA/percentage. Record durable local cursors and deduplicate(job,run,sequence). Tail omissions, queue/storage loss, crash gaps and last-observed time are explicit. SSE replay checks session/job authorization throughout and cannot replay execution or credentials. Missing final response never becomes success from progress.
+
+Schema5 evidence tables are job-linked with cascade deletion. Journal default20,000 events/8MiB tail; latest checkpoint bounded; report default16MiB subject to reviewed slot bounds. Keep reports out of heavy ordinary job/history reads; load one authorized payload on demand. Parsed Checkmk sections are opt-in; default is labeled metadata_only and not a complete report body. Do not retain a secret cache, terminal history or shadow archive; backups/physical erasure have separate policy.
+
+Escape all labels/report text. Never follow returned paths/URLs or render HTML. Browser data storage remains forbidden for evidence. Preserve working modal/hamburger/theme and internal scrolling; no new privileges/services. Public result framing may grow independently of unchanged request/credential limits. Test full-size/split/torn/duplicate-final transport, all9 declarations, mixed outcomes, no_log/secret canaries, generic/global fixtures, two viewers/reload/revocation, retention pressure/deletion, migrations and matched rollback. Report native/browser/fixture boundaries honestly and update all current guides in the same release.
+
+
+## Core 3.3.0rc8 patch-wave presentation
+
+Obtain reboot/message/delay/continuation controls from public catalog metadata; do not maintain a second defaults table. Blank means omitted/inherited, not a forced value. Surface the Windows-only continuation flag and its catalog hint (false in rc8); explicit true is never inferred from reboot permission. Review normalized options before any run.
+
+Use only validated recorded patch_summary_v1 fields. A successful wave with continuation_required stays successful and calls for review, not an automatic job. remaining_updates_known=false prohibits presenting pending or an empty list as an authoritative next-wave state; retain original structured JSON separately. True refers to the dated final read-only discovery only. Missing optional fields in older reports remain unknown; validate new data with its prepared schema, not an old schema merely sharing the identifier.
+
+Show pre/post reboot/deferred observations, reviewed delay and cycles when supplied. Core owns bounded HRESULT codes/reasons/messages. Never parse raw failure output or equate install_not_allowed (including 0x80240016) with the separate preexisting_reboot_required preflight result. Native failure, report validation, report completeness and next-wave needs remain separate. No auto-enable reboot/rescan, no generic retry shortcut, no new permissions/services/secret handling.
diff --git a/scripts/addons/webgui/CHANGELOG.md b/scripts/addons/webgui/CHANGELOG.md
new file mode 100644
index 0000000..72aab04
--- /dev/null
+++ b/scripts/addons/webgui/CHANGELOG.md
@@ -0,0 +1,556 @@
+# Changelog
+
+## 2.1.0rc9 - Core 3.3.0rc8 release reconciliation
+
+Compatibility: separately deployed Core 3.3.0rc8; public service/wire/event 1.0; WebGUI HTTP v2; SQLite schema 5 unchanged.
+
+- Repackage the rc8-compatible WebGUI line as rc9 after reconciling current-release metadata, operator guidance and verification evidence with the supplied Core 3.3.0rc8 archive.
+- Preserve the rc8 public contract and live capability gates, including `ansible.windows >=3.8.0,<4.0.0`, `play_task_host_v1`, `inventory_hierarchy_v1`, `target_outcome_summary_v1`, `native_defaults_preflight_v2` and structured operation results.
+- Remove stale current-candidate rc4/rc5 labels from active documentation while retaining historical release notes and historical Core reviews as provenance.
+- Refresh release verification against the supplied rc8 source tree; no Core files, database schema, service API, permission model, credential model or execution semantics are changed by this repackaging.
+- Correct a stale legacy rollback comment (`rc18-only`) to describe the actual pre-2.x adapter boundary; runtime behavior is unchanged.
+
+## 2.1.0rc5 - Core 3.3.0rc8 compatibility
+
+Compatibility: separately deployed Core 3.3.0rc8; public service/wire/event 1.0; WebGUI HTTP v2; SQLite schema 5 unchanged.
+
+- Requalify the exact adapter/executor/deployment gates for Core 3.3.0rc8 while retaining live capability negotiation.
+- Require Core's advertised `ansible.windows >=3.8.0,<4.0.0` collection baseline. WebGUI does not install or upgrade collections.
+- Accept and render the additive `patch_summary_v1.reboot_reasons_before` native reboot-source observations without changing job verdicts or triggering follow-up work.
+- Update Windows filesystem-report wording to attached local storage volumes; mapped/network drives are intentionally excluded by Core rc8.
+- Preserve patch continuation, remaining-update knowledge, HRESULT presentation, report/journal retention, credentials, mobile UX, database schema 5 and the existing permission/systemd model.
+- Treat Core rc8 Checkmk script relocation/ACL hardening as Core-owned runbook behavior; do not reconstruct paths/ACLs or add private APIs.
+- Update fresh-install, deployment, controller-pilot and agent guidance for the new native collection floor and Core rc8 acceptance boundary.
+
+## Preserved previous release notes
+
+## 2.1.0rc4 - Core 3.3.0rc3 patch-wave support
+
+Compatibility: separately deployed Core3.3.0rc3; public service/wire/event1.0; WebGUI HTTPv2; SQLite5 unchanged from rc3.
+
+- Update exact adapter/executor/CLI/deployment compatibility checks while retaining live capability negotiation. Core remains unchanged.
+- Expose reboot message/delay and Windows-only post-reboot continuation through existing public catalog forms, showing platform applicability and catalog hints. Blank still omits overrides. Review distinguishes explicit reboot/continuation/delay from inherited inventory/role policy.
+- Present continuation_required independently from successful/failed Core and job status. No automatic follow-up jobs, reboot enablement or continuation override.
+- Render reboot before/after/deferred state, observed AIM reboot, reviewed delay, cycles, stop reasons and per-update unsigned/hex HRESULT, fixed reason and safe message. No raw fatal-text/event-log parsing.
+- Treat remaining_updates_known=false as unknown rather than an authoritative empty/old queue. True labels a final read-only, dated discovery, not an expanded install queue or current compliance. Original validated JSON stays available.
+- Preserve old patch reports using their recorded contracts, including the older closed patch_summary_v1 shape; do not invent absent fields or validate old history against the new catalog.
+- Keep modal/mobile/graph/history, retained journal/report policy, target outcomes, execution review, credential boundaries and the generated permission/unit contract unchanged.
+- Include the requested ADDON-INSTALLATION.md in the release and update deployment/patch acceptance/agent guidance. No new database migration, dependencies, services or write exceptions.
+- Add public-Core rc3, historical-report, patch-state, escaped-output and review regression coverage. Actual results and environment limitations are in docs/VERIFICATION.md.
+
+## Preserved previous release notes
+
+
+## 2.1.0rc3 - Core3.3 reports and retained execution evidence
+
+- Target independently managed Core3.3.0rc1 with existing service/wire/event1.0; WebHTTPv2, additive SQLite schema5.
+- Preserve negotiated result contracts in review; validate final operation reports and new result_validation/error families while keeping native outcome and report availability separate.
+- Separate large public-result framing from unchanged inbound credential/request limits; reject malformed, torn or oversized payloads without replay.
+- Retain structured worker-side progress with bounded batched writes, tail/checkpoints, durable cursor replay and explicit coverage gaps. No raw output or browser-dependent collection.
+- Retain eight ordinary report types by default and only metadata for parsed Checkmk config unless opted in. All9 schema-keyed summaries and generic supported JSON views; lazy per-slot payload reads, dated Host Activity links.
+- Cascade report/journal deletion with jobs, preserving only compact audit metadata. Historical jobs are not backfilled and stale pre-upgrade work is stopped by migration.
+- Preserve modal, mobile header, hierarchy/history, normal executor identity and all narrow staging/IPC permissions. Add restored-adapter Core compatibility check before service restarts on rollback.
+- Qualification evidence is recorded in docs/VERIFICATION.md; no new live-host certification is implied.
+
+## Historical releases
+
+# Changelog
+
+## 2.1.0rc2 - one-run credential dialog and attention
+
+Compatibility: AIM Core 3.2.1rc2; service/event API 1.0; WebGUI HTTP v2; SQLite schema 4. No Core, deployment, permission or dependency-pin change.
+
+- Replace default navigation to password entry with an owner-initiated native modal; retain full-page/no-JavaScript fallback. The modal is outside polled job fragments.
+- Show reviewed job context, server-synchronized reservation countdown, required fields, Show/Hide and Caps Lock feedback. Short/mobile viewports scroll within the dialog.
+- Add Bootstrap 5 segmented radio choices for customer-Vault versus separate SSH key passphrase only when Core permits both. Explicitly required key passphrases stay required. No Custom authentication override.
+- Clear revealed/masked inputs on dismissal, submit, invalidation and navigation. Treat lost acknowledgement as uncertain; reconcile with read-only status rather than automatically resending credentials.
+- Add Needs your attention to Overview/Jobs with owner credential actions and existing independent-administrator review links. Do not change approval or execution policy.
+- Add canonical /api/v2/runs/{id}/credentials POST alias, retaining /api/v2/jobs/{id}/credentials; add owner-only credential-status and guarded HTML fragment GETs. Both POST routes share existing throttling and worker handoff.
+- Preserve literal secrets, CSRF/origin/session/grant checks, bounded bodies and existing one-run deadlines. Improve ambiguous-handoff wording; enforce an explicitly required SSH key passphrase.
+- Add synthetic endpoint and real local worker-socket tests plus mobile/desktop credential-dialog browser fixtures. See VERIFICATION.md for measured results and limitations.
+
+
+## 2.1.0rc1 - read-only experience candidate
+
+Compatibility: independently managed AIM Core3.2.1rc2; service/wire/event1.0; WebGUI HTTPv2; SQLite4. Based on WebGUI2.0.0rc8. No new Core requirement, database migration, runtime permission or execution-policy change.
+
+- Replace the mobile swipe rail with a compact AIM-home / sun-moon / right-aligned hamburger row and native keyboard-operable dropdown; desktop sidebar retained.
+- Add current Core Inventory Explorer with linked SVG group/host map, branch focus, distinct counts, search and equivalent mobile outline. Graph nodes navigate, never execute.
+- Add Host Activity from retained WebGUI final per-target results with mode/time/playbook/outcome filters, paginated timeline, counter details and own saved-plan references.
+- Add Playbook Insights with explicit metric denominators, outcome distribution, paged host-by-playbook matrix and mobile cards. Never scrape terminal/core-wide history or infer live health.
+- Scope aggregation to underlying job authorization before reading records; cover more than100 jobs, legacy/unknown data and deletion without a shadow archive.
+- Connect existing host lists, job target summaries, Jobs and Saved Plans previews to activity pages. Keep partial host/parent outcomes distinct and current inventory outages visible.
+- Preserve one-run review/idempotency, optional collision-safe names, credentials, retry/deletion controls, bounded live output and existing managed permission model.
+- Reconcile current agent/read-only/mobile documentation and add unit, real-Core read, browser-fixture and synthetic large-history coverage. Actual qualification is recorded in docs/VERIFICATION.md, not inferred from older RC counts.
+
+## Preserved historical record
+
+The following is the changelog as supplied in2.0.0rc8, including its duplicated historical headings. It is retained as provenance; it is not new2.1 behavior or new verification.
+
+# Changelog
+
+## 2.0.0rc8
+
+- Require and integrate AIM Core 3.2.1rc2 / service API 1.0 while preserving the independent Core/WebGUI release boundary.
+- Consume `target_outcome_summary_v1` and retain Core's authoritative overall `failed` status while presenting mixed requested-target outcomes as `Partially succeeded` in WebGUI.
+- Show Core-provided per-target outcome and task counters on Job detail; Jobs overview shows successful/requested and failed/unreachable/not-started/indeterminate counts. No task-event reconstruction is used for final host state.
+- Consume read-only `inventory_hierarchy_v1` for nested parent/subgroup selection and inventory display. Parent scopes include Core-declared descendant hosts; execution still submits explicit reviewed hostnames.
+- Require `native_defaults_preflight_v2`; keep rc6 release-managed split-home staging and executor sandbox unchanged.
+- Remove the special persistent orange outline around Jobs and Saved plans; active/hover navigation styling remains consistent with the rest of the menu.
+- Preserve one-run jobs, optional collision-safe plan names, detailed safe live output, running-job deletion protection, API v2, SQLite schema 4, and the rc6 managed permission model.
+
+## 2.0.0rc6
+
+- Fix delegated `localhost` execution under the hardened executor sandbox. Ansible 2.19 local connections expand `~svc_bf-ansible/.ansible/tmp` from the passwd database even when the executor service sets `HOME=/var/lib/aim-web-executor`.
+- Release-manage `/home/<executor>/.ansible` and `/home/<executor>/.ansible/tmp` as executor-owned `0700`, and grant `ReadWritePaths` only to that exact local staging path while keeping `ProtectHome=read-only`.
+- Extend `core-staging-check` so startup validates both Core controller-local staging and Ansible delegated-local staging inside the actual systemd sandbox.
+- Do not set global `ANSIBLE_REMOTE_TMP`; doing so would also alter POSIX temp paths on managed Linux hosts.
+- Preserve Core 3.2.1rc1 detailed progress, managed socket/runtime permissions, API v2, SQLite schema 4, and existing credential boundaries.
+
+## 2.0.0rc5
+
+- Fix the rc4 executor-start race: deployment now waits for the `Type=simple` executor to bind and permission `/run/aim-web-executor/core.sock` before validating runtime ownership/mode. A temporarily missing socket is treated as startup-in-progress rather than immediate migration failure.
+- Fail deterministically if the executor service exits before binding, or if the managed socket does not become ready within the bounded startup window.
+- Preserve the rc4 release-managed identity model: `svc_bf-ansible` primary user/group, unit-scoped `aim-web` supplementary group, executor-owned `0711` runtime directory, and `executor:aim-web 0660` socket.
+- No Core, database schema, API, credential, inventory, Vault, key-ownership, or global SSH-trust changes.
+
+
+## 2.0.0rc5
+
+- Fix the rc3 runtime-directory ownership transition: systemd now owns `/run/aim-web-executor` as the executor identity with mode `0711`; authorization remains on `core.sock` as `executor:aim-web 0660`. This removes runtime `chgrp` and allows upgrades from rc2 without manual `/run` repair.
+- Preserve the release-managed executor primary group plus unit-scoped `aim-web` supplementary group, staging checks, config/state ownership, and detailed Core 3.2.1rc1 progress rendering.
+
+
+## 2.0.0rc5 — Core 3.2 detailed progress, operational UI, and managed permissions
+
+Compatibility: AIM 3.2.1rc1; public core service/wire/event 1.0; detail schema `play_task_host_v1`; WebGUI HTTP v2; SQLite 4.
+
+- Negotiate `progress_mode=detail` and render safety-filtered play/task/host progress in the live job console while keeping raw module stdout/stderr unavailable.
+- Adopt Core 3.2.1rc1 controller staging preflight requirements in the executor unit: private `.ansible/tmp`, scoped `ReadWritePaths`, and startup staging check.
+- Add semantic job state chips, richer Jobs and Saved plans scope previews, stronger navigation emphasis, aligned Audit filters, and viewport-bounded internal console scrolling.
+- Preserve running-job deletion protection, one-run execution, optional collision-safe plan names, API v2, schema 4, and separate non-root core executor architecture.
+- Preserve the executor account's normal primary group and grant `aim-web` only as a unit-scoped supplementary group; no `/etc/group` mutation is performed.
+- Release-manage and verify WebGUI config/state, executor HOME/staging, systemd unit ownership, runtime directory group, and core socket mode/ownership during deployment.
+- Keep Core-owned inventory/Vault/private-key permissions and global SSH trust outside WebGUI's ownership boundary.
+
+## 2.0.0rc1 — independent core API migration
+
+Compatibility: AIM3.1.0; public core service/wire/event1.0; WebGUI HTTPv2; SQLite4.
+Release candidate: no live-controller execution qualification is implied.
+
+- Replace private rc18 imports/command hooks/Ansible strategies and sudo key export
+  with the documented aimctl protocol. Pre-started non-root add-on executor under
+  the existing authorized key-owning account; no automatic core/user/permission edits.
+- New run -> review -> one-run submission, without a saved plan. Mode/key handling
+  included in immutable review. Saving is secondary and optional.
+- Generated unique titles for blank names, transactional casefold/NFKC duplicate
+  rejection for explicit account-local titles. Never overwrite by title.
+- Preserve authentication, grants, history, audit, bulk deletion, explicit retry,
+  existing orange light/dark/mobile shell and browser-local timestamp lifecycle.
+- Schema4 retains records; old pending/queued jobs blocked, running interrupted.
+  Old plans require fresh core review. Historical duplicate titles retained.
+- Retire unsupported Custom/raw-console features rather than misrepresent native
+  inventory defaults or bypass the new API. Platform groups remain selectable;
+  core1.0 lacks subgroup paths. Structured final core result/counters are shown.
+- Major migration requires --migrate-core; stages public core checks as executor,
+  backs up/removes known legacy helpers/drop-in, uses no privileged capabilities.
+  Rollback to legacy adapter remains stopped with incompatible core.
+- Verify the release manifest before deployment; use a separate executor HOME for
+  native caches and independently verified host trust. Alternative direct-HTTP
+  browsing profile keeps execution/credentials disabled.
+- New API/migration/security/contract-review/agent guidance and regression coverage.
+
+## Historical WebGUI1.x entries (superseded architecture)
+
+# Changelog
+
+## 2.0.0rc5
+
+- Fix the rc3 runtime-directory ownership transition: systemd now owns `/run/aim-web-executor` as the executor identity with mode `0711`; authorization remains on `core.sock` as `executor:aim-web 0660`. This removes runtime `chgrp` and allows upgrades from rc2 without manual `/run` repair.
+- Preserve the release-managed executor primary group plus unit-scoped `aim-web` supplementary group, staging checks, config/state ownership, and detailed Core 3.2.1rc1 progress rendering.
+
+
+## 1.1.0rc10 - 2026-09-19 (ephemeral live job console and execution diagnostics)
+
+- Adds an authenticated same-origin Server-Sent Events job console backed by an owner-only local Unix socket. Playbook output is bounded in memory, sanitized before leaving the worker child, cleared on navigation, and never stored in SQLite, audit history, or regular files.
+- Keeps the console outside the HTMX-polled status fragment so polling cannot erase the stream. SSE responses disable proxy buffering and use keepalives for reverse-proxy compatibility without WebSockets.
+- Classifies non-zero Ansible runs into remote connection/authentication, playbook task, controller/playbook-loading, or generic execution failures using sanitized output only.
+- Retains rc9 credential/runtime fixes and AIM 3.0.0rc18 compatibility; no AIM or database-schema changes.
+
+## 1.1.0rc9 - 2026-09-19 (Ansible 2.19 runtime qualification fixes)
+
+- Treat resolved Vault/connection secret values as literal data. Standard AIM exact variable references are dereferenced once; the resulting password/passphrase is never recursively templated, so Jinja-looking password text remains unchanged.
+- Remove the empty `ANSIBLE_CALLBACKS_ENABLED` environment override. Ansible Core 2.19.11 interprets an empty callback name as an invalid plugin and aborts before playbook execution.
+- Correct the synthetic SSH-key runtime test to use owner-only `0600`, matching the secure canonical-key policy.
+- Correct `credential-check` acceptance-test guidance for a disposable test environment and `AIM_TEST_ANSIBLE_PYTHON`.
+- No AIM 3.0.0rc18, SQLite schema, permission model, HTTP API version, or credential lifetime change.
+
+## 1.1.0rc8 - 2026-09-19 (secure key handoff + history QOL)
+
+- Fix the rc7 secure-key preflight: the resolver no longer opens canonical service-owned `0600` SSH private keys as `aim-web`. It validates path/type/mode metadata only; the restricted export helper running as AIM `service_user` is the sole reader of canonical key bytes.
+- Add bulk deletion to the Jobs overview for terminal jobs and to the Saved Plans overview for the requesting account's own plans. Individual deletion and append-only deletion audit records remain.
+- Add **Retry as new job** for failed jobs. Retry is requester-only, manual, creates a new job ID, revalidates current grants/source revisions/execution policy, preserves reviewed non-secret parameters and credential mode, and requires fresh one-run credentials.
+- Preserve the secure permission model: inventory/Vault sharing through `aim-runtime`; canonical private keys owned by AIM `service_user` at `0600`; one-job WebGUI key copies only.
+- No AIM 3.0.0rc18 or SQLite schema change. HTTP API v1 gains the additive manual retry endpoint.
+
+## 1.1.0rc7 - 2026-09-19 (rc6 deployment packaging fix)
+
+- Fix deployment of the restricted SSH key-export helper after the staged source directory is atomically activated. rc6 moved the staging directory before reading `key_export.py`, then attempted to read the obsolete staging path and rolled back. rc7 reads the helper from the activated managed source tree.
+- No AIM 3.0.0rc18, SQLite schema, execution policy, credential protocol, or WebGUI API changes.
+- Retains the rc6 secure permission model, terminal-job deletion, saved-plan deletion, and browser-local timestamp behavior.
+
+
+## 1.1.0rc6 - 2026-09-18 (Ansible 2.19 Vault/runtime qualification fixes)
+
+- Use Ansible Core 2.19.11's runtime `VaultSecret` API with UTF-8 bytes for one-run Vault passwords; remove the unavailable `TextVaultSecret` test-helper import exposed by controller qualification.
+- Keep `/usr/bin` as the shipped Ansible binary directory for this controller profile and resolve `/usr/bin/python3` from the actual `ansible-playbook` runtime rather than assuming a venv.
+- Distinguish missing, unreadable and empty SSH private keys using sanitized fixed messages. Permission failures now point to the shared `aim-runtime` read/traverse policy rather than collapsing into a generic Vault/reference error.
+- Preserve the rc4 fixes for literal special characters, explicit Vault-decrypt preflight, browser-local timestamp rendering, grant de-duplication and one-run credential lifetime.
+- Document the qualified filesystem model: AIM/WebGUI runtime identities need read/traverse access to encrypted Vault and configured customer private keys; AIM source remains externally managed and unchanged.
+- No AIM, HTTP API or SQLite schema change.
+
+## 1.1.0rc3 - 2026-09-18 (grant picker de-duplication)
+
+- Scoped execution grant forms now refresh the playbook choices for the selected account/customer and omit exact grants the account already has.
+- If every catalog playbook is already granted for that scope, the form shows a disabled explanatory option instead of offering a duplicate grant.
+- Duplicate grant submissions are rejected server-side with a conflict response rather than silently succeeding.
+- Existing grants remain visible below the form for review and revocation.
+- No schema, credential, execution, API version, AIM compatibility, or deployment-policy changes.
+
+## 1.1.0rc2 - 2026-09-18 (administration layout fix)
+
+- Removed the duplicate **Scoped execution grants** panel from the User administration page subtitle area.
+- Kept a single grant-management panel below Local accounts / Add account so account administration reads top-to-bottom without repeated controls.
+- No schema, credential, execution, API, AIM compatibility, or deployment-policy changes.
+
+## 1.1.0rc2 - 2026-09-18 (credential feature candidate)
+
+**Compatibility:** AIM **3.0.0rc18 only, unchanged**; HTTP API v1 with additive
+credential routes; SQLite schema **3** (additive from 2); Python >=3.11.
+Credential execution targets **Ansible Core 2.19.11 exactly**, in the existing
+external Ansible environment. No Ansible/AIM package is installed or updated.
+
+**Candidate, not production-qualified:** the build environment could not obtain
+Ansible 2.19.11 or OpenSSH client tools. Local protocol/route/policy tests and
+fake-worker regression tests pass; real Ansible/SSH/WinRM qualification remains
+required. Read docs/VERIFICATION.md, not a test count as a certification.
+
+### Added
+- Separate disabled-by-default [credentials] enabled switch, plus existing
+  execution allowlist, HTTPS transport attestation and approval requirements.
+- Accessible Vault/Custom mode control at job review. The custom username and
+  mode become immutable reviewed metadata. Passwords are collected only after
+  approval and the single worker reserves the job; they are not plan fields.
+- Five-minute empty worker reservation and 60-second single-run hand-off/start
+  deadline. No secrets are held for approval or scheduled-job delays. A retry or
+  check-to-apply is a new credential submission. No automatic replay on restart.
+- Private Unix socket hand-off, requester/session/job checks, anonymous child
+  pipe and job-private password-source helpers. Add-on code never persists
+  infrastructure passwords to SQLite, helper text, argv or environment values.
+- Resolver in the existing Ansible Python: standard customer Vault, effective
+  host/group connection references, per-host Windows NTLM credentials, existing
+  customer SSH keys and separate Vault key passphrase. Unused legacy SSH
+  password references do not block key authentication.
+- Custom mode overrides connection identity/password for every selected host;
+  disables prior SSH control sockets and key/agent fallback. SSH uses an add-on
+  ASKPASS helper, avoiding the native 2.19 named password shared-memory helper.
+- Dedicated linear strategy adapter and final launch authorization. Endpoint
+  changes, unsupported auth transports and selected source patterns fail closed.
+- aim-web credential-check for non-secret exact-runtime/import/tool checks;
+  six opt-in synthetic actual-Ansible tests and an execution acceptance guide.
+- Mobile/desktop credential page and no-echo error handling. Existing appearance,
+  account policy, selection semantics and network/TLS profile remain unchanged.
+
+### Deliberate restrictions
+- Standard SSH and WinRM/NTLM only; no network/API plugins, become-password
+  collection, private-key uploads, saved passwords, raw output streaming or SSO.
+- Credential jobs reject delegation, asynchronous tasks, explicit strategies,
+  dynamic task imports/inventory changes, external roles and SSH argument escape
+  hatches. Some rc18 catalog plays (notably delegated Checkmk work) remain terminal
+  only. An allowlist entry is not a guarantee that a play is eligible.
+- Custom credentials may still require Vault unlock for unrelated play variables.
+- Passwords use small HTTPS POST bodies. Proxy/body buffering and trusted playbook
+  behavior remain deployment responsibilities; process separation/shared UID is
+  not a privilege sandbox, and Python does not promise physical memory erasure.
+
+### Upgrade and rollback
+- Whole-release replacement and overwritten TOML continue. Credentials and
+  execution are both disabled in shipped defaults; the backend TLS setup is not
+  touched. Existing accounts, sessions, plans and jobs survive forward migration.
+- Schema 3 adds only credential phase/deadline metadata, not a credential store.
+- Rollback to 1.0.0/schema2 requires explicit historical database restoration,
+  losing post-checkpoint changes and potentially restoring old passwords. Make
+  a current protected backup first. Do not manually repoint the active venv.
+- Global AGENTS.md and security/API/deployment/execution docs updated together.
+
+
+## 1.0.0 - 2026-09-18
+
+**Compatibility:** AIM 3.0.0rc18 only (unchanged); HTTP API v1; SQLite schema **2**;
+Python >=3.11. Independently versioned add-on, not an AIM release.
+
+### Added
+- Named-administrator setup and bootstrap retirement, with forced first-password
+  change and last-admin/session protections retained.
+- Status/config-check/doctor CLI and administrator System diagnostics.
+- Inventory search, group filters, sorting and 100-row browse pagination;
+  private selection restoration, clear/visible select-all controls.
+- Typed catalog forms and private non-secret saved plans/preset reuse, using
+  existing rc18 input parsing and target validation.
+- Searchable/paginated administrative audit history and lifecycle events.
+- Optional disabled-by-default worker using rc18's existing PlaybookManager.run
+  and its external_presentation hook; no monkey patches or duplicated AIM CLI.
+- Exact customer/playbook execution grants; catalog allowlist; independent
+  administrator approval; one active job; host/timeout/start-window policies;
+  idempotent submission; one-shot UTC schedules; cancellation and crash recovery.
+- API v1 plan, selection, diagnostics, audit and job routes. Existing preflight
+  remains validation-only. POST /api/v1/runs returns 501 while execution is off.
+- Source-revision checks at submission and dispatch; interrupted jobs are never
+  automatically replayed. Potentially sensitive raw command output is discarded.
+
+### Fixed
+- Mobile group count badges have their own constrained grid slot instead of
+  overflowing two-column group cards. Long labels wrap without moving counts out.
+- The mobile navigation rail now shows scroll instructions and arrow controls.
+- Deployment journals before replacing TOML; checks installed candidate identity;
+  manages the worker with rollback; tests schema compatibility before rollback.
+- Verified, unchanged installed browser assets can be reused without a download.
+
+### Deployment changes requiring review
+- Release-managed TOML now uses loopback 127.0.0.1:8080 and trusts 127.0.0.1,
+  matching NPM -> HTTPS controller:8443 -> local Nginx -> WebGUI. NPM/certificates
+  are externally managed and are NOT modified by the add-on deployment.
+- Additive schema 1 -> 2 migration preserves accounts. Rollback to 0.1.x needs
+  explicit --restore-auth-db and loses post-checkpoint data; read the guide.
+- Execution is off, has an empty allowlist, and has no TLS verification
+  attestation by default. A release upgrade does not silently enable jobs.
+- Raw output streaming and interactive infrastructure credentials remain deferred.
+- See docs/VERIFICATION.md for actual test results and live-controller limits.
+
+# AIM WebGUI changelog
+
+WebGUI uses its own version sequence. An add-on release does not imply any AIM
+release, source edit or upgrade. Every entry must include supported AIM versions,
+auth schema compatibility, HTTP API compatibility and upgrade/rollback notes.
+
+## 0.1.6 - 2026-09-17
+
+### Compatibility
+
+| Component | Contract |
+| --- | --- |
+| AIM base | **3.0.0rc18 only; unchanged and externally managed** |
+| Python | 3.11+ |
+| HTTP API | v1 unchanged |
+| Add-on database | Schema 1 unchanged |
+| WebGUI config | Release-managed; overwritten on install/update/rollback |
+
+### Added / changed
+
+- Made mobile/responsive behavior a global UI standard. At 760px and below the desktop sidebar becomes a compact sticky header with one non-wrapping, horizontally scrollable navigation rail, preventing staggered/wrapped top navigation.
+- Reworked the mobile account/display bar so theme controls and account actions remain level and usable, long usernames ellipsize, and the desktop layout remains unchanged.
+- Added narrow-screen rules for touch-friendly group controls, contained table scrolling, stacked forms/actions, responsive system facts, reduced card spacing, and device safe-area insets.
+- Expanded the repository-root `AGENTS.md` into the authoritative AI-agent/contributor standards document covering the immutable AIM boundary, release/state ownership, security invariants, design system, mobile requirements, selection semantics, authentication, testing, verification, and documentation upkeep.
+
+### Upgrade / rollback
+
+Whole-release replacement semantics are unchanged. The release-managed deployment profile remains the validated `https://aim.desq-gaming.de` / Nginx Proxy Manager configuration from 0.1.5. `/var/lib/aim/webgui` auth/runtime state remains preserved across normal updates. AIM rc18 is never modified.
+
+## 0.1.5 - 2026-09-17
+
+### Compatibility
+
+| Component | Contract |
+| --- | --- |
+| AIM base | **3.0.0rc18 only; unchanged and externally managed** |
+| Python | 3.11+ |
+| HTTP API | v1 unchanged |
+| Add-on database | Schema 1 unchanged |
+| WebGUI config | Release-managed; overwritten on install/update/rollback |
+
+### Added / changed
+
+- Replaced the text Light/Dark selector with compact sun/moon theme controls while retaining explicit accessible labels and pressed-state semantics.
+- Tidied inventory-group bulk-selection controls and aligned the select-all header checkbox exactly with host-row selection checkboxes. Selection behavior and explicit-host-only preflight semantics are unchanged.
+- Managed deployment now creates `/usr/local/bin/aim-web` as a guarded symlink to `/opt/aim-web/current/bin/aim-web`. It follows update/rollback automatically and refuses to overwrite unrelated files or symlinks.
+
+### Upgrade / rollback
+
+Whole-release replacement semantics are unchanged. The release-managed config still uses `https://aim.desq-gaming.de`, backend listener `0.0.0.0:8080`, and trusted Nginx Proxy Manager `192.168.20.3`. `/var/lib/aim/webgui` auth/runtime state remains preserved across normal updates. AIM rc18 is never modified.
+
+## 0.1.4 - 2026-09-17
+
+### Compatibility
+
+| Component | Contract |
+| --- | --- |
+| AIM base | **3.0.0rc18 only; unchanged and externally managed** |
+| Python | 3.11+ |
+| HTTP API | v1 unchanged |
+| Add-on database | Schema 1 unchanged |
+| WebGUI config | Release-managed; overwritten on install/update/rollback |
+
+### Added / changed
+
+- Added a global Light/Dark display selector in the WebGUI top bar. The preference is browser-local presentation state only; no authentication/session material is stored with it.
+- Added a dark palette built from charcoal/slate surfaces instead of pure black, while retaining the existing AIM orange accent and accessible focus/selection states.
+- Centralized additional surface, table, note, badge and control colors into theme tokens so pages switch consistently between light and dark modes.
+- Added a select-all checkbox to the explicit-host table header with checked/indeterminate synchronization.
+- Added inventory-group bulk selection controls with host counts. Overlapping groups and manual host selections update group controls to checked/indeterminate states.
+- Group selection remains presentation-only: preflight continues to submit explicit inventory hostnames and never Ansible patterns or group expressions. The existing server-side explicit-target validation and 500-target limit are unchanged.
+
+### Upgrade / rollback
+
+Whole-release replacement semantics are unchanged. The release-managed config still uses `https://aim.desq-gaming.de`, backend listener `0.0.0.0:8080`, and trusted Nginx Proxy Manager `192.168.20.3`. `/var/lib/aim/webgui` auth/runtime state remains preserved across normal updates. AIM rc18 is never modified.
+
+## 0.1.3 - 2026-09-17
+
+### Compatibility
+
+| Component | Contract |
+| --- | --- |
+| AIM base | **3.0.0rc18 only; unchanged and externally managed** |
+| Python | 3.11+ |
+| HTTP API | v1 unchanged |
+| Add-on database | Schema 1 unchanged; users/passwords/auth state preserved |
+| WebGUI config | Release-managed; overwritten on install/update/rollback |
+
+### Fixed / changed
+
+- Hardened browser CSRF-origin handling for reverse-proxy deployments. `Origin` remains authoritative when present and must match `public_url`; a same-origin `Referer` is accepted only when `Origin` is absent.
+- If both `Origin` and `Referer` are absent, unsafe browser requests are accepted only with `Sec-Fetch-Site: same-origin`, and the existing per-session CSRF token remains mandatory. `Origin: null`, cross-site Fetch Metadata, and mismatching Origin/Referer values remain rejected.
+- Changed the response `Referrer-Policy` from `no-referrer` to `same-origin` so browsers can provide the safe Referer fallback without leaking referrers cross-origin.
+- Improved origin-rejection messages to distinguish mismatched Origin, mismatched Referer, cross-site Fetch Metadata, and missing same-origin browser metadata.
+- Corrected the managed Nginx Proxy Manager trust address for the validated deployment profile to `192.168.20.3`; backend remains `192.168.20.46:8080` and public origin remains `https://aim.desq-gaming.de`.
+
+### Upgrade / rollback
+
+Whole-release replacement semantics from 0.1.2 are unchanged. The release-managed WebGUI configuration is overwritten with the 0.1.3 profile during update; `/var/lib/aim/webgui` authentication/runtime state is preserved. Rollback restores the prior release source/config while leaving the auth database intact unless explicitly requested. AIM rc18 is never modified.
+
+## 0.1.2 - 2026-09-17
+
+### Compatibility
+
+| Component | Contract |
+| --- | --- |
+| AIM base | **3.0.0rc18 only; unchanged and externally managed** |
+| Python | 3.11+ |
+| HTTP API | v1 unchanged |
+| Add-on database | Schema 1 unchanged; users/passwords/auth state preserved |
+| WebGUI config | **Release-managed; overwritten on install/update/rollback** |
+
+### Changed
+
+- Managed deployments now treat `/etc/ansible/scripts/config/webgui.toml` as part of the versioned WebGUI release rather than operator state. Every install/update writes the release copy, and rollback restores the copy captured with the rolled-back release.
+- Update sequencing now snapshots and validates the active release before replacing configuration, then validates the candidate with the candidate runtime. An older WebGUI runtime is never asked to parse a newer configuration schema.
+- Authentication database checkpoints now use Python SQLite's native online backup API directly, so backup and update no longer depend on the previous WebGUI runtime or its ability to parse any configuration schema.
+- Private runtime state under `/var/lib/aim/webgui`, including the SQLite authentication database and consumed bootstrap state, remains preserved across normal updates.
+- The managed release profile binds `0.0.0.0:8080`, uses `https://aim.desq-gaming.de`, and trusts forwarded headers only from Nginx Proxy Manager at `192.168.10.11`.
+
+### Upgrade semantics
+
+`deploy/deploy.py update` performs whole-release replacement without Git. Source, venv, systemd unit and WebGUI configuration advance together. The SQLite authentication database is retained. On deployment failure, the previous source, venv, unit and configuration are restored automatically; AIM rc18 is never modified.
+
+## 0.1.1 - 2026-09-17
+
+### Compatibility
+
+| Component | Contract in this release |
+| --- | --- |
+| AIM baseline | Original `AIM-Ansible-3.0.0rc18.zip` only; unchanged |
+| Upgrade from WebGUI | `0.1.0` supported by managed replacement update |
+| Add-on database | Schema 1 unchanged; users/passwords/sessions preserved |
+| HTTP interface | API v1 unchanged |
+| Reverse proxy | Explicit trusted forwarded-header support added |
+
+### Fixed / changed
+
+- Added explicit non-loopback listener support for reverse-proxy deployments. The safe default remains `127.0.0.1`.
+- Added `proxy_headers` and `forwarded_allow_ips`; Uvicorn now trusts forwarded headers only when configured.
+- Added sectioned TOML configuration while retaining full read compatibility with the 0.1.0 flat configuration.
+- Non-loopback listeners require an HTTPS `public_url`, proxy-header processing, and at least one explicitly trusted proxy address/network.
+- Managed readiness checks now work with wildcard listeners (`0.0.0.0` / `::`) by probing loopback while sending the configured public Host header.
+- Documented Nginx Proxy Manager deployment validated with `aim.desq-gaming.de`, backend `192.168.20.46:8080`; site-specific values are examples, not package defaults.
+- Clarified that the managed systemd unit supplies AIM rc18's required group as a supplementary process group; manual tests launched with `sudo -u` may not inherit that group.
+
+### Upgrade / rollback
+
+Use `deploy/deploy.py update` from a freshly unpacked 0.1.1 release. The active add-on source and isolated venv are replaced as a unit; operator configuration and `/var/lib/aim/webgui/webgui.sqlite3` are retained. 0.1.0 flat TOML remains valid after upgrade. Rollback to the managed 0.1.0 snapshot remains supported without restoring the auth database unless explicitly requested. AIM rc18 is never modified.
+
+## 0.1.0 - 2026-09-17
+
+### Compatibility
+
+| Component | Contract in this release |
+| --- | --- |
+| AIM baseline | Original `AIM-Ansible-3.0.0rc18.zip` only |
+| AIM product version | `3.0.0rc18`, unchanged |
+| AIM rc19 / later | Not claimed; startup refuses unapproved versions |
+| Python | Requires 3.11+; executable tests run on CPython 3.13.5 |
+| Managed deployment | Linux with systemd; separate unprivileged service account |
+| Add-on database | Schema 1, SQLite rollback-journal mode |
+| HTTP interface | `/api/v1`, cookie authentication and CSRF for unsafe methods |
+| Frontend | Jinja2, HTMX 2.0.10, Bootstrap 5.3.8; no EJS/Node |
+| Core change requirement | None; no service/API facade added to AIM |
+
+### Added
+
+Independent `aim-webgui` Python distribution and `aim-web` executable. FastAPI /
+Uvicorn server, Jinja2 pages/partials, local static asset preparation and
+centralized orange theme with explicit Bootstrap component overrides.
+
+Read-only rc18 adapter for Config, group membership, CustomerManager,
+InventoryDocument/InventoryEditor, catalog parsing, InputSpec.parse/validate
+and PlaybookManager.validate_overrides. Target/platform filtering mirrors the
+rc18 target screen without importing its terminal UI. Inputs inherit role
+defaults unless explicitly supplied; the existing cleanup-off safety default
+is retained. Customer path traversal and escaping symlinks are rejected.
+
+SQLite bootstrap admin with random password written to private `.credentials`,
+mandatory first password change, Argon2id hashes, server-side hashed session IDs,
+CSRF/origin checks, idle/absolute expiry, request limits, login throttling,
+local account administration, last-admin protection and terminal recovery.
+
+Add-on-only, non-git staged replacement deployment. It prepares dependencies
+before stopping WebGUI, stores SQLite backups using its backup API, retains
+operator config/auth state, replaces old source rather than merging, and
+switches between permanent isolated venv paths. Readiness failures attempt
+rollback; interrupted operations leave a root-owned recovery journal.
+Code-only rollback preserves accounts by default. Database restoration requires
+an explicit destructive flag, and session tokens are always revoked on rollback.
+
+### Deliberately not included
+
+Browser-triggered playbook execution, infrastructure writes, Vault/SSH/WinRM
+credential collection, job workers, customer-scoped roles, MFA, SSO, API bearer
+tokens, generic plugin discovery, or any change to the base AIM installation.
+The `POST /api/v1/runs` compatibility boundary explicitly returns 501 after
+normal authentication/CSRF checks. It never starts a job.
+
+### Upgrade and rollback compatibility
+
+This is the first independent Python add-on release. It is NOT an upgrade path
+for the historical Node/EJS rc19 WebGUI or its API daemon. Leave those separate
+artifacts unused when deploying against rc18.
+
+Future updates must use a new add-on version and an explicitly recorded AIM
+compatibility contract. The installer refuses same-version replacement and
+downgrades through `update`. Use `rollback` for an installed prior snapshot.
+Migrations only advance schema versions; startup refuses a newer database.
+Do not restore an old database merely to roll back compatible code: that would
+also revert password, user and audit changes after the snapshot.
+
+### Verification limits
+
+See `docs/VERIFICATION.md` for actual results. No managed-host Ansible operations
+were run. Linux/systemd activation and an online dependency installation were
+not exercised against the operator's controller. The build container could not
+download browser assets or dependency wheels; deployment has a required pinned,
+integrity-checked online/offline preparation step. No claim of a penetration
+test or a current complete dependency vulnerability audit is made.
+
+## 1.1.0rc7
+- Preserve canonical AIM SSH private keys as service-owned `0600`; WebGUI uses a restricted service-user export bridge and job-private `0600` copies only.
+- Add deletion of terminal job history while retaining append-only audit deletion records. Saved-plan deletion remains supported.
+- Re-run browser-local timestamp formatting after HTMX settle and browser page-cache restores.
+- Document the `aim-runtime` shared-read model: inventories/Vaults `root:aim-runtime`, private keys service-owned `0600`.
diff --git a/scripts/addons/webgui/MANIFEST.sha256 b/scripts/addons/webgui/MANIFEST.sha256
new file mode 100644
index 0000000..ccad07c
--- /dev/null
+++ b/scripts/addons/webgui/MANIFEST.sha256
@@ -0,0 +1,160 @@
+1f1384af56beddd47178a8c60a2237d9f507097aa05c8cd670bae4d741c2d357  ADDON-INSTALLATION.md
+dc99c09506dc06a25ee247d09911149acbd38369de27d4ae818a17d7bafc09fb  AGENTS.md
+c51cfc40c62dd261c5dbab1c9f320a408103433a59530d261b6ba5473dfed740  CHANGELOG.md
+d1997dbfb80c93ee9c407f134dee90d22a52217f62a54bf99a618043cb560ff1  README.md
+ec7dd6d823636327eea262d158f9357bf2c620df8cee377814389a8a8a9688de  constraints.txt
+37142da0781c809f7c10ece7da94a1eea3cc01c88ec1468b440838bbfd7ee299  deploy/deploy.py
+0fea12d2a4a707a64770a5d29a0a4647c0ec7195ecb07ec121b0a3f54e61c36e  deploy/fetch_assets.py
+dae90333281d07cf827585775516dd7091b62fcf0443b3685080739749f86d5c  deploy/nginx.example.conf
+df104ed57e4e0d12c5a280cf8b521680747ec762fce4f7972c9099d4d3b0042d  deploy/profiles/direct-npm.toml
+506e69c23372af047185de91f1a449bf0ac602192a1cd727eac7cf5c46f92cd2  deploy/webgui.example.toml
+80415ff7c4d6a56692405eb7f598592dd934753debd9ba0b6c25587bd17ca461  docs/API.md
+2673309dbf6a037cd9a35da7fb913bb6dc8d32486a52897378941e60a5cc4724  docs/ARCHITECTURE.md
+917e8808e7e8c661ece0e267c604a776bc73b90c0bd2fe38979ee9928dc27f7c  docs/CONTROLLER-PILOT.md
+c3705f7efbbfa4cbe87d962b166522abb52cc0674cdade0014e1e65299828e60  docs/CORE-3.1-REVIEW.md
+d888ee7d061301b9648b50d1736ecac145735c20895b58f4e33477ac9ad443de  docs/CORE-3.2.1RC1-REVIEW.md
+a81d360c0e3cb43c7fca22ebc377d69794a64daf171603dd4d2189e540819739  docs/CORE-3.2.1RC2-REVIEW.md
+8ccc3df07cc54d10048676692e522822719fdfaa44d26f6eb87be4f736ea09e8  docs/CORE-3.3-REVIEW.md
+dd4ef39a61f99eda3ff02d339210572ab0332cf30b0c7321b895a1e8f602b291  docs/CORE-3.3.0RC3-REVIEW.md
+6774b0924ce5a8293c0c6b7c1bf146cd3949be5da5f70c5e095e98993217b499  docs/CORE-3.3.0RC8-REVIEW.md
+969f07f03a6423894c678dbb63e1f5651f16f24f8d1bd3b754612ab30a4d09aa  docs/CREDENTIALS.md
+f1df31bc38df55641d109be5f59086472b179e6f4643f88c52e6f1742e99adc8  docs/DEPLOYMENT.md
+cb9f965d7070d0bb0a3fe7bf76b7d6bec2ddac758d7d5b559d4150d5a41b875b  docs/EXECUTION.md
+d2d8cb462e3589d05f3f335936aefccb5c8e3b5254e7a6157324fef81802e967  docs/JOURNAL.md
+a0b450bb134e0e9c729ebb3beeff426565b0ccb2c9c5c43b129377f757f93bd7  docs/MIGRATION-3.1.md
+408d97151591f55216b83c4e6994f1fb0f42eb04c35e5c57f81b8db8ca648226  docs/PATCH-WAVES.md
+82976cd54ac75b37c1061070fcd88d35a115b55ad53bade6682e3dae8596412d  docs/PERMISSIONS-ROLLOUT.md
+2b31c7fb4d52361be9e2eadb4e445f466ed4c6bbd82ee7dec4a788c94b1a2100  docs/PRODUCT-COMPARISON.md
+f8462d2dd45f035d1c15ef5561f11de4b9ee64b0c5b5abdf7a1c7964dc2da022  docs/READ-ONLY-EXPERIENCE.md
+3955e965c2ad13f081f38fcefa64927e7f28c77cd96a069308beec860d43a591  docs/REPORTS.md
+48c3d5fa43902fd62472eaa59cb36a0291e34c7dd77a7e160fd8e78c4e60eff9  docs/ROADMAP.md
+76fc73c2cf6cf8b8ffab2b20fb4edc8033f8fefe25d654e2e3e8cacb6059a9de  docs/RUN-COMFORT.md
+eb8982fa542381d877b723736423da1f8f79d1730e50a76870ae85e5e23316fe  docs/SECURITY.md
+eccda2e276cc59c58e52e9dd79987253fd92e1eabf4ade1387b097480a140d89  docs/VERIFICATION.md
+bb981b7b25ac6596d0b4e39c4377563afdab1ba309411568f0028123b0cd1865  docs/verification-results.json
+076e15dec2cccb30d41db0caf8c119723989a3db19a8e7c747c7865ec8e4d39f  pyproject.toml
+f8f4b4ca210adbceb2d9c0caad5de35dfa32c8b729c21925fd87ce3330978e2d  requirements-test.txt
+c8883045777b542ac62894e833dc22b332528bbe13ddec90e3a28be82aadc2c9  src/aim_webgui/__init__.py
+7579c8c24cf1822096cdd914b5a60057e94e0e7c21d8e46d50ac2c3416c62ff8  src/aim_webgui/__main__.py
+92c961cf11f9c5e907e00f8ccfc53baac2b2b4901d9518bc9987d4b597b7464e  src/aim_webgui/activity.py
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  src/aim_webgui/adapters/__init__.py
+ae71a963c320b131b85b45ec65525a6cc207bd32b8f0925ef579eb029a353e7f  src/aim_webgui/adapters/core_v1.py
+11d793eb6cf2f4c4862a82e467e5230bf7a391520ede165b151a175a69cce6ef  src/aim_webgui/app.py
+d5f74e126b9e969d93e5156b34d047b3d97471d58de3f0ad14b0948652912acc  src/aim_webgui/assets.py
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  src/aim_webgui/auth/__init__.py
+8178c02694ba9e52529bf6863281a170d394ebc010962b4f3c86f84cc16494d4  src/aim_webgui/auth/service.py
+2aee1ed63c9e6a63ddd685b49763488eb495f44c24647c13d6d72d493fcef95a  src/aim_webgui/cli.py
+7f7d74e6f4bc16be096cdae7b4abdfda8feb830d6b15ad94b6150436531b0d9d  src/aim_webgui/config.py
+a4821e251f2fa79fd5998bcbc4c00871ba23f64d39c014a67c9931b7a02d7ffa  src/aim_webgui/console.py
+ef57a644af7e925375105a9139f0bc4d083be3a18aad21311479e844519c4817  src/aim_webgui/core/__init__.py
+4b40a2f61190f50ddd77cdfea88a61f99a3c5e3288be921a4e2911b8960d4547  src/aim_webgui/core/client.py
+41589bd35f6bd15db01d36f3888f378e913a7e11e633f2adb76d939cf95c9f4b  src/aim_webgui/core/executor.py
+50c900f3df331fb42d7c55b82e4f76103128b5cb98034765b44e1b5b8bec812c  src/aim_webgui/core/jsonio.py
+293206bcb4bea0a6c28662f288762a70ee2428059f5b0536cc4d89e11ade0f0c  src/aim_webgui/core/limits.py
+55fa4979bf80dcf786129208cbd47e891d7d5dff0845884f1975ffe163ff192e  src/aim_webgui/core/process.py
+eb5d9868d930de6c9b2c72c97fdde759c97163a527fb840a54e8f1e01286d3c0  src/aim_webgui/core/protocol.py
+9c0d2343103c62060b901616490b349d27cf82f92700426db9a0de03d241bda2  src/aim_webgui/core/reports.py
+5478f1c990d81f677a3067b6cc9150f8384929b4288d6206970a4b4f459ec95e  src/aim_webgui/credentials/__init__.py
+80fa44f632827f756f07dce4ea074b7c43f2414902fcbc3aeb1d58c4c306057b  src/aim_webgui/credentials/presentation.py
+c16ab7e2c0a48e2ac63b53af4e72b137b5f3cb3141972f723da72289ab8169b6  src/aim_webgui/credentials/service.py
+541f6300ebe90b74f9f8cd99ccfd2346f1182b67a611436cef59326162390dcb  src/aim_webgui/credentials/wire.py
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  src/aim_webgui/db/__init__.py
+31d4dbe46e301e745cf1f9965cfa31761a75978468c2cc0a9ab47eb9f7649e2a  src/aim_webgui/db/migrations/0001_initial.sql
+712492fdcb23d8837c7c5c78de2124f1e3e5dc6956b788b2ae93465df7c2d9f8  src/aim_webgui/db/migrations/0002_workflows.sql
+6a6512b135382c23301b64c7ba88332d20c929fab3dc88ed1a5ab3178bf34985  src/aim_webgui/db/migrations/0003_credentials.sql
+2130f09e21d26a9ebfaddc321cdeb5c8952a3b31d8160ea47dea575ee2aea2ec  src/aim_webgui/db/migrations/0004_core_v1.sql
+18b507b2dcf38a682f24db8771d60dd5fa039a5a110eba2447fec44adcc250f9  src/aim_webgui/db/migrations/0005_job_evidence.sql
+6fb41e826fc86396c54f9b665355eb5612ca58f34b9e4e310687ee3b95851f0a  src/aim_webgui/db/store.py
+56463b5c5aefa0df0751df2ddbeaed29f1f211170dcc7e1d34c0ae593d63087e  src/aim_webgui/diagnostics.py
+2d0fa9753846cadc0eb131a774e5355bb25050fb46ae1bc9a0f9dcca3d8e7ce5  src/aim_webgui/errors.py
+66dcd5b4d83e4c77eb21f651dbf2494ede6ab95c1711887ae905287853217ef9  src/aim_webgui/evidence_views.py
+b691092718c1ded269ef8c8fe7e5c30b30f1bbaab5796ac052ba8ec93890260c  src/aim_webgui/explorer.py
+6b3302db5b97761d48aee621900a1f35bca2a32050479361c8e6e23cc9ebf04e  src/aim_webgui/journal.py
+ce868ddf856ff4c36565cad2734f5e4d16182db822bc06ac802c3f4e95dac32d  src/aim_webgui/names.py
+d982dc030bbaf30785aa337432662471c5970f680d0c64634096d6d5c3aea86d  src/aim_webgui/patch_view.py
+d152c65c95a855e2f553923a0e620c106e9451d181b7ae087757481478425a18  src/aim_webgui/read_views.py
+5db233b25ce1316adb12dc95fcd16e08fb3b9d991e3c48d4232712ff13814c3b  src/aim_webgui/reports.py
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  src/aim_webgui/routes/__init__.py
+8c53fbe43006ada151f4abe6a15c50638fdc6c2b4590ce88129d02ed4e728fca  src/aim_webgui/routes/workflows.py
+0ab884dcef0d56fd7707ff0ba1f7c7b60e485d9923a9db2cccaeb7d7d9555698  src/aim_webgui/security.py
+a562f9af41fccf20b7d344a8015cffab03b24cc043d146746c16c958e0081640  src/aim_webgui/static/css/aim.css
+bd42da3a3466e2cf14f99046c0a3fec29c9498bb3ada1aaed2f32b5280b769c7  src/aim_webgui/static/css/bootstrap-overrides.css
+96e738bd85dc3105c0f5fd463f5ca72424347bb06ab9f5fbc94d4fede05df83b  src/aim_webgui/static/css/credentials.css
+a976ecb03caf249f6cfc382863d370b1e94714a653bebdaba332b7503474ea9e  src/aim_webgui/static/css/evidence.css
+220b3ffb332bb98a87ac1d187ae13b3e324d876d8531a8001ec3c32fb5e0a964  src/aim_webgui/static/css/experience.css
+f7d2db283169d8a04f73f256c7df9b3c513cab36b635032e96ff7a1853c12c3f  src/aim_webgui/static/css/tokens.css
+78fc1d9449080b97716284ce7c261a0ea3fbf5c76d6ccfec16eba0f8f2f27b95  src/aim_webgui/static/js/aim.js
+00a4f188d4bc1131c7e88cca63a5ce5f9cbc15f4c393aa4fcfc054585735bb3b  src/aim_webgui/static/js/credentials.js
+2b45ee9845893852503b031e343046c8b72eecddb3824caca1d09a1d375adf50  src/aim_webgui/static/js/evidence.js
+8ce9d1eafe0e96c8d65f045f0256542e88821521bb8fe4db58e97fedd1385d19  src/aim_webgui/static/js/experience.js
+1b4b4a0d37f3a9d4de5a149cf3d79d573d2dfdbf6abbf317929ed35910edec11  src/aim_webgui/static/js/theme.js
+f9b169a6ac2d46579997299da9a56488a0240db9e4880da653777ccb4c2a03de  src/aim_webgui/static/vendor/THIRD-PARTY.txt
+3208cbbb47ea11d71bd1800d550dd6042e27e7bb26c433c568ecb397c7a9c534  src/aim_webgui/templates/layouts/base.html
+16112906e032601178e3c9828d678859d8eadc0a8c652f137bc0bd934f288787  src/aim_webgui/templates/pages/activity.html
+e6ec444c021b7b042bffae5267950ac56dbaa82833b85d1ee6c3c90c3e58f949  src/aim_webgui/templates/pages/audit.html
+b498800995024eba45adbdc82c5307b38e1f6b32054d253d372acaf711d5731b  src/aim_webgui/templates/pages/credentials.html
+4f10734406e80f907d662ba7d43cf0faff232013773cb4c7cf72a113ab1a4b6c  src/aim_webgui/templates/pages/customers.html
+28a413663f40f4862b1d5ebe8cc59f5bd6ffc262b5773cc73a49861360cd82da  src/aim_webgui/templates/pages/error.html
+42a58b0e19ae4de3a40d90fcbf9e558a9dea9b45a72ae35f60a58f56a03e20f8  src/aim_webgui/templates/pages/explorer.html
+a819d71da97d0739f21578a961dc3ed5eb5ed1067946e263867307b85944a620  src/aim_webgui/templates/pages/hosts.html
+eafde0574c181c1e176bdd63a5a09b37f8c7aae32e9ad69dadb16ba9074a7a60  src/aim_webgui/templates/pages/insights.html
+9322f24f8476864838705775fcf50555cd00922ebef203c58e8bc8e09ea8821f  src/aim_webgui/templates/pages/job.html
+d1258ec71642ab5e8b93d101ca2acc9a119380944f2b533d39f03a1b52223ab2  src/aim_webgui/templates/pages/jobs.html
+2592a7aaabd1b9ed8d55645fe93900b33bad307902c049572acb52f19efdc9a4  src/aim_webgui/templates/pages/login.html
+b642639de0e76bc9070fe8f2d176241787d993a153153ca72c1142b534002e16  src/aim_webgui/templates/pages/overview.html
+f2b7067d2f24e48e6ed40590ba968283c1fe7b54fed11d903d3cd9147b30339e  src/aim_webgui/templates/pages/password.html
+268ab10c351a1e2bbd5df26ad0c134455a7f2e7122173b59853f1dae484d3f5c  src/aim_webgui/templates/pages/plan.html
+6fb355b248007b755abb827a923aac8a6b4da5df4ec02606daa19b6a361147b3  src/aim_webgui/templates/pages/plan_detail.html
+4ccfe0e41a0f9fec427880f49add50e835b3ca78747bffbc2bfc862c7454e8a8  src/aim_webgui/templates/pages/plans.html
+ffe2f058a075bc69ddcc520874928e98c6840079deca7e54f33840be56777a86  src/aim_webgui/templates/pages/playbooks.html
+4e25189e533f9f0a9a2137f4faa8a436fd2a9da3e706790a85c996909e4ac6b3  src/aim_webgui/templates/pages/preflight.html
+e3cf11300103b24baee21156423f410c62d1901b7ee9c21d89662647d5c2686a  src/aim_webgui/templates/pages/progress.html
+86251827563519b1ab7fed7c57c28db891ccbc319753f29905b9187b20760ce3  src/aim_webgui/templates/pages/report.html
+f02c5011a8022943b770fe67f6c862f9ce2801fd2b88a08079ff4a61b63b99cd  src/aim_webgui/templates/pages/setup.html
+4bb8da42b5b57bce49131be876ecdeadd292a8440f89bde384a3275fac78afc7  src/aim_webgui/templates/pages/system.html
+e61b65c17fa24dbe99df9088b6e6e78915b8ca06fe29afabf84fa06a3f538bd1  src/aim_webgui/templates/pages/users.html
+370c78ed200254418afa3faf6496591150fdcaf6d7b97af954bb83cbdf6a7e38  src/aim_webgui/templates/partials/activity_macros.html
+218ce522d1f38d11e005b518a44a6d6d511745836a6a7495103ed33c8359bc38  src/aim_webgui/templates/partials/attention.html
+47e9b1cc70960f0c0f2d37bc90a60f8ffda278d2a8cf9f4ea662670991438939  src/aim_webgui/templates/partials/credential_dialog.html
+633092741d3a0d76582a4a608228360bbae4f6ec2cf47c23f5bee873b4d13bfb  src/aim_webgui/templates/partials/credential_panel.html
+804af94cf92c3e83577ff508872da5a015b7963da8fca35be79b8cb9ce22838e  src/aim_webgui/templates/partials/customers.html
+098a41c6cd6137d19af6f416c03ade15b4ac890b99fda1079cf7a297d89fe393  src/aim_webgui/templates/partials/error.html
+ee1f145576c0ed017e501e85053aee9ff28bb2b16b09feefc75875d211fd5d46  src/aim_webgui/templates/partials/grant_fields.html
+1baa4777f7fd31f56e3bed2b77dfae16f9fc2117c28d746d9aa7596035f90e6a  src/aim_webgui/templates/partials/hosts.html
+7281ecceb20c7f74d9f025a2f37dcacdffd4592d766015f307e15576d85f6455  src/aim_webgui/templates/partials/job.html
+59c4cd9e7192ca65038f140b414c885b1c0bf1fe99d3c7e26fd720d6c87bc633  src/aim_webgui/templates/partials/navigation.html
+5a7ccab88b0314ba6df9ebf2b9b731d93fc447bc5b69bdb391b754c8828b09db  src/aim_webgui/templates/partials/patch_report.html
+5d09d14049e13fffafbb0d5a788bd185b1ddec7fa2370708cdbfe9d9944309ab  src/aim_webgui/templates/partials/preflight.html
+1460829bf004a878742edc683917054e252c19a96412197239f4418ae1726560  src/aim_webgui/templates/partials/progress.html
+0554bcf57db81e330cafd3df916975f7b4acc0313e9cbfdb9ab37b8fa8682339  src/aim_webgui/templates/partials/reports.html
+61e594655689bda7f7483b52c381115a9392bff4378e5629937e702d270eb363  src/aim_webgui/worker.py
+1a6ad0a12a43f9e25977552f5af4535f3fd447819e864b7e5fff4b2302cf68dd  src/aim_webgui/workflows.py
+5ed4630e94de88f231e7d01527efb6e8ab0ef2cb0ebd86c51d753a396a7c8886  tests/benchmark_journal.py
+922138d85c03b14ad2df4861bbc28a9192647904a1e9e0d77ef1ea2a2a552061  tests/benchmark_read_history.py
+4880f3fa6f7a5645a5d5e77532c1c6c118c2a781c7ad935654b46c2c2945de00  tests/browser_credentials_qa.py
+fb3e951f74dfdb923356a35d11e25033ef555ec579d09490c545b4aacfd2b20e  tests/browser_evidence_qa.py
+979b612a5898c9519399f5aa4037b3bdf8265ae1721d9c2942105b0361d08a7a  tests/browser_patch_qa.py
+3258a1f7ea5997bc83f549060a9421c1c267de7a2a635b5640936427bfd1e3f5  tests/browser_qa.py
+1a7a29381207f04e06c49502165c3f4cbf25f8db3bdd6d71ffa0d9b9a7c2cc8d  tests/conftest.py
+cc3e91a6a0c76c7cb37f843cbbff69c9401281287767fca30a07f6931b24f847  tests/evidence_fixtures.py
+b8a3cf8c9fd5987a3103177c5ab035faf0a1835a21a48ced2f0a1747188ac908  tests/fixtures/patch-summary-rc1.json
+e92ab1266cd139b77065ff4e5fa65c6489a1705e5dda3b0a33cd6e3d3e4d8fb1  tests/patch_fixtures.py
+bc55efde812758dedfff615d249aec28feebfe0ec8c03e7c51c11f5f2b37dc6e  tests/run_release_tests.py
+776a7cfdd21704e44070f1e608b64345fdd0b620b356f7c9af6638de5bdab1bd  tests/test_auth.py
+03e5ffbc9b3bdc6627c8a755a481311c071b8ac6773b39c0e355e0804cac77a7  tests/test_core_contract.py
+7fbb53e5a1382d648b0368c6a06c31a8444c780a1c545f9ddc446b59c2986812  tests/test_core_execution.py
+67bfc54b30fb1252358f06c551a877a89b1eca8f9cddeeeb3fba21459f62ef61  tests/test_core_rc8_patch.py
+2fa80cc2eb4b26b882634da157fb4cc293da4e12288a8fd8c3077ed1e60d096d  tests/test_core_reports.py
+5f88ab6355a31b79ea29f9536316e215d187c0b3059175747f203bc65e60212c  tests/test_credential_ux.py
+0df192ca4e46f9f2956012e7ca733d7cfcacc73536ac89bf73e9824c5f7cd888  tests/test_deployment_v2.py
+2e1ddfe17869b6f0ef60527a8e10c129658b310b2bada8c857f643d336d4afa7  tests/test_executor_unix.py
+4d8888c7588523ba9f1feb01139aa18187a89d349a7ce6017d9b87b1b6eb0e12  tests/test_journal_v5.py
+aad1fa10665dacf53ec405586ccc60a112b9005d40bebf7a48691b19052a2af4  tests/test_migration_v4.py
+d6756e12b74e6ca8134c4ac949fef93d0f25dd0fd9bedb287a73ed5294b93b54  tests/test_migration_v5.py
+30539c491ed9d8e6edc2583d2a43de5ab17ca3fd76082b5c1e43259d965a1f7f  tests/test_read_experience.py
+01bf651842bd35fc1d40e7f8e5ec8fd1c5a95ab4243974d7228df5ceee0213db  tests/test_report_transport.py
+2be7f712af36b182db40a9418a6ab238d269ea73278f5e55a8a23ff1eca93c0f  tests/test_reports_v33.py
+88c67c59202b9f1cbb2f74bf5b96bb40e3c24798a9df288c16ac8e98a6f5271a  tests/test_routes_v2.py
+5f3595836e79758fe7c451cb9a851cd00485fc6c91c292acb7ea8903b578070f  tests/test_transport.py
+12adb2e7af91a9de4f6b782273ae91e626fd5ae896fcb4b0f85c7c89f89ee5ab  tests/test_worker_v2.py
+5c8ecd8a5440b1c0ae36870c20e4610b030fe8eae07808f7c63e73a844c28673  tests/test_workflows_v2.py
diff --git a/scripts/addons/webgui/README.md b/scripts/addons/webgui/README.md
new file mode 100644
index 0000000..d674f49
--- /dev/null
+++ b/scripts/addons/webgui/README.md
@@ -0,0 +1,84 @@
+# AIM WebGUI 2.1.0rc9
+
+Independent add-on for **AIM Core 3.3.0rc8**, service/wire/event API **1.0**.
+WebGUI HTTP API **v2**; SQLite **schema 5**. This remains a release candidate,
+not a native Windows Update/controller acceptance certificate.
+
+## This update
+
+Core 3.3.0rc8 keeps service/wire/event API 1.0 and the nine structured report
+contracts, while tightening the native Windows baseline and several runbook internals.
+WebGUI now qualifies exactly against rc8 and requires the live capability metadata to
+advertise `ansible.windows >=3.8.0,<4.0.0`. Collection installation remains Core/operator
+owned; the add-on does not upgrade it.
+
+The patch report accepts rc8's additive `reboot_reasons_before` facts from native
+`ansible.windows.win_reboot_info`, renders them as dated observations, and keeps them
+separate from the existing reboot-required/blocked/continuation semantics. The overall
+patch policy remains unchanged: no automatic retry, no automatic follow-up job, and no
+silent post-reboot continuation.
+
+Windows filesystem reporting is relabeled to match rc8: it represents attached local
+storage volumes. Mapped/network drives are intentionally outside that host-capacity
+report. Existing retained reports continue to render against their recorded contracts.
+
+Core also relocates several AIM-managed Checkmk scripts and hardens their Windows ACLs.
+Those are Core/runbook changes, not WebGUI API changes; WebGUI continues to display the
+validated structured reports rather than reconstructing filesystem paths or ACL state.
+
+## Preserved functionality
+
+The credential modal, grouped passphrase controls, compact mobile hamburger/theme
+header, inventory map, Host Activity, Playbook Insights, one-run review, optional
+collision-safe plan names and per-target/partial-success views remain.
+
+The worker-side structured journal survives page reloads and other-device viewing:
+tail of20,000 events or8MiB by default. Final reports for nine schemas are retained
+separately with a16MiB per-job budget; full parsed Checkmk configuration stays opt-in.
+No raw output archive, credential cache, terminal-history collector, inventory/Vault
+manager or alternative execution engine is added. Job deletion removes linked evidence.
+
+## Install or upgrade
+
+Fresh installations: follow [ADDON-INSTALLATION.md](ADDON-INSTALLATION.md) after Core's
+separate `scripts/docs/INSTALLATION.md`.
+
+Upgrades: read [Deployment](docs/DEPLOYMENT.md). Quiesce work, independently deploy
+Core3.3.0rc8 with its own preview/apply procedure, then install from a fresh add-on
+extraction. The old add-on's exact Core gate must not be bypassed.
+
+```bash
+cd /var/tmp
+sha256sum -c AIM-WebGUI-2.1.0rc9.zip.sha256
+unzip AIM-WebGUI-2.1.0rc9.zip
+cd aim-web-2.1.0rc9
+sudo python3 deploy/deploy.py update
+```
+
+No --migrate-core flag is needed from2.x. From2.1.0rc3, no database schema change is
+needed. Accounts/plans/jobs/journals/reports/audit are retained. The approved full
+webgui.toml is still release-managed and overwritten. Existing unit/permission/staging
+contracts, dependency pins and browser pins are unchanged. No new ports or services.
+Unknown local unit overrides still require operator review.
+
+```bash
+aim-web --version
+aim-web config-check
+sudo systemctl status aim-web-executor.service aim-web.service aim-web-worker.service --no-pager
+sudo -u aim-web aim-web core-check
+```
+
+## Guides
+
+- [Patch-wave inputs, reports and semantic boundaries](docs/PATCH-WAVES.md)
+- [Reviewed Core rc8 delta](docs/CORE-3.3.0RC8-REVIEW.md)
+- [Operation reports](docs/REPORTS.md) and [retained progress](docs/JOURNAL.md)
+- [Credential modal](docs/RUN-COMFORT.md) and [read-only history](docs/READ-ONLY-EXPERIENCE.md)
+- [Controller acceptance](docs/CONTROLLER-PILOT.md)
+- [Current verification and limits](docs/VERIFICATION.md)
+- [Public API](docs/API.md), [security](docs/SECURITY.md), [agent standards](AGENTS.md)
+
+The release is not a complete offline dependency bundle. Bootstrap5.3.8 / HTMX2.0.10
+remain locally served and integrity-checked by the installer. Tests are separate from
+managed production environments; fixture browser assets and native-command simulators
+are never release acceptance of actual target updates or the production service sandbox.
diff --git a/scripts/addons/webgui/constraints.txt b/scripts/addons/webgui/constraints.txt
new file mode 100644
index 0000000..e8e0e21
--- /dev/null
+++ b/scripts/addons/webgui/constraints.txt
@@ -0,0 +1,25 @@
+# Deployment constraints: tested resolved runtime versions, independent of AIM.
+# No claim of being the newest releases. Review advisory updates before promotion.
+fastapi==0.128.2
+starlette==0.50.0
+uvicorn==0.48.0
+Jinja2==3.1.6
+argon2-cffi==25.1.0
+argon2-cffi-bindings==25.1.0
+ruamel.yaml==0.18.17
+ruamel.yaml.clib==0.2.15
+pydantic==2.13.4
+pydantic-core==2.46.4
+annotated-types==0.7.0
+annotated-doc==0.0.4
+typing-extensions==4.16.0
+typing-inspection==0.4.2
+anyio==4.13.0
+idna==3.17
+click==8.1.8
+h11==0.16.0
+MarkupSafe==3.0.3
+cffi==2.0.0
+pycparser==3.0
+setuptools==82.0.1
+packaging==25.0
diff --git a/scripts/addons/webgui/deploy/deploy.py b/scripts/addons/webgui/deploy/deploy.py
new file mode 100644
index 0000000..22fb93e
--- /dev/null
+++ b/scripts/addons/webgui/deploy/deploy.py
@@ -0,0 +1,890 @@
+#!/usr/bin/env python3
+"""Root-only, staged replacement of the WebGUI add-on. Never runs pip for AIM.
+
+Run from a freshly unpacked release directory, not the active add-on directory.
+Linux + systemd + Python >=3.11. See docs/DEPLOYMENT.md before use.
+"""
+from __future__ import annotations
+
+import argparse
+from dataclasses import dataclass
+from datetime import datetime, timezone
+import fcntl
+import grp
+import hashlib
+import json
+import os
+from pathlib import Path
+import pwd
+import re
+import shutil
+import sqlite3
+import subprocess
+import sys
+import tempfile
+import time
+import tomllib
+from urllib.request import Request, ProxyHandler, build_opener
+from urllib.parse import urlsplit
+
+from fetch_assets import prepare
+
+SERVICE = 'aim-web.service'
+PREFIX = Path('/opt/aim-web')
+STATE = Path('/var/lib/aim/webgui')
+BACKUPS = Path('/var/backups/aim-web')
+UNIT = Path('/etc/systemd/system') / SERVICE
+META = PREFIX / 'deployment.json'
+PENDING = PREFIX / 'pending.json'
+CLI_LINK = Path('/usr/local/bin/aim-web')
+EXECUTOR_UNIT = UNIT.with_name('aim-web-executor.service')
+EXECUTOR_STATE = Path('/var/lib/aim-web-executor')
+LEGACY_FILES = (
+    Path('/usr/local/libexec/aim-web-key-export'),
+    Path('/etc/sudoers.d/aim-web-key-export'),
+    Path('/etc/systemd/system/aim-web-worker.service.d/10-key-export-capabilities.conf'),
+)
+
+
+def executor_service(action):
+    if EXECUTOR_UNIT.is_file():
+        run(['systemctl', action, EXECUTOR_UNIT.name])
+
+
+def unit_text(user, group, config, command, *, executor=False, executor_group=None, supplementary_group=None, executor_local_home=None):
+    description = 'AIM WebGUI core executor (AIM remains separately managed)' if executor else 'AIM WebGUI ' + command
+    state = EXECUTOR_STATE if executor else STATE
+    runtime = 'RuntimeDirectory=aim-web-executor\nRuntimeDirectoryMode=0711\n' if executor else ''
+    # Native core takes its own inventory locks. DAC permissions still decide write
+    # access. The add-on does not chown or otherwise modify the inventory tree.
+    executor_home = EXECUTOR_STATE
+    staging = executor_home / '.ansible/tmp'
+    executor_local_tmp = Path(executor_local_home) / '.ansible/tmp' if executor and executor_local_home is not None else None
+    writable = f'{state} {staging} {executor_local_tmp} -/etc/ansible/inventories' if executor else str(state)
+    after = 'After=network.target\n' if executor else 'After=network.target aim-web-executor.service\nWants=aim-web-executor.service\n'
+    executor_env = f'Environment=HOME={executor_home}\n' if executor else ''
+    executor_pre = f'ExecStartPre={PREFIX}/current/bin/aim-web --config {config} core-staging-check\n' if executor else ''
+    service_group = executor_group if executor and executor_group is not None else group
+    supplementary = f'SupplementaryGroups={supplementary_group}\n' if executor and supplementary_group is not None else ''
+    return f'''[Unit]
+Description={description}
+{after}
+[Service]
+Type=simple
+User={user}
+Group={service_group}
+{supplementary}WorkingDirectory=/
+ExecStart={PREFIX}/current/bin/aim-web --config {config} {command}
+Environment=PYTHONDONTWRITEBYTECODE=1
+Environment=PYTHONNOUSERSITE=1
+{executor_env}{executor_pre}UMask=0077
+Restart=on-failure
+RestartSec=3
+KillMode=control-group
+TimeoutStopSec=30
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome={'read-only' if executor else 'true'}
+ReadWritePaths={writable}
+{runtime}RestrictSUIDSGID=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+CapabilityBoundingSet=
+AmbientCapabilities=
+LockPersonality=true
+LimitCORE=0
+
+[Install]
+WantedBy=multi-user.target
+'''
+
+
+def provision_executor_staging(executor_user):
+    account=pwd.getpwnam(executor_user)
+    base=EXECUTOR_STATE / '.ansible'
+    staging=base / 'tmp'
+    local_base=Path(account.pw_dir) / '.ansible'
+    local_staging=local_base / 'tmp'
+    for path in (EXECUTOR_STATE,base,staging,local_base,local_staging):
+        path.mkdir(mode=0o700,parents=True,exist_ok=True)
+        os.chown(path,account.pw_uid,account.pw_gid)
+        path.chmod(0o700)
+
+
+
+def require_owner_mode(path: Path, uid: int, gid: int, mode: int, *, kind: str = 'path'):
+    if path.is_symlink() or not path.exists():
+        raise ValueError(f'Managed {kind} is missing or a symlink: {path}')
+    st=path.stat()
+    actual=st.st_mode & 0o777
+    if st.st_uid!=uid or st.st_gid!=gid or actual!=mode:
+        raise ValueError(
+            f'Managed {kind} has unexpected ownership/mode: {path}; '
+            f'expected uid={uid} gid={gid} mode={mode:04o}, got '
+            f'uid={st.st_uid} gid={st.st_gid} mode={actual:04o}.')
+
+
+def validate_managed_permissions(service_user: str, executor_user: str, config: Path):
+    web=pwd.getpwnam(service_user); executor=pwd.getpwnam(executor_user)
+    require_owner_mode(STATE,web.pw_uid,web.pw_gid,0o700,kind='WebGUI state directory')
+    require_owner_mode(config,0,web.pw_gid,0o640,kind='WebGUI configuration')
+    require_owner_mode(EXECUTOR_STATE,executor.pw_uid,executor.pw_gid,0o700,kind='executor state directory')
+    require_owner_mode(EXECUTOR_STATE/'.ansible',executor.pw_uid,executor.pw_gid,0o700,kind='executor Ansible directory')
+    require_owner_mode(EXECUTOR_STATE/'.ansible/tmp',executor.pw_uid,executor.pw_gid,0o700,kind='executor controller-local staging directory')
+    require_owner_mode(Path(executor.pw_dir)/'.ansible',executor.pw_uid,executor.pw_gid,0o700,kind='executor delegated-local Ansible directory')
+    require_owner_mode(Path(executor.pw_dir)/'.ansible/tmp',executor.pw_uid,executor.pw_gid,0o700,kind='executor delegated-local staging directory')
+    for path in (UNIT,worker_unit(),EXECUTOR_UNIT):
+        require_owner_mode(path,0,0,0o644,kind='systemd unit')
+
+
+def validate_executor_runtime_permissions(service_user: str, executor_user: str, socket_path: Path):
+    web=pwd.getpwnam(service_user); executor=pwd.getpwnam(executor_user)
+    require_owner_mode(socket_path.parent,executor.pw_uid,executor.pw_gid,0o711,kind='executor runtime directory')
+    require_owner_mode(socket_path,executor.pw_uid,web.pw_gid,0o660,kind='executor socket')
+
+
+def wait_executor_runtime_permissions(service_user: str, executor_user: str, socket_path: Path, *, timeout: float = 10.0):
+    """Wait for the Type=simple executor to bind and permission its managed socket.
+
+    systemctl start returns after the process is launched, not after Executor.run()
+    has completed capability negotiation and listener.bind().  Treat a missing socket
+    during that short window as startup-in-progress, not as a migration failure.
+    """
+    deadline=time.monotonic()+timeout
+    last=None
+    while True:
+        try:
+            validate_executor_runtime_permissions(service_user,executor_user,socket_path)
+            return
+        except ValueError as exc:
+            last=exc
+        active=subprocess.run(['systemctl','is-active','--quiet',EXECUTOR_UNIT.name]).returncode==0
+        if not active:
+            raise ValueError('Executor service exited before its managed socket became ready.') from last
+        if time.monotonic()>=deadline:
+            raise ValueError(f'Executor managed socket did not become ready within {timeout:g}s: {socket_path}') from last
+        time.sleep(0.1)
+
+def validate_legacy_files():
+    for path in LEGACY_FILES:
+        if path.is_symlink():
+            raise ValueError(f'Refusing a symlink at legacy bridge: {path}')
+        if not path.exists():
+            continue
+        text = path.read_text()
+        if path.name == 'aim-web-key-export':
+            if 'key' not in text or ('aim-web' not in text and 'private' not in text.lower()):
+                raise ValueError(f'Unrecognized legacy bridge; review manually: {path}')
+        elif 'CapabilityBoundingSet=CAP_SETUID CAP_SETGID' not in text:
+            raise ValueError(f'Unexpected worker capability override; review manually: {path}')
+    # Other unit overrides can silently retain the old identity/capabilities.
+    for name in ('aim-web.service','aim-web-worker.service','aim-web-executor.service'):
+        directory = UNIT.parent / (name + '.d')
+        if directory.exists():
+            unexpected = [p for p in directory.glob('*.conf') if p not in LEGACY_FILES]
+            if unexpected:
+                raise ValueError('Review and temporarily move unmanaged unit drop-ins before migration: ' + ', '.join(map(str,unexpected)))
+
+
+def restore_extra(snapshot, record):
+    for number,path in enumerate((EXECUTOR_UNIT,*LEGACY_FILES)):
+        saved=snapshot/f'extra-{number}'
+        if saved.exists():
+            path.parent.mkdir(parents=True,exist_ok=True)
+            atomic_bytes(path,saved.read_bytes(),record['extra_modes'][str(path)])
+            os.chown(path,0,0)
+        else:
+            path.unlink(missing_ok=True)
+
+
+
+def run(args, *, capture=False, **kwargs):
+    return subprocess.run([str(a) for a in args], check=True, text=True, capture_output=capture, **kwargs)
+
+
+def atomic_bytes(path: Path, data: bytes, mode=0o600):
+    if path.is_symlink():
+        raise ValueError(f'Refusing a symlink at managed file: {path}')
+    fd, name = tempfile.mkstemp(prefix='.aim-web-', dir=path.parent)
+    temp = Path(name)
+    try:
+        with os.fdopen(fd, 'wb') as stream:
+            stream.write(data)
+            stream.flush()
+            os.fsync(stream.fileno())
+        temp.chmod(mode)
+        os.replace(temp, path)
+        directory = os.open(path.parent, os.O_RDONLY | os.O_DIRECTORY)
+        try:
+            os.fsync(directory)
+        finally:
+            os.close(directory)
+    finally:
+        temp.unlink(missing_ok=True)
+
+
+def write_json(path, value):
+    atomic_bytes(path, (json.dumps(value, indent=2) + '\n').encode())
+
+
+
+
+def sqlite_backup(source: Path, destination: Path):
+    """Create a consistent SQLite checkpoint without importing any WebGUI runtime."""
+    if not source.is_file():
+        raise ValueError(f'Authentication database is missing: {source}')
+    destination.unlink(missing_ok=True)
+    src = sqlite3.connect(f'file:{source}?mode=ro', uri=True)
+    dst = sqlite3.connect(destination)
+    try:
+        src.backup(dst)
+        dst.commit()
+    finally:
+        dst.close()
+        src.close()
+    destination.chmod(0o600)
+
+def current_env() -> Path | None:
+    link = PREFIX / 'current'
+    return link.resolve() if link.is_symlink() else None
+
+
+def switch_env(env: Path):
+    link = PREFIX / '.current-next'
+    if link.exists() or link.is_symlink():
+        link.unlink()
+    link.symlink_to(env)
+    os.replace(link, PREFIX / 'current')
+
+
+def ensure_cli_link():
+    """Expose the active release on PATH without copying a versioned executable."""
+    target = PREFIX / 'current/bin/aim-web'
+    if CLI_LINK.exists() and not CLI_LINK.is_symlink():
+        raise ValueError(f'Refusing to overwrite an unmanaged CLI file: {CLI_LINK}')
+    if CLI_LINK.is_symlink():
+        if Path(os.readlink(CLI_LINK)) != target:
+            raise ValueError(f'Refusing to replace an unrelated CLI symlink: {CLI_LINK}')
+        return
+    CLI_LINK.parent.mkdir(parents=True, mode=0o755, exist_ok=True)
+    temporary = CLI_LINK.parent / ('.aim-web-link-' + new_id())
+    try:
+        temporary.symlink_to(target)
+        os.replace(temporary, CLI_LINK)
+    finally:
+        temporary.unlink(missing_ok=True)
+
+
+def remove_managed_cli_link():
+    target = PREFIX / 'current/bin/aim-web'
+    if CLI_LINK.is_symlink() and Path(os.readlink(CLI_LINK)) == target:
+        CLI_LINK.unlink()
+
+
+def worker_unit() -> Path:
+    return UNIT.with_name('aim-web-worker.service')
+
+
+def worker_active() -> bool:
+    return worker_unit().is_file() and subprocess.run(
+        ['systemctl', 'is-active', '--quiet', 'aim-web-worker.service'], check=False).returncode == 0
+
+
+def worker_service(action):
+    if worker_unit().is_file():
+        run(['systemctl', action, 'aim-web-worker.service'])
+
+
+def active() -> bool:
+    return subprocess.run(['systemctl', 'is-active', '--quiet', SERVICE], check=False).returncode == 0
+
+
+def service(action):
+    run(['systemctl', action, SERVICE])
+
+
+def web_config_value(config: dict, section: str, key: str, legacy: str, default):
+    values = config.get(section, {})
+    if isinstance(values, dict) and key in values:
+        return values[key]
+    return config.get(legacy, default)
+
+
+def safe_absolute(path: Path) -> Path:
+    # Protect systemd syntax and prevent unexpectedly following operator symlinks.
+    if not path.is_absolute() or not re.fullmatch(r'/[A-Za-z0-9_./-]+', str(path)):
+        raise ValueError('Deployment paths must be absolute and contain only letters, digits, /, _, . and -.')
+    if path.resolve() != path:
+        raise ValueError(f'Use a canonical path without symlinks or dot components: {path}')
+    return path
+
+
+def release_order(version: str) -> tuple[int, ...]:
+    match = re.fullmatch(r'(\d+)\.(\d+)\.(\d+)(?:rc(\d+))?', version)
+    if not match:
+        raise ValueError('Use independent x.y.z or x.y.zrcN add-on versions.')
+    major, minor, patch, rc = match.groups()
+    return (int(major), int(minor), int(patch), int(rc is None), int(rc or 0))
+
+
+def new_id() -> str:
+    return datetime.now(timezone.utc).strftime('%Y%m%dT%H%M%S%fZ')
+
+
+@dataclass
+class Deployment:
+    scripts: Path
+    user: str
+    required_gid: int
+
+    @property
+    def target(self):
+        return self.scripts / 'addons/webgui'
+
+    @property
+    def config(self):
+        return self.scripts / 'config/webgui.toml'
+
+    def as_user(self, command, *, capture=False):
+        account = pwd.getpwnam(self.user)
+        groups = list(set(os.getgrouplist(self.user, account.pw_gid) + [self.required_gid]))
+        def drop():
+            os.setgroups(groups)
+            os.setgid(account.pw_gid)
+            os.setuid(account.pw_uid)
+            os.umask(0o077)
+        env = {'PATH':'/usr/sbin:/usr/bin:/sbin:/bin', 'HOME':str(STATE), 'LANG':'C.UTF-8',
+               'PYTHONDONTWRITEBYTECODE':'1', 'PYTHONNOUSERSITE':'1'}
+        return run(command, preexec_fn=drop, cwd='/', env=env, capture=capture)
+
+    def as_executor(self, user, command, *, capture=False):
+        account=pwd.getpwnam(user)
+        web=pwd.getpwnam(self.user)
+        def drop():
+            # Match the managed systemd identity: preserve the executor account's
+            # normal primary GID and add only the WebGUI group needed for the
+            # release-managed config/socket boundary. No /etc/group mutation.
+            os.setgroups(list(set(os.getgrouplist(user,account.pw_gid) + [web.pw_gid])))
+            os.setgid(account.pw_gid)
+            os.setuid(account.pw_uid)
+            os.umask(0o077)
+        environment={'PATH':'/usr/local/bin:/usr/bin:/bin','HOME':str(EXECUTOR_STATE),'LANG':'C.UTF-8',
+                     'PYTHONDONTWRITEBYTECODE':'1','PYTHONNOUSERSITE':'1'}
+        return run(command,preexec_fn=drop,cwd='/',env=environment,capture=capture)
+
+    def cli(self, env, *args, capture=False):
+        return self.as_user([env / 'bin/aim-web', '--config', self.config, *args], capture=capture)
+
+    def snapshot(self, old: dict | None) -> Path:
+        stamp = BACKUPS / new_id()
+        stamp.mkdir(mode=0o700)
+        data = {'previous':old, 'was_active':active(), 'worker_active':worker_active(), 'worker_present':worker_unit().exists(), 'config_present':self.config.exists(),
+                'unit_present':UNIT.exists(), 'database_present':STATE.joinpath('webgui.sqlite3').exists()}
+        if self.target.exists():
+            shutil.copytree(self.target, stamp / 'source', symlinks=True)
+        if self.config.exists():
+            shutil.copy2(self.config, stamp / 'webgui.toml')
+        if UNIT.exists():
+            shutil.copy2(UNIT, stamp / 'aim-web.service')
+        if worker_unit().exists():
+            shutil.copy2(worker_unit(), stamp / 'aim-web-worker.service')
+        if data['database_present']:
+            # Use SQLite's online backup API directly. Snapshotting must not depend on
+            # the previous WebGUI runtime being able to parse the current config.
+            sqlite_backup(STATE / 'webgui.sqlite3', stamp / 'webgui.sqlite3')
+            os.chown(stamp / 'webgui.sqlite3', 0, 0)
+        data['executor_active'] = EXECUTOR_UNIT.exists() and subprocess.run(['systemctl','is-active','--quiet',EXECUTOR_UNIT.name],check=False).returncode==0
+        data['extra_modes']={}
+        for number,path in enumerate((EXECUTOR_UNIT,*LEGACY_FILES)):
+            if path.exists():
+                if path.is_symlink():raise ValueError(f'Unexpected symlink: {path}')
+                shutil.copy2(path,stamp/f'extra-{number}')
+                data['extra_modes'][str(path)] = path.stat().st_mode & 0o777
+        write_json(stamp / 'snapshot.json', data)
+        return stamp
+
+    def restore_db(self, snapshot: Path):
+        source = snapshot / 'webgui.sqlite3'
+        if not source.is_file():
+            raise ValueError('This snapshot has no database to restore.')
+        target = STATE / 'webgui.sqlite3'
+        temporary = STATE / '.restore.sqlite3'
+        temporary.unlink(missing_ok=True)
+        shutil.copyfile(source, temporary)
+        account = pwd.getpwnam(self.user)
+        os.chown(temporary, account.pw_uid, account.pw_gid)
+        temporary.chmod(0o600)
+        # Service must be stopped. Preserve failed data in the snapshot before replacement.
+        for suffix in ('', '-wal', '-shm', '-journal'):
+            file = Path(str(target) + suffix)
+            if file.exists():
+                shutil.copy2(file, snapshot / ('pre-restore-' + new_id() + suffix + '.sqlite3'))
+                if suffix:
+                    file.unlink()
+        os.replace(temporary, target)
+
+    def restore(self, snapshot: Path, *, database: bool, config: bool = False):
+        record = json.loads((snapshot / 'snapshot.json').read_text())
+        old = record['previous']
+        worker_service('stop')
+        executor_service('stop')
+        restore_extra(snapshot,record)
+        if old is None:
+            # An early first-install failure may not have created/loaded a unit.
+            if UNIT.exists() or active():
+                service('stop')
+            # A failed first install preserves private state for a deliberate retry.
+            if self.target.exists():
+                shutil.rmtree(self.target)
+            (PREFIX / 'current').unlink(missing_ok=True)
+            remove_managed_cli_link()
+            META.unlink(missing_ok=True)
+            subprocess.run(['systemctl','disable',SERVICE,'aim-web-worker.service',EXECUTOR_UNIT.name],check=False,stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL)
+            UNIT.unlink(missing_ok=True)
+            worker_unit().unlink(missing_ok=True)
+            if config:
+                self.config.unlink(missing_ok=True)
+            run(['systemctl', 'daemon-reload'])
+            return
+        service('stop')
+        if database:
+            self.restore_db(snapshot)
+        staged = self.target.parent / ('.webgui-restore-' + new_id())
+        shutil.copytree(snapshot / 'source', staged, symlinks=True)
+        displaced = self.target.parent / ('.webgui-displaced-' + new_id())
+        if self.target.exists():
+            os.replace(self.target, displaced)
+        os.replace(staged, self.target)
+        if displaced.exists():
+            shutil.rmtree(displaced)
+        switch_env(Path(old['venv']))
+        ensure_cli_link()
+        if config and record['config_present']:
+            atomic_bytes(self.config, (snapshot / 'webgui.toml').read_bytes(), 0o640)
+            os.chown(self.config, 0, pwd.getpwnam(self.user).pw_gid)
+        if record['unit_present']:
+            atomic_bytes(UNIT, (snapshot / 'aim-web.service').read_bytes(), 0o644)
+        if record.get('worker_present'):
+            atomic_bytes(worker_unit(), (snapshot / 'aim-web-worker.service').read_bytes(), 0o644)
+        else:
+            if worker_unit().exists():
+                run(['systemctl', 'disable', 'aim-web-worker.service'])
+                worker_unit().unlink()
+        write_json(META, old)
+        run(['systemctl', 'daemon-reload'])
+        # Revoking sessions also avoids restoring live session tokens from backups.
+        self.as_user([Path(old['venv']) / 'bin/python', '-c',
+                      'from aim_webgui.auth.service import Auth; from aim_webgui.config import Settings; '
+                      'from pathlib import Path; import sys; a=Auth(Settings.load(Path(sys.argv[1]))); '
+                      'db=a.store.connect(); db.execute("DELETE FROM sessions"); db.commit(); db.close()', self.config])
+        if release_order(old['version'])[0] < 2:
+            # The core was separately upgraded to 3.3.0rc8. The legacy 1.x adapter
+            # cannot be declared healthy here. Restored history/code remains stopped.
+            subprocess.run(['systemctl','disable',SERVICE,'aim-web-worker.service'],check=False,stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL)
+            print('Restored legacy WebGUI but left services STOPPED and disabled: coordinate a separate AIM core rollback before restarting. AIM was not changed.',file=sys.stderr)
+            return
+        # Source and state restoration must not restart an adapter whose exact
+        # independently managed Core contract is no longer available. Probe using
+        # the restored package/config and the executor identity, never root.
+        if not self.restored_core_compatible(old):
+            subprocess.run(['systemctl','disable',SERVICE,'aim-web-worker.service',EXECUTOR_UNIT.name],
+                           check=False,stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL)
+            print('Restored add-on source/config/state; services remain STOPPED and disabled. '
+                  'The restored adapter does not qualify the currently installed Core. '
+                  'Coordinate the independent Core rollback, then explicitly re-enable services. '
+                  'No Core files were changed.',file=sys.stderr)
+            return
+        if record.get('executor_active'):
+            executor_service('start')
+        self.cli(Path(old['venv']), 'check')
+        if record['was_active']:
+            service('start')
+            self.health()
+        if record.get('worker_active'):
+            worker_service('start')
+
+    def restored_core_compatible(self, old):
+        try:
+            self.as_executor(old.get('executor_user','svc_bf-ansible'),
+                [Path(old['venv'])/'bin/python','-B','-c',
+                 'from dataclasses import replace; from pathlib import Path; import sys; '
+                 'from aim_webgui.config import Settings; from aim_webgui.adapters.core_v1 import CoreAdapter; '
+                 'CoreAdapter(replace(Settings.load(Path(sys.argv[1])),core_transport="stdio"))',self.config],capture=True)
+            return True
+        except (OSError,ValueError,subprocess.SubprocessError):
+            return False
+
+    def health(self):
+        with self.config.open('rb') as stream:
+            config = tomllib.load(stream)
+        host = web_config_value(config, 'server', 'host', 'host', '127.0.0.1')
+        port = web_config_value(config, 'server', 'port', 'port', 8080)
+        # A wildcard listener is not a routable health-check destination.
+        check_host = '127.0.0.1' if host in {'0.0.0.0', '::'} else host
+        authority = f'[{check_host}]' if ':' in check_host else check_host
+        url = f'http://{authority}:{port}/readyz'
+        origin = urlsplit(web_config_value(config, 'server', 'public_url', 'public_url', 'http://127.0.0.1:8080'))
+        opener = build_opener(ProxyHandler({}))
+        for _ in range(12):
+            try:
+                req = Request(url, headers={'Host':origin.netloc})
+                with opener.open(req, timeout=10) as response:
+                    if response.status == 200 and json.load(response).get('status') == 'ready':
+                        return
+            except Exception:
+                pass
+            time.sleep(.5)
+        raise RuntimeError('Readiness check failed. Inspect journalctl -u aim-web.service.')
+
+
+def verify_release(source):
+    """Verify the ZIP payload manifest before staging/provisioning any resource.
+
+    The separately verified ZIP digest checks the expected release file;
+    this manifest detects extraction damage, not publisher signatures.
+    """
+    manifest=source/'MANIFEST.sha256'
+    if not manifest.is_file() or manifest.is_symlink():
+        raise ValueError('Missing release MANIFEST.sha256. Use a fresh release ZIP.')
+    seen=set()
+    for line in manifest.read_text(encoding='utf-8').splitlines():
+        if not line: continue
+        digest,sep,name=line.partition('  ')
+        rel=Path(name)
+        normalized=rel.as_posix()
+        if not sep or not re.fullmatch('[0-9a-f]{64}',digest) or not name or rel.is_absolute() or '..' in rel.parts or normalized in seen:
+            raise ValueError('Invalid release manifest entry.')
+        seen.add(normalized)
+        path=source/rel
+        if any(p.is_symlink() for p in (path,*path.parents)) or not path.is_file():
+            raise ValueError('Release manifest references an unsafe or missing file.')
+        if hashlib.sha256(path.read_bytes()).hexdigest()!=digest:
+            raise ValueError('Release integrity mismatch: '+name)
+    if not {'pyproject.toml','deploy/deploy.py','src/aim_webgui/__init__.py'}<=seen:
+        raise ValueError('Release manifest does not cover required files.')
+
+
+def install(args):
+    scripts = safe_absolute(args.aim_scripts)
+    source = Path(__file__).resolve().parents[1]
+    verify_release(source)
+    target = scripts / 'addons/webgui'
+    if source == target:
+        raise ValueError('Unpack the new ZIP in a separate staging directory; do not update from the active source.')
+    if not scripts.is_dir():
+        raise ValueError('Deploy the separately managed AIM core first.')
+    core_launcher = args.aimctl.absolute()
+    if not core_launcher.is_file() or not os.access(core_launcher,os.X_OK):
+        raise ValueError('The configured aimctl launcher is missing or not executable. Deploy AIM 3.3.0rc8 first; this installer never creates it.')
+    safe_absolute(args.core_config)
+    if not re.fullmatch(r'[a-z_][a-z0-9_-]{0,30}',args.executor_user):raise ValueError('Invalid executor account name.')
+    try: executor_account=pwd.getpwnam(args.executor_user)
+    except KeyError: raise ValueError('Provision and authorize the existing non-root AIM execution/key-owning account first.') from None
+    if executor_account.pw_uid==0 or args.executor_user==args.service_user:
+        raise ValueError('Managed topology needs distinct non-root web and execution accounts.')
+    validate_legacy_files()
+    if any(p.exists() for p in LEGACY_FILES) and not args.migrate_core:
+        raise ValueError('Legacy key-export/capability files exist. Review migration and pass --migrate-core to retire only these backed-up files.')
+    with (source / 'pyproject.toml').open('rb') as stream:
+        project = tomllib.load(stream)['project']
+    version = project['version']
+    if not re.fullmatch(r'[0-9A-Za-z.+-]+', version):
+        raise ValueError('Invalid add-on version.')
+    previous = json.loads(META.read_text()) if META.exists() else None
+    if args.command == 'update' and previous is None:
+        raise ValueError('No managed add-on installation exists. Use install first.')
+    if args.command == 'install' and previous:
+        raise ValueError('Add-on already installed. Use update; existing accounts will be retained.')
+    if previous and release_order(previous['version'])[0] < 2 and not args.migrate_core:
+        raise ValueError('Major core integration migration: pass --migrate-core after reviewing MIGRATION-3.1.md. Old queued work is stopped; schema changes require a backup.')
+    if previous and (previous['scripts'] != str(scripts) or previous['user'] != args.service_user):
+        raise ValueError('Update must retain the installed AIM scripts path and service identity.')
+    if previous and release_order(version) < release_order(previous['version']):
+        raise ValueError('Downgrades use rollback, not update.')
+    if previous and previous['version'] == version:
+        raise ValueError('This add-on version is already installed. Published versions are immutable; use a new release number.')
+    if target.exists() and (not previous or not (target / '.aim-web-managed').is_file()):
+        raise ValueError('Target is not a recognized managed WebGUI directory. Back it up and move it aside manually.')
+    if not previous and UNIT.exists():
+        raise ValueError('An unmanaged aim-web.service already exists; refusing to overwrite it.')
+    if target.is_symlink():
+        raise ValueError('The active add-on source must be a real directory, not a symlink.')
+    for path in source.rglob('*'):
+        if path.is_symlink():
+            raise ValueError(f'Release contains an unexpected symlink: {path}')
+    if not target.parent.exists():
+        target.parent.mkdir(parents=True, mode=0o755)
+        target.parent.chmod(0o755)
+    stage = Path(tempfile.mkdtemp(prefix='.webgui-stage-', dir=target.parent))
+    environment = PREFIX / 'venvs' / (version + '-' + new_id())
+    snapshot = None
+    deployment = None
+    activated = False
+    try:
+        shutil.copytree(source, stage, dirs_exist_ok=True,
+                        ignore=shutil.ignore_patterns('__pycache__', '*.pyc', '.pytest_cache', '.credentials', '*.egg-info', 'build', 'dist', 'wheelhouse', 'offline-assets', '*.zip'))
+        # Network/offline artifacts are prepared BEFORE stopping the running service.
+        prepare(stage / 'src/aim_webgui/static/vendor', args.assets_dir,
+                reuse=target / 'src/aim_webgui/static/vendor' if previous else None)
+        environment.parent.mkdir(parents=True, mode=0o755, exist_ok=True)
+        environment.parent.chmod(0o755)
+        # Runtime code is root-owned but readable/executable by the service account.
+        os.umask(0o022)
+        run([args.python, '-m', 'venv', environment])
+        pip = [environment / 'bin/python', '-m', 'pip', 'install', '--no-compile', '--no-cache-dir']
+        if args.wheelhouse:
+            pip.extend(['--no-index', '--find-links', args.wheelhouse])
+        run([*pip, '-c', stage / 'constraints.txt', 'setuptools'])
+        run([*pip, '--no-build-isolation', '-c', stage / 'constraints.txt', stage])
+        run([environment / 'bin/python', '-m', 'pip', 'check'])
+        identity = run([environment / 'bin/python', '-B', '-c',
+                        'import aim_webgui,importlib.metadata; '
+                        'print(aim_webgui.__version__); print(importlib.metadata.version("aim-webgui"))'], capture=True)
+        if identity.stdout.splitlines() != [version, version]:
+            raise ValueError('Candidate package identity does not match this release; nothing was activated.')
+        os.umask(0o077)
+        # Do not parse or import private core configuration. Public protocol probe follows.
+        if not re.fullmatch(r'[a-z_][a-z0-9_-]{0,30}', args.service_user):
+            raise ValueError('Use a local service account name, not a shell expression.')
+        try:
+            account = pwd.getpwnam(args.service_user)
+        except KeyError:
+            shell = shutil.which('nologin') or '/usr/sbin/nologin'
+            run(['useradd','--system','--user-group','--home-dir',STATE,'--shell',shell,args.service_user])
+            account = pwd.getpwnam(args.service_user)
+        if account.pw_uid == 0:
+            raise ValueError('The web service must not run as root.')
+        if not STATE.parent.exists():
+            STATE.parent.mkdir(parents=True, mode=0o755)
+            STATE.parent.chmod(0o755)
+        STATE.mkdir(mode=0o700, exist_ok=True)
+        if STATE.is_symlink():
+            raise ValueError('State directory must not be a symlink.')
+        os.chown(STATE, account.pw_uid, account.pw_gid)
+        STATE.chmod(0o700)
+        required_gid = account.pw_gid
+        deployment = Deployment(scripts, args.service_user, required_gid)
+        if not deployment.config.parent.exists():
+            deployment.config.parent.mkdir(parents=True, mode=0o755)
+            deployment.config.parent.chmod(0o755)
+
+        # Stage and parse the candidate config without changing the installed config.
+        text=(stage/'deploy/webgui.example.toml').read_text().replace('/etc/ansible/scripts',str(scripts))
+        text=text.replace('command = ["/usr/local/bin/aimctl"]',f'command = [{json.dumps(str(core_launcher))}]')
+        text=text.replace('config = "/etc/ansible/scripts/aim.yml"',f'config = {json.dumps(str(args.core_config))}')
+        text=text.replace('executor_user = "svc_bf-ansible"',f'executor_user = {json.dumps(args.executor_user)}')
+        text=text.replace('client_user = "aim-web"',f'client_user = {json.dumps(args.service_user)}')
+        release_config=tomllib.loads(text)
+        if release_config['state']['state_dir']!=str(STATE):raise ValueError('Unexpected managed state location.')
+        candidate=stage/'candidate.toml'
+        candidate.write_text(text);candidate.chmod(0o640);os.chown(candidate,0,account.pw_gid);stage.chmod(0o755)
+        deployment.as_user([environment/'bin/aim-web','--config',candidate,'check','--without-db','--without-core'])
+        # Test public capabilities and authorization in the EXISTING core environment,
+        # as the eventual executor identity. No dependency installation or core writes.
+        probe=deployment.as_executor(args.executor_user,[environment/'bin/python','-B','-c',
+            'from dataclasses import replace; from pathlib import Path; import sys; '
+            'from aim_webgui.config import Settings; from aim_webgui.adapters.core_v1 import CoreAdapter; '
+            'a=CoreAdapter(replace(Settings.load(Path(sys.argv[1])),core_transport="stdio")); '
+            'print(a.version); print("Authorized customer listing:",len(a.customers()))',candidate],capture=True)
+        print(probe.stdout.strip())
+        candidate.unlink()
+        snapshot=deployment.snapshot(previous)
+        write_json(PENDING,{'backup':snapshot.name,'candidate':str(environment),'phase':'before-stop',
+                           'scripts':str(scripts),'user':args.service_user,'required_gid':required_gid})
+        if previous:
+            worker_service('stop');service('stop');executor_service('stop')
+            sqlite_backup(STATE/'webgui.sqlite3',snapshot/'webgui.sqlite3')
+            os.chown(snapshot/'webgui.sqlite3',0,0)
+        atomic_bytes(deployment.config,text.encode(),0o640);os.chown(deployment.config,0,account.pw_gid)
+        # Neither group memberships nor inventory/key ownership are touched.
+        if EXECUTOR_STATE.exists() and (EXECUTOR_STATE.is_symlink() or EXECUTOR_STATE.stat().st_uid!=executor_account.pw_uid):
+            raise ValueError('Existing executor state directory has an unexpected owner or type.')
+        EXECUTOR_STATE.mkdir(mode=0o700,exist_ok=True);os.chown(EXECUTOR_STATE,executor_account.pw_uid,executor_account.pw_gid);EXECUTOR_STATE.chmod(0o700)
+        provision_executor_staging(args.executor_user)
+        if previous:deployment.cli(environment,'db','migrate')
+        else:deployment.cli(environment,'init')
+        deployment.cli(environment,'check','--without-core')
+        for directory in list(stage.rglob('__pycache__')) + list(stage.glob('src/*.egg-info')) + [stage / 'build', stage / 'dist']:
+            if directory.is_dir():
+                shutil.rmtree(directory)
+        # Source is replaced wholesale. No stale files, git, patch hunks or core overlay.
+        for item in stage.rglob('*'):
+            if not item.is_symlink():
+                item.chmod(0o755 if item.is_dir() else 0o644)
+        (stage / '.aim-web-managed').write_text('aim-webgui ' + version + '\n')
+        (stage / '.credentials').symlink_to(STATE / '.credentials')
+        stage.chmod(0o755)
+        if target.exists():
+            displaced = target.parent / ('.webgui-old-' + new_id())
+            os.replace(target, displaced)
+        else:
+            displaced = None
+        os.replace(stage, target)
+        activated = True
+        if displaced:
+            shutil.rmtree(displaced)
+        switch_env(environment)
+        ensure_cli_link()
+        atomic_bytes(UNIT,unit_text(args.service_user,account.pw_gid,deployment.config,'serve').encode(),0o644)
+        atomic_bytes(worker_unit(),unit_text(args.service_user,account.pw_gid,deployment.config,'worker').encode(),0o644)
+        atomic_bytes(EXECUTOR_UNIT,unit_text(args.executor_user,account.pw_gid,deployment.config,'executor',executor=True,executor_group=executor_account.pw_gid,supplementary_group=account.pw_gid,executor_local_home=executor_account.pw_dir).encode(),0o644)
+        for managed_unit in (UNIT,worker_unit(),EXECUTOR_UNIT): os.chown(managed_unit,0,0);managed_unit.chmod(0o644)
+        validate_managed_permissions(args.service_user,args.executor_user,deployment.config)
+        # Approved major migration retires the known old bridge and elevated worker
+        # override; snapshot restoration restores matching legacy files if needed.
+        for path in LEGACY_FILES:path.unlink(missing_ok=True)
+        write_json(META, {'version':version,'scripts':str(scripts),'user':args.service_user,
+                          'required_gid':required_gid,'venv':str(environment),'backup':snapshot.name,
+                          'executor_user':args.executor_user,'core_version':'3.3.0rc8','api_version':'1.0'})
+        write_json(PENDING, {'backup':snapshot.name,'candidate':str(environment),'phase':'activated',
+                             'scripts':str(scripts),'user':args.service_user,'required_gid':required_gid})
+        run(['systemctl','daemon-reload'])
+        run(['systemctl','enable',EXECUTOR_UNIT.name])
+        executor_service('start')
+        wait_executor_runtime_permissions(args.service_user,args.executor_user,Path(release_config['core']['socket']))
+        run(['systemctl','enable',SERVICE])
+        service('start')
+        deployment.health()
+        if release_config.get('execution', {}).get('enabled', False):
+            run(['systemctl', 'enable', 'aim-web-worker.service'])
+            worker_service('start')
+        else:
+            worker_service('stop')
+            run(['systemctl', 'disable', 'aim-web-worker.service'])
+        deployment.as_user([environment / 'bin/python', '-B', '-c',
+            'import sys; from pathlib import Path; from aim_webgui.config import Settings; '
+            'from aim_webgui.db.store import Store,audit; s=Store(Settings.load(Path(sys.argv[1])).database); '
+            'db=s.connect(); audit(db,"deployer","release-installed",sys.argv[2]); db.commit(); db.close()',
+            deployment.config, version])
+        PENDING.unlink()
+        print(f'Installed AIM WebGUI {version}; separately managed AIM 3.3.0rc8 was not modified.')
+        print(f'Add-on source: {target}')
+        print(f'Configuration: {deployment.config}')
+        print(f'Rollback snapshot: {snapshot.name}')
+        if (STATE / '.credentials').exists():
+            print(f'Initial admin credentials (local file only): {(target / ".credentials").as_uri()}')
+            print(f'Read locally: sudo cat {STATE}/.credentials')
+        print(f'CLI: {CLI_LINK} -> {PREFIX}/current/bin/aim-web')
+        print('Service: systemctl status aim-web.service')
+    except BaseException:
+        if snapshot and deployment and PENDING.exists():
+            print('Deployment failed. Attempting to restore the prior add-on; AIM was not modified.', file=sys.stderr)
+            try:
+                deployment.restore(snapshot, database=bool(previous), config=True)
+                PENDING.unlink(missing_ok=True)
+            except Exception:
+                print(f'Automatic recovery did not complete. Keep service stopped; recovery snapshot: {snapshot}', file=sys.stderr)
+        raise
+    finally:
+        if stage.exists():
+            shutil.rmtree(stage)
+        # Failed venvs are left for diagnosis; never delete one referenced by a snapshot.
+
+
+def rollback(args):
+    if not META.exists():
+        raise ValueError('No active deployment metadata. Recover using docs/DEPLOYMENT.md and pending.json.')
+    latest = json.loads(META.read_text())
+    if not args.backup or not re.fullmatch(r'[0-9]{8}T[0-9]{12}Z', args.backup):
+        raise ValueError('Use --backup with the exact snapshot identifier printed during deployment.')
+    selected = BACKUPS / args.backup
+    record = json.loads((selected / 'snapshot.json').read_text())
+    if not record.get('previous'):
+        raise ValueError('This is the first-install checkpoint, not an earlier installed version.')
+    if record['previous']['scripts'] != latest['scripts']:
+        raise ValueError('Snapshot is for a different installation.')
+    deployment = Deployment(Path(latest['scripts']), latest['user'], latest['required_gid'])
+    if not args.restore_auth_db:
+        # Validate the rollback runtime against the configuration stored with that release.
+        old_env = Path(record['previous']['venv'])
+        schema = deployment.as_user([old_env / 'bin/python', '-B', '-c',
+                                      'from aim_webgui import SCHEMA_VERSION; print(SCHEMA_VERSION)'], capture=True)
+        with sqlite3.connect((STATE / 'webgui.sqlite3').as_uri() + '?mode=ro', uri=True) as db:
+            current_schema = db.execute('PRAGMA user_version').fetchone()[0]
+        if current_schema != int(schema.stdout.strip()):
+            raise ValueError('Rollback crosses a database schema boundary. Use --restore-auth-db explicitly after backing up current data.')
+        with tempfile.TemporaryDirectory(prefix='.rollback-config-', dir=PREFIX) as directory:
+            check_dir = Path(directory)
+            check_dir.chmod(0o755)
+            check_config = check_dir / 'webgui.toml'
+            shutil.copyfile(selected / 'webgui.toml', check_config)
+            check_config.chmod(0o640)
+            os.chown(check_config, 0, pwd.getpwnam(latest['user']).pw_gid)
+            deployment.as_user([old_env / 'bin/aim-web', '--config', check_config, 'check', '--without-db', '--without-core'])
+    current_snapshot = deployment.snapshot(latest)
+    write_json(PENDING, {'backup':current_snapshot.name,'phase':'manual-rollback',
+                         'scripts':latest['scripts'],'user':latest['user'],'required_gid':latest['required_gid']})
+    try:
+        deployment.restore(selected, database=args.restore_auth_db, config=True)
+        PENDING.unlink(missing_ok=True)
+        print('Rollback completed. Release configuration restored. All WebGUI sessions revoked.')
+        print('Auth database restored from snapshot.' if args.restore_auth_db else 'Current users and passwords retained.')
+        print('Undo-rollback snapshot:', current_snapshot.name)
+    except BaseException:
+        deployment.restore(current_snapshot, database=args.restore_auth_db, config=True)
+        PENDING.unlink(missing_ok=True)
+        raise
+
+
+def recover():
+    if not PENDING.is_file():
+        raise ValueError('No interrupted deployment journal exists.')
+    pending = json.loads(PENDING.read_text())
+    snapshot = BACKUPS / pending['backup']
+    record = json.loads((snapshot / 'snapshot.json').read_text())
+    deployment = Deployment(Path(pending['scripts']), pending['user'], pending['required_gid'])
+    deployment.restore(snapshot, database=bool(record['previous']), config=True)
+    PENDING.unlink()
+    print('Interrupted deployment recovered. AIM was not changed.')
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('command', choices=['install','update','rollback','recover'])
+    parser.add_argument('--aim-scripts', type=Path, default=Path('/etc/ansible/scripts'))
+    parser.add_argument('--service-user', default='aim-web')
+    parser.add_argument('--executor-user',default='svc_bf-ansible',help='Existing authorized non-root key-owning AIM account; never created or modified.')
+    parser.add_argument('--aimctl',type=Path,default=Path('/usr/local/bin/aimctl'))
+    parser.add_argument('--core-config',type=Path,default=Path('/etc/ansible/scripts/aim.yml'))
+    parser.add_argument('--migrate-core',action='store_true',help='Acknowledge 1.x to 2.x API/state/service migration; read MIGRATION-3.1.md first.')
+    parser.add_argument('--python', default=sys.executable)
+    parser.add_argument('--wheelhouse', type=Path, help='Offline wheels for this Python/OS/architecture, including build dependencies.')
+    parser.add_argument('--assets-dir', type=Path, help='Offline pinned bootstrap.min.css and htmx.min.js.')
+    parser.add_argument('--backup', help='Rollback snapshot identifier.')
+    parser.add_argument('--restore-auth-db', action='store_true', help='DESTRUCTIVE: discard account changes since selected snapshot.')
+    args = parser.parse_args()
+    if os.geteuid() != 0:
+        parser.exit(1, 'Run deployment with sudo/root. Runtime will use an unprivileged account.\n')
+    if not Path('/run/systemd/system').is_dir():
+        parser.exit(1, 'Managed deployment requires Linux/systemd. See manual installation instructions.\n')
+    os.umask(0o077)
+    for location in (PREFIX, BACKUPS, STATE):
+        safe_absolute(location)
+    PREFIX.mkdir(mode=0o755, parents=True, exist_ok=True)
+    if PREFIX.stat().st_uid != 0:
+        parser.exit(1, 'The managed /opt/aim-web directory must be root-owned.\n')
+    PREFIX.chmod(0o755)
+    BACKUPS.mkdir(mode=0o700, parents=True, exist_ok=True)
+    if BACKUPS.stat().st_uid != 0:
+        parser.exit(1, 'The WebGUI backup directory must be root-owned.\n')
+    BACKUPS.chmod(0o700)
+    lock = os.open(PREFIX / '.deploy.lock', os.O_CREAT | os.O_RDWR | os.O_NOFOLLOW, 0o600)
+    try:
+        fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        if PENDING.exists() and args.command != 'recover':
+            raise ValueError('Interrupted deployment detected in /opt/aim-web/pending.json. Recover before retrying.')
+        if args.command == 'recover':
+            recover()
+        elif args.command == 'rollback':
+            rollback(args)
+        else:
+            install(args)
+    except Exception as exc:
+        parser.exit(1, f'Deployment stopped: {exc}\n')
+    finally:
+        os.close(lock)
+
+
+if __name__ == '__main__':
+    main()
diff --git a/scripts/addons/webgui/deploy/fetch_assets.py b/scripts/addons/webgui/deploy/fetch_assets.py
new file mode 100644
index 0000000..5a86f0c
--- /dev/null
+++ b/scripts/addons/webgui/deploy/fetch_assets.py
@@ -0,0 +1,78 @@
+#!/usr/bin/env python3
+"""Fetch pinned upstream assets ONCE; browsers only load local copies.
+
+Supply --from-directory for air-gapped deployment. Integrity checks are identical.
+No npm, Node, CDN requests from the browser, or mutable 'latest' URLs.
+"""
+from __future__ import annotations
+import argparse
+import base64
+import hashlib
+import os
+from pathlib import Path
+import tempfile
+from urllib.request import urlopen
+
+ASSETS = {
+    'bootstrap.min.css': (
+        'https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/css/bootstrap.min.css',
+        'sRIl4kxILFvY47J16cr9ZwB07vP4J8+LH7qKQnuqkuIAvNWLzeN8tE5YBujZqJLB'),
+    'htmx.min.js': (
+        'https://cdn.jsdelivr.net/npm/htmx.org@2.0.10/dist/htmx.min.js',
+        'H5SrcfygHmAuTDZphMHqBJLc3FhssKjG7w/CeCpFReSfwBWDTKpkzPP8c+cLsK+V'),
+}
+
+
+def valid(data: bytes, expected: str) -> bool:
+    return base64.b64encode(hashlib.sha384(data).digest()).decode('ascii') == expected
+
+
+def prepare(destination: Path, offline: Path | None = None, *, reuse: Path | None = None) -> None:
+    destination.mkdir(parents=True, exist_ok=True)
+    for name, (url, integrity) in ASSETS.items():
+        target = destination / name
+        if target.is_file() and valid(target.read_bytes(), integrity):
+            print('Verified local asset:', name)
+            continue
+        if offline:
+            data = (offline / name).read_bytes()
+        elif reuse and (reuse / name).is_file() and not (reuse / name).is_symlink():
+            candidate = (reuse / name).read_bytes()
+            if valid(candidate, integrity):
+                data = candidate
+                print('Reusing verified installed asset:', name)
+            else:
+                with urlopen(url, timeout=30) as response:
+                    data = response.read(2_000_001)
+        else:
+            with urlopen(url, timeout=30) as response:
+                data = response.read(2_000_001)
+        if len(data) > 2_000_000 or not valid(data, integrity):
+            raise ValueError(f'Upstream integrity mismatch: {name}. No asset was installed.')
+        fd, filename = tempfile.mkstemp(prefix='.asset-', dir=destination)
+        temporary = Path(filename)
+        try:
+            with os.fdopen(fd, 'wb') as stream:
+                stream.write(data)
+                stream.flush()
+                os.fsync(stream.fileno())
+            temporary.chmod(0o644)
+            os.replace(temporary, target)
+        finally:
+            temporary.unlink(missing_ok=True)
+        print('Installed verified local asset:', name)
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--from-directory', type=Path)
+    parser.add_argument('--destination', type=Path, default=Path(__file__).resolve().parents[1] / 'src/aim_webgui/static/vendor')
+    args = parser.parse_args()
+    try:
+        prepare(args.destination, args.from_directory)
+    except Exception as exc:
+        parser.exit(1, f'Assets not prepared: {exc}\nUse --from-directory with the exact pinned upstream files for offline installation.\n')
+
+
+if __name__ == '__main__':
+    main()
diff --git a/scripts/addons/webgui/deploy/nginx.example.conf b/scripts/addons/webgui/deploy/nginx.example.conf
new file mode 100644
index 0000000..ee30179
--- /dev/null
+++ b/scripts/addons/webgui/deploy/nginx.example.conf
@@ -0,0 +1,12 @@
+# NPM header reference only; not installed automatically.
+# Default 2.0 path: HTTPS 192.168.20.46:8443 -> host nginx -> loopback 8080.
+# See docs/EXECUTION.md for separate upstream CA verification requirements.
+# Reference only. Nginx Proxy Manager normally generates the server block.
+# AIM WebGUI does not require WebSockets.
+# Configure webgui.toml public_url to the exact HTTPS browser origin.
+
+proxy_set_header Host $host;
+proxy_set_header X-Real-IP $remote_addr;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_set_header X-Forwarded-Host $host;
diff --git a/scripts/addons/webgui/deploy/profiles/direct-npm.toml b/scripts/addons/webgui/deploy/profiles/direct-npm.toml
new file mode 100644
index 0000000..fb249c4
--- /dev/null
+++ b/scripts/addons/webgui/deploy/profiles/direct-npm.toml
@@ -0,0 +1,65 @@
+# AIM WebGUI 2.1.0rc9 release-managed configuration
+# Replaced on every managed install/update/rollback.
+# AIM core configuration is never modified.
+
+[server]
+host = "0.0.0.0"
+port = 8080
+public_url = "https://aim.desq-gaming.de"
+
+[proxy]
+proxy_headers = true
+forwarded_allow_ips = ["192.168.20.3"]
+
+[session]
+session_hours = 8
+idle_minutes = 30
+
+[aim]
+scripts_path = "/etc/ansible/scripts"
+
+# Public core protocol, not an Ansible executable or private source import.
+[core]
+transport = "unix"
+command = ["/usr/local/bin/aimctl"]
+config = "/etc/ansible/scripts/aim.yml"
+socket = "/run/aim-web-executor/core.sock"
+executor_user = "svc_bf-ansible"
+client_user = "aim-web"
+# Dedicated writable process HOME for native caches; SSH trust uses effective SSH configuration.
+home = "/var/lib/aim-web-executor"
+
+[state]
+state_dir = "/var/lib/aim/webgui"
+
+# Alternative browsing-only direct NPM -> application profile; do not use it to carry infrastructure credentials.
+# This release does not create, replace or renew the separately installed TLS certificates.
+[execution]
+enabled = false
+playbooks = [
+    "checkmk_install_agent",
+    "checkmk_update_scripts_config",
+    "checkmk_read_windows_config",
+    "checkmk_cleanup_scripts",
+    "debug_test_connection",
+    "debug_show_disk_usage",
+    "debug_detect_host_roles",
+    "maintenance_export_event_logs",
+    "maintenance_start_stopped_services",
+    "maintenance_patch_os",
+    "maintenance_reboot_hosts",
+    "sophos_apply_baseline",
+    "sophos_apply_customer",
+    "pfsense_apply_baseline",
+]
+max_hosts = 25
+timeout_seconds = 1800
+require_approval = false
+# WebGUI policy only; core addons.execution_enabled is a separate operator opt-in.
+# Direct NPM -> application HTTP is browsing-only until authenticated transport is separately designed.
+transport_verified = false
+window_start_hour = 0
+window_end_hour = 24
+
+[credentials]
+enabled = false
diff --git a/scripts/addons/webgui/deploy/webgui.example.toml b/scripts/addons/webgui/deploy/webgui.example.toml
new file mode 100644
index 0000000..9a39a79
--- /dev/null
+++ b/scripts/addons/webgui/deploy/webgui.example.toml
@@ -0,0 +1,75 @@
+# AIM WebGUI 2.1.0rc9 release-managed configuration
+# Replaced on every managed install/update/rollback.
+# AIM core configuration is never modified.
+
+[server]
+host = "127.0.0.1"
+port = 8080
+public_url = "https://aim.desq-gaming.de"
+
+[proxy]
+proxy_headers = true
+forwarded_allow_ips = ["127.0.0.1"]
+
+[session]
+session_hours = 8
+idle_minutes = 30
+
+[aim]
+scripts_path = "/etc/ansible/scripts"
+
+# Public core protocol, not an Ansible executable or private source import.
+[core]
+transport = "unix"
+command = ["/usr/local/bin/aimctl"]
+config = "/etc/ansible/scripts/aim.yml"
+socket = "/run/aim-web-executor/core.sock"
+executor_user = "svc_bf-ansible"
+client_user = "aim-web"
+# Dedicated writable process HOME for native caches; SSH trust uses effective SSH configuration.
+home = "/var/lib/aim-web-executor"
+
+[state]
+state_dir = "/var/lib/aim/webgui"
+
+# Browser -> NPM 192.168.20.3 -> HTTPS 192.168.20.46:8443 -> local nginx -> 127.0.0.1:8080.
+# This release does not create, replace or renew the separately installed TLS certificates.
+[execution]
+enabled = true
+playbooks = [
+    "checkmk_install_agent",
+    "checkmk_update_scripts_config",
+    "checkmk_read_windows_config",
+    "checkmk_cleanup_scripts",
+    "debug_test_connection",
+    "debug_show_disk_usage",
+    "debug_detect_host_roles",
+    "maintenance_export_event_logs",
+    "maintenance_start_stopped_services",
+    "maintenance_patch_os",
+    "maintenance_reboot_hosts",
+    "sophos_apply_baseline",
+    "sophos_apply_customer",
+    "pfsense_apply_baseline",
+]
+max_hosts = 25
+timeout_seconds = 1800
+require_approval = false
+# WebGUI policy only; core addons.execution_enabled is a separate operator opt-in.
+# Operator attestation for this deployment profile: backend CA trust has been established.
+transport_verified = true
+window_start_hour = 0
+window_end_hour = 24
+
+[credentials]
+enabled = true
+
+# Retained public metadata, not raw Ansible stdout/stderr. Deleted with the job.
+[journal]
+max_events = 20000
+max_bytes = 8388608
+
+[reports]
+max_bytes = 16777216
+# Expanded configuration content retention requires explicit operator opt-in.
+retain_configuration = false
diff --git a/scripts/addons/webgui/docs/API.md b/scripts/addons/webgui/docs/API.md
new file mode 100644
index 0000000..b3e2e48
--- /dev/null
+++ b/scripts/addons/webgui/docs/API.md
@@ -0,0 +1,31 @@
+# WebGUI HTTP APIv2 - Core3.3 / schema5 candidate
+
+Core service/wire/event remains1.0 and is reached through fixed aimctl transport. WebGUI HTTPv2 is a separate authenticated API. All existing review, one-run, credential, grant, plan/retry/delete routes remain; unsafe requests require existing CSRF and same-origin policy. No arbitrary core-command/actor/path endpoint.
+
+## Existing workflows
+
+POST /api/v2/preflight takes customer,playbook,explicit targets,overrides,check,key_mode and returns private expiring review_id and normalized plan. result_contract is now preserved. POST /api/v2/runs takes review_id,confirm plus Idempotency-Key; no saved plan is required. Optional one-shot UTC scheduled_at remains unchanged. POST /api/v2/plans has an optional unique account-local name, never an upsert. POST /api/v2/runs/{id}/retry is a new requester-owned reviewed attempt; running jobs cannot be deleted.
+
+Credential POST /api/v2/runs/{id}/credentials and existing jobs alias remain8KiB, requester-only reserved-window input; private FD downstream; no credential response echo. GET credential-status does not extend reservations or prove correctness. Modal and full-page fallback remain unchanged.
+
+## New retained-evidence reads
+
+All routes use owner-or-admin job authorization. Missing/inaccessible jobs are404, not aggregate leaks.
+
+| GET | Meaning |
+|---|---|
+| /api/v2/runs/{id}/progress | Tail snapshot/checkpoint, default200 records. after/before mutually exclusive, nonnegative committed local cursors; limit1..500. |
+| /api/v2/runs/{id}/progress/stream?after=N | Replay then follow committed public metadata through SSE; Last-Event-ID overrides initial after on reconnect. |
+| /api/v2/runs/{id}/console | Compatibility alias to the durable progress SSE, not raw console output. |
+| /jobs/{id}/progress?before=N | Authorized server-rendered pagination/no-JavaScript timeline. |
+| /api/v2/runs/{id}/reports | Report header/availability/retention index; no report bodies. |
+| /api/v2/runs/{id}/report?host=HOST | One retained slot, schema/availability/mode/time/retention and bounded data. Empty host selects global scope where applicable. |
+| /jobs/{id}/reports?host=HOST&field=FIELD&page=N | Schema-aware HTML summary,50-row collection paging and lazy JSON. |
+
+A journal response includes job/status/terminal, available,cursor,next_cursor,first_cursor,events,checkpoint,has_more,has_older,omitted_events,dropped_events,capture_state and capture_interrupted. Each event record has local cursor,receipt time,allowlisted Core event and derived display text. Text is rendered on reads, never stored as a console transcript.
+
+SSE events: snapshot (committed metadata), line (record and legacy text), gap (retention omission), end (terminal or revoked access). Only durable records carry data cursors. Transport keepalive comments are not task activity. Final event and final response are one run, not duplicate reports. Final authoritative target facts remain in /api/v2/runs/{id}; operation_result there is a compact availability/retention projection, with bodies only in the separate report route.
+
+Report states: available,missing,withheld,invalid,not_started,indeterminate. Local retention: retained,metadata_only,unavailable,not_retained_limit. Do not conflate these fields with execution success. Checkmk configuration defaults to metadata_only even with Core status available. Reports are finalization-only.
+
+No browser read calls prepare/execute, opens the credential channel, probes hosts or imports terminal Core history. Deletion cascades journal/reports while audit keeps its compact event. Old jobs without evidence show unavailable; cursor replay cannot recover nonretained/uncaptured data. All evidence uses Cache-Control:no-store and is escaped for display.
diff --git a/scripts/addons/webgui/docs/ARCHITECTURE.md b/scripts/addons/webgui/docs/ARCHITECTURE.md
new file mode 100644
index 0000000..a72e916
--- /dev/null
+++ b/scripts/addons/webgui/docs/ARCHITECTURE.md
@@ -0,0 +1,17 @@
+# Architecture - 2.1.0rc9
+
+Core3.3.0rc8 owns current inventory, normalized requests/revisions, native execution, credential handling, safe progress, per-target outcomes and declared final report validation. Its API remains1.0. WebGUI owns authentication/authorization, reviewed workflows, UI and its own retained history.
+
+Browser -> HTTP/queue (aim-web) -> fixed private executor socket -> executor account -> aimctl under same UID -> native Ansible. No new daemon, privilege or Core import.
+
+The reviewed plan now includes a validated result_contract. Public response parsing has separate large-result limits and strict JSON parsing; secret transport stays unchanged. Core's final result event is progress only. The final response is projected against the reviewed schema/scope/targets/mode and is the sole report-persistence input.
+
+During execution Capture.submit projects metadata into a bounded queue. A writer thread batches durable journal rows and a latest-observation checkpoint into SQLite transactions. HTTP reads/replay query committed rows and never connect to the process console. Browser latency cannot fill the Core credential pipe or control capture. Capture loss/limits are recorded distinctly from execution outcomes.
+
+Schema5 adds job_progress_events,job_progress_state,job_operation_results and job_operation_reports; all reference jobs with ON DELETE CASCADE. Core_result keeps its small authoritative status/targets and a compact report availability summary. Analytics need not decode report bodies. Report reads lazily select one slot. Histories still use only retained WebGUI jobs, with owner/admin authorization before queries and aggregation.
+
+Core reports are independent of progress. Schema-aware views render typed structured facts and a generic safe JSON alternative. Unknown supported schemas have no dynamic code/$ref/network loading. Report availability, retention and execution verdict remain separate. No global reporting operation ships with Core; generic global support is fixture-qualified only.
+
+Journal/report storage uses the existing private web DB, rollback journaling and synchronous FULL. It is not an immutable or tamper-proof audit store. Bounded metadata queues plus250ms transaction busy limits separate capture pressure from task execution; persistent DB failure remains a service failure and cannot be hidden as success. Job-linked deletion is not backup/physical erasure.
+
+The existing read-only Explorer/Activity/Insights remain public Core reads or authorized SQL reads. They do not modify current inventory, contact hosts or include terminal history. Host report references explicitly label date/mode; successful Ansible outcomes are not live health/compliance.
diff --git a/scripts/addons/webgui/docs/CONTROLLER-PILOT.md b/scripts/addons/webgui/docs/CONTROLLER-PILOT.md
new file mode 100644
index 0000000..97e9717
--- /dev/null
+++ b/scripts/addons/webgui/docs/CONTROLLER-PILOT.md
@@ -0,0 +1,37 @@
+# Controller acceptance - WebGUI2.1.0rc9 / Core3.3.0rc8
+
+**Controller prerequisite:** Core rc8 requires `ansible.windows >=3.8.0,<4.0.0` for Windows playbooks. Confirm it in the canonical collection path under the executor identity; WebGUI does not install collections.
+
+Not a record of already performed managed-host tests. Use Core's SANITY.md and approved disposable targets. Preserve the actual execution UID/groups/HOME/sandbox and both staging exceptions; do not use root-shell success to certify the service.
+
+1. Quiesce/backup, deploy Core independently, deploy new WebGUI preserving schema5 (or migrate older schema4), verify versions/permissions and installed executor preflight. Check terminal AIM remains independent. Confirm old prepared jobs did not replay and old history remains.
+2. Run role detection and disk usage on a small approved scope. Verify prepared report declaration/schema, existing Unlock modal, final native facts and report payloads against authorized native observation. Verify unavailable/null/false values are distinct.
+3. During a longer safe run, close the page, reopen/reload, use another authorized device and inspect the same committed timeline. Check interleaved host/task IDs, last activity and bounded internal scrolling. Manual upward scrolling stops following. No invented ETA/completion percentage.
+4. Check mixed targets (one unreachable) and separate report availability. Test a controlled required-report fixture failing validation after native exit0: job stays failed/result_validation, native targets remain visible and no automatic retry occurs. Fixture/source changes require fresh review.
+5. Verify all nine report types in separately approved scope. Patching/reboot/service-start/export/delete operations require dedicated test conditions, not a casual UI smoke. Reports change task totals; compare intended effects, outcomes and schemas, not old exact task counts.
+6. Verify default parsed Checkmk config retention excludes sections while showing file/redaction metadata. Full content opt-in is deliberate. Check report copying/rendering and narrow mobile/short landscape; values never become HTML or automatic links.
+7. Revoke session/access while streaming, check another owner's job is unavailable, and confirm admin access does not mean submitting someone else's credentials. Verify journal/report deletion cascades and Host Activity contributions disappear without recreating data from audit.
+8. In a disposable run, restart a worker/executor and confirm prior recorded metadata survives but remote execution is not automatically resumed/replayed; uncommitted metadata or missing final outcome is disclosed.
+9. Test retention with synthetic high-volume data, not unbounded production playbooks. Omissions must be visible; final Core facts remain independent. Monitor DB growth/backups and storage pressure.
+10. Test matched schema/Core rollback with historical DB warning and sessions revoked. An incompatible restored adapter must remain stopped/disabled until independent Core rollback and explicit service enablement.
+
+Record actual versions, UID/group context, platform, report/mode and final result. Source/browser fixtures or success on one host do not certify all9 operations, other operating systems, physical keyboards, global reports or a different security profile.
+
+## Core rc8 patch-wave and native-baseline acceptance
+
+After the low-risk reporting checks above, use Core3.3.0rc8's current SANITY.md on
+separately approved disposable Windows update/reboot targets. Confirm the new catalog
+controls, false continuation hint, omitted inherited values and explicit true/false
+review. A reboot flag must not auto-enable continuation.
+
+Verify a successful patch-triggered reboot can end with continuation_required=true,
+remaining_updates_known=false and no next-wave list or auto-submitted job. Verify an
+explicit continuation run uses the documented Core cycle bound. Test the final
+read-only pending discovery path, deferred reboot, pre-existing-reboot block and a
+bounded per-update failure. Distinguish unsigned/hex HRESULT plus reason/message from
+the independent pending-reboot observation. Old reports without wave fields should
+remain viewable and labeled as historical; no unknown value becomes false/zero.
+
+Do not equate a Windows test with Linux or every supported Windows release. Preserve
+native result-validation failures, partial host outcomes, journal/report retention,
+modal deadlines and global SSH trust. This release does not change their policies.
diff --git a/scripts/addons/webgui/docs/CORE-3.1-REVIEW.md b/scripts/addons/webgui/docs/CORE-3.1-REVIEW.md
new file mode 100644
index 0000000..2dfc57c
--- /dev/null
+++ b/scripts/addons/webgui/docs/CORE-3.1-REVIEW.md
@@ -0,0 +1,90 @@
+> Historical reference retained from the preceding release. Current deployment/contracts and evidence are in DEPLOYMENT.md, REPORTS.md, JOURNAL.md and VERIFICATION.md. Do not treat old limitations or tests as current qualification.
+
+> Historical core review. Current2.1 behavior is documented in README, API and READ-ONLY-EXPERIENCE; older capability limits below are not current release claims.
+
+# Review of the supplied AIM 3.1.0 contract
+
+Reviewed archive: AIM-Ansible-3.1.0.zip
+SHA-256: `6005cab58875cfd6eabfd18e9b388c219a02d5b0472ba50a94c78abafb637ae9` (matched the supplied checksum).
+This is source-based analysis, not live-controller verification. The core archive
+and extracted baseline are not changed by WebGUI development.
+
+## Sources reviewed
+
+Paths below are relative to aim-core-3.1.0 in the uploaded ZIP:
+
+| Source | Load-bearing contract/findings |
+|---|---|
+| ADDON_AGENTS.md | Authoritative same-UID, independent client boundary; no private imports, argument interception or key export |
+| scripts/docs/ADDON_API.md | Public operations, RunRequest, credentials-fd framing, event/result schema, limits |
+| scripts/docs/ADDON_SUPPORT.md and addon-support-v1.json | Implemented scope versus unsupported Custom, raw output and mutable APIs |
+| scripts/docs/RELEASE_HANDOFF.md | Core 3.1/API 1.0 stability; controller results do NOT establish noninteractive execution or non-root SSH qualification |
+| scripts/docs/RC19_HANDOFF.md | Historical design intent only; newer support contract takes precedence |
+| scripts/docs/LOCAL_VALIDATION.md and CONTROLLER_ACCEPTANCE.md | Core acceptance procedure and evidence boundaries |
+| deploy/README.md and scripts/aim.yml | Independently installed aim/aimctl; operator-owned addon execution opt-in and runtime settings |
+| scripts/src/aim/services/v1/models.py | Strict RunRequest; unknown fields rejected; explicit hosts; no credential or arbitrary path/actor fields |
+| scripts/src/aim/services/v1/service.py | prepare/readiness/execute, key 0600 calling-UID policy, authoritative revisions, native inventory precedence, safe events |
+| scripts/src/aim/ctl.py | One request JSONL line; separate inherited pipe/socket secret channel; final response required |
+| scripts/src/aim/runtime/ansible.py and process.py | Native CLI discovery/execution, core-owned environment and cancellation |
+| scripts/src/aim/locking.py | Stable customer .aim.lock, shared terminal/service advisory locking |
+| scripts/src/aim/inventory and playbooks modules | Checked only to understand documented output; never imported by the add-on |
+
+## Decisions derived from these sources
+
+1. Replace RC18Adapter, external_presentation interception and the private Ansible
+credential strategy entirely with a bounded aimctl client. Core's private signatures
+are not the supported extension interface.
+2. `service_user` remains the remote account/key basename. `runtime.private_key_owner`
+controls new-key ownership, not automatic local UID switching. An explicitly
+pre-started add-on executor runs as the actual authorized key-owning UID. This is
+add-on infrastructure, not a claimed native core broker.
+3. prepare returns a core-owned revision and credential requirements. Save/queue/
+dispatch revalidate through prepare, not local inventory scans/hashes. No stat-only
+shortcut for protected sources. Key mode customer needs key access during prepare.
+4. Core 1.0 supports customer/catalog reads but no inventory mutations, Custom forced
+authentication or password-only verification. Native password defaults retain
+inventory precedence. The old Custom UI is removed rather than silently reinterpreted.
+5. list_hosts exposes name/address/platforms, not recursive inventory group paths.
+Bulk selection is retained for available platform groups only. This is a temporary
+feature-parity loss, not a reason to import inventory internals.
+6. Global catalog is a union of customer-scoped available catalogs; unavailable
+customer-specific playbooks are not offered. Catalog inputs remain core-typed.
+7. Events contain structured fixed statuses/counters, not raw task names/messages.
+The old raw live console becomes Execution progress. RunResult controls success;
+zero exit without final counters is not treated as successful.
+8. Optional core fields are ignored safely. The tested product is 3.1.0, service/
+wire/event1.0. Future core products need qualification even if API 1.x is stable.
+9. Core's public `readiness` performs local runtime/collection checks. It is not a
+remote connection test or guarantee that native task execution will succeed.
+10. There is no public per-browser-user actor authorization. WebGUI maintains its
+own account/grant/approval checks, but the executor UID is a trusted controller actor
+with the core permissions of that OS identity, not an isolated tenant.
+
+## Explicit changes from old WebGUI
+
+- Removed imports of aim.config, managers, inventory readers and old command hooks.
+- Removed TextVaultSecret/VaultSecret API adaptation, custom Ansible strategies,
+canonical-key-export sudo bridge, job-private canonical-key copies and elevated
+CAP_SETUID/CAP_SETGID worker design.
+- Ansible/version/collection interpretation now belongs to core. `/usr/bin` is no
+longer an add-on execution.ansible_bin setting.
+- Added a reviewed one-run path; saving is optional. Name collisions return 409.
+- New HTTP v2 and schema 4, independently of core API 1.0. Old APIs are not silently
+accepted with changed semantics.
+
+## Useful requests for a future core release (NOT implemented here)
+
+Additive HostSummary group paths would restore subgroup selection. Safe per-host
+result identifiers and explicitly bounded diagnostic categories could improve
+progress without raw logs. A separately designed forced Custom authentication mode
+would need to define native precedence, key/agent/control-socket fallback and
+approval semantics. None should be recreated in the add-on using private APIs.
+
+## Qualification status
+
+The tests use the real uploaded-core machine interface. Native Ansible is absent
+in this development container: controlled fake native commands verify protocol,
+result and worker integration only. Real SSH/WinRM, encrypted-key behavior, actual
+systemd sandbox deployment and reverse-proxy streaming require controller acceptance.
+See VERIFICATION.md for exact tests and limitations; no old rc9 qualification is
+claimed as qualification of this new core boundary.
diff --git a/scripts/addons/webgui/docs/CORE-3.2.1RC1-REVIEW.md b/scripts/addons/webgui/docs/CORE-3.2.1RC1-REVIEW.md
new file mode 100644
index 0000000..68c22f6
--- /dev/null
+++ b/scripts/addons/webgui/docs/CORE-3.2.1RC1-REVIEW.md
@@ -0,0 +1,20 @@
+> Historical reference retained from the preceding release. Current deployment/contracts and evidence are in DEPLOYMENT.md, REPORTS.md, JOURNAL.md and VERIFICATION.md. Do not treat old limitations or tests as current qualification.
+
+> Historical core review. Current2.1 behavior is documented in README, API and READ-ONLY-EXPERIENCE; older capability limits below are not current release claims.
+
+# Review of supplied AIM 3.2.1rc1
+
+Reviewed archive checksum: `AIM-Ansible-3.2.1rc1.zip.sha256` matched the uploaded ZIP. Core is separately managed and was not modified.
+
+## Contract adopted
+
+- Product: AIM 3.2.1rc1; service/wire/event API remains 1.0 / stable_1.x.
+- Canonical Ansible Core remains 2.19.11.
+- `capabilities.execution_progress` advertises `summary` and `detail`; WebGUI opts reviewed runs into `progress_mode: detail`.
+- Detail schema `play_task_host_v1` exposes safety-filtered static play/task labels, host outcomes, fixed failure hints, retries/async polls and per-host recap. Raw stdout/stderr, module arguments/results, rendered labels, paths and variables remain unavailable.
+- `staging_check` is now a public operation and staging preflight runs before credentials and again before launch. WebGUI treats staging errors as executor deployment/access failures rather than credential failures.
+- Core 3.2.1rc1 requires a private writable controller staging directory in the executor sandbox. The release-managed executor profile provisions `/var/lib/aim-web-executor/.ansible/tmp`, adds only that path to the writable sandbox set, sets the matching executor HOME, and runs `core-staging-check` as `ExecStartPre`.
+
+## UI mapping
+
+WebGUI renders the detail stream into an Ansible-like live view (`PLAY`, `TASK`, host status, fixed hints, recap) but does not claim it is raw Ansible output. The stream remains memory-only and disappears after completion/navigation. Authoritative job outcome remains the Core final result/counters.
diff --git a/scripts/addons/webgui/docs/CORE-3.2.1RC2-REVIEW.md b/scripts/addons/webgui/docs/CORE-3.2.1RC2-REVIEW.md
new file mode 100644
index 0000000..ebed8c6
--- /dev/null
+++ b/scripts/addons/webgui/docs/CORE-3.2.1RC2-REVIEW.md
@@ -0,0 +1,16 @@
+> Historical reference retained from the preceding release. Current deployment/contracts and evidence are in DEPLOYMENT.md, REPORTS.md, JOURNAL.md and VERIFICATION.md. Do not treat old limitations or tests as current qualification.
+
+# Review of supplied AIM 3.2.1rc2
+
+The uploaded SHA-256 sidecar matched the supplied Core archive. AIM Core remains separately installed and managed; this add-on does not modify it.
+
+## Public additions consumed by WebGUI rc7
+
+- `inventory_hierarchy_v1`: read-only customer/group/subgroup tree with direct hosts only per node. WebGUI uses Core paths for presentation and expands parent selection from Core-declared descendants, then submits explicit hosts through normal prepare/review.
+- `target_outcome_summary_v1`: authoritative final requested-target accounting from native Ansible host stats. WebGUI does not infer final host success from task events.
+- `native_defaults_preflight_v2`: separately covers process/config-home staging and passwd/NSS-home local-connection staging. WebGUI rc7 retains the rc6 release-managed writable paths and hardened systemd sandbox.
+- Service/wire/event API remains 1.0; detailed progress remains `play_task_host_v1`; raw module output remains unavailable.
+
+## Presentation boundary
+
+Core overall execution status remains authoritative. For a mixed result such as 24 successful targets and one unreachable target, Core may correctly return `failed`; WebGUI presents the job as `Partially succeeded` while showing the original Core status/exit code and the per-target facts.
diff --git a/scripts/addons/webgui/docs/CORE-3.3-REVIEW.md b/scripts/addons/webgui/docs/CORE-3.3-REVIEW.md
new file mode 100644
index 0000000..4565d10
--- /dev/null
+++ b/scripts/addons/webgui/docs/CORE-3.3-REVIEW.md
@@ -0,0 +1,15 @@
+> Historical integration basis for WebGUI 2.1.0rc3. For this candidate see [Core rc3 review](CORE-3.3.0RC3-REVIEW.md); historical test counts below are not new acceptance.
+
+# Core 3.3.0rc1 integration basis
+
+The separately supplied archive and checksum were verified. The197 source/documentation files are unchanged. Authoritative handoff material is Core ADDON_AGENTS.md and scripts/docs/{ADDON_API,ADDON_SUPPORT,OPERATION_RESULTS,DETAILED_PROGRESS,TARGET_OUTCOMES,INVENTORY_HIERARCHY,EXECUTOR_STAGING,VALIDATION,SANITY,RELEASE_HANDOFF}. The supplied ten standalone documents matched their archived versions during review.
+
+Core adds operation_results capability, null or schema-resolved catalog result declarations, PreparedRun.result_contract and final RunResult.operation_result. The publisher is aim_output_v1; public wrapper aim_operation_result_v1. The final event and final response are one result. Data arrives at finalization only. Existing API/event1.0, target accounting, hierarchy and dual-home preflight remain.
+
+WebGUI consumes only the public process boundary. Its consumer independently validates the published schema subset, declaration/review association, report data and response budgets. It never loads playbook schemas from the controller filesystem. Core source fixtures and schema files are used only in disposable release tests. All9 bundled schemas have registered presentation metadata and generic bounded data rendering. No Core source/config/Ansible runtime change is made by the add-on.
+
+A native exit0 with required output absent/invalid is a result_validation failure. Per-target native success remains distinct, and a native failed run can have useful available reports. Missing response never becomes success from an earlier event. Payload data.complete can have a separate meaning from report-slot complete. Config sections remain an explicit retention opt-in because safe filtering is not a universal secret scanner.
+
+The operation payload can total16MiB, with1MiB slot bounds. Core private native callback chunks do not imply chunked public JSONL. WebGUI therefore increased only public response frame/line/stream budgets and kept request/private-secret limits unchanged. Reports are stored separately from compact final job facts. Progress journaling is add-on-owned and not a new Core history collector.
+
+Core's188 recorded upstream local tests are not WebGUI test results. Native Ansible2.19.11, Windows/Linux publishers, global publishers and hardened controller behavior remain acceptance gates. See this release's VERIFICATION.md for observed tests and limitations.
diff --git a/scripts/addons/webgui/docs/CORE-3.3.0RC3-REVIEW.md b/scripts/addons/webgui/docs/CORE-3.3.0RC3-REVIEW.md
new file mode 100644
index 0000000..1fccb2a
--- /dev/null
+++ b/scripts/addons/webgui/docs/CORE-3.3.0RC3-REVIEW.md
@@ -0,0 +1,84 @@
+# Core 3.3.0rc3 integration review
+
+This is a source-based review of the user-supplied Core archive, not a native Windows
+Update qualification. AIM Core remains separately deployed and unmodified.
+
+## Source basis
+
+Authoritative Core topics: `ADDON_AGENTS.md`, `AGENTS.md`,
+`scripts/docs/RELEASE_NOTES.md`, `RELEASE_HANDOFF.md`, `ADDON_SUPPORT.md`, `ADDON_API.md`,
+`OPERATION_RESULTS.md`, `PLAYBOOKS.md`, `VALIDATION.md`, `SANITY.md`,
+`scripts/docs/INSTALLATION.md`, and `deploy/README.md`.
+
+The supplied Core ZIP contains 200 files under `aim-core-3.3.0rc3/`. Its sidecar and
+ZIP integrity were checked before extraction. Archive hashes and unchanged-source
+comparison are in this release's verification record.
+
+Compared with the supplied Core 3.3.0rc1 (the actual previous WebGUI integration),
+there are three added files: two Windows patch-cycle tasks and the Core installation
+guide. No files were removed in that comparison. The source-version/metadata,
+patch runbook/filter/catalog/schema and documentation changed. The semantic catalog
+difference is confined to `maintenance_patch_os`; eight other reporting schemas are
+byte-identical. Core's runtime, credentials, service transport, target-outcome,
+hierarchy and staging implementations are unchanged in this comparison. This is not
+an assertion that the new patch runbook was executed successfully here.
+
+## Existing public boundaries retained
+
+Service/wire/event API remains 1.0. Reports still use `aim_output_v1` publication and
+`aim_operation_result_v1` final results, with `result_contract` captured at review.
+Reports arrive at finalization, not as raw debug/stdout. Detailed progress remains
+`play_task_host_v1`; native target outcomes and the two-home staging preflight remain.
+No new execute-request field, credential channel, service or filesystem access is needed.
+
+## New rc2/rc3 patch metadata consumed
+
+Core's catalog provides reboot delay (minutes, 0..1440), reboot message and the
+Windows-only `os_patching_rescan_after_reboot` boolean. Its catalog hint is `false`.
+The WebGUI obtains these options and constraints from public discovery, not a
+parallel defaults table. Unchanged controls are omitted to preserve inventory/role
+precedence; a catalog hint is not a resolved effective inventory setting.
+
+Windows now discovers a deterministic queue, installs one discovered update per
+native invocation and stops a wave at a reboot boundary. With continuation disabled,
+an AIM-performed reboot can end a successful run with `continuation_required: true`
+and `remaining_updates_known: false`. An explicitly reviewed true continuation value
+allows Core to rediscover after reboot, bounded to 12 cycles. This is within one Core
+operation, not permission for the add-on to create more jobs.
+
+A wave finishing without reboot can perform a final read-only search; this does not
+extend the approved installation queue. When `remaining_updates_known` is true,
+`pending` is the recorded final discovery only. When false, the WebGUI must not show
+a pre-reboot queue or zero-length list as the established next-wave state.
+
+The patch report adds pre/post reboot observations, delay, deferred state and a stop
+reason (introduced in Core rc2). Windows adds optional continuation, cycle and
+remaining-update-knowledge fields in rc3. Individual failed updates carry Core's
+unsigned/hex HRESULT, reason and bounded safe message. `install_not_allowed` is not
+proof of a pending reboot; `preexisting_reboot_required` is an independent Core
+preflight observation. The UI displays provided codes; it does not parse fatal text,
+Windows logs or native error messages.
+
+## Consumer changes made
+
+- Qualify exact Core 3.3.0rc3 in adapter/executor/CLI/deployment metadata, while keeping
+  live capability negotiation and version rejection intact.
+- Surface all catalog-driven patch controls and platform hints, with a review note
+  separating reboot from continuation and preserving explicit true/false vs inherited.
+- Add a report presentation model for continuation, deferred reboot, pre-existing
+  reboot and bounded-cycle stop conditions. This never changes the job/Core verdict.
+- Present remaining updates according to the new knowledge flag; keep raw *structured
+  report JSON* available separately, not unrestricted process output.
+- Preserve historical schemas and data. The same `patch_summary_v1` identifier has a
+  larger closed shape now: newly added reboot fields and failure `message`/hex fields
+  are required where declared. Old jobs render with their recorded schema, never
+  revalidated against today's catalog or backfilled with invented false values.
+- Retain journal, reports, modal, owner/admin visibility and existing retention limits.
+
+## Qualification boundary
+
+Core's current VALIDATION.md records static/filter/schema and disposable deployment
+checks, not native Ansible 2.19.11/Windows Update/service-sandbox acceptance of rc3.
+WebGUI test outcomes are recorded independently in VERIFICATION.md. Source tests and
+synthetic report fixtures do not certify Windows servicing ordering, reboots, pending
+update state, Server 2012 R2, or every delegated service environment.
diff --git a/scripts/addons/webgui/docs/CORE-3.3.0RC8-REVIEW.md b/scripts/addons/webgui/docs/CORE-3.3.0RC8-REVIEW.md
new file mode 100644
index 0000000..2a64de5
--- /dev/null
+++ b/scripts/addons/webgui/docs/CORE-3.3.0RC8-REVIEW.md
@@ -0,0 +1,50 @@
+# Core 3.3.0rc8 integration review
+
+This is a source/package compatibility review of the user-supplied AIM Core 3.3.0rc8
+archive against AIM WebGUI 2.1.0rc9. Core remains separately deployed and unmodified.
+
+## Public contract
+
+Core remains service/wire/event API 1.0 with the existing detail-progress,
+inventory-hierarchy, target-outcome and `aim_operation_result_v1` contracts. The nine
+shipped report schemas remain catalog-driven. WebGUI therefore does not add a private
+adapter or parse playbook output.
+
+The release changes the required native Windows collection baseline. Live Core
+capabilities now advertise:
+
+```text
+ansible.windows >=3.8.0,<4.0.0
+```
+
+WebGUI 2.1.0rc9 requires that capability declaration. The actual collection remains
+Core/operator managed and must be visible to the execution identity in the canonical
+Ansible collection path. Core readiness remains authoritative for the installed runtime.
+
+## Report deltas
+
+`patch_summary_v1` is additive: rc8 adds optional `reboot_reasons_before`, a bounded
+array of `{source, description}` observations from `ansible.windows.win_reboot_info`.
+Existing required fields and the established patch continuation/reboot semantics remain.
+Historical reports continue to validate against their recorded result contracts.
+
+`filesystem_usage_v1` remains schema-compatible, but Windows semantics now describe
+attached local storage volumes through `community.windows.win_disk_facts`; mapped/network
+drives are intentionally excluded. WebGUI updates its explanatory note accordingly.
+
+Core's Checkmk script placement and Windows ACL hardening are runbook behavior, not a new
+add-on API. WebGUI does not reconstruct those paths, permissions or deployment rules from
+private source; it renders final structured reports supplied by Core.
+
+## Patch behavior retained
+
+The rc4 patch-wave model remains: one native `win_updates` wave per selected categories,
+AIM-owned reviewed reboot message/delay, explicit opt-in for post-reboot continuation,
+no automatic replay, and `remaining_updates_known` governing whether a final pending list
+is authoritative. `install_not_allowed` alone is not treated as proof of a reboot need.
+
+## Qualification boundary
+
+This review does not certify native Windows Update, Checkmk ACL changes, collection
+installation, WinRM/SSH, or the production systemd sandbox. Controller acceptance must
+use Core rc8's current SANITY/VALIDATION guidance under the actual executor identity.
diff --git a/scripts/addons/webgui/docs/CREDENTIALS.md b/scripts/addons/webgui/docs/CREDENTIALS.md
new file mode 100644
index 0000000..b5237d4
--- /dev/null
+++ b/scripts/addons/webgui/docs/CREDENTIALS.md
@@ -0,0 +1,66 @@
+> The behaviors below are retained from2.1.0rc2. Current candidate2.1.0rc9 targets Core3.3.0rc8/schema5 and adds reports/journal described in REPORTS.md and JOURNAL.md. Credential, read-only inventory and OS-permission boundaries here remain unchanged; old version/no-migration statements describe the earlier slice.
+
+# One-run credentials through core API 1.0
+
+Core 3.3.0rc8 is authoritative. WebGUI 2.1 does not decrypt Vault or read/export/copy keys.
+Use native inventory or explicit customer-key loading in New run. Existing usernames,
+Vault variables and host/group precedence are core/Ansible behavior.
+
+Custom forced username/password override is NOT exposed by core and was removed
+from this adapter. A supplied connection_password, when the catalog requests it, is
+a native default and may be overridden by inventory. It is not password-only testing.
+Become-password UI, key uploads, cross-job password caching and raw task output are
+not implemented. Terminal features are not automatically API features.
+
+## Where to enter a password
+
+Submit the reviewed job first. With approval disabled it queues directly; otherwise
+an independent enabled administrator approves it. The running queue worker reserves
+a slot after local core readiness. Job detail then offers Unlock this run. With JavaScript and native dialog support this opens an in-page modal; its link remains an authenticated full-page fallback. Overview and Jobs also surface your eligible reservations in Needs your attention.
+Only the requesting account may use this form. All requested fields derive from
+PreparedRun. A present customer Vault is conservatively required even when the
+catalog's require_vault flag is false. An encrypted customer key can use an explicit
+key passphrase or Core's literal vault_linux_ssh_key_passphrase lookup. The grouped Use customer Vault / Enter separately choice appears only for that alternative requirement with a Vault source. A separately required key passphrase is never made optional.
+
+A reservation without secrets lasts5minutes. After submission, hand-off/preparation/
+start must fit60seconds; execution has the separate bounded job timeout. An expired
+or failed attempt does not retain credentials for the next attempt. Scheduled jobs
+collect secrets only when their time/window/approval and worker are ready.
+
+## Transport and processing
+
+Existing verified HTTPS to NPM/backend and loopback final hop are assumed configured
+by the operator. Dedicated POST bodies, CSRF/origin/session authorization and8KiB
+body limit remain. Passwords are literal, max2048 UTF8 bytes each, no CR/LF/NUL. No
+client-side hash substitution. Browser fields clear on navigation and never enter
+HTMX history/localStorage. Raw body/error logging remains prohibited.
+
+The web identity sends private bounded local frames to its worker, then to the
+executor. The executor starts aimctl with a separate inherited secret pipe FD, not
+stdin request JSON, argv, environment or a password file. Core owns its provider,
+key agent and native credential helpers. WebGUI does not reinterpret Vault values.
+
+Python release of references is not guaranteed RAM erasure. Review swap/dumps,
+proxy request buffering and access to the service accounts. A compromised authorized
+web process may exercise the local core client authority; this is not tenant isolation.
+No automatic data/file-permission repair or credential fallback is performed.
+
+## Qualification
+
+`aim-web credential-check` now means public capability/authorized metadata checking.
+It does not test decryption or remote auth and requires no pytest in production.
+`core-check --customer ... --playbook ... --host ... --key-mode customer` additionally
+runs documented local readiness. Real SSH/WinRM acceptance remains an operator gate.
+Use the included disposable test instructions for API integration; fake native
+fixtures do not certify real Ansible or controller systemd permissions.
+
+
+## Dialog lifecycle and recovery
+
+The dialog loads only after an explicit user action. Its form lives outside status/attention polling so typing is not discarded by an HTMX replacement. It shows the frozen customer/playbook/mode and target count. Show/Hide never changes what is submitted, and pasting is not blocked. Escape/Close/Not now clear fields, including visible-password inputs, and return focus without canceling the job. Backdrop taps do not dismiss it. A small visual viewport constrains the dialog's internal scroll area rather than growing the page.
+
+Only required/supported Core fields are rendered. For the Vault/key alternative, the default sends just the Vault password; Enter separately adds a required key-passphrase field. Switching back clears that field. No source-radio name or extra scope/identity field is sent to the API. A plain HTML form with JavaScript unavailable exposes the optional separate field with its explanation and does not submit disabled source controls.
+
+The countdown uses the server deadline, not a new five-minute timer on each opening. Polling does not renew it. Submission clears live form values and disables repeat clicks. A 202 accepted response means only that the existing worker claimed the handoff. Core validation and remote authentication happen later. A lost acknowledgement must not cause automatic POST retry: the client locks the form and polls owner-only status. Worker single-claim/session/scope checks remain authoritative across tabs.
+
+The canonical POST route is `/api/v2/runs/{id}/credentials`; the existing `/api/v2/jobs/{id}/credentials` is kept as an alias. Both use the same five-attempts-per-minute requester throttle and existing private worker socket. `GET /api/v2/runs/{id}/credential-status` is non-secret status only. It never reports a password as correct, requests new work or extends the reservation.
diff --git a/scripts/addons/webgui/docs/DEPLOYMENT.md b/scripts/addons/webgui/docs/DEPLOYMENT.md
new file mode 100644
index 0000000..9492f5e
--- /dev/null
+++ b/scripts/addons/webgui/docs/DEPLOYMENT.md
@@ -0,0 +1,131 @@
+# Deployment and recovery - AIM WebGUI 2.1.0rc9
+
+Target: separately installed AIM Core **3.3.0rc8**, service/wire/event API **1.0**.
+WebGUI HTTP **v2**, SQLite **schema 5**. From WebGUI 2.1.0rc3 there is no database
+schema change or new permission/service requirement. This candidate qualifies the
+new public patch catalog/report shape; it does not upgrade Core itself.
+
+## Fresh installation
+
+Use [ADDON-INSTALLATION.md](../ADDON-INSTALLATION.md) after the independently supplied
+Core `scripts/docs/INSTALLATION.md`. `install` is for a new add-on; `update` is for an
+existing managed installation. The Core and WebGUI deployers have different flags.
+
+## Coordinate Core and WebGUI versions
+
+The previous WebGUI 2.1.0rc4 targets Core3.3.0rc3 exactly; it does not accept Core rc8.
+Finish active jobs, prevent new submissions and quiesce terminal writers. Cancellation
+is not rollback. Keep matching Core and add-on backups, including the workflow DB.
+
+```bash
+sudo systemctl stop aim-web-worker.service aim-web.service aim-web-executor.service
+```
+
+Deploy Core3.3.0rc8 independently with its verified source archive and its own
+
+**Controller prerequisite:** Core rc8 requires `ansible.windows >=3.8.0,<4.0.0` for Windows playbooks. Confirm it in the canonical collection path under the executor identity; WebGUI does not install collections.
+preview/apply/quiesced procedure. Do not overwrite Core settings, environments,
+inventory/Vault/keys or global SSH trust. Review patch-wave changes in Core's release
+notes and complete separately approved terminal acceptance. A UI release does not
+certify the new native Windows Update flow.
+
+Then extract this add-on into a fresh directory, not over the active source:
+
+```bash
+cd /var/tmp
+sha256sum -c AIM-WebGUI-2.1.0rc9.zip.sha256
+unzip AIM-WebGUI-2.1.0rc9.zip
+cd aim-web-2.1.0rc9
+sudo python3 deploy/deploy.py update
+```
+
+Ordinary2.x updates do not need --migrate-core. Same-version reinstall is rejected.
+The installer validates the actual manifest/required files, prepares dependencies and
+assets, checks public Core access, backs up and activates the release, writes known
+managed units and waits boundedly for socket readiness. Unknown unit drop-ins require
+operator review. Core remains unchanged by this updater.
+
+## State, review and retention
+
+Accounts, grants, plans, journals, reports and audit remain in schema5. Its five
+released SQL migrations are unchanged. An older schema4 install follows the existing
+schema5 migration (pending/queued work blocked, running work interrupted, old reviews
+removed). A schema5-to5 update does not rewrite job states: old prepared work is still
+subject to the existing source/revision revalidation and cannot silently execute a new
+Core revision. Quiesce first and use a fresh review after Core source/schema changes.
+
+Saved plans remain presets; selecting one requires a fresh review. Historical reports
+use their stored schema and are not revalidated with the new enlarged patch schema.
+There is no backfill, terminal-history collection or automatic retry/continuation.
+
+The full webgui.toml remains release-managed and overwritten with the approved site
+profile (execution enabled, existing14-playbook allowlist, no independent approval,
+credential transport attestation). Keep the independently configured Core opt-in.
+Retention defaults remain:
+
+```toml
+[journal]
+max_events = 20000
+max_bytes = 8388608
+[reports]
+max_bytes = 16777216
+retain_configuration = false
+```
+
+Custom local TOML edits must be incorporated into the reviewed release profile to
+survive later replacements. Job deletion removes its linked evidence; protected
+backups and physical-storage erasure have separate operator policies.
+
+## Verify in the real service context
+
+```bash
+aim-web --version
+aim-web config-check
+sudo systemctl status aim-web-executor.service aim-web.service aim-web-worker.service --no-pager
+sudo -u aim-web aim-web core-check
+sudo journalctl -u aim-web-executor.service -n 60 --no-pager
+```
+
+Expected: AIM WebGUI2.1.0rc9 / Core3.3.0rc8. ExecStartPre remains the authoritative
+staging probe inside the executor's actual sandbox. A plain sudo -u shell lacks its
+unit-scoped aim-web group and is not an equivalent preflight. Do not loosen config or
+staging permissions to make the interactive wrapper pass.
+
+The generated unit contract is unchanged: normal executor primary group plus aim-web
+supplementary group; web state0700; config root:aim-web0640; executor state and both
+staging paths0700; runtime directory executor0711; socket executor:aim-web0660;
+NoNewPrivileges, empty capabilities, ProtectSystem=strict, ProtectHome=read-only with
+only exact staging write exceptions. No new ports/services/writable paths are needed.
+
+Start with a safe read-only reporting job and reload its recorded evidence. New native
+patching/reboot behavior needs Core's disposable-target acceptance, not a production
+installation used as a browser smoke test. See [PATCH-WAVES.md](PATCH-WAVES.md).
+
+## Recovery and rollback
+
+Record the printed /var/backups/aim-web checkpoint. After an interrupted deployment,
+investigate pending.json and use the same release deployer's recover command; do not
+manually retarget current symlinks.
+
+```bash
+sudo python3 deploy/deploy.py recover
+sudo python3 deploy/deploy.py rollback --backup CHECKPOINT
+```
+
+The commands above are alternative recovery actions, not a sequence to run blindly.
+An rc5->rc4 add-on rollback stays on schema5, but the older adapter still requires its
+matched Core version. The deployer tests restored compatibility; an incompatible
+restoration remains stopped/disabled until the operator separately restores the
+matching Core and deliberately enables the units.
+
+Crossing schema5->4 requires --restore-auth-db and an explicit historical database
+restore. That can reinstate older password hashes and discard later users/jobs/plans/
+journals/reports; restored sessions are revoked. Back up current data first. Neither
+product rollback reverses remote installations/reboots or unrelated operator changes.
+
+## Offline assets
+
+This is not a full offline dependency bundle. Python and production browser pins are
+unchanged (Bootstrap5.3.8 and HTMX2.0.10 with SHA384 checks). Existing matching assets
+can be reused. --wheelhouse and --assets-dir accept independently prepared exact
+artifacts. No development/test dependency is installed into either product environment.
diff --git a/scripts/addons/webgui/docs/EXECUTION.md b/scripts/addons/webgui/docs/EXECUTION.md
new file mode 100644
index 0000000..e1e026b
--- /dev/null
+++ b/scripts/addons/webgui/docs/EXECUTION.md
@@ -0,0 +1,21 @@
+# Reviewed execution - 2.1.0rc9
+
+AIM Core3.3.0rc8 builds native commands and owns validation, credential preparation, runtime discovery, customer locking, cancellation and authoritative results. WebGUI uses only its public aimctl API1.0 and the existing non-root executor.
+
+A new run needs review, not a saved plan. Select exact customer/playbook/hosts, declared typed options, check/apply and key mode. Review normalized scope, warnings, credentials and the **declared result contract**. Core source/schema changes invalidate earlier reviews; the worker never silently rebuilds and executes stale scope. Saving remains optional with collision-safe default titles.
+
+WebGUI execution policy, allowlist, grants, host limits and optional approval apply independently of Core's add-on opt-in. The executor's OS access is not proof of the browser requester's authority. Native inventory precedence is unchanged. Key mode customer requires the canonical owner-only key; key mode none is not forced password authentication.
+
+The worker performs local readiness before offering the owner-only credential modal. Its five-minute empty reservation and sixty-second post-handoff preparation/start window remain. Supplied values use the existing private channel, never job records, argv, environment or journals. The modal preserves deliberate opening, grouped alternative key source, paste/show controls, field clearing and lost-response reconciliation without an automatic second POST.
+
+## Progress and results are separate
+
+1. A bounded structured journal records approved Core metadata independently of viewers. Reopening a running or ended job replays committed events and continues after its durable cursor. IDs correlate tasks/hosts; there is no guessed task total/ETA or future task plan. Raw terminal text and module dictionaries are not retained. See JOURNAL.md.
+2. Native target outcomes and final Core status/exit remain authoritative. A final event without a final response cannot establish successful completion. A partially successful host population does not rewrite Core's overall failure.
+3. Purposeful operation reports arrive only at finalization and are separately validated against the reviewed contract. They are retained subject to explicit local limits/policy and fetched lazily. See REPORTS.md. A report can be available for a failed run. Missing/invalid required reports after native exit0 yield Core failed/result_validation while native target stats remain unchanged; this is not a password error and never triggers replay.
+
+A closed browser is not cancellation. User cancellation stops owned local process groups through Core, not already completed remote changes or independently running asynchronous work. Check mode is not an unconditional no-side-effect guarantee. Trusted playbooks can run controller-local/delegated tasks; both narrow staging exceptions stay enabled.
+
+Manual retry creates a new reviewed job and fresh credentials. Changes to mode, key handling, hosts or options are not edits to queued work. No automatic retry or recurring schedule is introduced; the existing explicitly UTC one-shot schedule remains.
+
+Only terminal jobs can be deleted. Deletion removes their lifecycle/idempotency/progress/report records and future history contributions, while keeping a compact audit deletion fact. Saved-plan deletion does not remove existing copied job intent. Protected backups are independently retained; deletion is not a promise of physical erasure. Old jobs are not rerun or reconstructed to populate missing evidence.
diff --git a/scripts/addons/webgui/docs/JOURNAL.md b/scripts/addons/webgui/docs/JOURNAL.md
new file mode 100644
index 0000000..057e61b
--- /dev/null
+++ b/scripts/addons/webgui/docs/JOURNAL.md
@@ -0,0 +1,43 @@
+# Retained execution journal - 2.1.0rc9
+
+## What is recorded
+
+The worker captures only projected public Core metadata: job/run/sequence, source UTC time and receipt time, stage, opaque play/task IDs, approved/withheld labels, reviewed logical hosts, result/changed/ignored flags, supported retry/poll information, fixed diagnostic hints and recap counters. Unknown additive payloads, legacy duplicate progress in detail mode, raw stdout/stderr, debug bodies, credential frames and final report data are not journal entries.
+
+Core labels remain withheld when Core withholds them. A missing host stays null; no inference from a nearby event. A task result can arrive interleaved with another host/task: use IDs, not last-arriving names. The result event records only that it was observed; **the final response** establishes the authoritative result and retained report.
+
+The normal final Core result, targets and existing lifecycle/audit metadata remain separate. A journal does not become a second execution engine or replay operation.
+
+## Browser-independent capture
+
+Capture starts in the execution child after review/claim checks. An open page is not required. A 2,048-entry nonblocking queue feeds batches of up to 128 events with a normal 250 ms flush target. SQLite synchronous FULL transactions publish the event rows, bounded checkpoint and durable cursor together. The writer's busy timeout is 250 ms. Closing tries to drain within 2.5 seconds and waits up to 3 seconds for its thread.
+
+Those are bounded scheduling/lock budgets, not a guarantee against slow storage or physical failure. A crash can lose queued/uncommitted events. Queue or write failures increment a loss counter on the next possible commit. Persistent storage failure or a killed writer leaves an unclosed capture, shown as interrupted when the job ends. Metadata loss does not establish a task failure or success and never triggers re-execution. If the database cannot persist the final result, the normal workflow cannot certify success from a prior event.
+
+## Retention and display windows
+
+```toml
+[journal]
+max_events = 20000
+max_bytes = 8388608
+```
+
+The newest tail is retained. Older event rows are removed in the same commit when either limit is exceeded; a visible omission count/range remains. A bounded checkpoint retains last stage/play/task, observed task-start count, up to64 recent task contexts, and up to500 latest logical-host observations. Final Core facts do not depend on journal coverage. Limits are validated in Settings; the byte budget may be64KiB..64MiB and the event budget100..200000.
+
+The initial page loads200 tail events; API pages allow1..500. The browser keeps at most2,000 displayed records, with a link to the paged timeline. Display pagination never changes retained counts. Large streams are rendered at most once per animation frame. Only the console's scrollTop changes; manual upward scrolling pauses Follow output.
+
+Job deletion cascades through the journal. No terminal/Core-wide history collection and no shadow archive. Database/backup files stay in existing private storage; deletion is not secure physical erasure or deletion of prior backups. There is no silent age-pruning policy.
+
+## Reopen, reconnect and authorization
+
+GET the snapshot/tail, then connect SSE strictly after the committed high-water cursor. Last-Event-ID takes precedence over the initial after query on reconnection. A per-job local cursor and unique(job, Core run, Core sequence) suppress duplicates. Filtered legacy events produce ordinary Core-sequence gaps, not automatic loss claims. Retention gaps are explicit.
+
+Every read uses existing owner-or-admin job authorization. Every streaming iteration rechecks live session, password-change state and job access. A cursor is not permission. Deleted/inaccessible jobs end the feed and request clearing the view. Two devices read the same committed rows and never directly attach to the executor process.
+
+When the job ends, SSE drains through the available committed cursor and ends; history remains readable. Worker/service interruption does not resume Ansible. Closing a page does not cancel a job or resend a credential.
+
+Progress means **last observed activity**, not a total task graph. There is no invented percentage, ETA, list of future tasks or proof of stall from silence. Host observations are not final per-host outcomes. The displayed time is localized while stored values remain UTC.
+
+## Historical jobs
+
+Schema migration does not fabricate progress for old jobs. They retain lifecycle and final facts but show detailed history unavailable. No terminal import or automatic rerun fills gaps. A new queued job may show waiting for capture until the execution child starts.
diff --git a/scripts/addons/webgui/docs/MIGRATION-3.1.md b/scripts/addons/webgui/docs/MIGRATION-3.1.md
new file mode 100644
index 0000000..093a946
--- /dev/null
+++ b/scripts/addons/webgui/docs/MIGRATION-3.1.md
@@ -0,0 +1,105 @@
+> Historical reference retained from the preceding release. Current deployment/contracts and evidence are in DEPLOYMENT.md, REPORTS.md, JOURNAL.md and VERIFICATION.md. Do not treat old limitations or tests as current qualification.
+
+> Historical major-migration guide for the 1.x-to-2.x architecture. An existing 2.0.0rc8 deployment uses the ordinary 2.1 update in DEPLOYMENT.md; no schema change or migration acknowledgement is needed. Current capabilities are in API.md.
+
+# Major migration: WebGUI 1.x / rc18 -> WebGUI 2.0 / AIM 3.1
+
+Read CORE-3.1-REVIEW.md first. This is an explicit major migration. Core and add-on
+are separate releases with separate backups and rollback decisions.
+
+## Before downtime
+
+1. Let active jobs finish; cancel deliberately only if their remote effects are understood.
+2. Back up the old core using its OWN deployment procedure. Back up the WebGUI's
+source/config/units/database with its managed deployment checkpoint. Do not reset
+users or remove /var/lib/aim/webgui.
+3. Deploy AIM 3.2.1rc2 independently using its included guide. Check terminal AIM first.
+Do not copy core into the old WebGUI tree or install WebGUI into core's interpreter.
+4. Choose an existing non-root execution account, normally svc_bf-ansible. It must
+already satisfy AIM required_group, read its config/inventory/Vault, own each selected
+customer key 0600, and see native collections. The add-on does not provision these
+core permissions. `runtime.private_key_owner` does not migrate old keys or switch UID.
+5. Check aimctl as that account, not merely from a root shell:
+
+```bash
+sudo -u svc_bf-ansible /usr/local/bin/aimctl   --config /etc/ansible/scripts/aim.yml capabilities
+printf '%s\n' '{"api_version":"1.0","operation":"list_customers"}' |   sudo -u svc_bf-ansible /usr/local/bin/aimctl   --config /etc/ansible/scripts/aim.yml request
+```
+
+The core config remains operator-owned. Its actual 3.1 settings include
+`addons.execution_enabled`, `runtime.ansible_playbook` and
+`runtime.private_key_owner` (NOT the earlier proposed execution_user/runtime_group
+fields). Configure/qualify those using the core guide. The add-on never edits them.
+
+The core acquires a stable customer `.aim.lock` during execution. The executor needs
+access to that lock, or creation permission if it does not exist; a read-only customer
+directory without an accessible lock is not sufficient. Use the core/operator's
+permission procedure rather than widening the whole tree from WebGUI.
+
+## Activation
+
+Unpack the new ZIP into a fresh staging path and run:
+
+```bash
+sudo python3 deploy/deploy.py update --migrate-core
+```
+
+The explicit flag acknowledges: schema 4, stopped legacy pending/running work,
+retirement of old key-export sudo bridge and its known worker capability drop-in,
+HTTP API v2, a new executor service and release-config replacement.
+
+The installer stages an isolated WebGUI venv/assets, probes the real public core
+metadata as the selected executor account, checkpoints old files, stops add-on
+services, migrates state, replaces source/config/units, then starts executor, web
+and the opt-in queue worker. It never stops terminal AIM or writes core files.
+Unknown systemd drop-ins block installation for deliberate operator review.
+
+## What is preserved
+
+Users/password hashes/sessions, named admin onboarding, grants, audit, selections,
+all old job records/events, and all saved plan payloads. Pending/queued old-core jobs
+become blocked; running ones become interrupted. Their state is not replayed.
+Historical duplicates in saved-plan names remain separate records.
+
+Legacy saved plans are reusable INPUTS only: open one, use its New run link and
+review mode/key handling again. Old Custom credentials cannot silently become native
+inventory credentials. A new valid review is required; no credentials are migrated.
+
+## What is retired
+
+Private core imports, rc18 adapter, command rewriting, private Ansible credential
+resolver/strategy, sudo key export, CAP_SETUID/CAP_SETGID worker capability grant and
+raw console interception. Known old helper/sudoers/drop-in files are backed up and
+removed. There is no need to give aim-web canonical key read access.
+
+## Rollback
+
+Schema4 cannot be opened by old schema 3 WebGUI. Downgrading requires the explicit
+--restore-auth-db flag, with loss of changes since that snapshot and possible
+restoration of older passwords. Services and config/code/venv must match the snapshot.
+Restoring a 1.x WebGUI while AIM 3.1 remains installed is NOT a working rollback: the
+installer restores the files/database but leaves legacy services stopped/disabled.
+Coordinate an independent core rollback before enabling them. Core is never rolled
+back by this add-on. Interrupted remote operations are never undone automatically.
+
+## Unsupported old behavior
+
+There is no Custom forced credential override or password-only verification in
+core API 1.0. No raw task/host output. Platform-group selection remains; recursive
+subgroup paths are unavailable. These limitations are shown in the interface and
+are recorded for an additive core extension, not bypassed through private access.
+
+## Executor HOME and host trust
+
+The release profile sets `[core] home = "/var/lib/aim-web-executor"`. aimctl and
+native commands use that separate writable HOME, not /root or WebGUI's private
+SQLite home. The executor remains the configured existing UID; no identity is
+changed by HOME. Install independently verified SSH host records under
+the effective SSH UserKnownHostsFile, owned by the execution account, or the already-reviewed system /etc/ssh/ssh_known_hosts policy. Process HOME alone does not select OpenSSH's known_hosts path. Do not blindly
+trust ssh-keyscan output. Existing per-user collections under the old home are not
+automatically copied: use the core's documented runtime.ansible_collections_path
+configuration if required. System collections remain native-core-discovered.
+
+The shipped systemd profile targets the documented /etc/ansible inventory layout.
+Nonstandard inventory roots require a separately reviewed ReadWritePaths service
+profile for core locks; this installer does not inspect private config to infer it.
diff --git a/scripts/addons/webgui/docs/PATCH-WAVES.md b/scripts/addons/webgui/docs/PATCH-WAVES.md
new file mode 100644
index 0000000..68ce481
--- /dev/null
+++ b/scripts/addons/webgui/docs/PATCH-WAVES.md
@@ -0,0 +1,72 @@
+# Patch-wave options and reports - WebGUI 2.1.0rc9 / Core 3.3.0rc8
+
+This guide describes add-on presentation of the Core-provided patch contract. It does
+not grant approval to install updates, reboot targets or perform repeated runs.
+
+## Prepare and review
+
+New run uses the public catalog for optional inputs. The Windows-only **Continue
+patching after reboot** control advertises the live catalog hint (false in this Core
+release). It starts as **Inherit**, not an explicit true override. Blank inputs stay
+omitted; inventory/role defaults are authoritative. To explicitly forbid continuation
+in a particular run, choose false and review the normalized override.
+
+**Reboot when required**, **Reboot delay (minutes)** and **Reboot message** are separate
+catalog controls. Enabling reboot must not implicitly enable continuation. Delay and
+message apply only to an AIM-initiated reboot; the message is not part of the report.
+The review highlights explicit vs inherited reboot, delay and continuation values.
+Core still revalidates scope/options/schema revision before execution.
+
+On Windows, each Core patch wave delegates the reviewed update categories to one native
+`ansible.windows.win_updates` install invocation with module reboot disabled. Windows
+Update and the collection own ordering inside that wave; AIM evaluates its reviewed reboot
+policy only after the native wave returns. With post-reboot continuation disabled, the run
+stops after an approved AIM reboot and another discovery requires a new reviewed run.
+Enabling continuation explicitly permits Core to rediscover and start another native wave
+after reboot within the same run, up to its 12-wave safety limit. There is no WebGUI
+follow-up scheduler or automatic replay.
+Linux keeps Core's native package-manager behavior and shared reboot-message/delay
+semantics; Windows cycle fields are not fabricated on Linux reports.
+
+## Reading a report
+
+| Field or condition | Meaning in the UI |
+|---|---|
+| Core succeeded + continuation_required true | Successful wave, but further patching needs review. The job is not relabeled failed. |
+| remaining_updates_known false | Remaining updates are not established. Do not show an empty pending list as zero remaining updates or reuse a pre-reboot queue. |
+| remaining_updates_known true | Pending is the final read-only discovery for the selected scope and recorded time, not current compliance or an expanded install queue. |
+| No remaining_updates_known field | Historical shape. Missing wave fields stay unestablished; no inferred post-reboot queue. |
+| reboot_deferred true | A reboot remains required with automatic reboot disabled. Installation success and reboot status remain separate. |
+| reboot_reasons_before | Bounded native reboot sources reported by `ansible.windows.win_reboot_info` before patching. These are observations from that run, not a live probe. |
+| blocked_reason preexisting_reboot_required | Core's independent preflight observed a prerequisite reboot; new patch work did not start on that path. |
+| blocked_reason cycle_limit_reached | Core stopped bounded continuation; a new decision is needed, never an automatic replay. |
+| failed_updates | Per-update title/ID, unsigned and hex HRESULT, fixed reason and safe message supplied by Core. |
+| install_not_allowed / 0x80240016 | May indicate an active installer or mandatory reboot; not proof of a pre-existing reboot by itself. |
+| Check mode | Observations/predictions, never proof of installation or an actual reboot. |
+
+The normal report summary keeps the pre/post reboot observations, performed/deferred
+flags, reviewed delay, cycle count and continuation policy visible when supplied.
+Pending-list display suppression is a presentation decision when Core says the list
+is not authoritative. It does not modify stored data: the retained structured JSON
+still provides the exact approved report body for inspection.
+
+Report-slot `complete` is availability, while payload `data.complete` describes update
+evidence. Neither independently proves the host is fully patched. Native target
+outcomes, Core result-validation failures and per-host reports remain separate.
+
+## Historical data and permissions
+
+Old reports retain their reviewed schema. No migration rewrites old patch outcomes or
+adds missing fields. Only retained WebGUI jobs contribute to host history; no terminal
+run tracking, inventory writes, raw logs or new credential storage are introduced.
+Report reads remain owner-or-admin and job deletion removes linked evidence. The
+Checkmk configuration-content retention opt-in is unchanged.
+
+## Controller acceptance
+
+Use Core's current SANITY.md under the actual executor context on a disposable,
+approved target. Confirm native `win_updates` wave behavior, the default stop after an AIM-performed
+reboot, explicit post-reboot continuation behavior, read-only final discovery,
+reboot-disabled/pre-existing-reboot cases and a bounded failure record. Compare actual
+effects and reported fields, not old task counts. Do not deliberately patch or reboot
+production systems merely to exercise a user-interface feature.
diff --git a/scripts/addons/webgui/docs/PERMISSIONS-ROLLOUT.md b/scripts/addons/webgui/docs/PERMISSIONS-ROLLOUT.md
new file mode 100644
index 0000000..08c26c0
--- /dev/null
+++ b/scripts/addons/webgui/docs/PERMISSIONS-ROLLOUT.md
@@ -0,0 +1,42 @@
+> The behaviors below are retained from2.1.0rc2. Current candidate2.1.0rc9 targets Core3.3.0rc8/schema5 and adds reports/journal described in REPORTS.md and JOURNAL.md. Credential, read-only inventory and OS-permission boundaries here remain unchanged; old version/no-migration statements describe the earlier slice.
+
+# Managed permissions - WebGUI 2.1.0rc1
+
+No permission change from2.0.0rc8. This document describes the existing add-on-owned contract, not instructions to recursively chown AIM.
+
+| Resource | Owner/group | Mode |
+|---|---|---|
+| WebGUI source, virtualenv, units | root-owned | Release-managed |
+| webgui.toml | root:aim-web |0640|
+| /var/lib/aim/webgui |aim-web:aim-web|0700|
+| SQLite database |aim-web:aim-web|0600|
+| /var/lib/aim-web-executor and .ansible/tmp chain |executor:native primary group|0700|
+| passwd-home .ansible and .ansible/tmp |executor:native primary group|0700|
+| /run/aim-web-executor |executor:native primary group|0711|
+| /run/aim-web-executor/core.sock |executor:aim-web|0660|
+
+Site executor is svc_bf-ansible. Systemd preserves its native primary group and grants aim-web as a unit-scoped SupplementaryGroups entry; numeric group IDs may appear in systemctl output. Other account memberships are resolved normally, so an empty explicit supplementary setting is not proof of an empty actual group list. The installer does not silently rewrite OS account memberships.
+
+The0711 runtime directory permits traversal to the known socket path, not directory listing for unrelated users. Socket DAC and peer checks govern access. NoNewPrivileges and empty capability sets remain; no sudo or root worker. ProtectHome remains read-only with a narrow writable passwd-home .ansible/tmp exception for delegated local tasks, plus the separate process-home staging path. The installer waits for socket readiness and checks exact managed owner/mode before starting dependent services.
+
+## Verification, not manual repair
+
+```bash
+systemctl show aim-web-executor.service -p User -p Group -p SupplementaryGroups
+stat -c '%U:%G %a %n' \
+  /var/lib/aim-web-executor \
+  /var/lib/aim-web-executor/.ansible/tmp \
+  /home/svc_bf-ansible/.ansible/tmp \
+  /run/aim-web-executor \
+  /run/aim-web-executor/core.sock \
+  /etc/ansible/scripts/config/webgui.toml
+sudo journalctl -u aim-web-executor.service -n 60 --no-pager
+```
+
+The release-managed ExecStartPre runs staging checks inside the real executor unit. Interactive sudo -u svc_bf-ansible alone does not reproduce unit-scoped aim-web group access to webgui.toml. Do not make that config world-readable to hide the distinction.
+
+## Outside add-on ownership
+
+AIM source/configuration, authorization groups, inventory/Vaults, canonical owner-only0600 private keys, /etc/ssh/ssh_known_hosts, certificates and Nginx remain Core/operator managed. The add-on does not enroll host keys or infer their trust from HOME. Keep independently verified effective SSH trust. Unknown unit drop-ins stop deployment for review; do not silently restore obsolete privilege/capability workarounds.
+
+The new explorer, activity and insights pages require no new write path, group, service, port or secret permission.
diff --git a/scripts/addons/webgui/docs/PRODUCT-COMPARISON.md b/scripts/addons/webgui/docs/PRODUCT-COMPARISON.md
new file mode 100644
index 0000000..908a055
--- /dev/null
+++ b/scripts/addons/webgui/docs/PRODUCT-COMPARISON.md
@@ -0,0 +1,96 @@
+> Historical reference retained from the preceding release. Current deployment/contracts and evidence are in DEPLOYMENT.md, REPORTS.md, JOURNAL.md and VERIFICATION.md. Do not treat old limitations or tests as current qualification.
+
+# AIM WebGUI 2.1.0rc2 compared with Jenkins, Semaphore UI and Foreman
+
+## Basis and limits
+
+This is a documentation-based capability and product-direction comparison, not a hands-on usability benchmark, security audit, licensing quotation or performance comparison. AIM statements refer to the inspected 2.1.0rc2 source and its test evidence. Other product statements refer to the official documentation listed below, consulted for this release. Features can depend on installed plugins, edition and configuration; Foreman examples use the published 3.18 host-management guide without claiming that version is the newest stable release. Recommendations below are design judgments, not measured rankings.
+
+## The products solve different problems
+
+**AIM Web** is a focused operator interface over a separately managed AIM Core. It discovers Core-owned customers, hosts, groups and catalog playbooks; prepares explicit reviewed runs; requests transient credentials only when the worker is ready; and shows Core-owned results. It does not own inventory/Vault editing, arbitrary automation code, server provisioning or a general plugin execution ecosystem. Its history covers retained WebGUI jobs only. [A1]
+
+**Jenkins** is primarily a Pipeline/CI/CD automation platform. Pipeline models multistage work and supports extensible execution through steps and plugins. Its Ansible plugin accepts playbooks, inventories and credential IDs. Treating Jenkins as a direct equivalent of a host inventory system would obscure that pipeline-centric design. [J1, J2]
+
+**Semaphore UI** is the closest operational comparator: projects combine repositories, inventories, reusable credentials, variables and task templates, with each execution recorded as a task. Its documented scope also includes tools other than Ansible. The user guide documents schedules and workflow-related capabilities, with some capabilities edition-dependent. [S1, S2]
+
+**Foreman** is broader host lifecycle management, not merely a Puppet runner. It maintains host inventory/group settings and supports provisioning and infrastructure integrations. Its documented remote-execution and Ansible workflows can operate against selected hosts through Smart Proxies; Puppet is one part of that ecosystem. [F1, F2]
+
+## Functional comparison
+
+| Area | AIM Web 2.1.0rc2 | Established-product reference |
+|---|---|---|
+| Inventory | Current read-only Core hierarchy; linked SVG/outline explorer; customer-scoped host pages | Semaphore manages inventory resources used by templates. Foreman manages hosts, host groups and inherited settings. Jenkins' Ansible plugin consumes inventory files/inline inventory for pipeline execution. [S3, F1, J2] |
+| Starting work | One-run review without mandatory plan; optional collision-safe saved title; existing independent approval when enabled | Semaphore starts tasks from templates and exposes user prompts. Jenkins offers Pipeline parameters/input steps. Foreman provides host selection and job-template workflows. [S2, J3, F2] |
+| Credential experience | Owner-initiated modal, Core-required fields, one-run lifetime, no add-on reusable secret store | Jenkins supports stored credentials referenced by IDs. Semaphore has a Key Store for reusable credentials. Foreman job settings include authentication/password and key-passphrase inputs where applicable. These are different operating models, not a security ranking. [J4, S4, F2] |
+| Output | Core-filtered static play/task/host labels and hints, bounded ephemeral stream; authoritative final per-target outcomes retained with the job | Jenkins' Ansible plugin supports console output; Semaphore documents live/completed logs and a raw-log view. Broader log access is useful for diagnosis but creates a different retention/exposure decision. [J2, S5] |
+| History | Host Activity and Playbook Insights over authorized retained WebGUI jobs, separating Check/Apply and host/whole-job outcomes | Semaphore exposes task/template history; Foreman is natively host-oriented. Do not equate a job log with an authoritative machine-wide history or claim a feature is absent merely because its documentation was not inspected. [S2, S5, F1] |
+| Orchestration | Existing queue, bounded targets, optional independent review and one-off UTC scheduling; no workflow DAG or recurring scheduler | Jenkins supports pipeline composition. Semaphore documents cron schedules; its documentation identifies workflows as a Pro feature. Foreman offers remote-job controls through its host-management workflow. [J1, S6, S7, F2] |
+| Access | Local accounts, customer/playbook execution grants; owner-or-admin job/history access and owner-only plans; not hostile-tenant isolation | Semaphore has project teams and built-in roles, with Enterprise extended permissions. Jenkins credential use is scoped and depends on authorization/plugin configuration. Wider identity deployments need product-specific evaluation. [S8, J4] |
+| Extensibility | Fixed public Core contract; add-on cannot import private Core managers or rewrite Ansible arguments | Jenkins has a broad Pipeline/plugin model; Foreman integrates host/provisioning components; Semaphore supports several automation applications. Flexibility also increases the scope an administrator must configure and govern. [J1, F1, S2] |
+
+## What the new modal improves
+
+The implemented path is now: open an existing reservation, recognize the reviewed customer/targets/mode, enter only the required credentials, submit once, then follow the job. Core-permitted key-passphrase choices use native radio buttons styled as a segmented control. Changing that presentation choice does not change reviewed scope, native inventory precedence or execution identity. [A2]
+
+This intentionally avoids asking an operator to configure a reusable credential resource just to perform one reviewed run. It also preserves a cost: repetitive or unattended operations are less convenient when credentials must be resupplied. That tradeoff is part of the current requested product boundary, not evidence that all stored-credential products are unsafe. [A2, J4, S4]
+
+Jenkins' input step demonstrates the value of making pending human input an explicit workflow state. Semaphore's template prompts demonstrate the value of exposing only the options a particular task needs. Our application of those lessons is the new Needs your attention section and Core-driven fields, not importing their wider parameter or credential models. [J3, S2]
+
+## Where AIM Web is already well aligned with this controller
+
+The strongest fit is the combination of explicit target review, customer-aware discovery, optional saved plans, per-target final results and linked host activity. Operators can inspect an inventory branch, open a host, find its last retained Checkmk result and return to the source run without moving inventory ownership out of AIM Core. The mobile header and native modal now make that narrower workflow easier to navigate. These are implemented behaviors, not evidence that our UI is universally faster or more accessible than the other products. [A1, A2]
+
+The history design is unusually explicit about what it does not know: no terminal AIM runs, deleted-job reconstruction, current-health score, inferred installed version or invented success for legacy data. A partially successful parent job does not erase each target's own final outcome. Preserve that clarity as the UI grows. [A1]
+
+## Where established platforms set a higher bar
+
+**Operational breadth:** reusable template catalogs, external integration, distributed execution, scheduled orchestration and richer organization models are documented strengths across these platforms. AIM Web does not yet provide comparable breadth, and turning a UI preference into a rushed workflow engine would undo the modularity gained from Core. [J1, S1, S6, S7, F1]
+
+**Investigative detail:** a retained full log can answer questions our ephemeral, filtered stream cannot. Semaphore explicitly exposes task logs after completion. AIM currently retains final facts, not a full transcript. A future Core-approved retention contract should be considered separately rather than quietly capturing raw stdout because it is convenient. [S5, A1]
+
+**Release and deployment assurance:** our recent manifest, startup and permission failures remain evidence that packaging and controller acceptance need attention. A passing synthetic suite does not establish production-browser, systemd, SSH/WinRM, upgrade or security qualification. This report does not claim comparable maturity or measure other products' defect rates. [A3]
+
+**Access administration:** project-scoped teams, federation and larger administrative structures deserve a deliberate design if the audience expands beyond the current controller. Semaphore documents built-in project roles and Enterprise extensions; those are not equivalent to our existing local execution grants. [S8, A1]
+
+## Security is not a badge comparison
+
+Jenkins documents encrypted stored credentials and ID-based use; its binding documentation also explains masking limitations and risks from processes sharing execution accounts. This is useful context, not a reason to claim that masking or a modal prevents all disclosure. [J4, J5]
+
+AIM's transient credential path reduces intentional add-on secret retention, but authorized controller code and service accounts remain trusted. DOM clearing cannot prove physical memory erasure. Core owns execution semantics; an accepted credential handoff does not prove authentication. Foreman/Semaphore/Jenkins have different persistence, identity and deployment choices that require their own configured-environment review. [A2]
+
+## Recommended direction after this RC
+
+My recommendation is to borrow interaction patterns, not product scope.
+
+1. **From Semaphore:** make supported playbook inputs feel like a small, well-labeled task form. Keep preflight and execution semantics in Core. Improve template/saved-plan discovery before adding arbitrary parameters.
+2. **From Foreman:** strengthen host-centric navigation and contextual actions. Add dated last-result overlays and comparisons of recorded runs, not invented live health or inventory mutation.
+3. **From Jenkins:** make stage transitions and pending human action unmistakable. Keep cancellation, acknowledgement uncertainty and dependency failures visible without turning every event into a wall of log text.
+
+None of those follow-on features is claimed shipped in this RC. The immediate release contains the modal and attention surface; targeted retry preparation, history overlays, run comparisons, federation and workflow orchestration remain separate proposals. Reliability and installed-controller acceptance should remain the next gate.
+
+## Official references and inspected AIM files
+
+Sources are provided as exact locations so the comparison can be rechecked as products evolve.
+
+- **A1** - This release: `AGENTS.md`, `docs/READ-ONLY-EXPERIENCE.md`, `docs/API.md`, `src/aim_webgui/activity.py`, `explorer.py`, `workflows.py` and `worker.py`.
+- **A2** - This release: `docs/RUN-COMFORT.md`, `docs/CREDENTIALS.md`, `credentials/presentation.py`, `credentials/service.py`, `routes/workflows.py`, credential templates and `static/js/credentials.js`.
+- **A3** - This release: `docs/VERIFICATION.md`, `docs/verification-results.json` and preserved `CHANGELOG.md` provenance.
+- **J1** - Jenkins Pipeline: `https://www.jenkins.io/doc/book/pipeline/`
+- **J2** - Official Jenkins Ansible plugin: `https://plugins.jenkins.io/ansible/`
+- **J3** - Jenkins Pipeline Input Step: `https://www.jenkins.io/doc/pipeline/steps/pipeline-input-step/`
+- **J4** - Jenkins Using credentials: `https://www.jenkins.io/doc/book/using/using-credentials/`
+- **J5** - Jenkins Credentials Binding: `https://www.jenkins.io/doc/pipeline/steps/credentials-binding/`
+- **S1** - Semaphore UI user guide: `https://semaphoreui.com/docs/user-guide`
+- **S2** - Semaphore task templates: `https://semaphoreui.com/docs/user-guide/task-templates/views` and `https://semaphoreui.com/docs/user-guide/task-templates`
+- **S3** - Semaphore inventory: `https://semaphoreui.com/docs/user-guide/inventory`
+- **S4** - Semaphore Key Store: `https://semaphoreui.com/docs/user-guide/key-store`
+- **S5** - Semaphore Tasks and log retention: `https://semaphoreui.com/docs/user-guide/tasks`
+- **S6** - Semaphore Schedules: `https://semaphoreui.com/docs/user-guide/schedules`
+- **S7** - Semaphore documentation index (Workflows Pro): `https://semaphoreui.com/docs`
+- **S8** - Semaphore Teams and Enterprise RBAC: `https://semaphoreui.com/docs/user-guide/team`
+- **F1** - Foreman introduction: `https://www.theforeman.org/introduction.html`
+- **F2** - Foreman 3.18 Managing hosts: `https://docs.theforeman.org/3.18/Managing_Hosts/index-foreman-el.html`
+- **U1** - User-provided Bootstrap4 button pattern: `https://getbootstrap.com/docs/4.0/components/buttons/#checkbox-and-radio-buttons`
+- **U2** - Bootstrap5 native check/radio toggle buttons used by this release: `https://getbootstrap.com/docs/5.3/forms/checks-radios/`
+- **U3** - WAI modal dialog interaction guidance: `https://www.w3.org/WAI/ARIA/apg/patterns/dialog-modal/`
diff --git a/scripts/addons/webgui/docs/READ-ONLY-EXPERIENCE.md b/scripts/addons/webgui/docs/READ-ONLY-EXPERIENCE.md
new file mode 100644
index 0000000..790ce5f
--- /dev/null
+++ b/scripts/addons/webgui/docs/READ-ONLY-EXPERIENCE.md
@@ -0,0 +1,46 @@
+> The behaviors below are retained from2.1.0rc2. Current candidate2.1.0rc9 targets Core3.3.0rc8/schema5 and adds reports/journal described in REPORTS.md and JOURNAL.md. Credential, read-only inventory and OS-permission boundaries here remain unchanged; old version/no-migration statements describe the earlier slice.
+
+# Read-only experience - 2.1.0rc1
+
+## Mobile header
+
+At <=760px the top bar is one row: AIM logo/home shortcut left, light/dark sun/moon segments to the left of the hamburger at the right edge. Navigation and account actions open in a native details dropdown beneath it. Escape returns focus to the hamburger; outside clicks, navigation and desktop resize close it. No-JavaScript details navigation remains available. There are no swipe rails or arrow instructions. Above760px the desktop sidebar remains.
+
+## Inventory Explorer
+
+Open Inventory explorer from navigation, then select a customer. Core's current hierarchy and flat host metadata are fetched for that request only. Desktop starts with a deterministic linked SVG map; phones start with the equivalent outline. Map/Outline links switch representation. The map shows the current branch, at most12 immediate subgroups and up to3 direct host links per subgroup. Open a group to drill down. Up to24 direct hosts are listed per page. Search pages have50 results. These display limits never change execution targets or summary totals.
+
+Each group uses its full Core path, not just the leaf label. Direct customer-root hosts are shown. Repeated membership is valid; total group/root host counts use distinct logical names. A host links to one customer-scoped activity page regardless of how many branches contain it. Map lines are inventory memberships, not network links or dependencies. Empty groups and no direct members are explicit.
+
+Zoom buttons and internal scrolling are optional conveniences; all nodes also have ordinary links and the outline view. A graph click never prepares or executes a job. Current inventory failures show an error, not an invented empty or offline graph. There is no persisted secondary inventory, force simulation or remote discovery. Historical outcome overlays on graph nodes are deferred; the activity link supplies dated results.
+
+## Host Activity
+
+Identity is `(customer, exact logical hostname)`, not a machine UUID. Current membership/platform/address is read from Core separately from history. A removed/renamed host can retain history without implying it is still targetable; no automatic merging occurs. Core outages show a current-metadata-unavailable banner while authorized retained history remains usable.
+
+The page offers mode, rolling time range, playbook and target-outcome filters; playbook summaries, a25-record timeline, expandable numeric target counters and the viewer's own saved plans containing the exact hostname. A successful target remains successful even if the whole job partially succeeded. Link to the source job for overall status, Core exit and reviewed scope.
+
+## Playbook Insights
+
+The matrix shows the latest matching record per customer/host/playbook, with timestamp, mode and source-job link. Mobile renders host cards instead of compressing the matrix. Matrix pages have20 hosts and up to12 playbook columns; larger catalogs require filtering and disclose omitted columns. Statistics cover all matching retained records, not only the visible rows or the100-job overview. Outcome filtering means latest *matching* outcome, not necessarily latest run; the page labels that distinction.
+
+## Exact data and metric scope
+
+- Only jobs executed/tracked by this add-on and still retained in its workflow database contribute. No terminal AIM history, Core-wide history, scan, agent or second event collector is added.
+- Each distinct requested host contributes at most one sample per job. Group appearances, SSE reconnects and task counts do not create extra samples. Retries are separate jobs/attempts.
+- Owner-or-admin job visibility is applied in SQL before data is read/aggregated. Saved plans stay owner-only even for administrators. Filters, cells and totals obey the same scope.
+- Apply mode is the default. Check is separate; All explicitly combines labeled records. Check results are never evidence of installed changes. Rolling7/30/90/365days and All retained are available. The time axis uses finished_at or, when absent, created_at; all timestamps stay UTC internally.
+- Success rate = successful / (successful + failed + unreachable). The denominator is displayed. Not started, indeterminate, missing/legacy detail and unfinished jobs are counted separately. A zero denominator displays no rate.
+- Final outcomes come from valid Core target summaries whose host set matches the stored reviewed targets. Invalid/missing legacy facts become Detail unavailable. A nonterminal database job is Not finished even if a final response is in flight.
+- Changed values are task counts. The derived metric says host/run samples reporting changed tasks, not changed hosts. No per-host duration is inferred from job duration. No live-health, compliance or installed-version score.
+- Deleting a job removes its contribution immediately on the next query. Audit deletion events are not enough to recreate per-host outcomes and are not used to do so. No shadow results archive or materialized analytics table exists.
+
+## Read services and performance
+
+`activity.py` performs a consistent SQLite read snapshot, streams all matching job rows and builds only safe presentation records. Output records and matrix are paginated; all-history aggregation cost remains linear in matching retained job data. Customer/playbook/mode/time/owner predicates run in SQL. Distinct host/playbook cells are retained in memory for latest-result projection. This is suitable for the measured candidate scale, not an unbounded analytics claim. The optional synthetic benchmark is in `tests/benchmark_read_history.py`; consider indexed/materialized projections only after measured need, with deletion and authorization parity.
+
+`explorer.py` performs read-only public hierarchy/host requests and computes presentation geometry; `read_views.py` registers GET routes. There is no credential/prepare/execute call or extra executor operation for these pages. UI state is request-local except non-sensitive existing theme preference. No browser inventory/history storage is added.
+
+## Deliberately not in this slice
+
+No saved-plan edits or inventory/Vault management, host probes, terminal-history tracking, raw output retention, automated retry or scheduling changes. The graph is branch-focused, not a full unlimited topology canvas. Account-synced density/view preferences and graph last-result overlays can follow later after this candidate is qualified.
diff --git a/scripts/addons/webgui/docs/REPORTS.md b/scripts/addons/webgui/docs/REPORTS.md
new file mode 100644
index 0000000..c1b9234
--- /dev/null
+++ b/scripts/addons/webgui/docs/REPORTS.md
@@ -0,0 +1,62 @@
+# Operation reports - 2.1.0rc9 / Core3.3.0rc8
+
+Core's live `operation_results` capability, catalog result declaration and prepared result_contract are validated and preserved with review. Core's public protocol is `aim_operation_result_v1`; its publisher convention is `aim_output_v1`. The API remains1.0 and no new execute flag/schema path/report body is supplied by the browser.
+
+The recorded contract, not a newly fetched catalog schema, governs historical rendering. Schema changes stale preparation. No private Core imports, local inventory parsing or external schema/$ref execution is added. An independently implemented consumer validates the documented bounded JSON-schema subset. Unknown additive wrapper fields are discarded rather than stored. Unknown report identifiers using the supported schema language get a generic renderer; unsupported protocols/languages fail explicitly.
+
+## Three independent facts
+
+1. Core status/stage/native exit and remote_work_may_have_started.
+2. Native per-target outcomes from the final Core stats.
+3. Report-slot availability and local retention.
+
+Native exit0 plus a missing required report remains **failed/result_validation/exit0**, even when all native targets are successful. An existing failure can contain useful available reports. Complete report slots do not prove execution success. No automatic retries occur; already applied changes are not rolled back. Reports require the final response; an observed final event alone is not enough.
+
+Only available slots render data. Missing, withheld, invalid, not_started and indeterminate have data:null and never become zero/false/empty reports. Null versions remain unknown. Slot errors are fixed nullable codes, not arbitrary exception messages. Native target metrics in Host Activity keep their existing denominator and meaning.
+
+## Views
+
+| Schema | Presentation and meaning |
+|---|---|
+| host_capabilities_v1 | Eight Yes/No facts, not current inventory membership or live health. Missing is not No. |
+| filesystem_usage_v1 | Mount/drive table, observed byte counts and utilization, explicit unavailable/null. Mapped drives remain WinRM-session scoped. |
+| event_log_export_v1 | Channels, time window and target file paths; no browser download/file-read capability. Check mode reports no completed export. |
+| service_start_summary_v1 | Before/eligible/attempted/excluded/after facts and fixed failure reasons. Excluded is not a failed start; observed running does not prove sole causation. |
+| patch_summary_v1 | Linux net package/version-set changes or Windows update IDs/KBs, installed/pending/failed and reboot evidence. data.complete is separate from report complete; not an exhaustive transaction log. |
+| managed_cleanup_preview_v1 | Candidate versus actual removed managed files, with mode prominent. No unknown-file purge. |
+| checkmk_user_config_v1 | Parsed/redacted configuration or default metadata subset, not raw YAML/comments. Redacted markers are not absent settings. |
+| checkmk_agent_state_v1 | Observed installation/version/source, services and managed changes. Do not infer version from an MSI filename. |
+| checkmk_agent_config_v1 | Named section/file/check changes; not raw field diffs or a count of untouched unknown files. |
+
+All nine have schema-keyed titles/semantic notes, scalar fact cards, bounded array/object sections and an escaped JSON alternative. Collection sections paginate at50 entries. Nested long values are visibly shortened in tables; the separately loaded retained JSON is not truncated. Unknown supported schemas/global scope have generic rendering. Core ships no global operation; its native qualification is separate.
+
+Reports are available **when Core finalizes**, not while a publisher task is merely running. Job sections link Summary/Progress/Targets/Reports. The report page shows host, mode, recorded time, source job, execution verdict, availability and retention. Host Activity links the latest20 authorized report references for its exact customer/host across all dates and modes, separately from history filters. No current-state overlay or inventory update is implied.
+
+## Persistence and confidentiality
+
+```toml
+[reports]
+max_bytes = 16777216
+retain_configuration = false
+```
+
+Report bodies live in job-linked tables, not the ordinary jobs.core_result payload used by status polls and analytics. The worker atomically records the compact final result and report metadata/data once. Each report read is authorized owner-or-admin, with lazy one-slot JSON retrieval. Paths/URLs remain text and never become arbitrary downloads or commands. HTML/Rich-looking strings are escaped. No browser data storage or raw-body logging.
+
+The default retains validated ordinary reports, bounded by the reviewed slot cap (up to1MiB) and16MiB Core/add-on per-run caps. Lower local caps skip whole bodies with not_retained_limit rather than cutting JSON while claiming validity. Original Core availability remains separate from local retention.
+
+For checkmk_user_config_v1, **full sections are NOT retained by default**. The metadata_only subset contains path, exists, size_bytes, last_write_time_utc, redacted_paths and comment_preservation. That subset is explicitly labeled, not claimed as a full schema payload. Set retain_configuration=true only after approving the extra data-retention exposure and restart/reload the relevant services; release-managed config replacements require re-review of that preference. It applies to newly finalized runs and cannot restore prior omitted sections.
+
+Core filtering is not a universal secret scanner. Operational reports can disclose configuration choices. Keep private database and backup permissions, HTTPS, session/RBAC and operational source trust. Supplied secrets are checked again during public-report validation. No arbitrary debug/module output, invocation, environment or passwords are added.
+
+Delete a job -> its report and journal rows disappear. Audit holds only the deletion fact. No separate archive; protected backups have their own operator retention policy. No backfill from terminal history.
+
+## Transport budget
+
+Large **public responses** use128MiB JSONL-line,512MiB total-process-output and32MiB canonical UTF-8 executor-frame bounds; non-execute metadata lines are bounded at32MiB. These finite transport ceilings accommodate encoding/wrappers and duplicated final event/response, not a license for report payloads beyond Core's1MiB/slot and16MiB/run limits. Structural decoding rejects excessive nesting, duplicate keys and non-finite numbers. The consumer revalidates data and reviewed target/mode/schema association. Torn/oversized responses never become partial valid JSON or success.
+
+Request/secret boundaries are unchanged: normal browser bodies64KiB, credential bodies8KiB, private secret frames bounded, per-value WebGUI2048UTF-8 bytes and the existing Core credential FD. Increasing response capacity did not increase secret lifetimes, password sizes or inbound command authority.
+
+
+## Core rc8 patch-wave extensions
+
+See [PATCH-WAVES.md](PATCH-WAVES.md) for reboot-before/after/deferred/delay fields, Windows continuation/cycle reporting, remaining-update knowledge, and supplied unsigned/hex HRESULT/reason/message fields. The patch view explains these facts without changing the Core/job verdict. Pending is not shown as a final remaining-update list when Core explicitly reports remaining_updates_known=false. Structured JSON remains available; no report data is rewritten. Old reports retain their recorded contract and missing optional values are never backfilled.
diff --git a/scripts/addons/webgui/docs/ROADMAP.md b/scripts/addons/webgui/docs/ROADMAP.md
new file mode 100644
index 0000000..5621b80
--- /dev/null
+++ b/scripts/addons/webgui/docs/ROADMAP.md
@@ -0,0 +1,7 @@
+# Roadmap after2.1.0rc9
+
+Implemented candidate: Core3.3 reports/contract transport, schema5 retained metadata journal and job-bound report storage, reconnect/reload/multi-view replay, dated Host Activity report references and conservative configuration retention. All existing read-only/mobile/modal/workflow features remain.
+
+Next gate is controller acceptance and bug fixes, not expanded execution authority. Qualify real Ansible2.19.11 publishers, report semantics and both staging locations inside installed services; browser pinned assets/HTMX/SSE/mobile keyboard; recover/rollback; load/backups and deletion policy. See VERIFICATION and CONTROLLER-PILOT.
+
+Later independently approved UI work: problem-target filters, comparison of two retained host reports, optional dated map overlays, density/view preferences, and richer presentation driven by future supported schemas. Current reports are finalization-only. Do not invent live reports, monitoring/current compliance, terminal-wide history, private Core reads, arbitrary Ansible args, automated replay or a second credential store.
diff --git a/scripts/addons/webgui/docs/RUN-COMFORT.md b/scripts/addons/webgui/docs/RUN-COMFORT.md
new file mode 100644
index 0000000..fc07351
--- /dev/null
+++ b/scripts/addons/webgui/docs/RUN-COMFORT.md
@@ -0,0 +1,43 @@
+> The behaviors below are retained from2.1.0rc2. Current candidate2.1.0rc9 targets Core3.3.0rc8/schema5 and adds reports/journal described in REPORTS.md and JOURNAL.md. Credential, read-only inventory and OS-permission boundaries here remain unchanged; old version/no-migration statements describe the earlier slice.
+
+# Run comfort - AIM WebGUI 2.1.0rc2
+
+## Scope
+
+Based on the working 2.1.0rc1 read-only release, targeting separately managed AIM Core3.3.0rc3/API1.0. This is a user-interface enhancement to the existing one-run credential path, not a password store, new authentication mode or execution engine. SQLite4, WebGUI HTTPv2, Core detail/outcome/hierarchy/staging contracts and release-managed permissions remain unchanged.
+
+## Open without leaving the job
+
+When the worker is ready, the job owner selects **Unlock this run** on Job detail or **Unlock run** in Needs your attention. A native modal opens over the current page, with the reviewed playbook/customer, target count and Apply/Check mode visible. It does not open automatically, move the user into a new window, or focus a password field without a deliberate action. The title gets initial focus so opening on a phone does not immediately summon the keyboard.
+
+The form is fetched lazily and is not part of the HTMX-polled job or attention region. Refreshing those regions does not erase typing. Tab/Shift+Tab stay inside the dialog; Escape or the explicit Close button dismisses it and returns focus, even when polling replaced the original trigger. A backdrop tap is ignored to avoid accidental loss of input. The viewport-bounded body scrolls internally and responds to visual-viewport resize. The full-page link still works without JS or dialog support, and also when deliberately opened in another tab.
+
+## Use only the fields Core requires
+
+Vault-only jobs show one password field. Each input has a persistent label, Required/Optional text, Show/Hide button and Caps Lock hint. Paste is supported; the app neither stores values in browser storage nor disables a user's deliberate password-manager use. These are infrastructure passwords, not MFA/one-time-code inputs.
+
+When the requirements contain both `vault_password` and `ssh_key_passphrase_or_customer_vault_value`, a native radio-button group styled as buttons offers **Use customer Vault** (default) and **Enter separately**. Choosing the latter reveals a required key-passphrase field; returning to Vault clears/disables it. When a key is explicitly required by Core, the field stays required and the alternate-source toggle is not offered. A requested connection password is labeled a default, since native inventory precedence still applies. No Vault/Custom credentials switch, forced account override, become field or private-key upload is added.
+
+The user's Bootstrap4 grouped-radio example was used as visual inspiration. Implementation uses existing Bootstrap5 `btn-check` inputs with associated labels and native radio semantics, not Bootstrap4's button plugin or jQuery. Theme tokens and focus contrast remain in the established design system.
+
+## Submission and deadlines
+
+The timer is synchronized to the server's existing reservation deadline and advances from a monotonic browser clock. Opening, polling and typing do not extend the five-minute window. An amber near-expiry notice is displayed once; the timer is not announced every second. POST validation, not the client timer, controls eligibility. Handoff/start keeps its existing 60-second bound.
+
+Submit clears the live DOM values (including revealed text inputs), disables repeat interaction and sends only supported credential fields in the authenticated/CSRF-protected JSON POST. The confirmation says **handoff accepted**, not password verified. Core validates Vault/key/connection details later, and the user can close the dialog to follow the existing job output. Closing is not a job cancellation.
+
+If the HTTP response is lost or uncertain, credentials are cleared and the form locks. It reads owner-only job status rather than resending the password automatically. Reopening that job on the same page preserves only the uncertainty marker/job ID, never secrets. The worker's existing atomic claim prevents reuse; refreshing a page is not a way to replay a claimed handoff. A 400 field-validation failure can allow another explicit corrected submission; throttles, revoked permission, expiry and ended jobs remove the input opportunity. No error echoes credential values or raw Core exceptions.
+
+Clearing references is not physical memory erasure. The browser, network stack and operating system may have other transient copies. Infrastructure administrators must still manage TLS, proxy buffering/logging, dumps, swap and the trust of service identities.
+
+## Needs your attention
+
+Overview shows up to eight actionable jobs; Jobs shows up to100 and discloses any remaining total. The query scans current actionable jobs rather than only the newest100 history entries. Your own live credential reservations come first. Administrators see other owners' jobs needing independent approval as review links, not automatically approved jobs and not another requester's credential form. Ended/expired/canceled jobs leave the action list. Ordinary failed jobs stay in history rather than masquerading as pending input.
+
+## Retained functionality
+
+Inventory map/outline, Host Activity, Playbook Insights, mobile hamburger/theme controls, customer-scoped histories, one-run review, unique saved-plan names, partial-result presentation, manual fresh retry and terminal-only deletion remain. History continues to include only retained WebGUI jobs. No terminal Core history, inventory writes, secrets cache or live host probing is introduced.
+
+## Operator acceptance
+
+Use a disposable authorized job and test both Vault-only and a customer-key requirement. Verify fields against Core, focus/keyboard/mobile viewport behavior, a live HTMX refresh while typing, close/expiry/revocation clearing and an accepted handoff followed by the actual run. Test an ambiguous response only on a safe disposable operation and confirm no automatic POST repetition. Verify fallback form and owner/admin policy. Source/browser fixture evidence and untested production boundaries are in VERIFICATION.md.
diff --git a/scripts/addons/webgui/docs/SECURITY.md b/scripts/addons/webgui/docs/SECURITY.md
new file mode 100644
index 0000000..c13c7a0
--- /dev/null
+++ b/scripts/addons/webgui/docs/SECURITY.md
@@ -0,0 +1,23 @@
+# Security boundaries - 2.1.0rc9
+
+Preserve the established web/auth/queue/executor separation: non-root web and existing non-root executor, fixed Core executable/config, Unix peer checks, normal service groups, both narrow staging exceptions and no new sudo/capability/key-export path. This is a trusted-controller execution service, not a hostile-tenant or malicious-playbook sandbox.
+
+Argon2id, opaque server sessions, Secure/HttpOnly/SameSite cookies under HTTPS, CSRF/origin/trusted-proxy policy, throttles, current grants, explicit scope/revision review and last-admin checks remain. One-run credentials are collected only for the owning reservation and travel via private frames/FD. No password in job data, reports, journal, browser storage, logs, argv, environment or files. Keep existing deadlines, no automatic retry/POST replay and honest handoff-accepted wording. Reference cleanup is not physical memory erasure.
+
+## Approved persistence boundary
+
+This release intentionally replaces ephemeral-only progress with a **bounded structured journal**. It does not store raw Ansible stdout/stderr, debug values, rendered terminal transcripts, invocation/module dictionaries or decrypted Vault data. Only validated public detail metadata/fixed hints is retained; unknown additional event fields are dropped. Core's withheld labels/hosts remain withheld. A rejected/missing final response cannot be promoted from an earlier event.
+
+Operation reports are explicitly declared Core data, not automatically harmless content. Validate the recorded public schema, request host/mode association, scope, limits and availability. Supplied-secret checks are defense in depth. Static labels and unknown configuration values can still disclose information; Core filtering is not universal secret detection. Full parsed Checkmk sections therefore require explicit retention opt-in, defaulting to availability/file/redaction metadata only.
+
+All replay/report reads and statistics enforce the same owner/admin access as jobs; plan references remain owner-only. Session/job access is rechecked during streams. Cursors are not bearer authorization. Auth revocation ends live views; already displayed/downloaded/copied information cannot be recalled from a user.
+
+Only textContent/escaped templates render report strings. No arbitrary URLs, file downloads, source paths, HTML/Rich markup, schema references or executable validators are followed. JSON is bounded and fetched one slot on demand. No report/graph/history data is placed in browser localStorage. Copy JSON is a deliberate user clipboard action, not an automatic export.
+
+Delete a job -> remove journal/report rows and its statistical contribution; leave only compact audit deletion metadata. No shadow archive. Protected backups, browser transient memory, SQLite free pages and storage remnants require independent operator policy; deletion is not certified erasure. Audit is local, not tamper-proof.
+
+## Failures and qualification
+
+Core verdict, native target stats, report availability and journal coverage remain distinct. Native exit0/result_validation is not success and must not auto-replay. Queue overflow or journal write loss does not independently prove task failure. An interrupted stream remains unknown where Core cannot establish a final result.
+
+No native/systemd/proxy/browser-security qualification is claimed from source fixtures. See VERIFICATION.md and run CONTROLLER-PILOT.md with approved disposable scope. Maintain native Ansible2.19.11, Core's declared dependency range, validated TLS/global SSH trust and current operational-source review.
diff --git a/scripts/addons/webgui/docs/VERIFICATION.md b/scripts/addons/webgui/docs/VERIFICATION.md
new file mode 100644
index 0000000..c0f897d
--- /dev/null
+++ b/scripts/addons/webgui/docs/VERIFICATION.md
@@ -0,0 +1,57 @@
+# Verification - AIM WebGUI 2.1.0rc9
+
+Date: 2026-09-22. Target: independently managed AIM Core **3.3.0rc8**, public
+service/wire/event **1.0**; WebGUI HTTP **v2**; SQLite **schema 5**.
+
+## Scope
+
+This candidate reconciles the add-on release surface with the supplied Core 3.3.0rc8
+archive and packages the result as 2.1.0rc9. It does not claim native Windows/Linux or
+production-systemd acceptance merely because local source/contract checks pass.
+
+The supplied Core ZIP SHA-256 observed during this build is:
+
+```text
+76733be206b14c8a822126dfdd67ee3ad3667cdb88d3db925dd57859dd322ea0
+```
+
+No independent publisher sidecar was supplied, so this is an observed digest rather
+than a publisher-authentication claim. ZIP extraction/integrity succeeded.
+
+## Contract findings checked
+
+- Core rc8 reports product version `3.3.0rc8` and service/wire/event API `1.0`.
+- Live capabilities advertise `collection_baselines.ansible.windows` as
+  `>=3.8.0,<4.0.0`; WebGUI requires that declaration and does not manage collections.
+- Existing public detail-progress, inventory-hierarchy, target-outcome, staging and
+  structured operation-result contracts remain the integration boundary.
+- `patch_summary_v1` accepts rc8's additive optional `reboot_reasons_before` data while
+  historical report contracts remain independently validated.
+- No WebGUI database migration, Core mutation, new privilege bridge or private Core
+  import is introduced by rc9.
+
+## Automated evidence observed for rc9
+
+- Python compilation of `src`, `tests` and `deploy`: **passed**.
+- `tests/test_deployment_v2.py`: **10 passed**.
+- `test_core_contract.py::test_real_core_capabilities_and_customers` against the supplied
+  rc8 tree: **1 passed**.
+- Targeted rc8 patch checks completed before the bounded native-finalization fixture:
+  public catalog/options and new-report-schema/old-Core-gate checks **passed**.
+- The full `test_core_rc8_patch.py` file and the release-wide bounded runner did not
+  complete inside this execution environment's command window. Their interrupted runs
+  are **not** counted as passes and no rc4/rc5 test totals are carried forward.
+
+The final extracted rc9 ZIP is verified with the release's own `deploy.verify_release`
+manifest checker before delivery.
+
+## Not qualified here
+
+This build does **not** establish production installation of
+`ansible.windows >=3.8.0,<4.0.0`, native `win_reboot_info`, Windows Update, Checkmk ACL
+normalization/script placement, real WinRM/SSH, reboot behavior, production proxy/CSP/
+HTMX/EventSource traffic, or the actual systemd sandbox.
+
+Core rc8's current SANITY/VALIDATION guidance remains the operator acceptance source.
+Use a low-risk reporting operation first, then qualify Windows patching and changed
+Checkmk workflows separately on approved disposable targets.
diff --git a/scripts/addons/webgui/docs/verification-results.json b/scripts/addons/webgui/docs/verification-results.json
new file mode 100644
index 0000000..27dacdb
--- /dev/null
+++ b/scripts/addons/webgui/docs/verification-results.json
@@ -0,0 +1,64 @@
+{
+  "release": "2.1.0rc9",
+  "core": "3.3.0rc8",
+  "core_service_api": "1.0",
+  "http_api": 2,
+  "database_schema": 5,
+  "core_archive_sha256": "76733be206b14c8a822126dfdd67ee3ad3667cdb88d3db925dd57859dd322ea0",
+  "automated_tests": {
+    "python_compilation": {
+      "status": "passed",
+      "paths": [
+        "src",
+        "tests",
+        "deploy"
+      ]
+    },
+    "completed": [
+      {
+        "test": "tests/test_deployment_v2.py",
+        "passed": 10,
+        "failed": 0
+      },
+      {
+        "test": "tests/test_core_contract.py::test_real_core_capabilities_and_customers",
+        "passed": 1,
+        "failed": 0
+      },
+      {
+        "test": "tests/test_core_rc8_patch.py::test_rc8_public_catalog_options_not_hardcoded_defaults",
+        "status": "passed"
+      },
+      {
+        "test": "tests/test_core_rc8_patch.py::test_new_report_schema_and_old_core_gate",
+        "status": "passed"
+      }
+    ],
+    "interrupted_not_counted": [
+      "full tests/test_core_rc8_patch.py run",
+      "release-wide tests/run_release_tests.py run",
+      "test_real_core_rc8_patch_finalization_through_fake_native in combined targeted run"
+    ],
+    "native_managed_hosts_tested": false
+  },
+  "contract": {
+    "core_version": "3.3.0rc8",
+    "api_version": "1.0",
+    "collection_baseline_ansible_windows": ">=3.8.0,<4.0.0",
+    "detail_progress_schema": "play_task_host_v1",
+    "inventory_hierarchy_schema": "inventory_hierarchy_v1",
+    "target_outcome_schema": "target_outcome_summary_v1",
+    "staging_profile": "native_defaults_preflight_v2",
+    "operation_result_protocol": "aim_operation_result_v1"
+  },
+  "final_archive": {
+    "manifest_verified": true,
+    "archive_sha256": null
+  },
+  "limitations": [
+    "No native managed-host qualification",
+    "No real systemd installation or recovery",
+    "No production browser HTTPS/CSP/cookies/proxy/HTMX/SSE acceptance",
+    "Full release suite did not complete within the execution environment command window"
+  ]
+}
diff --git a/scripts/addons/webgui/pyproject.toml b/scripts/addons/webgui/pyproject.toml
new file mode 100644
index 0000000..8235f66
--- /dev/null
+++ b/scripts/addons/webgui/pyproject.toml
@@ -0,0 +1,40 @@
+[build-system]
+requires = ["setuptools==82.0.1"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "aim-webgui"
+version = "2.1.0rc9"
+description = "Independent Python operations WebGUI add-on for AIM 3.3.0rc8 service API 1.0"
+readme = "README.md"
+requires-python = ">=3.11"
+dependencies = [
+  "fastapi==0.128.2", "starlette==0.50.0", "uvicorn==0.48.0",
+  "Jinja2==3.1.6", "argon2-cffi==25.1.0", "ruamel.yaml==0.18.17"
+]
+
+[project.scripts]
+aim-web = "aim_webgui.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+aim_webgui = ["templates/**/*.html", "static/**/*", "db/migrations/*.sql"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["src"]
+
+[tool.aim-web]
+compatible-aim = ["3.3.0rc8"]
+http-api = 2
+database-schema = 5
+core-service-api = "1.0"
+core-event-api = "1.0"
+# Native Ansible compatibility is owned/checked by core, not this package.
+release-status = "candidate; controller qualification required"
+# AIM is an externally managed runtime dependency, deliberately NOT pip-installed.
+
+[project.optional-dependencies]
+test = ["pytest>=8,<10", "httpx>=0.27,<1"]
diff --git a/scripts/addons/webgui/requirements-test.txt b/scripts/addons/webgui/requirements-test.txt
new file mode 100644
index 0000000..6750ee5
--- /dev/null
+++ b/scripts/addons/webgui/requirements-test.txt
@@ -0,0 +1,3 @@
+# Test tooling only; do not install in the AIM environment.
+pytest==9.0.2
+httpx==0.28.1
diff --git a/scripts/addons/webgui/src/aim_webgui/__init__.py b/scripts/addons/webgui/src/aim_webgui/__init__.py
new file mode 100644
index 0000000..25c6f8a
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/__init__.py
@@ -0,0 +1,4 @@
+__version__ = "2.1.0rc9"
+COMPATIBLE_AIM = ("3.3.0rc8",)
+SCHEMA_VERSION = 5
+HTTP_API_VERSION = 2
diff --git a/scripts/addons/webgui/src/aim_webgui/__main__.py b/scripts/addons/webgui/src/aim_webgui/__main__.py
new file mode 100644
index 0000000..17e6660
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/__main__.py
@@ -0,0 +1,2 @@
+from aim_webgui.cli import main
+main()
diff --git a/scripts/addons/webgui/src/aim_webgui/activity.py b/scripts/addons/webgui/src/aim_webgui/activity.py
new file mode 100644
index 0000000..1fe4df4
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/activity.py
@@ -0,0 +1,193 @@
+"""Read-only projections of retained WebGUI history, never terminal/Core history.
+
+Queries are scoped to the same owner/admin policy as Workflows.job. They stream
+all matching retained rows rather than using the latest-100 Jobs overview. No
+projection table, background collection, extra inventory database or secret access.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+import json
+import time
+from urllib.parse import urlencode, quote
+
+from aim_webgui.core.protocol import _target_outcomes
+from aim_webgui.db.store import Store
+from aim_webgui.errors import WebError
+from aim_webgui.workflows import actor, presentation_status, TERMINAL
+
+OUTCOMES = ('successful', 'failed', 'unreachable', 'not_started', 'indeterminate', 'unavailable', 'outstanding')
+LABELS = {'successful': 'Succeeded', 'failed': 'Failed', 'unreachable': 'Unreachable',
+          'not_started': 'Not started', 'indeterminate': 'Indeterminate',
+          'unavailable': 'Detail unavailable', 'outstanding': 'Not finished'}
+
+
+def text(value: str, limit: int = 200) -> str:
+    if not isinstance(value, str) or len(value) > limit or any(ord(c) < 32 or ord(c) == 127 for c in value):
+        raise WebError('invalid_filter', 'Use bounded printable filter values.', 400)
+    return value
+
+
+def host_url(customer: str, host: str, **filters) -> str:
+    return '/inventory/' + quote(customer, safe='') + '/activity?' + urlencode({'host': host, **filters})
+
+
+def explorer_url(customer: str, **filters) -> str:
+    return '/inventory/' + quote(customer, safe='') + '/explore' + ('?' + urlencode(filters) if filters else '')
+
+
+@dataclass(frozen=True)
+class HistoryFilter:
+    customer: str = ''
+    host: str = ''
+    playbook: str = ''
+    mode: str = 'apply'
+    days: str = '30'
+    outcome: str = ''
+    q: str = ''
+    page: int = 1
+
+    def validate(self) -> 'HistoryFilter':
+        for val in (self.customer, self.host, self.playbook, self.q): text(val, 255)
+        if self.mode not in {'apply', 'check', 'all'} or self.days not in {'7', '30', '90', '365', 'all'}:
+            raise WebError('invalid_filter', 'Choose an available mode and retained-history time range.')
+        if self.outcome and self.outcome not in OUTCOMES:
+            raise WebError('invalid_filter', 'Choose a supported target outcome.')
+        if type(self.page) is not int or not 1 <= self.page <= 100000:
+            raise WebError('invalid_filter', 'Page is outside the supported range.')
+        return self
+
+    def query(self, **updates) -> dict:
+        values = dict(customer=self.customer, host=self.host, playbook=self.playbook, mode=self.mode,
+                      days=self.days, outcome=self.outcome, q=self.q, page=self.page)
+        values.update(updates)
+        return {key: val for key, val in values.items() if val != ''}
+
+
+def _dict(raw):
+    try:
+        result = json.loads(raw) if raw else {}
+        return result if isinstance(result, dict) else {}
+    except (ValueError, TypeError):
+        return {}
+
+
+def _facts(raw, requested):
+    """Use only Core-owned final facts; missing legacy records are not successes."""
+    value = _dict(raw)
+    try:
+        _, targets = _target_outcomes(value)
+        if {t['host'] for t in targets} != set(requested):
+            return value, {}
+        return value, {target['host']: target for target in targets}
+    except (WebError, TypeError, ValueError, KeyError):
+        return value, {}
+
+
+def _counts():
+    return dict.fromkeys(OUTCOMES, 0)
+
+
+def _metric(counts):
+    eligible = sum(counts[x] for x in ('successful', 'failed', 'unreachable'))
+    return {'counts': counts, 'samples': sum(counts.values()), 'eligible': eligible,
+            'success_percent': round(counts['successful'] * 100 / eligible, 1) if eligible else None}
+
+
+class Activity:
+    def __init__(self, settings):
+        self.store = Store(settings.database)
+
+    def report(self, user_id: int, filters: HistoryFilter, *, now: int | None = None) -> dict:
+        """Read one consistent DB snapshot. Output is paginated, aggregates are not.
+
+        Customer/time/mode/owner predicates run in SQL. Each job JSON is read once.
+        No persistent rollup means deleting a job immediately removes its samples.
+        Counters are target/run participations, never task count or group count.
+        """
+        f = filters.validate()
+        now = int(time.time()) if now is None else now
+        since = None if f.days == 'all' else now - int(f.days) * 86400
+        totals = _counts(); rows = []; matched = 0; job_count = 0; changed_runs = 0
+        by_book = {}; latest = {}; distinct = set(); customers = set(); books = set()
+        coverage_start = None; coverage_end = None
+        start, end = (f.page - 1) * 25, f.page * 25
+        with self.store.read() as db:
+            db.execute('BEGIN')
+            who = actor(db, user_id)
+            # Never inspect another viewer's rows even while collecting filter options.
+            clauses = ['(? = \'admin\' OR j.owner_id = ?)']
+            args = [who['role'], user_id]
+            if f.mode != 'all': clauses.append('j.mode = ?'); args.append(f.mode)
+            if since is not None:
+                clauses.append('COALESCE(j.finished_at,j.created_at) >= ?'); args.append(since)
+            clauses.append('COALESCE(j.finished_at,j.created_at) <= ?'); args.append(now)
+            # json_valid guards historical malformed JSON without turning it into a query error.
+            if f.customer:
+                clauses.append("CASE WHEN json_valid(j.plan) THEN json_extract(j.plan,'$.customer') END = ?")
+                args.append(f.customer)
+            if f.playbook:
+                clauses.append("CASE WHEN json_valid(j.plan) THEN json_extract(j.plan,'$.playbook') END = ?")
+                args.append(f.playbook)
+            sql = '''SELECT j.id,j.owner_id,u.username,j.plan,j.core_result,j.mode,j.status,
+                     j.created_at,j.finished_at,COALESCE(j.finished_at,j.created_at) AS recorded_at
+                     FROM jobs j JOIN users u ON u.id=j.owner_id WHERE ''' + ' AND '.join(clauses) + ' ORDER BY recorded_at DESC,j.id DESC'
+            for row in db.execute(sql, args):
+                plan = _dict(row['plan']); customer = plan.get('customer'); book = plan.get('playbook')
+                targets = plan.get('targets')
+                if not isinstance(customer, str) or not isinstance(book, str) or not isinstance(targets, list):
+                    continue
+                requested = list(dict.fromkeys(t for t in targets if isinstance(t, str)))
+                if f.host and f.host not in requested: continue
+                result, facts = _facts(row['core_result'], requested)
+                display = presentation_status(row['status'], result)
+                job_matched = False
+                for host in requested:
+                    if f.host and f.host != host: continue
+                    if f.q and f.q.casefold() not in host.casefold(): continue
+                    fact = facts.get(host)
+                    # The database lifecycle must be terminal before presenting terminal facts.
+                    outcome = ('outstanding' if row['status'] not in TERMINAL else
+                               fact['outcome'] if fact else 'unavailable')
+                    if f.outcome and f.outcome != outcome: continue
+                    counts = fact['counts'] if fact and outcome != 'outstanding' else None
+                    sample = dict(job_id=row['id'], username=row['username'], customer=customer, playbook=book,
+                                  host=host, mode=row['mode'], outcome=outcome, counts=counts,
+                                  job_status=row['status'], job_display_status=display,
+                                  created_at=row['created_at'], recorded_at=row['recorded_at'],
+                                  finished_at=row['finished_at'], host_url=host_url(customer, host))
+                    if start <= matched < end: rows.append(sample)
+                    matched += 1; job_matched = True; totals[outcome] += 1
+                    identity = (customer, host); distinct.add(identity); customers.add(customer); books.add(book)
+                    stat = by_book.setdefault(book, {'playbook': book, 'counts': _counts(), 'latest': sample, 'jobs': 0, 'last_job': None})
+                    stat['counts'][outcome] += 1
+                    if stat['last_job'] != row['id']: stat['jobs'] += 1; stat['last_job'] = row['id']
+                    latest.setdefault((customer, host, book), sample)
+                    if counts and counts['changed'] > 0: changed_runs += 1
+                    coverage_start = row['recorded_at'] if coverage_start is None else min(coverage_start, row['recorded_at'])
+                    coverage_end = row['recorded_at'] if coverage_end is None else max(coverage_end, row['recorded_at'])
+                if job_matched: job_count += 1
+            # Saved plans retain their stricter owner-only visibility, including for admins.
+            plans = []
+            if f.customer and f.host:
+                for row in db.execute('SELECT id,name,customer,playbook,payload,created_at FROM plans WHERE owner_id=? AND customer=? ORDER BY created_at DESC,id', (user_id, f.customer)):
+                    payload = _dict(row['payload'])
+                    if f.host in payload.get('targets', []):
+                        plans.append({k: row[k] for k in ('id', 'name', 'customer', 'playbook', 'created_at')})
+        book_stats = []
+        for val in by_book.values():
+            book_stats.append({'playbook': val['playbook'], 'jobs': val['jobs'], 'latest': val['latest'], **_metric(val['counts'])})
+        book_stats.sort(key=lambda v: v['playbook'].casefold())
+        # Bounded matrix cells; pages do not truncate the aggregated statistics.
+        host_keys = sorted(distinct, key=lambda v: (v[0].casefold(), v[1].casefold(), v))
+        matrix_hosts = host_keys[(f.page-1)*20:f.page*20]
+        columns = sorted(books, key=str.casefold)[:12]
+        matrix = [{'customer': c, 'host': h, 'url': host_url(c, h),
+                   'cells': [latest.get((c, h, b)) for b in columns]} for c, h in matrix_hosts]
+        return dict(source='retained_webgui_jobs', filters=f, **_metric(totals), records=rows,
+                    matched=matched, jobs=job_count, host_count=len(distinct), book_stats=book_stats,
+                    changed_participations=changed_runs, page=f.page, pages=max(1, (matched+24)//25),
+                    matrix=matrix, columns=columns, matrix_pages=max(1, (len(host_keys)+19)//20),
+                    omitted_columns=max(0,len(books)-len(columns)), customers=sorted(customers),
+                    playbooks=sorted(books), plans=plans, since=since, as_of=now,
+                    coverage_start=coverage_start, coverage_end=coverage_end)
diff --git a/roles/checkmk_scripts/files/Linux/local/unifi.cfg.example b/scripts/addons/webgui/src/aim_webgui/adapters/__init__.py
similarity index 100%
rename from roles/checkmk_scripts/files/Linux/local/unifi.cfg.example
rename to scripts/addons/webgui/src/aim_webgui/adapters/__init__.py
diff --git a/scripts/addons/webgui/src/aim_webgui/adapters/core_v1.py b/scripts/addons/webgui/src/aim_webgui/adapters/core_v1.py
new file mode 100644
index 0000000..83614bd
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/adapters/core_v1.py
@@ -0,0 +1,160 @@
+"""UI presentation adapter for the public AIM 3.3.0rc8 service/wire/event API only.
+
+Form conversion is syntax/type marshalling; AIM prepare owns all target and option
+validation. No private imports, file parsing, command building or key access.
+"""
+from __future__ import annotations
+import json
+import re
+from types import SimpleNamespace
+from aim_webgui.core.client import CoreClient
+from aim_webgui.errors import WebError
+from aim_webgui.core.reports import contract
+
+class CoreAdapter:
+ def __init__(self,settings,client=None):
+  self.settings=settings;self.client=client or CoreClient(settings);self._caps=None
+ @property
+ def capabilities(self):
+  if self._caps is None:
+   caps=self.client.request('capabilities')
+   if (not isinstance(caps,dict) or caps.get('core_version')!='3.3.0rc8' or caps.get('api_version')!='1.0'
+       or caps.get('event_version')!='1.0' or not {'list_customers','list_hosts','inventory_hierarchy','list_playbooks','prepare','readiness','execute','staging_check'}<=set(caps.get('operations',[]))):
+    raise WebError('core_incompatible','This release requires AIM 3.3.0rc8 with documented service/wire/event API 1.0.',503)
+   progress=caps.get('execution_progress',{})
+   if ('detail' not in progress.get('modes',[]) or progress.get('request_field')!='progress_mode'
+       or progress.get('detail_schema')!='play_task_host_v1'):
+    raise WebError('core_incompatible','This release requires AIM 3.3.0rc8 detailed progress (play_task_host_v1).',503)
+   hierarchy=caps.get('inventory_hierarchy',{})
+   outcomes=caps.get('target_outcomes',{})
+   staging=caps.get('controller_staging',{})
+   if hierarchy.get('schema')!='inventory_hierarchy_v1' or not hierarchy.get('nested_groups'):
+    raise WebError('core_incompatible','This release requires AIM inventory_hierarchy_v1 discovery.',503)
+   if outcomes.get('schema')!='target_outcome_summary_v1' or outcomes.get('source')!='native_final_host_stats':
+    raise WebError('core_incompatible','This release requires AIM target_outcome_summary_v1 final host accounting.',503)
+   if staging.get('profile')!='native_defaults_preflight_v2':
+    raise WebError('core_incompatible','This release requires AIM native_defaults_preflight_v2 controller staging.',503)
+   reports=caps.get('operation_results',{})
+   if (reports.get('protocol')!='aim_output_v1' or reports.get('result_protocol')!='aim_operation_result_v1'
+       or not {'per_host','global'}<=set(reports.get('scopes',[])) or reports.get('raw_output')is not False):
+    raise WebError('core_incompatible','This release requires the Core aim_operation_result_v1 contract.',503)
+   baselines=caps.get('collection_baselines',{})
+   if baselines.get('ansible.windows')!='>=3.8.0,<4.0.0':
+    raise WebError('core_incompatible','This release requires Core to advertise ansible.windows >=3.8.0,<4.0.0.',503)
+   self._caps=caps
+  return self._caps
+ @property
+ def version(self):return self.capabilities['core_version']
+ def customers(self):
+  self.capabilities
+  return [{'name':x,'host_count':None,'status':'Available via core'} for x in self.client.request('list_customers')]
+ def customer_path(self,customer):
+  # Historical UI caller name; this validates an ID, never returns an OS path.
+  if customer not in {x['name'] for x in self.customers()}:
+   raise WebError('customer_unavailable','Customer unavailable.',404)
+  return customer
+ def inventory_hierarchy(self,customer):
+  self.capabilities
+  result=self.client.request('inventory_hierarchy',customer=customer)
+  if not isinstance(result,dict) or result.get('schema')!='inventory_hierarchy_v1' or result.get('customer')!=customer:
+   raise WebError('core_protocol','AIM returned an invalid inventory hierarchy response.',502)
+  return result
+ def hierarchy_groups(self,customer):
+  hierarchy=self.inventory_hierarchy(customer); groups=[]
+  def walk(nodes):
+   for node in nodes:
+    children=walk(node.get('children',[]))
+    direct=set(node.get('hosts',[])); recursive=set(direct)
+    for child in children:recursive.update(child['hosts'])
+    item={'name':'/'.join(node['path']),'label':node['name'],'path':list(node['path']),
+          'direct_hosts':sorted(direct,key=str.casefold),'hosts':sorted(recursive,key=str.casefold),'children':children}
+    groups.append(item)
+   return [g for g in groups if len(g['path']) and g['path'][-1] in {n.get('name') for n in nodes}]
+  # Build recursively without relying on a competing parser; paths/hosts are Core facts.
+  groups=[]
+  def build(node):
+   kids=[build(child) for child in node.get('children',[])]
+   recursive=set(node.get('hosts',[]))
+   for child in kids:recursive.update(child['hosts'])
+   return {'name':'/'.join(node['path']),'label':node['name'],'path':list(node['path']),
+           'direct_hosts':list(node.get('hosts',[])),'hosts':sorted(recursive,key=str.casefold),'children':kids}
+  roots=[build(node) for node in hierarchy.get('groups',[])]
+  def flatten(nodes):
+   out=[]
+   for node in nodes:out.append(node);out.extend(flatten(node['children']))
+   return out
+  return {'direct_hosts':list(hierarchy.get('hosts',[])),'roots':roots,'groups':flatten(roots)}
+ def hosts(self,customer):
+  self.capabilities
+  items=[{'name':h['name'],'address':h.get('address'),'groups':list(h.get('platforms',[])),
+          'platforms':list(h.get('platforms',[]))} for h in self.client.request('list_hosts',customer=customer)]
+  by_name={h['name']:h for h in items}
+  hierarchy=self.hierarchy_groups(customer)
+  for group in hierarchy['groups']:
+   label=group['name']
+   for host in group['hosts']:
+    if host in by_name and label not in by_name[host]['groups']:by_name[host]['groups'].append(label)
+  for host in items:host['groups'].sort(key=str.casefold)
+  return items
+ def playbooks(self,customer=None):
+  self.capabilities
+  if customer is not None:
+   return [dict(x,available=True) for x in self.client.request('list_playbooks',customer=customer)]
+  # The contract exposes a customer-scoped catalog only. Union available entries;
+  # do not manufacture unavailable entries from old private catalog files.
+  result={}
+  for item in self.customers():
+   for pb in self.playbooks(item['name']):result.setdefault(pb['key'],pb)
+  return list(result.values())
+ def spec(self,key,customer=None):
+  for p in self.playbooks(customer):
+   if p['key']==key:
+    p=dict(p);p['inputs']=tuple(SimpleNamespace(**x) for x in p.get('inputs',[]))
+    return SimpleNamespace(**p)
+  raise WebError('unknown_playbook','Playbook is not available for the selected customer.',404)
+ def typed_options(self,spec,values):
+  fields={x.name:x for x in spec.inputs};result={}
+  if not isinstance(values,dict) or set(values)-set(fields):raise WebError('invalid_options','Use declared catalog options only.')
+  for name,value in values.items():
+   if not isinstance(value,str):raise WebError('invalid_options','Form inputs must be text.')
+   if value=='':continue
+   kind=fields[name].type
+   try:
+    if kind=='bool':
+     if value.lower() not in {'true','false'}:raise ValueError()
+     result[name]=value.lower()=='true'
+    elif kind=='int':result[name]=int(value)
+    elif kind=='serial':result[name]=int(value) if value.strip().isdigit() else value.strip()
+    elif kind in {'list','sequence'}:
+     # JSON is the explicit interoperable wire type, not arbitrary YAML tags.
+     result[name]=json.loads(value) if value.strip().startswith('[') else [x.strip() for x in value.split(',')]
+    elif kind=='secret_ref':
+     if re.fullmatch(r'[A-Za-z_][A-Za-z0-9_]*',value.strip()):result[name]='{{ '+value.strip()+' }}'
+     else:result[name]=value # core validates the canonical reference, never a password
+    else:result[name]=value
+   except (ValueError,TypeError):raise WebError('invalid_options','An input could not be converted to its declared type.') from None
+  return result
+ def preflight(self,customer,playbook,targets,overrides,*,text_inputs=False,check=True,key_mode='none'):
+  self.capabilities
+  spec=self.spec(playbook,customer)
+  if text_inputs:overrides=self.typed_options(spec,overrides)
+  request={'customer':customer,'playbook':playbook,'hosts':targets,'overrides':overrides,
+           'check':check,'key_mode':key_mode,'become_password':False,'timeout_seconds':self.settings.execution_timeout_seconds,
+           'progress_mode':'detail'}
+  prepared=self.client.request('prepare',request=request)
+  req=prepared['request']; requirements=prepared['credential_requirements']
+  return {'customer':req['customer'],'playbook':req['playbook'],'targets':req['hosts'],
+          'overrides':req['overrides'],'target_limit':','.join(req['hosts']),
+          'required_collections':list(spec.requirements),'requires_vault_prompt':'vault_password' in requirements,
+          'requires_connection_password':'connection_password' in requirements,
+          'core_version':self.version,'core_api':'1.0','core_request':req,'core_revision':prepared['revision'],
+          'result_contract':contract(prepared.get('result_contract')),
+          'inventory_revision':prepared['revision'],'credential_requirements':requirements,
+          'credential_requirement_reasons':prepared.get('credential_requirement_reasons',{}),
+          'warnings':prepared.get('warnings',[]),'revision_coverage':prepared.get('revision_coverage',''),
+          'authentication':{'mode':'inventory','key_mode':req['key_mode']}}
+ def readiness(self,plan):return self.client.request('readiness',request=plan['core_request'])
+ def reprepare(self,plan):
+  req=plan.get('core_request')
+  if not isinstance(req,dict):raise WebError('legacy_plan','This plan predates the core API. Reuse its targets in New run and review again.',409)
+  return self.preflight(req['customer'],req['playbook'],req['hosts'],req['overrides'],check=req['check'],key_mode=req['key_mode'])
diff --git a/scripts/addons/webgui/src/aim_webgui/app.py b/scripts/addons/webgui/src/aim_webgui/app.py
new file mode 100644
index 0000000..b3ddd2b
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/app.py
@@ -0,0 +1,406 @@
+from __future__ import annotations
+
+from dataclasses import asdict
+from pathlib import Path
+from urllib.parse import parse_qs, urlsplit, urlencode
+import json
+import logging
+from datetime import datetime, timezone
+
+from fastapi import FastAPI, Request
+from fastapi.exceptions import RequestValidationError
+from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
+from fastapi.staticfiles import StaticFiles
+from fastapi.templating import Jinja2Templates
+from starlette.concurrency import run_in_threadpool
+from starlette.middleware.trustedhost import TrustedHostMiddleware
+
+from aim_webgui import __version__, SCHEMA_VERSION
+from aim_webgui.adapters.core_v1 import CoreAdapter
+from aim_webgui.auth.service import Auth
+from aim_webgui.workflows import Workflows
+from aim_webgui.credentials.presentation import attention
+from aim_webgui.config import Settings
+from aim_webgui.errors import WebError
+from aim_webgui.security import RequestPolicy, same_origin
+
+ROOT = Path(__file__).parent
+TEMPLATES = Jinja2Templates(directory=str(ROOT / 'templates'))
+LOG = logging.getLogger('aim_webgui')
+from aim_webgui.activity import host_url, explorer_url
+from aim_webgui.read_views import install_read_views
+from aim_webgui.evidence_views import install_evidence_views
+from aim_webgui.reports import cell as report_cell, label as report_label
+TEMPLATES.env.globals.update(host_url=host_url, explorer_url=explorer_url)
+TEMPLATES.env.filters['report_cell']=report_cell
+TEMPLATES.env.filters['report_label']=report_label
+TEMPLATES.env.filters['utc'] = lambda value: datetime.fromtimestamp(value, timezone.utc).strftime('%Y-%m-%d %H:%M:%S UTC') if value is not None else '-'
+TEMPLATES.env.filters['utc_iso'] = lambda value: datetime.fromtimestamp(value, timezone.utc).isoformat().replace('+00:00', 'Z') if value is not None else ''
+
+
+def create_app(settings: Settings) -> RequestPolicy:
+    settings.validate()
+    auth = Auth(settings)
+    workflows = Workflows(settings)
+    auth.store.check()
+    # Login/local recovery remain available if the independent executor is offline.
+    # All core operations and execution still fail closed through CoreAdapter.
+    app = FastAPI(title='AIM WebGUI', version=__version__, docs_url=None, redoc_url=None, openapi_url=None)
+    app.state.auth, app.state.settings = auth, settings
+    app.add_middleware(TrustedHostMiddleware, allowed_hosts=list({urlsplit(settings.public_url).hostname,
+                                                                 '127.0.0.1', 'localhost', '[::1]'}))
+    app.mount('/static', StaticFiles(directory=ROOT / 'static', follow_symlink=False), name='static')
+
+    def render(request, template, *, status=200, **context):
+        session = getattr(request.state, 'session', None)
+        values = dict(request=request, session=session, version=__version__,
+                      csrf=session['csrf'] if session else '', title='Controller overview',
+                      nav='overview', error=None, execution_enabled=settings.execution_enabled, require_approval=settings.execution_require_approval)
+        values.update(context)
+        return TEMPLATES.TemplateResponse(request=request, name=template, context=values, status_code=status)
+
+    def error_response(request, exc: WebError):
+        if request.url.path.startswith('/api/'):
+            return JSONResponse({'error': {'code': exc.code, 'message': exc.message}}, status_code=exc.status)
+        template = 'partials/error.html' if request.headers.get('HX-Request') == 'true' else 'pages/error.html'
+        return render(request, template, status=exc.status, error=exc.message, title='Request could not be completed')
+
+    def redirect(request, path):
+        if request.headers.get('HX-Request') == 'true':
+            return HTMLResponse('', status_code=200, headers={'HX-Redirect': path})
+        return RedirectResponse(path, status_code=303)
+
+    def session_cookie(response, token):
+        response.set_cookie(settings.cookie_name, token, httponly=True, secure=settings.secure_cookie,
+                            samesite='lax', path='/', max_age=settings.session_hours * 3600)
+        return response
+
+    async def form(request: Request) -> dict[str, list[str]]:
+        if request.headers.get('content-type', '').split(';')[0] != 'application/x-www-form-urlencoded':
+            raise WebError('unsupported_content_type', 'Use URL-encoded form data.', 415)
+        try:
+            return parse_qs((await request.body()).decode('utf-8'), keep_blank_values=True, max_num_fields=1500)
+        except (ValueError, UnicodeError):
+            raise WebError('invalid_form', 'Invalid form data.') from None
+
+    def one(values, key, default=''):
+        items = values.get(key, [default])
+        if len(items) != 1:
+            raise WebError('duplicate_field', 'Duplicate form field.')
+        return items[0]
+
+    def administrator(request):
+        session = request.state.session
+        if session['role'] != 'admin':
+            raise WebError('admin_required', 'Administrator access is required.', 403)
+        return session['user_id']
+
+    async def adapter_call(method, *args, **kwargs):
+        def call():
+            return getattr(CoreAdapter(settings), method)(*args, **kwargs)
+        return await run_in_threadpool(call)
+
+    @app.exception_handler(WebError)
+    async def web_error(request, exc):
+        return error_response(request, exc)
+
+    @app.exception_handler(RequestValidationError)
+    async def validation_error(request, exc):
+        return error_response(request, WebError('invalid_request', 'Request parameters are invalid.', 422))
+
+    @app.middleware('http')
+    async def gate(request, call_next):
+        path = request.url.path
+        try:
+            exempt = path in {'/healthz', '/readyz'} or path.startswith('/static/')
+            session = None if exempt else await run_in_threadpool(auth.session, request.cookies.get(settings.cookie_name))
+            request.state.session = session
+            if not exempt and path != '/login':
+                if not session or not session['user_id']:
+                    if path.startswith('/api/'):
+                        raise WebError('login_required', 'Sign in to access the API.', 401)
+                    return redirect(request, '/login')
+                if session['must_change_password'] and path not in {'/password', '/logout', '/api/v2/session'}:
+                    if path.startswith('/api/'):
+                        raise WebError('password_change_required', 'Change the initial password before continuing.', 403)
+                    return redirect(request, '/password')
+            if request.method not in {'GET', 'HEAD', 'OPTIONS'}:
+                fetch_site = request.headers.get('sec-fetch-site', '').strip().lower()
+                if fetch_site == 'cross-site':
+                    raise WebError('origin_rejected', 'Cross-site request rejected.', 403)
+
+                # Origin is authoritative when the browser supplies it. Some browser/privacy
+                # combinations omit Origin for same-origin form POSTs, so accept a verified
+                # same-origin Referer as the fallback. If both are absent, only modern browser
+                # requests explicitly marked same-origin by Fetch Metadata may continue. CSRF
+                # token validation remains mandatory in all cases below.
+                origin = request.headers.get('origin', '').strip()
+                referer = request.headers.get('referer', '').strip()
+                if origin:
+                    if origin == 'null' or not same_origin(origin, settings.public_url):
+                        raise WebError('origin_rejected', 'Request Origin header does not match WebGUI public_url.', 403)
+                elif referer:
+                    if not same_origin(referer, settings.public_url):
+                        raise WebError('origin_rejected', 'Request Referer header does not match WebGUI public_url.', 403)
+                elif fetch_site != 'same-origin':
+                    raise WebError('origin_rejected', 'Request is missing same-origin browser metadata.', 403)
+
+                token = request.headers.get('X-CSRF-Token', '')
+                if not token and request.headers.get('content-type', '').startswith('application/x-www-form-urlencoded'):
+                    token = one(await form(request), '_csrf')
+                auth.csrf(session, token)
+            return await call_next(request)
+        except WebError as exc:
+            return error_response(request, exc)
+        except Exception as exc:
+            # Do not log exception text/tracebacks containing inventories or form values.
+            LOG.error('Request failed (%s); inspect configuration and permissions locally.', type(exc).__name__)
+            return error_response(request, WebError('internal_error', 'The request failed. Check the service logs and local configuration.', 500))
+
+    install_read_views(app, settings, render)
+    install_evidence_views(app, settings, auth, render)
+
+    @app.get('/healthz')
+    async def health():
+        return {'status': 'ok'}
+
+    @app.get('/readyz')
+    async def ready():
+        try:
+            await run_in_threadpool(auth.store.check)
+            await run_in_threadpool(lambda: CoreAdapter(settings).customers())
+            return {'status': 'ready'}
+        except Exception:
+            return JSONResponse({'status': 'not_ready'}, status_code=503)
+
+    @app.get('/login')
+    async def login_page(request: Request):
+        if request.state.session and request.state.session['user_id']:
+            return redirect(request, '/password' if request.state.session['must_change_password'] else '/')
+        peer = request.client.host if request.client else 'unknown'
+        if not request.state.session:
+            await run_in_threadpool(auth.throttle, [('login-page:' + peer, 120)], window=60)
+            token, session = await run_in_threadpool(auth.new_session)
+            request.state.session = session
+            return session_cookie(render(request, 'pages/login.html', title='Sign in'), token)
+        return render(request, 'pages/login.html', title='Sign in')
+
+    @app.post('/login')
+    async def login_submit(request: Request):
+        values = await form(request)
+        try:
+            token, session = await run_in_threadpool(auth.login, one(values, 'username'), one(values, 'password'),
+                                                    request.cookies.get(settings.cookie_name, ''),
+                                                    request.client.host if request.client else 'unknown')
+        except WebError as exc:
+            return render(request, 'pages/login.html', title='Sign in', error=exc.message, status=exc.status)
+        return session_cookie(redirect(request, '/password' if session['must_change_password'] else '/'), token)
+
+    @app.get('/password')
+    async def password_page(request: Request):
+        return render(request, 'pages/password.html', title='Change password', nav='account')
+
+    @app.post('/password')
+    async def password_submit(request: Request):
+        values = await form(request)
+        if one(values, 'password') != one(values, 'confirm'):
+            return render(request, 'pages/password.html', title='Change password', error='New passwords do not match.', status=400)
+        try:
+            await run_in_threadpool(auth.change_password, request.state.session['user_id'],
+                                    one(values, 'current_password'), one(values, 'password'))
+        except WebError as exc:
+            return render(request, 'pages/password.html', title='Change password', error=exc.message, status=exc.status)
+        response = redirect(request, '/login')  # All sessions revoked; authenticate using the new password.
+        response.delete_cookie(settings.cookie_name, path='/', secure=settings.secure_cookie, httponly=True, samesite='lax')
+        return response
+
+    @app.post('/logout')
+    async def logout(request: Request):
+        await run_in_threadpool(auth.logout, request.cookies.get(settings.cookie_name, ''))
+        response = redirect(request, '/login')
+        response.delete_cookie(settings.cookie_name, path='/', secure=settings.secure_cookie, httponly=True, samesite='lax')
+        return response
+
+    @app.get('/')
+    async def overview(request: Request):
+        customers = await adapter_call('customers')
+        playbooks = await adapter_call('playbooks')
+        return render(request, 'pages/overview.html', customers=customers, playbooks=playbooks,
+                      host_count=None, core=await run_in_threadpool(lambda: CoreAdapter(settings).capabilities),
+                      recent_jobs=(await run_in_threadpool(workflows.jobs,request.state.session['user_id']))[:5],
+                      attention=await run_in_threadpool(attention,workflows,request.state.session['user_id']))
+
+    @app.get('/customers')
+    async def customers_page(request: Request):
+        return render(request, 'pages/customers.html', title='Customers', nav='customers', customers=await adapter_call('customers'))
+
+    async def host_view(customer, q, group, sort, page):
+        all_hosts = await adapter_call('hosts', customer)
+        groups = sorted({g for h in all_hosts for g in h['groups']}, key=str.casefold)
+        q = q[:200]
+        filtered = [h for h in all_hosts if q.casefold() in (h['name'] + ' ' + (h['address'] or '') + ' ' + ' '.join(h['groups'])).casefold()
+                    and (not group or group in h['groups'])]
+        if sort not in {'name','address','group'}:
+            sort = 'name'
+        filtered.sort(key=lambda h: (' '.join(h['groups']) if sort == 'group' else (h[sort] or '')).casefold())
+        pages = max(1, (len(filtered)+99)//100)
+        page = max(1, min(page, pages))
+        def link(number):
+            return '/customers/' + customer + '/hosts?' + urlencode({'q':q,'group':group,'sort':sort,'page':number})
+        return dict(customer=customer, hosts=filtered[(page-1)*100:page*100], q=q, group=group, sort=sort,
+                    groups=groups, matched=len(filtered), total=len(all_hosts), page=page, pages=pages,
+                    previous_url=link(page-1) if page>1 else None, next_url=link(page+1) if page<pages else None)
+
+    @app.get('/customers/{customer}/hosts')
+    async def hosts_page(request: Request, customer: str, q: str = '', group: str = '', sort: str = 'name', page: int = 1):
+        return render(request, 'pages/hosts.html', title=customer, nav='customers',
+                      **await host_view(customer, q, group, sort, page))
+
+    @app.get('/_partials/hosts')
+    async def host_partial(request: Request, customer: str, q: str = '', group: str = '', sort: str = 'name', page: int = 1):
+        return render(request, 'partials/hosts.html', **await host_view(customer, q, group, sort, page))
+
+    @app.get('/playbooks')
+    async def playbooks_page(request: Request, customer: str | None = None):
+        return render(request, 'pages/playbooks.html', title='Playbook catalog', nav='playbooks',
+                      playbooks=await adapter_call('playbooks', customer), customer=customer)
+
+    @app.get('/plan')
+    async def plan(request: Request, customer: str = '', playbook: str = '', saved: str = ''):
+        preset = None
+        option_values = {}
+        if saved:
+            preset = (await run_in_threadpool(workflows.plan, request.state.session['user_id'], saved))['payload']
+            customer, playbook = preset['customer'], preset['playbook']
+            for key, value in preset['overrides'].items():
+                if isinstance(value, bool):
+                    option_values[key] = 'true' if value else 'false'
+                elif isinstance(value, (list, dict)):
+                    option_values[key] = json.dumps(value)
+                elif isinstance(value, str) and value.startswith('{{ ') and value.endswith(' }}'):
+                    option_values[key] = value[3:-3]
+                else:
+                    option_values[key] = str(value)
+        customers = await adapter_call('customers')
+        books = await adapter_call('playbooks', customer or None)
+        spec = next((b for b in books if b['key'] == playbook), None)
+        hosts = await adapter_call('hosts', customer) if customer else []
+        if spec:
+            hosts = [h for h in hosts if set(h['platforms']).intersection(spec['platforms'])]
+        group_counts = {}
+        for host in hosts:
+            for group in host['groups']:
+                group_counts[group] = group_counts.get(group, 0) + 1
+        groups = [{'name': name, 'count': group_counts[name], 'depth': name.count('/')}
+                  for name in sorted(group_counts, key=lambda value: ([part.casefold() for part in value.split('/')], value.count('/')))]
+        selected = (preset['targets'] if preset else
+                    await run_in_threadpool(workflows.selection, request.state.session['user_id'], customer, playbook)
+                    if customer and playbook else [])
+        return render(request, 'pages/plan.html', title='New run', nav='plan', customers=customers,
+                      playbooks=books, customer=customer, playbook=playbook, spec=spec, hosts=hosts, groups=groups,
+                      selected=selected, option_values=option_values, reused=bool(preset),
+                      run_mode='check' if not preset or preset.get('core_request',{}).get('check',True) else 'apply',
+                      key_mode=preset.get('core_request',{}).get('key_mode','none') if preset else 'none')
+
+    async def form_preflight(request):
+        values = await form(request)
+        permitted = {'_csrf', 'customer', 'playbook', 'targets', 'mode', 'key_mode'}
+        if any(not key.startswith('option.') and key not in permitted for key in values):
+            raise WebError('invalid_field', 'Unknown preflight field.')
+        options = {key[7:]: one(values, key) for key in values if key.startswith('option.')}
+        mode=one(values,'mode','check')
+        if mode not in {'check','apply'}:raise WebError('invalid_mode','Choose check or apply.')
+        result = await run_in_threadpool(workflows.review, request.state.session['user_id'],
+                                    one(values,'customer'),one(values,'playbook'),values.get('targets',[]),options,
+                                    text_inputs=True,check=mode=='check',key_mode=one(values,'key_mode','none'))
+        return result
+
+    @app.post('/preflight')
+    async def preflight_page(request: Request):
+        return render(request, 'pages/preflight.html', title='Selection review', nav='plan', result=await form_preflight(request))
+
+    @app.post('/_partials/preflight')
+    async def preflight_partial(request: Request):
+        return render(request, 'partials/preflight.html', result=await form_preflight(request))
+
+    @app.get('/users')
+    async def users_page(request: Request):
+        administrator(request)
+        users = await run_in_threadpool(auth.users)
+        grants = await run_in_threadpool(workflows.grants, request.state.session['user_id'])
+        customers = await adapter_call('customers')
+        playbooks = await adapter_call('playbooks')
+        selected_user_id = users[0]['id'] if users else None
+        selected_customer = customers[0]['name'] if customers else ''
+        granted = {g['playbook'] for g in grants
+                   if g['user_id'] == selected_user_id and g['customer'] == selected_customer}
+        available_playbooks = [p for p in playbooks if p['key'] not in granted]
+        return render(request, 'pages/users.html', title='User administration', nav='users', users=users, grants=grants,
+                      customers=customers, playbooks=playbooks, selected_user_id=selected_user_id,
+                      selected_customer=selected_customer, available_playbooks=available_playbooks)
+
+    @app.post('/users')
+    async def create_user(request: Request):
+        actor = administrator(request)
+        values = await form(request)
+        if one(values, 'password') != one(values, 'confirm'):
+            raise WebError('password_mismatch', 'Temporary passwords do not match.')
+        await run_in_threadpool(auth.create_user, one(values, 'username'), one(values, 'password'),
+                                one(values, 'role', 'viewer'), actor_id=actor)
+        return redirect(request, '/users')
+
+    @app.post('/users/{name}')
+    async def manage_user(request: Request, name: str):
+        actor = administrator(request)
+        values = await form(request)
+        action = one(values, 'action')
+        if action == 'reset-password' and one(values, 'password') != one(values, 'confirm'):
+            raise WebError('password_mismatch', 'Temporary passwords do not match.')
+        await run_in_threadpool(auth.manage_user, name, action, password=one(values, 'password') or None, actor_id=actor)
+        return redirect(request, '/users')
+
+    @app.get('/api/v2/session')
+    async def api_session(request: Request):
+        s = request.state.session
+        return {'username': s['username'], 'role': s['role'], 'csrf_token': s['csrf'],
+                'must_change_password': bool(s['must_change_password'])}
+
+    @app.get('/api/v2/capabilities')
+    async def capabilities():
+        return {'addon_version': __version__, 'aim_version': '3.3.0rc8', 'core_api': '1.0', 'database_schema': SCHEMA_VERSION,
+                'inventory_read': True, 'catalog_read': True, 'selection_preflight': True,
+                'inventory_write': False, 'execution': settings.execution_enabled, 'credential_collection': settings.credentials_enabled, 'credential_release': 'candidate', 'credential_ansible_core': '2.19.11',
+                'saved_plans': True, 'one_run_without_saving':True,'custom_credential_override':False,'structured_progress':True,'persistent_progress':True,'operation_reports':True,'report_protocol':'aim_operation_result_v1','approval_queue': True, 'one_shot_scheduling': True, 'raw_output': False}
+
+    @app.get('/api/v2/customers')
+    async def api_customers():
+        return {'items': await adapter_call('customers')}
+
+    @app.get('/api/v2/customers/{customer}/hosts')
+    async def api_hosts(customer: str):
+        return {'items': await adapter_call('hosts', customer)}
+
+    @app.get('/api/v2/playbooks')
+    async def api_books(customer: str | None = None):
+        return {'items': await adapter_call('playbooks', customer)}
+
+    @app.post('/api/v2/preflight')
+    async def api_preflight(request: Request):
+        if request.headers.get('content-type', '').split(';')[0] != 'application/json':
+            raise WebError('unsupported_content_type', 'Use application/json.', 415)
+        try:
+            payload = await request.json()
+        except (ValueError, UnicodeError):
+            raise WebError('invalid_json', 'Invalid JSON.') from None
+        if (not isinstance(payload, dict) or set(payload) - {'customer', 'playbook', 'targets', 'overrides', 'check', 'key_mode'}
+                or not all(isinstance(payload.get(k), str) for k in ('customer', 'playbook'))):
+            raise WebError('invalid_request', 'Expected customer, playbook, targets and optional overrides.')
+        result = await run_in_threadpool(workflows.review,request.state.session['user_id'],payload['customer'],payload['playbook'],
+                       payload.get('targets'),payload.get('overrides',{}),check=payload.get('check',True),key_mode=payload.get('key_mode','none'))
+        return result
+
+    from aim_webgui.routes.workflows import install as install_workflows
+    install_workflows(app, settings, auth, render, form, one, redirect, administrator)
+
+    # Wrap outside FastAPI's server-error middleware so security headers also cover errors.
+    return RequestPolicy(app, secure=settings.secure_cookie)
diff --git a/scripts/addons/webgui/src/aim_webgui/assets.py b/scripts/addons/webgui/src/aim_webgui/assets.py
new file mode 100644
index 0000000..0d84745
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/assets.py
@@ -0,0 +1,19 @@
+from pathlib import Path
+import base64
+import hashlib
+
+HASHES = {
+    'bootstrap.min.css': 'sRIl4kxILFvY47J16cr9ZwB07vP4J8+LH7qKQnuqkuIAvNWLzeN8tE5YBujZqJLB',
+    'htmx.min.js': 'H5SrcfygHmAuTDZphMHqBJLc3FhssKjG7w/CeCpFReSfwBWDTKpkzPP8c+cLsK+V',
+}
+
+
+def check_assets():
+    root = Path(__file__).parent / 'static/vendor'
+    for name, expected in HASHES.items():
+        path = root / name
+        if not path.is_file():
+            raise ValueError('Browser assets are missing. Run deploy/fetch_assets.py in the release, then reinstall the add-on.')
+        actual = base64.b64encode(hashlib.sha384(path.read_bytes()).digest()).decode('ascii')
+        if actual != expected:
+            raise ValueError(f'Browser asset integrity check failed: {name}. Reinstall the approved release.')
diff --git a/roles/checkmk_scripts/files/Windows/local/check-ping.ps1.example b/scripts/addons/webgui/src/aim_webgui/auth/__init__.py
similarity index 100%
rename from roles/checkmk_scripts/files/Windows/local/check-ping.ps1.example
rename to scripts/addons/webgui/src/aim_webgui/auth/__init__.py
diff --git a/scripts/addons/webgui/src/aim_webgui/auth/service.py b/scripts/addons/webgui/src/aim_webgui/auth/service.py
new file mode 100644
index 0000000..661d59e
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/auth/service.py
@@ -0,0 +1,277 @@
+from __future__ import annotations
+
+import fcntl
+import hashlib
+import hmac
+import json
+import os
+import re
+import secrets
+import stat
+import time
+from datetime import datetime, timezone
+
+from argon2 import PasswordHasher, Type
+from argon2.exceptions import VerificationError, InvalidHashError
+
+from aim_webgui.config import Settings
+from aim_webgui.db.store import Store, audit, ensure_private_dir, private_file
+from aim_webgui.errors import WebError
+
+HASHER = PasswordHasher(time_cost=3, memory_cost=65536, parallelism=1, type=Type.ID)
+DUMMY_HASH = HASHER.hash(secrets.token_urlsafe(32))
+USER_RE = re.compile(r'^[a-z][a-z0-9._-]{2,63}$')
+
+
+def username(value: str) -> str:
+    normalized = value.strip().lower()
+    if not USER_RE.fullmatch(normalized):
+        raise WebError('invalid_username', 'Use 3-64 lowercase letters, numbers, dots, underscores or hyphens; start with a letter.')
+    return normalized
+
+
+def password_policy(value: str) -> None:
+    if not isinstance(value, str) or not 15 <= len(value) <= 128 or '\x00' in value:
+        raise WebError('password_policy', 'Use a password or passphrase of 15-128 characters without NUL characters.')
+
+
+def verify(encoded: str, supplied: str) -> bool:
+    if not isinstance(supplied, str) or len(supplied) > 128:
+        return False
+    try:
+        return HASHER.verify(encoded, supplied)
+    except (VerificationError, InvalidHashError):
+        return False
+
+
+def digest(token: str) -> str:
+    return hashlib.sha256(token.encode('utf-8')).hexdigest()
+
+
+class Auth:
+    def __init__(self, settings: Settings):
+        self.settings = settings
+        self.store = Store(settings.database)
+
+    def bootstrap(self) -> bool:
+        """Explicit and restartable first initialization, never triggered by HTTP.
+
+        A pre-commit crash leaves the same protected credential file for retry.
+        A missing database after a completed install requires deliberate recovery.
+        """
+        ensure_private_dir(self.settings.state_dir)
+        lock_fd = os.open(self.settings.state_dir / '.init.lock',
+                          os.O_CREAT | os.O_RDWR | os.O_NOFOLLOW, 0o600)
+        try:
+            fcntl.flock(lock_fd, fcntl.LOCK_EX)
+            marker = self.settings.state_dir / '.initialized'
+            if marker.exists() and not self.settings.database.exists():
+                raise ValueError('An initialized database is missing. Restore a backup; admin was not recreated.')
+            self.store.migrate(create=True)
+            with self.store.transaction() as db:
+                if db.execute("SELECT 1 FROM metadata WHERE key='initialized'").fetchone():
+                    # Repair a marker missing after a post-commit crash, without resetting admin.
+                    if not marker.exists():
+                        private_file(marker, 'Initialized; restore database if it is missing.\n')
+                    # Upgrade/reinstall does NOT regenerate credentials, even if deleted.
+                    return False
+                if db.execute('SELECT COUNT(*) FROM users').fetchone()[0]:
+                    raise ValueError('Accounts exist in an uninitialized database; refusing automatic bootstrap.')
+                credentials = self.settings.credentials
+                if credentials.exists() or credentials.is_symlink():
+                    mode = credentials.lstat()
+                    if (not stat.S_ISREG(mode.st_mode) or mode.st_uid != os.geteuid()
+                            or stat.S_IMODE(mode.st_mode) & 0o077):
+                        raise ValueError('Bootstrap credential file must be a service-owned regular 0600 file.')
+                    record = json.loads(credentials.read_text(encoding='utf-8'))
+                    if record.get('username') != 'admin' or record.get('purpose') != 'aim-web-first-install':
+                        raise ValueError('Unrecognized existing bootstrap credential file.')
+                    secret = record['password']
+                    password_policy(secret)
+                else:
+                    secret = secrets.token_urlsafe(24)
+                    record = {'purpose': 'aim-web-first-install', 'username': 'admin', 'password': secret,
+                              'created_at': datetime.now(timezone.utc).isoformat(),
+                              'notice': 'Change at first login. This file is never served over HTTP.'}
+                    private_file(credentials, json.dumps(record, indent=2) + '\n')
+                now = int(time.time())
+                db.execute('INSERT INTO users(username,password_hash,role,created_at,updated_at) VALUES(?,?,?,?,?)',
+                           ('admin', HASHER.hash(secret), 'admin', now, now))
+                db.execute("INSERT INTO metadata(key,value) VALUES('initialized',?)", (str(now),))
+                audit(db, 'local-installer', 'bootstrap', 'admin')
+            if not marker.exists():
+                private_file(marker, 'Initialized; restore database if it is missing.\n')
+            return True
+        finally:
+            os.close(lock_fd)
+
+    def new_session(self, user_id: int | None = None) -> tuple[str, dict]:
+        token, csrf, now = secrets.token_urlsafe(32), secrets.token_urlsafe(32), int(time.time())
+        ttl = self.settings.session_hours * 3600 if user_id else 600
+        with self.store.transaction() as db:
+            db.execute('DELETE FROM sessions WHERE expires_at < ? OR last_seen_at < ?',
+                       (now, now - self.settings.idle_minutes * 60))
+            # Bound anonymous session accumulation (plus proxy-level request limits).
+            if db.execute('SELECT COUNT(*) FROM sessions').fetchone()[0] >= 10000:
+                raise WebError('session_capacity', 'Session capacity reached. Try later.', 503)
+            db.execute('INSERT INTO sessions VALUES(?,?,?,?,?,?)',
+                       (digest(token), user_id, csrf, now, now + ttl, now))
+        return token, self.session(token)
+
+    def session(self, token: str | None) -> dict | None:
+        if not token or len(token) > 100:
+            return None
+        now = int(time.time())
+        with self.store.transaction() as db:
+            row = db.execute('''SELECT s.*, u.username, u.role, u.enabled, u.must_change_password
+              FROM sessions s LEFT JOIN users u ON u.id=s.user_id WHERE s.token_hash=?''',
+                             (digest(token),)).fetchone()
+            if not row:
+                return None
+            idle = self.settings.idle_minutes * 60 if row['user_id'] else 600
+            if (row['expires_at'] <= now or row['last_seen_at'] + idle <= now
+                    or (row['user_id'] is not None and not row['enabled'])):
+                db.execute('DELETE FROM sessions WHERE token_hash=?', (digest(token),))
+                return None
+            if now - row['last_seen_at'] >= 60:
+                db.execute('UPDATE sessions SET last_seen_at=? WHERE token_hash=?', (now, digest(token)))
+            return dict(row)
+
+    @staticmethod
+    def csrf(session: dict | None, supplied: str) -> None:
+        if not session or not supplied or len(supplied) > 100 or not hmac.compare_digest(session['csrf'], supplied):
+            raise WebError('csrf_failed', 'Security token expired or missing. Reload the page and retry.', 403)
+
+    def throttle(self, bucket_values: list[tuple[str, int]], *, window: int = 300) -> None:
+        now = int(time.time())
+        with self.store.transaction() as db:
+            # A short-window bucket must never erase a longer-window login bucket.
+            db.execute('DELETE FROM rate_limits WHERE started < ?', (now - 3600,))
+            reservations = []
+            for value, limit in bucket_values:
+                bucket = digest(value)
+                row = db.execute('SELECT started,attempts FROM rate_limits WHERE bucket=?', (bucket,)).fetchone()
+                started, count = (row['started'], row['attempts']) if row and now - row['started'] < window else (now, 0)
+                if count >= limit:
+                    raise WebError('login_throttled', 'Too many authentication attempts. Try again in five minutes.', 429)
+                reservations.append((bucket, started, count + 1))
+            for reservation in reservations:
+                db.execute("""INSERT INTO rate_limits VALUES(?,?,?)
+                  ON CONFLICT(bucket) DO UPDATE SET started=excluded.started,attempts=excluded.attempts""", reservation)
+
+    def login(self, name: str, password: str, old_token: str, peer: str) -> tuple[str, dict]:
+        canonical = name.strip().lower()[:64]
+        self.throttle([('user:' + canonical, 10), ('peer:' + peer, 60), ('login-global', 200)])
+        with self.store.read() as db:
+            user = db.execute('SELECT * FROM users WHERE username=?', (canonical,)).fetchone()
+        encoded = user['password_hash'] if user else DUMMY_HASH
+        correct = verify(encoded, password)
+        if not user or not user['enabled'] or not correct:
+            with self.store.transaction() as db:
+                audit(db, canonical if USER_RE.fullmatch(canonical) else 'invalid-identifier', 'login-failed', 'authentication')
+            raise WebError('invalid_login', 'Invalid username or password.', 401)
+        rehash = HASHER.hash(password) if HASHER.check_needs_rehash(encoded) else encoded
+        with self.store.transaction() as db:
+            # Recheck after expensive hash, so disable/reset races cannot authenticate stale credentials.
+            current = db.execute('SELECT * FROM users WHERE id=?', (user['id'],)).fetchone()
+            if not current['enabled'] or current['password_hash'] != encoded:
+                raise WebError('invalid_login', 'Invalid username or password.', 401)
+            db.execute('UPDATE users SET password_hash=?,last_login_at=? WHERE id=?',
+                       (rehash, int(time.time()), user['id']))
+            db.execute('DELETE FROM sessions WHERE token_hash=?', (digest(old_token),))
+            audit(db, canonical, 'login', canonical)
+        return self.new_session(user['id'])
+
+    def logout(self, token: str) -> None:
+        with self.store.transaction() as db:
+            user = db.execute('SELECT users.username FROM sessions JOIN users ON users.id=sessions.user_id WHERE token_hash=?', (digest(token),)).fetchone()
+            db.execute('DELETE FROM sessions WHERE token_hash=?', (digest(token),))
+            if user:
+                audit(db, user['username'], 'logout', user['username'])
+
+    def change_password(self, user_id: int, old: str, new: str) -> None:
+        password_policy(new)
+        self.throttle([('change:' + str(user_id), 10)])
+        with self.store.read() as db:
+            user = db.execute('SELECT * FROM users WHERE id=?', (user_id,)).fetchone()
+        if not user or not user['enabled'] or not verify(user['password_hash'], old):
+            raise WebError('invalid_password', 'Current password was not accepted.', 403)
+        if verify(user['password_hash'], new):
+            raise WebError('password_unchanged', 'Choose a password different from the current password.')
+        encoded = HASHER.hash(new)
+        with self.store.transaction() as db:
+            current = db.execute('SELECT * FROM users WHERE id=?', (user_id,)).fetchone()
+            if not current['enabled'] or current['password_hash'] != user['password_hash']:
+                raise WebError('account_changed', 'Account changed; sign in again.', 409)
+            db.execute('UPDATE users SET password_hash=?,must_change_password=0,updated_at=? WHERE id=?',
+                       (encoded, int(time.time()), user_id))
+            db.execute('DELETE FROM sessions WHERE user_id=?', (user_id,))
+            audit(db, user['username'], 'password-changed', user['username'])
+        if user['username'] == 'admin':
+            self.consume_bootstrap()
+
+    def consume_bootstrap(self) -> None:
+        # Password is already invalidated. Never rename a file still containing it.
+        self.settings.credentials.unlink(missing_ok=True)
+        used = self.settings.state_dir / '.credentials.used'
+        if not used.exists():
+            private_file(used, 'Bootstrap credentials invalidated at ' + datetime.now(timezone.utc).isoformat() + '\n')
+
+    def users(self) -> list[dict]:
+        with self.store.read() as db:
+            return [dict(r) for r in db.execute('''SELECT id,username,role,enabled,must_change_password,
+              created_at,last_login_at FROM users ORDER BY username''')]
+
+    @staticmethod
+    def require_admin(db, actor_id: int | None) -> str:
+        if actor_id is None:  # Local CLI: enforced by private state ownership, never exposed as an HTTP argument.
+            return 'local-console'
+        actor = db.execute('SELECT * FROM users WHERE id=?', (actor_id,)).fetchone()
+        if not actor or not actor['enabled'] or actor['role'] != 'admin' or actor['must_change_password']:
+            raise WebError('admin_required', 'Administrator access is required.', 403)
+        return actor['username']
+
+    def create_user(self, name: str, password: str, role: str = 'viewer', *, actor_id: int | None = None) -> None:
+        name = username(name)
+        password_policy(password)
+        if role not in {'admin', 'viewer'}:
+            raise WebError('invalid_role', 'Unknown role.')
+        encoded, now = HASHER.hash(password), int(time.time())
+        with self.store.transaction() as db:
+            actor = self.require_admin(db, actor_id)
+            if db.execute('SELECT 1 FROM users WHERE username=?', (name,)).fetchone():
+                raise WebError('user_exists', 'That username already exists.', 409)
+            db.execute('INSERT INTO users(username,password_hash,role,created_at,updated_at) VALUES(?,?,?,?,?)',
+                       (name, encoded, role, now, now))
+            audit(db, actor, 'user-created', name)
+
+    def manage_user(self, name: str, action: str, *, password: str | None = None,
+                    actor_id: int | None = None) -> None:
+        name = username(name)
+        allowed = {'enable', 'disable', 'promote', 'demote', 'revoke', 'reset-password'}
+        if action not in allowed:
+            raise WebError('invalid_action', 'Unknown user action.')
+        encoded = None
+        if action == 'reset-password':
+            password_policy(password)
+            encoded = HASHER.hash(password)
+        with self.store.transaction() as db:
+            actor = self.require_admin(db, actor_id)
+            user = db.execute('SELECT * FROM users WHERE username=?', (name,)).fetchone()
+            if not user:
+                raise WebError('user_not_found', 'Account not found.', 404)
+            if action in {'disable', 'demote'} and user['enabled'] and user['role'] == 'admin':
+                count = db.execute("SELECT COUNT(*) FROM users WHERE enabled=1 AND role='admin'").fetchone()[0]
+                if count <= 1:
+                    raise WebError('last_admin', 'The last enabled administrator cannot be disabled or demoted.', 409)
+            if action in {'enable', 'disable'}:
+                db.execute('UPDATE users SET enabled=? WHERE id=?', (int(action == 'enable'), user['id']))
+            elif action in {'promote', 'demote'}:
+                db.execute('UPDATE users SET role=? WHERE id=?', ('admin' if action == 'promote' else 'viewer', user['id']))
+            elif action == 'reset-password':
+                db.execute('UPDATE users SET password_hash=?,must_change_password=1 WHERE id=?', (encoded, user['id']))
+            db.execute('UPDATE users SET updated_at=? WHERE id=?', (int(time.time()), user['id']))
+            db.execute('DELETE FROM sessions WHERE user_id=?', (user['id'],))
+            audit(db, actor, 'user-' + action, name)
+        if name == 'admin' and action == 'reset-password':
+            self.consume_bootstrap()
diff --git a/scripts/addons/webgui/src/aim_webgui/cli.py b/scripts/addons/webgui/src/aim_webgui/cli.py
new file mode 100644
index 0000000..c2072f4
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/cli.py
@@ -0,0 +1,199 @@
+from __future__ import annotations
+
+import argparse
+import getpass
+import logging
+import json
+import subprocess
+import os
+import pwd
+import stat
+import tempfile
+from pathlib import Path
+import sys
+
+from aim_webgui import __version__
+from aim_webgui.config import DEFAULT_CONFIG, Settings
+
+
+def read_password() -> str:
+    from aim_webgui.auth.service import password_policy
+    if not sys.stdin.isatty():
+        raise ValueError('Use an interactive terminal. Passwords are not accepted as command-line arguments.')
+    first = getpass.getpass('New password: ')
+    if first != getpass.getpass('Confirm password: '):
+        raise ValueError('Passwords do not match.')
+    password_policy(first)
+    return first
+
+
+def main() -> None:
+    os.umask(0o077)
+    sys.dont_write_bytecode = True
+    parser = argparse.ArgumentParser(prog='aim-web', description='Independent WebGUI add-on; never updates AIM.')
+    parser.add_argument('--version', action='version', version=f'AIM WebGUI {__version__} (AIM compatibility: 3.3.0rc8 / service API 1.0)')
+    parser.add_argument('--config', type=Path, default=DEFAULT_CONFIG)
+    commands = parser.add_subparsers(dest='command', required=True)
+    commands.add_parser('serve', help='Serve on the configured interface; reverse-proxy settings are explicit.')
+    commands.add_parser('credential-check', help='Check core contract/credential fields; no passwords or remote contacts.')
+    commands.add_parser('executor', help='Pre-started local executor; run only as the configured execution identity.')
+    core_check=commands.add_parser('core-check', help='Core discovery, and optional prepared-run readiness, under the executor identity.')
+    core_check.add_argument('--customer')
+    core_check.add_argument('--playbook',default='debug_test_connection')
+    core_check.add_argument('--host',action='append',dest='hosts')
+    core_check.add_argument('--key-mode',choices=['none','customer'],default='none')
+    commands.add_parser('core-staging-check', help='Run Core 3.2 controller staging preflight under the executor identity.')
+    commands.add_parser('config-check', help='Validate TOML only; safe as root, no database access.')
+    status = commands.add_parser('status', help='Read systemd state and configured listener without opening SQLite.')
+    status.add_argument('--json', action='store_true')
+    doctor = commands.add_parser('doctor', help='Read-only diagnostics; run under the aim-web service identity.')
+    doctor.add_argument('--json', action='store_true')
+    worker = commands.add_parser('worker', help='Run the opt-in single-job worker, separate from HTTP.')
+    worker.add_argument('--once', action='store_true')
+    commands.add_parser('init', help='Explicit idempotent first initialization; never reset existing admin.')
+    check = commands.add_parser('check', help='Check core integration and optional database readiness.')
+    check.add_argument('--without-db', action='store_true')
+    check.add_argument('--without-core', action='store_true',help='Package/assets/state check only; deployment staging use.')
+    db = commands.add_parser('db').add_subparsers(dest='db_command', required=True)
+    db.add_parser('migrate', help='Apply forward migrations; stop service and back up first.')
+    backup = db.add_parser('backup', help='Use SQLite backup API, not a raw live copy.')
+    backup.add_argument('destination', type=Path)
+    users = commands.add_parser('user').add_subparsers(dest='user_command', required=True)
+    users.add_parser('list')
+    create = users.add_parser('create')
+    create.add_argument('username')
+    create.add_argument('--role', choices=['viewer', 'admin'], default='viewer')
+    for action in ('enable', 'disable', 'promote', 'demote', 'revoke', 'reset-password'):
+        users.add_parser(action).add_argument('username')
+    args = parser.parse_args()
+    logging.basicConfig(level=logging.INFO, format='%(levelname)s %(name)s: %(message)s')
+    try:
+        settings = Settings.load(args.config)
+        if args.command == 'executor':
+            from aim_webgui.core.executor import Executor
+            Executor(settings).run()
+            return
+        if args.command == 'core-staging-check':
+            # Core validates its controller-local staging path. Ansible's local
+            # connection plugin independently expands ~<executor>/.ansible/tmp
+            # for delegated localhost tasks, so validate that path from inside
+            # the same systemd sandbox before accepting executor readiness.
+            account = pwd.getpwuid(os.geteuid())
+            local_base = Path(account.pw_dir) / '.ansible'
+            local_tmp = local_base / 'tmp'
+            for path in (local_base, local_tmp):
+                st = path.lstat()
+                if stat.S_ISLNK(st.st_mode) or not stat.S_ISDIR(st.st_mode):
+                    raise ValueError(f'Executor delegated-local staging path is unsafe: {path}')
+                if st.st_uid != account.pw_uid or st.st_gid != account.pw_gid or stat.S_IMODE(st.st_mode) != 0o700:
+                    raise ValueError(f'Executor delegated-local staging ownership/mode is unsafe: {path}')
+            fd, probe = tempfile.mkstemp(prefix='.aim-web-probe-', dir=local_tmp)
+            os.close(fd)
+            Path(probe).unlink()
+            from dataclasses import replace
+            from aim_webgui.core.client import CoreClient
+            result = CoreClient(replace(settings, core_transport='stdio')).request('staging_check')
+            result['delegated_local_tmp'] = {'path': str(local_tmp), 'writable': True, 'private': True}
+            print(json.dumps(result, indent=2))
+            return
+        if args.command in {'credential-check','core-check'}:
+            from aim_webgui.adapters.core_v1 import CoreAdapter
+            adapter=CoreAdapter(settings)
+            result={'core':adapter.capabilities,'customers':adapter.customers()}
+            if args.command=='core-check' and (args.customer or args.hosts):
+                if not args.customer or not args.hosts:raise ValueError('Provide both --customer and at least one --host.')
+                plan=adapter.preflight(args.customer,args.playbook,args.hosts,{},check=True,key_mode=args.key_mode)
+                result['readiness']=adapter.readiness(plan)
+            print(json.dumps(result,indent=2))
+            print('No passwords read or hosts contacted. Readiness is local, not a live execution qualification.')
+            return
+        if args.command == 'config-check':
+            print(f'Configuration valid: {args.config}; public origin: {settings.public_url}; execution={settings.execution_enabled}')
+            return
+        if args.command == 'status':
+            result = {'version': __version__, 'config': str(args.config),
+                      'listener': f'{settings.host}:{settings.port}', 'public_url': settings.public_url,
+                      'execution_enabled': settings.execution_enabled}
+            for unit in ('aim-web.service', 'aim-web-worker.service','aim-web-executor.service'):
+                try:
+                    proc = subprocess.run(['systemctl', 'show', unit, '-p', 'ActiveState', '-p', 'SubState', '-p', 'MainPID'],
+                                          capture_output=True, text=True, timeout=5, check=False)
+                    result[unit] = dict(line.split('=', 1) for line in proc.stdout.splitlines() if '=' in line)
+                except (OSError, subprocess.TimeoutExpired):
+                    result[unit] = {'status': 'systemd unavailable'}
+            print(json.dumps(result, indent=2) if args.json else '\n'.join(f'{k}: {v}' for k,v in result.items()))
+            return
+        if args.command == 'doctor':
+            from aim_webgui.diagnostics import report
+            result = report(settings, args.config)
+            if args.json:
+                print(json.dumps(result, indent=2))
+            else:
+                print(f'AIM WebGUI {__version__}; {settings.public_url}')
+                for check in result['checks']:
+                    print(f"{'PASS' if check['ok'] else 'CHECK'} {check['name']}: {check['detail']}")
+                print(result['transport_note'])
+                if os.geteuid() == 0:
+                    print('Run doctor as the service identity: sudo -u aim-web aim-web doctor')
+            if not result['ok']:
+                raise SystemExit(1)
+            return
+        if args.command == 'worker':
+            from aim_webgui.worker import Worker
+            Worker(settings, args.config).run(once=args.once)
+            return
+        from aim_webgui.auth.service import Auth
+        auth = Auth(settings)
+        if args.command == 'init':
+            created = auth.bootstrap()
+            print('Initialized administrator: admin' if created else 'Already initialized; users and passwords unchanged.')
+            if created:
+                print(f'Bootstrap credentials (local file only): {settings.credentials.as_uri()}')
+                print('A password change is required at first login. The password is not printed here.')
+        elif args.command == 'check':
+            from aim_webgui.adapters.core_v1 import CoreAdapter
+            adapter = None if args.without_core else CoreAdapter(settings)
+            from aim_webgui.assets import check_assets
+            check_assets()
+            if not args.without_db:
+                auth.store.check()
+            print(f'AIM WebGUI {__version__}: ' + ('package/state checked; core not contacted' if args.without_core else f'AIM {adapter.version} / service v1 compatible; core unchanged.'))
+        elif args.command == 'db':
+            if args.db_command == 'migrate':
+                auth.store.migrate()
+                print('Database schema is current. Accounts preserved.')
+            else:
+                auth.store.backup(args.destination.resolve())
+                print(f'Database backed up: {args.destination}')
+        elif args.command == 'user':
+            # Local database owner can repair an out-of-band disabled admin; HTTP still fails closed.
+            auth.store.check(require_admin=False)
+            if args.user_command == 'list':
+                for user in auth.users():
+                    print(f"{user['username']}\t{user['role']}\tenabled={bool(user['enabled'])}\tchange_password={bool(user['must_change_password'])}")
+            elif args.user_command == 'create':
+                auth.create_user(args.username, read_password(), args.role)
+                print('Account created; password change required at first login.')
+            else:
+                new = read_password() if args.user_command == 'reset-password' else None
+                auth.manage_user(args.username, args.user_command, password=new)
+                print('Account updated; active sessions revoked.')
+        else:
+            from aim_webgui.app import create_app
+            import uvicorn
+            from aim_webgui.assets import check_assets
+            check_assets()
+            app = create_app(settings)
+            print(f'AIM WebGUI {__version__}; public origin: {settings.public_url}')
+            uvicorn.run(app, host=settings.host, port=settings.port, workers=1,
+                        proxy_headers=settings.proxy_headers,
+                        forwarded_allow_ips=settings.forwarded_allow_ips_value,
+                        server_header=False, access_log=False,
+                        timeout_keep_alive=5, limit_concurrency=32, ws='none')
+    except KeyboardInterrupt:
+        raise SystemExit(130) from None
+    except Exception as exc:
+        from aim_webgui.errors import WebError
+        message = exc.message if isinstance(exc, WebError) else (str(exc) if isinstance(exc, ValueError) else type(exc).__name__)
+        print(f'AIM WebGUI: {message}', file=sys.stderr)
+        raise SystemExit(1) from None
diff --git a/scripts/addons/webgui/src/aim_webgui/config.py b/scripts/addons/webgui/src/aim_webgui/config.py
new file mode 100644
index 0000000..d28f091
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/config.py
@@ -0,0 +1,221 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path
+import ipaddress
+import tomllib
+from urllib.parse import urlsplit
+
+DEFAULT_CONFIG = Path('/etc/ansible/scripts/config/webgui.toml')
+
+
+@dataclass(frozen=True)
+class Settings:
+    aim_scripts: Path = Path('/etc/ansible/scripts')
+    state_dir: Path = Path('/var/lib/aim/webgui')
+    host: str = '127.0.0.1'
+    port: int = 8080
+    public_url: str = 'http://127.0.0.1:8080'
+    proxy_headers: bool = False
+    forwarded_allow_ips: tuple[str, ...] = ()
+    session_hours: int = 8
+    idle_minutes: int = 30
+    credentials_enabled: bool = False
+    execution_enabled: bool = False
+    core_transport: str = 'unix'
+    core_command: tuple[str, ...] = ('/usr/local/bin/aimctl',)
+    core_config: Path = Path('/etc/ansible/scripts/aim.yml')
+    core_socket: Path = Path('/run/aim-web-executor/core.sock')
+    core_executor_user: str = 'svc_bf-ansible'
+    core_client_user: str = 'aim-web'
+    core_home: Path | None = None
+    execution_playbooks: tuple[str, ...] = ()
+    execution_max_hosts: int = 25
+    execution_timeout_seconds: int = 900
+    execution_require_approval: bool = True
+    execution_transport_verified: bool = False
+    execution_window_start_hour: int = 0
+    execution_window_end_hour: int = 24
+
+    journal_max_events: int = 20_000
+    journal_max_bytes: int = 8 * 1024 * 1024
+    reports_max_bytes: int = 16 * 1024 * 1024
+    reports_retain_configuration: bool = False
+
+    @property
+    def database(self) -> Path:
+        return self.state_dir / 'webgui.sqlite3'
+
+    @property
+    def credentials(self) -> Path:
+        return self.state_dir / '.credentials'
+
+    @property
+    def secure_cookie(self) -> bool:
+        return urlsplit(self.public_url).scheme == 'https'
+
+    @property
+    def cookie_name(self) -> str:
+        return '__Host-aim_web' if self.secure_cookie else 'aim_web_local'
+
+    @property
+    def forwarded_allow_ips_value(self) -> str:
+        return ','.join(self.forwarded_allow_ips)
+
+    def validate(self) -> 'Settings':
+        if not self.aim_scripts.is_absolute() or not self.state_dir.is_absolute():
+            raise ValueError('aim_scripts and state_dir must be absolute paths.')
+        if self.state_dir.resolve().is_relative_to(self.aim_scripts.resolve()):
+            raise ValueError('Mutable state must be outside the AIM source directory.')
+        if not isinstance(self.host, str) or not self.host.strip():
+            raise ValueError('host must be a non-empty listen address.')
+        if type(self.port) is not int or not 1024 <= self.port <= 65535:
+            raise ValueError('port must be an unprivileged TCP port (1024..65535).')
+        p = urlsplit(self.public_url)
+        if (p.scheme not in {'http', 'https'} or not p.hostname or p.username or p.password
+                or p.path or p.query or p.fragment):
+            raise ValueError('public_url must be an HTTP(S) origin without a trailing slash or path.')
+        _ = p.port
+        if p.scheme == 'http':
+            try:
+                local = ipaddress.ip_address(p.hostname).is_loopback
+            except ValueError:
+                local = p.hostname == 'localhost'
+            if not local:
+                raise ValueError('Non-local public_url requires HTTPS.')
+        try:
+            bind_loopback = ipaddress.ip_address(self.host).is_loopback
+        except ValueError:
+            bind_loopback = self.host == 'localhost'
+        if not bind_loopback:
+            if p.scheme != 'https':
+                raise ValueError('A non-loopback listener requires an HTTPS public_url behind a reverse proxy.')
+            if not self.proxy_headers:
+                raise ValueError('A non-loopback listener requires proxy_headers=true.')
+            if not self.forwarded_allow_ips:
+                raise ValueError('A non-loopback listener requires at least one trusted proxy IP.')
+        if type(self.proxy_headers) is not bool:
+            raise ValueError('proxy_headers must be true or false.')
+        if not isinstance(self.forwarded_allow_ips, tuple):
+            raise ValueError('forwarded_allow_ips must be a list of IP addresses or CIDR networks.')
+        for value in self.forwarded_allow_ips:
+            if value == '*':
+                continue
+            try:
+                ipaddress.ip_network(value, strict=False)
+            except ValueError:
+                raise ValueError(f'Invalid trusted proxy IP/network: {value}') from None
+        if not self.proxy_headers and self.forwarded_allow_ips:
+            raise ValueError('forwarded_allow_ips requires proxy_headers=true.')
+        if not (type(self.session_hours) is int and 1 <= self.session_hours <= 24):
+            raise ValueError('session_hours must be 1..24.')
+        if not (type(self.idle_minutes) is int and 1 <= self.idle_minutes <= 60):
+            raise ValueError('idle_minutes must be 1..60.')
+        if any(type(getattr(self, name)) is not bool for name in
+               ('execution_enabled', 'execution_require_approval', 'execution_transport_verified')):
+            raise ValueError('Execution switches must be TOML booleans.')
+        if not isinstance(self.execution_playbooks, tuple) or any(
+                not isinstance(x, str) or not x or not all(c.isalnum() or c in '_-' for c in x)
+                for x in self.execution_playbooks):
+            raise ValueError('execution_playbooks must contain explicit catalog keys.')
+        if self.core_transport not in {'stdio', 'unix'}:
+            raise ValueError('core.transport must be stdio or unix.')
+        if (not isinstance(self.core_command, tuple) or not self.core_command
+                or not all(isinstance(x, str) and x and not any(ord(c)<32 for c in x) for x in self.core_command)
+                or not Path(self.core_command[0]).is_absolute()):
+            raise ValueError('core.command must be an explicit command array with an absolute executable.')
+        if not self.core_config.is_absolute() or not self.core_socket.is_absolute() or len(str(self.core_socket).encode())>100:
+            raise ValueError('Use absolute core config/socket paths; socket path must be at most 100 bytes.')
+        if self.core_home is not None and (not self.core_home.is_absolute() or self.core_home.resolve().is_relative_to(self.state_dir.resolve())):
+            raise ValueError('core.home must be an absolute separate executor home, never WebGUI private state.')
+        for name in (self.core_executor_user,self.core_client_user):
+            if not name or not all(c.isalnum() or c in '_-' for c in name):
+                raise ValueError('Use explicit local executor and client account names.')
+        if type(self.execution_max_hosts) is not int or not 1 <= self.execution_max_hosts <= 500:
+            raise ValueError('execution_max_hosts must be 1..500.')
+        if type(self.execution_timeout_seconds) is not int or not 30 <= self.execution_timeout_seconds <= 7200:
+            raise ValueError('execution_timeout_seconds must be 30..7200.')
+        if (type(self.execution_window_start_hour) is not int or type(self.execution_window_end_hour) is not int
+                or not 0 <= self.execution_window_start_hour < self.execution_window_end_hour <= 24):
+            raise ValueError('Execution start window must satisfy 0 <= start_hour < end_hour <= 24 (UTC).')
+        if self.execution_enabled and (not self.execution_playbooks or not self.secure_cookie
+                                       or not self.execution_transport_verified):
+            raise ValueError('Execution requires HTTPS, an explicit playbook allowlist, and transport_verified=true after operator verification of backend TLS.')
+        if type(self.credentials_enabled) is not bool:
+            raise ValueError('credentials_enabled must be a TOML boolean.')
+        if self.credentials_enabled and (not self.execution_enabled or not self.execution_transport_verified or not self.secure_cookie):
+            raise ValueError('Credential execution requires enabled execution and verified HTTPS transport.')
+        if self.execution_enabled and '*' in self.forwarded_allow_ips:
+            raise ValueError('Execution does not accept wildcard proxy trust.')
+        if type(self.journal_max_events) is not int or not 100 <= self.journal_max_events <= 200_000:
+            raise ValueError('journal.max_events must be 100..200000.')
+        if type(self.journal_max_bytes) is not int or not 65_536 <= self.journal_max_bytes <= 64 * 1024 * 1024:
+            raise ValueError('journal.max_bytes must be 65536..67108864.')
+        if type(self.reports_max_bytes) is not int or not 65_536 <= self.reports_max_bytes <= 16 * 1024 * 1024:
+            raise ValueError('reports.max_bytes must be 65536..16777216.')
+        if type(self.reports_retain_configuration) is not bool:
+            raise ValueError('reports.retain_configuration must be a TOML boolean.')
+        return self
+
+    @classmethod
+    def load(cls, path: Path = DEFAULT_CONFIG) -> 'Settings':
+        if not path.is_file():
+            raise ValueError(f'Configuration missing: {path}. Run deployment first.')
+        with path.open('rb') as stream:
+            raw = tomllib.load(stream)
+
+        # 0.1.0 used a flat TOML document. 0.1.1+ accepts it unchanged while
+        # introducing named sections for future add-on growth.
+        section_names = {'server', 'proxy', 'session', 'aim', 'state', 'execution', 'credentials', 'core', 'journal', 'reports'}
+        if section_names.intersection(raw):
+            unknown_sections = set(raw) - section_names
+            if unknown_sections:
+                raise ValueError('Unknown WebGUI configuration sections: ' + ', '.join(sorted(unknown_sections)))
+            data = {}
+            mapping = {
+                'journal': {'max_events','max_bytes'},
+                'reports': {'max_bytes','retain_configuration'},
+                'credentials': {'enabled'},
+                'core': {'transport','command','config','socket','executor_user','client_user','home'},
+                'server': {'host', 'port', 'public_url'},
+                'proxy': {'proxy_headers', 'forwarded_allow_ips'},
+                'session': {'session_hours', 'idle_minutes'},
+                'aim': {'scripts_path'},
+                'state': {'state_dir'},
+                'execution': {'enabled', 'playbooks', 'max_hosts', 'timeout_seconds',
+                              'require_approval', 'transport_verified', 'window_start_hour', 'window_end_hour'},
+            }
+            for section, allowed in mapping.items():
+                values = raw.get(section, {})
+                if not isinstance(values, dict):
+                    raise ValueError(f'[{section}] must be a TOML table.')
+                unknown = set(values) - allowed
+                if unknown:
+                    raise ValueError(f'Unknown keys in [{section}]: ' + ', '.join(sorted(unknown)))
+                for key, value in values.items():
+                    data[section + '_' + key if section in {'execution', 'credentials', 'core', 'journal', 'reports'} else ('aim_scripts' if key == 'scripts_path' else key)] = value
+        else:
+            data = dict(raw)
+            unknown = set(data) - cls.__dataclass_fields__.keys()
+            if unknown:
+                raise ValueError('Unknown WebGUI configuration keys: ' + ', '.join(sorted(unknown)))
+
+        for name in ('aim_scripts', 'state_dir', 'core_config', 'core_socket', 'core_home'):
+            if name in data:
+                if not isinstance(data[name], str):
+                    raise ValueError(f'{name} must be a string path.')
+                data[name] = Path(data[name])
+        if 'forwarded_allow_ips' in data:
+            values = data['forwarded_allow_ips']
+            if not isinstance(values, list) or not all(isinstance(v, str) for v in values):
+                raise ValueError('forwarded_allow_ips must be an array of strings.')
+            data['forwarded_allow_ips'] = tuple(values)
+        if 'core_command' in data:
+            if not isinstance(data['core_command'], list):
+                raise ValueError('core.command must be a TOML array.')
+            data['core_command'] = tuple(data['core_command'])
+        if 'execution_playbooks' in data:
+            if not isinstance(data['execution_playbooks'], list):
+                raise ValueError('Execution playbooks must be an array.')
+            data['execution_playbooks'] = tuple(data['execution_playbooks'])
+        return cls(**data).validate()
diff --git a/scripts/addons/webgui/src/aim_webgui/console.py b/scripts/addons/webgui/src/aim_webgui/console.py
new file mode 100644
index 0000000..fc9cb4f
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/console.py
@@ -0,0 +1,175 @@
+"""Ephemeral, same-host live console transport.
+
+Console text is sanitized in the execution child, kept only in a bounded memory
+buffer, and relayed through an owner-only Unix socket. Nothing here writes
+playbook output to SQLite, audit, logs, or regular files.
+"""
+from __future__ import annotations
+
+from collections import deque
+import json
+import os
+from pathlib import Path
+import re
+import socket
+import struct
+import threading
+from urllib.parse import quote
+
+ANSI = re.compile(r"\x1b(?:\[[0-?]*[ -/]*[@-~]|\][^\x07]*(?:\x07|\x1b\\))")
+CONTROL = re.compile(r"[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]")
+SENSITIVE_ASSIGNMENT = re.compile(
+    r"(?i)(\b(?:password|passwd|passphrase|token|secret|api[_-]?key|private[_-]?key|vault_password)\b\s*[:=]\s*)"
+    r"(?:\"[^\"]*\"|'[^']*'|[^\s,}\]]+)"
+)
+MAX_LINE = 4096
+MAX_LINES = 500
+MAX_BYTES = 256 * 1024
+
+
+def console_socket(settings, ident: str) -> Path:
+    # Keep Unix-domain paths comfortably below the platform limit, including
+    # long test/state roots. The peer credential check and owner-only socket
+    # permissions remain the authorization boundary.
+    return settings.state_dir / f'.console-{ident[:12]}.sock'
+
+
+class Redactor:
+    def __init__(self, secrets=()):
+        self.secrets = []
+        self.add(secrets)
+
+    def add(self, secrets):
+        variants = set(self.secrets)
+        for value in secrets:
+            if not isinstance(value, str) or not value:
+                continue
+            variants.add(value)
+            variants.add(quote(value, safe=''))
+            try:
+                variants.add(json.dumps(value, ensure_ascii=False)[1:-1])
+            except (TypeError, ValueError):
+                pass
+        self.secrets = sorted((v for v in variants if v), key=len, reverse=True)
+
+    def clean(self, value: str) -> str:
+        text = ANSI.sub('', str(value)).replace('\r', '').rstrip('\n')
+        text = CONTROL.sub('', text)
+        for secret in self.secrets:
+            text = text.replace(secret, '*** REDACTED ***')
+        text = SENSITIVE_ASSIGNMENT.sub(r'\1*** REDACTED ***', text)
+        if len(text) > MAX_LINE:
+            text = text[:MAX_LINE] + ' …[truncated]'
+        return text
+
+
+def classify_failure(lines) -> str:
+    text = '\n'.join(lines).lower()
+    if any(marker in text for marker in (
+        'unreachable!', 'failed to connect to the host via ssh', 'permission denied (publickey',
+        'connection timed out', 'connection refused', 'winrm', 'ntlm', 'kerberos unreachable',
+    )):
+        return 'Remote connection or authentication failed. Review the live console and target connectivity.'
+    if any(marker in text for marker in (
+        "couldn't resolve module/action", 'syntax error', 'the error appears to be in',
+        '[error]:', 'unexpected exception', 'non-empty plugin name is required',
+    )):
+        return 'Ansible configuration or playbook loading failed. Review the live console and controller prerequisites.'
+    if any(marker in text for marker in ('failed!', 'fatal:', 'failed=', 'rescue')):
+        return 'A playbook task failed. Review the live console; completed remote changes were not rolled back.'
+    return 'AIM/Ansible execution failed. Review the live console while the run is active or reproduce it in AIM terminal.'
+
+
+class ConsoleServer:
+    """One-job console server; snapshot and live data exist only in memory."""
+    def __init__(self, path: Path, secrets=()):
+        self.path = path
+        self.redactor = Redactor(secrets)
+        self.buffer = deque()
+        self.buffer_bytes = 0
+        self.clients = set()
+        self.lock = threading.Lock()
+        self.stop = threading.Event()
+        path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+        os.chmod(path.parent, 0o700)
+        path.unlink(missing_ok=True)
+        self.sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+        self.sock.bind(str(path))
+        os.chmod(path, 0o600)
+        self.sock.listen(8)
+        self.sock.settimeout(.5)
+        self.thread = threading.Thread(target=self._serve, name='aim-live-console', daemon=True)
+        self.thread.start()
+
+    def _serve(self):
+        while not self.stop.is_set():
+            try:
+                conn, _ = self.sock.accept()
+            except socket.timeout:
+                continue
+            except OSError:
+                break
+            try:
+                if hasattr(socket, 'SO_PEERCRED'):
+                    _pid, uid, _gid = struct.unpack('3i', conn.getsockopt(socket.SOL_SOCKET, socket.SO_PEERCRED, 12))
+                    if uid != os.getuid():
+                        conn.close(); continue
+                conn.settimeout(2)
+                with self.lock:
+                    snapshot = list(self.buffer)
+                    for payload in snapshot:
+                        conn.sendall(payload)
+                    self.clients.add(conn)
+            except OSError:
+                with self.lock:
+                    self.clients.discard(conn)
+                try: conn.close()
+                except OSError: pass
+
+    def _publish(self, obj):
+        payload = (json.dumps(obj, ensure_ascii=False, separators=(',', ':')) + '\n').encode('utf-8')
+        with self.lock:
+            self.buffer.append(payload)
+            self.buffer_bytes += len(payload)
+            while len(self.buffer) > MAX_LINES or self.buffer_bytes > MAX_BYTES:
+                self.buffer_bytes -= len(self.buffer.popleft())
+            clients = list(self.clients)
+        dead = []
+        for conn in clients:
+            try:
+                conn.sendall(payload)
+            except OSError:
+                dead.append(conn)
+        if dead:
+            with self.lock:
+                for conn in dead:
+                    self.clients.discard(conn)
+                    try: conn.close()
+                    except OSError: pass
+
+    def add_secrets(self, secrets):
+        self.redactor.add(secrets)
+
+    def line(self, text: str):
+        clean = self.redactor.clean(text)
+        if clean:
+            self._publish({'type': 'line', 'text': clean})
+
+    def notice(self, text: str):
+        self._publish({'type': 'notice', 'text': self.redactor.clean(text)})
+
+    def close(self):
+        try:
+            self._publish({'type': 'end', 'text': 'Execution ended. Live console output is not retained.'})
+        except Exception:
+            pass
+        self.stop.set()
+        try: self.sock.close()
+        except OSError: pass
+        self.thread.join(timeout=2)
+        with self.lock:
+            clients = list(self.clients); self.clients.clear()
+        for conn in clients:
+            try: conn.close()
+            except OSError: pass
+        self.path.unlink(missing_ok=True)
diff --git a/scripts/addons/webgui/src/aim_webgui/core/__init__.py b/scripts/addons/webgui/src/aim_webgui/core/__init__.py
new file mode 100644
index 0000000..5f0245a
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/core/__init__.py
@@ -0,0 +1 @@
+"""AIM service/wire v1 client. No AIM or Ansible private imports belong here."""
diff --git a/scripts/addons/webgui/src/aim_webgui/core/client.py b/scripts/addons/webgui/src/aim_webgui/core/client.py
new file mode 100644
index 0000000..882f5e4
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/core/client.py
@@ -0,0 +1,66 @@
+"""Transport selection for AIM's documented API, never private manager access."""
+from __future__ import annotations
+import os
+import pwd
+import socket
+import stat
+import struct
+import threading
+import time
+from aim_webgui.errors import WebError
+from aim_webgui.credentials import wire
+from .protocol import request_message, response_result, safe_event, validate_secrets, TRANSPORT_ERRORS
+from .process import invoke
+from .reports import UNSPECIFIED
+from .limits import PUBLIC_FRAME_BYTES
+from .jsonio import loads
+
+class CoreClient:
+ def __init__(self,settings): self.settings=settings
+ def request(self,operation,*,credentials=None,event_sink=None,cancel=None,deadline=None,result_contract=UNSPECIFIED,**fields):
+  message=request_message(operation,**fields)
+  def emit(frame):
+   if event_sink: event_sink(safe_event(frame['event']))
+  if self.settings.core_transport=='stdio':
+   frame=invoke(self.settings,message,credentials=credentials,emit=emit,cancel=cancel,deadline=deadline)
+   return response_result(frame,operation,declaration=result_contract,request=fields.get('request'),secrets=tuple((credentials or {}).values()))
+  path=self.settings.core_socket
+  try:
+   st=path.lstat();expected=pwd.getpwnam(self.settings.core_executor_user).pw_uid
+   if not stat.S_ISSOCK(st.st_mode) or st.st_uid!=expected or stat.S_IMODE(st.st_mode)&0o007:
+    raise WebError('executor_identity','The local executor socket has an unexpected owner or mode.',503)
+   with socket.socket(socket.AF_UNIX) as sock:
+    sock.settimeout(5);sock.connect(str(path))
+    pid,uid,gid=struct.unpack('3i',sock.getsockopt(socket.SOL_SOCKET,socket.SO_PEERCRED,12))
+    if uid!=expected: raise WebError('executor_identity','Unexpected local executor identity.',503)
+    # Secret data is an explicitly separate bounded frame, never part of core request JSON.
+    has_credentials=operation=='execute'
+    remaining=min(60.0,max(0.0,deadline-time.monotonic())) if deadline is not None else None
+    wire.send(sock,{'request':message,'credential_frame':has_credentials,'start_seconds':remaining},131200)
+    if has_credentials: wire.send(sock,{'credentials':validate_secrets(credentials or {})},wire.SECRET_LIMIT+512)
+    interrupted=threading.Event()
+    def watcher():
+     while not interrupted.wait(.1):
+      if cancel is not None and cancel.is_set():
+       try: sock.shutdown(socket.SHUT_RDWR)
+       except OSError: pass
+       return
+    watcher_thread=threading.Thread(target=watcher,daemon=True);watcher_thread.start()
+    timeout=(fields.get('request',{}).get('timeout_seconds',3600)+200 if operation=='execute' else 135)
+    sock.settimeout(timeout)
+    try:
+     while True:
+      frame=wire.receive(sock,PUBLIC_FRAME_BYTES,decoder=loads)
+      if frame.get('type')=='event': emit(frame)
+      elif frame.get('type')=='response': return response_result(frame,operation,declaration=result_contract,request=fields.get('request'),secrets=tuple((credentials or {}).values()))
+      elif frame.get('type')=='transport_error':
+       code=frame.get('code')
+       messages=TRANSPORT_ERRORS
+       raise WebError(code if code in messages else 'executor_error',messages.get(code,'The local executor could not complete the core request; no raw diagnostic was exposed.'),503)
+      else: raise WebError('core_protocol','Invalid local executor response.',502)
+    finally:
+     interrupted.set();watcher_thread.join(timeout=1)
+  except WebError: raise
+  except (OSError,ValueError,KeyError):
+   if cancel is not None and cancel.is_set(): raise WebError('core_cancelled','Cancellation requested; completed remote work is not rolled back.',409) from None
+   raise WebError('executor_unavailable','The local AIM executor is unavailable. Check aim-web-executor.service and the configured core endpoint.',503) from None
diff --git a/scripts/addons/webgui/src/aim_webgui/core/executor.py b/scripts/addons/webgui/src/aim_webgui/core/executor.py
new file mode 100644
index 0000000..c493ead
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/core/executor.py
@@ -0,0 +1,119 @@
+"""Add-on-owned pre-started executor. Core itself has no broker/daemon.
+
+systemd starts this process under the already authorized, key-owning identity.
+No sudo, setuid, key export, private API imports or raw output forwarding occurs.
+The local web UID is a trusted controller client, NOT a multi-tenant boundary.
+"""
+from __future__ import annotations
+import os
+import pwd
+import resource
+import select
+import signal
+import socket
+import stat
+import struct
+import threading
+import time
+from aim_webgui.credentials import wire
+from aim_webgui.errors import WebError
+from .process import invoke
+from .limits import PUBLIC_FRAME_BYTES
+from .protocol import validate_request, validate_secrets, TRANSPORT_ERRORS
+
+class Executor:
+ def __init__(self,settings):
+  self.settings=settings;self.stopping=threading.Event()
+  self.slots=threading.BoundedSemaphore(8);self.run_slot=threading.Lock();self.threads=[]
+ def handle(self,conn):
+  acquired=False;running=False
+  try:
+   conn.settimeout(5)
+   _,uid,_=struct.unpack('3i',conn.getsockopt(socket.SOL_SOCKET,socket.SO_PEERCRED,12))
+   if uid not in {pwd.getpwnam(self.settings.core_client_user).pw_uid,0}: return
+   acquired=self.slots.acquire(blocking=False)
+   if not acquired: raise WebError('executor_busy','Concurrent executor limit.',503)
+   envelope=wire.receive(conn,131200)
+   if set(envelope)!={'request','credential_frame','start_seconds'} or type(envelope['credential_frame']) is not bool:
+    raise WebError('core_request','Invalid executor envelope.')
+   message=validate_request(envelope['request']); execute=message['operation']=='execute'
+   if envelope['credential_frame']!=execute: raise WebError('core_request','Invalid credential framing.')
+   supplied={}
+   if execute:
+    running=self.run_slot.acquire(blocking=False)
+    if not running: raise WebError('executor_busy','Another core run is active.',409)
+    frame=wire.receive(conn,wire.SECRET_LIMIT+512)
+    if set(frame)!={'credentials'}: raise WebError('invalid_credentials','Invalid credential frame.')
+    supplied=validate_secrets(frame['credentials']);frame.clear()
+   seconds=envelope['start_seconds']
+   if seconds is not None and (type(seconds) not in (int,float) or not 0 < seconds <= 60):
+    raise WebError('credential_expired','Credential start window expired.',409)
+   deadline=time.monotonic()+seconds if seconds is not None else None
+   def connected():
+    if self.stopping.is_set(): return False
+    ready,_,_=select.select([conn],[],[],0)
+    if ready:
+     # No more input is allowed; EOF means cancellation/disconnect.
+     return False
+    return True
+   def emit(frame): wire.send(conn,frame,PUBLIC_FRAME_BYTES)
+   final=invoke(self.settings,message,credentials=supplied,emit=emit,cancel=self.stopping,connected=connected,deadline=deadline)
+   wire.send(conn,final,PUBLIC_FRAME_BYTES)
+  except (WebError,OSError,ValueError,KeyError,TypeError) as exc:
+   # Deliberately do not log repr/body/traceback; submitted values may be secrets.
+   try: wire.send(conn,{'type':'transport_error','code':exc.code if isinstance(exc,WebError) and exc.code in TRANSPORT_ERRORS else 'executor_error'})
+   except (OSError,ValueError): pass
+  finally:
+   if 'supplied' in locals(): supplied.clear()
+   if running: self.run_slot.release()
+   if acquired: self.slots.release()
+   conn.close()
+ def run(self):
+  settings=self.settings
+  if os.geteuid()!=pwd.getpwnam(settings.core_executor_user).pw_uid or os.geteuid()==0:
+   raise ValueError('Executor must run as the configured non-root execution/key identity.')
+  resource.setrlimit(resource.RLIMIT_CORE,(0,0));os.umask(0o077)
+  if settings.core_home is not None:
+   home=settings.core_home.lstat()
+   if not stat.S_ISDIR(home.st_mode) or home.st_uid!=os.geteuid() or stat.S_IMODE(home.st_mode)&0o077:
+    raise ValueError('The configured executor home must be an executor-owned private 0700 directory.')
+  parent=settings.core_socket.parent
+  client_gid=pwd.getpwnam(settings.core_client_user).pw_gid
+  # systemd owns the runtime-directory contract.  Keep the executor's normal
+  # primary group and permit pathname traversal only; authorization is enforced
+  # on the socket itself (executor:aim-web 0660).  This avoids runtime chgrp and
+  # keeps the HTTP/worker identity unable to list the executor runtime directory.
+  st=parent.lstat()
+  if (not stat.S_ISDIR(st.st_mode) or st.st_uid!=os.geteuid()
+      or stat.S_IMODE(st.st_mode)!=0o711):
+   raise ValueError('Executor socket directory must be executor-owned 0711 and non-symlinked.')
+  # Verify the actual wire/API before accepting traffic; this needs no Ansible run.
+  from .protocol import response_result
+  result=response_result(invoke(settings,{'api_version':'1.0','operation':'capabilities'}),'capabilities')
+  if result.get('api_version')!='1.0' or result.get('core_version')!='3.3.0rc8':
+   raise ValueError('This executor release is qualified for AIM 3.3.0rc8 / service API 1.0 only.')
+  path=settings.core_socket
+  if path.exists():
+   item=path.lstat()
+   if not stat.S_ISSOCK(item.st_mode) or item.st_uid!=os.geteuid(): raise ValueError('Unexpected existing executor endpoint.')
+   # Refuse a second live executor; remove only a stale same-owner socket.
+   with socket.socket(socket.AF_UNIX) as probe:
+    try: probe.connect(str(path))
+    except ConnectionRefusedError: path.unlink()
+    else: raise ValueError('Another executor is already listening.')
+  listener=socket.socket(socket.AF_UNIX)
+  previous={}
+  try:
+   listener.bind(str(path));os.chown(path,-1,client_gid);os.chmod(path,0o660);listener.listen(8);listener.settimeout(.5)
+   for sig in (signal.SIGINT,signal.SIGTERM):
+    previous[sig]=signal.signal(sig,lambda *_:self.stopping.set())
+   while not self.stopping.is_set():
+    try: conn,_=listener.accept()
+    except socket.timeout: continue
+    t=threading.Thread(target=self.handle,args=(conn,),daemon=True);self.threads.append(t);t.start()
+    self.threads=[t for t in self.threads if t.is_alive()]
+  finally:
+   self.stopping.set();listener.close()
+   for t in self.threads:t.join(timeout=15)
+   path.unlink(missing_ok=True)
+   for sig,handler in previous.items():signal.signal(sig,handler)
diff --git a/scripts/addons/webgui/src/aim_webgui/core/jsonio.py b/scripts/addons/webgui/src/aim_webgui/core/jsonio.py
new file mode 100644
index 0000000..efb250d
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/core/jsonio.py
@@ -0,0 +1,26 @@
+"""Strict public JSON decoding; rejects ambiguous keys, NaN and excessive depth."""
+import json
+
+
+def loads(raw, max_depth=48):
+    # Scan brackets outside strings before allocating a recursive JSON tree.
+    text=raw.decode('utf-8') if isinstance(raw,(bytes,bytearray)) else raw
+    depth=0;quoted=False;escaped=False
+    for char in text:
+        if quoted:
+            if escaped:escaped=False
+            elif char=='\\':escaped=True
+            elif char=='"':quoted=False
+        elif char=='"':quoted=True
+        elif char in '[{':
+            depth+=1
+            if depth>max_depth:raise ValueError('Public JSON nesting exceeds its bound.')
+        elif char in ']}':depth-=1
+    def pairs(items):
+        result={}
+        for key,val in items:
+            if key in result:raise ValueError('Duplicate public JSON member.')
+            result[key]=val
+        return result
+    def constant(_):raise ValueError('Non-finite public JSON number.')
+    return json.loads(text,object_pairs_hook=pairs,parse_constant=constant)
diff --git a/scripts/addons/webgui/src/aim_webgui/core/limits.py b/scripts/addons/webgui/src/aim_webgui/core/limits.py
new file mode 100644
index 0000000..09c0e2c
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/core/limits.py
@@ -0,0 +1,11 @@
+"""Public response budgets, deliberately separate from request/credential limits.
+
+Core's 16 MiB report uses UTF-8 sizing. JSON escaping can expand it, and the final
+result appears twice on the wire. Default 128 MiB line / 512 MiB stream leaves
+bounded room for escaping, target/schema overhead and progress. IPC is canonical
+UTF-8 and gets a 32 MiB final frame. These limits never apply to credential input.
+"""
+PUBLIC_LINE_BYTES = 128 * 1024 * 1024
+PUBLIC_STREAM_BYTES = 512 * 1024 * 1024
+PUBLIC_FRAME_BYTES = 32 * 1024 * 1024
+METADATA_LINE_BYTES = 32 * 1024 * 1024
diff --git a/scripts/addons/webgui/src/aim_webgui/core/process.py b/scripts/addons/webgui/src/aim_webgui/core/process.py
new file mode 100644
index 0000000..40819a7
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/core/process.py
@@ -0,0 +1,139 @@
+"""One native aimctl process per call, under the existing execution UID.
+
+AIM is invoked through its documented wire protocol. Never imports AIM, alters
+Ansible arguments, supplies an actor, or switches operating-system identity.
+"""
+from __future__ import annotations
+import json
+import os
+import pwd
+import selectors
+import signal
+import subprocess
+import threading
+import time
+
+from aim_webgui.errors import WebError
+from .protocol import validate_request, validate_secrets, safe_event
+from .limits import PUBLIC_LINE_BYTES, PUBLIC_STREAM_BYTES, METADATA_LINE_BYTES
+from .jsonio import loads
+
+
+def stop(process):
+ if process.poll() is not None: return
+ try: process.send_signal(signal.SIGTERM)
+ except ProcessLookupError: return
+ try: process.wait(timeout=12)
+ except subprocess.TimeoutExpired:
+  try: os.killpg(process.pid,signal.SIGKILL)
+  except ProcessLookupError: pass
+  process.wait(timeout=3)
+
+
+def invoke(settings, message, *, credentials=None, emit=None, cancel=None, connected=None, deadline=None):
+ """Return a raw, authoritative response. Side-channel secrets never join stdin."""
+ validate_request(message)
+ operation=message['operation']
+ secret=validate_secrets(credentials or {})
+ if secret and operation!='execute':
+  raise WebError('core_request','Only execute accepts a private credential channel.')
+ request=(json.dumps(message,ensure_ascii=False,allow_nan=False,separators=(',',':'))+'\n').encode('utf-8')
+ command=list(settings.core_command)+['--config',str(settings.core_config)]
+ read_fd=write_fd=None
+ process=None; writer=None; delivered=threading.Event()
+ credential_bytes=None
+ try:
+  if operation=='execute':
+   read_fd,write_fd=os.pipe()
+   command+=['--credentials-fd',str(read_fd)]
+   credential_bytes=json.dumps(secret,ensure_ascii=False,allow_nan=False).encode('utf-8')
+  command+=['request']
+  # Trusted operator configuration chooses the executable; no browser-controlled argv.
+  account=pwd.getpwuid(os.geteuid())
+  env={'PATH':'/usr/local/bin:/usr/bin:/bin','HOME':str(settings.core_home) if settings.core_home else account.pw_dir,'LANG':'C.UTF-8',
+       'PYTHONDONTWRITEBYTECODE':'1','PYTHONNOUSERSITE':'1'}
+  process=subprocess.Popen(command,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.DEVNULL,
+                           pass_fds=(() if read_fd is None else (read_fd,)),env=env,cwd='/',start_new_session=True)
+  if read_fd is not None: os.close(read_fd);read_fd=None
+  if write_fd is not None:
+   fd=write_fd;write_fd=None
+   def deliver():
+    try:
+     with os.fdopen(fd,'wb',buffering=0) as stream:
+      view=memoryview(credential_bytes)
+      while view:
+       n=stream.write(view)
+       if not n: break
+       view=view[n:]
+    except (OSError,BrokenPipeError): pass
+    finally: delivered.set()
+   writer=threading.Thread(target=deliver,daemon=True);writer.start()
+  # stdin is small/bounded (128 KiB). Writer runs concurrently with event reads.
+  def request_writer():
+   try: process.stdin.write(request);process.stdin.close()
+   except (OSError,BrokenPipeError): pass
+  sender=threading.Thread(target=request_writer,daemon=True);sender.start()
+  timeout=(message.get('request',{}).get('timeout_seconds',3600)+180 if operation=='execute'
+           else 120 if operation=='readiness' else 30)
+  end=time.monotonic()+timeout
+  line_limit=PUBLIC_LINE_BYTES if operation=='execute' else METADATA_LINE_BYTES
+  buffer=bytearray(); total=0; final=None; sequence=0; executing=False
+  with selectors.DefaultSelector() as selector:
+   selector.register(process.stdout,selectors.EVENT_READ)
+   eof=False
+   while not eof:
+    if cancel is not None and cancel.is_set():
+     stop(process); raise WebError('core_cancelled','Cancellation requested; completed remote work is not rolled back.',409)
+    if connected is not None and not connected():
+     stop(process); raise WebError('core_disconnected','Execution client disconnected; cancellation requested.',409)
+    if deadline is not None and not executing and time.monotonic()>deadline:
+     stop(process);raise WebError('credential_expired','Credentials expired before execution began. Review a fresh attempt.',409)
+    if time.monotonic()>end:
+     stop(process);raise WebError('core_timeout','Core did not complete within its bounded lifecycle. Outcome requires review.',504)
+    for key,_ in selector.select(.1):
+     chunk=os.read(key.fileobj.fileno(),65536)
+     if not chunk:
+      eof=True;break
+     total+=len(chunk);buffer.extend(chunk)
+     if total>PUBLIC_STREAM_BYTES:
+      raise WebError('core_protocol','Core output exceeded bounded protocol limits.',502)
+     while b'\n' in buffer:
+      raw,_,remainder=buffer.partition(b'\n');buffer=bytearray(remainder)
+      if len(raw)>line_limit:raise WebError('core_protocol','Core JSON line exceeded its response budget.',502)
+      if not raw.strip(): continue
+      try: value=loads(raw)
+      except (ValueError,UnicodeError): raise WebError('core_protocol','Core output is not valid JSONL.',502) from None
+      if final is not None: raise WebError('core_protocol','Unexpected data after final core response.',502)
+      if not isinstance(value,dict): raise WebError('core_protocol','Invalid core frame.',502)
+      if value.get('type')=='event':
+       event=safe_event(value.get('event'))
+       if event is not None:
+        if event['sequence']<=sequence: raise WebError('core_protocol','Non-monotonic core event stream.',502)
+        sequence=event['sequence']
+        if event.get('kind')=='stage' and event.get('stage')=='execution': executing=True
+        if emit: emit({'type':'event','event':event})
+      elif value.get('type')=='response': final=value
+      else: raise WebError('core_protocol','Unknown wire frame type.',502)
+     if len(buffer)>line_limit:raise WebError('core_protocol','Core JSON line exceeded its response budget.',502)
+   if buffer.strip(): raise WebError('core_protocol','Truncated core wire frame.',502)
+  process.wait(timeout=5)
+  sender.join(timeout=1)
+  if final is None: raise WebError('core_outcome_unknown','Core exited without a final response. Do not assume success or retry automatically.',502)
+  if final.get('ok') is True and process.returncode!=0:
+   raise WebError('core_outcome_unknown','Core exit status disagrees with its final response.',502)
+  return final
+ except (OSError,subprocess.TimeoutExpired):
+  raise WebError('core_unavailable','Configured aimctl could not run. Check the core launcher and execution identity.',503) from None
+ finally:
+  if process is not None:
+   stop(process)
+   for stream in (process.stdin,process.stdout):
+    if stream is not None:
+     try: stream.close()
+     except OSError: pass
+  for fd in (read_fd,write_fd):
+   if fd is not None:
+    try: os.close(fd)
+    except OSError: pass
+  if writer: writer.join(timeout=1)
+  secret.clear();credential_bytes=None
diff --git a/scripts/addons/webgui/src/aim_webgui/core/protocol.py b/scripts/addons/webgui/src/aim_webgui/core/protocol.py
new file mode 100644
index 0000000..827a6b4
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/core/protocol.py
@@ -0,0 +1,279 @@
+"""Narrow validation of the documented core wire/event protocol.
+
+Only structured core progress reaches a browser. Unknown additive response fields
+are ignored; unknown errors fail safely. Requests never carry passwords.
+"""
+from __future__ import annotations
+import json
+import re
+from aim_webgui.errors import WebError
+from .reports import contract, operation_result, UNSPECIFIED
+
+OPERATIONS = {'capabilities': set(), 'staging_check': set(), 'list_customers': set(),
+              'list_hosts': {'customer'}, 'inventory_hierarchy': {'customer'}, 'list_playbooks': {'customer'},
+              'prepare': {'request'}, 'readiness': {'request'},
+              'execute': {'request', 'expected_revision'}}
+REQUEST_FIELDS = {'customer','playbook','hosts','overrides','check','key_mode','become_password','timeout_seconds','progress_mode'}
+CREDENTIAL_FIELDS = {'vault_password','connection_password','ssh_key_passphrase'}
+COUNTS = {'ok','changed','failures','unreachable','skipped','rescued','ignored'}
+ERRORS = {
+ 'operation_result_missing': 'Execution completed but a required report was missing. Remote changes may be complete; do not retry automatically.',
+ 'operation_result_invalid': 'Core rejected an operation report. Inspect report availability; no automatic retry was made.',
+ 'operation_result_withheld': 'Core withheld sensitive operation report data. This is not a credential-retry instruction.',
+ 'operation_result_limit': 'Operation report exceeded its declared limits. Remote work may be complete.',
+ 'operation_result_incomplete': 'Core did not receive a complete operation report stream. Review the execution and report states separately.',
+ 'invalid_credentials': 'Core rejected the supplied one-run credential fields.',
+ 'event_bridge_unavailable': 'Native execution did not emit final safe counters; success is not assumed.',
+ 'runtime_config_invalid': 'Core rejected the local Ansible configuration.',
+ 'runtime_incomplete': 'Core needs the native Ansible CLI tools in one consistent runtime.',
+ 'runtime_identity_ambiguous': 'The native Ansible tools do not report one unambiguous interpreter environment.',
+ 'collection_discovery_failed': 'Core could not inspect collections for the execution account.',
+ 'ssh_tools_missing': 'Core requires OpenSSH key-loading tools for this request.',
+ 'unencrypted_vault': 'Core requires the standard customer Vault to be encrypted.',
+ 'access_denied': 'The configured core execution identity cannot access a required resource or is not in AIM required_group.',
+ 'execution_disabled': 'AIM core has external execution disabled. An operator must review addons.execution_enabled in aim.yml.',
+ 'invalid_request': 'AIM rejected the request schema. Review the selection and supported options.',
+ 'invalid_target': 'A selected target is missing, incompatible or ambiguous. Review the current inventory.',
+ 'invalid_options': 'A selected catalog option is invalid. Review the declared inputs.',
+ 'source_invalid': 'Core configuration, inventory or catalog is invalid or inaccessible to its execution identity.',
+ 'customer_unavailable': 'The selected customer is unavailable to AIM core.',
+ 'unknown_playbook': 'The requested catalog playbook is not available.',
+ 'playbook_unavailable': 'The catalog entry has no installed playbook for this customer.',
+ 'resource_busy': 'Another AIM operation holds the customer lock. No automatic retry was made.',
+ 'review_stale': 'AIM sources or reviewed options changed. Review a new run before submitting.',
+ 'key_access_policy': 'Customer key mode requires a canonical 0600 key owned by the core execution account. No ownership changes were made.',
+ 'key_unavailable': 'The canonical customer SSH key is unavailable to AIM core.',
+ 'key_load_failed': 'AIM could not load the customer key. Verify ownership, key format and key passphrase in the terminal.',
+ 'vault_missing': 'This catalog operation requires a customer Vault which is not available.',
+ 'vault_unlock_failed': 'The customer Vault could not be unlocked. No automatic execution retry was made.',
+ 'credential_required': 'Core requires fresh credentials for the reviewed run.',
+ 'credentials_expired': 'The one-run credential window expired. Review and submit a new attempt.',
+ 'invalid_credential_channel': 'The private credential channel was rejected; no insecure fallback is available.',
+ 'runtime_missing': 'Core could not locate its configured native Ansible runtime.',
+ 'runtime_version_unsupported': 'The configured native Ansible runtime is not supported by AIM core.',
+ 'collections_missing': 'A catalog-required collection is missing for the core execution identity.',
+ 'collection_version_unsupported': 'A required Ansible collection version is outside the Core-supported range. Update the approved Core collection environment before retrying.',
+ 'runtime_credential_defaults_unsupported': 'Core rejected controller-wide Vault defaults for unattended execution. Inspect core readiness in the terminal.',
+ 'controller_staging_unavailable': 'Core executor staging is unavailable. Review the executor sandbox/write path; credentials were not consumed.',
+ 'controller_staging_unsafe': 'Core executor staging has unsafe ownership, permissions, type or symlinks. No automatic repair was made.',
+ 'controller_staging_config_unsupported': 'Core could not safely resolve the configured controller staging path.',
+ 'controller_staging_timeout': 'Core staging preflight timed out before remote execution.',
+ 'controller_staging_probe_failed': 'Core staging preflight failed inside the executor sandbox.',
+ 'event_bridge_incomplete': 'Core detailed progress was incomplete; success is not assumed.',
+ 'event_limit': 'Core detailed progress exceeded its bounded event limit; success is not assumed.',
+ 'syntax_check_failed': 'Native syntax/preflight checking failed. Use AIM terminal for detailed diagnostics.',
+ 'host_unreachable': 'Ansible reported unreachable hosts. This does not distinguish network failure from rejected authentication.',
+ 'playbook_failed': 'Ansible reported an execution or task failure. Remote work may have started.',
+ 'timeout': 'Core timed out. Completed remote work is not rolled back.',
+ 'cancelled': 'Core cancelled the local execution. Completed remote work is not rolled back.',
+ 'event_sink_failed': 'The progress consumer disconnected or failed; execution cancellation was requested.',
+ 'invalid_event_stream': 'Core could not validate native progress. The outcome requires operator review.',
+ 'internal_error': 'AIM core could not complete the operation. No raw exception or secret was exposed.',
+ 'api_version_unsupported': 'AIM service API version is incompatible with this add-on.',
+ 'source_symlink_unsupported': 'Core does not accept symlinks in this reviewed source set.',
+ 'revision_limit': 'Core source revision limits were exceeded.',
+}
+
+TRANSPORT_ERRORS = {
+ 'operation_result_missing': 'Execution completed but a required report was missing. Remote changes may be complete; do not retry automatically.',
+ 'operation_result_invalid': 'Core rejected an operation report. Inspect report availability; no automatic retry was made.',
+ 'operation_result_withheld': 'Core withheld sensitive operation report data. This is not a credential-retry instruction.',
+ 'operation_result_limit': 'Operation report exceeded its declared limits. Remote work may be complete.',
+ 'operation_result_incomplete': 'Core did not receive a complete operation report stream. Review the execution and report states separately.',
+ 'executor_busy': 'The executor is busy. Submit a fresh attempt when it is ready; credentials are not retained.',
+ 'credential_expired': 'Credentials expired before execution began. Submit a fresh attempt.',
+ 'core_cancelled': 'Core cancellation requested; completed remote work is not rolled back.',
+ 'core_unavailable': 'The executor could not start configured aimctl. Check the launcher, configuration path and execution account.',
+ 'core_timeout': 'The bounded core call timed out. Inspect the execution account and outcome before any explicit retry.',
+ 'core_protocol': 'Core returned an invalid or unsupported wire response. No success is assumed.',
+ 'core_outcome_unknown': 'Core exited without an authoritative result. The remote outcome is unknown; do not replay automatically.',
+ 'core_disconnected': 'The local execution client disconnected; cancellation was requested.',
+}
+
+def request_message(operation, **fields):
+ value={'api_version':'1.0','operation':operation,**fields}
+ validate_request(value)
+ return value
+
+def validate_request(value):
+ if not isinstance(value,dict) or value.get('api_version') != '1.0':
+  raise WebError('core_request', 'Use the supported AIM service API 1.0.')
+ op=value.get('operation')
+ if op not in OPERATIONS or set(value) != {'api_version','operation'}|OPERATIONS[op]:
+  raise WebError('core_request','Unsupported core operation or request field.')
+ if len(json.dumps(value,ensure_ascii=False,allow_nan=False).encode('utf-8')) > 131071:
+  raise WebError('core_request','Core request exceeds its size limit.')
+ if 'request' in value:
+  req=value['request']
+  if not isinstance(req,dict) or set(req)-REQUEST_FIELDS or not {'customer','playbook','hosts'} <= set(req):
+   raise WebError('core_request','Use documented run fields only; no credential, actor, path or command fields.')
+  if req.get('become_password',False) is not False:
+   raise WebError('become_unsupported','Become password entry is not exposed in this add-on release.')
+ return value
+
+def validate_secrets(values):
+ if not isinstance(values,dict) or set(values)-CREDENTIAL_FIELDS:
+  raise WebError('invalid_credentials','Only supported one-run credential fields are accepted.')
+ result={}
+ for k,v in values.items():
+  try: valid = isinstance(v,str) and not any(c in v for c in ('\x00','\r','\n')) and len(v.encode('utf-8'))<=2048
+  except UnicodeError: valid=False
+  if not valid:
+   raise WebError('invalid_credentials','Use literal single-line passwords up to 2048 UTF-8 bytes.')
+  if v: result[k]=v
+ if len(json.dumps(result,ensure_ascii=False).encode())>8192:
+  raise WebError('invalid_credentials','Credential hand-off exceeds 8 KiB.')
+ return result
+
+def safe_event(value):
+ if not isinstance(value,dict) or value.get('event_version')!='1.0':
+  raise WebError('core_protocol','Unsupported core event version.',502)
+ base={k:value[k] for k in ('event_version','run_id','sequence','timestamp','kind') if k in value}
+ if type(base.get('sequence')) is not int or base['sequence'] < 1:
+  raise WebError('core_protocol','Invalid core event sequence.',502)
+ kind=value.get('kind')
+ if kind=='stage':
+  if value.get('stage') not in {'credentials','syntax_check','execution'}: return None
+  base['stage']=value['stage']; return base
+ if kind=='progress':
+  if value.get('status') not in {'started','task','ok','failed','unreachable','skipped'}: return None
+  base['status']=value['status']; return base
+ if kind=='stats':
+  if not isinstance(value.get('counts'),dict): raise WebError('core_protocol','Invalid progress counters.',502)
+  base['counts']={k:v for k,v in value['counts'].items() if k in COUNTS and type(v) is int and v>=0}; return base
+ if kind=='result':
+  summary=value.get('result',value)
+  base['status']=summary.get('status') if isinstance(summary,dict) and summary.get('status') in {'succeeded','failed','cancelled'} else 'pending'
+  return base
+ # AIM 3.2 detailed events: validate the public safe projection again at the add-on boundary.
+ if kind=='play_started':
+  if not _id(value.get('play_id'),'p'): raise WebError('core_protocol','Invalid detailed play event.',502)
+  return {**base,'play_id':value['play_id'],'label':_label(value.get('label')),'label_redacted':value.get('label_redacted') is True}
+ if kind in {'play_skipped','play_stopped'}:
+  expected='no_hosts_matched' if kind=='play_skipped' else 'no_hosts_remaining'
+  if not _id(value.get('play_id'),'p') or value.get('reason')!=expected: raise WebError('core_protocol','Invalid detailed play state.',502)
+  return {**base,'play_id':value['play_id'],'reason':expected}
+ if kind=='task_started':
+  if not _id(value.get('play_id'),'p') or not _id(value.get('task_id'),'t') or type(value.get('handler')) is not bool:
+   raise WebError('core_protocol','Invalid detailed task event.',502)
+  return {**base,'play_id':value['play_id'],'task_id':value['task_id'],'label':_label(value.get('label')),
+          'label_redacted':value.get('label_redacted') is True,'handler':value['handler']}
+ if kind=='host_result':
+  status=value.get('status')
+  if (not _id(value.get('play_id'),'p') or not _id(value.get('task_id'),'t') or status not in {'ok','changed','skipped','failed','unreachable'}
+      or any(type(value.get(k)) is not bool for k in ('host_redacted','changed','ignored','details_redacted'))):
+   raise WebError('core_protocol','Invalid detailed host result.',502)
+  error=value.get('error')
+  if error is not None:
+   if (not isinstance(error,dict) or set(error)!={'code','message','classification'} or not _label(error.get('message'),400)
+       or not isinstance(error.get('code'),str) or not isinstance(error.get('classification'),str)):
+    raise WebError('core_protocol','Invalid detailed diagnostic hint.',502)
+   code=error['code']
+   messages={
+    'connection_refused':'Connection refused. Check the listener, port and firewall.',
+    'connection_timeout':'Connection timed out.', 'name_resolution_failed':'Name resolution failed.',
+    'tls_verification_failed':'TLS certificate verification failed.',
+    'authentication_failed':'Connection authentication failed. Check the configured identity and authentication method.',
+    'permission_denied':'Permission was denied.',
+    'host_unreachable':'Ansible could not reach or authenticate to this host. Further details are withheld.',
+    'task_failed':'The task failed. Further details are withheld.',
+    'details_withheld':'Sensitive task details are withheld by Core.'}
+   code=code if code in messages else 'details_withheld'
+   error={'code':code,'message':messages[code],'classification':code}
+  return {**base,'play_id':value['play_id'],'task_id':value['task_id'],'host':_host(value.get('host')),
+          'host_redacted':value['host_redacted'],'status':status,'changed':value['changed'],'ignored':value['ignored'],
+          'details_redacted':value['details_redacted'],'error':error}
+ if kind in {'task_retry','task_async_poll'}:
+  attempt=value.get('attempt')
+  if (not _id(value.get('play_id'),'p') or not _id(value.get('task_id'),'t') or type(value.get('host_redacted')) is not bool
+      or type(value.get('details_redacted')) is not bool or (attempt is not None and (type(attempt) is not int or not 0<=attempt<=1_000_000))):
+   raise WebError('core_protocol','Invalid detailed retry/poll event.',502)
+  return {**base,'play_id':value['play_id'],'task_id':value['task_id'],'host':_host(value.get('host')),
+          'host_redacted':value['host_redacted'],'attempt':attempt,'details_redacted':value['details_redacted']}
+ if kind=='host_recap':
+  if type(value.get('host_redacted')) is not bool or not isinstance(value.get('counts'),dict):
+   raise WebError('core_protocol','Invalid detailed recap event.',502)
+  counts={k:v for k,v in value['counts'].items() if k in COUNTS and type(v) is int and v>=0}
+  return {**base,'host':_host(value.get('host')),'host_redacted':value['host_redacted'],'counts':counts}
+ return None
+
+def _id(value,prefix):
+ return isinstance(value,str) and bool(re.fullmatch(prefix+r'[1-9][0-9]{0,8}',value))
+
+def _label(value,limit=200):
+ if not isinstance(value,str) or not value or len(value)>limit or any(ord(c)<32 and c!='\t' for c in value):
+  raise WebError('core_protocol','Invalid detailed label.',502)
+ return value
+
+def _host(value):
+ if value is None:return None
+ if not isinstance(value,str) or len(value)>255 or not re.fullmatch(r'[A-Za-z0-9_][A-Za-z0-9_.-]*',value):
+  raise WebError('core_protocol','Invalid detailed host label.',502)
+ return value
+
+def safe_error(value):
+ code=value.get('code','internal_error') if isinstance(value,dict) else 'internal_error'
+ if not isinstance(code,str) or not re.fullmatch('[a-z][a-z0-9_]{0,79}',code): code='internal_error'
+ return {'code':code, 'message':ERRORS.get(code,'Core reported an unsupported error code. Inspect the core contract; no automatic retry was made.'),
+         'stage':value.get('stage','unknown') if isinstance(value,dict) and value.get('stage') in {'validation','authorization','readiness','credentials','syntax_check','execution','unknown','preparation','key_loading','vault_unlock','completed','result_validation'} else 'unknown',
+         'retryable':bool(isinstance(value,dict) and value.get('retryable') is True)}
+
+def _target_outcomes(result):
+ summary=result.get('target_summary')
+ targets=result.get('targets')
+ if not isinstance(summary,dict) or summary.get('schema')!='target_outcome_summary_v1' or not isinstance(targets,list):
+  raise WebError('core_protocol','Core did not provide authoritative per-target outcomes.',502)
+ fields=('requested','successful','failed','unreachable','not_started','indeterminate','accounted')
+ if any(type(summary.get(k)) is not int or summary[k]<0 for k in fields) or type(summary.get('complete')) is not bool:
+  raise WebError('core_protocol','Invalid target outcome summary.',502)
+ if summary['accounted']!=summary['requested'] or len(targets)!=summary['requested']:
+  raise WebError('core_protocol','Incomplete target outcome accounting.',502)
+ states={'successful','failed','unreachable','not_started','indeterminate'}
+ projected=[]; totals={state:0 for state in states}; seen=set()
+ for item in targets:
+  if not isinstance(item,dict) or item.get('outcome') not in states or not isinstance(item.get('counts'),dict):
+   raise WebError('core_protocol','Invalid per-target outcome.',502)
+  host=_host(item.get('host'))
+  if host is None or host in seen:raise WebError('core_protocol','Invalid per-target host accounting.',502)
+  seen.add(host); outcome=item['outcome'];totals[outcome]+=1
+  counts={k:v for k,v in item['counts'].items() if k in COUNTS and type(v) is int and v>=0}
+  if set(counts)!=COUNTS:raise WebError('core_protocol','Invalid per-target counters.',502)
+  projected.append({'host':host,'outcome':outcome,'counts':counts})
+ if any(summary[state]!=totals[state] for state in states):
+  raise WebError('core_protocol','Target outcome totals do not match target facts.',502)
+ projected_summary={'schema':'target_outcome_summary_v1',**{k:summary[k] for k in fields},'complete':summary['complete']}
+ return projected_summary,projected
+
+def response_result(value, operation, *, declaration=UNSPECIFIED, request=None, secrets=()):
+ if not isinstance(value,dict) or value.get('type')!='response' or value.get('api_version')!='1.0' or type(value.get('ok')) is not bool:
+  raise WebError('core_protocol','Missing or invalid authoritative core response.',502)
+ if 'result' in value and operation=='execute':
+  result=value['result']
+  if not isinstance(result,dict) or result.get('status') not in {'succeeded','failed','cancelled'} or type(result.get('remote_work_may_have_started')) is not bool:
+   raise WebError('core_protocol','Core execution outcome could not be established.',502)
+  if result['status']=='succeeded' and (value['ok'] is not True or not isinstance(result.get('counts'),dict) or not COUNTS<=set(result['counts']) or any(type(result['counts'][k])is not int or result['counts'][k]<0 for k in COUNTS) or result.get('exit_code')!=0 or result.get('error')):
+   raise WebError('core_protocol','Core did not provide final execution counters; success is not assumed.',502)
+  target_summary,targets=_target_outcomes(result)
+  if request is not None and [x['host'] for x in targets]!=request['hosts']:
+   raise WebError('core_protocol','Final target accounting differs from the reviewed request.',502)
+  report=operation_result(result.get('operation_result'),declaration,targets=[x['host'] for x in targets],
+                          check=request.get('check',True) if request else None,secrets=secrets)
+  return {'api_version':'1.0', 'run_id':str(result.get('run_id',''))[:100], 'status':result['status'],
+          'stage':result.get('stage') if result.get('stage') in {'validation','authorization','readiness','credentials','syntax_check','execution','preparation','key_loading','vault_unlock','completed','result_validation'} else 'unknown', 'exit_code':result.get('exit_code') if type(result.get('exit_code')) is int else None,
+          'remote_work_may_have_started':result['remote_work_may_have_started'],
+          'error':safe_error(result['error']) if result.get('error') else None,
+          'counts':{k:v for k,v in (result.get('counts') if isinstance(result.get('counts'),dict) else {}).items() if k in COUNTS and type(v)is int and v>=0},
+          'target_summary':target_summary,'targets':targets,'operation_result':report}
+ if not value['ok']:
+  err=safe_error(value.get('error',{}))
+  exc=WebError('core_'+err['code'],err['message'],409 if err['code'] in {'review_stale','resource_busy'} else 503)
+  exc.core_error=err
+  raise exc
+ result=value.get('result')
+ if operation=='prepare' and isinstance(result,dict):
+  result={**result,'result_contract':contract(result.get('result_contract'))}
+ elif operation=='readiness' and isinstance(result,dict) and isinstance(result.get('prepared'),dict):
+  result={**result,'prepared':{**result['prepared'],'result_contract':contract(result['prepared'].get('result_contract'))}}
+ elif operation=='list_playbooks' and isinstance(result,list):
+  result=[{**item,'result':contract(item.get('result'))} for item in result]
+ return result
diff --git a/scripts/addons/webgui/src/aim_webgui/core/reports.py b/scripts/addons/webgui/src/aim_webgui/core/reports.py
new file mode 100644
index 0000000..54ad0cd
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/core/reports.py
@@ -0,0 +1,171 @@
+"""Validate the documented Core operation-report schema at the add-on boundary.
+
+Independent consumer implementation of the public, bounded JSON-schema subset.
+Never import Core/Ansible, resolve schema files, execute validators or fetch $refs.
+"""
+from __future__ import annotations
+import json
+import math
+import re
+from aim_webgui.errors import WebError
+
+PROTOCOL = 'aim_operation_result_v1'
+PUBLISHER = 'aim_output_v1'
+SLOT_BYTES = 1024 * 1024
+RUN_BYTES = 16 * 1024 * 1024
+MAX_DEPTH, MAX_NODES, MAX_ITEMS = 20, 200_000, 20_000
+SCHEMA_ID = re.compile(r'[a-z][a-z0-9_]{0,79}_v[1-9][0-9]*\Z')
+SECRET_KEY = re.compile(r'(^|_)(password|passwd|passphrase|secret|token|credential|private_key|vault)(_|$)', re.I)
+AVAILABILITY = frozenset({'available','missing','withheld','invalid','not_started','indeterminate'})
+REPORT_ERRORS = frozenset({'operation_result_missing','operation_result_invalid','operation_result_withheld',
+                          'operation_result_limit','operation_result_incomplete'})
+KEYWORDS = {'type','properties','required','additionalProperties','items','enum','maxItems','maxLength','minimum','maximum','description'}
+KINDS = {'object','array','string','number','integer','boolean','null'}
+CONTRACT_FIELDS = {'protocol','schema','scope','required','sensitivity','max_bytes_per_host','data_schema'}
+UNSPECIFIED = object()
+
+
+def bad(message='Core supplied an invalid operation-report contract or payload.'):
+    raise WebError('core_protocol', message, 502)
+
+
+def encoded(value):
+    try:
+        return json.dumps(value, ensure_ascii=False, allow_nan=False, separators=(',',':')).encode('utf-8')
+    except (ValueError, TypeError, UnicodeError, RecursionError):
+        bad()
+
+
+def _text(value, maximum=8192):
+    if not isinstance(value,str) or len(value)>maximum or any(ord(c)<32 or ord(c)==127 for c in value):
+        bad()
+    try: value.encode('utf-8')
+    except UnicodeError: bad()
+    return value
+
+
+def contract(value):
+    if value is None:
+        return None
+    if not isinstance(value,dict) or not CONTRACT_FIELDS <= value.keys():
+        bad()
+    if (value['protocol']!=PUBLISHER or not isinstance(value['schema'],str) or not SCHEMA_ID.fullmatch(value['schema'])
+            or value['scope'] not in ('per_host','global') or type(value['required']) is not bool
+            or value['sensitivity']!='safe' or type(value['max_bytes_per_host']) is not int
+            or not 1<=value['max_bytes_per_host']<=SLOT_BYTES):
+        bad()
+    budget=[0]
+    def shape(node, depth=0):
+        budget[0]+=1
+        if depth>MAX_DEPTH or budget[0]>5000 or not isinstance(node,dict) or set(node)-KEYWORDS:
+            bad('Core report schema uses an unsupported or unbounded schema language.')
+        kinds=node.get('type'); kinds=kinds if isinstance(kinds,list) else [kinds]
+        if not kinds or any(not isinstance(k,str) or k not in KINDS for k in kinds):bad()
+        if len(kinds)!=len(set(kinds)):bad()
+        clean={k:v for k,v in node.items() if k in KEYWORDS}
+        if 'description' in node:_text(node['description'])
+        if 'object' in kinds:
+            if type(node.get('additionalProperties'))is not bool or not isinstance(node.get('properties'),dict):bad()
+            if len(node['properties'])>MAX_ITEMS:bad()
+            props={}
+            for key,child in node['properties'].items():
+                _text(key,256)
+                if SECRET_KEY.search(key):bad()
+                props[key]=shape(child,depth+1)
+            required=node.get('required',[])
+            if not isinstance(required,list) or any(not isinstance(k,str) or k not in props for k in required):bad()
+            if len(required)!=len(set(required)):bad()
+            clean['properties']=props;clean['required']=required
+        if 'array' in kinds:
+            if type(node.get('maxItems'))is not int or not 0<=node['maxItems']<=MAX_ITEMS:bad()
+            clean['items']=shape(node.get('items'),depth+1)
+        if 'string' in kinds and (type(node.get('maxLength'))is not int or not 0<=node['maxLength']<=8192):bad()
+        if 'enum' in node:
+            if not isinstance(node['enum'],list) or len(node['enum'])>100:bad()
+            if any(type(item) not in (type(None),bool,int,float,str) for item in node['enum']):bad()
+            for item in node['enum']:
+                if isinstance(item,str):_text(item)
+                if type(item) in (int,float) and (not -1e100<=item<=1e100 or not math.isfinite(item)):bad()
+        for key in ('minimum','maximum'):
+            if key in node and (type(node[key])not in (int,float) or not -1e100<=node[key]<=1e100 or not math.isfinite(node[key])):bad()
+        return clean
+    result={key:value[key] for key in CONTRACT_FIELDS}
+    result['data_schema']=shape(value['data_schema'])
+    if len(encoded(result))>256*1024:bad('Core report schema exceeds the supported metadata size.')
+    return result
+
+
+def data(value, schema, *, secrets=()):
+    """Copy and validate types, sizes and declared fields. No string reinterpretation."""
+    budget=[0]
+    dynamic={'type':list(KINDS),'properties':{},'additionalProperties':True,'maxItems':MAX_ITEMS,'maxLength':8192}
+    dynamic['items']=dynamic
+    def walk(item,node,depth=0):
+        budget[0]+=1
+        if depth>MAX_DEPTH or budget[0]>MAX_NODES:bad('Core report exceeds its structural bounds.')
+        kind=('null' if item is None else 'boolean' if type(item)is bool else 'integer' if type(item)is int
+              else 'number' if type(item)is float else 'string' if type(item)is str
+              else 'object' if type(item)is dict else 'array' if type(item)is list else 'invalid')
+        kinds=node['type'] if isinstance(node['type'],list) else [node['type']]
+        if kind not in kinds and not(kind=='integer' and 'number' in kinds):bad()
+        if 'enum' in node and not any(item==v and (type(item)is type(v) or type(item)in(int,float) and type(v)in(int,float)) for v in node['enum']):bad()
+        if kind=='object':
+            if len(item)>MAX_ITEMS:bad()
+            props=node['properties']
+            if (not node['additionalProperties'] and set(item)-set(props)) or set(node.get('required',[]))-set(item):bad()
+            result={}
+            for key,val in item.items():
+                _text(key,256)
+                if (SECRET_KEY.search(key) and val!='[REDACTED]') or any(s and s in key for s in secrets):bad('Core report contained disallowed sensitive content.')
+                result[key]=walk(val,props.get(key,dynamic),depth+1)
+            return result
+        if kind=='array':
+            if len(item)>node['maxItems']:bad()
+            return [walk(v,node['items'],depth+1) for v in item]
+        if kind=='string':
+            _text(item,node['maxLength'])
+            if any(s and s in item for s in secrets):bad('Core report contained a supplied credential value.')
+        if kind in ('integer','number'):
+            if not node.get('minimum',-1e100)<=item<=node.get('maximum',1e100) or not math.isfinite(item):bad()
+        return item
+    return walk(value,schema)
+
+
+def operation_result(value, declaration=UNSPECIFIED, *, targets=(), check=None, secrets=()):
+    """Project only public fields and bind every report to the reviewed contract."""
+    if value is None:
+        if declaration not in (None,UNSPECIFIED):bad('Declared report accounting is absent from the final Core result.')
+        return None
+    if declaration is None:bad('Core returned an undeclared operation report.')
+    if declaration is UNSPECIFIED:bad('A reviewed result contract is required to accept operation reports.')
+    decl=contract(declaration)
+    if not isinstance(value,dict):bad()
+    for key,expect in (('protocol',PROTOCOL),('schema',decl['schema']),('scope',decl['scope']),('required',decl['required'])):
+        if value.get(key)!=expect or key=='required' and type(value.get(key))is not bool:bad()
+    if type(value.get('complete'))is not bool or type(value.get('check_mode'))is not bool:bad()
+    if check is not None and value['check_mode'] is not check:bad('Core report mode differs from the reviewed request.')
+    hosts=value.get('hosts')
+    if not isinstance(hosts,dict) or len(hosts)>1000:bad()
+    if decl['scope']=='per_host':
+        if set(hosts)!=set(targets) or len(hosts)!=len(targets) or value.get('global')is not None:bad('Core report hosts differ from the reviewed targets.')
+        slots=hosts
+    else:
+        if hosts or not isinstance(value.get('global'),dict):bad()
+        slots={'':value['global']}
+    cleaned={};total=0
+    for host,entry in slots.items():
+        if (not isinstance(entry,dict) or entry.get('schema')!=decl['schema'] or not isinstance(entry.get('status'),str) or entry.get('status')not in AVAILABILITY
+                or entry.get('error') is not None and (not isinstance(entry.get('error'),str) or entry.get('error')not in REPORT_ERRORS)):bad()
+        content=None
+        if entry['status']=='available':
+            if entry.get('error')is not None:bad()
+            content=data(entry.get('data'),decl['data_schema'],secrets=secrets)
+            size=len(encoded({'protocol':PUBLISHER,'schema':decl['schema'],'data':content}))
+            total+=size
+            if size>decl['max_bytes_per_host'] or total>RUN_BYTES:bad('Core operation report exceeded its advertised byte limits.')
+        elif entry.get('data')is not None:bad('Unavailable report slots must not carry data.')
+        cleaned[host]={'schema':decl['schema'],'status':entry['status'],'data':content,'error':entry.get('error')}
+    if value['complete'] and any(v['status']!='available' for v in cleaned.values()):bad()
+    return {'protocol':PROTOCOL,'schema':decl['schema'],'scope':decl['scope'],'required':decl['required'],
+            'complete':value['complete'],'check_mode':value['check_mode'],
+            'hosts':cleaned if decl['scope']=='per_host' else {},'global':cleaned.get('') if decl['scope']=='global' else None}
diff --git a/scripts/addons/webgui/src/aim_webgui/credentials/__init__.py b/scripts/addons/webgui/src/aim_webgui/credentials/__init__.py
new file mode 100644
index 0000000..423f51e
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/credentials/__init__.py
@@ -0,0 +1 @@
+"""Job-scoped credentials. No durable secret store or cross-run cache."""
diff --git a/scripts/addons/webgui/src/aim_webgui/credentials/presentation.py b/scripts/addons/webgui/src/aim_webgui/credentials/presentation.py
new file mode 100644
index 0000000..78de64a
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/credentials/presentation.py
@@ -0,0 +1,77 @@
+"""Non-secret credential/attention presentation. Never prepares or runs Core work."""
+from __future__ import annotations
+
+import json
+import time
+
+from aim_webgui.errors import WebError
+from aim_webgui.workflows import Workflows, actor, allowed
+
+SUPPORTED = frozenset({'vault_password', 'connection_password',
+                       'ssh_key_passphrase', 'ssh_key_passphrase_or_customer_vault_value'})
+
+
+def form_context(job: dict, *, now: int | None = None) -> dict:
+    requirements = job['plan'].get('credential_requirements', [])
+    if not isinstance(requirements, list) or not requirements or any(r not in SUPPORTED for r in requirements):
+        raise WebError('unsupported_credentials', 'This run needs credentials not supported by this form. Review the job.', 409)
+    return {'job': job, 'credential_requirements': requirements,
+            'credential_server_now': int(time.time()) if now is None else now,
+            'has_vault': 'vault_password' in requirements,
+            'has_connection': 'connection_password' in requirements,
+            'has_key': any(r.startswith('ssh_key_passphrase') for r in requirements),
+            'key_from_vault': ('vault_password' in requirements
+                               and 'ssh_key_passphrase_or_customer_vault_value' in requirements
+                               and 'ssh_key_passphrase' not in requirements)}
+
+
+def status(flow: Workflows, user_id: int, ident: str) -> dict:
+    """Owner-only status, not an eligibility token or an execution/renewal action."""
+    job = flow.job(user_id, ident)
+    if job['owner_id'] != user_id:
+        raise WebError('credential_owner', 'Only the requesting account may supply this job\'s credentials.', 403)
+    now = int(time.time())
+    deadline = job.get('credential_deadline') or 0
+    phase = job.get('credential_phase') or ''
+    can_submit = (flow.settings.credentials_enabled and job['status'] == 'running'
+                  and phase == 'waiting' and deadline > now and not job['cancel_requested'])
+    if can_submit:
+        with flow.store.read() as db:
+            allowed(db, user_id, job['plan']['customer'], job['plan']['playbook'])
+    return {'job_id': ident, 'status': job['status'], 'phase': phase,
+            'can_submit': bool(can_submit), 'cancel_requested': bool(job['cancel_requested']),
+            'server_now': now, 'deadline': deadline if phase == 'waiting' else None}
+
+
+def attention(flow: Workflows, user_id: int, *, limit: int = 8) -> dict:
+    """All actionable jobs, not the latest-100 history page. No secrets or Core calls."""
+    now = int(time.time())
+    items = []
+    with flow.store.read() as db:
+        who = actor(db, user_id)
+        rows = db.execute('''SELECT jobs.id, jobs.owner_id, jobs.plan, jobs.mode, jobs.status,
+            jobs.credential_deadline, jobs.created_at, users.username
+            FROM jobs JOIN users ON users.id=jobs.owner_id
+            WHERE jobs.cancel_requested=0 AND (
+              (jobs.owner_id=? AND jobs.status='running' AND jobs.credential_phase='waiting'
+               AND jobs.credential_deadline>?) OR
+              (?='admin' AND jobs.owner_id<>? AND jobs.status='pending'))
+            ORDER BY CASE WHEN jobs.status='running' THEN 0 ELSE 1 END,
+                     jobs.credential_deadline, jobs.created_at''', (user_id, now, who['role'], user_id))
+        for row in rows:
+            credential = row['status'] == 'running'
+            if credential and not flow.settings.credentials_enabled:
+                continue
+            plan = json.loads(row['plan'])
+            try:
+                allowed(db, row['owner_id'], plan['customer'], plan['playbook'])
+            except WebError:
+                continue
+            items.append({'id': row['id'], 'customer': plan['customer'], 'playbook': plan['playbook'],
+                          'username': row['username'], 'mode': row['mode'],
+                          'target_count': len(plan.get('targets', [])),
+                          'kind': 'credentials' if credential else 'approval',
+                          'deadline': row['credential_deadline'] if credential else None})
+    return {'items': items[:limit], 'total': len(items), 'shown': min(limit, len(items)),
+            'credentials': sum(i['kind'] == 'credentials' for i in items),
+            'approvals': sum(i['kind'] == 'approval' for i in items)}
diff --git a/scripts/addons/webgui/src/aim_webgui/credentials/service.py b/scripts/addons/webgui/src/aim_webgui/credentials/service.py
new file mode 100644
index 0000000..02a9c52
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/credentials/service.py
@@ -0,0 +1,67 @@
+"""HTTP-to-worker hand-off. Never retain secrets awaiting a queue slot."""
+from __future__ import annotations
+import json
+import time
+
+from aim_webgui.credentials import wire
+from aim_webgui.errors import WebError
+from aim_webgui.workflows import Workflows, allowed
+
+HANDOFF_SECONDS = 60
+WAIT_SECONDS = 300
+
+
+def fields(value, requirements):
+    """Core-reported one-run fields only. Passwords are literal, not overrides."""
+    from aim_webgui.core.protocol import validate_secrets
+    result=validate_secrets(value)
+    permitted=set(requirements)-{'ssh_key_passphrase_or_customer_vault_value'}
+    if 'ssh_key_passphrase_or_customer_vault_value' in requirements:permitted.add('ssh_key_passphrase')
+    if set(result)-permitted:raise WebError('unexpected_credentials','Only fields requested by this prepared core run may be supplied.')
+    for name in ('vault_password','connection_password','ssh_key_passphrase'):
+        if name in requirements and not result.get(name):
+            raise WebError('credential_required','Enter the required one-run credential; values are not saved.')
+    if ('ssh_key_passphrase_or_customer_vault_value' in requirements and not result.get('vault_password')
+            and not result.get('ssh_key_passphrase')):
+        raise WebError('credential_required','Enter the key passphrase or unlock the customer Vault containing it.')
+    return result
+
+
+def valid_session(flow, token_hash, user_id):
+    now = int(time.time())
+    with flow.store.read() as db:
+        row = db.execute('SELECT * FROM sessions WHERE token_hash=? AND user_id=?', (token_hash, user_id)).fetchone()
+        if not row or row['expires_at'] <= now or row['last_seen_at'] + flow.settings.idle_minutes * 60 <= now:
+            raise WebError('session_expired', 'Sign in again before submitting credentials.', 403)
+
+
+def eligible(flow, user_id, ident):
+    if not flow.settings.credentials_enabled:
+        raise WebError('credentials_disabled', 'Credential execution is disabled in this release profile.', 501)
+    job = flow.job(user_id, ident)
+    if job['owner_id'] != user_id:
+        raise WebError('credential_owner', 'Only the requesting account may supply this job\'s credentials.', 403)
+    if (job['status'] != 'running' or job['credential_phase'] != 'waiting'
+            or (job['credential_deadline'] or 0) <= time.time() or job['cancel_requested']):
+        raise WebError('worker_not_ready', 'Credentials are accepted only while this job is awaiting credentials.', 409)
+    with flow.store.read() as db:
+        allowed(db, user_id, job['plan']['customer'], job['plan']['playbook'])
+    return job
+
+
+def submit(settings, user_id, session_hash, ident, supplied):
+    flow = Workflows(settings)
+    job = eligible(flow, user_id, ident)
+    valid_session(flow, session_hash, user_id)
+    secret = fields(supplied, job['plan']['credential_requirements'])
+    try:
+        with wire.connect(settings.state_dir / '.credential.sock') as sock:
+            wire.send(sock, {'job': ident, 'user': user_id, 'session': session_hash, 'credentials': secret}, wire.SECRET_LIMIT)
+            result = wire.receive(sock, wire.SECRET_LIMIT)
+        if result.get('accepted') is not True:
+            raise WebError('credential_rejected', 'The worker did not accept this credential hand-off. Check the job before another manual attempt.', 409)
+        return {'accepted': True, 'notice': 'One-run hand-off accepted; this is not remote authentication verification.'}
+    except (OSError, ValueError):
+        raise WebError('worker_not_ready', 'The credential hand-off could not be confirmed. Check the job state before another manual attempt; do not resubmit automatically.', 409) from None
+    finally:
+        secret.clear()
diff --git a/scripts/addons/webgui/src/aim_webgui/credentials/wire.py b/scripts/addons/webgui/src/aim_webgui/credentials/wire.py
new file mode 100644
index 0000000..ac6df25
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/credentials/wire.py
@@ -0,0 +1,78 @@
+"""Bounded, length-framed local IPC. This module uses only the standard library."""
+from __future__ import annotations
+import json
+import os
+import socket
+import stat
+import struct
+
+MAX_MESSAGE = 1024 * 1024
+SECRET_LIMIT = 8192
+
+
+def recv_exact(sock, size):
+    buf = bytearray()
+    while len(buf) < size:
+        chunk = sock.recv(size - len(buf))
+        if not chunk:
+            raise ValueError('Credential channel closed.')
+        buf.extend(chunk)
+    return bytes(buf)
+
+
+def receive(sock, limit=MAX_MESSAGE, *, decoder=json.loads):
+    size = struct.unpack('!I', recv_exact(sock, 4))[0]
+    if size < 2 or size > limit:
+        raise ValueError('Credential message exceeds its limit.')
+    result = decoder(recv_exact(sock, size))
+    if not isinstance(result, dict):
+        raise ValueError('Invalid credential message.')
+    return result
+
+
+def send(sock, value, limit=MAX_MESSAGE):
+    data = json.dumps(value, ensure_ascii=False, allow_nan=False, separators=(',', ':')).encode('utf-8')
+    if len(data) > limit:
+        raise ValueError('Credential message exceeds its limit.')
+    sock.sendall(struct.pack('!I', len(data)) + data)
+
+
+def peer(sock, *, same_group=False):
+    pid, uid, gid = struct.unpack('3i', sock.getsockopt(socket.SOL_SOCKET, socket.SO_PEERCRED, 12))
+    if uid != os.geteuid() or (same_group and os.getpgid(pid) != os.getpgrp()):
+        raise ValueError('Untrusted local credential peer.')
+    return pid
+
+
+def connect(path, *, timeout=5):
+    item = os.lstat(path)
+    if not stat.S_ISSOCK(item.st_mode) or item.st_uid != os.geteuid() or item.st_mode & 0o077:
+        raise ValueError('Credential endpoint must be private and service-owned.')
+    sock = socket.socket(socket.AF_UNIX)
+    sock.settimeout(timeout)
+    try:
+        sock.connect(str(path))
+        peer(sock)
+    except BaseException:
+        sock.close()
+        raise
+    return sock
+
+
+def listen(path):
+    # Caller owns a private directory. Never follow/delete an arbitrary symlink.
+    if os.path.lexists(path):
+        item = os.lstat(path)
+        if not stat.S_ISSOCK(item.st_mode) or item.st_uid != os.geteuid():
+            raise ValueError('Unsafe existing credential endpoint.')
+        os.unlink(path)
+    sock = socket.socket(socket.AF_UNIX)
+    try:
+        sock.bind(str(path))
+        os.chmod(path, 0o600)
+        sock.listen(2)
+        sock.settimeout(.5)
+    except BaseException:
+        sock.close()
+        raise
+    return sock
diff --git a/roles/checkmk_scripts/files/Windows/local/citrix_sessions_customized.ps1.example b/scripts/addons/webgui/src/aim_webgui/db/__init__.py
similarity index 100%
rename from roles/checkmk_scripts/files/Windows/local/citrix_sessions_customized.ps1.example
rename to scripts/addons/webgui/src/aim_webgui/db/__init__.py
diff --git a/scripts/addons/webgui/src/aim_webgui/db/migrations/0001_initial.sql b/scripts/addons/webgui/src/aim_webgui/db/migrations/0001_initial.sql
new file mode 100644
index 0000000..8e3e3a4
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/db/migrations/0001_initial.sql
@@ -0,0 +1,27 @@
+CREATE TABLE metadata (key TEXT PRIMARY KEY, value TEXT NOT NULL);
+CREATE TABLE users (
+ id INTEGER PRIMARY KEY,
+ username TEXT NOT NULL UNIQUE COLLATE NOCASE,
+ password_hash TEXT NOT NULL,
+ role TEXT NOT NULL CHECK(role IN ('admin','viewer')),
+ enabled INTEGER NOT NULL DEFAULT 1 CHECK(enabled IN (0,1)),
+ must_change_password INTEGER NOT NULL DEFAULT 1 CHECK(must_change_password IN (0,1)),
+ created_at INTEGER NOT NULL,
+ updated_at INTEGER NOT NULL,
+ last_login_at INTEGER
+);
+CREATE TABLE sessions (
+ token_hash TEXT PRIMARY KEY,
+ user_id INTEGER REFERENCES users(id) ON DELETE CASCADE,
+ csrf TEXT NOT NULL,
+ created_at INTEGER NOT NULL,
+ expires_at INTEGER NOT NULL,
+ last_seen_at INTEGER NOT NULL
+);
+CREATE INDEX sessions_user ON sessions(user_id);
+CREATE INDEX sessions_expiry ON sessions(expires_at);
+CREATE TABLE rate_limits (bucket TEXT PRIMARY KEY, started INTEGER NOT NULL, attempts INTEGER NOT NULL);
+CREATE TABLE audit (
+ id INTEGER PRIMARY KEY, occurred_at INTEGER NOT NULL,
+ actor TEXT NOT NULL, action TEXT NOT NULL, subject TEXT NOT NULL
+);
diff --git a/scripts/addons/webgui/src/aim_webgui/db/migrations/0002_workflows.sql b/scripts/addons/webgui/src/aim_webgui/db/migrations/0002_workflows.sql
new file mode 100644
index 0000000..b0f273c
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/db/migrations/0002_workflows.sql
@@ -0,0 +1,54 @@
+CREATE TABLE plans (
+ id TEXT PRIMARY KEY,
+ owner_id INTEGER NOT NULL REFERENCES users(id),
+ name TEXT NOT NULL,
+ customer TEXT NOT NULL,
+ playbook TEXT NOT NULL,
+ payload TEXT NOT NULL,
+ created_at INTEGER NOT NULL
+);
+CREATE INDEX plans_owner ON plans(owner_id, created_at);
+CREATE TABLE grants (
+ user_id INTEGER NOT NULL REFERENCES users(id),
+ customer TEXT NOT NULL,
+ playbook TEXT NOT NULL,
+ PRIMARY KEY(user_id, customer, playbook)
+);
+CREATE TABLE jobs (
+ id TEXT PRIMARY KEY,
+ owner_id INTEGER NOT NULL REFERENCES users(id),
+ approver_id INTEGER REFERENCES users(id),
+ plan TEXT NOT NULL,
+ mode TEXT NOT NULL CHECK(mode IN ('apply','check')),
+ status TEXT NOT NULL CHECK(status IN ('pending','queued','running','successful','failed','canceled','timed_out','blocked','interrupted')),
+ created_at INTEGER NOT NULL,
+ scheduled_at INTEGER NOT NULL,
+ started_at INTEGER,
+ finished_at INTEGER,
+ return_code INTEGER,
+ cancel_requested INTEGER NOT NULL DEFAULT 0,
+ reason TEXT NOT NULL DEFAULT ''
+);
+CREATE INDEX jobs_due ON jobs(status, scheduled_at);
+CREATE TABLE job_events (
+ id INTEGER PRIMARY KEY,
+ job_id TEXT NOT NULL REFERENCES jobs(id),
+ occurred_at INTEGER NOT NULL,
+ event TEXT NOT NULL
+);
+CREATE INDEX events_job ON job_events(job_id, id);
+CREATE TABLE selection_drafts (
+ user_id INTEGER NOT NULL REFERENCES users(id),
+ customer TEXT NOT NULL,
+ playbook TEXT NOT NULL,
+ targets TEXT NOT NULL,
+ updated_at INTEGER NOT NULL,
+ PRIMARY KEY(user_id, customer, playbook)
+);
+CREATE INDEX audit_time ON audit(occurred_at, id);
+CREATE TABLE job_requests (
+ owner_id INTEGER NOT NULL REFERENCES users(id),
+ request_key TEXT NOT NULL,
+ job_id TEXT NOT NULL REFERENCES jobs(id),
+ PRIMARY KEY(owner_id,request_key)
+);
diff --git a/scripts/addons/webgui/src/aim_webgui/db/migrations/0003_credentials.sql b/scripts/addons/webgui/src/aim_webgui/db/migrations/0003_credentials.sql
new file mode 100644
index 0000000..790c016
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/db/migrations/0003_credentials.sql
@@ -0,0 +1,3 @@
+-- Non-secret phase metadata only. Passwords never enter this database.
+ALTER TABLE jobs ADD COLUMN credential_phase TEXT NOT NULL DEFAULT 'none';
+ALTER TABLE jobs ADD COLUMN credential_deadline INTEGER;
diff --git a/scripts/addons/webgui/src/aim_webgui/db/migrations/0004_core_v1.sql b/scripts/addons/webgui/src/aim_webgui/db/migrations/0004_core_v1.sql
new file mode 100644
index 0000000..9c30464
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/db/migrations/0004_core_v1.sql
@@ -0,0 +1,19 @@
+-- Additive migration. Keep historical jobs, accounts, grants, plans and audit.
+ALTER TABLE plans ADD COLUMN name_key TEXT;
+CREATE UNIQUE INDEX plan_names_unique ON plans(owner_id,name_key) WHERE name_key IS NOT NULL;
+ALTER TABLE job_requests ADD COLUMN request_hash TEXT;
+ALTER TABLE jobs ADD COLUMN core_result TEXT;
+CREATE TABLE run_reviews (
+    id TEXT PRIMARY KEY,
+    owner_id INTEGER NOT NULL REFERENCES users(id),
+    payload TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL
+);
+CREATE INDEX review_owner_expiry ON run_reviews(owner_id,expires_at);
+INSERT INTO audit(occurred_at,actor,action,subject)
+SELECT CAST(strftime('%s','now') AS INTEGER),'migration','legacy-job-stopped',id FROM jobs WHERE status IN ('pending','queued','running');
+UPDATE jobs SET status=CASE WHEN status='running' THEN 'interrupted' ELSE 'blocked' END,
+ finished_at=CAST(strftime('%s','now') AS INTEGER),credential_phase='released',credential_deadline=NULL,
+ reason='Core API migration: this old-core job was not replayed. Review a new run against AIM 3.1.0.'
+ WHERE status IN ('pending','queued','running');
diff --git a/scripts/addons/webgui/src/aim_webgui/db/migrations/0005_job_evidence.sql b/scripts/addons/webgui/src/aim_webgui/db/migrations/0005_job_evidence.sql
new file mode 100644
index 0000000..b34df39
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/db/migrations/0005_job_evidence.sql
@@ -0,0 +1,36 @@
+-- Retained WebGUI-owned evidence. No raw output, credential or inventory archive.
+CREATE TABLE job_progress_state (
+ job_id TEXT PRIMARY KEY REFERENCES jobs(id) ON DELETE CASCADE,
+ run_id TEXT, capture_state TEXT NOT NULL DEFAULT 'recording',
+ cursor INTEGER NOT NULL DEFAULT 0, last_sequence INTEGER NOT NULL DEFAULT 0,
+ retained_events INTEGER NOT NULL DEFAULT 0, retained_bytes INTEGER NOT NULL DEFAULT 0,
+ omitted_events INTEGER NOT NULL DEFAULT 0, dropped_events INTEGER NOT NULL DEFAULT 0,
+ checkpoint TEXT NOT NULL DEFAULT '{}', updated_at REAL NOT NULL, closed_at REAL
+);
+CREATE TABLE job_progress_events (
+ job_id TEXT NOT NULL REFERENCES jobs(id) ON DELETE CASCADE, cursor INTEGER NOT NULL,
+ run_id TEXT NOT NULL, sequence INTEGER NOT NULL, received_at REAL NOT NULL,
+ payload TEXT NOT NULL, size_bytes INTEGER NOT NULL,
+ PRIMARY KEY(job_id,cursor), UNIQUE(job_id,run_id,sequence)
+);
+CREATE TABLE job_operation_results (
+ job_id TEXT PRIMARY KEY REFERENCES jobs(id) ON DELETE CASCADE,
+ contract TEXT, protocol TEXT, schema_id TEXT, scope TEXT,
+ required INTEGER, complete INTEGER, check_mode INTEGER, stored_at REAL NOT NULL,
+ retention_policy TEXT NOT NULL
+);
+CREATE TABLE job_operation_reports (
+ job_id TEXT NOT NULL REFERENCES jobs(id) ON DELETE CASCADE,
+ slot TEXT NOT NULL, schema_id TEXT NOT NULL, status TEXT NOT NULL, error TEXT,
+ retention TEXT NOT NULL, data TEXT, size_bytes INTEGER NOT NULL DEFAULT 0,
+ PRIMARY KEY(job_id,slot)
+);
+-- Never replay plans prepared against the old independently upgraded Core.
+INSERT INTO audit(occurred_at,actor,action,subject)
+ SELECT CAST(strftime('%s','now') AS INTEGER),'migration','core33-job-stopped',id
+ FROM jobs WHERE status IN ('pending','queued','running');
+UPDATE jobs SET status=CASE WHEN status='running' THEN 'interrupted' ELSE 'blocked' END,
+ finished_at=CAST(strftime('%s','now') AS INTEGER),credential_phase='released',credential_deadline=NULL,
+ reason='Core 3.3 migration: old prepared work was not replayed. Review a fresh run.'
+ WHERE status IN ('pending','queued','running');
+DELETE FROM run_reviews;
diff --git a/scripts/addons/webgui/src/aim_webgui/db/store.py b/scripts/addons/webgui/src/aim_webgui/db/store.py
new file mode 100644
index 0000000..2572171
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/db/store.py
@@ -0,0 +1,149 @@
+from __future__ import annotations
+
+from contextlib import contextmanager
+import os
+from pathlib import Path
+import sqlite3
+import stat
+import time
+
+from aim_webgui import SCHEMA_VERSION
+
+
+def private_file(path: Path, content: str, *, exclusive: bool = True) -> None:
+    flags = os.O_WRONLY | os.O_CREAT | os.O_NOFOLLOW
+    flags |= os.O_EXCL if exclusive else os.O_TRUNC
+    fd = os.open(path, flags, 0o600)
+    with os.fdopen(fd, 'w', encoding='utf-8') as stream:
+        os.fchmod(stream.fileno(), 0o600)
+        stream.write(content)
+        stream.flush()
+        os.fsync(stream.fileno())
+
+
+def ensure_private_dir(path: Path) -> None:
+    path.mkdir(parents=True, mode=0o700, exist_ok=True)
+    mode = path.lstat()
+    if not stat.S_ISDIR(mode.st_mode) or mode.st_uid != os.geteuid():
+        raise ValueError('State directory must be a real directory owned by the current service identity.')
+    if stat.S_IMODE(mode.st_mode) & 0o077:
+        raise ValueError('State directory must have mode 0700.')
+
+
+class Store:
+    def __init__(self, path: Path):
+        self.path = path
+
+    def connect(self, *, create: bool = False, timeout: float = 10) -> sqlite3.Connection:
+        ensure_private_dir(self.path.parent)
+        if create and not self.path.exists():
+            fd = os.open(self.path, os.O_CREAT | os.O_EXCL | os.O_WRONLY | os.O_NOFOLLOW, 0o600)
+            os.close(fd)
+        mode = self.path.lstat()
+        if (not stat.S_ISREG(mode.st_mode) or mode.st_uid != os.geteuid()
+                or stat.S_IMODE(mode.st_mode) & 0o077):
+            raise ValueError('Database must be a service-owned regular file with mode 0600.')
+        db = sqlite3.connect(self.path.as_uri() + '?mode=rw', uri=True, timeout=timeout)
+        db.row_factory = sqlite3.Row
+        db.execute('PRAGMA foreign_keys=ON')
+        db.execute(f'PRAGMA busy_timeout={max(0,int(timeout * 1000))}')
+        # Retain rollback journaling and FULL commits; evidence uses bounded batches.
+        db.execute('PRAGMA synchronous=FULL')
+        return db
+
+    @contextmanager
+    def transaction(self, *, timeout: float = 10):
+        db = self.connect(timeout=timeout)
+        try:
+            db.execute('BEGIN IMMEDIATE')
+            yield db
+            db.commit()
+        except BaseException:
+            db.rollback()
+            raise
+        finally:
+            db.close()
+
+    @contextmanager
+    def read(self):
+        db = self.connect()
+        try:
+            yield db
+        finally:
+            db.close()
+
+    def migrate(self, *, create: bool = False) -> None:
+        db = self.connect(create=create)
+        try:
+            db.execute('PRAGMA journal_mode=DELETE')
+            db.execute('BEGIN IMMEDIATE')
+            version = db.execute('PRAGMA user_version').fetchone()[0]
+            if version > SCHEMA_VERSION:
+                raise ValueError('Database schema is newer than this add-on. Restore the matched backup before rollback.')
+            for target in range(version + 1, SCHEMA_VERSION + 1):
+                matches = list((Path(__file__).parent / 'migrations').glob(f'{target:04d}_*.sql'))
+                if len(matches) != 1:
+                    raise ValueError('Missing or ambiguous database migration.')
+                statement = ''
+                for line in matches[0].read_text(encoding='utf-8').splitlines(True):
+                    statement += line
+                    if sqlite3.complete_statement(statement):
+                        db.execute(statement)
+                        statement = ''
+                if statement.strip():
+                    raise ValueError('Incomplete database migration.')
+                if target == 4:
+                    from aim_webgui.names import name_key
+                    seen=set()
+                    for row in db.execute('SELECT id,owner_id,name FROM plans ORDER BY created_at,id').fetchall():
+                        key=(row['owner_id'],name_key(row['name']))
+                        # Preserve existing duplicate titles/payloads unchanged. First
+                        # occurrence reserves the key; new saves also check all legacy names.
+                        if key not in seen:
+                            db.execute('UPDATE plans SET name_key=? WHERE id=?',(key[1],row['id']))
+                            seen.add(key)
+                db.execute(f'PRAGMA user_version={target}')
+            db.commit()
+        except BaseException:
+            db.rollback()
+            raise
+        finally:
+            db.close()
+
+    def check(self, *, require_admin: bool = True) -> None:
+        with self.read() as db:
+            if db.execute('PRAGMA user_version').fetchone()[0] != SCHEMA_VERSION:
+                raise ValueError('Database migration required. Stop the service and run aim-web db migrate.')
+            if db.execute("SELECT value FROM metadata WHERE key='initialized'").fetchone() is None:
+                raise ValueError('Database not initialized. Run aim-web init once.')
+            if require_admin and not db.execute("SELECT 1 FROM users WHERE role='admin' AND enabled=1 LIMIT 1").fetchone():
+                raise ValueError('No enabled administrator; use local recovery.')
+
+    def backup(self, destination: Path) -> None:
+        if destination.exists() or destination.is_symlink():
+            raise ValueError('Backup destination already exists.')
+        fd = os.open(destination, os.O_CREAT | os.O_EXCL | os.O_WRONLY | os.O_NOFOLLOW, 0o600)
+        os.close(fd)
+        try:
+            with self.read() as source:
+                target = sqlite3.connect(destination)
+                try:
+                    source.backup(target)
+                    if target.execute('PRAGMA integrity_check').fetchone()[0] != 'ok':
+                        raise ValueError('Database backup integrity check failed.')
+                finally:
+                    target.close()
+            fd = os.open(destination, os.O_RDONLY | os.O_NOFOLLOW)
+            try:
+                os.fsync(fd)
+            finally:
+                os.close(fd)
+        except BaseException:
+            destination.unlink(missing_ok=True)
+            raise
+
+
+def audit(db, actor: str, action: str, subject: str) -> None:
+    # Fixed event names and account identifiers only; never request bodies/credentials.
+    db.execute('INSERT INTO audit(occurred_at,actor,action,subject) VALUES(?,?,?,?)',
+               (int(time.time()), actor, action, subject))
diff --git a/scripts/addons/webgui/src/aim_webgui/diagnostics.py b/scripts/addons/webgui/src/aim_webgui/diagnostics.py
new file mode 100644
index 0000000..d7f40b9
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/diagnostics.py
@@ -0,0 +1,45 @@
+"""Read-only diagnostics. No automatic repairs, ownership changes or secrets."""
+from __future__ import annotations
+
+import os
+from pathlib import Path
+import time
+from aim_webgui import __version__, SCHEMA_VERSION, COMPATIBLE_AIM
+from aim_webgui.config import Settings
+from aim_webgui.db.store import Store
+
+
+def report(settings: Settings, config: Path | None = None) -> dict:
+    checks = []
+    def check(name, operation):
+        try:
+            value = operation()
+            checks.append({'name': name, 'ok': True, 'detail': str(value)})
+        except Exception as exc:
+            checks.append({'name': name, 'ok': False, 'detail': type(exc).__name__ + ': check service identity, permissions or installed dependencies.'})
+    check('configuration', lambda: settings.validate() and 'Valid')
+    from aim_webgui.adapters.core_v1 import CoreAdapter
+    check('AIM service contract',lambda:CoreAdapter(settings).version)
+    check('Core protected metadata access',lambda:len(CoreAdapter(settings).customers()))
+    check('Core execution opt-in',lambda:CoreAdapter(settings).capabilities['execution'])
+    from aim_webgui.assets import check_assets
+    check('local browser assets', lambda: check_assets() or 'Verified')
+    store = Store(settings.database)
+    check('database schema and enabled administrator', lambda: store.check() or f'Schema {SCHEMA_VERSION}')
+    heartbeat = None
+    try:
+        with store.read() as db:
+            row = db.execute("SELECT value FROM metadata WHERE key='worker_heartbeat'").fetchone()
+            heartbeat = max(0, int(time.time()) - int(row[0])) if row else None
+    except Exception:
+        pass
+    if settings.execution_enabled:
+        checks.append({'name': 'worker heartbeat', 'ok': heartbeat is not None and heartbeat < 15, 'detail': f'{heartbeat}s ago' if heartbeat is not None else 'Worker has not reported'})
+    return {'version': __version__, 'aim_compatibility': list(COMPATIBLE_AIM), 'schema': SCHEMA_VERSION,
+            'config': str(config) if config else '(provided at startup)',
+            'runtime': str(Path(__file__).resolve().parent), 'service_uid': os.geteuid(),'core_transport':settings.core_transport,'core_executor_user':settings.core_executor_user,
+            'listener': f'{settings.host}:{settings.port}', 'public_url': settings.public_url,
+            'trusted_proxies': list(settings.forwarded_allow_ips), 'execution_enabled': settings.execution_enabled,
+            'worker_heartbeat_age_seconds': heartbeat, 'checks': checks,
+            'ok': all(c['ok'] for c in checks),
+            'transport_note': 'TLS verification between NPM and controller must be checked in Nginx; this application cannot prove it.'}
diff --git a/scripts/addons/webgui/src/aim_webgui/errors.py b/scripts/addons/webgui/src/aim_webgui/errors.py
new file mode 100644
index 0000000..15ca05f
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/errors.py
@@ -0,0 +1,5 @@
+class WebError(Exception):
+    """Only this deliberately public message may be returned to a browser."""
+    def __init__(self, code: str, message: str, status: int = 400):
+        super().__init__(message)
+        self.code, self.message, self.status = code, message, status
diff --git a/scripts/addons/webgui/src/aim_webgui/evidence_views.py b/scripts/addons/webgui/src/aim_webgui/evidence_views.py
new file mode 100644
index 0000000..5335a46
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/evidence_views.py
@@ -0,0 +1,102 @@
+"""Authorized read/replay endpoints for WebGUI-owned execution evidence."""
+from __future__ import annotations
+import asyncio
+import json
+import time
+from urllib.parse import urlencode
+from fastapi import Request
+from fastapi.responses import JSONResponse, StreamingResponse
+from starlette.concurrency import run_in_threadpool
+from aim_webgui.errors import WebError
+from aim_webgui.journal import Journal
+from aim_webgui.reports import Reports, presentation
+from aim_webgui.workflows import Workflows
+
+
+def job_evidence(settings,user_id,ident):
+    return {'progress':Journal(settings).snapshot(user_id,ident),'reports':Reports(settings).index(user_id,ident)}
+
+
+def install_evidence_views(app,settings,auth,render):
+    journal=Journal(settings);reports=Reports(settings);flow=Workflows(settings)
+    def uid(request):return request.state.session['user_id']
+
+    @app.get('/api/v2/runs/{ident}/progress')
+    async def progress(request: Request,ident: str,after: int|None=None,before: int|None=None,limit: int=200):
+        return await run_in_threadpool(journal.snapshot,uid(request),ident,after=after,before=before,limit=limit)
+
+    @app.get('/jobs/{ident}/progress')
+    async def progress_page(request: Request,ident: str,before: int|None=None):
+        data=await run_in_threadpool(journal.snapshot,uid(request),ident,before=before)
+        job=await run_in_threadpool(flow.job,uid(request),ident)
+        return render(request,'pages/progress.html',title='Recorded execution progress',nav='jobs',job=job,progress=data)
+
+    @app.get('/api/v2/runs/{ident}/progress/stream')
+    @app.get('/api/v2/runs/{ident}/console')
+    async def stream_progress(request: Request,ident: str,after: int=0):
+        value=request.headers.get('Last-Event-ID')
+        if value is not None:
+            if not value.isascii() or not value.isdigit() or len(value)>16:raise WebError('invalid_cursor','Invalid progress cursor.')
+            after=int(value)
+        # Validate cursor and object authorization before streaming headers.
+        initial=await run_in_threadpool(journal.snapshot,uid(request),ident,after=after)
+        async def stream():
+            cursor=after;last_heartbeat=0.;last_snapshot=None;first=initial
+            yield 'retry: 1500\n\n'
+            try:
+                while not await request.is_disconnected():
+                    session=await run_in_threadpool(auth.session,request.cookies.get(settings.cookie_name))
+                    if not session or session.get('user_id')!=uid(request) or session.get('must_change_password'):
+                        yield 'event: end\ndata: {"text":"Session expired or access was revoked.","clear":true}\n\n';return
+                    # Do not hold a DB read transaction while waiting on a browser.
+                    data=first if first is not None else await run_in_threadpool(journal.snapshot,uid(request),ident,after=cursor)
+                    first=None
+                    if data.get('gap_before'):
+                        cursor=data['first_cursor']-1
+                        yield f'id: {cursor}\nevent: gap\ndata: '+json.dumps({'text':'Earlier progress metadata was omitted by the retention limit.','first_cursor':data['first_cursor']})+'\n\n'
+                    metadata={k:v for k,v in data.items() if k not in ('events','has_older','has_more','next_cursor')}
+                    fingerprint=(data['cursor'],data['job_status'],data.get('capture_state'),data.get('dropped_events'),data.get('capture_interrupted'))
+                    if fingerprint!=last_snapshot:
+                        yield 'event: snapshot\ndata: '+json.dumps(metadata,ensure_ascii=False,separators=(',',':'))+'\n\n'
+                        last_snapshot=fingerprint
+                    for item in data['events']:
+                        cursor=item['cursor']
+                        # Legacy console consumers can still render `text`; new clients
+                        # also receive the correlated public metadata. Neither is input.
+                        payload={'text':item['text'],'record':item}
+                        yield f'id: {cursor}\nevent: line\ndata: '+json.dumps(payload,ensure_ascii=False,separators=(',',':'))+'\n\n'
+                    if data['terminal'] and cursor>=data['cursor']:
+                        text=('Execution ended. Recorded metadata and retained reports remain with this job.' if data['available']
+                              else 'No detailed progress was captured for this historical or pre-execution job.')
+                        yield 'event: end\ndata: '+json.dumps({'text':text,'job_status':data['job_status'],'cursor':data['cursor']})+'\n\n';return
+                    if data.get('has_more'):continue
+                    now=time.monotonic()
+                    if now-last_heartbeat>=10:
+                        yield ': heartbeat (transport only, not task activity)\n\n';last_heartbeat=now
+                    await asyncio.sleep(.5)
+            except WebError:
+                yield 'event: end\ndata: {"text":"Job evidence is unavailable or access was revoked.","clear":true}\n\n'
+        return StreamingResponse(stream(),media_type='text/event-stream',headers={
+            'Cache-Control':'no-store','X-Accel-Buffering':'no','Connection':'keep-alive'})
+
+    @app.get('/api/v2/runs/{ident}/reports')
+    async def report_index(request: Request,ident: str):
+        return await run_in_threadpool(reports.index,uid(request),ident)
+
+    @app.get('/_partials/jobs/{ident}/reports')
+    async def report_panel(request: Request,ident: str):
+        return render(request,'partials/reports.html',reports=await run_in_threadpool(reports.index,uid(request),ident))
+
+    @app.get('/jobs/{ident}/reports')
+    async def report_page(request: Request,ident: str,host: str|None=None,field: str='',page: int=1):
+        item=await run_in_threadpool(reports.slot,uid(request),ident,host)
+        index=await run_in_threadpool(reports.index,uid(request),ident)
+        job=await run_in_threadpool(flow.job,uid(request),ident)
+        return render(request,'pages/report.html',title=item['title'],nav='jobs',job=job,item=item,reports=index,
+                      view=presentation(item,field=field,page=page),json_url='/api/v2/runs/'+ident+'/report?'+urlencode({'host':item['slot']}))
+
+    @app.get('/api/v2/runs/{ident}/report')
+    async def report_json(request: Request,ident: str,host: str|None=None):
+        item=await run_in_threadpool(reports.slot,uid(request),ident,host)
+        return JSONResponse({k:item[k] for k in ('schema_id','scope','slot','status','error','retention','data',
+                           'recorded_at','check_mode','complete')},headers={'Cache-Control':'no-store'})
diff --git a/scripts/addons/webgui/src/aim_webgui/explorer.py b/scripts/addons/webgui/src/aim_webgui/explorer.py
new file mode 100644
index 0000000..1074667
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/explorer.py
@@ -0,0 +1,130 @@
+"""Inventory presentation using only the documented Core read operations.
+
+The map is a deterministic focused hierarchy, not a network-topology or health
+map. Path tuples are identities; repeated host membership does not duplicate
+machine counts. No inventory is persisted and no execution endpoint is called.
+"""
+from __future__ import annotations
+import json
+import time
+from urllib.parse import urlencode
+
+from aim_webgui.adapters.core_v1 import CoreAdapter
+from aim_webgui.activity import explorer_url, host_url, text
+from aim_webgui.errors import WebError
+
+
+class Explorer:
+    def __init__(self, settings):
+        self.core = CoreAdapter(settings)
+
+    def snapshot(self, customer: str) -> dict:
+        text(customer)
+        hierarchy = self.core.inventory_hierarchy(customer)
+        # Reuse the same request-local client/capabilities; list_hosts is public.
+        metadata = self.core.client.request('list_hosts', customer=customer)
+        hosts = {x['name']: {'name': x['name'], 'address': x.get('address'),
+                            'platforms': list(x.get('platforms', [])), 'memberships': [],
+                            'url': host_url(customer, x['name'])} for x in metadata}
+        groups = {}; occurrences = 0
+        def build(node, depth):
+            nonlocal occurrences
+            if depth > 64 or len(groups) >= 10000:
+                raise WebError('core_protocol', 'Inventory hierarchy exceeds the documented bounds.', 502)
+            path = tuple(node['path'])
+            if path in groups: raise WebError('core_protocol', 'Core returned duplicate group paths.', 502)
+            group = {'name': node['name'], 'path': list(path), 'direct': sorted(set(node['hosts']), key=str.casefold), 'children': []}
+            groups[path] = group
+            group['children'] = [build(x, depth+1) for x in node['children']]
+            all_hosts = set(group['direct'])
+            for child in group['children']: all_hosts.update(child['members'])
+            group['members'] = all_hosts
+            group['url'] = explorer_url(customer, branch=json.dumps(list(path), separators=(',', ':')))
+            for host in group['direct']:
+                if host not in hosts: raise WebError('inventory_changed', 'Inventory changed during discovery. Refresh to fetch a consistent view.', 409)
+                hosts[host]['memberships'].append({'path': list(path), 'label': ' / '.join(path), 'url': group['url']})
+                occurrences += 1
+            return group
+        roots = [build(x, 1) for x in hierarchy['groups']]
+        direct = sorted(set(hierarchy['hosts']), key=str.casefold)
+        for h in direct:
+            if h not in hosts: raise WebError('inventory_changed', 'Inventory changed during discovery. Refresh to fetch a consistent view.', 409)
+            hosts[h]['memberships'].append({'path': [], 'label': 'Customer root', 'url': explorer_url(customer)})
+        members = set(direct)
+        for root in roots: members.update(root['members'])
+        if set(hosts) != members:
+            raise WebError('inventory_changed', 'Host metadata and hierarchy changed during discovery. Refresh to try again.', 409)
+        root = {'name': customer, 'path': [], 'direct': direct, 'children': roots, 'members': members, 'url': explorer_url(customer)}
+        return dict(customer=customer, root=root, groups=groups, hosts=hosts, host_count=len(members),
+                    group_count=len(groups), memberships=occurrences+len(direct), fetched_at=int(time.time()))
+
+    def page(self, customer, *, branch='', q='', view='auto', gpage=1, hpage=1):
+        text(q, 200); text(branch, 16000)
+        if view not in {'auto', 'map', 'outline'} or not 1 <= gpage <= 100000 or not 1 <= hpage <= 100000:
+            raise WebError('invalid_filter', 'Choose an available inventory view and page.')
+        try:
+            path = json.loads(branch) if branch else []
+            if not isinstance(path, list) or len(path)>64 or any(not isinstance(p,str) for p in path): raise ValueError()
+        except (ValueError, TypeError):
+            raise WebError('invalid_group', 'Choose a group from the current inventory.') from None
+        snap = self.snapshot(customer)
+        selected = snap['groups'].get(tuple(path)) if path else snap['root']
+        if selected is None: raise WebError('group_not_found', 'This group is no longer in the current inventory.', 404)
+        def url(**updates):
+            values = dict(branch=branch, q=q, view=view, gpage=gpage, hpage=hpage)
+            values.update(updates)
+            return explorer_url(customer, **{k: v for k,v in values.items() if v != ''})
+        children = sorted(selected['children'],key=lambda n:n['name'].casefold())
+        direct = selected['direct']
+        search = []
+        if q:
+            needle=q.casefold()
+            for group in snap['groups'].values():
+                if needle in ' / '.join(group['path']).casefold():
+                    search.append({'kind':'Group','name':' / '.join(group['path']),'url':group['url'], 'detail':str(len(group['members']))+' distinct hosts'})
+            for host in snap['hosts'].values():
+                if needle in (host['name']+' '+(host['address'] or '')).casefold():
+                    search.append({'kind':'Host','name':host['name'],'url':host['url'], 'detail':', '.join(host['platforms'])})
+        displayed_groups = children[(gpage-1)*12:gpage*12]
+        displayed_hosts = [snap['hosts'][h] for h in direct[(hpage-1)*24:hpage*24]]
+        # SVG presentation: one focus node and bounded group lanes, each with direct-host links.
+        nodes=[];edges=[];width=1040
+        nodes.append(dict(kind='focus', x=20,y=24,w=1000,h=70,label=selected['name'],
+                          detail=f"{len(selected['members'])} distinct hosts / {len(selected['children'])} subgroups",
+                          url=selected['url']))
+        y=132
+        for g in displayed_groups:
+            nodes.append(dict(kind='group',x=28,y=y,w=290,h=72,label=g['name'],
+                              detail=f"{len(g['direct'])} direct / {len(g['members'])} total",url=g['url']))
+            edges.append((170,94,170,y))
+            preview=g['direct'][:3]
+            for i,h in enumerate(preview):
+                nodes.append(dict(kind='host',x=354+i*226,y=y+5,w=212,h=62,label=h,
+                                  detail=', '.join(snap['hosts'][h]['platforms']) or 'Host',url=host_url(customer,h)))
+                edges.append((318,y+36,354+i*226,y+36))
+            if not preview:
+                nodes.append(dict(kind='note',x=354,y=y+5,w=658,h=62,label='Open group to explore its subgroups' if g['children'] else 'Empty group',
+                                  detail='Membership only; no live health checks',url=g['url']))
+            y+=102
+        if displayed_hosts:
+            y+=22
+            for i,h in enumerate(displayed_hosts):
+                row,col=divmod(i,3);x=28+col*336;yy=y+row*94
+                nodes.append(dict(kind='host',x=x,y=yy,w=318,h=68,label=h['name'],detail=', '.join(h['platforms']) or 'Direct member',url=h['url']))
+                edges.append((170,94,x+159,yy))
+            y+=((len(displayed_hosts)+2)//3)*94
+        crumbs=[{'name':customer,'url':explorer_url(customer)}]
+        for i,p in enumerate(path):
+            crumbs.append({'name':p,'url':explorer_url(customer,branch=json.dumps(path[:i+1],separators=(',',':')))})
+        return dict(customer=customer, snap=snap, selected=selected, crumbs=crumbs, q=q, view=view,
+                    groups=displayed_groups, direct_hosts=displayed_hosts, graph_nodes=nodes, graph_edges=edges,
+                    graph_width=width, graph_height=max(y+20,310), branch=branch,
+                    group_pages=max(1,(len(children)+11)//12), host_pages=max(1,(len(direct)+23)//24),
+                    gpage=gpage,hpage=hpage, map_url=url(view='map'),outline_url=url(view='outline'),
+                    groups_prev=url(gpage=gpage-1) if gpage>1 else None,
+                    groups_next=url(gpage=gpage+1) if gpage*12<len(children) else None,
+                    hosts_prev=url(hpage=hpage-1) if hpage>1 else None,
+                    hosts_next=url(hpage=hpage+1) if hpage*24<len(direct) else None,
+                    search=search[(hpage-1)*50:hpage*50],search_count=len(search),
+                    search_next=url(hpage=hpage+1) if hpage*50<len(search) else None,
+                    search_prev=url(hpage=hpage-1) if hpage>1 else None)
diff --git a/scripts/addons/webgui/src/aim_webgui/journal.py b/scripts/addons/webgui/src/aim_webgui/journal.py
new file mode 100644
index 0000000..3f8b884
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/journal.py
@@ -0,0 +1,235 @@
+"""Bounded durable PUBLIC progress metadata, owned only by retained WebGUI jobs.
+
+A bounded nonblocking queue isolates Core's event sink from DB/viewer latency.
+No rendered console, final report payload, secret frame or arbitrary event keys
+are stored. Readers use a committed per-job cursor, never a live-process socket.
+"""
+from __future__ import annotations
+from collections import deque
+from datetime import datetime
+import json
+import queue
+import re
+import sqlite3
+import threading
+import time
+from aim_webgui.core.protocol import safe_event
+from aim_webgui.db.store import Store
+from aim_webgui.errors import WebError
+from aim_webgui.workflows import actor, TERMINAL
+
+KINDS=frozenset({'stage','play_started','play_skipped','play_stopped','task_started',
+                 'host_result','task_retry','task_async_poll','host_recap','stats','result'})
+QUEUE_EVENTS=2048
+BATCH_EVENTS=128
+FLUSH_SECONDS=.25
+MAX_EVENT_BYTES=16*1024
+MAX_CHECKPOINT_TASKS=64
+
+
+def dumps(value):
+    return json.dumps(value,ensure_ascii=False,allow_nan=False,separators=(',',':'))
+
+
+def authorize(db,user_id,job_id):
+    user=actor(db,user_id)
+    row=db.execute('SELECT id,owner_id,status,plan,created_at,finished_at,reason FROM jobs WHERE id=?',(job_id,)).fetchone()
+    if not row or row['owner_id']!=user_id and user['role']!='admin':
+        raise WebError('job_not_found','Job not found for this account.',404)
+    return row
+
+
+def project(value,targets):
+    event=safe_event(value)
+    if event is None or event['kind']not in KINDS:return None
+    run=event.get('run_id');stamp=event.get('timestamp')
+    if not isinstance(run,str) or not re.fullmatch(r'[A-Za-z0-9_-]{1,100}',run):
+        raise ValueError('Invalid public run identity.')
+    if not isinstance(stamp,str) or len(stamp)>48:raise ValueError('Invalid event time.')
+    date=datetime.fromisoformat(stamp.replace('Z','+00:00'))
+    if date.tzinfo is None:raise ValueError('Event time requires a timezone.')
+    # The projected event may contain a withheld/null host. Never replace it by
+    # a nearby visible host/task. A public host must belong to the reviewed scope.
+    if event.get('host') is not None and event['host'] not in targets:
+        raise ValueError('Event host is outside the reviewed scope.')
+    body=dumps(event)
+    if len(body.encode())>MAX_EVENT_BYTES:raise ValueError('Progress event limit.')
+    return event,body
+
+
+def checkpoint_update(checkpoint,event,received):
+    checkpoint['last_timestamp']=event['timestamp'];checkpoint['last_received_at']=received
+    kind=event['kind'];checkpoint['last_kind']=kind
+    if kind=='stage':checkpoint['stage']=event['stage']
+    if kind=='play_started':checkpoint['last_play']={k:event[k] for k in ('play_id','label','label_redacted')}
+    if kind=='task_started':
+        checkpoint['observed_task_starts']=checkpoint.get('observed_task_starts',0)+1
+        tasks=checkpoint.setdefault('tasks',{})
+        tasks[event['task_id']]={k:event[k] for k in ('task_id','play_id','label','label_redacted','handler')}
+        tasks[event['task_id']]['timestamp']=event['timestamp']
+        while len(tasks)>MAX_CHECKPOINT_TASKS:del tasks[next(iter(tasks))]
+        checkpoint['last_task']=tasks[event['task_id']]
+    if kind in ('host_result','task_retry','task_async_poll') and event.get('host'):
+        hosts=checkpoint.setdefault('hosts',{})
+        hosts[event['host']]={k:event[k] for k in ('host','task_id','play_id','timestamp')}
+        hosts[event['host']]['observation']=event.get('status',kind)
+        hosts[event['host']]['error_code']=(event.get('error')or{}).get('code')
+        while len(hosts)>500:del hosts[next(iter(hosts))]
+    if kind=='stats':checkpoint['counts']=event['counts']
+    # Final event is observed, NOT authoritative until the response is persisted.
+    if kind=='result':checkpoint['result_event_observed']=True
+    return checkpoint
+
+
+class Journal:
+    def __init__(self,settings):
+        self.settings=settings;self.store=Store(settings.database)
+
+    def begin(self,job_id):
+        with self.store.transaction() as db:
+            db.execute('INSERT INTO job_progress_state(job_id,updated_at) VALUES(?,?) ON CONFLICT(job_id) DO NOTHING',(job_id,time.time()))
+
+    def append(self,job_id,batch,*,dropped=0,closed=False,timeout=.25):
+        """Atomic metadata/checkpoint/cursor commit; idempotent public sequences."""
+        with self.store.transaction(timeout=timeout) as db:
+            row=db.execute('SELECT * FROM job_progress_state WHERE job_id=?',(job_id,)).fetchone()
+            if row is None:return # Deletion/absence cannot recreate a shadow journal.
+            state=dict(row);cp=json.loads(state['checkpoint']);run=state['run_id']
+            lost=max(state['dropped_events'],dropped)
+            for event,body,received in batch:
+                if run is not None and event['run_id']!=run:
+                    lost+=1;continue
+                run=event['run_id']
+                if event['sequence']<=state['last_sequence']:continue
+                state['last_sequence']=event['sequence'];state['cursor']+=1
+                size=len(body.encode('utf-8'))
+                db.execute('INSERT INTO job_progress_events VALUES(?,?,?,?,?,?,?)',
+                           (job_id,state['cursor'],run,event['sequence'],received,body,size))
+                state['retained_events']+=1;state['retained_bytes']+=size
+                checkpoint_update(cp,event,received)
+            remove=[]
+            if state['retained_events']>self.settings.journal_max_events or state['retained_bytes']>self.settings.journal_max_bytes:
+                for old in db.execute('SELECT cursor,size_bytes FROM job_progress_events WHERE job_id=? ORDER BY cursor',(job_id,)):
+                    if state['retained_events']<=self.settings.journal_max_events and state['retained_bytes']<=self.settings.journal_max_bytes:break
+                    state['retained_events']-=1;state['retained_bytes']-=old['size_bytes'];state['omitted_events']+=1;remove.append(old['cursor'])
+                if remove:db.execute('DELETE FROM job_progress_events WHERE job_id=? AND cursor<=?',(job_id,remove[-1]))
+            now=time.time();capture='closed' if closed else 'recording'
+            if lost:capture='closed_with_gaps' if closed else 'recording_with_gaps'
+            db.execute('''UPDATE job_progress_state SET run_id=?,cursor=?,last_sequence=?,retained_events=?,retained_bytes=?,
+                       omitted_events=?,dropped_events=?,checkpoint=?,updated_at=?,capture_state=?,closed_at=? WHERE job_id=?''',
+                       (run,state['cursor'],state['last_sequence'],state['retained_events'],state['retained_bytes'],
+                        state['omitted_events'],lost,dumps(cp),now,capture,now if closed else None,job_id))
+
+    def snapshot(self,user_id,job_id,*,after=None,before=None,limit=200):
+        if type(limit)is not int or not 1<=limit<=500:raise WebError('invalid_cursor','Progress page size must be 1..500.')
+        for number in (after,before):
+            if number is not None and (type(number)is not int or not 0<=number<=2**53-1):raise WebError('invalid_cursor','Invalid progress cursor.')
+        if after is not None and before is not None:raise WebError('invalid_cursor','Choose before or after, not both.')
+        with self.store.read() as db:
+            db.execute('BEGIN')
+            job=authorize(db,user_id,job_id)
+            row=db.execute('SELECT * FROM job_progress_state WHERE job_id=?',(job_id,)).fetchone()
+            terminal=job['status']in TERMINAL
+            if row is None:
+                return {'job':job_id,'job_status':job['status'],'terminal':terminal,'available':False,'cursor':0,'next_cursor':0,
+                        'first_cursor':0,'events':[],'has_older':False,'has_more':False,'checkpoint':{},'capture_state':'unavailable',
+                        'omitted_events':0,'dropped_events':0,'capture_interrupted':False,
+                        'message':'Detailed history was not captured for this job.' if terminal else 'Waiting for the execution worker to begin metadata capture.'}
+            state=dict(row);watermark=state['cursor']
+            if after is not None and after>watermark:raise WebError('invalid_cursor','Progress cursor is ahead of this job.',409)
+            first=db.execute('SELECT MIN(cursor) FROM job_progress_events WHERE job_id=?',(job_id,)).fetchone()[0]or 0
+            params=[job_id]
+            if after is not None:
+                clause=' AND cursor>?';params.append(after);order='ASC'
+            elif before is not None:
+                clause=' AND cursor<?';params.append(before);order='DESC'
+            else:clause='';order='DESC'
+            rows=list(db.execute('SELECT cursor,received_at,payload FROM job_progress_events WHERE job_id=?'+clause+' ORDER BY cursor '+order+' LIMIT ?',(*params,limit)))
+            if order=='DESC':rows.reverse()
+            events=[{'cursor':r['cursor'],'received_at':r['received_at'],'event':json.loads(r['payload'])} for r in rows]
+            for item in events:item['text']=format_event(item['event'])
+            next_cursor=events[-1]['cursor'] if events else after if after is not None else watermark
+            cp=json.loads(state['checkpoint'])
+            cp['tasks']=list(cp.get('tasks',{}).values())
+            cp['hosts']=list(cp.get('hosts',{}).values())
+            return {'job':job_id,'job_status':job['status'],'terminal':terminal,'available':True,
+                    'cursor':watermark,'next_cursor':next_cursor,'first_cursor':first,'events':events,'checkpoint':cp,
+                    'has_more':next_cursor<watermark,'has_older':bool(events and events[0]['cursor']>first),
+                    'capture_state':state['capture_state'],'omitted_events':state['omitted_events'],
+                    'dropped_events':state['dropped_events'],'capture_interrupted':terminal and state['closed_at']is None,
+                    'retained_events':state['retained_events'],'retained_bytes':state['retained_bytes'],
+                    'updated_at':state['updated_at'],'gap_before':bool(after is not None and first and after<first-1)}
+
+
+class Capture:
+    """Worker-only writer. Queue drops are explicit, never a reason to replay work."""
+    def __init__(self,settings,job_id,targets):
+        self.journal=Journal(settings);self.job_id=job_id;self.targets=frozenset(targets)
+        self.items=queue.Queue(maxsize=QUEUE_EVENTS);self.stopping=threading.Event()
+        self.dropped=0;self.closed=False;self.loss_lock=threading.Lock();self.flush_deadline=None
+        self.journal.begin(job_id)
+        self.thread=threading.Thread(target=self._write,name='aim-progress-journal',daemon=True);self.thread.start()
+
+    def lost(self,count):
+        with self.loss_lock:self.dropped+=count
+
+    def loss_count(self):
+        with self.loss_lock:return self.dropped
+
+    def submit(self,value):
+        if self.closed:return
+        try:
+            pair=project(value,self.targets)
+            if pair is None:return
+            self.items.put_nowait((*pair,time.time()))
+        except (WebError,ValueError,TypeError,UnicodeError,queue.Full):self.lost(1)
+
+    def _write(self):
+        while not self.stopping.is_set() or not self.items.empty():
+            batch=[];end=time.monotonic()+FLUSH_SECONDS
+            while len(batch)<BATCH_EVENTS:
+                try:batch.append(self.items.get(timeout=max(.001,end-time.monotonic())))
+                except queue.Empty:break
+                if time.monotonic()>=end:break
+            if self.flush_deadline is not None and time.monotonic()>=self.flush_deadline:
+                self.lost(len(batch))
+                while True:
+                    try:self.items.get_nowait();self.lost(1)
+                    except queue.Empty:break
+                break
+            if not batch:continue
+            try:self.journal.append(self.job_id,batch,dropped=self.loss_count())
+            except (sqlite3.Error,OSError,ValueError):
+                self.lost(len(batch))
+                # No exception bodies or payloads are logged. Next commit records
+                # loss. A persistent storage failure leaves capture unconfirmed.
+        try:self.journal.append(self.job_id,[],dropped=self.loss_count(),closed=True)
+        except (sqlite3.Error,OSError,ValueError):pass
+
+    def close(self):
+        if self.closed:return not self.thread.is_alive()
+        self.closed=True;self.flush_deadline=time.monotonic()+2.5
+        self.stopping.set();self.thread.join(timeout=3)
+        # A killed writer may lose its uncommitted batch. A missing durable
+        # closed_at is rendered as interrupted capture, not complete history.
+        return not self.thread.is_alive()
+
+
+def format_event(e):
+    kind=e['kind'];host=e.get('host')or'<host withheld>';task=e.get('task_id','')
+    if kind=='stage':return '[AIM] Core stage: '+e['stage']
+    if kind=='play_started':return 'PLAY ['+e['label']+']'
+    if kind=='play_skipped':return 'skipping: no hosts matched'
+    if kind=='play_stopped':return 'stopped: no hosts remaining'
+    if kind=='task_started':return ('RUNNING HANDLER' if e['handler'] else 'TASK')+' ['+e['label']+'] ('+task+')'
+    if kind=='host_result':
+        status=e['status'];line=(f'fatal: [{host}]: '+status.upper()+'!' if status in ('failed','unreachable') else f'{status}: [{host}]')
+        line+=' ('+task+')'+(' (ignored)' if e['ignored'] else '')
+        if e.get('error'):line+='\n  '+e['error']['message']
+        return line
+    if kind in ('task_retry','task_async_poll'):
+        return ('retrying' if kind=='task_retry' else 'async poll')+f': [{host}] ({task})'+(f" attempt={e['attempt']}" if e['attempt']is not None else '')
+    if kind=='host_recap':return f'RECAP [{host}] '+' '.join(f'{k}={v}' for k,v in e['counts'].items())
+    if kind=='stats':return 'PLAY RECAP\n[AIM] Counters: '+', '.join(f'{k}={v}' for k,v in sorted(e['counts'].items()))
+    if kind=='result':return '[AIM] Final result event observed. Authoritative response is recorded separately.'
+    return ''
diff --git a/scripts/addons/webgui/src/aim_webgui/names.py b/scripts/addons/webgui/src/aim_webgui/names.py
new file mode 100644
index 0000000..d6673ed
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/names.py
@@ -0,0 +1,10 @@
+"""Plan titles: presentation only, never record identifiers or upsert keys."""
+import unicodedata
+import uuid
+from datetime import datetime, timezone
+
+def name_key(name):
+    return unicodedata.normalize('NFKC',name.strip()).casefold()
+
+def suggested_name(playbook):
+    return f"{playbook[:48]} - {datetime.now(timezone.utc):%Y%m%d-%H%M%S} - {uuid.uuid4().hex[:10]}"
diff --git a/scripts/addons/webgui/src/aim_webgui/patch_view.py b/scripts/addons/webgui/src/aim_webgui/patch_view.py
new file mode 100644
index 0000000..394fbbe
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/patch_view.py
@@ -0,0 +1,90 @@
+"""Read-only presentation of Core's patch_summary_v1, including historic shapes.
+
+This module never plans updates, interprets HRESULTs, changes a job verdict, or
+starts a continuation. Values come only from a retained, schema-validated report.
+"""
+from __future__ import annotations
+from typing import Any
+
+BLOCK_NOTICES = {
+    'preexisting_reboot_required': (
+        'Pending reboot observed before patching',
+        'Core reports a pre-existing reboot prerequisite. In this preflight path, new '
+        'patch work did not start. Review the reboot policy before preparing another run.'),
+    'cycle_limit_reached': (
+        'Post-reboot continuation limit reached',
+        'Core stopped at its bounded continuation limit. Review the recorded results '
+        'before deciding whether to prepare another run.'),
+    'install_not_allowed': (
+        'Windows Update did not permit installation',
+        'This classification can indicate an active installer or a mandatory reboot. '
+        'It does not by itself prove a pending reboot; use the separate preflight observation.'),
+}
+
+
+def patch_view(item: dict[str, Any]) -> dict[str, Any] | None:
+    """Explain independent patch/reboot/report facts without manufacturing state."""
+    payload = item.get('data')
+    if (item.get('schema_id') != 'patch_summary_v1'
+            or item.get('status') != 'available' or not isinstance(payload, dict)):
+        return None
+    windows = payload.get('platform') == 'windows'
+    check = item.get('check_mode') is True
+    notices: list[dict[str, str]] = []
+    blocked = payload.get('blocked_reason')
+    if blocked:
+        title, text = BLOCK_NOTICES.get(blocked, (
+            'A reported condition stopped this patch run',
+            'Inspect the bounded failure records and original Core verdict. '
+            'No failed update or job will be submitted again automatically.'))
+        notices.append({'tone': 'warning', 'title': title, 'text': text, 'code': blocked})
+    reasons=payload.get('reboot_reasons_before')
+    if windows and isinstance(reasons,list) and reasons:
+        notices.append({'tone':'secondary','title':'Native reboot prerequisite details','code':'',
+            'text':'Core recorded one or more reboot sources from ansible.windows.win_reboot_info before patching. '
+                   'These are bounded observations from that run, not a live reboot-state probe.'})
+    if payload.get('reboot_deferred') is True:
+        notices.append({'tone': 'warning', 'title': 'Reboot deferred', 'code': '',
+            'text': 'The report records a remaining reboot requirement with automatic reboot '
+                    'disabled. This is separate from whether the updates in this run succeeded. '
+                    'Review an explicit reboot decision before continuing patching.'})
+    if windows and payload.get('continuation_required') is True:
+        notices.append({'tone': 'info', 'title': 'Another patch run needs review', 'code': '',
+            'text': 'Core reports that further patching needs a fresh operator decision. '
+                    'A successful wave can still need a later run; this does not change '
+                    'the Core verdict or create another job.'})
+    if windows and 'remaining_updates_known' not in payload:
+        notices.append({'tone': 'secondary', 'title': 'Historical patch-report format', 'code': '',
+            'text': 'This recorded report does not supply the newer remaining-update knowledge '
+                    'flag. Missing wave or reboot fields are not assumed false or reconstructed.'})
+    if check:
+        notices.insert(0, {'tone': 'info', 'title': 'Check mode: no installation claim', 'code': '',
+            'text': 'These are recorded check-mode observations or predictions. They are not '
+                    'evidence that updates were installed or that a reboot took place.'})
+    known = payload.get('remaining_updates_known')
+    if windows and known is False:
+        pending = {'title': 'Remaining updates not established', 'suppressed': True,
+            'note': 'Core did not establish an authoritative final remaining-update list for '
+                    'this wave. No pending count or next-wave list is inferred, even if an '
+                    'earlier queue appears in the retained JSON.',
+            'empty_text': 'Unknown after this wave. A new reviewed run owns the next discovery.'}
+    elif windows and known is True:
+        pending = {'title': 'Pending updates - final read-only discovery', 'suppressed': False,
+            'note': 'The pending list is authoritative for the final read-only search recorded '
+                    'by Core, within the selected scope at that time. Discovery did not extend '
+                    'the approved install queue; it is not a live compliance check.',
+            'empty_text': 'No pending updates reported by that final discovery in the selected scope.'}
+    elif windows:
+        pending = {'title': 'Pending updates - recorded legacy observation', 'suppressed': False,
+            'note': 'No explicit remaining-update knowledge flag exists in this older report. '
+                    'Do not treat an empty list as proof that no later updates are applicable.',
+            'empty_text': 'No entries reported; later update applicability is not established.'}
+    else:
+        pending = {'title': 'Pending updates', 'suppressed': False,
+            'note': 'Use the report\'s evidence and mode. Linux package snapshots describe net '
+                    'observed version-set changes, not every intermediate transaction.',
+            'empty_text': 'No entries reported.'}
+    return {'windows': windows, 'check_mode': check, 'notices': notices, 'pending': pending,
+            'failure_note': 'Reason, safe message and unsigned/hexadecimal native code are '
+                'supplied by Core. WebGUI does not parse fatal output or infer a reboot '
+                'requirement from an HRESULT. Missing older fields remain unknown.'}
diff --git a/scripts/addons/webgui/src/aim_webgui/read_views.py b/scripts/addons/webgui/src/aim_webgui/read_views.py
new file mode 100644
index 0000000..e3ef066
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/read_views.py
@@ -0,0 +1,68 @@
+"""Add-on-owned GET-only discovery/history endpoints. No run preparation or writes."""
+from __future__ import annotations
+from dataclasses import asdict
+from urllib.parse import urlencode
+from fastapi import Request
+from starlette.concurrency import run_in_threadpool
+from aim_webgui.activity import Activity, HistoryFilter, LABELS, host_url
+from aim_webgui.explorer import Explorer
+from aim_webgui.errors import WebError
+from aim_webgui.reports import Reports
+
+
+def install_read_views(app, settings, render):
+    activity = Activity(settings)
+
+    async def report(request, customer='', host='', playbook='', mode='apply', days='30', outcome='', q='', page=1):
+        return await run_in_threadpool(activity.report, request.state.session['user_id'],
+                                      HistoryFilter(customer,host,playbook,mode,days,outcome,q,page))
+
+    @app.get('/inventory/{customer}/explore')
+    async def explore(request: Request, customer: str, branch: str='', q: str='', view: str='auto', gpage: int=1, hpage: int=1):
+        model = await run_in_threadpool(Explorer(settings).page,customer,branch=branch,q=q,view=view,gpage=gpage,hpage=hpage)
+        return render(request,'pages/explorer.html',title='Inventory explorer',nav='customers',**model)
+
+    @app.get('/api/v2/inventory/{customer}/explore')
+    async def explore_api(request: Request, customer: str, branch: str='', gpage: int=1, hpage: int=1):
+        model = await run_in_threadpool(Explorer(settings).page,customer,branch=branch,gpage=gpage,hpage=hpage)
+        return {'source':'core_inventory_hierarchy_v1','customer':customer,'branch':model['selected']['path'],
+                'retrieved_at':model['snap']['fetched_at'],'host_count':model['snap']['host_count'],
+                'group_count':model['snap']['group_count'],'nodes':model['graph_nodes'],'edges':model['graph_edges'],
+                'width':model['graph_width'],'height':model['graph_height'],
+                'group_pages':model['group_pages'],'host_pages':model['host_pages'],
+                'gpage':gpage,'hpage':hpage}
+
+    @app.get('/inventory/{customer}/activity')
+    async def host_activity(request: Request, customer: str, host: str, playbook: str='', mode: str='apply', days: str='30', outcome: str='', page: int=1):
+        data = await report(request,customer,host,playbook,mode,days,outcome,page=page)
+        current = None; inventory_error = False; fetched_at = None
+        try:
+            snapshot = await run_in_threadpool(Explorer(settings).snapshot,customer)
+            current=snapshot['hosts'].get(host); fetched_at=snapshot['fetched_at']
+        except WebError:
+            # A historical page remains useful during a Core outage. Do not fake an empty inventory.
+            inventory_error=True
+        prev = host_url(customer,host,**{k:v for k,v in data['filters'].query(page=page-1).items() if k not in {'host','customer'}}) if page>1 else None
+        nxt = host_url(customer,host,**{k:v for k,v in data['filters'].query(page=page+1).items() if k not in {'host','customer'}}) if page<data['pages'] else None
+        links=await run_in_threadpool(Reports(settings).host_links,request.state.session['user_id'],customer,host)
+        return render(request,'pages/activity.html',report_links=links,title=host,nav='customers',customer=customer,host=host,
+                      current=current,inventory_error=inventory_error,fetched_at=fetched_at,data=data,
+                      previous_url=prev,next_url=nxt,outcome_labels=LABELS)
+
+    @app.get('/api/v2/activity')
+    async def activity_api(request: Request, customer: str, host: str, playbook: str='', mode: str='apply', days: str='30', outcome: str='', page: int=1):
+        data=await report(request,customer,host,playbook,mode,days,outcome,page=page)
+        return {**data,'filters':asdict(data['filters'])}
+
+    @app.get('/insights')
+    async def insights(request: Request, customer: str='', playbook: str='', mode: str='apply', days: str='30', outcome: str='', q: str='', page: int=1):
+        data=await report(request,customer,'',playbook,mode,days,outcome,q,page)
+        previous='/insights?'+urlencode(data['filters'].query(page=page-1)) if page>1 else None
+        next_url='/insights?'+urlencode(data['filters'].query(page=page+1)) if page<data['matrix_pages'] else None
+        return render(request,'pages/insights.html',title='Playbook insights',nav='insights',data=data,
+                      customer=customer,previous_url=previous,next_url=next_url,outcome_labels=LABELS)
+
+    @app.get('/api/v2/insights')
+    async def insights_api(request: Request, customer: str='', playbook: str='', mode: str='apply', days: str='30', outcome: str='', q: str='', page: int=1):
+        data=await report(request,customer,'',playbook,mode,days,outcome,q,page)
+        return {**data,'filters':asdict(data['filters'])}
diff --git a/scripts/addons/webgui/src/aim_webgui/reports.py b/scripts/addons/webgui/src/aim_webgui/reports.py
new file mode 100644
index 0000000..430648b
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/reports.py
@@ -0,0 +1,197 @@
+"""Job-owned report persistence/read models. No Core calls, files or raw output.
+
+Reports have availability, retention and execution outcomes as separate facts.
+Large payloads are separate from jobs.core_result and are fetched one slot at a time.
+"""
+from __future__ import annotations
+import json
+import time
+from urllib.parse import urlencode
+from aim_webgui.core.reports import contract, operation_result, encoded
+from aim_webgui.db.store import Store
+from aim_webgui.errors import WebError
+from aim_webgui.journal import authorize
+from aim_webgui.patch_view import patch_view
+
+TITLES={
+ 'host_capabilities_v1':'Detected host roles', 'filesystem_usage_v1':'Filesystem usage',
+ 'event_log_export_v1':'Event log export', 'service_start_summary_v1':'Service recovery',
+ 'patch_summary_v1':'Operating-system patch report', 'managed_cleanup_preview_v1':'Managed cleanup',
+ 'checkmk_user_config_v1':'Checkmk user configuration', 'checkmk_agent_state_v1':'Checkmk agent state',
+ 'checkmk_agent_config_v1':'Checkmk configuration changes'}
+NOTES={
+ 'host_capabilities_v1':'Recorded detection facts, not current inventory membership or live health.',
+ 'filesystem_usage_v1':'Observed byte quantities. Windows reports attached local storage volumes; mapped/network drives are intentionally excluded. Unavailable is not zero.',
+ 'event_log_export_v1':'Paths refer to files on the managed target, not downloadable controller artifacts. Check mode creates no export.',
+ 'service_start_summary_v1':'Excluded services are not failed starts. Observed newly running services may include concurrent external starts.',
+ 'patch_summary_v1':'Linux rows describe net observed package/version changes, not every transaction. Pending Windows updates are not installed. Evidence completeness is separate from report availability.',
+ 'managed_cleanup_preview_v1':'Preview candidates are not deletions. Mode and completion indicators remain explicit.',
+ 'checkmk_user_config_v1':'Parsed sections are operational configuration data, not guaranteed secret-free. Redacted values are not absent settings. Paths are display-only.',
+ 'checkmk_agent_state_v1':'Installed versions are observations from the registry/package database. Null means unknown; check mode is not evidence of installation.',
+ 'checkmk_agent_config_v1':'Named semantic changes, not raw before/after diffs. Unknown files remain untouched and unenumerated.'}
+LABELS={'is_dc':'Domain controller','is_dhcp_server':'DHCP server','is_hyperv_host':'Hyper-V host',
+ 'has_veeam_vbr':'Veeam Backup & Replication','has_veeam_vbo':'Veeam Microsoft 365 backup',
+ 'has_veeam_em':'Veeam Enterprise Manager','is_unifi_controller':'UniFi controller','is_unifi_os_server':'UniFi OS server',
+ 'complete':'Evidence complete','required':'Required report','used_bytes':'Used bytes','total_bytes':'Total bytes',
+ 'available_bytes':'Available bytes','used_percent':'Used percent','failed_to_start':'Failed to start',
+ 'before_count':'Initially stopped count','after_observed':'After state observed','newly_running':'Observed newly running',
+ 'started_count':'Attempted services observed running','changed':'Changes reported','last_write_time_utc':'Source last-write time (UTC)',
+ 'reboot_required':'Final reboot requirement (legacy field)',
+ 'reboot_required_before':'Reboot required before this run',
+ 'reboot_reasons_before':'Native reboot reasons observed before this run',
+ 'reboot_required_after':'Reboot required after this run',
+ 'reboot_performed':'AIM-performed reboot', 'reboot_deferred':'Reboot deferred',
+ 'reboot_delay_minutes':'Reviewed reboot delay (minutes)',
+ 'rescan_after_reboot':'Reviewed post-reboot continuation option',
+ 'patch_cycles':'Windows discovery/install cycles entered',
+ 'continuation_required':'Further patching needs review',
+ 'remaining_updates_known':'Final remaining-update list established',
+ 'blocked_reason':'Core-reported stop reason',
+ 'native_code':'Native code (unsigned)', 'native_code_hex':'Native code (hex)',
+ 'failed_updates':'Failed Windows updates', 'message':'Core diagnostic message'}
+CONFIG_METADATA=('path','exists','size_bytes','last_write_time_utc','redacted_paths','comment_preservation')
+
+
+def label(key):return LABELS.get(key,key.replace('_',' ').capitalize())
+
+
+def url(job_id,slot=''):
+    return '/jobs/'+job_id+'/reports'+('?' + urlencode({'host':slot}) if slot else '')
+
+
+def persist(db,settings,job_id,plan,result):
+    """One authoritative response transaction. Never persist the result event body."""
+    decl=contract(plan.get('result_contract'))
+    report=operation_result(result.get('operation_result'),decl,targets=plan['targets'],check=plan['core_request']['check'])
+    now=time.time();policy='full_configuration' if settings.reports_retain_configuration else 'configuration_metadata_only'
+    existing=db.execute('SELECT 1 FROM job_operation_results WHERE job_id=?',(job_id,)).fetchone()
+    if existing:raise WebError('result_already_recorded','This job already has an authoritative report record. No replay was made.',409)
+    db.execute('''INSERT INTO job_operation_results(job_id,contract,protocol,schema_id,scope,required,complete,check_mode,stored_at,retention_policy)
+                  VALUES(?,?,?,?,?,?,?,?,?,?)''',
+               (job_id,encoded(decl).decode(),report['protocol'] if report else None,report['schema'] if report else None,
+                report['scope'] if report else None,report['required'] if report else None,report['complete'] if report else None,
+                plan['core_request']['check'],now,policy))
+    summary=None
+    if report:
+        summary={k:v for k,v in report.items() if k not in ('hosts','global')};summary['hosts']={};summary['global']=None
+        slots=report['hosts'] if report['scope']=='per_host' else {'':report['global']}
+        retained=0
+        for slot,entry in slots.items():
+            content=entry['data'];retention='unavailable';text=None;size=0
+            if entry['status']=='available':
+                retention='retained'
+                if report['schema']=='checkmk_user_config_v1' and not settings.reports_retain_configuration:
+                    content={key:content[key] for key in CONFIG_METADATA};retention='metadata_only'
+                raw=encoded(content);size=len(raw)
+                if retained+size>settings.reports_max_bytes:
+                    retention='not_retained_limit';size=0
+                else:text=raw.decode();retained+=size
+            db.execute('INSERT INTO job_operation_reports VALUES(?,?,?,?,?,?,?,?)',
+                       (job_id,slot,entry['schema'],entry['status'],entry['error'],retention,text,size))
+            item={'schema':entry['schema'],'status':entry['status'],'error':entry['error'],'retention':retention,'size_bytes':size}
+            if slot:summary['hosts'][slot]=item
+            else:summary['global']=item
+    # Preserve the public accounting, not megabytes of report bodies, in job polls.
+    small={**result,'operation_result':summary}
+    return small
+
+
+class Reports:
+    def __init__(self,settings):self.settings=settings;self.store=Store(settings.database)
+
+    def index(self,user_id,job_id):
+        with self.store.read() as db:
+            db.execute('BEGIN');job=authorize(db,user_id,job_id)
+            plan=json.loads(job['plan']);row=db.execute('SELECT * FROM job_operation_results WHERE job_id=?',(job_id,)).fetchone()
+            slots=[dict(r) for r in db.execute('SELECT slot,schema_id,status,error,retention,size_bytes FROM job_operation_reports WHERE job_id=? ORDER BY slot',(job_id,))]
+        declared=plan.get('result_contract')
+        model={'job':job_id,'job_status':job['status'],'customer':plan.get('customer'),'playbook':plan.get('playbook'),
+               'mode':'check' if plan.get('core_request',{}).get('check') else 'apply','recorded':row is not None,
+               'declared':declared is not None,'schema':declared.get('schema') if declared else None,
+               'slots':slots,'recorded_at':row['stored_at'] if row else None}
+        if row:
+            model.update(schema=row['schema_id'],declared=row['schema_id']is not None,complete=bool(row['complete']),scope=row['scope'],
+                         required=bool(row['required']),retention_policy=row['retention_policy'])
+        model['title']=TITLES.get(model['schema'],'Operation report')
+        for item in slots:item['url']=url(job_id,item['slot'])
+        return model
+
+    def slot(self,user_id,job_id,host=None):
+        with self.store.read() as db:
+            db.execute('BEGIN');job=authorize(db,user_id,job_id)
+            meta=db.execute('SELECT * FROM job_operation_results WHERE job_id=?',(job_id,)).fetchone()
+            if not meta or not meta['schema_id']:raise WebError('report_unavailable','No retained report is available for this job.',404)
+            if host is None:
+                row=db.execute("SELECT * FROM job_operation_reports WHERE job_id=? ORDER BY CASE status WHEN 'available' THEN 0 ELSE 1 END,slot LIMIT 1",(job_id,)).fetchone()
+            else:row=db.execute('SELECT * FROM job_operation_reports WHERE job_id=? AND slot=?',(job_id,host)).fetchone()
+            if not row:raise WebError('report_unavailable','This report slot is unavailable.',404)
+            item=dict(row);item['data']=json.loads(item['data']) if item['data']is not None else None
+            item['contract']=json.loads(meta['contract']);item['recorded_at']=meta['stored_at'];item['scope']=meta['scope']
+            item['complete']=bool(meta['complete']);item['check_mode']=bool(meta['check_mode']);item['required']=bool(meta['required'])
+            item['title']=TITLES.get(item['schema_id'],'Operation report');item['note']=NOTES.get(item['schema_id'],'Validated structured operation data; render as historical observation, not live state.')
+            item['url']=url(job_id,item['slot'])
+            return item
+
+    def host_links(self,user_id,customer,host,*,limit=20):
+        # Policy before SELECT/aggregation. Exact customer/logical hostname identity.
+        from aim_webgui.workflows import actor
+        with self.store.read() as db:
+            who=actor(db,user_id)
+            rows=db.execute('''SELECT r.job_id,r.schema_id,r.status,r.retention,m.stored_at,m.check_mode,
+                         json_extract(j.plan,'$.playbook') AS playbook
+                FROM job_operation_reports r JOIN job_operation_results m ON m.job_id=r.job_id JOIN jobs j ON j.id=r.job_id
+                WHERE (?='admin' OR j.owner_id=?) AND json_extract(j.plan,'$.customer')=? AND r.slot=?
+                ORDER BY m.stored_at DESC,r.job_id DESC LIMIT ?''',(who['role'],user_id,customer,host,limit))
+            result=[dict(r) for r in rows]
+        for item in result:item['url']=url(item['job_id'],host);item['title']=TITLES.get(item['schema_id'],item['schema_id'])
+        return result
+
+
+def presentation(item,*,field='',page=1):
+    """Schema-keyed summaries plus generic bounded sections for every supported shape.
+
+    A page has at most 50 rows per collection; JSON is fetched separately on demand.
+    This never follows returned file paths/URLs or interprets strings as markup.
+    """
+    if type(page)is not int or not 1<=page<=400:raise WebError('invalid_page','Invalid report page.')
+    content=item.get('data')
+    if not isinstance(content,dict):
+        return {'facts':[],'sections':[],'scalar':content,'is_scalar':True,'generic':True}
+    if field and field not in content:raise WebError('invalid_page','Unknown report section.')
+    patch=patch_view(item)
+    facts=[];sections=[]
+    for key,value in content.items():
+        if isinstance(value,list):
+            current=page if field==key else 1;start=(current-1)*50;selected=value[start:start+50]
+            headers=[]
+            if selected and all(isinstance(x,dict) for x in selected):
+                headers=list(dict.fromkeys(k for x in selected for k in x))[:40]
+            section={'key':key,'title':label(key),'rows':selected,'headers':headers,'total':len(value),
+                     'page':current,'pages':max(1,(len(value)+49)//50),'start':start,'kind':'array'}
+        elif isinstance(value,dict):
+            current=page if field==key else 1;start=(current-1)*50;keys=list(value)[start:start+50]
+            section={'key':key,'title':label(key),'rows':[(k,value[k]) for k in keys], 'headers':[], 'total':len(value),
+                     'page':current,'pages':max(1,(len(value)+49)//50),'start':start,'kind':'object'}
+        else:
+            facts.append({'key':key,'title':label(key),'value':value});continue
+        if patch and key=='pending':
+            section.update(patch['pending'])
+            if section['suppressed']:
+                section.update(rows=[],headers=[],total=None,page=1,pages=1)
+                current=1
+        elif patch and key=='failed_updates':
+            section['note']=patch['failure_note']
+        params={'host':item['slot'],'field':key}
+        section['previous']=('/jobs/'+item['job_id']+'/reports?'+urlencode({**params,'page':current-1})+'#report-'+key) if current>1 else None
+        section['next']=('/jobs/'+item['job_id']+'/reports?'+urlencode({**params,'page':current+1})+'#report-'+key) if current<section['pages'] else None
+        sections.append(section)
+    return {'facts':facts,'sections':sections,'scalar':None,'is_scalar':False,'generic':item['schema_id']not in TITLES,'patch':patch}
+
+
+def cell(value):
+    if value is None:return 'Unknown / not supplied'
+    if type(value)is bool:return 'Yes' if value else 'No'
+    if isinstance(value,(dict,list)):
+        text=json.dumps(value,ensure_ascii=False,allow_nan=False)
+        return text if len(text)<=1200 else text[:1200]+' ... [display shortened; use retained JSON]'
+    return str(value)
diff --git a/roles/checkmk_scripts/files/Windows/local/veeam_config_backup_status.ps1.example b/scripts/addons/webgui/src/aim_webgui/routes/__init__.py
similarity index 100%
rename from roles/checkmk_scripts/files/Windows/local/veeam_config_backup_status.ps1.example
rename to scripts/addons/webgui/src/aim_webgui/routes/__init__.py
diff --git a/scripts/addons/webgui/src/aim_webgui/routes/workflows.py b/scripts/addons/webgui/src/aim_webgui/routes/workflows.py
new file mode 100644
index 0000000..e711145
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/routes/workflows.py
@@ -0,0 +1,280 @@
+from __future__ import annotations
+
+from datetime import datetime, timezone
+import asyncio
+import json
+import uuid
+
+from fastapi import Request
+from fastapi.responses import JSONResponse, StreamingResponse
+from starlette.concurrency import run_in_threadpool
+
+from aim_webgui.diagnostics import report
+from aim_webgui.adapters.core_v1 import CoreAdapter
+from aim_webgui.errors import WebError
+from aim_webgui.workflows import Workflows
+from aim_webgui.credentials.presentation import form_context, status as credential_status, attention
+
+
+def install(app, settings, auth, render, form, one, redirect, administrator):
+    flow = Workflows(settings)
+    def uid(request):
+        return request.state.session['user_id']
+    async def call(method, *args, **kwargs):
+        return await run_in_threadpool(getattr(flow, method), *args, **kwargs)
+    def plan_payload(value):
+        if (not isinstance(value,dict) or set(value)-{'customer','playbook','targets','overrides','check','key_mode'}
+            or not {'customer','playbook','targets','overrides'}<=set(value)
+            or not isinstance(value['customer'],str) or not isinstance(value['playbook'],str)):
+            raise WebError('invalid_plan','Use customer, playbook, targets, overrides and optional check/key_mode.')
+        return value
+    async def api_payload(request):
+        if request.headers.get('content-type', '').split(';')[0] != 'application/json':
+            raise WebError('unsupported_content_type', 'Use application/json.', 415)
+        try:
+            value = await request.json()
+        except (ValueError, UnicodeError):
+            raise WebError('invalid_json', 'Invalid JSON.') from None
+        if not isinstance(value, dict):
+            raise WebError('invalid_request', 'Expected a JSON object.')
+        return value
+
+    @app.get('/setup')
+    async def setup(request: Request):
+        administrator(request)
+        return render(request, 'pages/setup.html', title='Named administrator setup', nav='setup',
+                      setup=await call('onboarding', uid(request)))
+
+    @app.post('/setup')
+    async def setup_submit(request: Request):
+        administrator(request)
+        values = await form(request)
+        action = one(values, 'action')
+        if action == 'create':
+            if one(values, 'password') != one(values, 'confirm'):
+                raise WebError('password_mismatch', 'Temporary passwords do not match.')
+            await call('named_admin', uid(request), one(values, 'username'), one(values, 'password'))
+        elif action == 'retire':
+            await call('retire_bootstrap', uid(request))
+        else:
+            raise WebError('invalid_action', 'Choose create or retire.')
+        return redirect(request, '/setup')
+
+    @app.get('/system')
+    async def system(request: Request):
+        administrator(request)
+        return render(request, 'pages/system.html', title='System & diagnostics', nav='system',
+                      system=await run_in_threadpool(report, settings))
+
+    @app.get('/api/v2/system')
+    async def api_system(request: Request):
+        administrator(request)
+        return await run_in_threadpool(report, settings)
+
+    @app.get('/audit')
+    async def audit_page(request: Request, before: int | None = None, action: str = ''):
+        administrator(request)
+        items = await call('audit', uid(request), before=before, action=action[:100])
+        return render(request, 'pages/audit.html', title='Audit history', nav='audit', items=items, action=action)
+
+    @app.get('/api/v2/audit')
+    async def api_audit(request: Request, before: int | None = None, action: str = ''):
+        administrator(request)
+        return {'items': await call('audit', uid(request), before=before, action=action[:100])}
+
+    @app.get('/_partials/grant-fields')
+    async def grant_fields(request: Request, user_id: int, customer: str):
+        administrator(request)
+        users = await run_in_threadpool(auth.users)
+        customers = await run_in_threadpool(CoreAdapter(settings).customers)
+        valid_users = {u['id'] for u in users}
+        valid_customers = {c['name'] for c in customers}
+        if user_id not in valid_users:
+            raise WebError('user_not_found', 'Account not found.', 404)
+        if customer not in valid_customers:
+            raise WebError('customer_not_found', 'Customer is unavailable.', 404)
+        playbooks = await run_in_threadpool(CoreAdapter(settings).playbooks, customer)
+        granted = set(await call('granted_playbooks', uid(request), user_id, customer))
+        available = [p for p in playbooks if p['key'] not in granted]
+        return render(request, 'partials/grant_fields.html', users=users, customers=customers,
+                      selected_user_id=user_id, selected_customer=customer, available_playbooks=available)
+
+    @app.post('/permissions')
+    async def permissions(request: Request):
+        administrator(request)
+        values = await form(request)
+        try:
+            user_id = int(one(values, 'user_id'))
+        except ValueError:
+            raise WebError('invalid_user', 'Choose a user.') from None
+        action = one(values, 'action')
+        if action not in {'grant','revoke'}:
+            raise WebError('invalid_action', 'Choose grant or revoke.')
+        await call('grant', uid(request), user_id, one(values, 'customer'), one(values, 'playbook'), revoke=action == 'revoke')
+        return redirect(request, '/users')
+
+    @app.get('/plans')
+    async def plans(request: Request):
+        return render(request, 'pages/plans.html', title='Saved plans', nav='plans', items=await call('plans', uid(request)))
+
+    @app.post('/plans')
+    async def save_plan(request: Request):
+        values = await form(request)
+        ident = await call('save_review',uid(request),one(values,'review_id'),one(values,'name'))
+        return redirect(request, '/plans/' + ident)
+
+    @app.get('/plans/{ident}')
+    async def plan(request: Request, ident: str):
+        saved = await call('plan', uid(request), ident)
+        return render(request, 'pages/plan_detail.html', title=saved['name'], nav='plans', saved=saved,
+                      result=saved['payload'], execution=settings.execution_enabled, credential_feature=settings.credentials_enabled, submission_key=uuid.uuid4().hex)
+
+    @app.post('/plans/{ident}/delete')
+    async def delete_plan(request: Request, ident: str):
+        await call('delete_plan', uid(request), ident)
+        return redirect(request, '/plans')
+
+    @app.post('/plans/bulk-delete')
+    async def bulk_delete_plans(request: Request):
+        values = await form(request)
+        await call('delete_plans', uid(request), values.get('plan_ids', []))
+        return redirect(request, '/plans')
+
+    @app.get('/api/v2/plans')
+    async def api_plans(request: Request):
+        return {'items': await call('plans', uid(request))}
+
+    @app.post('/api/v2/plans')
+    async def api_save_plan(request: Request):
+        value = await api_payload(request)
+        if set(value)-{'name','customer','playbook','targets','overrides','check','key_mode'}:
+            raise WebError('invalid_plan', 'Expected name, customer, playbook, targets and overrides.')
+        name = value.pop('name','')
+        ident = await call('save_plan', uid(request), name, **plan_payload(value))
+        return JSONResponse({'id': ident}, status_code=201)
+
+    @app.post('/api/v2/selections')
+    async def selection(request: Request):
+        value = await api_payload(request)
+        if set(value) != {'customer', 'playbook', 'targets'}:
+            raise WebError('invalid_selection', 'Expected customer, playbook and targets.')
+        return await call('save_selection', uid(request), **value)
+
+    @app.get('/jobs')
+    async def jobs(request: Request):
+        return render(request, 'pages/jobs.html', title='Jobs', nav='jobs',
+                      items=await call('jobs', uid(request)), execution=settings.execution_enabled,
+                      attention=await run_in_threadpool(attention, flow, uid(request), limit=100), attention_expanded=True)
+
+    @app.get('/_partials/attention')
+    async def attention_fragment(request: Request, all_items: bool = False):
+        return render(request, 'partials/attention.html',
+                      attention=await run_in_threadpool(attention, flow, uid(request), limit=100 if all_items else 8),
+                      attention_expanded=all_items)
+
+    @app.post('/jobs')
+    async def queue(request: Request):
+        values = await form(request)
+        if one(values, 'confirm') != 'reviewed':
+            raise WebError('review_required', 'Confirm that you reviewed the targets and change risk.')
+        when = None
+        if one(values, 'scheduled_at'):
+            try:
+                when = int(datetime.fromisoformat(one(values, 'scheduled_at')).replace(tzinfo=timezone.utc).timestamp())
+            except ValueError:
+                raise WebError('invalid_schedule', 'Use the UTC date and time selector.') from None
+        key = one(values, 'submission_key')
+        if not key or len(key) > 80 or not key.isalnum():
+            raise WebError('submission_key', 'Reload the plan before submitting.')
+        ident = await call('queue_review',uid(request),one(values,'review_id'),when,idempotency_key=key)
+        return redirect(request, '/jobs/' + ident)
+
+    @app.get('/jobs/{ident}')
+    async def job(request: Request, ident: str):
+        from aim_webgui.evidence_views import job_evidence
+        evidence=await run_in_threadpool(job_evidence,settings,uid(request),ident)
+        return render(request, 'pages/job.html', title='Job detail', nav='jobs', job=await call('job', uid(request), ident), **evidence)
+
+    @app.get('/_partials/jobs/{ident}')
+    async def job_fragment(request: Request, ident: str):
+        return render(request, 'partials/job.html', job=await call('job', uid(request), ident))
+
+    @app.get('/_partials/jobs/{ident}/credentials')
+    async def credential_fragment(request: Request, ident: str):
+        from aim_webgui.credentials.service import eligible
+        job = await run_in_threadpool(eligible, flow, uid(request), ident)
+        return render(request, 'partials/credential_panel.html', **form_context(job))
+
+    @app.get('/api/v2/runs/{ident}/credential-status')
+    async def credential_state(request: Request, ident: str):
+        return await run_in_threadpool(credential_status, flow, uid(request), ident)
+
+    @app.get('/jobs/{ident}/credentials')
+    async def credential_page(request: Request, ident: str):
+        from aim_webgui.credentials.service import eligible
+        job = await run_in_threadpool(eligible, flow, uid(request), ident)
+        return render(request, 'pages/credentials.html', title='One-run credentials', nav='jobs', **form_context(job))
+
+    async def credentials_submit(request, ident, value):
+        from aim_webgui.credentials.service import submit
+        # Trust only server-authenticated identity and session hash, never body fields.
+        await run_in_threadpool(auth.throttle, [('credential:' + str(uid(request)), 5)], window=60)
+        return await run_in_threadpool(submit, settings, uid(request), request.state.session['token_hash'], ident, value)
+
+    @app.post('/jobs/{ident}/credentials')
+    async def credential_form(request: Request, ident: str):
+        values = await form(request)
+        if set(values) - {'_csrf','vault_password','connection_password','ssh_key_passphrase'}:
+            raise WebError('invalid_credentials', 'Unexpected credential fields.')
+        await credentials_submit(request, ident, {k: one(values, k) for k in ('vault_password','connection_password','ssh_key_passphrase')})
+        return redirect(request, '/jobs/' + ident)
+
+    @app.post('/api/v2/runs/{ident}/credentials')
+    @app.post('/api/v2/jobs/{ident}/credentials')
+    async def credential_api(request: Request, ident: str):
+        return JSONResponse(await credentials_submit(request, ident, await api_payload(request)), status_code=202)
+
+    @app.post('/jobs/bulk-delete')
+    async def bulk_delete_jobs(request: Request):
+        values = await form(request)
+        await call('delete_jobs', uid(request), values.get('job_ids', []))
+        return redirect(request, '/jobs')
+
+    @app.post('/jobs/{ident}/retry')
+    async def retry_job(request: Request, ident: str):
+        new_ident = await call('retry_job', uid(request), ident)
+        return redirect(request, '/jobs/' + new_ident)
+
+    @app.post('/jobs/{ident}/{action}')
+    async def job_action(request: Request, ident: str, action: str):
+        await call('job_action', uid(request), ident, action)
+        return redirect(request, '/jobs/' + ident)
+
+    @app.get('/api/v2/runs')
+    async def api_jobs(request: Request):
+        return {'items': await call('jobs', uid(request))}
+
+    @app.get('/api/v2/runs/{ident}')
+    async def api_job(request: Request, ident: str):
+        return await call('job', uid(request), ident)
+
+    @app.post('/api/v2/runs')
+    async def api_queue(request: Request):
+        if not settings.execution_enabled:
+            raise WebError('execution_disabled', 'Execution is disabled; no run was started.', 501)
+        payload = await api_payload(request)
+        if set(payload)-{'review_id','scheduled_at','confirm'} or payload.get('confirm') is not True:
+            raise WebError('review_required','Send review_id, optional scheduled_at and confirm=true. Saving a plan is not required.')
+        key=request.headers.get('Idempotency-Key','')
+        ident=await call('queue_review',uid(request),payload.get('review_id'),payload.get('scheduled_at'),idempotency_key=key)
+        return JSONResponse({'id': ident}, status_code=202)
+
+    @app.post('/api/v2/runs/{ident}/retry')
+    async def api_retry(request: Request, ident: str):
+        new_ident = await call('retry_job', uid(request), ident)
+        return JSONResponse({'id': new_ident, 'retried_from': ident}, status_code=202)
+
+    @app.post('/api/v2/runs/{ident}/{action}')
+    async def api_action(request: Request, ident: str, action: str):
+        await call('job_action', uid(request), ident, action)
+        return {'id': ident, 'action': action}
diff --git a/scripts/addons/webgui/src/aim_webgui/security.py b/scripts/addons/webgui/src/aim_webgui/security.py
new file mode 100644
index 0000000..ed56947
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/security.py
@@ -0,0 +1,61 @@
+"""Small ASGI body limiter and response policy, independent of application routes."""
+from urllib.parse import urlsplit
+from starlette.responses import JSONResponse
+
+CSP = ("default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; "
+       "connect-src 'self'; font-src 'self'; object-src 'none'; base-uri 'none'; "
+       "frame-ancestors 'none'; form-action 'self'")
+
+
+class RequestPolicy:
+    def __init__(self, app, secure: bool = False):
+        self.app, self.secure = app, secure
+
+    async def __call__(self, scope, receive, send):
+        if scope['type'] != 'http':
+            return await self.app(scope, receive, send)
+        async def secured_send(message):
+            if message['type'] == 'http.response.start':
+                headers = list(message.get('headers', []))
+                headers.extend([(b'content-security-policy', CSP.encode()),
+                                (b'x-content-type-options', b'nosniff'),
+                                (b'referrer-policy', b'same-origin'),
+                                (b'x-frame-options', b'DENY'),
+                                (b'cache-control', b'no-store'),
+                                (b'permissions-policy', b'camera=(), microphone=(), geolocation=()')])
+                if self.secure:
+                    headers.append((b'strict-transport-security', b'max-age=31536000'))
+                message['headers'] = headers
+            await send(message)
+        upstream = receive
+        if scope['method'] not in {'GET', 'HEAD', 'OPTIONS'}:
+            limit = 8192 if scope.get('path', '').endswith('/credentials') else 65536
+            body = bytearray()
+            while True:
+                message = await receive()
+                if message['type'] == 'http.disconnect':
+                    return
+                body.extend(message.get('body', b''))
+                if len(body) > limit:
+                    return await JSONResponse({'error': {'code': 'body_too_large', 'message': 'Request exceeds the body limit.'}},
+                                              status_code=413)(scope, receive, secured_send)
+                if not message.get('more_body', False):
+                    break
+            delivered = False
+            async def replay():
+                nonlocal delivered
+                if not delivered:
+                    delivered = True
+                    return {'type': 'http.request', 'body': bytes(body), 'more_body': False}
+                return await upstream()
+            receive = replay
+        return await self.app(scope, receive, secured_send)
+
+
+def same_origin(actual: str, expected: str) -> bool:
+    try:
+        a, b = urlsplit(actual), urlsplit(expected)
+        return (a.scheme, a.hostname, a.port or (443 if a.scheme == 'https' else 80)) == (
+            b.scheme, b.hostname, b.port or (443 if b.scheme == 'https' else 80))
+    except ValueError:
+        return False
diff --git a/scripts/addons/webgui/src/aim_webgui/static/css/aim.css b/scripts/addons/webgui/src/aim_webgui/static/css/aim.css
new file mode 100644
index 0000000..8631bcf
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/static/css/aim.css
@@ -0,0 +1,200 @@
+a {text-decoration: none;} a:hover {text-decoration: underline;}
+:focus-visible {outline: 3px solid var(--aim-accent-ink); outline-offset: 3px;}
+h1 {font-size: clamp(1.65rem, 2.4vw, 2.1rem);font-weight: 700;letter-spacing: -.035em;}
+h2,h3 {letter-spacing: -.025em;}
+.app-shell {display: flex; min-height: 100vh;}
+.sidebar {width: 256px; flex: 0 0 256px; background: var(--aim-sidebar); color: var(--aim-ink); padding: 2rem 1rem; display: flex; flex-direction: column;}
+.brand {display: flex; gap: .75rem; align-items: center; color: white; padding: 0 .75rem 2.4rem; font-size: 1.8rem;font-weight: 750;line-height: 1.1;letter-spacing: -.03em;}
+.brand:hover {color: white;text-decoration: none;}
+.brand-mark {display: grid; place-items: center; background: var(--aim-accent); color: var(--aim-sidebar); width: 44px; height: 44px; border-radius: .7rem; font-size: 1.8rem;}
+.brand-subtitle {display: block; font-size: .5rem; letter-spacing: .13em; margin-top: .5rem; color: var(--aim-sidebar-muted);}
+.sidebar-caption {padding: 1rem .8rem .65rem; color: var(--aim-sidebar-muted); font-size: .65rem; font-weight: 600; letter-spacing: .12em;}
+.sidebar .nav-link {color: var(--aim-sidebar-link); border-radius: .45rem; padding: .8rem; font-size: .85rem; margin-bottom: .3rem; display: flex; align-items: center; gap: .85rem;}
+.sidebar .nav-link:hover {background: var(--aim-sidebar-hover);text-decoration: none;color: white;}
+.sidebar .nav-link.active {background: var(--aim-sidebar-active);color: var(--aim-sidebar-active-ink);box-shadow: inset 3px 0 var(--aim-accent);}
+.nav-symbol {font-size: .65rem; opacity: .75; font-family: monospace;}
+.sidebar-bottom {margin-top: auto; padding: 3rem .8rem 0; font-size: .7rem; color: var(--aim-sidebar-muted);line-height: 1.8;}
+.sidebar-bottom p {margin: .65rem 0 0;}
+.status-dot {display: inline-block; width: 6px; height: 6px; background: var(--aim-accent); border-radius: 50%; margin-right: .5rem;vertical-align: middle;}
+.workspace {flex: 1;min-width: 0;display: flex;flex-direction: column;}
+.topbar {min-height: 77px;display: flex; align-items: center; justify-content: space-between;gap: 1rem; padding: 1rem 2.5rem; border-bottom: 1px solid var(--aim-border);background: var(--aim-surface);}
+.environment-label {font-size: .65rem;font-weight: 650;letter-spacing: .12em;color: var(--aim-muted);}
+.account-links {display: flex; align-items: center;gap: .7rem;font-size: .8rem;}
+.account-links a {color: var(--aim-ink);font-weight: 600;}.account-links form {margin: 0;}
+.theme-control {display:inline-flex;align-items:center;gap:.2rem;padding:.2rem;border:1px solid var(--aim-border);border-radius:.55rem;background:var(--aim-surface-raised);}
+.theme-option {display:grid;place-items:center;width:2rem;height:2rem;padding:0;border:0;border-radius:.38rem;background:transparent;color:var(--aim-muted);font:inherit;line-height:1;cursor:pointer;}
+.theme-option span {font-size:1.08rem;transform:translateY(-.02rem);}
+.theme-option:hover {background:var(--aim-neutral-soft);color:var(--aim-ink);}
+.theme-option.active,.theme-option[aria-pressed="true"] {background:var(--aim-accent-soft);color:var(--aim-accent-ink);box-shadow:inset 0 0 0 1px var(--aim-pill-border);}
+.theme-option:focus-visible {outline-offset:2px;}
+.role-label {border: 1px solid var(--aim-border);border-radius: .3rem;padding: .1rem .4rem;color: var(--aim-muted);font-size: .65rem;}
+.main-content {padding: 2.5rem;max-width: 1540px;width: 100%;margin: 0 auto;flex: 1;}
+.page-heading {margin-bottom: 1.7rem;}.page-heading p:last-child {max-width: 850px;margin-top: .65rem;font-size: .92rem;line-height: 1.65;}
+.eyebrow {font-size: .64rem;font-weight: 700;letter-spacing: .13em;color: var(--aim-muted);margin-bottom: .65rem;display: block;}
+.mode-banner {border: 1px solid var(--aim-banner-border);background: linear-gradient(115deg,var(--aim-banner-start),var(--aim-banner-end));border-radius: var(--aim-radius);padding: 1.7rem;display: flex;align-items: center;justify-content: space-between;gap: 1.5rem;margin-bottom: 1.5rem;}
+.mode-banner h2 {font-size: 1.45rem;margin: .8rem 0 .5rem;}.mode-banner p {font-size: .85rem;color: var(--aim-muted);margin: 0;max-width: 590px;}.mode-banner .btn {flex-shrink: 0;}
+.pill {color: var(--aim-accent-ink);font-size: .6rem;letter-spacing: .09em;font-weight: 700;background: var(--aim-accent-soft);border: 1px solid var(--aim-pill-border);padding: .3rem .5rem;border-radius: .3rem;display: inline-block;}
+.metric-card {padding: 1.5rem;}.metric-label {font-size: .8rem;color: var(--aim-muted);font-weight: 500;}.metric-value {font-size: 2.4rem;letter-spacing: -.05em;line-height: 1.7;}
+.badge-success {background: var(--aim-success-soft);color: var(--aim-success);}.badge-warning {background: var(--aim-warning-soft);color: var(--aim-warning);}.badge-neutral {background: var(--aim-neutral-soft);color: var(--aim-neutral);}
+.entity-link,.entity-name {font-weight: 600;}.entity-link {color: var(--aim-ink);}
+.system-facts {display: grid;grid-template-columns: minmax(110px,1fr) minmax(0,1.4fr);font-size: .8rem;margin: 1.4rem 0;}.system-facts dt,.system-facts dd {padding: .65rem 0;border-bottom: 1px solid var(--aim-border);margin: 0;overflow-wrap: anywhere;}.system-facts dt {font-weight: 500;color: var(--aim-muted);}
+.note {font-size: .8rem;color: var(--aim-note-ink);background: var(--aim-note-bg);padding: 1rem;border-radius: .4rem;line-height: 1.6;border-left: 3px solid var(--aim-accent);}
+.empty-state {text-align: center;color: var(--aim-muted);padding: 3rem 1.5rem!important;}.empty-state p {font-size: .85rem;margin: .5rem 0 0;}
+.toolbar {display: flex;align-items: center;justify-content: space-between;gap: 1rem;margin-bottom: 1.5rem;}.search-form {display: flex;gap: .5rem;flex: 1;max-width: 570px;}.section-heading {display: flex;align-items: start;justify-content: space-between;gap: 1rem;}
+.form-card {max-width: 580px;}.login-layout {display: grid;grid-template-columns: minmax(270px,430px) minmax(250px,420px);gap: 4rem;align-items: center;}.login-note {color: var(--aim-muted);font-size: .9rem;line-height: 1.8;}.login-note h2 {color: var(--aim-ink);line-height: 1.4;}.section-index {display: block;font-size: .65rem;letter-spacing: .12em;color: var(--aim-accent-ink);font-weight: 650;margin-bottom: 1rem;}.reset-form {max-width: 360px;}
+.review-result {border-top: 3px solid var(--aim-accent);}.code-panel {background: var(--aim-code-panel);border: 1px solid var(--aim-border);padding: 1rem;border-radius: .4rem;margin-top: 1rem;white-space: pre-wrap;overflow-wrap: anywhere;}
+.selection-card-header {align-items:flex-start;}
+.selection-limit {font-size:.7rem;color:var(--aim-muted);white-space:nowrap;}
+.selection-column {width:64px!important;min-width:64px;text-align:center!important;padding-left:1rem!important;padding-right:1rem!important;}
+.selection-column .form-check-input {display:block;margin:0 auto;vertical-align:middle;}
+.group-selector {display:grid;grid-template-columns:minmax(130px,auto) 1fr;align-items:center;gap:1rem 1.25rem;padding:.9rem 1rem;border-bottom:1px solid var(--aim-border);background:var(--aim-surface-raised);}
+.group-selector-heading {display:flex;flex-direction:column;gap:.15rem;}
+.group-selector-label {font-size:.65rem;font-weight:700;letter-spacing:.1em;text-transform:uppercase;color:var(--aim-muted);}
+.group-selector-help {font-size:.68rem;color:var(--aim-muted);white-space:nowrap;}
+.group-selector-items {display:flex;flex-wrap:wrap;gap:.42rem;}
+.group-choice {display:inline-flex;align-items:center;gap:.45rem;min-height:2rem;padding:.32rem .58rem;border:1px solid var(--aim-border);border-radius:.5rem;background:var(--aim-surface);color:var(--aim-ink);font-size:.78rem;cursor:pointer;}
+.group-choice:hover {border-color:var(--aim-accent);}
+.group-choice .form-check-input {margin:0;}
+.group-count {display:inline-grid;place-items:center;min-width:1.45rem;height:1.45rem;padding:0 .35rem;border-radius:999px;background:var(--aim-neutral-soft);color:var(--aim-neutral);font-size:.68rem;font-variant-numeric:tabular-nums;}
+html[data-theme="dark"] body {background:var(--aim-bg);color:var(--aim-ink);}
+html[data-theme="dark"] code {color:#ffc18d;}
+html[data-theme="dark"] .text-secondary {color:var(--aim-muted)!important;}
+.workspace-footer {font-size: .65rem;color: var(--aim-muted);padding: 1.25rem 2.5rem;border-top: 1px solid var(--aim-border);display: flex;gap: 1rem;justify-content: space-between;}.workspace-footer span {white-space: nowrap;}
+.table-responsive {overscroll-behavior-x:contain;-webkit-overflow-scrolling:touch;}
+.skip-link {position: absolute;left: 1rem;top: -5rem;background: var(--aim-surface);color: var(--aim-ink);padding: .75rem;z-index: 100;}.skip-link:focus {top: 1rem;}.htmx-indicator {opacity: 0;}.htmx-request .htmx-indicator {opacity: 1;}
+@media(max-width:1100px){
+  .sidebar{width:218px;flex-basis:218px;}
+  .main-content{padding:1.75rem;}
+  .mode-banner{align-items:flex-start;flex-direction:column;}
+  .login-layout{gap:2rem;grid-template-columns:1fr;}
+  .login-note{max-width:500px;}
+  .topbar{padding:1rem 1.75rem;}
+}
+
+/* Compact layout primitives. The mobile header/menu lives in experience.css. */
+@media(max-width:760px){
+  .workspace{min-width:0;}
+  .main-content{padding:1.25rem max(1rem,env(safe-area-inset-right)) 1.5rem max(1rem,env(safe-area-inset-left));}
+  .page-heading{margin-bottom:1.3rem;}
+  .toolbar,.section-heading{flex-direction:column;align-items:stretch;}
+  .group-selector{grid-template-columns:1fr;align-items:start;gap:.65rem;padding:.85rem 1rem;}
+  .group-selector-help{white-space:normal;}
+  .group-selector-items{gap:.5rem;}
+  .group-choice{min-height:2.65rem;padding:.45rem .65rem;}
+  .selection-limit{white-space:normal;}
+  .selection-column{width:56px!important;min-width:56px;padding-left:.75rem!important;padding-right:.75rem!important;}
+  .mode-banner{padding:1.25rem;}
+  .workspace-footer{padding:1rem max(1rem,env(safe-area-inset-right)) calc(1rem + env(safe-area-inset-bottom)) max(1rem,env(safe-area-inset-left));flex-direction:column;gap:.35rem;}
+  .workspace-footer span{white-space:normal;}
+  .table-responsive>.table{min-width:620px;}
+  .host-selection-card .table{min-width:720px;}
+  .table td,.table th{padding:.8rem 1rem;}
+}
+
+@media(max-width:480px){
+  h1{font-size:1.55rem;}
+  .brand-subtitle{display:none;}
+  .topbar{padding-top:.55rem;padding-bottom:.55rem;}
+  .account-links>a{max-width:8.5rem;}
+  .main-content{padding-top:1rem;}
+  .card-body.p-4{padding:1.1rem!important;}
+  .card-header{padding:1rem;}
+  .search-form{max-width:none;flex-direction:column;}
+  .search-form .btn,.toolbar>.btn,.mode-banner>.btn{width:100%;}
+  .group-selector-items{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));width:100%;}
+  .group-choice{width:100%;justify-content:flex-start;}
+  .group-count{margin-left:auto;}
+  .system-facts{grid-template-columns:1fr;}
+  .system-facts dt{padding-bottom:.15rem;border-bottom:0;}
+  .system-facts dd{padding-top:0;}
+}
+
+@media(prefers-reduced-motion:reduce){*,*::before,*::after{scroll-behavior:auto!important;transition:none!important;}}
+
+/* 1.0 shared responsive primitives. Count is a separate fixed grid track. */
+.group-choice { display:grid; grid-template-columns:1.05rem minmax(0,1fr) auto; align-items:center; gap:.5rem; min-width:0; max-width:100%; }
+.group-choice .group-name { min-width:0; overflow-wrap:anywhere; line-height:1.3; }
+.group-choice .group-count { margin-left:0; white-space:nowrap; justify-self:end; flex:none; }
+
+.filter-toolbar { display:flex; flex-wrap:wrap; gap:.65rem; padding:1rem; align-items:end; }
+.filter-toolbar>label { flex:1 1 10rem; min-width:0; }
+.filter-toolbar .btn { min-height:2.65rem; }
+.selection-help { padding:0 1rem .75rem; margin:0; }
+.workflow-grid { display:grid; grid-template-columns:repeat(2,minmax(0,1fr)); gap:1rem; }
+.workflow-grid>* { min-width:0; }
+.workflow-actions { display:flex; flex-wrap:wrap; gap:.6rem; align-items:center; }
+.workflow-actions form { margin:0; }
+.form-text, .text-break, .system-facts dd { overflow-wrap:anywhere; }
+.event-list { list-style:none; padding:0; }
+.event-list li { border-bottom:1px solid var(--aim-border); padding:.75rem 0; }
+.job-status { background:var(--aim-accent-soft); color:var(--aim-accent-ink); padding:.3rem .65rem; border-radius:1rem; }
+@media(max-width:760px) {
+ .workflow-grid { grid-template-columns:1fr; }
+ .workflow-actions .btn { min-height:44px; }
+}
+@media(max-width:480px) {
+ .group-choice { grid-template-columns:1rem minmax(0,1fr) auto; gap:.35rem; padding:.45rem .5rem; }
+ .group-count { font-variant-numeric:tabular-nums; font-size:.72rem; padding:.15rem .3rem; }
+ .filter-toolbar>label, .filter-toolbar>.btn { flex-basis:100%; }
+}
+
+/* Shared, accessible credential controls. No page-local colour literals. */
+.credential-card { max-width: 52rem; }
+.credential-switch { display: grid; grid-template-columns: repeat(2,minmax(0,1fr)); gap: .25rem; padding: .25rem; border: 1px solid var(--aim-border); border-radius: .75rem; }
+.credential-switch label { position: relative; min-width: 0; margin: 0; }
+.credential-switch label span, .credential-choice { display: flex; align-items: center; justify-content: center; min-height: 44px; padding: .6rem .75rem; border-radius: .5rem; text-align: center; overflow-wrap: anywhere; }
+.credential-switch input { position: absolute; opacity: 0; width: 1px; height: 1px; }
+.credential-switch input:checked + span, .credential-choice.is-active { background: var(--aim-accent); color: var(--aim-on-accent); font-weight: 700; }
+.credential-switch input:focus-visible + span { outline: 3px solid var(--aim-accent); outline-offset: 2px; }
+.credential-mode { min-width: 0; }
+@media (max-width: 480px) { [data-secret-form] .btn { width: 100%; margin-top: .5rem; } }
+
+/* Ephemeral job console: dark terminal surface in both themes, accent-aware controls. */
+.live-console-card { overflow: hidden; }
+.console-toolbar { display:flex; justify-content:space-between; align-items:center; gap:1rem; padding:1rem 1.25rem; border-bottom:1px solid var(--bs-border-color); }
+.console-controls { display:flex; align-items:center; justify-content:flex-end; gap:1rem; flex-wrap:wrap; }
+.console-state { font-size:.78rem; letter-spacing:.06em; text-transform:uppercase; color:var(--bs-secondary-color); }
+.live-console { margin:0; height:clamp(18rem,55dvh,40rem); max-height:calc(100dvh - 12rem); overflow-y:auto; overscroll-behavior:contain; scrollbar-gutter:stable; padding:1rem 1.25rem; border:0; border-radius:0; background:var(--aim-console-bg); color:var(--aim-console-ink); font-size:.82rem; line-height:1.55; white-space:pre-wrap; overflow-wrap:anywhere; }
+.console-line-notice { color:inherit; }
+.console-footnote { padding:.7rem 1.25rem; font-size:.78rem; color:var(--bs-secondary-color); border-top:1px solid var(--bs-border-color); }
+@media (max-width: 575.98px) {
+  .console-toolbar { align-items:flex-start; flex-direction:column; }
+  .console-controls { justify-content:flex-start; width:100%; }
+  .live-console { height:48dvh; min-height:14rem; max-height:calc(100dvh - 13rem); font-size:.76rem; padding:.85rem; }
+}
+
+
+/* Operational overview hierarchy and semantic state chips. */
+.nav-link-featured { font-weight:700; }
+.status-tag { display:inline-flex; align-items:center; gap:.42rem; border:1px solid var(--aim-border); border-radius:999px; padding:.28rem .58rem; font-size:.74rem; font-weight:750; line-height:1.15; text-transform:capitalize; white-space:nowrap; background:var(--bs-tertiary-bg); }
+.status-dot-mini { width:.48rem; height:.48rem; border-radius:50%; background:currentColor; flex:0 0 auto; }
+.status-successful { color:var(--bs-success-text-emphasis); background:var(--bs-success-bg-subtle); border-color:var(--bs-success-border-subtle); }
+.status-failed,.status-timed_out { color:var(--bs-danger-text-emphasis); background:var(--bs-danger-bg-subtle); border-color:var(--bs-danger-border-subtle); }
+.status-running { color:var(--bs-primary-text-emphasis); background:var(--bs-primary-bg-subtle); border-color:var(--bs-primary-border-subtle); }
+.status-running .status-dot-mini { animation:aim-status-pulse 1.5s ease-in-out infinite; }
+.status-pending,.status-queued,.status-blocked { color:var(--bs-warning-text-emphasis); background:var(--bs-warning-bg-subtle); border-color:var(--bs-warning-border-subtle); }
+.status-canceled,.status-interrupted { color:var(--bs-secondary-color); background:var(--bs-secondary-bg); }
+@keyframes aim-status-pulse { 50% { opacity:.35; transform:scale(.82); } }
+@media (prefers-reduced-motion:reduce) { .status-running .status-dot-mini { animation:none; } }
+.mode-tag { display:inline-block; border:1px solid var(--aim-border); border-radius:.4rem; padding:.18rem .4rem; font-size:.72rem; font-weight:700; text-transform:uppercase; }
+.overview-toolbar { display:flex; justify-content:space-between; align-items:end; gap:1rem; margin-bottom:.75rem; }
+.overview-toolbar>div { display:grid; gap:.12rem; }
+.operation-link { font-weight:750; }
+.row-meta,.host-preview { margin-top:.2rem; color:var(--bs-secondary-color); font-size:.76rem; line-height:1.35; }
+.host-preview { max-width:30rem; overflow-wrap:anywhere; }
+.host-preview span { white-space:nowrap; font-weight:650; }
+.operational-table tbody tr:hover { background:color-mix(in srgb,var(--aim-accent) 4%,transparent); }
+.audit-stack { display:grid; gap:1rem; }
+.audit-filter { padding:1rem 1.15rem; margin:0; border:1px solid var(--aim-border); border-radius:.65rem; background:var(--bs-body-bg); }
+.audit-filter>label { flex:1 1 24rem; }
+.filter-actions { display:flex; gap:.65rem; align-items:end; }
+@media (max-width:760px) { .overview-toolbar { align-items:stretch; flex-direction:column; } .overview-toolbar .btn { align-self:flex-start; } .filter-actions { width:100%; } .filter-actions .btn { flex:1; } }
+
+.status-partially_succeeded { color:var(--bs-warning-text-emphasis); background:var(--bs-warning-bg-subtle); border-color:var(--bs-warning-border-subtle); }
+.target-outcomes { border:1px solid var(--aim-border); border-radius:.7rem; padding:1rem; background:var(--aim-surface-raised); }
+.outcome-counters { display:flex; flex-wrap:wrap; gap:.55rem 1rem; margin-top:.8rem; font-size:.8rem; color:var(--aim-muted); }
+.target-outcome-table td:last-child { min-width:18rem; }
+.target-status-successful { color:var(--bs-success-text-emphasis); background:var(--bs-success-bg-subtle); border-color:var(--bs-success-border-subtle); }
+.target-status-failed,.target-status-unreachable { color:var(--bs-danger-text-emphasis); background:var(--bs-danger-bg-subtle); border-color:var(--bs-danger-border-subtle); }
+.target-status-not_started,.target-status-indeterminate { color:var(--bs-secondary-color); background:var(--bs-secondary-bg); }
+.outcome-summary { margin-top:.35rem; }
diff --git a/scripts/addons/webgui/src/aim_webgui/static/css/bootstrap-overrides.css b/scripts/addons/webgui/src/aim_webgui/static/css/bootstrap-overrides.css
new file mode 100644
index 0000000..ed9d7fe
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/static/css/bootstrap-overrides.css
@@ -0,0 +1,65 @@
+/* Component variables are intentional: --bs-primary alone does not recolor buttons. */
+:root {
+  --bs-primary: var(--aim-accent);
+  --bs-primary-rgb: var(--aim-accent-rgb);
+  --bs-body-color: var(--aim-ink);
+  --bs-body-bg: var(--aim-bg);
+  --bs-secondary-color: var(--aim-muted);
+  --bs-border-color: var(--aim-border);
+  --bs-link-color: var(--aim-accent-ink);
+  --bs-link-hover-color: var(--aim-link-hover);
+  --bs-border-radius: .5rem;
+  --bs-font-sans-serif: system-ui, -apple-system, "Segoe UI", sans-serif;
+}
+.btn-primary {
+  --bs-btn-color: #1e1d1a;
+  --bs-btn-bg: var(--aim-accent);
+  --bs-btn-border-color: var(--aim-accent);
+  --bs-btn-hover-color: #1e1d1a;
+  --bs-btn-hover-bg: var(--aim-accent-hover);
+  --bs-btn-hover-border-color: var(--aim-accent-hover);
+  --bs-btn-active-color: #1e1d1a;
+  --bs-btn-active-bg: var(--aim-accent-hover);
+  --bs-btn-active-border-color: var(--aim-accent-hover);
+  --bs-btn-disabled-bg: var(--aim-accent);
+  --bs-btn-disabled-color: #1e1d1a;
+  --bs-btn-disabled-border-color: var(--aim-accent);
+  --bs-btn-focus-shadow-rgb: var(--aim-accent-rgb);
+}
+.btn-outline-primary {
+  --bs-btn-color: var(--aim-accent-ink);
+  --bs-btn-border-color: var(--aim-accent);
+  --bs-btn-hover-color: #1e1d1a;
+  --bs-btn-hover-bg: var(--aim-accent);
+  --bs-btn-hover-border-color: var(--aim-accent);
+  --bs-btn-active-bg: var(--aim-accent-hover);
+  --bs-btn-active-color: #1e1d1a;
+}
+.btn-outline-secondary {
+  --bs-btn-color: var(--aim-muted);
+  --bs-btn-border-color: var(--aim-border);
+  --bs-btn-hover-color: var(--aim-ink);
+  --bs-btn-hover-bg: var(--aim-surface-raised);
+  --bs-btn-hover-border-color: var(--aim-border);
+  --bs-btn-active-color: var(--aim-ink);
+  --bs-btn-active-bg: var(--aim-surface-raised);
+  --bs-btn-active-border-color: var(--aim-border);
+}
+.btn {font-weight: 600; padding: .65rem 1rem;}
+.btn-sm {padding: .35rem .6rem; font-size: .8rem;}
+.card {--bs-card-border-color: var(--aim-border); --bs-card-border-radius: var(--aim-radius); --bs-card-bg: var(--aim-surface); color: var(--aim-ink); box-shadow: var(--aim-shadow); overflow: hidden;}
+.card-header {background: var(--aim-surface); border-color: var(--aim-border); padding: 1.25rem 1.5rem; display: flex; gap: 1rem; align-items: center; justify-content: space-between;}
+.form-control,.form-select {background-color: var(--aim-surface); color: var(--aim-ink); border-color: var(--aim-border); min-height: 2.65rem;}
+.form-control::placeholder {color: var(--aim-muted); opacity: .8;}
+.form-control:focus,.form-select:focus {background-color: var(--aim-surface); color: var(--aim-ink); border-color: var(--aim-accent); box-shadow: 0 0 0 .2rem rgb(var(--aim-accent-rgb) / 22%);}
+.form-select option {background: var(--aim-surface); color: var(--aim-ink);}
+.form-check-input {background-color: var(--aim-surface); border-color: var(--aim-border);}
+.form-check-input:checked,.form-check-input:indeterminate {background-color: var(--aim-accent-ink);border-color: var(--aim-accent-ink);}
+.form-label {font-size: .875rem; font-weight: 600;}
+.form-text {color: var(--aim-muted);}
+.table {--bs-table-bg: var(--aim-surface); --bs-table-color: var(--aim-ink); --bs-table-border-color: var(--aim-border); font-size: .9rem;}
+.table th {background: var(--aim-table-head); color: var(--aim-muted); font-size: .7rem; letter-spacing: .06em; text-transform: uppercase; padding: .85rem 1.5rem;}
+.table td {padding: 1rem 1.5rem;}
+.table tr:last-child td {border-bottom: 0;}
+.badge {font-weight: 550; border-radius: .35rem; padding: .45rem .6rem; line-height: 1.2; white-space: normal;}
+.alert-danger {--bs-alert-bg: color-mix(in srgb, #dc3545 12%, var(--aim-surface)); --bs-alert-color: var(--aim-ink); --bs-alert-border-color: color-mix(in srgb, #dc3545 32%, var(--aim-border));}
diff --git a/scripts/addons/webgui/src/aim_webgui/static/css/credentials.css b/scripts/addons/webgui/src/aim_webgui/static/css/credentials.css
new file mode 100644
index 0000000..aecb901
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/static/css/credentials.css
@@ -0,0 +1,88 @@
+/* One-run dialog and attention surface. Bootstrap 5 native radio/label semantics. */
+.credential-dialog { padding: 0; border: 1px solid var(--aim-border); border-radius: 1.1rem; background: var(--aim-surface); color: var(--aim-ink); width: min(36rem, calc(100vw - 2rem)); max-width: 100%; max-height: calc(100dvh - 2rem); overflow: hidden; box-shadow: var(--aim-shadow); }
+.credential-dialog[open] { display: flex; flex-direction: column; }
+.credential-dialog::backdrop { background: var(--aim-dialog-backdrop); }
+html.credential-modal-open { overflow: hidden; scrollbar-gutter: stable; }
+.credential-dialog-header { flex: 0 0 auto; display: flex; align-items: flex-start; gap: 1rem; padding: 1.25rem 1.5rem; border-bottom: 1px solid var(--aim-border); background: var(--aim-surface-raised); }
+.credential-dialog-header > div { flex: 1; min-width: 0; }
+.credential-dialog-header .eyebrow { margin: 0 0 .3rem; }
+.credential-dialog-header h2 { font-size: 1.45rem; margin: 0; line-height: 1.2; }
+.credential-dialog-header p:last-child { margin: .35rem 0 0; color: var(--aim-muted); font-size: .85rem; }
+.credential-close { width: 2.75rem; min-width: 2.75rem; height: 2.75rem; padding: 0; font-size: 1.5rem; line-height: 1; }
+.credential-dialog-body { flex: 1 1 auto; min-height: 0; overflow-y: auto; overscroll-behavior: contain; padding: 1.25rem 1.5rem; }
+.credential-panel { text-align: left; min-width: 0; }
+.credential-panel [hidden] { display: none !important; }
+.credential-scope { display: flex; align-items: center; gap: .75rem; padding: .85rem; background: var(--aim-code-panel); border: 1px solid var(--aim-border); border-radius: .7rem; margin-bottom: 1rem; }
+.credential-scope > div { min-width: 0; }
+.credential-scope strong { display: block; font-size: 1rem; overflow-wrap: anywhere; }
+.credential-scope div > span { display: block; margin-top: .25rem; color: var(--aim-muted); font-size: .85rem; overflow-wrap: anywhere; }
+.credential-scope-symbol { display: grid; place-items: center; width: 2.5rem; min-width: 2.5rem; height: 2.5rem; border-radius: .55rem; background: var(--aim-accent-soft); color: var(--aim-accent-ink); }
+.credential-scope-symbol svg { fill: none; stroke: currentColor; stroke-width: 1.6; stroke-linecap: round; stroke-linejoin: round; }
+.credential-reservation { display: flex; flex-wrap: wrap; justify-content: space-between; align-items: center; gap: .5rem; color: var(--aim-muted); font-size: .83rem; margin-bottom: .85rem; }
+[data-credential-countdown] { font-variant-numeric: tabular-nums; }
+.credential-reservation.is-urgent { color: var(--aim-warning); }
+.credential-intro { color: var(--aim-muted); font-size: .9rem; margin-bottom: 1.2rem; }
+.credential-inputs { padding: 0; border: 0; margin: 0; min-width: 0; }
+.credential-field { margin-bottom: 1.1rem; min-width: 0; }
+.credential-field .form-label { display: flex; align-items: baseline; flex-wrap: wrap; justify-content: space-between; gap: .35rem; width: 100%; font-weight: 600; margin-bottom: .4rem; }
+.field-requirement { color: var(--aim-muted); font-size: .76rem; font-weight: 400; }
+.credential-input-row { display: flex; align-items: stretch; gap: .4rem; }
+.credential-input-row .form-control { min-width: 0; font-size: 1rem; min-height: 2.8rem; }
+.credential-reveal { min-width: 4rem; min-height: 2.8rem; font-size: .85rem; }
+.credential-caps { color: var(--aim-warning); font-size: .8rem; margin: .35rem 0 0; }
+.credential-field .form-text { margin-top: .35rem; line-height: 1.45; }
+.credential-key-source { margin: 0 0 .8rem; border: 0; padding: 0; min-width: 0; }
+.credential-key-source legend { font-size: .94rem; font-weight: 600; margin: 0 0 .5rem; float: none; width: auto; }
+.credential-segments { display: flex; width: 100%; gap: 0; }
+.credential-segments .btn { flex: 1 1 0; min-width: 0; min-height: 2.75rem; display: flex; justify-content: center; align-items: center; white-space: normal; font-size: .85rem; line-height: 1.25; border-color: var(--aim-border); background: var(--aim-surface); color: var(--aim-muted); }
+.credential-segments .btn-check:checked + .btn { background: var(--aim-accent-soft); border-color: var(--aim-accent-ink); color: var(--aim-accent-ink); font-weight: 600; }
+.credential-segments .btn-check:focus-visible + .btn { outline: 2px solid var(--aim-accent-ink); outline-offset: 3px; box-shadow: none; z-index: 2; }
+.credential-source-choice .form-text { margin: .5rem 0 .9rem; }
+.credential-explanation { padding: .8rem 0; margin: .2rem 0 .8rem; border-top: 1px solid var(--aim-border); border-bottom: 1px solid var(--aim-border); }
+.credential-explanation summary { color: var(--aim-muted); font-size: .85rem; cursor: pointer; }
+.credential-explanation p { font-size: .82rem; margin: .65rem 0 0; overflow-wrap: anywhere; }
+.credential-privacy { margin: .9rem 0; color: var(--aim-muted); font-size: .83rem; }
+.credential-privacy span { color: var(--aim-success); }
+.credential-submit-row { display: flex; flex-wrap: wrap; align-items: stretch; gap: .6rem; }
+.credential-submit-row .btn { min-height: 2.8rem; }
+.credential-submit-row .btn-primary { flex: 1; }
+.credential-submit-note { margin: .65rem 0 0; font-size: .78rem; }
+.credential-feedback { border-radius: .6rem; border: 1px solid var(--aim-border); padding: .9rem; margin-bottom: 1rem; background: var(--aim-neutral-soft); color: var(--aim-ink); font-size: .9rem; }
+.credential-feedback[data-tone="error"] { border-color: var(--aim-danger); }
+.credential-feedback[data-tone="accepted"] { color: var(--aim-success); background: var(--aim-success-soft); }
+.credential-fallback { max-width: 42rem; }
+.credential-loading { padding: 1rem; color: var(--aim-muted); }
+.status-waiting_credentials { color: var(--aim-warning); background: var(--aim-warning-soft); border-color: var(--aim-border); }
+.attention-section { margin: 1.2rem 0; padding: 1rem 1.2rem; background: var(--aim-surface); border: 1px solid var(--aim-border); border-radius: var(--aim-radius); }
+.attention-section .section-heading { margin-bottom: .75rem; }
+.attention-count { display: grid; place-items: center; min-width: 2rem; min-height: 2rem; padding: .15rem .45rem; background: var(--aim-warning-soft); color: var(--aim-warning); border-radius: .5rem; font-weight: 700; }
+.attention-items { display: grid; gap: .75rem; }
+.attention-item { display: flex; align-items: center; justify-content: space-between; gap: 1rem; padding: .9rem; border-radius: .65rem; background: var(--aim-code-panel); }
+.attention-item > div { min-width: 0; }
+.attention-item strong { display: block; margin-top: .4rem; overflow-wrap: anywhere; }
+.attention-item p { margin: .15rem 0; color: var(--aim-muted); font-size: .84rem; overflow-wrap: anywhere; }
+.attention-item small { color: var(--aim-muted); }
+.attention-item > a { flex-shrink: 0; min-height: 2.6rem; align-content: center; }
+.attention-empty { margin: 0; color: var(--aim-muted); font-size: .85rem; }
+@media(max-width:760px) {
+  .credential-dialog { width: calc(100vw - 1rem); border-radius: .85rem; max-height: calc(100dvh - 1rem); }
+  .credential-dialog-header { padding: .9rem 1rem; }
+  .credential-dialog-header h2 { font-size: 1.2rem; }
+  .credential-dialog-body { padding: 1rem; }
+  .credential-submit-row { flex-direction: column; }
+  .credential-scope { padding: .65rem; }
+  .attention-section { padding: .9rem; }
+  .attention-item { align-items: stretch; flex-direction: column; gap: .6rem; }
+}
+@media(max-height:430px) {
+  .credential-dialog-header { padding: .55rem 1rem; }
+  .credential-dialog-header .eyebrow, .credential-dialog-header p:last-child { display: none; }
+  .credential-close { min-height: 2.5rem; height: 2.5rem; }
+}
+/* Do not inherit the old full-width mobile secret-form button rule in input groups. */
+.credential-input-row .form-control { flex: 1 1 auto; width: 0; }
+.credential-panel .credential-input-row .credential-reveal { flex: 0 0 4.25rem; width: 4.25rem; margin: 0; }
+.credential-panel .credential-segments .btn { width: auto; margin-top: 0; }
+.credential-panel .credential-submit-row .btn { margin-top: 0; }
+/* Programmatic heading focus announces the modal; keyboard controls retain rings. */
+.credential-dialog-header h2:focus { outline: none; }
diff --git a/scripts/addons/webgui/src/aim_webgui/static/css/evidence.css b/scripts/addons/webgui/src/aim_webgui/static/css/evidence.css
new file mode 100644
index 0000000..b392abb
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/static/css/evidence.css
@@ -0,0 +1,49 @@
+/* Evidence views use the existing AIM tokens; no new theme or navigation language. */
+.job-view-nav {display:flex; flex-wrap:wrap; gap:.4rem; margin:0 0 1.2rem; padding:.35rem; background:var(--aim-surface); border:1px solid var(--aim-border);border-radius:var(--aim-radius);}
+.job-view-nav a {padding:.55rem 1rem; border-radius:.5rem; color:var(--aim-ink);text-decoration:none;}
+.job-view-nav a:hover,.job-view-nav a[aria-current] {background:var(--aim-accent-soft);color:var(--aim-accent-ink);}
+#job-status,#job-progress,#job-targets,#job-reports {scroll-margin-top:5rem;}
+.progress-checkpoint {display:grid;grid-template-columns:1fr 2fr;gap:.55rem 1rem;color:var(--aim-muted);font-size:.875rem;}
+.progress-checkpoint strong {color:var(--aim-ink);}
+.progress-checkpoint span {min-width:0;overflow-wrap:anywhere;}
+.journal-warning {color:var(--aim-warning);background:var(--aim-warning-soft);padding:.8rem;border-block:1px solid var(--aim-border);}
+.journal-output {white-space:pre-wrap;overflow-wrap:anywhere;scrollbar-gutter:stable;}
+.journal-timeline {list-style:none;padding:0;margin:0;}
+.journal-timeline li {padding:.75rem 0;border-bottom:1px solid var(--aim-border);}
+.journal-timeline time {font-size:.8rem;color:var(--aim-muted);}
+.journal-timeline pre {white-space:pre-wrap;overflow-wrap:anywhere;margin:.35rem 0;font-size:.85rem;color:var(--aim-ink);}
+.report-slot-list {display:grid;gap:.6rem;grid-template-columns:repeat(auto-fit,minmax(min(100%,20rem),1fr));}
+.report-slot {display:grid;grid-template-columns:1fr auto;gap:.4rem .7rem;padding:.9rem;border:1px solid var(--aim-border);border-radius:.6rem;color:var(--aim-ink);text-decoration:none;min-width:0;}
+.report-slot .entity-name {overflow-wrap:anywhere;min-width:0;}
+.report-slot:hover {background:var(--aim-accent-soft);}
+.report-slot small {color:var(--aim-muted);}
+.report-open {font-size:.8rem;color:var(--aim-accent-ink);}
+.report-availability {display:inline-flex;align-items:center;font-size:.78rem;border-radius:2rem;padding:.25rem .7rem;background:var(--aim-neutral-soft);color:var(--aim-neutral);width:max-content;max-width:100%;}
+.report-available {color:var(--aim-success);background:var(--aim-success-soft);}
+.report-invalid,.report-missing,.report-indeterminate {color:var(--aim-warning);background:var(--aim-warning-soft);}
+.report-host-select {display:grid;grid-template-columns:auto minmax(0,1fr) auto;align-items:center;gap:.8rem;}
+.report-facts {display:grid;grid-template-columns:repeat(auto-fit,minmax(min(100%,14rem),1fr));gap:.75rem;margin:0;}
+.report-facts>div {padding:.85rem;background:var(--aim-code-panel);border-radius:.5rem;min-width:0;}
+.report-facts dt {font-size:.85rem;color:var(--aim-muted);font-weight:500;}
+.report-facts dd {margin:.35rem 0 0;font-weight:600;overflow-wrap:anywhere;}
+.fact-yes {color:var(--aim-success);}.fact-no {color:var(--aim-muted);}
+.report-semantic-note {border-left:3px solid var(--aim-accent);padding:.7rem 1rem;background:var(--aim-note-bg);color:var(--aim-note-ink);}
+.report-table {font-size:.85rem;min-width:32rem;}
+.report-table td {white-space:normal;overflow-wrap:anywhere;max-width:28rem;min-width:8rem;vertical-align:top;}
+.report-table th {min-width:7rem;}
+.report-values {padding:1rem 1.2rem 1rem 2rem;overflow-wrap:anywhere;}
+.report-values li {padding:.2rem;}
+.report-key-values>div {padding:1rem;border-top:1px solid var(--aim-border);}
+.report-key-values pre {white-space:pre-wrap;overflow-wrap:anywhere;margin:.4rem 0 0;max-height:14rem;overflow:auto;}
+.report-json {min-height:8rem;max-height:min(45dvh,32rem);white-space:pre;overflow:auto;overscroll-behavior:contain;margin-top:.8rem;font-size:.85rem;}
+[data-json-status] {margin-left:.7rem;color:var(--aim-muted);font-size:.85rem;}
+@media (max-width:760px) {
+ .job-view-nav {gap:.1rem;}.job-view-nav a {flex:1;text-align:center;padding:.6rem .4rem;font-size:.85rem;}
+ .progress-checkpoint {grid-template-columns:1fr;gap:.35rem;}
+ .report-host-select {grid-template-columns:1fr auto;}.report-host-select label {grid-column:1/-1;}
+ .report-slot {grid-template-columns:minmax(0,1fr) auto;}.report-slot small {grid-column:1/-1;}
+ .report-slot-list {grid-template-columns:1fr;}.report-facts {grid-template-columns:repeat(2,minmax(0,1fr));gap:.45rem;}
+ .report-facts>div {padding:.65rem;}.report-facts dt {font-size:.8rem;}
+ .report-semantic-note {font-size:.875rem;}.report-json {max-height:38dvh;}
+}
+@media (max-width:360px) {.report-facts{grid-template-columns:1fr;}}
diff --git a/scripts/addons/webgui/src/aim_webgui/static/css/experience.css b/scripts/addons/webgui/src/aim_webgui/static/css/experience.css
new file mode 100644
index 0000000..5f88b97
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/static/css/experience.css
@@ -0,0 +1,162 @@
+/* Read-only workspaces. Shared colours live in tokens.css. */
+.mobile-topbar { display:none; }
+.main-content { overflow-wrap:anywhere; }
+.page-heading h1 { overflow-wrap:anywhere; }
+.context-links,.inventory-breadcrumbs { display:flex; flex-wrap:wrap; gap:.6rem 1.15rem; align-items:center; margin-bottom:1.3rem; font-size:.85rem; }
+.inventory-breadcrumbs { gap:.5rem; }
+.inventory-breadcrumbs [aria-current] { color:var(--aim-ink); font-weight:750; }
+.coverage-note { display:block; font-size:.76rem; line-height:1.65; color:var(--aim-muted); }
+.context-links a,.membership-chip { color:var(--aim-accent-ink); }
+.host-identity { display:flex; flex-direction:row; gap:1rem; padding:1.35rem; align-items:flex-start; }
+.host-identity>div:last-child { min-width:0; }
+.entity-symbol { display:grid; place-items:center; width:3rem; height:3rem; flex:0 0 3rem; border-radius:.8rem; background:var(--aim-accent-soft); color:var(--aim-accent-ink); font-size:1.5rem; }
+.small-symbol { width:2.25rem; height:2.25rem; flex-basis:2.25rem; border-radius:.6rem; font-size:1.2rem; }
+.membership-links { display:flex; flex-wrap:wrap; gap:.5rem; }
+.membership-chip { display:inline-flex; border:1px solid var(--aim-border); padding:.3rem .6rem; border-radius:.45rem; font-size:.8rem; background:var(--aim-surface-raised); }
+.history-filters { display:grid; grid-template-columns:repeat(auto-fit,minmax(135px,1fr)); align-items:end; gap:1rem; padding:1.1rem; margin:1rem 0; border:1px solid var(--aim-border); border-radius:var(--aim-radius); background:var(--aim-surface); }
+.history-filters label { display:grid; gap:.45rem; font-size:.76rem; font-weight:650; min-width:0; }
+.history-filters .btn { min-height:42px; }
+.insight-metrics { display:grid; grid-template-columns:repeat(3,minmax(0,1fr)); gap:1rem; margin:1.2rem 0; }
+.insight-metrics .card { padding:1.25rem; min-width:0; }
+.insight-metrics strong { font-size:2.2rem; font-weight:700; letter-spacing:-.04em; line-height:1.4; }
+.insight-metrics section>span:last-child { font-size:.76rem; color:var(--aim-muted); }
+.distribution-card { padding:1.25rem; }
+.outcome-bar { display:block; width:100%; height:12px; border-radius:999px; overflow:hidden; margin:.6rem 0 1rem; background:var(--aim-neutral-soft); }
+.chart-successful { fill:var(--aim-success); background:var(--aim-success); }
+.chart-failed { fill:var(--aim-danger); background:var(--aim-danger); }
+.chart-unreachable { fill:var(--aim-warning); background:var(--aim-warning); }
+.chart-not_started { fill:var(--aim-muted); background:var(--aim-muted); }
+.chart-indeterminate { fill:var(--aim-info); background:var(--aim-info); }
+.chart-unavailable { fill:var(--aim-neutral); background:var(--aim-neutral); }
+.chart-outstanding { fill:var(--aim-accent); background:var(--aim-accent); }
+.outcome-legend { display:flex; gap:.6rem 1.15rem; flex-wrap:wrap; font-size:.76rem; margin-bottom:.8rem; }
+.outcome-legend>span { display:flex; gap:.4rem; align-items:center; }
+.legend-dot { display:inline-block; width:8px; height:8px; border-radius:50%; }
+.target-status-unavailable,.target-status-outstanding { background:var(--aim-neutral-soft); color:var(--aim-neutral); }
+.history-item { display:grid; grid-template-columns:minmax(0,1fr) auto; gap:.65rem 1rem; padding:1.2rem; border-bottom:1px solid var(--aim-border); }
+.history-item:last-child { border-bottom:0; }
+.history-item-result { display:flex; flex-direction:column; align-items:flex-end; gap:.45rem; }
+.history-item-main { display:grid; gap:.4rem; min-width:0; }
+.counter-details { grid-column:1/-1; }
+.counter-details summary { font-size:.76rem; cursor:pointer; color:var(--aim-muted); padding:.3rem 0; }
+.counter-grid { display:flex; gap:1.25rem; flex-wrap:wrap; margin:.7rem 0 0; padding:1rem; background:var(--aim-bg); border-radius:.5rem; }
+.counter-grid dt { font-size:.7rem; color:var(--aim-muted); font-weight:500; }
+.counter-grid dd { font-size:.95rem; margin:0; font-variant-numeric:tabular-nums; }
+.book-summary-grid { display:grid; grid-template-columns:repeat(auto-fit,minmax(230px,1fr)); }
+.book-summary { display:grid; gap:.45rem; padding:1.2rem; color:var(--aim-ink); border-bottom:1px solid var(--aim-border); }
+.book-summary:hover { background:var(--aim-surface-raised); text-decoration:none; }
+.book-summary>span { font-size:.76rem; color:var(--aim-muted); }
+.pagination-controls { display:flex; gap:.65rem; flex-wrap:wrap; align-items:center; margin-top:1rem; }
+.insights-matrix table { min-width:640px; }
+.insights-matrix th { min-width:170px; max-width:240px; }
+.insights-matrix th:first-child { min-width:220px; }
+.matrix-result { display:grid; gap:.4rem; justify-items:start; min-width:150px; }
+.matrix-result>span:not(.status-tag,.mode-tag) { color:var(--aim-muted); font-size:.72rem; }
+.matrix-mobile { display:none; }
+.mobile-cell { display:grid; gap:.45rem; padding:.65rem 0; border-top:1px solid var(--aim-border); }
+.mobile-cell strong { font-size:.83rem; }
+.explorer-summary { display:flex; align-items:center; flex-wrap:wrap; gap:1rem; justify-content:space-between; padding:1rem 1.3rem; border-left:3px solid var(--aim-accent); background:var(--aim-surface); border-radius:0 .65rem .65rem 0; }
+.explorer-summary strong { font-size:1.6rem; letter-spacing:-.03em; }
+.summary-separator { color:var(--aim-border); margin:0 .65rem; }
+.explorer-search { display:grid; gap:.5rem; margin:1.4rem 0; }
+.explorer-search>label { font-size:.8rem; font-weight:650; }
+.explorer-search>div { display:flex; gap:.65rem; }
+.explorer-search input { flex:1; min-width:0; }
+.explorer-toolbar { display:flex; flex-wrap:wrap; gap:1rem; align-items:center; justify-content:space-between; }
+.view-switch { display:flex; gap:.4rem; }
+.view-switch [aria-current] { color:var(--aim-accent-ink); background:var(--aim-accent-soft); border-color:var(--aim-pill-border); }
+.explorer-panel { overflow:hidden; }
+.map-controls { display:flex; gap:1rem; justify-content:space-between; align-items:center; padding:.8rem 1rem; }
+.zoom-controls { display:flex; gap:.35rem; }
+.zoom-controls button { min-width:40px; min-height:40px; padding:.3rem .7rem; border:1px solid var(--aim-border); background:var(--aim-surface); color:var(--aim-ink); border-radius:.4rem; }
+.zoom-controls button:disabled { opacity:.4; }
+.inventory-canvas { max-height:58dvh; min-height:240px; overflow:auto; overscroll-behavior:contain; background-color:var(--aim-map-bg); background-image:radial-gradient(var(--aim-graph-dot) 1px,transparent 1px); background-size:18px 18px; border-block:1px solid var(--aim-border); }
+.inventory-canvas svg { display:block; max-width:none; }
+.graph-edge { stroke:var(--aim-graph-edge); stroke-width:1.5; fill:none; }
+.graph-node rect { fill:var(--aim-surface); stroke:var(--aim-border); stroke-width:1.5; }
+.graph-node:hover rect,.graph-node:focus rect { stroke:var(--aim-accent-ink); stroke-width:2.5; }
+.graph-node:focus { outline:none; }
+.graph-focus rect { fill:var(--aim-accent-soft); stroke:var(--aim-pill-border); }
+.graph-group rect { fill:var(--aim-surface-raised); }
+.graph-symbol { font-size:22px; fill:var(--aim-accent-ink); }
+.graph-label { font-size:12px; font-weight:650; fill:var(--aim-ink); }
+.graph-focus .graph-label { font-size:17px; }
+.graph-detail { font-size:11px; fill:var(--aim-muted); }
+.graph-note rect { fill:var(--aim-bg); stroke-dasharray:4; }
+.inventory-group-grid { display:grid; grid-template-columns:repeat(2,minmax(0,1fr)); gap:1rem; padding:1.2rem; }
+.inventory-group-card { padding:1rem; border:1px solid var(--aim-border); border-radius:.65rem; background:var(--aim-surface-raised); }
+.group-card-title { display:flex; align-items:center; gap:.6rem; color:var(--aim-ink); margin-bottom:.65rem; }
+.group-card-title>strong { flex:1; min-width:0; }
+.branch-hosts { list-style:none; padding:0; margin:.85rem 0; }
+.branch-hosts li { padding:.35rem 0; font-size:.8rem; }
+.branch-hosts a { color:var(--aim-ink); }
+.inventory-direct { padding:1.2rem; border-top:1px solid var(--aim-border); }
+.direct-host-grid { display:grid; grid-template-columns:repeat(auto-fit,minmax(240px,1fr)); gap:.8rem; }
+.host-node-link { display:flex; align-items:center; gap:.65rem; color:var(--aim-ink); padding:.85rem; border:1px solid var(--aim-border); border-radius:.6rem; min-width:0; }
+.host-node-link>span:last-child { display:grid; gap:.3rem; min-width:0; font-size:.8rem; }
+.host-node-link small { color:var(--aim-muted); }
+.view-map .explorer-outline,.view-auto .explorer-outline { display:none; }
+.view-outline .explorer-map { display:none; }
+.experience-links { display:grid; grid-template-columns:repeat(2,minmax(0,1fr)); gap:1rem; margin:1.5rem 0; }
+.experience-link { padding:1.3rem; background:var(--aim-surface); border:1px solid var(--aim-border); border-radius:var(--aim-radius); display:flex; gap:1rem; color:var(--aim-ink); }
+.experience-link>span:last-child { display:grid; gap:.4rem; }
+.experience-link small { color:var(--aim-muted); line-height:1.5; }
+
+@media(max-width:760px) {
+  .sidebar,.topbar { display:none; }
+  .app-shell { display:block; min-height:calc(100dvh - 64px); }
+  .mobile-topbar { display:flex; align-items:center; justify-content:space-between; gap:.65rem; min-height:64px; padding:.5rem max(.75rem,env(safe-area-inset-right)) .5rem max(.75rem,env(safe-area-inset-left)); background:var(--aim-surface); border-bottom:1px solid var(--aim-border); position:sticky; top:0; z-index:500; }
+  .mobile-brand { display:flex; align-items:center; gap:.6rem; font-size:1.25rem; color:var(--aim-ink); flex-shrink:0; }
+  .mobile-brand .brand-mark { width:36px; height:36px; font-size:1.35rem; border-radius:.55rem; }
+  .mobile-actions { display:flex; align-items:center; gap:.5rem; }
+  .mobile-actions .theme-control { padding:.13rem; }
+  .mobile-actions .theme-option { width:42px; height:42px; }
+  .mobile-menu { position:static; }
+  .mobile-menu summary { display:grid; place-items:center; width:44px; height:44px; cursor:pointer; border:1px solid var(--aim-border); border-radius:.5rem; color:var(--aim-ink); list-style:none; background:var(--aim-surface-raised); }
+  .mobile-menu summary::-webkit-details-marker { display:none; }
+  .mobile-menu summary svg { stroke:currentColor; stroke-width:1.7; fill:none; stroke-linecap:round; }
+  .mobile-menu[open] summary { color:var(--aim-accent-ink); background:var(--aim-accent-soft); }
+  .mobile-menu-panel { position:absolute; top:calc(100% + .35rem); right:max(.75rem,env(safe-area-inset-right)); width:min(350px,calc(100vw - 1.5rem)); max-height:calc(100dvh - 85px); overflow-y:auto; overscroll-behavior:contain; padding:.8rem; border:1px solid var(--aim-border); border-radius:.8rem; box-shadow:var(--aim-shadow); background:var(--aim-surface); }
+  .mobile-menu .primary-nav { display:flex; flex-direction:column; flex-wrap:nowrap; gap:.2rem; overflow:visible; padding:0; }
+  .mobile-menu .nav-link { display:flex; align-items:center; gap:.8rem; color:var(--aim-ink); font-size:.88rem; min-height:44px; padding:.7rem .8rem; border-radius:.5rem; white-space:normal; }
+  .mobile-menu .nav-link.active { background:var(--aim-accent-soft); color:var(--aim-accent-ink); box-shadow:inset 3px 0 var(--aim-accent); }
+  .mobile-menu .nav-link:hover { background:var(--aim-neutral-soft); text-decoration:none; }
+  .mobile-menu .sidebar-caption { display:block; margin:0; padding:.75rem .8rem .4rem; color:var(--aim-muted); }
+  .mobile-account { display:flex; flex-wrap:wrap; gap:.6rem; align-items:center; margin-top:.75rem; padding:1rem .75rem .4rem; border-top:1px solid var(--aim-border); font-size:.8rem; }
+  .mobile-account .account-name { max-width:100%; overflow-wrap:anywhere; }
+  .mobile-account form { margin:0; }
+  .mobile-account .btn { min-height:44px; }
+  .context-links { gap:.65rem 1rem; }
+  .context-links a { min-height:40px; display:flex; align-items:center; }
+  .history-filters { grid-template-columns:repeat(2,minmax(0,1fr)); padding:.9rem; gap:.9rem; }
+  .history-filters .form-control,.history-filters .form-select { min-height:44px; }
+  .history-item { grid-template-columns:minmax(0,1fr); padding:1rem; }
+  .history-item-result { align-items:flex-start; }
+  .insight-metrics { gap:.5rem; }
+  .insight-metrics .card { padding:.8rem; }
+  .insight-metrics strong { font-size:1.6rem; }
+  .insight-metrics .eyebrow { font-size:.55rem; letter-spacing:.06em; }
+  .insights-matrix { display:none; }
+  .matrix-mobile { display:block; }
+  .matrix-mobile .history-item { display:grid; grid-template-columns:minmax(0,1fr); }
+  .book-summary-grid { grid-template-columns:1fr; }
+  .inventory-group-grid,.direct-host-grid { grid-template-columns:minmax(0,1fr); }
+  .view-auto .explorer-map { display:none; }
+  .view-auto .explorer-outline { display:block; }
+  .inventory-canvas { min-height:220px; max-height:52dvh; }
+  .explorer-toolbar { padding:1rem; }
+  .view-switch .btn { min-height:44px; display:flex; align-items:center; }
+  .map-controls { flex-wrap:wrap; gap:.5rem; }
+  .zoom-controls button { min-width:44px; min-height:44px; }
+  .experience-links { grid-template-columns:minmax(0,1fr); }
+  .host-identity { padding:1rem; }
+  .live-console { min-height:0; max-height:60dvh; height:50dvh; }
+}
+@media(max-width:380px) {
+  .insight-metrics { grid-template-columns:1fr; }
+  .insight-metrics .card { display:grid; grid-template-columns:1fr auto; gap:.1rem .5rem; }
+  .insight-metrics strong { grid-column:2; grid-row:1/3; }
+  .history-filters { grid-template-columns:1fr; }
+  .explorer-search>div { flex-wrap:wrap; }
+  .explorer-search input { flex-basis:100%; }
+}
diff --git a/scripts/addons/webgui/src/aim_webgui/static/css/tokens.css b/scripts/addons/webgui/src/aim_webgui/static/css/tokens.css
new file mode 100644
index 0000000..8aad0ad
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/static/css/tokens.css
@@ -0,0 +1,92 @@
+/* AIM identity: change these tokens, not individual page templates. */
+:root,
+html[data-theme="light"] {
+  --aim-accent: #f58220;
+  --aim-on-accent: #202a39;
+  --aim-accent-rgb: 245, 130, 32;
+  --aim-accent-hover: #df7017;
+  --aim-accent-ink: #913900;
+  --aim-accent-soft: #fff1e5;
+  --aim-bg: #f5f6f8;
+  --aim-surface: #ffffff;
+  --aim-surface-raised: #ffffff;
+  --aim-ink: #202a39;
+  --aim-muted: #5d6879;
+  --aim-border: #e1e5ea;
+  --aim-sidebar: #18212e;
+  --aim-sidebar-muted: #a9b5c6;
+  --aim-sidebar-link: #d5ddea;
+  --aim-sidebar-hover: #253244;
+  --aim-sidebar-active: #352c27;
+  --aim-sidebar-active-ink: #ffac68;
+  --aim-danger: #a32f40;
+  --aim-info: #385eb1;
+  --aim-map-bg: #f4f6f9;
+  --aim-graph-edge: #bcc7d4;
+  --aim-graph-dot: #dce3ec;
+  --aim-console-bg: #17191d;
+  --aim-console-ink: #e6e7e9;
+  --aim-success: #176c4b;
+  --aim-success-soft: #e9f5ee;
+  --aim-warning: #785400;
+  --aim-warning-soft: #fff4df;
+  --aim-neutral: #495468;
+  --aim-neutral-soft: #eef1f6;
+  --aim-table-head: #fafbfc;
+  --aim-code-panel: #f6f7f9;
+  --aim-note-bg: #fff8f1;
+  --aim-note-ink: #5a483a;
+  --aim-banner-start: #fff8f1;
+  --aim-banner-end: #ffffff;
+  --aim-banner-border: #f0d9c6;
+  --aim-pill-border: #edcfb6;
+  --aim-link-hover: #632700;
+  --aim-dialog-backdrop: rgb(13 20 30 / 65%);
+  --aim-radius: .75rem;
+  --aim-shadow: 0 2px 6px rgb(24 33 46 / 3%);
+  --aim-space: 1.5rem;
+}
+
+html[data-theme="dark"] {
+  --aim-accent: #f58b32;
+  --aim-on-accent: #202a39;
+  --aim-accent-rgb: 245, 139, 50;
+  --aim-accent-hover: #ff9d52;
+  --aim-accent-ink: #ffb06f;
+  --aim-accent-soft: #3a291f;
+  --aim-bg: #171b21;
+  --aim-surface: #20262f;
+  --aim-surface-raised: #252c36;
+  --aim-ink: #e8edf3;
+  --aim-muted: #a7b0bc;
+  --aim-border: #343d49;
+  --aim-sidebar: #131920;
+  --aim-sidebar-muted: #929eac;
+  --aim-sidebar-link: #c7d0db;
+  --aim-sidebar-hover: #202a35;
+  --aim-sidebar-active: #382b22;
+  --aim-sidebar-active-ink: #ffb678;
+  --aim-danger: #f395a4;
+  --aim-info: #96b7ff;
+  --aim-map-bg: #1a2029;
+  --aim-graph-edge: #435268;
+  --aim-graph-dot: #313b4b;
+  --aim-console-bg: #17191d;
+  --aim-console-ink: #e6e7e9;
+  --aim-success: #7bd1a8;
+  --aim-success-soft: #1d382d;
+  --aim-warning: #e4c676;
+  --aim-warning-soft: #3b321f;
+  --aim-neutral: #c2cad5;
+  --aim-neutral-soft: #2b333e;
+  --aim-table-head: #252c35;
+  --aim-code-panel: #181e25;
+  --aim-note-bg: #2b231d;
+  --aim-note-ink: #d8c3b1;
+  --aim-banner-start: #2b231d;
+  --aim-banner-end: #20262f;
+  --aim-banner-border: #4a392d;
+  --aim-pill-border: #5a4030;
+  --aim-link-hover: #ffc28f;
+  --aim-shadow: 0 8px 24px rgb(0 0 0 / 16%);
+}
diff --git a/scripts/addons/webgui/src/aim_webgui/static/js/aim.js b/scripts/addons/webgui/src/aim_webgui/static/js/aim.js
new file mode 100644
index 0000000..f940fe0
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/static/js/aim.js
@@ -0,0 +1,227 @@
+'use strict';
+// No inline handlers, no eval, no inventory or authentication tokens in browser storage.
+document.addEventListener('htmx:configRequest', function (event) {
+  const token = document.querySelector('meta[name="csrf-token"]');
+  if (token) event.detail.headers['X-CSRF-Token'] = token.content;
+});
+document.addEventListener('htmx:beforeSwap', function (event) {
+  if (event.detail.xhr.status >= 400 && event.detail.xhr.status < 600) {
+    event.detail.shouldSwap = true;
+    event.detail.isError = false;
+  }
+});
+
+
+function formatLocalTimes(root) {
+  const scope = root || document;
+  const items = Array.from(scope.querySelectorAll('time.js-local-time[datetime]'));
+  if (scope.matches && scope.matches('time.js-local-time[datetime]')) items.unshift(scope);
+  items.forEach(function (element) {
+    const date = new Date(element.getAttribute('datetime'));
+    if (Number.isNaN(date.getTime())) return;
+    try {
+      element.textContent = new Intl.DateTimeFormat(undefined, {dateStyle: 'medium', timeStyle: 'medium'}).format(date);
+      element.title = element.getAttribute('datetime') + ' (UTC)';
+    } catch (_) {
+      // Keep the server-rendered UTC fallback when Intl formatting is unavailable.
+    }
+  });
+}
+
+function hostGroups(input) {
+  try { return JSON.parse(input.dataset.groups || '[]'); }
+  catch (_) { return []; }
+}
+function allHosts() { return Array.from(document.querySelectorAll('[data-host-target]')); }
+function visibleHosts() { return allHosts().filter(function (host) { return !host.closest('tr').hidden; }); }
+function syncHostSelection() {
+  const hosts = allHosts();
+  const visible = visibleHosts();
+  const selected = hosts.filter(function (host) { return host.checked; }).length;
+  const selectedVisible = visible.filter(function (host) { return host.checked; }).length;
+  const all = document.querySelector('[data-select-all-hosts]');
+  const counter = document.querySelector('[data-selected-count]');
+  if (counter) counter.textContent = selected + ' selected' + (selected > 500 ? ' (limit 500)' : '');
+  const visibleCount = document.querySelector('[data-visible-count]');
+  if (visibleCount) visibleCount.textContent = visible.length + ' of ' + hosts.length + ' hosts match.';
+  if (all) {
+    all.checked = visible.length > 0 && selectedVisible === visible.length;
+    all.indeterminate = selectedVisible > 0 && selectedVisible < visible.length;
+    all.disabled = visible.length === 0;
+  }
+  document.querySelectorAll('[data-group-select]').forEach(function (group) {
+    const members = hosts.filter(function (host) { return hostGroups(host).includes(group.value); });
+    const checked = members.filter(function (host) { return host.checked; }).length;
+    group.checked = members.length > 0 && checked === members.length;
+    group.indeterminate = checked > 0 && checked < members.length;
+  });
+}
+function initializeHostSelection() {
+  const all = document.querySelector('[data-select-all-hosts]');
+  if (!all || all.dataset.initialized) return;
+  all.dataset.initialized = 'true';
+  const form = all.closest('form');
+  let timer;
+  let revision = 0;
+  function remember() {
+    syncHostSelection();
+    clearTimeout(timer);
+    const sequence = ++revision;
+    timer = setTimeout(async function () {
+      const status = document.querySelector('[data-selection-saved]');
+      const targets = allHosts().filter(function (h) { return h.checked; }).map(function (h) { return h.value; });
+      if (targets.length > 500) {
+        if (status) status.textContent = 'Select at most 500 hosts before saving or validating.';
+        return;
+      }
+      try {
+        const token = document.querySelector('meta[name="csrf-token"]').content;
+        const result = await fetch('/api/v2/selections', {
+          method: 'POST', credentials: 'same-origin',
+          headers: {'Content-Type': 'application/json', 'X-CSRF-Token': token},
+          body: JSON.stringify({customer: form.elements.customer.value, playbook: form.elements.playbook.value, targets: targets})
+        });
+        if (!result.ok) throw new Error('not saved');
+        if (status && revision === sequence) status.textContent = 'Selection saved privately for seven days.';
+      } catch (_) {
+        if (status && revision === sequence) status.textContent = 'Selection could not be saved. Your checkboxes are unchanged; reload after signing in.';
+      }
+    }, 300);
+  }
+  all.addEventListener('change', function () {
+    visibleHosts().forEach(function (host) { host.checked = all.checked; });
+    remember();
+  });
+  document.querySelectorAll('[data-group-select]').forEach(function (group) {
+    group.addEventListener('change', function () {
+      allHosts().forEach(function (host) { if (hostGroups(host).includes(group.value)) host.checked = group.checked; });
+      remember();
+    });
+  });
+  allHosts().forEach(function (host) { host.addEventListener('change', remember); });
+  const clear = document.querySelector('[data-clear-hosts]');
+  if (clear) clear.addEventListener('click', function () {
+    allHosts().forEach(function (host) { host.checked = false; }); remember();
+  });
+  const search = document.querySelector('[data-host-search]');
+  const group = document.querySelector('[data-host-group-filter]');
+  function filter() {
+    const q = search.value.toLocaleLowerCase().trim();
+    allHosts().forEach(function (host) {
+      const row = host.closest('tr');
+      const text = [row.dataset.name, row.dataset.address, row.dataset.group].join(' ').toLocaleLowerCase();
+      row.hidden = !text.includes(q) || (group.value && !hostGroups(host).includes(group.value));
+    });
+    syncHostSelection();
+  }
+  if (search && group) {
+    search.addEventListener('input', filter);
+    group.addEventListener('change', filter);
+  }
+  const sort = document.querySelector('[data-host-sort]');
+  if (sort) sort.addEventListener('change', function () {
+    const rows = Array.from(document.querySelectorAll('[data-host-row]'));
+    rows.sort(function (a, b) {
+      return (a.dataset[sort.value] || '').localeCompare(b.dataset[sort.value] || '', undefined, {numeric: true});
+    });
+    rows.forEach(function (row) { row.parentElement.appendChild(row); });
+  });
+  syncHostSelection();
+}
+document.addEventListener('DOMContentLoaded', function () { initializeHostSelection(); formatLocalTimes(document); });
+document.addEventListener('htmx:afterSwap', function (event) { initializeHostSelection(); formatLocalTimes(event.detail.target); });
+document.addEventListener('htmx:afterSettle', function (event) { formatLocalTimes(event.detail.target); });
+window.addEventListener('pageshow', function () { formatLocalTimes(document); });
+
+// Credentials never enter history, browser persistence or reusable form drafts.
+window.addEventListener('pagehide', function () {
+  document.querySelectorAll('[data-secret-form] input[type="password"], [data-credential-secret]').forEach(function (input) { input.value = ''; });
+});
+
+function initConfirmForms(root) {
+  (root || document).querySelectorAll('form[data-confirm]').forEach(function (form) {
+    if (form.dataset.confirmBound) return; form.dataset.confirmBound='1';
+    form.addEventListener('submit', function (event) { if (!window.confirm(form.dataset.confirm)) event.preventDefault(); });
+  });
+}
+document.addEventListener('DOMContentLoaded', function () { initConfirmForms(document); });
+document.addEventListener('htmx:afterSwap', function (event) { initConfirmForms(event.detail.target); });
+
+function initBulkForms(root) {
+  (root || document).querySelectorAll('[data-bulk-form]').forEach(function (form) {
+    if (form.dataset.bulkBound) return;
+    form.dataset.bulkBound = '1';
+    const all = form.querySelector('[data-bulk-select-all]');
+    const items = Array.from(form.querySelectorAll('[data-bulk-item]'));
+    const submit = form.querySelector('[data-bulk-submit]');
+    const sync = function () {
+      const checked = items.filter(function (item) { return item.checked; }).length;
+      if (all) {
+        all.checked = items.length > 0 && checked === items.length;
+        all.indeterminate = checked > 0 && checked < items.length;
+        all.disabled = items.length === 0;
+      }
+      if (submit) submit.disabled = checked === 0;
+    };
+    if (all) all.addEventListener('change', function () {
+      items.forEach(function (item) { item.checked = all.checked; });
+      sync();
+    });
+    items.forEach(function (item) { item.addEventListener('change', sync); });
+    sync();
+  });
+}
+document.addEventListener('DOMContentLoaded', function () { initBulkForms(document); });
+document.addEventListener('htmx:afterSwap', function (event) { initBulkForms(event.detail.target); });
+
+function initJobConsole(root) {
+  (root || document).querySelectorAll('[data-job-console]').forEach(function (panel) {
+    if (panel.dataset.consoleBound) return;
+    panel.dataset.consoleBound = '1';
+    const output = panel.querySelector('[data-console-output]');
+    const state = panel.querySelector('[data-console-state]');
+    const auto = panel.querySelector('[data-console-autoscroll]');
+    if (!output || panel.dataset.consoleActive !== 'true' || !window.EventSource) return;
+    output.textContent = '';
+    let internalScroll = false;
+    output.addEventListener('scroll', function () {
+      if (internalScroll || !auto || !auto.checked) return;
+      const atBottom = output.scrollHeight - output.scrollTop - output.clientHeight < 24;
+      if (!atBottom) auto.checked = false;
+    }, {passive:true});
+    if (auto) auto.addEventListener('change', function () {
+      if (auto.checked) { internalScroll=true; output.scrollTop=output.scrollHeight;
+        requestAnimationFrame(function () { internalScroll=false; }); }
+    });
+    const lines = [];
+    const append = function (text, kind) {
+      if (typeof text !== 'string' || !text) return;
+      lines.push((kind === 'notice' ? '[AIM] ' : '') + text);
+      while (lines.length > 500) lines.shift();
+      output.textContent = lines.join('\n') + '\n';
+      if (auto && auto.checked) { internalScroll=true; output.scrollTop=output.scrollHeight; requestAnimationFrame(function(){ internalScroll=false; }); }
+    };
+    const source = new EventSource('/api/v2/runs/' + encodeURIComponent(panel.dataset.jobId) + '/console');
+    panel._aimConsoleSource = source;
+    source.addEventListener('open', function () { if (state) state.textContent = 'Live'; });
+    ['line','notice'].forEach(function (kind) {
+      source.addEventListener(kind, function (event) {
+        try { append(JSON.parse(event.data).text, kind); } catch (_) {}
+      });
+    });
+    source.addEventListener('end', function (event) {
+      try { append(JSON.parse(event.data).text, 'notice'); } catch (_) {}
+      if (state) state.textContent = 'Ended';
+      source.close();
+    });
+    source.onerror = function () { if (state && source.readyState !== EventSource.CLOSED) state.textContent = 'Reconnecting'; };
+  });
+}
+document.addEventListener('DOMContentLoaded', function () { initJobConsole(document); });
+window.addEventListener('pagehide', function () {
+  document.querySelectorAll('[data-job-console]').forEach(function (panel) {
+    if (panel._aimConsoleSource) panel._aimConsoleSource.close();
+    const output = panel.querySelector('[data-console-output]');
+    if (output) output.textContent = 'Live console cleared on navigation.';
+  });
+});
diff --git a/scripts/addons/webgui/src/aim_webgui/static/js/credentials.js b/scripts/addons/webgui/src/aim_webgui/static/js/credentials.js
new file mode 100644
index 0000000..e6a76f4
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/static/js/credentials.js
@@ -0,0 +1,348 @@
+'use strict';
+// Presentation only. No browser secret cache, automatic POST retry or scope edits.
+(function () {
+  const sessions = new Set();
+  const dialog = document.querySelector('[data-credential-dialog]');
+  const body = dialog && dialog.querySelector('[data-credential-dialog-body]');
+  let opener = null;
+  let openedJob = null;
+  let loadController = null;
+  let loadSequence = 0;
+  const uncertainJobs = new Set(); // IDs only; cleared when the page is left.
+  const terminal = new Set(['successful', 'failed', 'blocked', 'canceled', 'timed_out', 'interrupted']);
+
+  function clearSecrets(root) {
+    root.querySelectorAll('[data-credential-secret]').forEach(function (input) {
+      input.value = '';
+      input.type = 'password';
+    });
+    root.querySelectorAll('[data-credential-reveal]').forEach(function (button) {
+      button.textContent = 'Show';
+      button.setAttribute('aria-pressed', 'false');
+      button.setAttribute('aria-label', button.getAttribute('aria-label').replace(/^Hide /, 'Show '));
+    });
+    root.querySelectorAll('[data-credential-caps]').forEach(function (note) { note.hidden = true; });
+  }
+  function feedback(ctx, text, tone, focus) {
+    ctx.feedback.textContent = text;
+    ctx.feedback.dataset.tone = tone || 'info';
+    ctx.feedback.hidden = false;
+    if (focus) ctx.feedback.focus({preventScroll: true});
+  }
+  function finish(ctx, text, accepted) {
+    if (ctx.closed) return;
+    clearSecrets(ctx.panel);
+    ctx.locked = true;
+    ctx.inputs.disabled = true;
+    ctx.inputs.hidden = true;
+    ctx.submit.disabled = true;
+    ctx.submit.hidden = true;
+    ctx.panel.querySelector('.credential-intro').hidden = true;
+    ctx.panel.querySelector('.credential-reservation').hidden = true;
+    ctx.panel.querySelector('[data-credential-submit-note]').hidden = true;
+    ctx.dismiss.textContent = 'View job progress';
+    feedback(ctx, text, accepted ? 'accepted' : 'error', true);
+  }
+  function expire(ctx) {
+    if (ctx.busy || ctx.locked || ctx.closed) return;
+    finish(ctx, 'This credential window has expired. Check the job before creating a fresh attempt. No further credentials will be submitted from this dialog.', false);
+  }
+  function clock(ctx, serverNow, deadline) {
+    ctx.remainingAtSync = Math.max(0, Number(deadline) - Number(serverNow));
+    ctx.syncedAt = performance.now();
+  }
+  function tick(ctx) {
+    if (ctx.closed || ctx.locked) return;
+    const seconds = Math.max(0, Math.ceil(ctx.remainingAtSync - (performance.now() - ctx.syncedAt) / 1000));
+    ctx.countdown.textContent = 'Time left ' + String(Math.floor(seconds / 60)).padStart(2, '0') + ':' + String(seconds % 60).padStart(2, '0');
+    ctx.countdown.closest('.credential-reservation').classList.toggle('is-urgent', seconds <= 60);
+    if (seconds <= 60 && !ctx.warned && seconds > 0 && !ctx.busy && !ctx.uncertain) {
+      ctx.warned = true;
+      feedback(ctx, 'Less than one minute remains in this reservation. Opening the form does not extend it.', 'info', false);
+    }
+    if (seconds === 0) expire(ctx);
+  }
+  function sourceMode(ctx) {
+    const choice = ctx.form.querySelector('[data-key-source-choice]');
+    if (!choice) return;
+    const separate = choice.querySelector('input[value="separate"]').checked;
+    const field = ctx.form.querySelector('[data-key-passphrase-field]');
+    const input = field.querySelector('[data-credential-secret]');
+    field.hidden = !separate;
+    input.disabled = !separate;
+    input.required = separate;
+    if (!separate) clearSecrets(field);
+    choice.querySelector('[data-key-source-explanation]').textContent = separate
+      ? 'Supply the private key passphrase for this run only. This does not change the reviewed authentication mode.'
+      : "Uses the Vault's stored key passphrase, checked after submission.";
+  }
+  async function poll(ctx) {
+    if (ctx.closed || ctx.checking || (ctx.locked && !ctx.uncertain)) return;
+    ctx.checking = true;
+    try {
+      const response = await fetch('/api/v2/runs/' + ctx.job + '/credential-status', {
+        credentials: 'same-origin', cache: 'no-store', headers: {'Accept': 'application/json'}, signal: ctx.getController.signal
+      });
+      if (ctx.closed) return;
+      if ([401, 403, 404].includes(response.status)) {
+        finish(ctx, 'This credential form is no longer available to this session. Return to the job or sign in again.', false);
+        ctx.uncertain = false;
+        return;
+      }
+      if (!response.ok) return; // Expiry remains local display only; POST always revalidates.
+      const state = await response.json();
+      if (ctx.closed || state.job_id !== ctx.job) return;
+      if (state.cancel_requested || terminal.has(state.status)) {
+        ctx.uncertain = false;
+        finish(ctx, 'This run has ended or cancellation was requested. Review the job result; do not resubmit credentials here.', false);
+      } else if (state.status === 'running' && state.phase === 'claimed') {
+        uncertainJobs.delete(ctx.job);
+        ctx.uncertain = false;
+        finish(ctx, 'The worker has claimed the credential handoff. Core validates credentials next; this is not confirmation of successful authentication.', true);
+      } else if (state.can_submit && !ctx.locked && !ctx.uncertain) {
+        clock(ctx, state.server_now, state.deadline);
+        tick(ctx);
+      } else if (!state.can_submit && !ctx.busy) {
+        ctx.uncertain = false;
+        finish(ctx, 'The worker is no longer accepting credentials for this reservation. Return to the job for its current status.', false);
+      }
+    } catch (_) {
+      // Never echo response bodies, exceptions, form values or credentials.
+    } finally { ctx.checking = false; }
+  }
+  function validationMessage(ctx) {
+    for (const input of ctx.form.querySelectorAll('[data-credential-secret]')) {
+      if (input.disabled) continue;
+      const value = input.value;
+      if (/[\r\n\u0000]/.test(value) || new TextEncoder().encode(value).length > 2048) {
+        input.focus();
+        return 'Use a single-line password of at most 2048 UTF-8 bytes. Spaces and other literal characters are preserved.';
+      }
+    }
+    return '';
+  }
+  async function submit(ctx, event) {
+    event.preventDefault();
+    if (ctx.busy || ctx.locked || ctx.uncertain || ctx.closed) return;
+    tick(ctx);
+    if (ctx.locked || !ctx.form.reportValidity()) return;
+    const invalid = validationMessage(ctx);
+    if (invalid) { feedback(ctx, invalid, 'error', false); return; }
+    let values = {};
+    ctx.form.querySelectorAll('[data-credential-secret]').forEach(function (input) {
+      if (!input.disabled && input.value !== '') values[input.name] = input.value;
+    });
+    let encoded = JSON.stringify(values);
+    if (new TextEncoder().encode(encoded).length > 8192) {
+      values = null; encoded = null;
+      feedback(ctx, 'The combined credential request exceeds 8 KiB. Nothing was submitted.', 'error', false);
+      return;
+    }
+    const csrf = ctx.form.querySelector('input[name="_csrf"]').value;
+    ctx.busy = true;
+    ctx.submit.disabled = true;
+    ctx.inputs.disabled = true;
+    ctx.form.setAttribute('aria-busy', 'true');
+    ctx.submit.textContent = 'Submitting...';
+    feedback(ctx, 'Submitting once. Core has not yet verified these credentials.', 'info', false);
+    // Minimize live DOM lifetime, including a currently revealed input.
+    clearSecrets(ctx.panel);
+    const controller = new AbortController();
+    const timeout = setTimeout(function () { controller.abort(); }, 15000);
+    try {
+      const request = fetch('/api/v2/runs/' + ctx.job + '/credentials', {
+        method: 'POST', credentials: 'same-origin', cache: 'no-store', redirect: 'error',
+        headers: {'Content-Type': 'application/json', 'Accept': 'application/json', 'X-CSRF-Token': csrf},
+        body: encoded, signal: controller.signal
+      });
+      values = null; encoded = null; // Not a physical memory-erasure guarantee.
+      const response = await request;
+      const result = await response.json();
+      if (response.status === 202 && result.accepted === true) {
+        uncertainJobs.delete(ctx.job);
+        if (!ctx.closed) finish(ctx, 'Credential handoff accepted for this run. Core validates the Vault, key or connection next. Follow the job for the result.', true);
+      } else if (response.status === 400 && result.error && ['credential_required', 'invalid_credentials', 'unexpected_credentials'].includes(result.error.code)) {
+        if (!ctx.closed) {
+          ctx.inputs.disabled = false;
+          ctx.submit.disabled = false;
+          feedback(ctx, 'The credential fields were not accepted. Enter the required values again; nothing is saved or echoed here.', 'error', true);
+        }
+      } else if (response.status === 429) {
+        if (!ctx.closed) finish(ctx, 'Too many credential submissions. Check the job and wait before making another manual attempt.', false);
+      } else if ([401, 403, 404].includes(response.status)) {
+        if (!ctx.closed) finish(ctx, 'Your session or permission no longer allows this submission. Return to the job or sign in again.', false);
+      } else {
+        uncertainJobs.add(ctx.job);
+        if (!ctx.closed) {
+          ctx.uncertain = true;
+          finish(ctx, 'Submission was not confirmed. Checking the job status; do not submit the password again. Closing this dialog does not cancel a submitted run.', false);
+        }
+      }
+    } catch (_) {
+      uncertainJobs.add(ctx.job);
+      if (!ctx.closed) {
+        ctx.uncertain = true;
+        finish(ctx, 'Submission was not confirmed. Checking the job status; do not submit the password again. Closing this dialog does not cancel a submitted run.', false);
+      }
+    } finally {
+      values = null; encoded = null; clearTimeout(timeout);
+      ctx.busy = false;
+      ctx.form.removeAttribute('aria-busy');
+      ctx.submit.textContent = 'Submit credentials and continue';
+      if (!ctx.closed) { clearSecrets(ctx.panel); poll(ctx); }
+    }
+  }
+  function initialize(panel) {
+    if (panel.dataset.credentialBound) return;
+    panel.dataset.credentialBound = 'true';
+    const form = panel.querySelector('[data-credential-form]');
+    if (!form || !/^[a-f0-9]{32}$/.test(panel.dataset.jobId)) return;
+    const ctx = {panel: panel, form: form, job: panel.dataset.jobId, feedback: panel.querySelector('[data-credential-feedback]'),
+      inputs: form.querySelector('[data-credential-inputs]'), submit: form.querySelector('[data-credential-submit]'),
+      dismiss: form.querySelector('[data-credential-dismiss]'), countdown: panel.querySelector('[data-credential-countdown]'),
+      busy: false, closed: false, locked: false, checking: false, uncertain: false, warned: false, getController: new AbortController()};
+    sessions.add(ctx);
+    clock(ctx, panel.dataset.serverNow, panel.dataset.deadline);
+    panel.querySelectorAll('[data-credential-reveal]').forEach(function (button) {
+      button.hidden = false;
+      button.addEventListener('click', function () {
+        const input = panel.querySelector('#' + button.getAttribute('aria-controls'));
+        const show = input.type === 'password';
+        input.type = show ? 'text' : 'password';
+        button.textContent = show ? 'Hide' : 'Show';
+        button.setAttribute('aria-pressed', String(show));
+        button.setAttribute('aria-label', button.getAttribute('aria-label').replace(/^(Show|Hide) /, show ? 'Hide ' : 'Show '));
+      });
+    });
+    panel.querySelectorAll('[data-credential-secret]').forEach(function (input) {
+      function caps(event) { input.closest('.credential-field').querySelector('[data-credential-caps]').hidden = !event.getModifierState('CapsLock'); }
+      input.addEventListener('keydown', caps); input.addEventListener('keyup', caps);
+      input.addEventListener('blur', function () { input.closest('.credential-field').querySelector('[data-credential-caps]').hidden = true; });
+    });
+    const choice = form.querySelector('[data-key-source-choice]');
+    if (choice) {
+      choice.hidden = false;
+      choice.querySelectorAll('input').forEach(function (input) { input.disabled = false; });
+      choice.addEventListener('change', function () { sourceMode(ctx); }); sourceMode(ctx);
+    }
+    form.addEventListener('submit', function (event) { submit(ctx, event); });
+    ctx.dismiss.addEventListener('click', function (event) {
+      if (dialog && dialog.contains(panel)) { event.preventDefault(); closeDialog(); }
+    });
+    ctx.tickTimer = setInterval(function () { tick(ctx); }, 1000);
+    ctx.pollTimer = setInterval(function () { poll(ctx); }, 3000);
+    tick(ctx);
+    if (uncertainJobs.has(ctx.job)) {
+      ctx.uncertain = true;
+      finish(ctx, 'A previous submission has not been confirmed. Checking the job; do not resubmit credentials.', false);
+    }
+    poll(ctx);
+  }
+  function dispose(root) {
+    sessions.forEach(function (ctx) {
+      if (root.contains(ctx.panel)) {
+        ctx.closed = true; ctx.getController.abort(); clearInterval(ctx.tickTimer); clearInterval(ctx.pollTimer);
+        clearSecrets(ctx.panel); sessions.delete(ctx);
+      }
+    });
+  }
+  function fitDialog() {
+    if (!dialog || !dialog.open || !window.visualViewport) return;
+    const viewport = window.visualViewport;
+    dialog.style.maxHeight = Math.max(100, viewport.height - 16) + 'px';
+    dialog.style.top = (viewport.offsetTop + viewport.height / 2) + 'px';
+    dialog.style.bottom = 'auto'; dialog.style.margin = '0 auto'; dialog.style.transform = 'translateY(-50%)';
+  }
+  function closeDialog() {
+    if (!dialog) return;
+    ++loadSequence;
+    if (loadController) { loadController.abort(); loadController = null; }
+    dispose(dialog);
+    if (dialog.open) dialog.close();
+    body.replaceChildren();
+    document.documentElement.classList.remove('credential-modal-open');
+    let target = opener && opener.isConnected ? opener : null;
+    if (!target && openedJob) target = document.querySelector('[data-credential-open][data-job-id="' + openedJob + '"]');
+    if (!target) target = document.querySelector('#job-status') || document.querySelector('main');
+    if (target) { if (!target.matches('a,button,input')) target.setAttribute('tabindex', '-1'); target.focus({preventScroll: true}); }
+    opener = null; openedJob = null;
+  }
+  async function openDialog(link) {
+    const job = link.dataset.jobId;
+    if (!/^[a-f0-9]{32}$/.test(job)) return;
+    if (dialog.open) return;
+    opener = link; openedJob = job;
+    const sequence = ++loadSequence;
+    const loading = document.createElement('p'); loading.className = 'credential-loading'; loading.setAttribute('role', 'status'); loading.textContent = 'Checking this worker reservation...'; body.replaceChildren(loading);
+    dialog.showModal(); document.documentElement.classList.add('credential-modal-open'); fitDialog();
+    dialog.querySelector('[data-credential-title]').focus({preventScroll: true});
+    loadController = new AbortController();
+    const timeout = setTimeout(function () { if (sequence === loadSequence && loadController) loadController.abort(); }, 10000);
+    try {
+      const response = await fetch('/_partials/jobs/' + job + '/credentials', {credentials: 'same-origin', cache: 'no-store', redirect: 'error', signal: loadController.signal});
+      if (!response.ok) throw new Error('unavailable');
+      const html = await response.text();
+      if (sequence !== loadSequence || !dialog.open) return;
+      const doc = new DOMParser().parseFromString(html, 'text/html');
+      const panel = doc.querySelector('[data-credential-panel]');
+      if (!panel || panel.dataset.jobId !== job) throw new Error('invalid fragment');
+      body.replaceChildren(document.importNode(panel, true));
+      initialize(body.querySelector('[data-credential-panel]'));
+      if (typeof formatLocalTimes === 'function') formatLocalTimes(body);
+    } catch (_) {
+      if (sequence !== loadSequence || !dialog.open) return;
+      const note = document.createElement('p'); note.setAttribute('role', 'alert'); note.textContent = 'This credential window is unavailable or the session changed. Check the job before trying again.';
+      const back = document.createElement('a'); back.href = '/jobs/' + job; back.className = 'btn btn-outline-primary'; back.textContent = 'Open job'; body.replaceChildren(note, back);
+    } finally { clearTimeout(timeout); }
+  }
+  if (dialog && typeof dialog.showModal === 'function') {
+    function enhanceOpeners() {
+      document.querySelectorAll('[data-credential-open]').forEach(function (link) {
+        link.setAttribute('role', 'button');
+        link.setAttribute('aria-haspopup', 'dialog');
+        link.setAttribute('aria-controls', 'credential-dialog');
+      });
+    }
+    enhanceOpeners();
+    document.addEventListener('htmx:afterSwap', enhanceOpeners);
+    document.addEventListener('keydown', function (event) {
+      const link = event.target.closest('[data-credential-open]');
+      if (link && event.key === ' ' && !event.ctrlKey && !event.metaKey && !event.altKey) {
+        event.preventDefault(); openDialog(link);
+      }
+    });
+    document.addEventListener('click', function (event) {
+      const link = event.target.closest('[data-credential-open]');
+      if (!link || event.defaultPrevented || event.button !== 0 || event.ctrlKey || event.metaKey || event.shiftKey || event.altKey) return;
+      event.preventDefault(); openDialog(link);
+    });
+    dialog.querySelector('[data-credential-close]').addEventListener('click', closeDialog);
+    dialog.addEventListener('cancel', function (event) { event.preventDefault(); closeDialog(); });
+    dialog.addEventListener('keydown', function (event) {
+      if (event.key !== 'Tab' || !dialog.open) return;
+      const focusable = Array.from(dialog.querySelectorAll('button,a[href],input,select,textarea,summary,[tabindex]:not([tabindex="-1"])')).filter(function (element) {
+        return !element.matches(':disabled') && element.tabIndex >= 0 && element.getClientRects().length > 0;
+      });
+      if (!focusable.length) { event.preventDefault(); dialog.querySelector('[data-credential-title]').focus(); return; }
+      const first = focusable[0], last = focusable[focusable.length - 1];
+      if (event.shiftKey && (document.activeElement === first || !focusable.includes(document.activeElement))) {
+        event.preventDefault(); last.focus();
+      } else if (!event.shiftKey && (document.activeElement === last || !focusable.includes(document.activeElement))) {
+        event.preventDefault(); first.focus();
+      }
+    });
+    // Deliberate Close/Escape only: a stray backdrop tap cannot erase typed input.
+    if (window.visualViewport) {
+      window.visualViewport.addEventListener('resize', fitDialog);
+      window.visualViewport.addEventListener('scroll', fitDialog);
+    }
+  }
+  document.querySelectorAll('[data-credential-panel]').forEach(initialize);
+  window.addEventListener('pagehide', function () { dispose(document); closeDialog(); clearSecrets(document); uncertainJobs.clear(); });
+  window.addEventListener('pageshow', function (event) {
+    if (event.persisted) {
+      clearSecrets(document);
+      document.querySelectorAll('[data-credential-panel]').forEach(function (panel) { delete panel.dataset.credentialBound; initialize(panel); });
+    }
+  });
+}());
diff --git a/scripts/addons/webgui/src/aim_webgui/static/js/evidence.js b/scripts/addons/webgui/src/aim_webgui/static/js/evidence.js
new file mode 100644
index 0000000..fed974c
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/static/js/evidence.js
@@ -0,0 +1,123 @@
+/* Durable public metadata replay. No secrets, localStorage, execution or POST. */
+(function () {
+  'use strict';
+  function stamp(value) {
+    const d = new Date(value);
+    return Number.isNaN(d.getTime()) ? value : new Intl.DateTimeFormat(undefined, {dateStyle:'medium',timeStyle:'medium'}).format(d);
+  }
+  function text(node, value) { if (node) node.textContent = value == null ? 'Not observed' : String(value); }
+  function dates(root) {
+    root.querySelectorAll('time[data-evidence-time], time[data-journal-time]').forEach(function (node) {
+      if (node.dateTime) { text(node, stamp(node.dateTime)); node.title = node.dateTime; }
+    });
+  }
+  async function read(url) {
+    const response=await fetch(url,{credentials:'same-origin',cache:'no-store',headers:{'Accept':'application/json'}});
+    if (!response.ok) throw new Error(response.status === 401 || response.status === 403 || response.status === 404 ? 'Access expired or this job is unavailable.' : 'Recorded evidence could not be loaded.');
+    return await response.json();
+  }
+  function journal(panel) {
+    if (panel.dataset.bound) return;
+    panel.dataset.bound='1';
+    const job=panel.dataset.jobId, base='/api/v2/runs/'+encodeURIComponent(job), output=panel.querySelector('[data-journal-output]');
+    const follow=panel.querySelector('[data-journal-follow]'), state=panel.querySelector('[data-journal-state]'), warning=panel.querySelector('[data-journal-warning]');
+    const older=panel.querySelector('[data-journal-older]');
+    let records=[], cursor=0, first=0, internal=false, source=null, alive=true, ended=false, olderTrimmed=false, drawPending=false;
+    function warningText(data) {
+      const messages=[];
+      if (data.omitted_events) messages.push(data.omitted_events+' older events omitted by retention policy.');
+      if (data.dropped_events) messages.push(data.dropped_events+' events were not recorded due to capture pressure.');
+      if (data.capture_interrupted) messages.push('Capture did not close cleanly; the last uncommitted batch may be absent.');
+      if (olderTrimmed) messages.push('The screen shows a bounded recent window; use the paged timeline for the remaining retained metadata.');
+      text(warning,messages.join(' ')); if(warning) warning.hidden=!messages.length;
+    }
+    function snapshot(data) {
+      const cp=data.checkpoint||{};
+      text(panel.querySelector('[data-journal-stage]'),cp.stage);
+      text(panel.querySelector('[data-journal-task]'),cp.last_task ? cp.last_task.label+' ('+cp.last_task.task_id+')' : 'Not observed');
+      text(panel.querySelector('[data-journal-tasks]'),cp.observed_task_starts||0);
+      const when=panel.querySelector('[data-journal-time]');
+      if (when && cp.last_timestamp) {when.dateTime=cp.last_timestamp;text(when,stamp(cp.last_timestamp));when.title=cp.last_timestamp;}
+      warningText(data);
+      const list=panel.querySelector('[data-journal-hosts]');
+      if (list) {
+        list.replaceChildren();
+        (cp.hosts||[]).slice(0,25).forEach(function(h){
+          const row=document.createElement('li');row.textContent=h.host+' - '+h.observation+' ('+h.task_id+')';list.appendChild(row);
+        });
+        if ((cp.hosts||[]).length>25) {const row=document.createElement('li');row.textContent='Latest observations for '+cp.hosts.length+' hosts; first 25 shown here. Use the correlated timeline for more.';list.appendChild(row);}
+      }
+    }
+    function render(preserve) {
+      const scroll=output.scrollTop, previousHeight=output.scrollHeight;
+      output.textContent=records.map(function(r){return stamp(r.event.timestamp)+'  '+r.text;}).join('\n')+(records.length?'\n':'');
+      first=records.length?records[0].cursor:0;
+      internal=true;
+      if (preserve) output.scrollTop=scroll+output.scrollHeight-previousHeight;
+      else if (follow && follow.checked) output.scrollTop=output.scrollHeight;
+      else output.scrollTop=scroll;
+      requestAnimationFrame(function(){internal=false;});
+    }
+    function append(record) {
+      if (!record || !Number.isSafeInteger(record.cursor) || record.cursor<=cursor) return;
+      cursor=record.cursor;records.push(record);
+      if(records.length>2000) {records.splice(0,records.length-2000);olderTrimmed=true;}
+      if(!drawPending){drawPending=true;requestAnimationFrame(function(){drawPending=false;if(alive)render(false);});}
+    }
+    output.addEventListener('scroll',function(){if(!internal && follow && follow.checked && output.scrollHeight-output.scrollTop-output.clientHeight>24)follow.checked=false;},{passive:true});
+    if(follow)follow.addEventListener('change',function(){if(follow.checked)render(false);});
+    async function connect() {
+      try {
+        const data=await read(base+'/progress');if(!alive)return;
+        records=data.events||[];cursor=data.cursor;first=records.length?records[0].cursor:0;snapshot(data);render(false);
+        if(!records.length)text(output,data.message||'No metadata recorded yet.');
+        if(older)older.hidden=!data.has_older;
+        if(data.terminal){text(state,'Finished - retained');ended=true;return;}
+        if(!window.EventSource){text(state,'Use Refresh for updated metadata');return;}
+        source=new EventSource(base+'/progress/stream?after='+cursor);panel._journalSource=source;
+        source.addEventListener('open',function(){text(state,'Following');});
+        source.addEventListener('snapshot',function(e){try{snapshot(JSON.parse(e.data));}catch(_){text(state,'Invalid progress metadata');}});
+        source.addEventListener('line',function(e){try{const data=JSON.parse(e.data);append(data.record);}catch(_){text(state,'Invalid progress event');}});
+        source.addEventListener('gap',function(e){try{const data=JSON.parse(e.data);text(warning,data.text);warning.hidden=false;}catch(_){} });
+        source.addEventListener('end',function(e){
+          source.close();ended=true;text(state,'Ended - retained');
+          try{const data=JSON.parse(e.data);if(data.clear){records=[];text(output,data.text);text(state,'Access unavailable');return;}}catch(_){}
+          // Refresh only the final report summary, never the credential modal or window.
+          const report=document.getElementById('job-reports');
+          if(report && window.htmx) window.htmx.ajax('GET','/_partials/jobs/'+job+'/reports',{target:report,swap:'outerHTML'});
+        });
+        source.onerror=function(){if(!ended)text(state,'Reconnecting - recorded history preserved');};
+      } catch(e){text(state,'History unavailable');text(output,e.message);}
+    }
+    if(older)older.addEventListener('click',async function(e){
+      if(!window.fetch || !first)return;
+      e.preventDefault();older.setAttribute('aria-disabled','true');
+      try{const data=await read(base+'/progress?before='+first);if(!alive)return;
+        if(follow)follow.checked=false;
+        if(records.length+(data.events||[]).length>2000){window.location.assign('/jobs/'+job+'/progress?before='+first);return;}
+        records=(data.events||[]).concat(records);render(true);older.hidden=!data.has_older;
+      }catch(error){text(state,error.message);}finally{older.removeAttribute('aria-disabled');}
+    });
+    panel._journalClose=function(){alive=false;if(source)source.close();records=[];output.textContent='View cleared. Retained metadata remains available after authorized reload.';};
+    connect();
+  }
+  function jsonPanel(node) {
+    if(node.dataset.bound)return;node.dataset.bound='1';
+    let loaded=false,loading=false;
+    const output=node.querySelector('[data-json-output]'), status=node.querySelector('[data-json-status]'),copy=node.querySelector('[data-json-copy]');
+    node.addEventListener('toggle',async function(){
+      if(!node.open||loaded||loading)return;loading=true;text(status,'Loading');
+      try {const data=await read(node.dataset.reportJson);text(output,JSON.stringify(data.data,null,2));loaded=true;if(copy)copy.disabled=false;text(status,data.retention==='metadata_only'?'Retained metadata subset':'Retained report data');}
+      catch(e){text(status,e.message);}finally{loading=false;}
+    });
+    if(copy)copy.addEventListener('click',async function(){
+      try{await navigator.clipboard.writeText(output.textContent);text(status,'Copied');}
+      catch(_){text(status,'Copy is unavailable; select the JSON text manually.');}
+    });
+  }
+  function init(root){dates(root);root.querySelectorAll('[data-progress-journal]').forEach(journal);root.querySelectorAll('[data-report-json]').forEach(jsonPanel);}
+  document.addEventListener('DOMContentLoaded',function(){init(document);});
+  document.addEventListener('htmx:afterSwap',function(e){init(e.detail.target||document);});
+  window.addEventListener('pagehide',function(){document.querySelectorAll('[data-progress-journal]').forEach(function(p){if(p._journalClose)p._journalClose();});document.querySelectorAll('[data-json-output]').forEach(function(n){n.textContent='View cleared.';});});
+  window.addEventListener('pageshow',function(e){if(e.persisted)window.location.reload();});
+})();
diff --git a/scripts/addons/webgui/src/aim_webgui/static/js/experience.js b/scripts/addons/webgui/src/aim_webgui/static/js/experience.js
new file mode 100644
index 0000000..9cc23b8
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/static/js/experience.js
@@ -0,0 +1,47 @@
+'use strict';
+// Presentation-only state. No inventory, histories or credentials are persisted here.
+(function () {
+  function initialize(root) {
+    const menu = document.querySelector('[data-mobile-menu]');
+    if (menu && !menu.dataset.bound) {
+      menu.dataset.bound = 'true';
+      const toggle = menu.querySelector('summary');
+      const close = (restore) => { menu.open = false; if (restore) toggle.focus(); };
+      menu.addEventListener('keydown', (e) => {
+        if (e.key === 'Escape' && menu.open) { e.preventDefault(); close(true); }
+      });
+      document.addEventListener('click', (e) => { if (menu.open && !menu.contains(e.target)) close(false); });
+      menu.addEventListener('focusout', () => requestAnimationFrame(() => {
+        if (menu.open && !menu.contains(document.activeElement)) close(false);
+      }));
+      menu.querySelectorAll('a').forEach((a) => a.addEventListener('click', () => close(false)));
+      window.addEventListener('resize', () => { if (window.innerWidth > 760) close(false); });
+      window.addEventListener('pagehide', () => close(false));
+    }
+    (root || document).querySelectorAll('[data-explorer]').forEach((panel) => {
+      if (panel.dataset.graphBound) return;
+      panel.dataset.graphBound='true';
+      const graph=panel.querySelector('[data-inventory-graph]');
+      const box=panel.querySelector('.inventory-canvas');
+      if (!graph || !box) return;
+      const bw=Number(graph.dataset.baseWidth), bh=Number(graph.dataset.baseHeight);
+      let scale=1;
+      function setSize(n) {
+        scale=Math.max(.35,Math.min(1.8,n));
+        graph.setAttribute('width',String(Math.round(bw*scale)));
+        graph.setAttribute('height',String(Math.round(bh*scale)));
+        panel.querySelector('[data-graph-zoom="out"]').disabled=scale<=.35;
+        panel.querySelector('[data-graph-zoom="in"]').disabled=scale>=1.8;
+      }
+      // On phones avoid illegible fit-to-width; the graph remains internally scrollable.
+      setSize(Math.max(.65,Math.min(1,box.clientWidth/bw)));
+      panel.querySelectorAll('[data-graph-zoom]').forEach((button) => button.addEventListener('click', () => {
+        const dir=button.dataset.graphZoom;
+        setSize(dir==='reset'?Math.max(.65,Math.min(1,box.clientWidth/bw)):scale+(dir==='in'?.15:-.15));
+      }));
+    });
+  }
+  document.addEventListener('DOMContentLoaded',()=>initialize(document));
+  document.addEventListener('htmx:afterSwap',(e)=>initialize(e.detail.target));
+  window.addEventListener('pageshow',()=>initialize(document));
+}());
diff --git a/scripts/addons/webgui/src/aim_webgui/static/js/theme.js b/scripts/addons/webgui/src/aim_webgui/static/js/theme.js
new file mode 100644
index 0000000..1931188
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/static/js/theme.js
@@ -0,0 +1,45 @@
+'use strict';
+(function () {
+  const key = 'aim-web-display-theme';
+  const valid = new Set(['light', 'dark']);
+
+  function storedTheme() {
+    try {
+      const value = window.localStorage.getItem(key);
+      return valid.has(value) ? value : 'light';
+    } catch (_) {
+      return 'light';
+    }
+  }
+
+  function syncButtons(theme) {
+    document.querySelectorAll('[data-theme-option]').forEach(function (button) {
+      const active = button.dataset.themeOption === theme;
+      button.setAttribute('aria-pressed', active ? 'true' : 'false');
+      button.classList.toggle('active', active);
+    });
+  }
+
+  function applyTheme(theme) {
+    const value = valid.has(theme) ? theme : 'light';
+    document.documentElement.dataset.theme = value;
+    document.documentElement.dataset.bsTheme = value;
+    document.documentElement.style.colorScheme = value;
+    syncButtons(value);
+  }
+
+  applyTheme(storedTheme());
+
+  document.addEventListener('DOMContentLoaded', function () {
+    const buttons = document.querySelectorAll('[data-theme-option]');
+    if (!buttons.length) return;
+    syncButtons(document.documentElement.dataset.theme || 'light');
+    buttons.forEach(function (button) {
+      button.addEventListener('click', function () {
+        const value = valid.has(button.dataset.themeOption) ? button.dataset.themeOption : 'light';
+        try { window.localStorage.setItem(key, value); } catch (_) { /* Display preference only. */ }
+        applyTheme(value);
+      });
+    });
+  });
+}());
diff --git a/scripts/addons/webgui/src/aim_webgui/static/vendor/THIRD-PARTY.txt b/scripts/addons/webgui/src/aim_webgui/static/vendor/THIRD-PARTY.txt
new file mode 100644
index 0000000..99f4c43
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/static/vendor/THIRD-PARTY.txt
@@ -0,0 +1,38 @@
+Assets installed by deploy/fetch_assets.py:
+
+Bootstrap 5.3.8 (CSS only)
+https://github.com/twbs/bootstrap/tree/v5.3.8
+MIT License
+Copyright (c) 2011-2025 The Bootstrap Authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+htmx 2.0.10
+https://github.com/bigskysoftware/htmx/tree/v2.0.10
+Zero-Clause BSD
+
+Permission to use, copy, modify, and/or distribute this software for
+any purpose with or without fee is hereby granted.
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
+WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE
+FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY
+DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
+AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/scripts/addons/webgui/src/aim_webgui/static/vendor/bootstrap.min.css b/scripts/addons/webgui/src/aim_webgui/static/vendor/bootstrap.min.css
new file mode 100644
index 0000000..1d8bac4
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/static/vendor/bootstrap.min.css
@@ -0,0 +1,6 @@
+@charset "UTF-8";/*!
+ * Bootstrap  v5.3.8 (https://getbootstrap.com/)
+ * Copyright 2011-2025 The Bootstrap Authors
+ * Licensed under MIT (https://github.com/twbs/bootstrap/blob/main/LICENSE)
+ */:root,[data-bs-theme=light]{--bs-blue:#0d6efd;--bs-indigo:#6610f2;--bs-purple:#6f42c1;--bs-pink:#d63384;--bs-red:#dc3545;--bs-orange:#fd7e14;--bs-yellow:#ffc107;--bs-green:#198754;--bs-teal:#20c997;--bs-cyan:#0dcaf0;--bs-black:#000;--bs-white:#fff;--bs-gray:#6c757d;--bs-gray-dark:#343a40;--bs-gray-100:#f8f9fa;--bs-gray-200:#e9ecef;--bs-gray-300:#dee2e6;--bs-gray-400:#ced4da;--bs-gray-500:#adb5bd;--bs-gray-600:#6c757d;--bs-gray-700:#495057;--bs-gray-800:#343a40;--bs-gray-900:#212529;--bs-primary:#0d6efd;--bs-secondary:#6c757d;--bs-success:#198754;--bs-info:#0dcaf0;--bs-warning:#ffc107;--bs-danger:#dc3545;--bs-light:#f8f9fa;--bs-dark:#212529;--bs-primary-rgb:13,110,253;--bs-secondary-rgb:108,117,125;--bs-success-rgb:25,135,84;--bs-info-rgb:13,202,240;--bs-warning-rgb:255,193,7;--bs-danger-rgb:220,53,69;--bs-light-rgb:248,249,250;--bs-dark-rgb:33,37,41;--bs-primary-text-emphasis:#052c65;--bs-secondary-text-emphasis:#2b2f32;--bs-success-text-emphasis:#0a3622;--bs-info-text-emphasis:#055160;--bs-warning-text-emphasis:#664d03;--bs-danger-text-emphasis:#58151c;--bs-light-text-emphasis:#495057;--bs-dark-text-emphasis:#495057;--bs-primary-bg-subtle:#cfe2ff;--bs-secondary-bg-subtle:#e2e3e5;--bs-success-bg-subtle:#d1e7dd;--bs-info-bg-subtle:#cff4fc;--bs-warning-bg-subtle:#fff3cd;--bs-danger-bg-subtle:#f8d7da;--bs-light-bg-subtle:#fcfcfd;--bs-dark-bg-subtle:#ced4da;--bs-primary-border-subtle:#9ec5fe;--bs-secondary-border-subtle:#c4c8cb;--bs-success-border-subtle:#a3cfbb;--bs-info-border-subtle:#9eeaf9;--bs-warning-border-subtle:#ffe69c;--bs-danger-border-subtle:#f1aeb5;--bs-light-border-subtle:#e9ecef;--bs-dark-border-subtle:#adb5bd;--bs-white-rgb:255,255,255;--bs-black-rgb:0,0,0;--bs-font-sans-serif:system-ui,-apple-system,"Segoe UI",Roboto,"Helvetica Neue","Noto Sans","Liberation Sans",Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";--bs-font-monospace:SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",monospace;--bs-gradient:linear-gradient(180deg, rgba(255, 255, 255, 0.15), rgba(255, 255, 255, 0));--bs-body-font-family:var(--bs-font-sans-serif);--bs-body-font-size:1rem;--bs-body-font-weight:400;--bs-body-line-height:1.5;--bs-body-color:#212529;--bs-body-color-rgb:33,37,41;--bs-body-bg:#fff;--bs-body-bg-rgb:255,255,255;--bs-emphasis-color:#000;--bs-emphasis-color-rgb:0,0,0;--bs-secondary-color:rgba(33, 37, 41, 0.75);--bs-secondary-color-rgb:33,37,41;--bs-secondary-bg:#e9ecef;--bs-secondary-bg-rgb:233,236,239;--bs-tertiary-color:rgba(33, 37, 41, 0.5);--bs-tertiary-color-rgb:33,37,41;--bs-tertiary-bg:#f8f9fa;--bs-tertiary-bg-rgb:248,249,250;--bs-heading-color:inherit;--bs-link-color:#0d6efd;--bs-link-color-rgb:13,110,253;--bs-link-decoration:underline;--bs-link-hover-color:#0a58ca;--bs-link-hover-color-rgb:10,88,202;--bs-code-color:#d63384;--bs-highlight-color:#212529;--bs-highlight-bg:#fff3cd;--bs-border-width:1px;--bs-border-style:solid;--bs-border-color:#dee2e6;--bs-border-color-translucent:rgba(0, 0, 0, 0.175);--bs-border-radius:0.375rem;--bs-border-radius-sm:0.25rem;--bs-border-radius-lg:0.5rem;--bs-border-radius-xl:1rem;--bs-border-radius-xxl:2rem;--bs-border-radius-2xl:var(--bs-border-radius-xxl);--bs-border-radius-pill:50rem;--bs-box-shadow:0 0.5rem 1rem rgba(0, 0, 0, 0.15);--bs-box-shadow-sm:0 0.125rem 0.25rem rgba(0, 0, 0, 0.075);--bs-box-shadow-lg:0 1rem 3rem rgba(0, 0, 0, 0.175);--bs-box-shadow-inset:inset 0 1px 2px rgba(0, 0, 0, 0.075);--bs-focus-ring-width:0.25rem;--bs-focus-ring-opacity:0.25;--bs-focus-ring-color:rgba(13, 110, 253, 0.25);--bs-form-valid-color:#198754;--bs-form-valid-border-color:#198754;--bs-form-invalid-color:#dc3545;--bs-form-invalid-border-color:#dc3545}[data-bs-theme=dark]{color-scheme:dark;--bs-body-color:#dee2e6;--bs-body-color-rgb:222,226,230;--bs-body-bg:#212529;--bs-body-bg-rgb:33,37,41;--bs-emphasis-color:#fff;--bs-emphasis-color-rgb:255,255,255;--bs-secondary-color:rgba(222, 226, 230, 0.75);--bs-secondary-color-rgb:222,226,230;--bs-secondary-bg:#343a40;--bs-secondary-bg-rgb:52,58,64;--bs-tertiary-color:rgba(222, 226, 230, 0.5);--bs-tertiary-color-rgb:222,226,230;--bs-tertiary-bg:#2b3035;--bs-tertiary-bg-rgb:43,48,53;--bs-primary-text-emphasis:#6ea8fe;--bs-secondary-text-emphasis:#a7acb1;--bs-success-text-emphasis:#75b798;--bs-info-text-emphasis:#6edff6;--bs-warning-text-emphasis:#ffda6a;--bs-danger-text-emphasis:#ea868f;--bs-light-text-emphasis:#f8f9fa;--bs-dark-text-emphasis:#dee2e6;--bs-primary-bg-subtle:#031633;--bs-secondary-bg-subtle:#161719;--bs-success-bg-subtle:#051b11;--bs-info-bg-subtle:#032830;--bs-warning-bg-subtle:#332701;--bs-danger-bg-subtle:#2c0b0e;--bs-light-bg-subtle:#343a40;--bs-dark-bg-subtle:#1a1d20;--bs-primary-border-subtle:#084298;--bs-secondary-border-subtle:#41464b;--bs-success-border-subtle:#0f5132;--bs-info-border-subtle:#087990;--bs-warning-border-subtle:#997404;--bs-danger-border-subtle:#842029;--bs-light-border-subtle:#495057;--bs-dark-border-subtle:#343a40;--bs-heading-color:inherit;--bs-link-color:#6ea8fe;--bs-link-hover-color:#8bb9fe;--bs-link-color-rgb:110,168,254;--bs-link-hover-color-rgb:139,185,254;--bs-code-color:#e685b5;--bs-highlight-color:#dee2e6;--bs-highlight-bg:#664d03;--bs-border-color:#495057;--bs-border-color-translucent:rgba(255, 255, 255, 0.15);--bs-form-valid-color:#75b798;--bs-form-valid-border-color:#75b798;--bs-form-invalid-color:#ea868f;--bs-form-invalid-border-color:#ea868f}*,::after,::before{box-sizing:border-box}@media (prefers-reduced-motion:no-preference){:root{scroll-behavior:smooth}}body{margin:0;font-family:var(--bs-body-font-family);font-size:var(--bs-body-font-size);font-weight:var(--bs-body-font-weight);line-height:var(--bs-body-line-height);color:var(--bs-body-color);text-align:var(--bs-body-text-align);background-color:var(--bs-body-bg);-webkit-text-size-adjust:100%;-webkit-tap-highlight-color:transparent}hr{margin:1rem 0;color:inherit;border:0;border-top:var(--bs-border-width) solid;opacity:.25}.h1,.h2,.h3,.h4,.h5,.h6,h1,h2,h3,h4,h5,h6{margin-top:0;margin-bottom:.5rem;font-weight:500;line-height:1.2;color:var(--bs-heading-color)}.h1,h1{font-size:calc(1.375rem + 1.5vw)}@media (min-width:1200px){.h1,h1{font-size:2.5rem}}.h2,h2{font-size:calc(1.325rem + .9vw)}@media (min-width:1200px){.h2,h2{font-size:2rem}}.h3,h3{font-size:calc(1.3rem + .6vw)}@media (min-width:1200px){.h3,h3{font-size:1.75rem}}.h4,h4{font-size:calc(1.275rem + .3vw)}@media (min-width:1200px){.h4,h4{font-size:1.5rem}}.h5,h5{font-size:1.25rem}.h6,h6{font-size:1rem}p{margin-top:0;margin-bottom:1rem}abbr[title]{-webkit-text-decoration:underline dotted;text-decoration:underline dotted;cursor:help;-webkit-text-decoration-skip-ink:none;text-decoration-skip-ink:none}address{margin-bottom:1rem;font-style:normal;line-height:inherit}ol,ul{padding-left:2rem}dl,ol,ul{margin-top:0;margin-bottom:1rem}ol ol,ol ul,ul ol,ul ul{margin-bottom:0}dt{font-weight:700}dd{margin-bottom:.5rem;margin-left:0}blockquote{margin:0 0 1rem}b,strong{font-weight:bolder}.small,small{font-size:.875em}.mark,mark{padding:.1875em;color:var(--bs-highlight-color);background-color:var(--bs-highlight-bg)}sub,sup{position:relative;font-size:.75em;line-height:0;vertical-align:baseline}sub{bottom:-.25em}sup{top:-.5em}a{color:rgba(var(--bs-link-color-rgb),var(--bs-link-opacity,1));text-decoration:underline}a:hover{--bs-link-color-rgb:var(--bs-link-hover-color-rgb)}a:not([href]):not([class]),a:not([href]):not([class]):hover{color:inherit;text-decoration:none}code,kbd,pre,samp{font-family:var(--bs-font-monospace);font-size:1em}pre{display:block;margin-top:0;margin-bottom:1rem;overflow:auto;font-size:.875em}pre code{font-size:inherit;color:inherit;word-break:normal}code{font-size:.875em;color:var(--bs-code-color);word-wrap:break-word}a>code{color:inherit}kbd{padding:.1875rem .375rem;font-size:.875em;color:var(--bs-body-bg);background-color:var(--bs-body-color);border-radius:.25rem}kbd kbd{padding:0;font-size:1em}figure{margin:0 0 1rem}img,svg{vertical-align:middle}table{caption-side:bottom;border-collapse:collapse}caption{padding-top:.5rem;padding-bottom:.5rem;color:var(--bs-secondary-color);text-align:left}th{text-align:inherit;text-align:-webkit-match-parent}tbody,td,tfoot,th,thead,tr{border-color:inherit;border-style:solid;border-width:0}label{display:inline-block}button{border-radius:0}button:focus:not(:focus-visible){outline:0}button,input,optgroup,select,textarea{margin:0;font-family:inherit;font-size:inherit;line-height:inherit}button,select{text-transform:none}[role=button]{cursor:pointer}select{word-wrap:normal}select:disabled{opacity:1}[list]:not([type=date]):not([type=datetime-local]):not([type=month]):not([type=week]):not([type=time])::-webkit-calendar-picker-indicator{display:none!important}[type=button],[type=reset],[type=submit],button{-webkit-appearance:button}[type=button]:not(:disabled),[type=reset]:not(:disabled),[type=submit]:not(:disabled),button:not(:disabled){cursor:pointer}::-moz-focus-inner{padding:0;border-style:none}textarea{resize:vertical}fieldset{min-width:0;padding:0;margin:0;border:0}legend{float:left;width:100%;padding:0;margin-bottom:.5rem;line-height:inherit;font-size:calc(1.275rem + .3vw)}@media (min-width:1200px){legend{font-size:1.5rem}}legend+*{clear:left}::-webkit-datetime-edit-day-field,::-webkit-datetime-edit-fields-wrapper,::-webkit-datetime-edit-hour-field,::-webkit-datetime-edit-minute,::-webkit-datetime-edit-month-field,::-webkit-datetime-edit-text,::-webkit-datetime-edit-year-field{padding:0}::-webkit-inner-spin-button{height:auto}[type=search]{-webkit-appearance:textfield;outline-offset:-2px}[type=search]::-webkit-search-cancel-button{cursor:pointer;filter:grayscale(1)}::-webkit-search-decoration{-webkit-appearance:none}::-webkit-color-swatch-wrapper{padding:0}::-webkit-file-upload-button{font:inherit;-webkit-appearance:button}::file-selector-button{font:inherit;-webkit-appearance:button}output{display:inline-block}iframe{border:0}summary{display:list-item;cursor:pointer}progress{vertical-align:baseline}[hidden]{display:none!important}.lead{font-size:1.25rem;font-weight:300}.display-1{font-weight:300;line-height:1.2;font-size:calc(1.625rem + 4.5vw)}@media (min-width:1200px){.display-1{font-size:5rem}}.display-2{font-weight:300;line-height:1.2;font-size:calc(1.575rem + 3.9vw)}@media (min-width:1200px){.display-2{font-size:4.5rem}}.display-3{font-weight:300;line-height:1.2;font-size:calc(1.525rem + 3.3vw)}@media (min-width:1200px){.display-3{font-size:4rem}}.display-4{font-weight:300;line-height:1.2;font-size:calc(1.475rem + 2.7vw)}@media (min-width:1200px){.display-4{font-size:3.5rem}}.display-5{font-weight:300;line-height:1.2;font-size:calc(1.425rem + 2.1vw)}@media (min-width:1200px){.display-5{font-size:3rem}}.display-6{font-weight:300;line-height:1.2;font-size:calc(1.375rem + 1.5vw)}@media (min-width:1200px){.display-6{font-size:2.5rem}}.list-unstyled{padding-left:0;list-style:none}.list-inline{padding-left:0;list-style:none}.list-inline-item{display:inline-block}.list-inline-item:not(:last-child){margin-right:.5rem}.initialism{font-size:.875em;text-transform:uppercase}.blockquote{margin-bottom:1rem;font-size:1.25rem}.blockquote>:last-child{margin-bottom:0}.blockquote-footer{margin-top:-1rem;margin-bottom:1rem;font-size:.875em;color:#6c757d}.blockquote-footer::before{content:"— "}.img-fluid{max-width:100%;height:auto}.img-thumbnail{padding:.25rem;background-color:var(--bs-body-bg);border:var(--bs-border-width) solid var(--bs-border-color);border-radius:var(--bs-border-radius);max-width:100%;height:auto}.figure{display:inline-block}.figure-img{margin-bottom:.5rem;line-height:1}.figure-caption{font-size:.875em;color:var(--bs-secondary-color)}.container,.container-fluid,.container-lg,.container-md,.container-sm,.container-xl,.container-xxl{--bs-gutter-x:1.5rem;--bs-gutter-y:0;width:100%;padding-right:calc(var(--bs-gutter-x) * .5);padding-left:calc(var(--bs-gutter-x) * .5);margin-right:auto;margin-left:auto}@media (min-width:576px){.container,.container-sm{max-width:540px}}@media (min-width:768px){.container,.container-md,.container-sm{max-width:720px}}@media (min-width:992px){.container,.container-lg,.container-md,.container-sm{max-width:960px}}@media (min-width:1200px){.container,.container-lg,.container-md,.container-sm,.container-xl{max-width:1140px}}@media (min-width:1400px){.container,.container-lg,.container-md,.container-sm,.container-xl,.container-xxl{max-width:1320px}}:root{--bs-breakpoint-xs:0;--bs-breakpoint-sm:576px;--bs-breakpoint-md:768px;--bs-breakpoint-lg:992px;--bs-breakpoint-xl:1200px;--bs-breakpoint-xxl:1400px}.row{--bs-gutter-x:1.5rem;--bs-gutter-y:0;display:flex;flex-wrap:wrap;margin-top:calc(-1 * var(--bs-gutter-y));margin-right:calc(-.5 * var(--bs-gutter-x));margin-left:calc(-.5 * var(--bs-gutter-x))}.row>*{flex-shrink:0;width:100%;max-width:100%;padding-right:calc(var(--bs-gutter-x) * .5);padding-left:calc(var(--bs-gutter-x) * .5);margin-top:var(--bs-gutter-y)}.col{flex:1 0 0}.row-cols-auto>*{flex:0 0 auto;width:auto}.row-cols-1>*{flex:0 0 auto;width:100%}.row-cols-2>*{flex:0 0 auto;width:50%}.row-cols-3>*{flex:0 0 auto;width:33.33333333%}.row-cols-4>*{flex:0 0 auto;width:25%}.row-cols-5>*{flex:0 0 auto;width:20%}.row-cols-6>*{flex:0 0 auto;width:16.66666667%}.col-auto{flex:0 0 auto;width:auto}.col-1{flex:0 0 auto;width:8.33333333%}.col-2{flex:0 0 auto;width:16.66666667%}.col-3{flex:0 0 auto;width:25%}.col-4{flex:0 0 auto;width:33.33333333%}.col-5{flex:0 0 auto;width:41.66666667%}.col-6{flex:0 0 auto;width:50%}.col-7{flex:0 0 auto;width:58.33333333%}.col-8{flex:0 0 auto;width:66.66666667%}.col-9{flex:0 0 auto;width:75%}.col-10{flex:0 0 auto;width:83.33333333%}.col-11{flex:0 0 auto;width:91.66666667%}.col-12{flex:0 0 auto;width:100%}.offset-1{margin-left:8.33333333%}.offset-2{margin-left:16.66666667%}.offset-3{margin-left:25%}.offset-4{margin-left:33.33333333%}.offset-5{margin-left:41.66666667%}.offset-6{margin-left:50%}.offset-7{margin-left:58.33333333%}.offset-8{margin-left:66.66666667%}.offset-9{margin-left:75%}.offset-10{margin-left:83.33333333%}.offset-11{margin-left:91.66666667%}.g-0,.gx-0{--bs-gutter-x:0}.g-0,.gy-0{--bs-gutter-y:0}.g-1,.gx-1{--bs-gutter-x:0.25rem}.g-1,.gy-1{--bs-gutter-y:0.25rem}.g-2,.gx-2{--bs-gutter-x:0.5rem}.g-2,.gy-2{--bs-gutter-y:0.5rem}.g-3,.gx-3{--bs-gutter-x:1rem}.g-3,.gy-3{--bs-gutter-y:1rem}.g-4,.gx-4{--bs-gutter-x:1.5rem}.g-4,.gy-4{--bs-gutter-y:1.5rem}.g-5,.gx-5{--bs-gutter-x:3rem}.g-5,.gy-5{--bs-gutter-y:3rem}@media (min-width:576px){.col-sm{flex:1 0 0}.row-cols-sm-auto>*{flex:0 0 auto;width:auto}.row-cols-sm-1>*{flex:0 0 auto;width:100%}.row-cols-sm-2>*{flex:0 0 auto;width:50%}.row-cols-sm-3>*{flex:0 0 auto;width:33.33333333%}.row-cols-sm-4>*{flex:0 0 auto;width:25%}.row-cols-sm-5>*{flex:0 0 auto;width:20%}.row-cols-sm-6>*{flex:0 0 auto;width:16.66666667%}.col-sm-auto{flex:0 0 auto;width:auto}.col-sm-1{flex:0 0 auto;width:8.33333333%}.col-sm-2{flex:0 0 auto;width:16.66666667%}.col-sm-3{flex:0 0 auto;width:25%}.col-sm-4{flex:0 0 auto;width:33.33333333%}.col-sm-5{flex:0 0 auto;width:41.66666667%}.col-sm-6{flex:0 0 auto;width:50%}.col-sm-7{flex:0 0 auto;width:58.33333333%}.col-sm-8{flex:0 0 auto;width:66.66666667%}.col-sm-9{flex:0 0 auto;width:75%}.col-sm-10{flex:0 0 auto;width:83.33333333%}.col-sm-11{flex:0 0 auto;width:91.66666667%}.col-sm-12{flex:0 0 auto;width:100%}.offset-sm-0{margin-left:0}.offset-sm-1{margin-left:8.33333333%}.offset-sm-2{margin-left:16.66666667%}.offset-sm-3{margin-left:25%}.offset-sm-4{margin-left:33.33333333%}.offset-sm-5{margin-left:41.66666667%}.offset-sm-6{margin-left:50%}.offset-sm-7{margin-left:58.33333333%}.offset-sm-8{margin-left:66.66666667%}.offset-sm-9{margin-left:75%}.offset-sm-10{margin-left:83.33333333%}.offset-sm-11{margin-left:91.66666667%}.g-sm-0,.gx-sm-0{--bs-gutter-x:0}.g-sm-0,.gy-sm-0{--bs-gutter-y:0}.g-sm-1,.gx-sm-1{--bs-gutter-x:0.25rem}.g-sm-1,.gy-sm-1{--bs-gutter-y:0.25rem}.g-sm-2,.gx-sm-2{--bs-gutter-x:0.5rem}.g-sm-2,.gy-sm-2{--bs-gutter-y:0.5rem}.g-sm-3,.gx-sm-3{--bs-gutter-x:1rem}.g-sm-3,.gy-sm-3{--bs-gutter-y:1rem}.g-sm-4,.gx-sm-4{--bs-gutter-x:1.5rem}.g-sm-4,.gy-sm-4{--bs-gutter-y:1.5rem}.g-sm-5,.gx-sm-5{--bs-gutter-x:3rem}.g-sm-5,.gy-sm-5{--bs-gutter-y:3rem}}@media (min-width:768px){.col-md{flex:1 0 0}.row-cols-md-auto>*{flex:0 0 auto;width:auto}.row-cols-md-1>*{flex:0 0 auto;width:100%}.row-cols-md-2>*{flex:0 0 auto;width:50%}.row-cols-md-3>*{flex:0 0 auto;width:33.33333333%}.row-cols-md-4>*{flex:0 0 auto;width:25%}.row-cols-md-5>*{flex:0 0 auto;width:20%}.row-cols-md-6>*{flex:0 0 auto;width:16.66666667%}.col-md-auto{flex:0 0 auto;width:auto}.col-md-1{flex:0 0 auto;width:8.33333333%}.col-md-2{flex:0 0 auto;width:16.66666667%}.col-md-3{flex:0 0 auto;width:25%}.col-md-4{flex:0 0 auto;width:33.33333333%}.col-md-5{flex:0 0 auto;width:41.66666667%}.col-md-6{flex:0 0 auto;width:50%}.col-md-7{flex:0 0 auto;width:58.33333333%}.col-md-8{flex:0 0 auto;width:66.66666667%}.col-md-9{flex:0 0 auto;width:75%}.col-md-10{flex:0 0 auto;width:83.33333333%}.col-md-11{flex:0 0 auto;width:91.66666667%}.col-md-12{flex:0 0 auto;width:100%}.offset-md-0{margin-left:0}.offset-md-1{margin-left:8.33333333%}.offset-md-2{margin-left:16.66666667%}.offset-md-3{margin-left:25%}.offset-md-4{margin-left:33.33333333%}.offset-md-5{margin-left:41.66666667%}.offset-md-6{margin-left:50%}.offset-md-7{margin-left:58.33333333%}.offset-md-8{margin-left:66.66666667%}.offset-md-9{margin-left:75%}.offset-md-10{margin-left:83.33333333%}.offset-md-11{margin-left:91.66666667%}.g-md-0,.gx-md-0{--bs-gutter-x:0}.g-md-0,.gy-md-0{--bs-gutter-y:0}.g-md-1,.gx-md-1{--bs-gutter-x:0.25rem}.g-md-1,.gy-md-1{--bs-gutter-y:0.25rem}.g-md-2,.gx-md-2{--bs-gutter-x:0.5rem}.g-md-2,.gy-md-2{--bs-gutter-y:0.5rem}.g-md-3,.gx-md-3{--bs-gutter-x:1rem}.g-md-3,.gy-md-3{--bs-gutter-y:1rem}.g-md-4,.gx-md-4{--bs-gutter-x:1.5rem}.g-md-4,.gy-md-4{--bs-gutter-y:1.5rem}.g-md-5,.gx-md-5{--bs-gutter-x:3rem}.g-md-5,.gy-md-5{--bs-gutter-y:3rem}}@media (min-width:992px){.col-lg{flex:1 0 0}.row-cols-lg-auto>*{flex:0 0 auto;width:auto}.row-cols-lg-1>*{flex:0 0 auto;width:100%}.row-cols-lg-2>*{flex:0 0 auto;width:50%}.row-cols-lg-3>*{flex:0 0 auto;width:33.33333333%}.row-cols-lg-4>*{flex:0 0 auto;width:25%}.row-cols-lg-5>*{flex:0 0 auto;width:20%}.row-cols-lg-6>*{flex:0 0 auto;width:16.66666667%}.col-lg-auto{flex:0 0 auto;width:auto}.col-lg-1{flex:0 0 auto;width:8.33333333%}.col-lg-2{flex:0 0 auto;width:16.66666667%}.col-lg-3{flex:0 0 auto;width:25%}.col-lg-4{flex:0 0 auto;width:33.33333333%}.col-lg-5{flex:0 0 auto;width:41.66666667%}.col-lg-6{flex:0 0 auto;width:50%}.col-lg-7{flex:0 0 auto;width:58.33333333%}.col-lg-8{flex:0 0 auto;width:66.66666667%}.col-lg-9{flex:0 0 auto;width:75%}.col-lg-10{flex:0 0 auto;width:83.33333333%}.col-lg-11{flex:0 0 auto;width:91.66666667%}.col-lg-12{flex:0 0 auto;width:100%}.offset-lg-0{margin-left:0}.offset-lg-1{margin-left:8.33333333%}.offset-lg-2{margin-left:16.66666667%}.offset-lg-3{margin-left:25%}.offset-lg-4{margin-left:33.33333333%}.offset-lg-5{margin-left:41.66666667%}.offset-lg-6{margin-left:50%}.offset-lg-7{margin-left:58.33333333%}.offset-lg-8{margin-left:66.66666667%}.offset-lg-9{margin-left:75%}.offset-lg-10{margin-left:83.33333333%}.offset-lg-11{margin-left:91.66666667%}.g-lg-0,.gx-lg-0{--bs-gutter-x:0}.g-lg-0,.gy-lg-0{--bs-gutter-y:0}.g-lg-1,.gx-lg-1{--bs-gutter-x:0.25rem}.g-lg-1,.gy-lg-1{--bs-gutter-y:0.25rem}.g-lg-2,.gx-lg-2{--bs-gutter-x:0.5rem}.g-lg-2,.gy-lg-2{--bs-gutter-y:0.5rem}.g-lg-3,.gx-lg-3{--bs-gutter-x:1rem}.g-lg-3,.gy-lg-3{--bs-gutter-y:1rem}.g-lg-4,.gx-lg-4{--bs-gutter-x:1.5rem}.g-lg-4,.gy-lg-4{--bs-gutter-y:1.5rem}.g-lg-5,.gx-lg-5{--bs-gutter-x:3rem}.g-lg-5,.gy-lg-5{--bs-gutter-y:3rem}}@media (min-width:1200px){.col-xl{flex:1 0 0}.row-cols-xl-auto>*{flex:0 0 auto;width:auto}.row-cols-xl-1>*{flex:0 0 auto;width:100%}.row-cols-xl-2>*{flex:0 0 auto;width:50%}.row-cols-xl-3>*{flex:0 0 auto;width:33.33333333%}.row-cols-xl-4>*{flex:0 0 auto;width:25%}.row-cols-xl-5>*{flex:0 0 auto;width:20%}.row-cols-xl-6>*{flex:0 0 auto;width:16.66666667%}.col-xl-auto{flex:0 0 auto;width:auto}.col-xl-1{flex:0 0 auto;width:8.33333333%}.col-xl-2{flex:0 0 auto;width:16.66666667%}.col-xl-3{flex:0 0 auto;width:25%}.col-xl-4{flex:0 0 auto;width:33.33333333%}.col-xl-5{flex:0 0 auto;width:41.66666667%}.col-xl-6{flex:0 0 auto;width:50%}.col-xl-7{flex:0 0 auto;width:58.33333333%}.col-xl-8{flex:0 0 auto;width:66.66666667%}.col-xl-9{flex:0 0 auto;width:75%}.col-xl-10{flex:0 0 auto;width:83.33333333%}.col-xl-11{flex:0 0 auto;width:91.66666667%}.col-xl-12{flex:0 0 auto;width:100%}.offset-xl-0{margin-left:0}.offset-xl-1{margin-left:8.33333333%}.offset-xl-2{margin-left:16.66666667%}.offset-xl-3{margin-left:25%}.offset-xl-4{margin-left:33.33333333%}.offset-xl-5{margin-left:41.66666667%}.offset-xl-6{margin-left:50%}.offset-xl-7{margin-left:58.33333333%}.offset-xl-8{margin-left:66.66666667%}.offset-xl-9{margin-left:75%}.offset-xl-10{margin-left:83.33333333%}.offset-xl-11{margin-left:91.66666667%}.g-xl-0,.gx-xl-0{--bs-gutter-x:0}.g-xl-0,.gy-xl-0{--bs-gutter-y:0}.g-xl-1,.gx-xl-1{--bs-gutter-x:0.25rem}.g-xl-1,.gy-xl-1{--bs-gutter-y:0.25rem}.g-xl-2,.gx-xl-2{--bs-gutter-x:0.5rem}.g-xl-2,.gy-xl-2{--bs-gutter-y:0.5rem}.g-xl-3,.gx-xl-3{--bs-gutter-x:1rem}.g-xl-3,.gy-xl-3{--bs-gutter-y:1rem}.g-xl-4,.gx-xl-4{--bs-gutter-x:1.5rem}.g-xl-4,.gy-xl-4{--bs-gutter-y:1.5rem}.g-xl-5,.gx-xl-5{--bs-gutter-x:3rem}.g-xl-5,.gy-xl-5{--bs-gutter-y:3rem}}@media (min-width:1400px){.col-xxl{flex:1 0 0}.row-cols-xxl-auto>*{flex:0 0 auto;width:auto}.row-cols-xxl-1>*{flex:0 0 auto;width:100%}.row-cols-xxl-2>*{flex:0 0 auto;width:50%}.row-cols-xxl-3>*{flex:0 0 auto;width:33.33333333%}.row-cols-xxl-4>*{flex:0 0 auto;width:25%}.row-cols-xxl-5>*{flex:0 0 auto;width:20%}.row-cols-xxl-6>*{flex:0 0 auto;width:16.66666667%}.col-xxl-auto{flex:0 0 auto;width:auto}.col-xxl-1{flex:0 0 auto;width:8.33333333%}.col-xxl-2{flex:0 0 auto;width:16.66666667%}.col-xxl-3{flex:0 0 auto;width:25%}.col-xxl-4{flex:0 0 auto;width:33.33333333%}.col-xxl-5{flex:0 0 auto;width:41.66666667%}.col-xxl-6{flex:0 0 auto;width:50%}.col-xxl-7{flex:0 0 auto;width:58.33333333%}.col-xxl-8{flex:0 0 auto;width:66.66666667%}.col-xxl-9{flex:0 0 auto;width:75%}.col-xxl-10{flex:0 0 auto;width:83.33333333%}.col-xxl-11{flex:0 0 auto;width:91.66666667%}.col-xxl-12{flex:0 0 auto;width:100%}.offset-xxl-0{margin-left:0}.offset-xxl-1{margin-left:8.33333333%}.offset-xxl-2{margin-left:16.66666667%}.offset-xxl-3{margin-left:25%}.offset-xxl-4{margin-left:33.33333333%}.offset-xxl-5{margin-left:41.66666667%}.offset-xxl-6{margin-left:50%}.offset-xxl-7{margin-left:58.33333333%}.offset-xxl-8{margin-left:66.66666667%}.offset-xxl-9{margin-left:75%}.offset-xxl-10{margin-left:83.33333333%}.offset-xxl-11{margin-left:91.66666667%}.g-xxl-0,.gx-xxl-0{--bs-gutter-x:0}.g-xxl-0,.gy-xxl-0{--bs-gutter-y:0}.g-xxl-1,.gx-xxl-1{--bs-gutter-x:0.25rem}.g-xxl-1,.gy-xxl-1{--bs-gutter-y:0.25rem}.g-xxl-2,.gx-xxl-2{--bs-gutter-x:0.5rem}.g-xxl-2,.gy-xxl-2{--bs-gutter-y:0.5rem}.g-xxl-3,.gx-xxl-3{--bs-gutter-x:1rem}.g-xxl-3,.gy-xxl-3{--bs-gutter-y:1rem}.g-xxl-4,.gx-xxl-4{--bs-gutter-x:1.5rem}.g-xxl-4,.gy-xxl-4{--bs-gutter-y:1.5rem}.g-xxl-5,.gx-xxl-5{--bs-gutter-x:3rem}.g-xxl-5,.gy-xxl-5{--bs-gutter-y:3rem}}.table{--bs-table-color-type:initial;--bs-table-bg-type:initial;--bs-table-color-state:initial;--bs-table-bg-state:initial;--bs-table-color:var(--bs-emphasis-color);--bs-table-bg:var(--bs-body-bg);--bs-table-border-color:var(--bs-border-color);--bs-table-accent-bg:transparent;--bs-table-striped-color:var(--bs-emphasis-color);--bs-table-striped-bg:rgba(var(--bs-emphasis-color-rgb), 0.05);--bs-table-active-color:var(--bs-emphasis-color);--bs-table-active-bg:rgba(var(--bs-emphasis-color-rgb), 0.1);--bs-table-hover-color:var(--bs-emphasis-color);--bs-table-hover-bg:rgba(var(--bs-emphasis-color-rgb), 0.075);width:100%;margin-bottom:1rem;vertical-align:top;border-color:var(--bs-table-border-color)}.table>:not(caption)>*>*{padding:.5rem .5rem;color:var(--bs-table-color-state,var(--bs-table-color-type,var(--bs-table-color)));background-color:var(--bs-table-bg);border-bottom-width:var(--bs-border-width);box-shadow:inset 0 0 0 9999px var(--bs-table-bg-state,var(--bs-table-bg-type,var(--bs-table-accent-bg)))}.table>tbody{vertical-align:inherit}.table>thead{vertical-align:bottom}.table-group-divider{border-top:calc(var(--bs-border-width) * 2) solid currentcolor}.caption-top{caption-side:top}.table-sm>:not(caption)>*>*{padding:.25rem .25rem}.table-bordered>:not(caption)>*{border-width:var(--bs-border-width) 0}.table-bordered>:not(caption)>*>*{border-width:0 var(--bs-border-width)}.table-borderless>:not(caption)>*>*{border-bottom-width:0}.table-borderless>:not(:first-child){border-top-width:0}.table-striped>tbody>tr:nth-of-type(odd)>*{--bs-table-color-type:var(--bs-table-striped-color);--bs-table-bg-type:var(--bs-table-striped-bg)}.table-striped-columns>:not(caption)>tr>:nth-child(2n){--bs-table-color-type:var(--bs-table-striped-color);--bs-table-bg-type:var(--bs-table-striped-bg)}.table-active{--bs-table-color-state:var(--bs-table-active-color);--bs-table-bg-state:var(--bs-table-active-bg)}.table-hover>tbody>tr:hover>*{--bs-table-color-state:var(--bs-table-hover-color);--bs-table-bg-state:var(--bs-table-hover-bg)}.table-primary{--bs-table-color:#000;--bs-table-bg:#cfe2ff;--bs-table-border-color:#a6b5cc;--bs-table-striped-bg:#c5d7f2;--bs-table-striped-color:#000;--bs-table-active-bg:#bacbe6;--bs-table-active-color:#000;--bs-table-hover-bg:#bfd1ec;--bs-table-hover-color:#000;color:var(--bs-table-color);border-color:var(--bs-table-border-color)}.table-secondary{--bs-table-color:#000;--bs-table-bg:#e2e3e5;--bs-table-border-color:#b5b6b7;--bs-table-striped-bg:#d7d8da;--bs-table-striped-color:#000;--bs-table-active-bg:#cbccce;--bs-table-active-color:#000;--bs-table-hover-bg:#d1d2d4;--bs-table-hover-color:#000;color:var(--bs-table-color);border-color:var(--bs-table-border-color)}.table-success{--bs-table-color:#000;--bs-table-bg:#d1e7dd;--bs-table-border-color:#a7b9b1;--bs-table-striped-bg:#c7dbd2;--bs-table-striped-color:#000;--bs-table-active-bg:#bcd0c7;--bs-table-active-color:#000;--bs-table-hover-bg:#c1d6cc;--bs-table-hover-color:#000;color:var(--bs-table-color);border-color:var(--bs-table-border-color)}.table-info{--bs-table-color:#000;--bs-table-bg:#cff4fc;--bs-table-border-color:#a6c3ca;--bs-table-striped-bg:#c5e8ef;--bs-table-striped-color:#000;--bs-table-active-bg:#badce3;--bs-table-active-color:#000;--bs-table-hover-bg:#bfe2e9;--bs-table-hover-color:#000;color:var(--bs-table-color);border-color:var(--bs-table-border-color)}.table-warning{--bs-table-color:#000;--bs-table-bg:#fff3cd;--bs-table-border-color:#ccc2a4;--bs-table-striped-bg:#f2e7c3;--bs-table-striped-color:#000;--bs-table-active-bg:#e6dbb9;--bs-table-active-color:#000;--bs-table-hover-bg:#ece1be;--bs-table-hover-color:#000;color:var(--bs-table-color);border-color:var(--bs-table-border-color)}.table-danger{--bs-table-color:#000;--bs-table-bg:#f8d7da;--bs-table-border-color:#c6acae;--bs-table-striped-bg:#eccccf;--bs-table-striped-color:#000;--bs-table-active-bg:#dfc2c4;--bs-table-active-color:#000;--bs-table-hover-bg:#e5c7ca;--bs-table-hover-color:#000;color:var(--bs-table-color);border-color:var(--bs-table-border-color)}.table-light{--bs-table-color:#000;--bs-table-bg:#f8f9fa;--bs-table-border-color:#c6c7c8;--bs-table-striped-bg:#ecedee;--bs-table-striped-color:#000;--bs-table-active-bg:#dfe0e1;--bs-table-active-color:#000;--bs-table-hover-bg:#e5e6e7;--bs-table-hover-color:#000;color:var(--bs-table-color);border-color:var(--bs-table-border-color)}.table-dark{--bs-table-color:#fff;--bs-table-bg:#212529;--bs-table-border-color:#4d5154;--bs-table-striped-bg:#2c3034;--bs-table-striped-color:#fff;--bs-table-active-bg:#373b3e;--bs-table-active-color:#fff;--bs-table-hover-bg:#323539;--bs-table-hover-color:#fff;color:var(--bs-table-color);border-color:var(--bs-table-border-color)}.table-responsive{overflow-x:auto;-webkit-overflow-scrolling:touch}@media (max-width:575.98px){.table-responsive-sm{overflow-x:auto;-webkit-overflow-scrolling:touch}}@media (max-width:767.98px){.table-responsive-md{overflow-x:auto;-webkit-overflow-scrolling:touch}}@media (max-width:991.98px){.table-responsive-lg{overflow-x:auto;-webkit-overflow-scrolling:touch}}@media (max-width:1199.98px){.table-responsive-xl{overflow-x:auto;-webkit-overflow-scrolling:touch}}@media (max-width:1399.98px){.table-responsive-xxl{overflow-x:auto;-webkit-overflow-scrolling:touch}}.form-label{margin-bottom:.5rem}.col-form-label{padding-top:calc(.375rem + var(--bs-border-width));padding-bottom:calc(.375rem + var(--bs-border-width));margin-bottom:0;font-size:inherit;line-height:1.5}.col-form-label-lg{padding-top:calc(.5rem + var(--bs-border-width));padding-bottom:calc(.5rem + var(--bs-border-width));font-size:1.25rem}.col-form-label-sm{padding-top:calc(.25rem + var(--bs-border-width));padding-bottom:calc(.25rem + var(--bs-border-width));font-size:.875rem}.form-text{margin-top:.25rem;font-size:.875em;color:var(--bs-secondary-color)}.form-control{display:block;width:100%;padding:.375rem .75rem;font-size:1rem;font-weight:400;line-height:1.5;color:var(--bs-body-color);-webkit-appearance:none;-moz-appearance:none;appearance:none;background-color:var(--bs-body-bg);background-clip:padding-box;border:var(--bs-border-width) solid var(--bs-border-color);border-radius:var(--bs-border-radius);transition:border-color .15s ease-in-out,box-shadow .15s ease-in-out}@media (prefers-reduced-motion:reduce){.form-control{transition:none}}.form-control[type=file]{overflow:hidden}.form-control[type=file]:not(:disabled):not([readonly]){cursor:pointer}.form-control:focus{color:var(--bs-body-color);background-color:var(--bs-body-bg);border-color:#86b7fe;outline:0;box-shadow:0 0 0 .25rem rgba(13,110,253,.25)}.form-control::-webkit-date-and-time-value{min-width:85px;height:1.5em;margin:0}.form-control::-webkit-datetime-edit{display:block;padding:0}.form-control::placeholder{color:var(--bs-secondary-color);opacity:1}.form-control:disabled{background-color:var(--bs-secondary-bg);opacity:1}.form-control::-webkit-file-upload-button{padding:.375rem .75rem;margin:-.375rem -.75rem;-webkit-margin-end:.75rem;margin-inline-end:.75rem;color:var(--bs-body-color);background-color:var(--bs-tertiary-bg);pointer-events:none;border-color:inherit;border-style:solid;border-width:0;border-inline-end-width:var(--bs-border-width);border-radius:0;-webkit-transition:color .15s ease-in-out,background-color .15s ease-in-out,border-color .15s ease-in-out,box-shadow .15s ease-in-out;transition:color .15s ease-in-out,background-color .15s ease-in-out,border-color .15s ease-in-out,box-shadow .15s ease-in-out}.form-control::file-selector-button{padding:.375rem .75rem;margin:-.375rem -.75rem;-webkit-margin-end:.75rem;margin-inline-end:.75rem;color:var(--bs-body-color);background-color:var(--bs-tertiary-bg);pointer-events:none;border-color:inherit;border-style:solid;border-width:0;border-inline-end-width:var(--bs-border-width);border-radius:0;transition:color .15s ease-in-out,background-color .15s ease-in-out,border-color .15s ease-in-out,box-shadow .15s ease-in-out}@media (prefers-reduced-motion:reduce){.form-control::-webkit-file-upload-button{-webkit-transition:none;transition:none}.form-control::file-selector-button{transition:none}}.form-control:hover:not(:disabled):not([readonly])::-webkit-file-upload-button{background-color:var(--bs-secondary-bg)}.form-control:hover:not(:disabled):not([readonly])::file-selector-button{background-color:var(--bs-secondary-bg)}.form-control-plaintext{display:block;width:100%;padding:.375rem 0;margin-bottom:0;line-height:1.5;color:var(--bs-body-color);background-color:transparent;border:solid transparent;border-width:var(--bs-border-width) 0}.form-control-plaintext:focus{outline:0}.form-control-plaintext.form-control-lg,.form-control-plaintext.form-control-sm{padding-right:0;padding-left:0}.form-control-sm{min-height:calc(1.5em + .5rem + calc(var(--bs-border-width) * 2));padding:.25rem .5rem;font-size:.875rem;border-radius:var(--bs-border-radius-sm)}.form-control-sm::-webkit-file-upload-button{padding:.25rem .5rem;margin:-.25rem -.5rem;-webkit-margin-end:.5rem;margin-inline-end:.5rem}.form-control-sm::file-selector-button{padding:.25rem .5rem;margin:-.25rem -.5rem;-webkit-margin-end:.5rem;margin-inline-end:.5rem}.form-control-lg{min-height:calc(1.5em + 1rem + calc(var(--bs-border-width) * 2));padding:.5rem 1rem;font-size:1.25rem;border-radius:var(--bs-border-radius-lg)}.form-control-lg::-webkit-file-upload-button{padding:.5rem 1rem;margin:-.5rem -1rem;-webkit-margin-end:1rem;margin-inline-end:1rem}.form-control-lg::file-selector-button{padding:.5rem 1rem;margin:-.5rem -1rem;-webkit-margin-end:1rem;margin-inline-end:1rem}textarea.form-control{min-height:calc(1.5em + .75rem + calc(var(--bs-border-width) * 2))}textarea.form-control-sm{min-height:calc(1.5em + .5rem + calc(var(--bs-border-width) * 2))}textarea.form-control-lg{min-height:calc(1.5em + 1rem + calc(var(--bs-border-width) * 2))}.form-control-color{width:3rem;height:calc(1.5em + .75rem + calc(var(--bs-border-width) * 2));padding:.375rem}.form-control-color:not(:disabled):not([readonly]){cursor:pointer}.form-control-color::-moz-color-swatch{border:0!important;border-radius:var(--bs-border-radius)}.form-control-color::-webkit-color-swatch{border:0!important;border-radius:var(--bs-border-radius)}.form-control-color.form-control-sm{height:calc(1.5em + .5rem + calc(var(--bs-border-width) * 2))}.form-control-color.form-control-lg{height:calc(1.5em + 1rem + calc(var(--bs-border-width) * 2))}.form-select{--bs-form-select-bg-img:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16'%3e%3cpath fill='none' stroke='%23343a40' stroke-linecap='round' stroke-linejoin='round' stroke-width='2' d='m2 5 6 6 6-6'/%3e%3c/svg%3e");display:block;width:100%;padding:.375rem 2.25rem .375rem .75rem;font-size:1rem;font-weight:400;line-height:1.5;color:var(--bs-body-color);-webkit-appearance:none;-moz-appearance:none;appearance:none;background-color:var(--bs-body-bg);background-image:var(--bs-form-select-bg-img),var(--bs-form-select-bg-icon,none);background-repeat:no-repeat;background-position:right .75rem center;background-size:16px 12px;border:var(--bs-border-width) solid var(--bs-border-color);border-radius:var(--bs-border-radius);transition:border-color .15s ease-in-out,box-shadow .15s ease-in-out}@media (prefers-reduced-motion:reduce){.form-select{transition:none}}.form-select:focus{border-color:#86b7fe;outline:0;box-shadow:0 0 0 .25rem rgba(13,110,253,.25)}.form-select[multiple],.form-select[size]:not([size="1"]){padding-right:.75rem;background-image:none}.form-select:disabled{background-color:var(--bs-secondary-bg)}.form-select:-moz-focusring{color:transparent;text-shadow:0 0 0 var(--bs-body-color)}.form-select-sm{padding-top:.25rem;padding-bottom:.25rem;padding-left:.5rem;font-size:.875rem;border-radius:var(--bs-border-radius-sm)}.form-select-lg{padding-top:.5rem;padding-bottom:.5rem;padding-left:1rem;font-size:1.25rem;border-radius:var(--bs-border-radius-lg)}[data-bs-theme=dark] .form-select{--bs-form-select-bg-img:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16'%3e%3cpath fill='none' stroke='%23dee2e6' stroke-linecap='round' stroke-linejoin='round' stroke-width='2' d='m2 5 6 6 6-6'/%3e%3c/svg%3e")}.form-check{display:block;min-height:1.5rem;padding-left:1.5em;margin-bottom:.125rem}.form-check .form-check-input{float:left;margin-left:-1.5em}.form-check-reverse{padding-right:1.5em;padding-left:0;text-align:right}.form-check-reverse .form-check-input{float:right;margin-right:-1.5em;margin-left:0}.form-check-input{--bs-form-check-bg:var(--bs-body-bg);flex-shrink:0;width:1em;height:1em;margin-top:.25em;vertical-align:top;-webkit-appearance:none;-moz-appearance:none;appearance:none;background-color:var(--bs-form-check-bg);background-image:var(--bs-form-check-bg-image);background-repeat:no-repeat;background-position:center;background-size:contain;border:var(--bs-border-width) solid var(--bs-border-color);-webkit-print-color-adjust:exact;color-adjust:exact;print-color-adjust:exact}.form-check-input[type=checkbox]{border-radius:.25em}.form-check-input[type=radio]{border-radius:50%}.form-check-input:active{filter:brightness(90%)}.form-check-input:focus{border-color:#86b7fe;outline:0;box-shadow:0 0 0 .25rem rgba(13,110,253,.25)}.form-check-input:checked{background-color:#0d6efd;border-color:#0d6efd}.form-check-input:checked[type=checkbox]{--bs-form-check-bg-image:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 20 20'%3e%3cpath fill='none' stroke='%23fff' stroke-linecap='round' stroke-linejoin='round' stroke-width='3' d='m6 10 3 3 6-6'/%3e%3c/svg%3e")}.form-check-input:checked[type=radio]{--bs-form-check-bg-image:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='-4 -4 8 8'%3e%3ccircle r='2' fill='%23fff'/%3e%3c/svg%3e")}.form-check-input[type=checkbox]:indeterminate{background-color:#0d6efd;border-color:#0d6efd;--bs-form-check-bg-image:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 20 20'%3e%3cpath fill='none' stroke='%23fff' stroke-linecap='round' stroke-linejoin='round' stroke-width='3' d='M6 10h8'/%3e%3c/svg%3e")}.form-check-input:disabled{pointer-events:none;filter:none;opacity:.5}.form-check-input:disabled~.form-check-label,.form-check-input[disabled]~.form-check-label{cursor:default;opacity:.5}.form-switch{padding-left:2.5em}.form-switch .form-check-input{--bs-form-switch-bg:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='-4 -4 8 8'%3e%3ccircle r='3' fill='rgba%280, 0, 0, 0.25%29'/%3e%3c/svg%3e");width:2em;margin-left:-2.5em;background-image:var(--bs-form-switch-bg);background-position:left center;border-radius:2em;transition:background-position .15s ease-in-out}@media (prefers-reduced-motion:reduce){.form-switch .form-check-input{transition:none}}.form-switch .form-check-input:focus{--bs-form-switch-bg:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='-4 -4 8 8'%3e%3ccircle r='3' fill='%2386b7fe'/%3e%3c/svg%3e")}.form-switch .form-check-input:checked{background-position:right center;--bs-form-switch-bg:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='-4 -4 8 8'%3e%3ccircle r='3' fill='%23fff'/%3e%3c/svg%3e")}.form-switch.form-check-reverse{padding-right:2.5em;padding-left:0}.form-switch.form-check-reverse .form-check-input{margin-right:-2.5em;margin-left:0}.form-check-inline{display:inline-block;margin-right:1rem}.btn-check{position:absolute;clip:rect(0,0,0,0);pointer-events:none}.btn-check:disabled+.btn,.btn-check[disabled]+.btn{pointer-events:none;filter:none;opacity:.65}[data-bs-theme=dark] .form-switch .form-check-input:not(:checked):not(:focus){--bs-form-switch-bg:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='-4 -4 8 8'%3e%3ccircle r='3' fill='rgba%28255, 255, 255, 0.25%29'/%3e%3c/svg%3e")}.form-range{width:100%;height:1.5rem;padding:0;-webkit-appearance:none;-moz-appearance:none;appearance:none;background-color:transparent}.form-range:focus{outline:0}.form-range:focus::-webkit-slider-thumb{box-shadow:0 0 0 1px #fff,0 0 0 .25rem rgba(13,110,253,.25)}.form-range:focus::-moz-range-thumb{box-shadow:0 0 0 1px #fff,0 0 0 .25rem rgba(13,110,253,.25)}.form-range::-moz-focus-outer{border:0}.form-range::-webkit-slider-thumb{width:1rem;height:1rem;margin-top:-.25rem;-webkit-appearance:none;appearance:none;background-color:#0d6efd;border:0;border-radius:1rem;-webkit-transition:background-color .15s ease-in-out,border-color .15s ease-in-out,box-shadow .15s ease-in-out;transition:background-color .15s ease-in-out,border-color .15s ease-in-out,box-shadow .15s ease-in-out}@media (prefers-reduced-motion:reduce){.form-range::-webkit-slider-thumb{-webkit-transition:none;transition:none}}.form-range::-webkit-slider-thumb:active{background-color:#b6d4fe}.form-range::-webkit-slider-runnable-track{width:100%;height:.5rem;color:transparent;cursor:pointer;background-color:var(--bs-secondary-bg);border-color:transparent;border-radius:1rem}.form-range::-moz-range-thumb{width:1rem;height:1rem;-moz-appearance:none;appearance:none;background-color:#0d6efd;border:0;border-radius:1rem;-moz-transition:background-color .15s ease-in-out,border-color .15s ease-in-out,box-shadow .15s ease-in-out;transition:background-color .15s ease-in-out,border-color .15s ease-in-out,box-shadow .15s ease-in-out}@media (prefers-reduced-motion:reduce){.form-range::-moz-range-thumb{-moz-transition:none;transition:none}}.form-range::-moz-range-thumb:active{background-color:#b6d4fe}.form-range::-moz-range-track{width:100%;height:.5rem;color:transparent;cursor:pointer;background-color:var(--bs-secondary-bg);border-color:transparent;border-radius:1rem}.form-range:disabled{pointer-events:none}.form-range:disabled::-webkit-slider-thumb{background-color:var(--bs-secondary-color)}.form-range:disabled::-moz-range-thumb{background-color:var(--bs-secondary-color)}.form-floating{position:relative}.form-floating>.form-control,.form-floating>.form-control-plaintext,.form-floating>.form-select{height:calc(3.5rem + calc(var(--bs-border-width) * 2));min-height:calc(3.5rem + calc(var(--bs-border-width) * 2));line-height:1.25}.form-floating>label{position:absolute;top:0;left:0;z-index:2;max-width:100%;height:100%;padding:1rem .75rem;overflow:hidden;color:rgba(var(--bs-body-color-rgb),.65);text-align:start;text-overflow:ellipsis;white-space:nowrap;pointer-events:none;border:var(--bs-border-width) solid transparent;transform-origin:0 0;transition:opacity .1s ease-in-out,transform .1s ease-in-out}@media (prefers-reduced-motion:reduce){.form-floating>label{transition:none}}.form-floating>.form-control,.form-floating>.form-control-plaintext{padding:1rem .75rem}.form-floating>.form-control-plaintext::placeholder,.form-floating>.form-control::placeholder{color:transparent}.form-floating>.form-control-plaintext:focus,.form-floating>.form-control-plaintext:not(:placeholder-shown),.form-floating>.form-control:focus,.form-floating>.form-control:not(:placeholder-shown){padding-top:1.625rem;padding-bottom:.625rem}.form-floating>.form-control-plaintext:-webkit-autofill,.form-floating>.form-control:-webkit-autofill{padding-top:1.625rem;padding-bottom:.625rem}.form-floating>.form-select{padding-top:1.625rem;padding-bottom:.625rem;padding-left:.75rem}.form-floating>.form-control-plaintext~label,.form-floating>.form-control:focus~label,.form-floating>.form-control:not(:placeholder-shown)~label,.form-floating>.form-select~label{transform:scale(.85) translateY(-.5rem) translateX(.15rem)}.form-floating>.form-control:-webkit-autofill~label{transform:scale(.85) translateY(-.5rem) translateX(.15rem)}.form-floating>textarea:focus~label::after,.form-floating>textarea:not(:placeholder-shown)~label::after{position:absolute;inset:1rem 0.375rem;z-index:-1;height:1.5em;content:"";background-color:var(--bs-body-bg);border-radius:var(--bs-border-radius)}.form-floating>textarea:disabled~label::after{background-color:var(--bs-secondary-bg)}.form-floating>.form-control-plaintext~label{border-width:var(--bs-border-width) 0}.form-floating>.form-control:disabled~label,.form-floating>:disabled~label{color:#6c757d}.input-group{position:relative;display:flex;flex-wrap:wrap;align-items:stretch;width:100%}.input-group>.form-control,.input-group>.form-floating,.input-group>.form-select{position:relative;flex:1 1 auto;width:1%;min-width:0}.input-group>.form-control:focus,.input-group>.form-floating:focus-within,.input-group>.form-select:focus{z-index:5}.input-group .btn{position:relative;z-index:2}.input-group .btn:focus{z-index:5}.input-group-text{display:flex;align-items:center;padding:.375rem .75rem;font-size:1rem;font-weight:400;line-height:1.5;color:var(--bs-body-color);text-align:center;white-space:nowrap;background-color:var(--bs-tertiary-bg);border:var(--bs-border-width) solid var(--bs-border-color);border-radius:var(--bs-border-radius)}.input-group-lg>.btn,.input-group-lg>.form-control,.input-group-lg>.form-select,.input-group-lg>.input-group-text{padding:.5rem 1rem;font-size:1.25rem;border-radius:var(--bs-border-radius-lg)}.input-group-sm>.btn,.input-group-sm>.form-control,.input-group-sm>.form-select,.input-group-sm>.input-group-text{padding:.25rem .5rem;font-size:.875rem;border-radius:var(--bs-border-radius-sm)}.input-group-lg>.form-select,.input-group-sm>.form-select{padding-right:3rem}.input-group:not(.has-validation)>.dropdown-toggle:nth-last-child(n+3),.input-group:not(.has-validation)>.form-floating:not(:last-child)>.form-control,.input-group:not(.has-validation)>.form-floating:not(:last-child)>.form-select,.input-group:not(.has-validation)>:not(:last-child):not(.dropdown-toggle):not(.dropdown-menu):not(.form-floating){border-top-right-radius:0;border-bottom-right-radius:0}.input-group.has-validation>.dropdown-toggle:nth-last-child(n+4),.input-group.has-validation>.form-floating:nth-last-child(n+3)>.form-control,.input-group.has-validation>.form-floating:nth-last-child(n+3)>.form-select,.input-group.has-validation>:nth-last-child(n+3):not(.dropdown-toggle):not(.dropdown-menu):not(.form-floating){border-top-right-radius:0;border-bottom-right-radius:0}.input-group>:not(:first-child):not(.dropdown-menu):not(.valid-tooltip):not(.valid-feedback):not(.invalid-tooltip):not(.invalid-feedback){margin-left:calc(-1 * var(--bs-border-width));border-top-left-radius:0;border-bottom-left-radius:0}.input-group>.form-floating:not(:first-child)>.form-control,.input-group>.form-floating:not(:first-child)>.form-select{border-top-left-radius:0;border-bottom-left-radius:0}.valid-feedback{display:none;width:100%;margin-top:.25rem;font-size:.875em;color:var(--bs-form-valid-color)}.valid-tooltip{position:absolute;top:100%;z-index:5;display:none;max-width:100%;padding:.25rem .5rem;margin-top:.1rem;font-size:.875rem;color:#fff;background-color:var(--bs-success);border-radius:var(--bs-border-radius)}.is-valid~.valid-feedback,.is-valid~.valid-tooltip,.was-validated :valid~.valid-feedback,.was-validated :valid~.valid-tooltip{display:block}.form-control.is-valid,.was-validated .form-control:valid{border-color:var(--bs-form-valid-border-color);padding-right:calc(1.5em + .75rem);background-image:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 8 8'%3e%3cpath fill='%23198754' d='M2.3 6.73.6 4.53c-.4-1.04.46-1.4 1.1-.8l1.1 1.4 3.4-3.8c.6-.63 1.6-.27 1.2.7l-4 4.6c-.43.5-.8.4-1.1.1'/%3e%3c/svg%3e");background-repeat:no-repeat;background-position:right calc(.375em + .1875rem) center;background-size:calc(.75em + .375rem) calc(.75em + .375rem)}.form-control.is-valid:focus,.was-validated .form-control:valid:focus{border-color:var(--bs-form-valid-border-color);box-shadow:0 0 0 .25rem rgba(var(--bs-success-rgb),.25)}.was-validated textarea.form-control:valid,textarea.form-control.is-valid{padding-right:calc(1.5em + .75rem);background-position:top calc(.375em + .1875rem) right calc(.375em + .1875rem)}.form-select.is-valid,.was-validated .form-select:valid{border-color:var(--bs-form-valid-border-color)}.form-select.is-valid:not([multiple]):not([size]),.form-select.is-valid:not([multiple])[size="1"],.was-validated .form-select:valid:not([multiple]):not([size]),.was-validated .form-select:valid:not([multiple])[size="1"]{--bs-form-select-bg-icon:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 8 8'%3e%3cpath fill='%23198754' d='M2.3 6.73.6 4.53c-.4-1.04.46-1.4 1.1-.8l1.1 1.4 3.4-3.8c.6-.63 1.6-.27 1.2.7l-4 4.6c-.43.5-.8.4-1.1.1'/%3e%3c/svg%3e");padding-right:4.125rem;background-position:right .75rem center,center right 2.25rem;background-size:16px 12px,calc(.75em + .375rem) calc(.75em + .375rem)}.form-select.is-valid:focus,.was-validated .form-select:valid:focus{border-color:var(--bs-form-valid-border-color);box-shadow:0 0 0 .25rem rgba(var(--bs-success-rgb),.25)}.form-control-color.is-valid,.was-validated .form-control-color:valid{width:calc(3rem + calc(1.5em + .75rem))}.form-check-input.is-valid,.was-validated .form-check-input:valid{border-color:var(--bs-form-valid-border-color)}.form-check-input.is-valid:checked,.was-validated .form-check-input:valid:checked{background-color:var(--bs-form-valid-color)}.form-check-input.is-valid:focus,.was-validated .form-check-input:valid:focus{box-shadow:0 0 0 .25rem rgba(var(--bs-success-rgb),.25)}.form-check-input.is-valid~.form-check-label,.was-validated .form-check-input:valid~.form-check-label{color:var(--bs-form-valid-color)}.form-check-inline .form-check-input~.valid-feedback{margin-left:.5em}.input-group>.form-control:not(:focus).is-valid,.input-group>.form-floating:not(:focus-within).is-valid,.input-group>.form-select:not(:focus).is-valid,.was-validated .input-group>.form-control:not(:focus):valid,.was-validated .input-group>.form-floating:not(:focus-within):valid,.was-validated .input-group>.form-select:not(:focus):valid{z-index:3}.invalid-feedback{display:none;width:100%;margin-top:.25rem;font-size:.875em;color:var(--bs-form-invalid-color)}.invalid-tooltip{position:absolute;top:100%;z-index:5;display:none;max-width:100%;padding:.25rem .5rem;margin-top:.1rem;font-size:.875rem;color:#fff;background-color:var(--bs-danger);border-radius:var(--bs-border-radius)}.is-invalid~.invalid-feedback,.is-invalid~.invalid-tooltip,.was-validated :invalid~.invalid-feedback,.was-validated :invalid~.invalid-tooltip{display:block}.form-control.is-invalid,.was-validated .form-control:invalid{border-color:var(--bs-form-invalid-border-color);padding-right:calc(1.5em + .75rem);background-image:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 12 12' width='12' height='12' fill='none' stroke='%23dc3545'%3e%3ccircle cx='6' cy='6' r='4.5'/%3e%3cpath stroke-linejoin='round' d='M5.8 3.6h.4L6 6.5z'/%3e%3ccircle cx='6' cy='8.2' r='.6' fill='%23dc3545' stroke='none'/%3e%3c/svg%3e");background-repeat:no-repeat;background-position:right calc(.375em + .1875rem) center;background-size:calc(.75em + .375rem) calc(.75em + .375rem)}.form-control.is-invalid:focus,.was-validated .form-control:invalid:focus{border-color:var(--bs-form-invalid-border-color);box-shadow:0 0 0 .25rem rgba(var(--bs-danger-rgb),.25)}.was-validated textarea.form-control:invalid,textarea.form-control.is-invalid{padding-right:calc(1.5em + .75rem);background-position:top calc(.375em + .1875rem) right calc(.375em + .1875rem)}.form-select.is-invalid,.was-validated .form-select:invalid{border-color:var(--bs-form-invalid-border-color)}.form-select.is-invalid:not([multiple]):not([size]),.form-select.is-invalid:not([multiple])[size="1"],.was-validated .form-select:invalid:not([multiple]):not([size]),.was-validated .form-select:invalid:not([multiple])[size="1"]{--bs-form-select-bg-icon:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 12 12' width='12' height='12' fill='none' stroke='%23dc3545'%3e%3ccircle cx='6' cy='6' r='4.5'/%3e%3cpath stroke-linejoin='round' d='M5.8 3.6h.4L6 6.5z'/%3e%3ccircle cx='6' cy='8.2' r='.6' fill='%23dc3545' stroke='none'/%3e%3c/svg%3e");padding-right:4.125rem;background-position:right .75rem center,center right 2.25rem;background-size:16px 12px,calc(.75em + .375rem) calc(.75em + .375rem)}.form-select.is-invalid:focus,.was-validated .form-select:invalid:focus{border-color:var(--bs-form-invalid-border-color);box-shadow:0 0 0 .25rem rgba(var(--bs-danger-rgb),.25)}.form-control-color.is-invalid,.was-validated .form-control-color:invalid{width:calc(3rem + calc(1.5em + .75rem))}.form-check-input.is-invalid,.was-validated .form-check-input:invalid{border-color:var(--bs-form-invalid-border-color)}.form-check-input.is-invalid:checked,.was-validated .form-check-input:invalid:checked{background-color:var(--bs-form-invalid-color)}.form-check-input.is-invalid:focus,.was-validated .form-check-input:invalid:focus{box-shadow:0 0 0 .25rem rgba(var(--bs-danger-rgb),.25)}.form-check-input.is-invalid~.form-check-label,.was-validated .form-check-input:invalid~.form-check-label{color:var(--bs-form-invalid-color)}.form-check-inline .form-check-input~.invalid-feedback{margin-left:.5em}.input-group>.form-control:not(:focus).is-invalid,.input-group>.form-floating:not(:focus-within).is-invalid,.input-group>.form-select:not(:focus).is-invalid,.was-validated .input-group>.form-control:not(:focus):invalid,.was-validated .input-group>.form-floating:not(:focus-within):invalid,.was-validated .input-group>.form-select:not(:focus):invalid{z-index:4}.btn{--bs-btn-padding-x:0.75rem;--bs-btn-padding-y:0.375rem;--bs-btn-font-family: ;--bs-btn-font-size:1rem;--bs-btn-font-weight:400;--bs-btn-line-height:1.5;--bs-btn-color:var(--bs-body-color);--bs-btn-bg:transparent;--bs-btn-border-width:var(--bs-border-width);--bs-btn-border-color:transparent;--bs-btn-border-radius:var(--bs-border-radius);--bs-btn-hover-border-color:transparent;--bs-btn-box-shadow:inset 0 1px 0 rgba(255, 255, 255, 0.15),0 1px 1px rgba(0, 0, 0, 0.075);--bs-btn-disabled-opacity:0.65;--bs-btn-focus-box-shadow:0 0 0 0.25rem rgba(var(--bs-btn-focus-shadow-rgb), .5);display:inline-block;padding:var(--bs-btn-padding-y) var(--bs-btn-padding-x);font-family:var(--bs-btn-font-family);font-size:var(--bs-btn-font-size);font-weight:var(--bs-btn-font-weight);line-height:var(--bs-btn-line-height);color:var(--bs-btn-color);text-align:center;text-decoration:none;vertical-align:middle;cursor:pointer;-webkit-user-select:none;-moz-user-select:none;user-select:none;border:var(--bs-btn-border-width) solid var(--bs-btn-border-color);border-radius:var(--bs-btn-border-radius);background-color:var(--bs-btn-bg);transition:color .15s ease-in-out,background-color .15s ease-in-out,border-color .15s ease-in-out,box-shadow .15s ease-in-out}@media (prefers-reduced-motion:reduce){.btn{transition:none}}.btn:hover{color:var(--bs-btn-hover-color);background-color:var(--bs-btn-hover-bg);border-color:var(--bs-btn-hover-border-color)}.btn-check+.btn:hover{color:var(--bs-btn-color);background-color:var(--bs-btn-bg);border-color:var(--bs-btn-border-color)}.btn:focus-visible{color:var(--bs-btn-hover-color);background-color:var(--bs-btn-hover-bg);border-color:var(--bs-btn-hover-border-color);outline:0;box-shadow:var(--bs-btn-focus-box-shadow)}.btn-check:focus-visible+.btn{border-color:var(--bs-btn-hover-border-color);outline:0;box-shadow:var(--bs-btn-focus-box-shadow)}.btn-check:checked+.btn,.btn.active,.btn.show,.btn:first-child:active,:not(.btn-check)+.btn:active{color:var(--bs-btn-active-color);background-color:var(--bs-btn-active-bg);border-color:var(--bs-btn-active-border-color)}.btn-check:checked+.btn:focus-visible,.btn.active:focus-visible,.btn.show:focus-visible,.btn:first-child:active:focus-visible,:not(.btn-check)+.btn:active:focus-visible{box-shadow:var(--bs-btn-focus-box-shadow)}.btn-check:checked:focus-visible+.btn{box-shadow:var(--bs-btn-focus-box-shadow)}.btn.disabled,.btn:disabled,fieldset:disabled .btn{color:var(--bs-btn-disabled-color);pointer-events:none;background-color:var(--bs-btn-disabled-bg);border-color:var(--bs-btn-disabled-border-color);opacity:var(--bs-btn-disabled-opacity)}.btn-primary{--bs-btn-color:#fff;--bs-btn-bg:#0d6efd;--bs-btn-border-color:#0d6efd;--bs-btn-hover-color:#fff;--bs-btn-hover-bg:#0b5ed7;--bs-btn-hover-border-color:#0a58ca;--bs-btn-focus-shadow-rgb:49,132,253;--bs-btn-active-color:#fff;--bs-btn-active-bg:#0a58ca;--bs-btn-active-border-color:#0a53be;--bs-btn-active-shadow:inset 0 3px 5px rgba(0, 0, 0, 0.125);--bs-btn-disabled-color:#fff;--bs-btn-disabled-bg:#0d6efd;--bs-btn-disabled-border-color:#0d6efd}.btn-secondary{--bs-btn-color:#fff;--bs-btn-bg:#6c757d;--bs-btn-border-color:#6c757d;--bs-btn-hover-color:#fff;--bs-btn-hover-bg:#5c636a;--bs-btn-hover-border-color:#565e64;--bs-btn-focus-shadow-rgb:130,138,145;--bs-btn-active-color:#fff;--bs-btn-active-bg:#565e64;--bs-btn-active-border-color:#51585e;--bs-btn-active-shadow:inset 0 3px 5px rgba(0, 0, 0, 0.125);--bs-btn-disabled-color:#fff;--bs-btn-disabled-bg:#6c757d;--bs-btn-disabled-border-color:#6c757d}.btn-success{--bs-btn-color:#fff;--bs-btn-bg:#198754;--bs-btn-border-color:#198754;--bs-btn-hover-color:#fff;--bs-btn-hover-bg:#157347;--bs-btn-hover-border-color:#146c43;--bs-btn-focus-shadow-rgb:60,153,110;--bs-btn-active-color:#fff;--bs-btn-active-bg:#146c43;--bs-btn-active-border-color:#13653f;--bs-btn-active-shadow:inset 0 3px 5px rgba(0, 0, 0, 0.125);--bs-btn-disabled-color:#fff;--bs-btn-disabled-bg:#198754;--bs-btn-disabled-border-color:#198754}.btn-info{--bs-btn-color:#000;--bs-btn-bg:#0dcaf0;--bs-btn-border-color:#0dcaf0;--bs-btn-hover-color:#000;--bs-btn-hover-bg:#31d2f2;--bs-btn-hover-border-color:#25cff2;--bs-btn-focus-shadow-rgb:11,172,204;--bs-btn-active-color:#000;--bs-btn-active-bg:#3dd5f3;--bs-btn-active-border-color:#25cff2;--bs-btn-active-shadow:inset 0 3px 5px rgba(0, 0, 0, 0.125);--bs-btn-disabled-color:#000;--bs-btn-disabled-bg:#0dcaf0;--bs-btn-disabled-border-color:#0dcaf0}.btn-warning{--bs-btn-color:#000;--bs-btn-bg:#ffc107;--bs-btn-border-color:#ffc107;--bs-btn-hover-color:#000;--bs-btn-hover-bg:#ffca2c;--bs-btn-hover-border-color:#ffc720;--bs-btn-focus-shadow-rgb:217,164,6;--bs-btn-active-color:#000;--bs-btn-active-bg:#ffcd39;--bs-btn-active-border-color:#ffc720;--bs-btn-active-shadow:inset 0 3px 5px rgba(0, 0, 0, 0.125);--bs-btn-disabled-color:#000;--bs-btn-disabled-bg:#ffc107;--bs-btn-disabled-border-color:#ffc107}.btn-danger{--bs-btn-color:#fff;--bs-btn-bg:#dc3545;--bs-btn-border-color:#dc3545;--bs-btn-hover-color:#fff;--bs-btn-hover-bg:#bb2d3b;--bs-btn-hover-border-color:#b02a37;--bs-btn-focus-shadow-rgb:225,83,97;--bs-btn-active-color:#fff;--bs-btn-active-bg:#b02a37;--bs-btn-active-border-color:#a52834;--bs-btn-active-shadow:inset 0 3px 5px rgba(0, 0, 0, 0.125);--bs-btn-disabled-color:#fff;--bs-btn-disabled-bg:#dc3545;--bs-btn-disabled-border-color:#dc3545}.btn-light{--bs-btn-color:#000;--bs-btn-bg:#f8f9fa;--bs-btn-border-color:#f8f9fa;--bs-btn-hover-color:#000;--bs-btn-hover-bg:#d3d4d5;--bs-btn-hover-border-color:#c6c7c8;--bs-btn-focus-shadow-rgb:211,212,213;--bs-btn-active-color:#000;--bs-btn-active-bg:#c6c7c8;--bs-btn-active-border-color:#babbbc;--bs-btn-active-shadow:inset 0 3px 5px rgba(0, 0, 0, 0.125);--bs-btn-disabled-color:#000;--bs-btn-disabled-bg:#f8f9fa;--bs-btn-disabled-border-color:#f8f9fa}.btn-dark{--bs-btn-color:#fff;--bs-btn-bg:#212529;--bs-btn-border-color:#212529;--bs-btn-hover-color:#fff;--bs-btn-hover-bg:#424649;--bs-btn-hover-border-color:#373b3e;--bs-btn-focus-shadow-rgb:66,70,73;--bs-btn-active-color:#fff;--bs-btn-active-bg:#4d5154;--bs-btn-active-border-color:#373b3e;--bs-btn-active-shadow:inset 0 3px 5px rgba(0, 0, 0, 0.125);--bs-btn-disabled-color:#fff;--bs-btn-disabled-bg:#212529;--bs-btn-disabled-border-color:#212529}.btn-outline-primary{--bs-btn-color:#0d6efd;--bs-btn-border-color:#0d6efd;--bs-btn-hover-color:#fff;--bs-btn-hover-bg:#0d6efd;--bs-btn-hover-border-color:#0d6efd;--bs-btn-focus-shadow-rgb:13,110,253;--bs-btn-active-color:#fff;--bs-btn-active-bg:#0d6efd;--bs-btn-active-border-color:#0d6efd;--bs-btn-active-shadow:inset 0 3px 5px rgba(0, 0, 0, 0.125);--bs-btn-disabled-color:#0d6efd;--bs-btn-disabled-bg:transparent;--bs-btn-disabled-border-color:#0d6efd;--bs-gradient:none}.btn-outline-secondary{--bs-btn-color:#6c757d;--bs-btn-border-color:#6c757d;--bs-btn-hover-color:#fff;--bs-btn-hover-bg:#6c757d;--bs-btn-hover-border-color:#6c757d;--bs-btn-focus-shadow-rgb:108,117,125;--bs-btn-active-color:#fff;--bs-btn-active-bg:#6c757d;--bs-btn-active-border-color:#6c757d;--bs-btn-active-shadow:inset 0 3px 5px rgba(0, 0, 0, 0.125);--bs-btn-disabled-color:#6c757d;--bs-btn-disabled-bg:transparent;--bs-btn-disabled-border-color:#6c757d;--bs-gradient:none}.btn-outline-success{--bs-btn-color:#198754;--bs-btn-border-color:#198754;--bs-btn-hover-color:#fff;--bs-btn-hover-bg:#198754;--bs-btn-hover-border-color:#198754;--bs-btn-focus-shadow-rgb:25,135,84;--bs-btn-active-color:#fff;--bs-btn-active-bg:#198754;--bs-btn-active-border-color:#198754;--bs-btn-active-shadow:inset 0 3px 5px rgba(0, 0, 0, 0.125);--bs-btn-disabled-color:#198754;--bs-btn-disabled-bg:transparent;--bs-btn-disabled-border-color:#198754;--bs-gradient:none}.btn-outline-info{--bs-btn-color:#0dcaf0;--bs-btn-border-color:#0dcaf0;--bs-btn-hover-color:#000;--bs-btn-hover-bg:#0dcaf0;--bs-btn-hover-border-color:#0dcaf0;--bs-btn-focus-shadow-rgb:13,202,240;--bs-btn-active-color:#000;--bs-btn-active-bg:#0dcaf0;--bs-btn-active-border-color:#0dcaf0;--bs-btn-active-shadow:inset 0 3px 5px rgba(0, 0, 0, 0.125);--bs-btn-disabled-color:#0dcaf0;--bs-btn-disabled-bg:transparent;--bs-btn-disabled-border-color:#0dcaf0;--bs-gradient:none}.btn-outline-warning{--bs-btn-color:#ffc107;--bs-btn-border-color:#ffc107;--bs-btn-hover-color:#000;--bs-btn-hover-bg:#ffc107;--bs-btn-hover-border-color:#ffc107;--bs-btn-focus-shadow-rgb:255,193,7;--bs-btn-active-color:#000;--bs-btn-active-bg:#ffc107;--bs-btn-active-border-color:#ffc107;--bs-btn-active-shadow:inset 0 3px 5px rgba(0, 0, 0, 0.125);--bs-btn-disabled-color:#ffc107;--bs-btn-disabled-bg:transparent;--bs-btn-disabled-border-color:#ffc107;--bs-gradient:none}.btn-outline-danger{--bs-btn-color:#dc3545;--bs-btn-border-color:#dc3545;--bs-btn-hover-color:#fff;--bs-btn-hover-bg:#dc3545;--bs-btn-hover-border-color:#dc3545;--bs-btn-focus-shadow-rgb:220,53,69;--bs-btn-active-color:#fff;--bs-btn-active-bg:#dc3545;--bs-btn-active-border-color:#dc3545;--bs-btn-active-shadow:inset 0 3px 5px rgba(0, 0, 0, 0.125);--bs-btn-disabled-color:#dc3545;--bs-btn-disabled-bg:transparent;--bs-btn-disabled-border-color:#dc3545;--bs-gradient:none}.btn-outline-light{--bs-btn-color:#f8f9fa;--bs-btn-border-color:#f8f9fa;--bs-btn-hover-color:#000;--bs-btn-hover-bg:#f8f9fa;--bs-btn-hover-border-color:#f8f9fa;--bs-btn-focus-shadow-rgb:248,249,250;--bs-btn-active-color:#000;--bs-btn-active-bg:#f8f9fa;--bs-btn-active-border-color:#f8f9fa;--bs-btn-active-shadow:inset 0 3px 5px rgba(0, 0, 0, 0.125);--bs-btn-disabled-color:#f8f9fa;--bs-btn-disabled-bg:transparent;--bs-btn-disabled-border-color:#f8f9fa;--bs-gradient:none}.btn-outline-dark{--bs-btn-color:#212529;--bs-btn-border-color:#212529;--bs-btn-hover-color:#fff;--bs-btn-hover-bg:#212529;--bs-btn-hover-border-color:#212529;--bs-btn-focus-shadow-rgb:33,37,41;--bs-btn-active-color:#fff;--bs-btn-active-bg:#212529;--bs-btn-active-border-color:#212529;--bs-btn-active-shadow:inset 0 3px 5px rgba(0, 0, 0, 0.125);--bs-btn-disabled-color:#212529;--bs-btn-disabled-bg:transparent;--bs-btn-disabled-border-color:#212529;--bs-gradient:none}.btn-link{--bs-btn-font-weight:400;--bs-btn-color:var(--bs-link-color);--bs-btn-bg:transparent;--bs-btn-border-color:transparent;--bs-btn-hover-color:var(--bs-link-hover-color);--bs-btn-hover-border-color:transparent;--bs-btn-active-color:var(--bs-link-hover-color);--bs-btn-active-border-color:transparent;--bs-btn-disabled-color:#6c757d;--bs-btn-disabled-border-color:transparent;--bs-btn-box-shadow:0 0 0 #000;--bs-btn-focus-shadow-rgb:49,132,253;text-decoration:underline}.btn-link:focus-visible{color:var(--bs-btn-color)}.btn-link:hover{color:var(--bs-btn-hover-color)}.btn-group-lg>.btn,.btn-lg{--bs-btn-padding-y:0.5rem;--bs-btn-padding-x:1rem;--bs-btn-font-size:1.25rem;--bs-btn-border-radius:var(--bs-border-radius-lg)}.btn-group-sm>.btn,.btn-sm{--bs-btn-padding-y:0.25rem;--bs-btn-padding-x:0.5rem;--bs-btn-font-size:0.875rem;--bs-btn-border-radius:var(--bs-border-radius-sm)}.fade{transition:opacity .15s linear}@media (prefers-reduced-motion:reduce){.fade{transition:none}}.fade:not(.show){opacity:0}.collapse:not(.show){display:none}.collapsing{height:0;overflow:hidden;transition:height .35s ease}@media (prefers-reduced-motion:reduce){.collapsing{transition:none}}.collapsing.collapse-horizontal{width:0;height:auto;transition:width .35s ease}@media (prefers-reduced-motion:reduce){.collapsing.collapse-horizontal{transition:none}}.dropdown,.dropdown-center,.dropend,.dropstart,.dropup,.dropup-center{position:relative}.dropdown-toggle{white-space:nowrap}.dropdown-toggle::after{display:inline-block;margin-left:.255em;vertical-align:.255em;content:"";border-top:.3em solid;border-right:.3em solid transparent;border-bottom:0;border-left:.3em solid transparent}.dropdown-toggle:empty::after{margin-left:0}.dropdown-menu{--bs-dropdown-zindex:1000;--bs-dropdown-min-width:10rem;--bs-dropdown-padding-x:0;--bs-dropdown-padding-y:0.5rem;--bs-dropdown-spacer:0.125rem;--bs-dropdown-font-size:1rem;--bs-dropdown-color:var(--bs-body-color);--bs-dropdown-bg:var(--bs-body-bg);--bs-dropdown-border-color:var(--bs-border-color-translucent);--bs-dropdown-border-radius:var(--bs-border-radius);--bs-dropdown-border-width:var(--bs-border-width);--bs-dropdown-inner-border-radius:calc(var(--bs-border-radius) - var(--bs-border-width));--bs-dropdown-divider-bg:var(--bs-border-color-translucent);--bs-dropdown-divider-margin-y:0.5rem;--bs-dropdown-box-shadow:var(--bs-box-shadow);--bs-dropdown-link-color:var(--bs-body-color);--bs-dropdown-link-hover-color:var(--bs-body-color);--bs-dropdown-link-hover-bg:var(--bs-tertiary-bg);--bs-dropdown-link-active-color:#fff;--bs-dropdown-link-active-bg:#0d6efd;--bs-dropdown-link-disabled-color:var(--bs-tertiary-color);--bs-dropdown-item-padding-x:1rem;--bs-dropdown-item-padding-y:0.25rem;--bs-dropdown-header-color:#6c757d;--bs-dropdown-header-padding-x:1rem;--bs-dropdown-header-padding-y:0.5rem;position:absolute;z-index:var(--bs-dropdown-zindex);display:none;min-width:var(--bs-dropdown-min-width);padding:var(--bs-dropdown-padding-y) var(--bs-dropdown-padding-x);margin:0;font-size:var(--bs-dropdown-font-size);color:var(--bs-dropdown-color);text-align:left;list-style:none;background-color:var(--bs-dropdown-bg);background-clip:padding-box;border:var(--bs-dropdown-border-width) solid var(--bs-dropdown-border-color);border-radius:var(--bs-dropdown-border-radius)}.dropdown-menu[data-bs-popper]{top:100%;left:0;margin-top:var(--bs-dropdown-spacer)}.dropdown-menu-start{--bs-position:start}.dropdown-menu-start[data-bs-popper]{right:auto;left:0}.dropdown-menu-end{--bs-position:end}.dropdown-menu-end[data-bs-popper]{right:0;left:auto}@media (min-width:576px){.dropdown-menu-sm-start{--bs-position:start}.dropdown-menu-sm-start[data-bs-popper]{right:auto;left:0}.dropdown-menu-sm-end{--bs-position:end}.dropdown-menu-sm-end[data-bs-popper]{right:0;left:auto}}@media (min-width:768px){.dropdown-menu-md-start{--bs-position:start}.dropdown-menu-md-start[data-bs-popper]{right:auto;left:0}.dropdown-menu-md-end{--bs-position:end}.dropdown-menu-md-end[data-bs-popper]{right:0;left:auto}}@media (min-width:992px){.dropdown-menu-lg-start{--bs-position:start}.dropdown-menu-lg-start[data-bs-popper]{right:auto;left:0}.dropdown-menu-lg-end{--bs-position:end}.dropdown-menu-lg-end[data-bs-popper]{right:0;left:auto}}@media (min-width:1200px){.dropdown-menu-xl-start{--bs-position:start}.dropdown-menu-xl-start[data-bs-popper]{right:auto;left:0}.dropdown-menu-xl-end{--bs-position:end}.dropdown-menu-xl-end[data-bs-popper]{right:0;left:auto}}@media (min-width:1400px){.dropdown-menu-xxl-start{--bs-position:start}.dropdown-menu-xxl-start[data-bs-popper]{right:auto;left:0}.dropdown-menu-xxl-end{--bs-position:end}.dropdown-menu-xxl-end[data-bs-popper]{right:0;left:auto}}.dropup .dropdown-menu[data-bs-popper]{top:auto;bottom:100%;margin-top:0;margin-bottom:var(--bs-dropdown-spacer)}.dropup .dropdown-toggle::after{display:inline-block;margin-left:.255em;vertical-align:.255em;content:"";border-top:0;border-right:.3em solid transparent;border-bottom:.3em solid;border-left:.3em solid transparent}.dropup .dropdown-toggle:empty::after{margin-left:0}.dropend .dropdown-menu[data-bs-popper]{top:0;right:auto;left:100%;margin-top:0;margin-left:var(--bs-dropdown-spacer)}.dropend .dropdown-toggle::after{display:inline-block;margin-left:.255em;vertical-align:.255em;content:"";border-top:.3em solid transparent;border-right:0;border-bottom:.3em solid transparent;border-left:.3em solid}.dropend .dropdown-toggle:empty::after{margin-left:0}.dropend .dropdown-toggle::after{vertical-align:0}.dropstart .dropdown-menu[data-bs-popper]{top:0;right:100%;left:auto;margin-top:0;margin-right:var(--bs-dropdown-spacer)}.dropstart .dropdown-toggle::after{display:inline-block;margin-left:.255em;vertical-align:.255em;content:""}.dropstart .dropdown-toggle::after{display:none}.dropstart .dropdown-toggle::before{display:inline-block;margin-right:.255em;vertical-align:.255em;content:"";border-top:.3em solid transparent;border-right:.3em solid;border-bottom:.3em solid transparent}.dropstart .dropdown-toggle:empty::after{margin-left:0}.dropstart .dropdown-toggle::before{vertical-align:0}.dropdown-divider{height:0;margin:var(--bs-dropdown-divider-margin-y) 0;overflow:hidden;border-top:1px solid var(--bs-dropdown-divider-bg);opacity:1}.dropdown-item{display:block;width:100%;padding:var(--bs-dropdown-item-padding-y) var(--bs-dropdown-item-padding-x);clear:both;font-weight:400;color:var(--bs-dropdown-link-color);text-align:inherit;text-decoration:none;white-space:nowrap;background-color:transparent;border:0;border-radius:var(--bs-dropdown-item-border-radius,0)}.dropdown-item:focus,.dropdown-item:hover{color:var(--bs-dropdown-link-hover-color);background-color:var(--bs-dropdown-link-hover-bg)}.dropdown-item.active,.dropdown-item:active{color:var(--bs-dropdown-link-active-color);text-decoration:none;background-color:var(--bs-dropdown-link-active-bg)}.dropdown-item.disabled,.dropdown-item:disabled{color:var(--bs-dropdown-link-disabled-color);pointer-events:none;background-color:transparent}.dropdown-menu.show{display:block}.dropdown-header{display:block;padding:var(--bs-dropdown-header-padding-y) var(--bs-dropdown-header-padding-x);margin-bottom:0;font-size:.875rem;color:var(--bs-dropdown-header-color);white-space:nowrap}.dropdown-item-text{display:block;padding:var(--bs-dropdown-item-padding-y) var(--bs-dropdown-item-padding-x);color:var(--bs-dropdown-link-color)}.dropdown-menu-dark{--bs-dropdown-color:#dee2e6;--bs-dropdown-bg:#343a40;--bs-dropdown-border-color:var(--bs-border-color-translucent);--bs-dropdown-box-shadow: ;--bs-dropdown-link-color:#dee2e6;--bs-dropdown-link-hover-color:#fff;--bs-dropdown-divider-bg:var(--bs-border-color-translucent);--bs-dropdown-link-hover-bg:rgba(255, 255, 255, 0.15);--bs-dropdown-link-active-color:#fff;--bs-dropdown-link-active-bg:#0d6efd;--bs-dropdown-link-disabled-color:#adb5bd;--bs-dropdown-header-color:#adb5bd}.btn-group,.btn-group-vertical{position:relative;display:inline-flex;vertical-align:middle}.btn-group-vertical>.btn,.btn-group>.btn{position:relative;flex:1 1 auto}.btn-group-vertical>.btn-check:checked+.btn,.btn-group-vertical>.btn-check:focus+.btn,.btn-group-vertical>.btn.active,.btn-group-vertical>.btn:active,.btn-group-vertical>.btn:focus,.btn-group-vertical>.btn:hover,.btn-group>.btn-check:checked+.btn,.btn-group>.btn-check:focus+.btn,.btn-group>.btn.active,.btn-group>.btn:active,.btn-group>.btn:focus,.btn-group>.btn:hover{z-index:1}.btn-toolbar{display:flex;flex-wrap:wrap;justify-content:flex-start}.btn-toolbar .input-group{width:auto}.btn-group{border-radius:var(--bs-border-radius)}.btn-group>.btn-group:not(:first-child),.btn-group>:not(.btn-check:first-child)+.btn{margin-left:calc(-1 * var(--bs-border-width))}.btn-group>.btn-group:not(:last-child)>.btn,.btn-group>.btn.dropdown-toggle-split:first-child,.btn-group>.btn:not(:last-child):not(.dropdown-toggle){border-top-right-radius:0;border-bottom-right-radius:0}.btn-group>.btn-group:not(:first-child)>.btn,.btn-group>.btn:nth-child(n+3),.btn-group>:not(.btn-check)+.btn{border-top-left-radius:0;border-bottom-left-radius:0}.dropdown-toggle-split{padding-right:.5625rem;padding-left:.5625rem}.dropdown-toggle-split::after,.dropend .dropdown-toggle-split::after,.dropup .dropdown-toggle-split::after{margin-left:0}.dropstart .dropdown-toggle-split::before{margin-right:0}.btn-group-sm>.btn+.dropdown-toggle-split,.btn-sm+.dropdown-toggle-split{padding-right:.375rem;padding-left:.375rem}.btn-group-lg>.btn+.dropdown-toggle-split,.btn-lg+.dropdown-toggle-split{padding-right:.75rem;padding-left:.75rem}.btn-group-vertical{flex-direction:column;align-items:flex-start;justify-content:center}.btn-group-vertical>.btn,.btn-group-vertical>.btn-group{width:100%}.btn-group-vertical>.btn-group:not(:first-child),.btn-group-vertical>.btn:not(:first-child){margin-top:calc(-1 * var(--bs-border-width))}.btn-group-vertical>.btn-group:not(:last-child)>.btn,.btn-group-vertical>.btn:not(:last-child):not(.dropdown-toggle){border-bottom-right-radius:0;border-bottom-left-radius:0}.btn-group-vertical>.btn-group:not(:first-child)>.btn,.btn-group-vertical>.btn:nth-child(n+3),.btn-group-vertical>:not(.btn-check)+.btn{border-top-left-radius:0;border-top-right-radius:0}.nav{--bs-nav-link-padding-x:1rem;--bs-nav-link-padding-y:0.5rem;--bs-nav-link-font-weight: ;--bs-nav-link-color:var(--bs-link-color);--bs-nav-link-hover-color:var(--bs-link-hover-color);--bs-nav-link-disabled-color:var(--bs-secondary-color);display:flex;flex-wrap:wrap;padding-left:0;margin-bottom:0;list-style:none}.nav-link{display:block;padding:var(--bs-nav-link-padding-y) var(--bs-nav-link-padding-x);font-size:var(--bs-nav-link-font-size);font-weight:var(--bs-nav-link-font-weight);color:var(--bs-nav-link-color);text-decoration:none;background:0 0;border:0;transition:color .15s ease-in-out,background-color .15s ease-in-out,border-color .15s ease-in-out}@media (prefers-reduced-motion:reduce){.nav-link{transition:none}}.nav-link:focus,.nav-link:hover{color:var(--bs-nav-link-hover-color)}.nav-link:focus-visible{outline:0;box-shadow:0 0 0 .25rem rgba(13,110,253,.25)}.nav-link.disabled,.nav-link:disabled{color:var(--bs-nav-link-disabled-color);pointer-events:none;cursor:default}.nav-tabs{--bs-nav-tabs-border-width:var(--bs-border-width);--bs-nav-tabs-border-color:var(--bs-border-color);--bs-nav-tabs-border-radius:var(--bs-border-radius);--bs-nav-tabs-link-hover-border-color:var(--bs-secondary-bg) var(--bs-secondary-bg) var(--bs-border-color);--bs-nav-tabs-link-active-color:var(--bs-emphasis-color);--bs-nav-tabs-link-active-bg:var(--bs-body-bg);--bs-nav-tabs-link-active-border-color:var(--bs-border-color) var(--bs-border-color) var(--bs-body-bg);border-bottom:var(--bs-nav-tabs-border-width) solid var(--bs-nav-tabs-border-color)}.nav-tabs .nav-link{margin-bottom:calc(-1 * var(--bs-nav-tabs-border-width));border:var(--bs-nav-tabs-border-width) solid transparent;border-top-left-radius:var(--bs-nav-tabs-border-radius);border-top-right-radius:var(--bs-nav-tabs-border-radius)}.nav-tabs .nav-link:focus,.nav-tabs .nav-link:hover{isolation:isolate;border-color:var(--bs-nav-tabs-link-hover-border-color)}.nav-tabs .nav-item.show .nav-link,.nav-tabs .nav-link.active{color:var(--bs-nav-tabs-link-active-color);background-color:var(--bs-nav-tabs-link-active-bg);border-color:var(--bs-nav-tabs-link-active-border-color)}.nav-tabs .dropdown-menu{margin-top:calc(-1 * var(--bs-nav-tabs-border-width));border-top-left-radius:0;border-top-right-radius:0}.nav-pills{--bs-nav-pills-border-radius:var(--bs-border-radius);--bs-nav-pills-link-active-color:#fff;--bs-nav-pills-link-active-bg:#0d6efd}.nav-pills .nav-link{border-radius:var(--bs-nav-pills-border-radius)}.nav-pills .nav-link.active,.nav-pills .show>.nav-link{color:var(--bs-nav-pills-link-active-color);background-color:var(--bs-nav-pills-link-active-bg)}.nav-underline{--bs-nav-underline-gap:1rem;--bs-nav-underline-border-width:0.125rem;--bs-nav-underline-link-active-color:var(--bs-emphasis-color);gap:var(--bs-nav-underline-gap)}.nav-underline .nav-link{padding-right:0;padding-left:0;border-bottom:var(--bs-nav-underline-border-width) solid transparent}.nav-underline .nav-link:focus,.nav-underline .nav-link:hover{border-bottom-color:currentcolor}.nav-underline .nav-link.active,.nav-underline .show>.nav-link{font-weight:700;color:var(--bs-nav-underline-link-active-color);border-bottom-color:currentcolor}.nav-fill .nav-item,.nav-fill>.nav-link{flex:1 1 auto;text-align:center}.nav-justified .nav-item,.nav-justified>.nav-link{flex-grow:1;flex-basis:0;text-align:center}.nav-fill .nav-item .nav-link,.nav-justified .nav-item .nav-link{width:100%}.tab-content>.tab-pane{display:none}.tab-content>.active{display:block}.navbar{--bs-navbar-padding-x:0;--bs-navbar-padding-y:0.5rem;--bs-navbar-color:rgba(var(--bs-emphasis-color-rgb), 0.65);--bs-navbar-hover-color:rgba(var(--bs-emphasis-color-rgb), 0.8);--bs-navbar-disabled-color:rgba(var(--bs-emphasis-color-rgb), 0.3);--bs-navbar-active-color:rgba(var(--bs-emphasis-color-rgb), 1);--bs-navbar-brand-padding-y:0.3125rem;--bs-navbar-brand-margin-end:1rem;--bs-navbar-brand-font-size:1.25rem;--bs-navbar-brand-color:rgba(var(--bs-emphasis-color-rgb), 1);--bs-navbar-brand-hover-color:rgba(var(--bs-emphasis-color-rgb), 1);--bs-navbar-nav-link-padding-x:0.5rem;--bs-navbar-toggler-padding-y:0.25rem;--bs-navbar-toggler-padding-x:0.75rem;--bs-navbar-toggler-font-size:1.25rem;--bs-navbar-toggler-icon-bg:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 30 30'%3e%3cpath stroke='rgba%2833, 37, 41, 0.75%29' stroke-linecap='round' stroke-miterlimit='10' stroke-width='2' d='M4 7h22M4 15h22M4 23h22'/%3e%3c/svg%3e");--bs-navbar-toggler-border-color:rgba(var(--bs-emphasis-color-rgb), 0.15);--bs-navbar-toggler-border-radius:var(--bs-border-radius);--bs-navbar-toggler-focus-width:0.25rem;--bs-navbar-toggler-transition:box-shadow 0.15s ease-in-out;position:relative;display:flex;flex-wrap:wrap;align-items:center;justify-content:space-between;padding:var(--bs-navbar-padding-y) var(--bs-navbar-padding-x)}.navbar>.container,.navbar>.container-fluid,.navbar>.container-lg,.navbar>.container-md,.navbar>.container-sm,.navbar>.container-xl,.navbar>.container-xxl{display:flex;flex-wrap:inherit;align-items:center;justify-content:space-between}.navbar-brand{padding-top:var(--bs-navbar-brand-padding-y);padding-bottom:var(--bs-navbar-brand-padding-y);margin-right:var(--bs-navbar-brand-margin-end);font-size:var(--bs-navbar-brand-font-size);color:var(--bs-navbar-brand-color);text-decoration:none;white-space:nowrap}.navbar-brand:focus,.navbar-brand:hover{color:var(--bs-navbar-brand-hover-color)}.navbar-nav{--bs-nav-link-padding-x:0;--bs-nav-link-padding-y:0.5rem;--bs-nav-link-font-weight: ;--bs-nav-link-color:var(--bs-navbar-color);--bs-nav-link-hover-color:var(--bs-navbar-hover-color);--bs-nav-link-disabled-color:var(--bs-navbar-disabled-color);display:flex;flex-direction:column;padding-left:0;margin-bottom:0;list-style:none}.navbar-nav .nav-link.active,.navbar-nav .nav-link.show{color:var(--bs-navbar-active-color)}.navbar-nav .dropdown-menu{position:static}.navbar-text{padding-top:.5rem;padding-bottom:.5rem;color:var(--bs-navbar-color)}.navbar-text a,.navbar-text a:focus,.navbar-text a:hover{color:var(--bs-navbar-active-color)}.navbar-collapse{flex-grow:1;flex-basis:100%;align-items:center}.navbar-toggler{padding:var(--bs-navbar-toggler-padding-y) var(--bs-navbar-toggler-padding-x);font-size:var(--bs-navbar-toggler-font-size);line-height:1;color:var(--bs-navbar-color);background-color:transparent;border:var(--bs-border-width) solid var(--bs-navbar-toggler-border-color);border-radius:var(--bs-navbar-toggler-border-radius);transition:var(--bs-navbar-toggler-transition)}@media (prefers-reduced-motion:reduce){.navbar-toggler{transition:none}}.navbar-toggler:hover{text-decoration:none}.navbar-toggler:focus{text-decoration:none;outline:0;box-shadow:0 0 0 var(--bs-navbar-toggler-focus-width)}.navbar-toggler-icon{display:inline-block;width:1.5em;height:1.5em;vertical-align:middle;background-image:var(--bs-navbar-toggler-icon-bg);background-repeat:no-repeat;background-position:center;background-size:100%}.navbar-nav-scroll{max-height:var(--bs-scroll-height,75vh);overflow-y:auto}@media (min-width:576px){.navbar-expand-sm{flex-wrap:nowrap;justify-content:flex-start}.navbar-expand-sm .navbar-nav{flex-direction:row}.navbar-expand-sm .navbar-nav .dropdown-menu{position:absolute}.navbar-expand-sm .navbar-nav .nav-link{padding-right:var(--bs-navbar-nav-link-padding-x);padding-left:var(--bs-navbar-nav-link-padding-x)}.navbar-expand-sm .navbar-nav-scroll{overflow:visible}.navbar-expand-sm .navbar-collapse{display:flex!important;flex-basis:auto}.navbar-expand-sm .navbar-toggler{display:none}.navbar-expand-sm .offcanvas{position:static;z-index:auto;flex-grow:1;width:auto!important;height:auto!important;visibility:visible!important;background-color:transparent!important;border:0!important;transform:none!important;transition:none}.navbar-expand-sm .offcanvas .offcanvas-header{display:none}.navbar-expand-sm .offcanvas .offcanvas-body{display:flex;flex-grow:0;padding:0;overflow-y:visible}}@media (min-width:768px){.navbar-expand-md{flex-wrap:nowrap;justify-content:flex-start}.navbar-expand-md .navbar-nav{flex-direction:row}.navbar-expand-md .navbar-nav .dropdown-menu{position:absolute}.navbar-expand-md .navbar-nav .nav-link{padding-right:var(--bs-navbar-nav-link-padding-x);padding-left:var(--bs-navbar-nav-link-padding-x)}.navbar-expand-md .navbar-nav-scroll{overflow:visible}.navbar-expand-md .navbar-collapse{display:flex!important;flex-basis:auto}.navbar-expand-md .navbar-toggler{display:none}.navbar-expand-md .offcanvas{position:static;z-index:auto;flex-grow:1;width:auto!important;height:auto!important;visibility:visible!important;background-color:transparent!important;border:0!important;transform:none!important;transition:none}.navbar-expand-md .offcanvas .offcanvas-header{display:none}.navbar-expand-md .offcanvas .offcanvas-body{display:flex;flex-grow:0;padding:0;overflow-y:visible}}@media (min-width:992px){.navbar-expand-lg{flex-wrap:nowrap;justify-content:flex-start}.navbar-expand-lg .navbar-nav{flex-direction:row}.navbar-expand-lg .navbar-nav .dropdown-menu{position:absolute}.navbar-expand-lg .navbar-nav .nav-link{padding-right:var(--bs-navbar-nav-link-padding-x);padding-left:var(--bs-navbar-nav-link-padding-x)}.navbar-expand-lg .navbar-nav-scroll{overflow:visible}.navbar-expand-lg .navbar-collapse{display:flex!important;flex-basis:auto}.navbar-expand-lg .navbar-toggler{display:none}.navbar-expand-lg .offcanvas{position:static;z-index:auto;flex-grow:1;width:auto!important;height:auto!important;visibility:visible!important;background-color:transparent!important;border:0!important;transform:none!important;transition:none}.navbar-expand-lg .offcanvas .offcanvas-header{display:none}.navbar-expand-lg .offcanvas .offcanvas-body{display:flex;flex-grow:0;padding:0;overflow-y:visible}}@media (min-width:1200px){.navbar-expand-xl{flex-wrap:nowrap;justify-content:flex-start}.navbar-expand-xl .navbar-nav{flex-direction:row}.navbar-expand-xl .navbar-nav .dropdown-menu{position:absolute}.navbar-expand-xl .navbar-nav .nav-link{padding-right:var(--bs-navbar-nav-link-padding-x);padding-left:var(--bs-navbar-nav-link-padding-x)}.navbar-expand-xl .navbar-nav-scroll{overflow:visible}.navbar-expand-xl .navbar-collapse{display:flex!important;flex-basis:auto}.navbar-expand-xl .navbar-toggler{display:none}.navbar-expand-xl .offcanvas{position:static;z-index:auto;flex-grow:1;width:auto!important;height:auto!important;visibility:visible!important;background-color:transparent!important;border:0!important;transform:none!important;transition:none}.navbar-expand-xl .offcanvas .offcanvas-header{display:none}.navbar-expand-xl .offcanvas .offcanvas-body{display:flex;flex-grow:0;padding:0;overflow-y:visible}}@media (min-width:1400px){.navbar-expand-xxl{flex-wrap:nowrap;justify-content:flex-start}.navbar-expand-xxl .navbar-nav{flex-direction:row}.navbar-expand-xxl .navbar-nav .dropdown-menu{position:absolute}.navbar-expand-xxl .navbar-nav .nav-link{padding-right:var(--bs-navbar-nav-link-padding-x);padding-left:var(--bs-navbar-nav-link-padding-x)}.navbar-expand-xxl .navbar-nav-scroll{overflow:visible}.navbar-expand-xxl .navbar-collapse{display:flex!important;flex-basis:auto}.navbar-expand-xxl .navbar-toggler{display:none}.navbar-expand-xxl .offcanvas{position:static;z-index:auto;flex-grow:1;width:auto!important;height:auto!important;visibility:visible!important;background-color:transparent!important;border:0!important;transform:none!important;transition:none}.navbar-expand-xxl .offcanvas .offcanvas-header{display:none}.navbar-expand-xxl .offcanvas .offcanvas-body{display:flex;flex-grow:0;padding:0;overflow-y:visible}}.navbar-expand{flex-wrap:nowrap;justify-content:flex-start}.navbar-expand .navbar-nav{flex-direction:row}.navbar-expand .navbar-nav .dropdown-menu{position:absolute}.navbar-expand .navbar-nav .nav-link{padding-right:var(--bs-navbar-nav-link-padding-x);padding-left:var(--bs-navbar-nav-link-padding-x)}.navbar-expand .navbar-nav-scroll{overflow:visible}.navbar-expand .navbar-collapse{display:flex!important;flex-basis:auto}.navbar-expand .navbar-toggler{display:none}.navbar-expand .offcanvas{position:static;z-index:auto;flex-grow:1;width:auto!important;height:auto!important;visibility:visible!important;background-color:transparent!important;border:0!important;transform:none!important;transition:none}.navbar-expand .offcanvas .offcanvas-header{display:none}.navbar-expand .offcanvas .offcanvas-body{display:flex;flex-grow:0;padding:0;overflow-y:visible}.navbar-dark,.navbar[data-bs-theme=dark]{--bs-navbar-color:rgba(255, 255, 255, 0.55);--bs-navbar-hover-color:rgba(255, 255, 255, 0.75);--bs-navbar-disabled-color:rgba(255, 255, 255, 0.25);--bs-navbar-active-color:#fff;--bs-navbar-brand-color:#fff;--bs-navbar-brand-hover-color:#fff;--bs-navbar-toggler-border-color:rgba(255, 255, 255, 0.1);--bs-navbar-toggler-icon-bg:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 30 30'%3e%3cpath stroke='rgba%28255, 255, 255, 0.55%29' stroke-linecap='round' stroke-miterlimit='10' stroke-width='2' d='M4 7h22M4 15h22M4 23h22'/%3e%3c/svg%3e")}[data-bs-theme=dark] .navbar-toggler-icon{--bs-navbar-toggler-icon-bg:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 30 30'%3e%3cpath stroke='rgba%28255, 255, 255, 0.55%29' stroke-linecap='round' stroke-miterlimit='10' stroke-width='2' d='M4 7h22M4 15h22M4 23h22'/%3e%3c/svg%3e")}.card{--bs-card-spacer-y:1rem;--bs-card-spacer-x:1rem;--bs-card-title-spacer-y:0.5rem;--bs-card-title-color: ;--bs-card-subtitle-color: ;--bs-card-border-width:var(--bs-border-width);--bs-card-border-color:var(--bs-border-color-translucent);--bs-card-border-radius:var(--bs-border-radius);--bs-card-box-shadow: ;--bs-card-inner-border-radius:calc(var(--bs-border-radius) - (var(--bs-border-width)));--bs-card-cap-padding-y:0.5rem;--bs-card-cap-padding-x:1rem;--bs-card-cap-bg:rgba(var(--bs-body-color-rgb), 0.03);--bs-card-cap-color: ;--bs-card-height: ;--bs-card-color: ;--bs-card-bg:var(--bs-body-bg);--bs-card-img-overlay-padding:1rem;--bs-card-group-margin:0.75rem;position:relative;display:flex;flex-direction:column;min-width:0;height:var(--bs-card-height);color:var(--bs-body-color);word-wrap:break-word;background-color:var(--bs-card-bg);background-clip:border-box;border:var(--bs-card-border-width) solid var(--bs-card-border-color);border-radius:var(--bs-card-border-radius)}.card>hr{margin-right:0;margin-left:0}.card>.list-group{border-top:inherit;border-bottom:inherit}.card>.list-group:first-child{border-top-width:0;border-top-left-radius:var(--bs-card-inner-border-radius);border-top-right-radius:var(--bs-card-inner-border-radius)}.card>.list-group:last-child{border-bottom-width:0;border-bottom-right-radius:var(--bs-card-inner-border-radius);border-bottom-left-radius:var(--bs-card-inner-border-radius)}.card>.card-header+.list-group,.card>.list-group+.card-footer{border-top:0}.card-body{flex:1 1 auto;padding:var(--bs-card-spacer-y) var(--bs-card-spacer-x);color:var(--bs-card-color)}.card-title{margin-bottom:var(--bs-card-title-spacer-y);color:var(--bs-card-title-color)}.card-subtitle{margin-top:calc(-.5 * var(--bs-card-title-spacer-y));margin-bottom:0;color:var(--bs-card-subtitle-color)}.card-text:last-child{margin-bottom:0}.card-link+.card-link{margin-left:var(--bs-card-spacer-x)}.card-header{padding:var(--bs-card-cap-padding-y) var(--bs-card-cap-padding-x);margin-bottom:0;color:var(--bs-card-cap-color);background-color:var(--bs-card-cap-bg);border-bottom:var(--bs-card-border-width) solid var(--bs-card-border-color)}.card-header:first-child{border-radius:var(--bs-card-inner-border-radius) var(--bs-card-inner-border-radius) 0 0}.card-footer{padding:var(--bs-card-cap-padding-y) var(--bs-card-cap-padding-x);color:var(--bs-card-cap-color);background-color:var(--bs-card-cap-bg);border-top:var(--bs-card-border-width) solid var(--bs-card-border-color)}.card-footer:last-child{border-radius:0 0 var(--bs-card-inner-border-radius) var(--bs-card-inner-border-radius)}.card-header-tabs{margin-right:calc(-.5 * var(--bs-card-cap-padding-x));margin-bottom:calc(-1 * var(--bs-card-cap-padding-y));margin-left:calc(-.5 * var(--bs-card-cap-padding-x));border-bottom:0}.card-header-tabs .nav-link.active{background-color:var(--bs-card-bg);border-bottom-color:var(--bs-card-bg)}.card-header-pills{margin-right:calc(-.5 * var(--bs-card-cap-padding-x));margin-left:calc(-.5 * var(--bs-card-cap-padding-x))}.card-img-overlay{position:absolute;top:0;right:0;bottom:0;left:0;padding:var(--bs-card-img-overlay-padding);border-radius:var(--bs-card-inner-border-radius)}.card-img,.card-img-bottom,.card-img-top{width:100%}.card-img,.card-img-top{border-top-left-radius:var(--bs-card-inner-border-radius);border-top-right-radius:var(--bs-card-inner-border-radius)}.card-img,.card-img-bottom{border-bottom-right-radius:var(--bs-card-inner-border-radius);border-bottom-left-radius:var(--bs-card-inner-border-radius)}.card-group>.card{margin-bottom:var(--bs-card-group-margin)}@media (min-width:576px){.card-group{display:flex;flex-flow:row wrap}.card-group>.card{flex:1 0 0;margin-bottom:0}.card-group>.card+.card{margin-left:0;border-left:0}.card-group>.card:not(:last-child){border-top-right-radius:0;border-bottom-right-radius:0}.card-group>.card:not(:last-child)>.card-header,.card-group>.card:not(:last-child)>.card-img-top{border-top-right-radius:0}.card-group>.card:not(:last-child)>.card-footer,.card-group>.card:not(:last-child)>.card-img-bottom{border-bottom-right-radius:0}.card-group>.card:not(:first-child){border-top-left-radius:0;border-bottom-left-radius:0}.card-group>.card:not(:first-child)>.card-header,.card-group>.card:not(:first-child)>.card-img-top{border-top-left-radius:0}.card-group>.card:not(:first-child)>.card-footer,.card-group>.card:not(:first-child)>.card-img-bottom{border-bottom-left-radius:0}}.accordion{--bs-accordion-color:var(--bs-body-color);--bs-accordion-bg:var(--bs-body-bg);--bs-accordion-transition:color 0.15s ease-in-out,background-color 0.15s ease-in-out,border-color 0.15s ease-in-out,box-shadow 0.15s ease-in-out,border-radius 0.15s ease;--bs-accordion-border-color:var(--bs-border-color);--bs-accordion-border-width:var(--bs-border-width);--bs-accordion-border-radius:var(--bs-border-radius);--bs-accordion-inner-border-radius:calc(var(--bs-border-radius) - (var(--bs-border-width)));--bs-accordion-btn-padding-x:1.25rem;--bs-accordion-btn-padding-y:1rem;--bs-accordion-btn-color:var(--bs-body-color);--bs-accordion-btn-bg:var(--bs-accordion-bg);--bs-accordion-btn-icon:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='none' stroke='%23212529' stroke-linecap='round' stroke-linejoin='round'%3e%3cpath d='m2 5 6 6 6-6'/%3e%3c/svg%3e");--bs-accordion-btn-icon-width:1.25rem;--bs-accordion-btn-icon-transform:rotate(-180deg);--bs-accordion-btn-icon-transition:transform 0.2s ease-in-out;--bs-accordion-btn-active-icon:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='none' stroke='%23052c65' stroke-linecap='round' stroke-linejoin='round'%3e%3cpath d='m2 5 6 6 6-6'/%3e%3c/svg%3e");--bs-accordion-btn-focus-box-shadow:0 0 0 0.25rem rgba(13, 110, 253, 0.25);--bs-accordion-body-padding-x:1.25rem;--bs-accordion-body-padding-y:1rem;--bs-accordion-active-color:var(--bs-primary-text-emphasis);--bs-accordion-active-bg:var(--bs-primary-bg-subtle)}.accordion-button{position:relative;display:flex;align-items:center;width:100%;padding:var(--bs-accordion-btn-padding-y) var(--bs-accordion-btn-padding-x);font-size:1rem;color:var(--bs-accordion-btn-color);text-align:left;background-color:var(--bs-accordion-btn-bg);border:0;border-radius:0;overflow-anchor:none;transition:var(--bs-accordion-transition)}@media (prefers-reduced-motion:reduce){.accordion-button{transition:none}}.accordion-button:not(.collapsed){color:var(--bs-accordion-active-color);background-color:var(--bs-accordion-active-bg);box-shadow:inset 0 calc(-1 * var(--bs-accordion-border-width)) 0 var(--bs-accordion-border-color)}.accordion-button:not(.collapsed)::after{background-image:var(--bs-accordion-btn-active-icon);transform:var(--bs-accordion-btn-icon-transform)}.accordion-button::after{flex-shrink:0;width:var(--bs-accordion-btn-icon-width);height:var(--bs-accordion-btn-icon-width);margin-left:auto;content:"";background-image:var(--bs-accordion-btn-icon);background-repeat:no-repeat;background-size:var(--bs-accordion-btn-icon-width);transition:var(--bs-accordion-btn-icon-transition)}@media (prefers-reduced-motion:reduce){.accordion-button::after{transition:none}}.accordion-button:hover{z-index:2}.accordion-button:focus{z-index:3;outline:0;box-shadow:var(--bs-accordion-btn-focus-box-shadow)}.accordion-header{margin-bottom:0}.accordion-item{color:var(--bs-accordion-color);background-color:var(--bs-accordion-bg);border:var(--bs-accordion-border-width) solid var(--bs-accordion-border-color)}.accordion-item:first-of-type{border-top-left-radius:var(--bs-accordion-border-radius);border-top-right-radius:var(--bs-accordion-border-radius)}.accordion-item:first-of-type>.accordion-header .accordion-button{border-top-left-radius:var(--bs-accordion-inner-border-radius);border-top-right-radius:var(--bs-accordion-inner-border-radius)}.accordion-item:not(:first-of-type){border-top:0}.accordion-item:last-of-type{border-bottom-right-radius:var(--bs-accordion-border-radius);border-bottom-left-radius:var(--bs-accordion-border-radius)}.accordion-item:last-of-type>.accordion-header .accordion-button.collapsed{border-bottom-right-radius:var(--bs-accordion-inner-border-radius);border-bottom-left-radius:var(--bs-accordion-inner-border-radius)}.accordion-item:last-of-type>.accordion-collapse{border-bottom-right-radius:var(--bs-accordion-border-radius);border-bottom-left-radius:var(--bs-accordion-border-radius)}.accordion-body{padding:var(--bs-accordion-body-padding-y) var(--bs-accordion-body-padding-x)}.accordion-flush>.accordion-item{border-right:0;border-left:0;border-radius:0}.accordion-flush>.accordion-item:first-child{border-top:0}.accordion-flush>.accordion-item:last-child{border-bottom:0}.accordion-flush>.accordion-item>.accordion-collapse,.accordion-flush>.accordion-item>.accordion-header .accordion-button,.accordion-flush>.accordion-item>.accordion-header .accordion-button.collapsed{border-radius:0}[data-bs-theme=dark] .accordion-button::after{--bs-accordion-btn-icon:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='%236ea8fe'%3e%3cpath fill-rule='evenodd' d='M1.646 4.646a.5.5 0 0 1 .708 0L8 10.293l5.646-5.647a.5.5 0 0 1 .708.708l-6 6a.5.5 0 0 1-.708 0l-6-6a.5.5 0 0 1 0-.708'/%3e%3c/svg%3e");--bs-accordion-btn-active-icon:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='%236ea8fe'%3e%3cpath fill-rule='evenodd' d='M1.646 4.646a.5.5 0 0 1 .708 0L8 10.293l5.646-5.647a.5.5 0 0 1 .708.708l-6 6a.5.5 0 0 1-.708 0l-6-6a.5.5 0 0 1 0-.708'/%3e%3c/svg%3e")}.breadcrumb{--bs-breadcrumb-padding-x:0;--bs-breadcrumb-padding-y:0;--bs-breadcrumb-margin-bottom:1rem;--bs-breadcrumb-bg: ;--bs-breadcrumb-border-radius: ;--bs-breadcrumb-divider-color:var(--bs-secondary-color);--bs-breadcrumb-item-padding-x:0.5rem;--bs-breadcrumb-item-active-color:var(--bs-secondary-color);display:flex;flex-wrap:wrap;padding:var(--bs-breadcrumb-padding-y) var(--bs-breadcrumb-padding-x);margin-bottom:var(--bs-breadcrumb-margin-bottom);font-size:var(--bs-breadcrumb-font-size);list-style:none;background-color:var(--bs-breadcrumb-bg);border-radius:var(--bs-breadcrumb-border-radius)}.breadcrumb-item+.breadcrumb-item{padding-left:var(--bs-breadcrumb-item-padding-x)}.breadcrumb-item+.breadcrumb-item::before{float:left;padding-right:var(--bs-breadcrumb-item-padding-x);color:var(--bs-breadcrumb-divider-color);content:var(--bs-breadcrumb-divider, "/")}.breadcrumb-item.active{color:var(--bs-breadcrumb-item-active-color)}.pagination{--bs-pagination-padding-x:0.75rem;--bs-pagination-padding-y:0.375rem;--bs-pagination-font-size:1rem;--bs-pagination-color:var(--bs-link-color);--bs-pagination-bg:var(--bs-body-bg);--bs-pagination-border-width:var(--bs-border-width);--bs-pagination-border-color:var(--bs-border-color);--bs-pagination-border-radius:var(--bs-border-radius);--bs-pagination-hover-color:var(--bs-link-hover-color);--bs-pagination-hover-bg:var(--bs-tertiary-bg);--bs-pagination-hover-border-color:var(--bs-border-color);--bs-pagination-focus-color:var(--bs-link-hover-color);--bs-pagination-focus-bg:var(--bs-secondary-bg);--bs-pagination-focus-box-shadow:0 0 0 0.25rem rgba(13, 110, 253, 0.25);--bs-pagination-active-color:#fff;--bs-pagination-active-bg:#0d6efd;--bs-pagination-active-border-color:#0d6efd;--bs-pagination-disabled-color:var(--bs-secondary-color);--bs-pagination-disabled-bg:var(--bs-secondary-bg);--bs-pagination-disabled-border-color:var(--bs-border-color);display:flex;padding-left:0;list-style:none}.page-link{position:relative;display:block;padding:var(--bs-pagination-padding-y) var(--bs-pagination-padding-x);font-size:var(--bs-pagination-font-size);color:var(--bs-pagination-color);text-decoration:none;background-color:var(--bs-pagination-bg);border:var(--bs-pagination-border-width) solid var(--bs-pagination-border-color);transition:color .15s ease-in-out,background-color .15s ease-in-out,border-color .15s ease-in-out,box-shadow .15s ease-in-out}@media (prefers-reduced-motion:reduce){.page-link{transition:none}}.page-link:hover{z-index:2;color:var(--bs-pagination-hover-color);background-color:var(--bs-pagination-hover-bg);border-color:var(--bs-pagination-hover-border-color)}.page-link:focus{z-index:3;color:var(--bs-pagination-focus-color);background-color:var(--bs-pagination-focus-bg);outline:0;box-shadow:var(--bs-pagination-focus-box-shadow)}.active>.page-link,.page-link.active{z-index:3;color:var(--bs-pagination-active-color);background-color:var(--bs-pagination-active-bg);border-color:var(--bs-pagination-active-border-color)}.disabled>.page-link,.page-link.disabled{color:var(--bs-pagination-disabled-color);pointer-events:none;background-color:var(--bs-pagination-disabled-bg);border-color:var(--bs-pagination-disabled-border-color)}.page-item:not(:first-child) .page-link{margin-left:calc(-1 * var(--bs-border-width))}.page-item:first-child .page-link{border-top-left-radius:var(--bs-pagination-border-radius);border-bottom-left-radius:var(--bs-pagination-border-radius)}.page-item:last-child .page-link{border-top-right-radius:var(--bs-pagination-border-radius);border-bottom-right-radius:var(--bs-pagination-border-radius)}.pagination-lg{--bs-pagination-padding-x:1.5rem;--bs-pagination-padding-y:0.75rem;--bs-pagination-font-size:1.25rem;--bs-pagination-border-radius:var(--bs-border-radius-lg)}.pagination-sm{--bs-pagination-padding-x:0.5rem;--bs-pagination-padding-y:0.25rem;--bs-pagination-font-size:0.875rem;--bs-pagination-border-radius:var(--bs-border-radius-sm)}.badge{--bs-badge-padding-x:0.65em;--bs-badge-padding-y:0.35em;--bs-badge-font-size:0.75em;--bs-badge-font-weight:700;--bs-badge-color:#fff;--bs-badge-border-radius:var(--bs-border-radius);display:inline-block;padding:var(--bs-badge-padding-y) var(--bs-badge-padding-x);font-size:var(--bs-badge-font-size);font-weight:var(--bs-badge-font-weight);line-height:1;color:var(--bs-badge-color);text-align:center;white-space:nowrap;vertical-align:baseline;border-radius:var(--bs-badge-border-radius)}.badge:empty{display:none}.btn .badge{position:relative;top:-1px}.alert{--bs-alert-bg:transparent;--bs-alert-padding-x:1rem;--bs-alert-padding-y:1rem;--bs-alert-margin-bottom:1rem;--bs-alert-color:inherit;--bs-alert-border-color:transparent;--bs-alert-border:var(--bs-border-width) solid var(--bs-alert-border-color);--bs-alert-border-radius:var(--bs-border-radius);--bs-alert-link-color:inherit;position:relative;padding:var(--bs-alert-padding-y) var(--bs-alert-padding-x);margin-bottom:var(--bs-alert-margin-bottom);color:var(--bs-alert-color);background-color:var(--bs-alert-bg);border:var(--bs-alert-border);border-radius:var(--bs-alert-border-radius)}.alert-heading{color:inherit}.alert-link{font-weight:700;color:var(--bs-alert-link-color)}.alert-dismissible{padding-right:3rem}.alert-dismissible .btn-close{position:absolute;top:0;right:0;z-index:2;padding:1.25rem 1rem}.alert-primary{--bs-alert-color:var(--bs-primary-text-emphasis);--bs-alert-bg:var(--bs-primary-bg-subtle);--bs-alert-border-color:var(--bs-primary-border-subtle);--bs-alert-link-color:var(--bs-primary-text-emphasis)}.alert-secondary{--bs-alert-color:var(--bs-secondary-text-emphasis);--bs-alert-bg:var(--bs-secondary-bg-subtle);--bs-alert-border-color:var(--bs-secondary-border-subtle);--bs-alert-link-color:var(--bs-secondary-text-emphasis)}.alert-success{--bs-alert-color:var(--bs-success-text-emphasis);--bs-alert-bg:var(--bs-success-bg-subtle);--bs-alert-border-color:var(--bs-success-border-subtle);--bs-alert-link-color:var(--bs-success-text-emphasis)}.alert-info{--bs-alert-color:var(--bs-info-text-emphasis);--bs-alert-bg:var(--bs-info-bg-subtle);--bs-alert-border-color:var(--bs-info-border-subtle);--bs-alert-link-color:var(--bs-info-text-emphasis)}.alert-warning{--bs-alert-color:var(--bs-warning-text-emphasis);--bs-alert-bg:var(--bs-warning-bg-subtle);--bs-alert-border-color:var(--bs-warning-border-subtle);--bs-alert-link-color:var(--bs-warning-text-emphasis)}.alert-danger{--bs-alert-color:var(--bs-danger-text-emphasis);--bs-alert-bg:var(--bs-danger-bg-subtle);--bs-alert-border-color:var(--bs-danger-border-subtle);--bs-alert-link-color:var(--bs-danger-text-emphasis)}.alert-light{--bs-alert-color:var(--bs-light-text-emphasis);--bs-alert-bg:var(--bs-light-bg-subtle);--bs-alert-border-color:var(--bs-light-border-subtle);--bs-alert-link-color:var(--bs-light-text-emphasis)}.alert-dark{--bs-alert-color:var(--bs-dark-text-emphasis);--bs-alert-bg:var(--bs-dark-bg-subtle);--bs-alert-border-color:var(--bs-dark-border-subtle);--bs-alert-link-color:var(--bs-dark-text-emphasis)}@keyframes progress-bar-stripes{0%{background-position-x:var(--bs-progress-height)}}.progress,.progress-stacked{--bs-progress-height:1rem;--bs-progress-font-size:0.75rem;--bs-progress-bg:var(--bs-secondary-bg);--bs-progress-border-radius:var(--bs-border-radius);--bs-progress-box-shadow:var(--bs-box-shadow-inset);--bs-progress-bar-color:#fff;--bs-progress-bar-bg:#0d6efd;--bs-progress-bar-transition:width 0.6s ease;display:flex;height:var(--bs-progress-height);overflow:hidden;font-size:var(--bs-progress-font-size);background-color:var(--bs-progress-bg);border-radius:var(--bs-progress-border-radius)}.progress-bar{display:flex;flex-direction:column;justify-content:center;overflow:hidden;color:var(--bs-progress-bar-color);text-align:center;white-space:nowrap;background-color:var(--bs-progress-bar-bg);transition:var(--bs-progress-bar-transition)}@media (prefers-reduced-motion:reduce){.progress-bar{transition:none}}.progress-bar-striped{background-image:linear-gradient(45deg,rgba(255,255,255,.15) 25%,transparent 25%,transparent 50%,rgba(255,255,255,.15) 50%,rgba(255,255,255,.15) 75%,transparent 75%,transparent);background-size:var(--bs-progress-height) var(--bs-progress-height)}.progress-stacked>.progress{overflow:visible}.progress-stacked>.progress>.progress-bar{width:100%}.progress-bar-animated{animation:1s linear infinite progress-bar-stripes}@media (prefers-reduced-motion:reduce){.progress-bar-animated{animation:none}}.list-group{--bs-list-group-color:var(--bs-body-color);--bs-list-group-bg:var(--bs-body-bg);--bs-list-group-border-color:var(--bs-border-color);--bs-list-group-border-width:var(--bs-border-width);--bs-list-group-border-radius:var(--bs-border-radius);--bs-list-group-item-padding-x:1rem;--bs-list-group-item-padding-y:0.5rem;--bs-list-group-action-color:var(--bs-secondary-color);--bs-list-group-action-hover-color:var(--bs-emphasis-color);--bs-list-group-action-hover-bg:var(--bs-tertiary-bg);--bs-list-group-action-active-color:var(--bs-body-color);--bs-list-group-action-active-bg:var(--bs-secondary-bg);--bs-list-group-disabled-color:var(--bs-secondary-color);--bs-list-group-disabled-bg:var(--bs-body-bg);--bs-list-group-active-color:#fff;--bs-list-group-active-bg:#0d6efd;--bs-list-group-active-border-color:#0d6efd;display:flex;flex-direction:column;padding-left:0;margin-bottom:0;border-radius:var(--bs-list-group-border-radius)}.list-group-numbered{list-style-type:none;counter-reset:section}.list-group-numbered>.list-group-item::before{content:counters(section, ".") ". ";counter-increment:section}.list-group-item{position:relative;display:block;padding:var(--bs-list-group-item-padding-y) var(--bs-list-group-item-padding-x);color:var(--bs-list-group-color);text-decoration:none;background-color:var(--bs-list-group-bg);border:var(--bs-list-group-border-width) solid var(--bs-list-group-border-color)}.list-group-item:first-child{border-top-left-radius:inherit;border-top-right-radius:inherit}.list-group-item:last-child{border-bottom-right-radius:inherit;border-bottom-left-radius:inherit}.list-group-item.disabled,.list-group-item:disabled{color:var(--bs-list-group-disabled-color);pointer-events:none;background-color:var(--bs-list-group-disabled-bg)}.list-group-item.active{z-index:2;color:var(--bs-list-group-active-color);background-color:var(--bs-list-group-active-bg);border-color:var(--bs-list-group-active-border-color)}.list-group-item+.list-group-item{border-top-width:0}.list-group-item+.list-group-item.active{margin-top:calc(-1 * var(--bs-list-group-border-width));border-top-width:var(--bs-list-group-border-width)}.list-group-item-action{width:100%;color:var(--bs-list-group-action-color);text-align:inherit}.list-group-item-action:not(.active):focus,.list-group-item-action:not(.active):hover{z-index:1;color:var(--bs-list-group-action-hover-color);text-decoration:none;background-color:var(--bs-list-group-action-hover-bg)}.list-group-item-action:not(.active):active{color:var(--bs-list-group-action-active-color);background-color:var(--bs-list-group-action-active-bg)}.list-group-horizontal{flex-direction:row}.list-group-horizontal>.list-group-item:first-child:not(:last-child){border-bottom-left-radius:var(--bs-list-group-border-radius);border-top-right-radius:0}.list-group-horizontal>.list-group-item:last-child:not(:first-child){border-top-right-radius:var(--bs-list-group-border-radius);border-bottom-left-radius:0}.list-group-horizontal>.list-group-item.active{margin-top:0}.list-group-horizontal>.list-group-item+.list-group-item{border-top-width:var(--bs-list-group-border-width);border-left-width:0}.list-group-horizontal>.list-group-item+.list-group-item.active{margin-left:calc(-1 * var(--bs-list-group-border-width));border-left-width:var(--bs-list-group-border-width)}@media (min-width:576px){.list-group-horizontal-sm{flex-direction:row}.list-group-horizontal-sm>.list-group-item:first-child:not(:last-child){border-bottom-left-radius:var(--bs-list-group-border-radius);border-top-right-radius:0}.list-group-horizontal-sm>.list-group-item:last-child:not(:first-child){border-top-right-radius:var(--bs-list-group-border-radius);border-bottom-left-radius:0}.list-group-horizontal-sm>.list-group-item.active{margin-top:0}.list-group-horizontal-sm>.list-group-item+.list-group-item{border-top-width:var(--bs-list-group-border-width);border-left-width:0}.list-group-horizontal-sm>.list-group-item+.list-group-item.active{margin-left:calc(-1 * var(--bs-list-group-border-width));border-left-width:var(--bs-list-group-border-width)}}@media (min-width:768px){.list-group-horizontal-md{flex-direction:row}.list-group-horizontal-md>.list-group-item:first-child:not(:last-child){border-bottom-left-radius:var(--bs-list-group-border-radius);border-top-right-radius:0}.list-group-horizontal-md>.list-group-item:last-child:not(:first-child){border-top-right-radius:var(--bs-list-group-border-radius);border-bottom-left-radius:0}.list-group-horizontal-md>.list-group-item.active{margin-top:0}.list-group-horizontal-md>.list-group-item+.list-group-item{border-top-width:var(--bs-list-group-border-width);border-left-width:0}.list-group-horizontal-md>.list-group-item+.list-group-item.active{margin-left:calc(-1 * var(--bs-list-group-border-width));border-left-width:var(--bs-list-group-border-width)}}@media (min-width:992px){.list-group-horizontal-lg{flex-direction:row}.list-group-horizontal-lg>.list-group-item:first-child:not(:last-child){border-bottom-left-radius:var(--bs-list-group-border-radius);border-top-right-radius:0}.list-group-horizontal-lg>.list-group-item:last-child:not(:first-child){border-top-right-radius:var(--bs-list-group-border-radius);border-bottom-left-radius:0}.list-group-horizontal-lg>.list-group-item.active{margin-top:0}.list-group-horizontal-lg>.list-group-item+.list-group-item{border-top-width:var(--bs-list-group-border-width);border-left-width:0}.list-group-horizontal-lg>.list-group-item+.list-group-item.active{margin-left:calc(-1 * var(--bs-list-group-border-width));border-left-width:var(--bs-list-group-border-width)}}@media (min-width:1200px){.list-group-horizontal-xl{flex-direction:row}.list-group-horizontal-xl>.list-group-item:first-child:not(:last-child){border-bottom-left-radius:var(--bs-list-group-border-radius);border-top-right-radius:0}.list-group-horizontal-xl>.list-group-item:last-child:not(:first-child){border-top-right-radius:var(--bs-list-group-border-radius);border-bottom-left-radius:0}.list-group-horizontal-xl>.list-group-item.active{margin-top:0}.list-group-horizontal-xl>.list-group-item+.list-group-item{border-top-width:var(--bs-list-group-border-width);border-left-width:0}.list-group-horizontal-xl>.list-group-item+.list-group-item.active{margin-left:calc(-1 * var(--bs-list-group-border-width));border-left-width:var(--bs-list-group-border-width)}}@media (min-width:1400px){.list-group-horizontal-xxl{flex-direction:row}.list-group-horizontal-xxl>.list-group-item:first-child:not(:last-child){border-bottom-left-radius:var(--bs-list-group-border-radius);border-top-right-radius:0}.list-group-horizontal-xxl>.list-group-item:last-child:not(:first-child){border-top-right-radius:var(--bs-list-group-border-radius);border-bottom-left-radius:0}.list-group-horizontal-xxl>.list-group-item.active{margin-top:0}.list-group-horizontal-xxl>.list-group-item+.list-group-item{border-top-width:var(--bs-list-group-border-width);border-left-width:0}.list-group-horizontal-xxl>.list-group-item+.list-group-item.active{margin-left:calc(-1 * var(--bs-list-group-border-width));border-left-width:var(--bs-list-group-border-width)}}.list-group-flush{border-radius:0}.list-group-flush>.list-group-item{border-width:0 0 var(--bs-list-group-border-width)}.list-group-flush>.list-group-item:last-child{border-bottom-width:0}.list-group-item-primary{--bs-list-group-color:var(--bs-primary-text-emphasis);--bs-list-group-bg:var(--bs-primary-bg-subtle);--bs-list-group-border-color:var(--bs-primary-border-subtle);--bs-list-group-action-hover-color:var(--bs-emphasis-color);--bs-list-group-action-hover-bg:var(--bs-primary-border-subtle);--bs-list-group-action-active-color:var(--bs-emphasis-color);--bs-list-group-action-active-bg:var(--bs-primary-border-subtle);--bs-list-group-active-color:var(--bs-primary-bg-subtle);--bs-list-group-active-bg:var(--bs-primary-text-emphasis);--bs-list-group-active-border-color:var(--bs-primary-text-emphasis)}.list-group-item-secondary{--bs-list-group-color:var(--bs-secondary-text-emphasis);--bs-list-group-bg:var(--bs-secondary-bg-subtle);--bs-list-group-border-color:var(--bs-secondary-border-subtle);--bs-list-group-action-hover-color:var(--bs-emphasis-color);--bs-list-group-action-hover-bg:var(--bs-secondary-border-subtle);--bs-list-group-action-active-color:var(--bs-emphasis-color);--bs-list-group-action-active-bg:var(--bs-secondary-border-subtle);--bs-list-group-active-color:var(--bs-secondary-bg-subtle);--bs-list-group-active-bg:var(--bs-secondary-text-emphasis);--bs-list-group-active-border-color:var(--bs-secondary-text-emphasis)}.list-group-item-success{--bs-list-group-color:var(--bs-success-text-emphasis);--bs-list-group-bg:var(--bs-success-bg-subtle);--bs-list-group-border-color:var(--bs-success-border-subtle);--bs-list-group-action-hover-color:var(--bs-emphasis-color);--bs-list-group-action-hover-bg:var(--bs-success-border-subtle);--bs-list-group-action-active-color:var(--bs-emphasis-color);--bs-list-group-action-active-bg:var(--bs-success-border-subtle);--bs-list-group-active-color:var(--bs-success-bg-subtle);--bs-list-group-active-bg:var(--bs-success-text-emphasis);--bs-list-group-active-border-color:var(--bs-success-text-emphasis)}.list-group-item-info{--bs-list-group-color:var(--bs-info-text-emphasis);--bs-list-group-bg:var(--bs-info-bg-subtle);--bs-list-group-border-color:var(--bs-info-border-subtle);--bs-list-group-action-hover-color:var(--bs-emphasis-color);--bs-list-group-action-hover-bg:var(--bs-info-border-subtle);--bs-list-group-action-active-color:var(--bs-emphasis-color);--bs-list-group-action-active-bg:var(--bs-info-border-subtle);--bs-list-group-active-color:var(--bs-info-bg-subtle);--bs-list-group-active-bg:var(--bs-info-text-emphasis);--bs-list-group-active-border-color:var(--bs-info-text-emphasis)}.list-group-item-warning{--bs-list-group-color:var(--bs-warning-text-emphasis);--bs-list-group-bg:var(--bs-warning-bg-subtle);--bs-list-group-border-color:var(--bs-warning-border-subtle);--bs-list-group-action-hover-color:var(--bs-emphasis-color);--bs-list-group-action-hover-bg:var(--bs-warning-border-subtle);--bs-list-group-action-active-color:var(--bs-emphasis-color);--bs-list-group-action-active-bg:var(--bs-warning-border-subtle);--bs-list-group-active-color:var(--bs-warning-bg-subtle);--bs-list-group-active-bg:var(--bs-warning-text-emphasis);--bs-list-group-active-border-color:var(--bs-warning-text-emphasis)}.list-group-item-danger{--bs-list-group-color:var(--bs-danger-text-emphasis);--bs-list-group-bg:var(--bs-danger-bg-subtle);--bs-list-group-border-color:var(--bs-danger-border-subtle);--bs-list-group-action-hover-color:var(--bs-emphasis-color);--bs-list-group-action-hover-bg:var(--bs-danger-border-subtle);--bs-list-group-action-active-color:var(--bs-emphasis-color);--bs-list-group-action-active-bg:var(--bs-danger-border-subtle);--bs-list-group-active-color:var(--bs-danger-bg-subtle);--bs-list-group-active-bg:var(--bs-danger-text-emphasis);--bs-list-group-active-border-color:var(--bs-danger-text-emphasis)}.list-group-item-light{--bs-list-group-color:var(--bs-light-text-emphasis);--bs-list-group-bg:var(--bs-light-bg-subtle);--bs-list-group-border-color:var(--bs-light-border-subtle);--bs-list-group-action-hover-color:var(--bs-emphasis-color);--bs-list-group-action-hover-bg:var(--bs-light-border-subtle);--bs-list-group-action-active-color:var(--bs-emphasis-color);--bs-list-group-action-active-bg:var(--bs-light-border-subtle);--bs-list-group-active-color:var(--bs-light-bg-subtle);--bs-list-group-active-bg:var(--bs-light-text-emphasis);--bs-list-group-active-border-color:var(--bs-light-text-emphasis)}.list-group-item-dark{--bs-list-group-color:var(--bs-dark-text-emphasis);--bs-list-group-bg:var(--bs-dark-bg-subtle);--bs-list-group-border-color:var(--bs-dark-border-subtle);--bs-list-group-action-hover-color:var(--bs-emphasis-color);--bs-list-group-action-hover-bg:var(--bs-dark-border-subtle);--bs-list-group-action-active-color:var(--bs-emphasis-color);--bs-list-group-action-active-bg:var(--bs-dark-border-subtle);--bs-list-group-active-color:var(--bs-dark-bg-subtle);--bs-list-group-active-bg:var(--bs-dark-text-emphasis);--bs-list-group-active-border-color:var(--bs-dark-text-emphasis)}.btn-close{--bs-btn-close-color:#000;--bs-btn-close-bg:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='%23000'%3e%3cpath d='M.293.293a1 1 0 0 1 1.414 0L8 6.586 14.293.293a1 1 0 1 1 1.414 1.414L9.414 8l6.293 6.293a1 1 0 0 1-1.414 1.414L8 9.414l-6.293 6.293a1 1 0 0 1-1.414-1.414L6.586 8 .293 1.707a1 1 0 0 1 0-1.414'/%3e%3c/svg%3e");--bs-btn-close-opacity:0.5;--bs-btn-close-hover-opacity:0.75;--bs-btn-close-focus-shadow:0 0 0 0.25rem rgba(13, 110, 253, 0.25);--bs-btn-close-focus-opacity:1;--bs-btn-close-disabled-opacity:0.25;box-sizing:content-box;width:1em;height:1em;padding:.25em .25em;color:var(--bs-btn-close-color);background:transparent var(--bs-btn-close-bg) center/1em auto no-repeat;filter:var(--bs-btn-close-filter);border:0;border-radius:.375rem;opacity:var(--bs-btn-close-opacity)}.btn-close:hover{color:var(--bs-btn-close-color);text-decoration:none;opacity:var(--bs-btn-close-hover-opacity)}.btn-close:focus{outline:0;box-shadow:var(--bs-btn-close-focus-shadow);opacity:var(--bs-btn-close-focus-opacity)}.btn-close.disabled,.btn-close:disabled{pointer-events:none;-webkit-user-select:none;-moz-user-select:none;user-select:none;opacity:var(--bs-btn-close-disabled-opacity)}.btn-close-white{--bs-btn-close-filter:invert(1) grayscale(100%) brightness(200%)}:root,[data-bs-theme=light]{--bs-btn-close-filter: }[data-bs-theme=dark]{--bs-btn-close-filter:invert(1) grayscale(100%) brightness(200%)}.toast{--bs-toast-zindex:1090;--bs-toast-padding-x:0.75rem;--bs-toast-padding-y:0.5rem;--bs-toast-spacing:1.5rem;--bs-toast-max-width:350px;--bs-toast-font-size:0.875rem;--bs-toast-color: ;--bs-toast-bg:rgba(var(--bs-body-bg-rgb), 0.85);--bs-toast-border-width:var(--bs-border-width);--bs-toast-border-color:var(--bs-border-color-translucent);--bs-toast-border-radius:var(--bs-border-radius);--bs-toast-box-shadow:var(--bs-box-shadow);--bs-toast-header-color:var(--bs-secondary-color);--bs-toast-header-bg:rgba(var(--bs-body-bg-rgb), 0.85);--bs-toast-header-border-color:var(--bs-border-color-translucent);width:var(--bs-toast-max-width);max-width:100%;font-size:var(--bs-toast-font-size);color:var(--bs-toast-color);pointer-events:auto;background-color:var(--bs-toast-bg);background-clip:padding-box;border:var(--bs-toast-border-width) solid var(--bs-toast-border-color);box-shadow:var(--bs-toast-box-shadow);border-radius:var(--bs-toast-border-radius)}.toast.showing{opacity:0}.toast:not(.show){display:none}.toast-container{--bs-toast-zindex:1090;position:absolute;z-index:var(--bs-toast-zindex);width:-webkit-max-content;width:-moz-max-content;width:max-content;max-width:100%;pointer-events:none}.toast-container>:not(:last-child){margin-bottom:var(--bs-toast-spacing)}.toast-header{display:flex;align-items:center;padding:var(--bs-toast-padding-y) var(--bs-toast-padding-x);color:var(--bs-toast-header-color);background-color:var(--bs-toast-header-bg);background-clip:padding-box;border-bottom:var(--bs-toast-border-width) solid var(--bs-toast-header-border-color);border-top-left-radius:calc(var(--bs-toast-border-radius) - var(--bs-toast-border-width));border-top-right-radius:calc(var(--bs-toast-border-radius) - var(--bs-toast-border-width))}.toast-header .btn-close{margin-right:calc(-.5 * var(--bs-toast-padding-x));margin-left:var(--bs-toast-padding-x)}.toast-body{padding:var(--bs-toast-padding-x);word-wrap:break-word}.modal{--bs-modal-zindex:1055;--bs-modal-width:500px;--bs-modal-padding:1rem;--bs-modal-margin:0.5rem;--bs-modal-color:var(--bs-body-color);--bs-modal-bg:var(--bs-body-bg);--bs-modal-border-color:var(--bs-border-color-translucent);--bs-modal-border-width:var(--bs-border-width);--bs-modal-border-radius:var(--bs-border-radius-lg);--bs-modal-box-shadow:var(--bs-box-shadow-sm);--bs-modal-inner-border-radius:calc(var(--bs-border-radius-lg) - (var(--bs-border-width)));--bs-modal-header-padding-x:1rem;--bs-modal-header-padding-y:1rem;--bs-modal-header-padding:1rem 1rem;--bs-modal-header-border-color:var(--bs-border-color);--bs-modal-header-border-width:var(--bs-border-width);--bs-modal-title-line-height:1.5;--bs-modal-footer-gap:0.5rem;--bs-modal-footer-bg: ;--bs-modal-footer-border-color:var(--bs-border-color);--bs-modal-footer-border-width:var(--bs-border-width);position:fixed;top:0;left:0;z-index:var(--bs-modal-zindex);display:none;width:100%;height:100%;overflow-x:hidden;overflow-y:auto;outline:0}.modal-dialog{position:relative;width:auto;margin:var(--bs-modal-margin);pointer-events:none}.modal.fade .modal-dialog{transform:translate(0,-50px);transition:transform .3s ease-out}@media (prefers-reduced-motion:reduce){.modal.fade .modal-dialog{transition:none}}.modal.show .modal-dialog{transform:none}.modal.modal-static .modal-dialog{transform:scale(1.02)}.modal-dialog-scrollable{height:calc(100% - var(--bs-modal-margin) * 2)}.modal-dialog-scrollable .modal-content{max-height:100%;overflow:hidden}.modal-dialog-scrollable .modal-body{overflow-y:auto}.modal-dialog-centered{display:flex;align-items:center;min-height:calc(100% - var(--bs-modal-margin) * 2)}.modal-content{position:relative;display:flex;flex-direction:column;width:100%;color:var(--bs-modal-color);pointer-events:auto;background-color:var(--bs-modal-bg);background-clip:padding-box;border:var(--bs-modal-border-width) solid var(--bs-modal-border-color);border-radius:var(--bs-modal-border-radius);outline:0}.modal-backdrop{--bs-backdrop-zindex:1050;--bs-backdrop-bg:#000;--bs-backdrop-opacity:0.5;position:fixed;top:0;left:0;z-index:var(--bs-backdrop-zindex);width:100vw;height:100vh;background-color:var(--bs-backdrop-bg)}.modal-backdrop.fade{opacity:0}.modal-backdrop.show{opacity:var(--bs-backdrop-opacity)}.modal-header{display:flex;flex-shrink:0;align-items:center;padding:var(--bs-modal-header-padding);border-bottom:var(--bs-modal-header-border-width) solid var(--bs-modal-header-border-color);border-top-left-radius:var(--bs-modal-inner-border-radius);border-top-right-radius:var(--bs-modal-inner-border-radius)}.modal-header .btn-close{padding:calc(var(--bs-modal-header-padding-y) * .5) calc(var(--bs-modal-header-padding-x) * .5);margin-top:calc(-.5 * var(--bs-modal-header-padding-y));margin-right:calc(-.5 * var(--bs-modal-header-padding-x));margin-bottom:calc(-.5 * var(--bs-modal-header-padding-y));margin-left:auto}.modal-title{margin-bottom:0;line-height:var(--bs-modal-title-line-height)}.modal-body{position:relative;flex:1 1 auto;padding:var(--bs-modal-padding)}.modal-footer{display:flex;flex-shrink:0;flex-wrap:wrap;align-items:center;justify-content:flex-end;padding:calc(var(--bs-modal-padding) - var(--bs-modal-footer-gap) * .5);background-color:var(--bs-modal-footer-bg);border-top:var(--bs-modal-footer-border-width) solid var(--bs-modal-footer-border-color);border-bottom-right-radius:var(--bs-modal-inner-border-radius);border-bottom-left-radius:var(--bs-modal-inner-border-radius)}.modal-footer>*{margin:calc(var(--bs-modal-footer-gap) * .5)}@media (min-width:576px){.modal{--bs-modal-margin:1.75rem;--bs-modal-box-shadow:var(--bs-box-shadow)}.modal-dialog{max-width:var(--bs-modal-width);margin-right:auto;margin-left:auto}.modal-sm{--bs-modal-width:300px}}@media (min-width:992px){.modal-lg,.modal-xl{--bs-modal-width:800px}}@media (min-width:1200px){.modal-xl{--bs-modal-width:1140px}}.modal-fullscreen{width:100vw;max-width:none;height:100%;margin:0}.modal-fullscreen .modal-content{height:100%;border:0;border-radius:0}.modal-fullscreen .modal-footer,.modal-fullscreen .modal-header{border-radius:0}.modal-fullscreen .modal-body{overflow-y:auto}@media (max-width:575.98px){.modal-fullscreen-sm-down{width:100vw;max-width:none;height:100%;margin:0}.modal-fullscreen-sm-down .modal-content{height:100%;border:0;border-radius:0}.modal-fullscreen-sm-down .modal-footer,.modal-fullscreen-sm-down .modal-header{border-radius:0}.modal-fullscreen-sm-down .modal-body{overflow-y:auto}}@media (max-width:767.98px){.modal-fullscreen-md-down{width:100vw;max-width:none;height:100%;margin:0}.modal-fullscreen-md-down .modal-content{height:100%;border:0;border-radius:0}.modal-fullscreen-md-down .modal-footer,.modal-fullscreen-md-down .modal-header{border-radius:0}.modal-fullscreen-md-down .modal-body{overflow-y:auto}}@media (max-width:991.98px){.modal-fullscreen-lg-down{width:100vw;max-width:none;height:100%;margin:0}.modal-fullscreen-lg-down .modal-content{height:100%;border:0;border-radius:0}.modal-fullscreen-lg-down .modal-footer,.modal-fullscreen-lg-down .modal-header{border-radius:0}.modal-fullscreen-lg-down .modal-body{overflow-y:auto}}@media (max-width:1199.98px){.modal-fullscreen-xl-down{width:100vw;max-width:none;height:100%;margin:0}.modal-fullscreen-xl-down .modal-content{height:100%;border:0;border-radius:0}.modal-fullscreen-xl-down .modal-footer,.modal-fullscreen-xl-down .modal-header{border-radius:0}.modal-fullscreen-xl-down .modal-body{overflow-y:auto}}@media (max-width:1399.98px){.modal-fullscreen-xxl-down{width:100vw;max-width:none;height:100%;margin:0}.modal-fullscreen-xxl-down .modal-content{height:100%;border:0;border-radius:0}.modal-fullscreen-xxl-down .modal-footer,.modal-fullscreen-xxl-down .modal-header{border-radius:0}.modal-fullscreen-xxl-down .modal-body{overflow-y:auto}}.tooltip{--bs-tooltip-zindex:1080;--bs-tooltip-max-width:200px;--bs-tooltip-padding-x:0.5rem;--bs-tooltip-padding-y:0.25rem;--bs-tooltip-margin: ;--bs-tooltip-font-size:0.875rem;--bs-tooltip-color:var(--bs-body-bg);--bs-tooltip-bg:var(--bs-emphasis-color);--bs-tooltip-border-radius:var(--bs-border-radius);--bs-tooltip-opacity:0.9;--bs-tooltip-arrow-width:0.8rem;--bs-tooltip-arrow-height:0.4rem;z-index:var(--bs-tooltip-zindex);display:block;margin:var(--bs-tooltip-margin);font-family:var(--bs-font-sans-serif);font-style:normal;font-weight:400;line-height:1.5;text-align:left;text-align:start;text-decoration:none;text-shadow:none;text-transform:none;letter-spacing:normal;word-break:normal;white-space:normal;word-spacing:normal;line-break:auto;font-size:var(--bs-tooltip-font-size);word-wrap:break-word;opacity:0}.tooltip.show{opacity:var(--bs-tooltip-opacity)}.tooltip .tooltip-arrow{display:block;width:var(--bs-tooltip-arrow-width);height:var(--bs-tooltip-arrow-height)}.tooltip .tooltip-arrow::before{position:absolute;content:"";border-color:transparent;border-style:solid}.bs-tooltip-auto[data-popper-placement^=top] .tooltip-arrow,.bs-tooltip-top .tooltip-arrow{bottom:calc(-1 * var(--bs-tooltip-arrow-height))}.bs-tooltip-auto[data-popper-placement^=top] .tooltip-arrow::before,.bs-tooltip-top .tooltip-arrow::before{top:-1px;border-width:var(--bs-tooltip-arrow-height) calc(var(--bs-tooltip-arrow-width) * .5) 0;border-top-color:var(--bs-tooltip-bg)}.bs-tooltip-auto[data-popper-placement^=right] .tooltip-arrow,.bs-tooltip-end .tooltip-arrow{left:calc(-1 * var(--bs-tooltip-arrow-height));width:var(--bs-tooltip-arrow-height);height:var(--bs-tooltip-arrow-width)}.bs-tooltip-auto[data-popper-placement^=right] .tooltip-arrow::before,.bs-tooltip-end .tooltip-arrow::before{right:-1px;border-width:calc(var(--bs-tooltip-arrow-width) * .5) var(--bs-tooltip-arrow-height) calc(var(--bs-tooltip-arrow-width) * .5) 0;border-right-color:var(--bs-tooltip-bg)}.bs-tooltip-auto[data-popper-placement^=bottom] .tooltip-arrow,.bs-tooltip-bottom .tooltip-arrow{top:calc(-1 * var(--bs-tooltip-arrow-height))}.bs-tooltip-auto[data-popper-placement^=bottom] .tooltip-arrow::before,.bs-tooltip-bottom .tooltip-arrow::before{bottom:-1px;border-width:0 calc(var(--bs-tooltip-arrow-width) * .5) var(--bs-tooltip-arrow-height);border-bottom-color:var(--bs-tooltip-bg)}.bs-tooltip-auto[data-popper-placement^=left] .tooltip-arrow,.bs-tooltip-start .tooltip-arrow{right:calc(-1 * var(--bs-tooltip-arrow-height));width:var(--bs-tooltip-arrow-height);height:var(--bs-tooltip-arrow-width)}.bs-tooltip-auto[data-popper-placement^=left] .tooltip-arrow::before,.bs-tooltip-start .tooltip-arrow::before{left:-1px;border-width:calc(var(--bs-tooltip-arrow-width) * .5) 0 calc(var(--bs-tooltip-arrow-width) * .5) var(--bs-tooltip-arrow-height);border-left-color:var(--bs-tooltip-bg)}.tooltip-inner{max-width:var(--bs-tooltip-max-width);padding:var(--bs-tooltip-padding-y) var(--bs-tooltip-padding-x);color:var(--bs-tooltip-color);text-align:center;background-color:var(--bs-tooltip-bg);border-radius:var(--bs-tooltip-border-radius)}.popover{--bs-popover-zindex:1070;--bs-popover-max-width:276px;--bs-popover-font-size:0.875rem;--bs-popover-bg:var(--bs-body-bg);--bs-popover-border-width:var(--bs-border-width);--bs-popover-border-color:var(--bs-border-color-translucent);--bs-popover-border-radius:var(--bs-border-radius-lg);--bs-popover-inner-border-radius:calc(var(--bs-border-radius-lg) - var(--bs-border-width));--bs-popover-box-shadow:var(--bs-box-shadow);--bs-popover-header-padding-x:1rem;--bs-popover-header-padding-y:0.5rem;--bs-popover-header-font-size:1rem;--bs-popover-header-color:inherit;--bs-popover-header-bg:var(--bs-secondary-bg);--bs-popover-body-padding-x:1rem;--bs-popover-body-padding-y:1rem;--bs-popover-body-color:var(--bs-body-color);--bs-popover-arrow-width:1rem;--bs-popover-arrow-height:0.5rem;--bs-popover-arrow-border:var(--bs-popover-border-color);z-index:var(--bs-popover-zindex);display:block;max-width:var(--bs-popover-max-width);font-family:var(--bs-font-sans-serif);font-style:normal;font-weight:400;line-height:1.5;text-align:left;text-align:start;text-decoration:none;text-shadow:none;text-transform:none;letter-spacing:normal;word-break:normal;white-space:normal;word-spacing:normal;line-break:auto;font-size:var(--bs-popover-font-size);word-wrap:break-word;background-color:var(--bs-popover-bg);background-clip:padding-box;border:var(--bs-popover-border-width) solid var(--bs-popover-border-color);border-radius:var(--bs-popover-border-radius)}.popover .popover-arrow{display:block;width:var(--bs-popover-arrow-width);height:var(--bs-popover-arrow-height)}.popover .popover-arrow::after,.popover .popover-arrow::before{position:absolute;display:block;content:"";border-color:transparent;border-style:solid;border-width:0}.bs-popover-auto[data-popper-placement^=top]>.popover-arrow,.bs-popover-top>.popover-arrow{bottom:calc(-1 * (var(--bs-popover-arrow-height)) - var(--bs-popover-border-width))}.bs-popover-auto[data-popper-placement^=top]>.popover-arrow::after,.bs-popover-auto[data-popper-placement^=top]>.popover-arrow::before,.bs-popover-top>.popover-arrow::after,.bs-popover-top>.popover-arrow::before{border-width:var(--bs-popover-arrow-height) calc(var(--bs-popover-arrow-width) * .5) 0}.bs-popover-auto[data-popper-placement^=top]>.popover-arrow::before,.bs-popover-top>.popover-arrow::before{bottom:0;border-top-color:var(--bs-popover-arrow-border)}.bs-popover-auto[data-popper-placement^=top]>.popover-arrow::after,.bs-popover-top>.popover-arrow::after{bottom:var(--bs-popover-border-width);border-top-color:var(--bs-popover-bg)}.bs-popover-auto[data-popper-placement^=right]>.popover-arrow,.bs-popover-end>.popover-arrow{left:calc(-1 * (var(--bs-popover-arrow-height)) - var(--bs-popover-border-width));width:var(--bs-popover-arrow-height);height:var(--bs-popover-arrow-width)}.bs-popover-auto[data-popper-placement^=right]>.popover-arrow::after,.bs-popover-auto[data-popper-placement^=right]>.popover-arrow::before,.bs-popover-end>.popover-arrow::after,.bs-popover-end>.popover-arrow::before{border-width:calc(var(--bs-popover-arrow-width) * .5) var(--bs-popover-arrow-height) calc(var(--bs-popover-arrow-width) * .5) 0}.bs-popover-auto[data-popper-placement^=right]>.popover-arrow::before,.bs-popover-end>.popover-arrow::before{left:0;border-right-color:var(--bs-popover-arrow-border)}.bs-popover-auto[data-popper-placement^=right]>.popover-arrow::after,.bs-popover-end>.popover-arrow::after{left:var(--bs-popover-border-width);border-right-color:var(--bs-popover-bg)}.bs-popover-auto[data-popper-placement^=bottom]>.popover-arrow,.bs-popover-bottom>.popover-arrow{top:calc(-1 * (var(--bs-popover-arrow-height)) - var(--bs-popover-border-width))}.bs-popover-auto[data-popper-placement^=bottom]>.popover-arrow::after,.bs-popover-auto[data-popper-placement^=bottom]>.popover-arrow::before,.bs-popover-bottom>.popover-arrow::after,.bs-popover-bottom>.popover-arrow::before{border-width:0 calc(var(--bs-popover-arrow-width) * .5) var(--bs-popover-arrow-height)}.bs-popover-auto[data-popper-placement^=bottom]>.popover-arrow::before,.bs-popover-bottom>.popover-arrow::before{top:0;border-bottom-color:var(--bs-popover-arrow-border)}.bs-popover-auto[data-popper-placement^=bottom]>.popover-arrow::after,.bs-popover-bottom>.popover-arrow::after{top:var(--bs-popover-border-width);border-bottom-color:var(--bs-popover-bg)}.bs-popover-auto[data-popper-placement^=bottom] .popover-header::before,.bs-popover-bottom .popover-header::before{position:absolute;top:0;left:50%;display:block;width:var(--bs-popover-arrow-width);margin-left:calc(-.5 * var(--bs-popover-arrow-width));content:"";border-bottom:var(--bs-popover-border-width) solid var(--bs-popover-header-bg)}.bs-popover-auto[data-popper-placement^=left]>.popover-arrow,.bs-popover-start>.popover-arrow{right:calc(-1 * (var(--bs-popover-arrow-height)) - var(--bs-popover-border-width));width:var(--bs-popover-arrow-height);height:var(--bs-popover-arrow-width)}.bs-popover-auto[data-popper-placement^=left]>.popover-arrow::after,.bs-popover-auto[data-popper-placement^=left]>.popover-arrow::before,.bs-popover-start>.popover-arrow::after,.bs-popover-start>.popover-arrow::before{border-width:calc(var(--bs-popover-arrow-width) * .5) 0 calc(var(--bs-popover-arrow-width) * .5) var(--bs-popover-arrow-height)}.bs-popover-auto[data-popper-placement^=left]>.popover-arrow::before,.bs-popover-start>.popover-arrow::before{right:0;border-left-color:var(--bs-popover-arrow-border)}.bs-popover-auto[data-popper-placement^=left]>.popover-arrow::after,.bs-popover-start>.popover-arrow::after{right:var(--bs-popover-border-width);border-left-color:var(--bs-popover-bg)}.popover-header{padding:var(--bs-popover-header-padding-y) var(--bs-popover-header-padding-x);margin-bottom:0;font-size:var(--bs-popover-header-font-size);color:var(--bs-popover-header-color);background-color:var(--bs-popover-header-bg);border-bottom:var(--bs-popover-border-width) solid var(--bs-popover-border-color);border-top-left-radius:var(--bs-popover-inner-border-radius);border-top-right-radius:var(--bs-popover-inner-border-radius)}.popover-header:empty{display:none}.popover-body{padding:var(--bs-popover-body-padding-y) var(--bs-popover-body-padding-x);color:var(--bs-popover-body-color)}.carousel{position:relative}.carousel.pointer-event{touch-action:pan-y}.carousel-inner{position:relative;width:100%;overflow:hidden}.carousel-inner::after{display:block;clear:both;content:""}.carousel-item{position:relative;display:none;float:left;width:100%;margin-right:-100%;-webkit-backface-visibility:hidden;backface-visibility:hidden;transition:transform .6s ease-in-out}@media (prefers-reduced-motion:reduce){.carousel-item{transition:none}}.carousel-item-next,.carousel-item-prev,.carousel-item.active{display:block}.active.carousel-item-end,.carousel-item-next:not(.carousel-item-start){transform:translateX(100%)}.active.carousel-item-start,.carousel-item-prev:not(.carousel-item-end){transform:translateX(-100%)}.carousel-fade .carousel-item{opacity:0;transition-property:opacity;transform:none}.carousel-fade .carousel-item-next.carousel-item-start,.carousel-fade .carousel-item-prev.carousel-item-end,.carousel-fade .carousel-item.active{z-index:1;opacity:1}.carousel-fade .active.carousel-item-end,.carousel-fade .active.carousel-item-start{z-index:0;opacity:0;transition:opacity 0s .6s}@media (prefers-reduced-motion:reduce){.carousel-fade .active.carousel-item-end,.carousel-fade .active.carousel-item-start{transition:none}}.carousel-control-next,.carousel-control-prev{position:absolute;top:0;bottom:0;z-index:1;display:flex;align-items:center;justify-content:center;width:15%;padding:0;color:#fff;text-align:center;background:0 0;filter:var(--bs-carousel-control-icon-filter);border:0;opacity:.5;transition:opacity .15s ease}@media (prefers-reduced-motion:reduce){.carousel-control-next,.carousel-control-prev{transition:none}}.carousel-control-next:focus,.carousel-control-next:hover,.carousel-control-prev:focus,.carousel-control-prev:hover{color:#fff;text-decoration:none;outline:0;opacity:.9}.carousel-control-prev{left:0}.carousel-control-next{right:0}.carousel-control-next-icon,.carousel-control-prev-icon{display:inline-block;width:2rem;height:2rem;background-repeat:no-repeat;background-position:50%;background-size:100% 100%}.carousel-control-prev-icon{background-image:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='%23fff'%3e%3cpath d='M11.354 1.646a.5.5 0 0 1 0 .708L5.707 8l5.647 5.646a.5.5 0 0 1-.708.708l-6-6a.5.5 0 0 1 0-.708l6-6a.5.5 0 0 1 .708 0'/%3e%3c/svg%3e")}.carousel-control-next-icon{background-image:url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='%23fff'%3e%3cpath d='M4.646 1.646a.5.5 0 0 1 .708 0l6 6a.5.5 0 0 1 0 .708l-6 6a.5.5 0 0 1-.708-.708L10.293 8 4.646 2.354a.5.5 0 0 1 0-.708'/%3e%3c/svg%3e")}.carousel-indicators{position:absolute;right:0;bottom:0;left:0;z-index:2;display:flex;justify-content:center;padding:0;margin-right:15%;margin-bottom:1rem;margin-left:15%}.carousel-indicators [data-bs-target]{box-sizing:content-box;flex:0 1 auto;width:30px;height:3px;padding:0;margin-right:3px;margin-left:3px;text-indent:-999px;cursor:pointer;background-color:var(--bs-carousel-indicator-active-bg);background-clip:padding-box;border:0;border-top:10px solid transparent;border-bottom:10px solid transparent;opacity:.5;transition:opacity .6s ease}@media (prefers-reduced-motion:reduce){.carousel-indicators [data-bs-target]{transition:none}}.carousel-indicators .active{opacity:1}.carousel-caption{position:absolute;right:15%;bottom:1.25rem;left:15%;padding-top:1.25rem;padding-bottom:1.25rem;color:var(--bs-carousel-caption-color);text-align:center}.carousel-dark{--bs-carousel-indicator-active-bg:#000;--bs-carousel-caption-color:#000;--bs-carousel-control-icon-filter:invert(1) grayscale(100)}:root,[data-bs-theme=light]{--bs-carousel-indicator-active-bg:#fff;--bs-carousel-caption-color:#fff;--bs-carousel-control-icon-filter: }[data-bs-theme=dark]{--bs-carousel-indicator-active-bg:#000;--bs-carousel-caption-color:#000;--bs-carousel-control-icon-filter:invert(1) grayscale(100)}.spinner-border,.spinner-grow{display:inline-block;flex-shrink:0;width:var(--bs-spinner-width);height:var(--bs-spinner-height);vertical-align:var(--bs-spinner-vertical-align);border-radius:50%;animation:var(--bs-spinner-animation-speed) linear infinite var(--bs-spinner-animation-name)}@keyframes spinner-border{to{transform:rotate(360deg)}}.spinner-border{--bs-spinner-width:2rem;--bs-spinner-height:2rem;--bs-spinner-vertical-align:-0.125em;--bs-spinner-border-width:0.25em;--bs-spinner-animation-speed:0.75s;--bs-spinner-animation-name:spinner-border;border:var(--bs-spinner-border-width) solid currentcolor;border-right-color:transparent}.spinner-border-sm{--bs-spinner-width:1rem;--bs-spinner-height:1rem;--bs-spinner-border-width:0.2em}@keyframes spinner-grow{0%{transform:scale(0)}50%{opacity:1;transform:none}}.spinner-grow{--bs-spinner-width:2rem;--bs-spinner-height:2rem;--bs-spinner-vertical-align:-0.125em;--bs-spinner-animation-speed:0.75s;--bs-spinner-animation-name:spinner-grow;background-color:currentcolor;opacity:0}.spinner-grow-sm{--bs-spinner-width:1rem;--bs-spinner-height:1rem}@media (prefers-reduced-motion:reduce){.spinner-border,.spinner-grow{--bs-spinner-animation-speed:1.5s}}.offcanvas,.offcanvas-lg,.offcanvas-md,.offcanvas-sm,.offcanvas-xl,.offcanvas-xxl{--bs-offcanvas-zindex:1045;--bs-offcanvas-width:400px;--bs-offcanvas-height:30vh;--bs-offcanvas-padding-x:1rem;--bs-offcanvas-padding-y:1rem;--bs-offcanvas-color:var(--bs-body-color);--bs-offcanvas-bg:var(--bs-body-bg);--bs-offcanvas-border-width:var(--bs-border-width);--bs-offcanvas-border-color:var(--bs-border-color-translucent);--bs-offcanvas-box-shadow:var(--bs-box-shadow-sm);--bs-offcanvas-transition:transform 0.3s ease-in-out;--bs-offcanvas-title-line-height:1.5}@media (max-width:575.98px){.offcanvas-sm{position:fixed;bottom:0;z-index:var(--bs-offcanvas-zindex);display:flex;flex-direction:column;max-width:100%;color:var(--bs-offcanvas-color);visibility:hidden;background-color:var(--bs-offcanvas-bg);background-clip:padding-box;outline:0;transition:var(--bs-offcanvas-transition)}}@media (max-width:575.98px) and (prefers-reduced-motion:reduce){.offcanvas-sm{transition:none}}@media (max-width:575.98px){.offcanvas-sm.offcanvas-start{top:0;left:0;width:var(--bs-offcanvas-width);border-right:var(--bs-offcanvas-border-width) solid var(--bs-offcanvas-border-color);transform:translateX(-100%)}.offcanvas-sm.offcanvas-end{top:0;right:0;width:var(--bs-offcanvas-width);border-left:var(--bs-offcanvas-border-width) solid var(--bs-offcanvas-border-color);transform:translateX(100%)}.offcanvas-sm.offcanvas-top{top:0;right:0;left:0;height:var(--bs-offcanvas-height);max-height:100%;border-bottom:var(--bs-offcanvas-border-width) solid var(--bs-offcanvas-border-color);transform:translateY(-100%)}.offcanvas-sm.offcanvas-bottom{right:0;left:0;height:var(--bs-offcanvas-height);max-height:100%;border-top:var(--bs-offcanvas-border-width) solid var(--bs-offcanvas-border-color);transform:translateY(100%)}.offcanvas-sm.show:not(.hiding),.offcanvas-sm.showing{transform:none}.offcanvas-sm.hiding,.offcanvas-sm.show,.offcanvas-sm.showing{visibility:visible}}@media (min-width:576px){.offcanvas-sm{--bs-offcanvas-height:auto;--bs-offcanvas-border-width:0;background-color:transparent!important}.offcanvas-sm .offcanvas-header{display:none}.offcanvas-sm .offcanvas-body{display:flex;flex-grow:0;padding:0;overflow-y:visible;background-color:transparent!important}}@media (max-width:767.98px){.offcanvas-md{position:fixed;bottom:0;z-index:var(--bs-offcanvas-zindex);display:flex;flex-direction:column;max-width:100%;color:var(--bs-offcanvas-color);visibility:hidden;background-color:var(--bs-offcanvas-bg);background-clip:padding-box;outline:0;transition:var(--bs-offcanvas-transition)}}@media (max-width:767.98px) and (prefers-reduced-motion:reduce){.offcanvas-md{transition:none}}@media (max-width:767.98px){.offcanvas-md.offcanvas-start{top:0;left:0;width:var(--bs-offcanvas-width);border-right:var(--bs-offcanvas-border-width) solid var(--bs-offcanvas-border-color);transform:translateX(-100%)}.offcanvas-md.offcanvas-end{top:0;right:0;width:var(--bs-offcanvas-width);border-left:var(--bs-offcanvas-border-width) solid var(--bs-offcanvas-border-color);transform:translateX(100%)}.offcanvas-md.offcanvas-top{top:0;right:0;left:0;height:var(--bs-offcanvas-height);max-height:100%;border-bottom:var(--bs-offcanvas-border-width) solid var(--bs-offcanvas-border-color);transform:translateY(-100%)}.offcanvas-md.offcanvas-bottom{right:0;left:0;height:var(--bs-offcanvas-height);max-height:100%;border-top:var(--bs-offcanvas-border-width) solid var(--bs-offcanvas-border-color);transform:translateY(100%)}.offcanvas-md.show:not(.hiding),.offcanvas-md.showing{transform:none}.offcanvas-md.hiding,.offcanvas-md.show,.offcanvas-md.showing{visibility:visible}}@media (min-width:768px){.offcanvas-md{--bs-offcanvas-height:auto;--bs-offcanvas-border-width:0;background-color:transparent!important}.offcanvas-md .offcanvas-header{display:none}.offcanvas-md .offcanvas-body{display:flex;flex-grow:0;padding:0;overflow-y:visible;background-color:transparent!important}}@media (max-width:991.98px){.offcanvas-lg{position:fixed;bottom:0;z-index:var(--bs-offcanvas-zindex);display:flex;flex-direction:column;max-width:100%;color:var(--bs-offcanvas-color);visibility:hidden;background-color:var(--bs-offcanvas-bg);background-clip:padding-box;outline:0;transition:var(--bs-offcanvas-transition)}}@media (max-width:991.98px) and (prefers-reduced-motion:reduce){.offcanvas-lg{transition:none}}@media (max-width:991.98px){.offcanvas-lg.offcanvas-start{top:0;left:0;width:var(--bs-offcanvas-width);border-right:var(--bs-offcanvas-border-width) solid var(--bs-offcanvas-border-color);transform:translateX(-100%)}.offcanvas-lg.offcanvas-end{top:0;right:0;width:var(--bs-offcanvas-width);border-left:var(--bs-offcanvas-border-width) solid var(--bs-offcanvas-border-color);transform:translateX(100%)}.offcanvas-lg.offcanvas-top{top:0;right:0;left:0;height:var(--bs-offcanvas-height);max-height:100%;border-bottom:var(--bs-offcanvas-border-width) solid var(--bs-offcanvas-border-color);transform:translateY(-100%)}.offcanvas-lg.offcanvas-bottom{right:0;left:0;height:var(--bs-offcanvas-height);max-height:100%;border-top:var(--bs-offcanvas-border-width) solid var(--bs-offcanvas-border-color);transform:translateY(100%)}.offcanvas-lg.show:not(.hiding),.offcanvas-lg.showing{transform:none}.offcanvas-lg.hiding,.offcanvas-lg.show,.offcanvas-lg.showing{visibility:visible}}@media (min-width:992px){.offcanvas-lg{--bs-offcanvas-height:auto;--bs-offcanvas-border-width:0;background-color:transparent!important}.offcanvas-lg .offcanvas-header{display:none}.offcanvas-lg .offcanvas-body{display:flex;flex-grow:0;padding:0;overflow-y:visible;background-color:transparent!important}}@media (max-width:1199.98px){.offcanvas-xl{position:fixed;bottom:0;z-index:var(--bs-offcanvas-zindex);display:flex;flex-direction:column;max-width:100%;color:var(--bs-offcanvas-color);visibility:hidden;background-color:var(--bs-offcanvas-bg);background-clip:padding-box;outline:0;transition:var(--bs-offcanvas-transition)}}@media (max-width:1199.98px) and (prefers-reduced-motion:reduce){.offcanvas-xl{transition:none}}@media (max-width:1199.98px){.offcanvas-xl.offcanvas-start{top:0;left:0;width:var(--bs-offcanvas-width);border-right:var(--bs-offcanvas-border-width) solid var(--bs-offcanvas-border-color);transform:translateX(-100%)}.offcanvas-xl.offcanvas-end{top:0;right:0;width:var(--bs-offcanvas-width);border-left:var(--bs-offcanvas-border-width) solid var(--bs-offcanvas-border-color);transform:translateX(100%)}.offcanvas-xl.offcanvas-top{top:0;right:0;left:0;height:var(--bs-offcanvas-height);max-height:100%;border-bottom:var(--bs-offcanvas-border-width) solid var(--bs-offcanvas-border-color);transform:translateY(-100%)}.offcanvas-xl.offcanvas-bottom{right:0;left:0;height:var(--bs-offcanvas-height);max-height:100%;border-top:var(--bs-offcanvas-border-width) solid var(--bs-offcanvas-border-color);transform:translateY(100%)}.offcanvas-xl.show:not(.hiding),.offcanvas-xl.showing{transform:none}.offcanvas-xl.hiding,.offcanvas-xl.show,.offcanvas-xl.showing{visibility:visible}}@media (min-width:1200px){.offcanvas-xl{--bs-offcanvas-height:auto;--bs-offcanvas-border-width:0;background-color:transparent!important}.offcanvas-xl .offcanvas-header{display:none}.offcanvas-xl .offcanvas-body{display:flex;flex-grow:0;padding:0;overflow-y:visible;background-color:transparent!important}}@media (max-width:1399.98px){.offcanvas-xxl{position:fixed;bottom:0;z-index:var(--bs-offcanvas-zindex);display:flex;flex-direction:column;max-width:100%;color:var(--bs-offcanvas-color);visibility:hidden;background-color:var(--bs-offcanvas-bg);background-clip:padding-box;outline:0;transition:var(--bs-offcanvas-transition)}}@media (max-width:1399.98px) and (prefers-reduced-motion:reduce){.offcanvas-xxl{transition:none}}@media (max-width:1399.98px){.offcanvas-xxl.offcanvas-start{top:0;left:0;width:var(--bs-offcanvas-width);border-right:var(--bs-offcanvas-border-width) solid var(--bs-offcanvas-border-color);transform:translateX(-100%)}.offcanvas-xxl.offcanvas-end{top:0;right:0;width:var(--bs-offcanvas-width);border-left:var(--bs-offcanvas-border-width) solid var(--bs-offcanvas-border-color);transform:translateX(100%)}.offcanvas-xxl.offcanvas-top{top:0;right:0;left:0;height:var(--bs-offcanvas-height);max-height:100%;border-bottom:var(--bs-offcanvas-border-width) solid var(--bs-offcanvas-border-color);transform:translateY(-100%)}.offcanvas-xxl.offcanvas-bottom{right:0;left:0;height:var(--bs-offcanvas-height);max-height:100%;border-top:var(--bs-offcanvas-border-width) solid var(--bs-offcanvas-border-color);transform:translateY(100%)}.offcanvas-xxl.show:not(.hiding),.offcanvas-xxl.showing{transform:none}.offcanvas-xxl.hiding,.offcanvas-xxl.show,.offcanvas-xxl.showing{visibility:visible}}@media (min-width:1400px){.offcanvas-xxl{--bs-offcanvas-height:auto;--bs-offcanvas-border-width:0;background-color:transparent!important}.offcanvas-xxl .offcanvas-header{display:none}.offcanvas-xxl .offcanvas-body{display:flex;flex-grow:0;padding:0;overflow-y:visible;background-color:transparent!important}}.offcanvas{position:fixed;bottom:0;z-index:var(--bs-offcanvas-zindex);display:flex;flex-direction:column;max-width:100%;color:var(--bs-offcanvas-color);visibility:hidden;background-color:var(--bs-offcanvas-bg);background-clip:padding-box;outline:0;transition:var(--bs-offcanvas-transition)}@media (prefers-reduced-motion:reduce){.offcanvas{transition:none}}.offcanvas.offcanvas-start{top:0;left:0;width:var(--bs-offcanvas-width);border-right:var(--bs-offcanvas-border-width) solid var(--bs-offcanvas-border-color);transform:translateX(-100%)}.offcanvas.offcanvas-end{top:0;right:0;width:var(--bs-offcanvas-width);border-left:var(--bs-offcanvas-border-width) solid var(--bs-offcanvas-border-color);transform:translateX(100%)}.offcanvas.offcanvas-top{top:0;right:0;left:0;height:var(--bs-offcanvas-height);max-height:100%;border-bottom:var(--bs-offcanvas-border-width) solid var(--bs-offcanvas-border-color);transform:translateY(-100%)}.offcanvas.offcanvas-bottom{right:0;left:0;height:var(--bs-offcanvas-height);max-height:100%;border-top:var(--bs-offcanvas-border-width) solid var(--bs-offcanvas-border-color);transform:translateY(100%)}.offcanvas.show:not(.hiding),.offcanvas.showing{transform:none}.offcanvas.hiding,.offcanvas.show,.offcanvas.showing{visibility:visible}.offcanvas-backdrop{position:fixed;top:0;left:0;z-index:1040;width:100vw;height:100vh;background-color:#000}.offcanvas-backdrop.fade{opacity:0}.offcanvas-backdrop.show{opacity:.5}.offcanvas-header{display:flex;align-items:center;padding:var(--bs-offcanvas-padding-y) var(--bs-offcanvas-padding-x)}.offcanvas-header .btn-close{padding:calc(var(--bs-offcanvas-padding-y) * .5) calc(var(--bs-offcanvas-padding-x) * .5);margin-top:calc(-.5 * var(--bs-offcanvas-padding-y));margin-right:calc(-.5 * var(--bs-offcanvas-padding-x));margin-bottom:calc(-.5 * var(--bs-offcanvas-padding-y));margin-left:auto}.offcanvas-title{margin-bottom:0;line-height:var(--bs-offcanvas-title-line-height)}.offcanvas-body{flex-grow:1;padding:var(--bs-offcanvas-padding-y) var(--bs-offcanvas-padding-x);overflow-y:auto}.placeholder{display:inline-block;min-height:1em;vertical-align:middle;cursor:wait;background-color:currentcolor;opacity:.5}.placeholder.btn::before{display:inline-block;content:""}.placeholder-xs{min-height:.6em}.placeholder-sm{min-height:.8em}.placeholder-lg{min-height:1.2em}.placeholder-glow .placeholder{animation:placeholder-glow 2s ease-in-out infinite}@keyframes placeholder-glow{50%{opacity:.2}}.placeholder-wave{-webkit-mask-image:linear-gradient(130deg,#000 55%,rgba(0,0,0,0.8) 75%,#000 95%);mask-image:linear-gradient(130deg,#000 55%,rgba(0,0,0,0.8) 75%,#000 95%);-webkit-mask-size:200% 100%;mask-size:200% 100%;animation:placeholder-wave 2s linear infinite}@keyframes placeholder-wave{100%{-webkit-mask-position:-200% 0%;mask-position:-200% 0%}}.clearfix::after{display:block;clear:both;content:""}.text-bg-primary{color:#fff!important;background-color:RGBA(var(--bs-primary-rgb),var(--bs-bg-opacity,1))!important}.text-bg-secondary{color:#fff!important;background-color:RGBA(var(--bs-secondary-rgb),var(--bs-bg-opacity,1))!important}.text-bg-success{color:#fff!important;background-color:RGBA(var(--bs-success-rgb),var(--bs-bg-opacity,1))!important}.text-bg-info{color:#000!important;background-color:RGBA(var(--bs-info-rgb),var(--bs-bg-opacity,1))!important}.text-bg-warning{color:#000!important;background-color:RGBA(var(--bs-warning-rgb),var(--bs-bg-opacity,1))!important}.text-bg-danger{color:#fff!important;background-color:RGBA(var(--bs-danger-rgb),var(--bs-bg-opacity,1))!important}.text-bg-light{color:#000!important;background-color:RGBA(var(--bs-light-rgb),var(--bs-bg-opacity,1))!important}.text-bg-dark{color:#fff!important;background-color:RGBA(var(--bs-dark-rgb),var(--bs-bg-opacity,1))!important}.link-primary{color:RGBA(var(--bs-primary-rgb),var(--bs-link-opacity,1))!important;-webkit-text-decoration-color:RGBA(var(--bs-primary-rgb),var(--bs-link-underline-opacity,1))!important;text-decoration-color:RGBA(var(--bs-primary-rgb),var(--bs-link-underline-opacity,1))!important}.link-primary:focus,.link-primary:hover{color:RGBA(10,88,202,var(--bs-link-opacity,1))!important;-webkit-text-decoration-color:RGBA(10,88,202,var(--bs-link-underline-opacity,1))!important;text-decoration-color:RGBA(10,88,202,var(--bs-link-underline-opacity,1))!important}.link-secondary{color:RGBA(var(--bs-secondary-rgb),var(--bs-link-opacity,1))!important;-webkit-text-decoration-color:RGBA(var(--bs-secondary-rgb),var(--bs-link-underline-opacity,1))!important;text-decoration-color:RGBA(var(--bs-secondary-rgb),var(--bs-link-underline-opacity,1))!important}.link-secondary:focus,.link-secondary:hover{color:RGBA(86,94,100,var(--bs-link-opacity,1))!important;-webkit-text-decoration-color:RGBA(86,94,100,var(--bs-link-underline-opacity,1))!important;text-decoration-color:RGBA(86,94,100,var(--bs-link-underline-opacity,1))!important}.link-success{color:RGBA(var(--bs-success-rgb),var(--bs-link-opacity,1))!important;-webkit-text-decoration-color:RGBA(var(--bs-success-rgb),var(--bs-link-underline-opacity,1))!important;text-decoration-color:RGBA(var(--bs-success-rgb),var(--bs-link-underline-opacity,1))!important}.link-success:focus,.link-success:hover{color:RGBA(20,108,67,var(--bs-link-opacity,1))!important;-webkit-text-decoration-color:RGBA(20,108,67,var(--bs-link-underline-opacity,1))!important;text-decoration-color:RGBA(20,108,67,var(--bs-link-underline-opacity,1))!important}.link-info{color:RGBA(var(--bs-info-rgb),var(--bs-link-opacity,1))!important;-webkit-text-decoration-color:RGBA(var(--bs-info-rgb),var(--bs-link-underline-opacity,1))!important;text-decoration-color:RGBA(var(--bs-info-rgb),var(--bs-link-underline-opacity,1))!important}.link-info:focus,.link-info:hover{color:RGBA(61,213,243,var(--bs-link-opacity,1))!important;-webkit-text-decoration-color:RGBA(61,213,243,var(--bs-link-underline-opacity,1))!important;text-decoration-color:RGBA(61,213,243,var(--bs-link-underline-opacity,1))!important}.link-warning{color:RGBA(var(--bs-warning-rgb),var(--bs-link-opacity,1))!important;-webkit-text-decoration-color:RGBA(var(--bs-warning-rgb),var(--bs-link-underline-opacity,1))!important;text-decoration-color:RGBA(var(--bs-warning-rgb),var(--bs-link-underline-opacity,1))!important}.link-warning:focus,.link-warning:hover{color:RGBA(255,205,57,var(--bs-link-opacity,1))!important;-webkit-text-decoration-color:RGBA(255,205,57,var(--bs-link-underline-opacity,1))!important;text-decoration-color:RGBA(255,205,57,var(--bs-link-underline-opacity,1))!important}.link-danger{color:RGBA(var(--bs-danger-rgb),var(--bs-link-opacity,1))!important;-webkit-text-decoration-color:RGBA(var(--bs-danger-rgb),var(--bs-link-underline-opacity,1))!important;text-decoration-color:RGBA(var(--bs-danger-rgb),var(--bs-link-underline-opacity,1))!important}.link-danger:focus,.link-danger:hover{color:RGBA(176,42,55,var(--bs-link-opacity,1))!important;-webkit-text-decoration-color:RGBA(176,42,55,var(--bs-link-underline-opacity,1))!important;text-decoration-color:RGBA(176,42,55,var(--bs-link-underline-opacity,1))!important}.link-light{color:RGBA(var(--bs-light-rgb),var(--bs-link-opacity,1))!important;-webkit-text-decoration-color:RGBA(var(--bs-light-rgb),var(--bs-link-underline-opacity,1))!important;text-decoration-color:RGBA(var(--bs-light-rgb),var(--bs-link-underline-opacity,1))!important}.link-light:focus,.link-light:hover{color:RGBA(249,250,251,var(--bs-link-opacity,1))!important;-webkit-text-decoration-color:RGBA(249,250,251,var(--bs-link-underline-opacity,1))!important;text-decoration-color:RGBA(249,250,251,var(--bs-link-underline-opacity,1))!important}.link-dark{color:RGBA(var(--bs-dark-rgb),var(--bs-link-opacity,1))!important;-webkit-text-decoration-color:RGBA(var(--bs-dark-rgb),var(--bs-link-underline-opacity,1))!important;text-decoration-color:RGBA(var(--bs-dark-rgb),var(--bs-link-underline-opacity,1))!important}.link-dark:focus,.link-dark:hover{color:RGBA(26,30,33,var(--bs-link-opacity,1))!important;-webkit-text-decoration-color:RGBA(26,30,33,var(--bs-link-underline-opacity,1))!important;text-decoration-color:RGBA(26,30,33,var(--bs-link-underline-opacity,1))!important}.link-body-emphasis{color:RGBA(var(--bs-emphasis-color-rgb),var(--bs-link-opacity,1))!important;-webkit-text-decoration-color:RGBA(var(--bs-emphasis-color-rgb),var(--bs-link-underline-opacity,1))!important;text-decoration-color:RGBA(var(--bs-emphasis-color-rgb),var(--bs-link-underline-opacity,1))!important}.link-body-emphasis:focus,.link-body-emphasis:hover{color:RGBA(var(--bs-emphasis-color-rgb),var(--bs-link-opacity,.75))!important;-webkit-text-decoration-color:RGBA(var(--bs-emphasis-color-rgb),var(--bs-link-underline-opacity,0.75))!important;text-decoration-color:RGBA(var(--bs-emphasis-color-rgb),var(--bs-link-underline-opacity,0.75))!important}.focus-ring:focus{outline:0;box-shadow:var(--bs-focus-ring-x,0) var(--bs-focus-ring-y,0) var(--bs-focus-ring-blur,0) var(--bs-focus-ring-width) var(--bs-focus-ring-color)}.icon-link{display:inline-flex;gap:.375rem;align-items:center;-webkit-text-decoration-color:rgba(var(--bs-link-color-rgb),var(--bs-link-opacity,0.5));text-decoration-color:rgba(var(--bs-link-color-rgb),var(--bs-link-opacity,0.5));text-underline-offset:0.25em;-webkit-backface-visibility:hidden;backface-visibility:hidden}.icon-link>.bi{flex-shrink:0;width:1em;height:1em;fill:currentcolor;transition:.2s ease-in-out transform}@media (prefers-reduced-motion:reduce){.icon-link>.bi{transition:none}}.icon-link-hover:focus-visible>.bi,.icon-link-hover:hover>.bi{transform:var(--bs-icon-link-transform,translate3d(.25em,0,0))}.ratio{position:relative;width:100%}.ratio::before{display:block;padding-top:var(--bs-aspect-ratio);content:""}.ratio>*{position:absolute;top:0;left:0;width:100%;height:100%}.ratio-1x1{--bs-aspect-ratio:100%}.ratio-4x3{--bs-aspect-ratio:75%}.ratio-16x9{--bs-aspect-ratio:56.25%}.ratio-21x9{--bs-aspect-ratio:42.8571428571%}.fixed-top{position:fixed;top:0;right:0;left:0;z-index:1030}.fixed-bottom{position:fixed;right:0;bottom:0;left:0;z-index:1030}.sticky-top{position:-webkit-sticky;position:sticky;top:0;z-index:1020}.sticky-bottom{position:-webkit-sticky;position:sticky;bottom:0;z-index:1020}@media (min-width:576px){.sticky-sm-top{position:-webkit-sticky;position:sticky;top:0;z-index:1020}.sticky-sm-bottom{position:-webkit-sticky;position:sticky;bottom:0;z-index:1020}}@media (min-width:768px){.sticky-md-top{position:-webkit-sticky;position:sticky;top:0;z-index:1020}.sticky-md-bottom{position:-webkit-sticky;position:sticky;bottom:0;z-index:1020}}@media (min-width:992px){.sticky-lg-top{position:-webkit-sticky;position:sticky;top:0;z-index:1020}.sticky-lg-bottom{position:-webkit-sticky;position:sticky;bottom:0;z-index:1020}}@media (min-width:1200px){.sticky-xl-top{position:-webkit-sticky;position:sticky;top:0;z-index:1020}.sticky-xl-bottom{position:-webkit-sticky;position:sticky;bottom:0;z-index:1020}}@media (min-width:1400px){.sticky-xxl-top{position:-webkit-sticky;position:sticky;top:0;z-index:1020}.sticky-xxl-bottom{position:-webkit-sticky;position:sticky;bottom:0;z-index:1020}}.hstack{display:flex;flex-direction:row;align-items:center;align-self:stretch}.vstack{display:flex;flex:1 1 auto;flex-direction:column;align-self:stretch}.visually-hidden,.visually-hidden-focusable:not(:focus):not(:focus-within){width:1px!important;height:1px!important;padding:0!important;margin:-1px!important;overflow:hidden!important;clip:rect(0,0,0,0)!important;white-space:nowrap!important;border:0!important}.visually-hidden-focusable:not(:focus):not(:focus-within):not(caption),.visually-hidden:not(caption){position:absolute!important}.visually-hidden *,.visually-hidden-focusable:not(:focus):not(:focus-within) *{overflow:hidden!important}.stretched-link::after{position:absolute;top:0;right:0;bottom:0;left:0;z-index:1;content:""}.text-truncate{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.vr{display:inline-block;align-self:stretch;width:var(--bs-border-width);min-height:1em;background-color:currentcolor;opacity:.25}.align-baseline{vertical-align:baseline!important}.align-top{vertical-align:top!important}.align-middle{vertical-align:middle!important}.align-bottom{vertical-align:bottom!important}.align-text-bottom{vertical-align:text-bottom!important}.align-text-top{vertical-align:text-top!important}.float-start{float:left!important}.float-end{float:right!important}.float-none{float:none!important}.object-fit-contain{-o-object-fit:contain!important;object-fit:contain!important}.object-fit-cover{-o-object-fit:cover!important;object-fit:cover!important}.object-fit-fill{-o-object-fit:fill!important;object-fit:fill!important}.object-fit-scale{-o-object-fit:scale-down!important;object-fit:scale-down!important}.object-fit-none{-o-object-fit:none!important;object-fit:none!important}.opacity-0{opacity:0!important}.opacity-25{opacity:.25!important}.opacity-50{opacity:.5!important}.opacity-75{opacity:.75!important}.opacity-100{opacity:1!important}.overflow-auto{overflow:auto!important}.overflow-hidden{overflow:hidden!important}.overflow-visible{overflow:visible!important}.overflow-scroll{overflow:scroll!important}.overflow-x-auto{overflow-x:auto!important}.overflow-x-hidden{overflow-x:hidden!important}.overflow-x-visible{overflow-x:visible!important}.overflow-x-scroll{overflow-x:scroll!important}.overflow-y-auto{overflow-y:auto!important}.overflow-y-hidden{overflow-y:hidden!important}.overflow-y-visible{overflow-y:visible!important}.overflow-y-scroll{overflow-y:scroll!important}.d-inline{display:inline!important}.d-inline-block{display:inline-block!important}.d-block{display:block!important}.d-grid{display:grid!important}.d-inline-grid{display:inline-grid!important}.d-table{display:table!important}.d-table-row{display:table-row!important}.d-table-cell{display:table-cell!important}.d-flex{display:flex!important}.d-inline-flex{display:inline-flex!important}.d-none{display:none!important}.shadow{box-shadow:var(--bs-box-shadow)!important}.shadow-sm{box-shadow:var(--bs-box-shadow-sm)!important}.shadow-lg{box-shadow:var(--bs-box-shadow-lg)!important}.shadow-none{box-shadow:none!important}.focus-ring-primary{--bs-focus-ring-color:rgba(var(--bs-primary-rgb), var(--bs-focus-ring-opacity))}.focus-ring-secondary{--bs-focus-ring-color:rgba(var(--bs-secondary-rgb), var(--bs-focus-ring-opacity))}.focus-ring-success{--bs-focus-ring-color:rgba(var(--bs-success-rgb), var(--bs-focus-ring-opacity))}.focus-ring-info{--bs-focus-ring-color:rgba(var(--bs-info-rgb), var(--bs-focus-ring-opacity))}.focus-ring-warning{--bs-focus-ring-color:rgba(var(--bs-warning-rgb), var(--bs-focus-ring-opacity))}.focus-ring-danger{--bs-focus-ring-color:rgba(var(--bs-danger-rgb), var(--bs-focus-ring-opacity))}.focus-ring-light{--bs-focus-ring-color:rgba(var(--bs-light-rgb), var(--bs-focus-ring-opacity))}.focus-ring-dark{--bs-focus-ring-color:rgba(var(--bs-dark-rgb), var(--bs-focus-ring-opacity))}.position-static{position:static!important}.position-relative{position:relative!important}.position-absolute{position:absolute!important}.position-fixed{position:fixed!important}.position-sticky{position:-webkit-sticky!important;position:sticky!important}.top-0{top:0!important}.top-50{top:50%!important}.top-100{top:100%!important}.bottom-0{bottom:0!important}.bottom-50{bottom:50%!important}.bottom-100{bottom:100%!important}.start-0{left:0!important}.start-50{left:50%!important}.start-100{left:100%!important}.end-0{right:0!important}.end-50{right:50%!important}.end-100{right:100%!important}.translate-middle{transform:translate(-50%,-50%)!important}.translate-middle-x{transform:translateX(-50%)!important}.translate-middle-y{transform:translateY(-50%)!important}.border{border:var(--bs-border-width) var(--bs-border-style) var(--bs-border-color)!important}.border-0{border:0!important}.border-top{border-top:var(--bs-border-width) var(--bs-border-style) var(--bs-border-color)!important}.border-top-0{border-top:0!important}.border-end{border-right:var(--bs-border-width) var(--bs-border-style) var(--bs-border-color)!important}.border-end-0{border-right:0!important}.border-bottom{border-bottom:var(--bs-border-width) var(--bs-border-style) var(--bs-border-color)!important}.border-bottom-0{border-bottom:0!important}.border-start{border-left:var(--bs-border-width) var(--bs-border-style) var(--bs-border-color)!important}.border-start-0{border-left:0!important}.border-primary{--bs-border-opacity:1;border-color:rgba(var(--bs-primary-rgb),var(--bs-border-opacity))!important}.border-secondary{--bs-border-opacity:1;border-color:rgba(var(--bs-secondary-rgb),var(--bs-border-opacity))!important}.border-success{--bs-border-opacity:1;border-color:rgba(var(--bs-success-rgb),var(--bs-border-opacity))!important}.border-info{--bs-border-opacity:1;border-color:rgba(var(--bs-info-rgb),var(--bs-border-opacity))!important}.border-warning{--bs-border-opacity:1;border-color:rgba(var(--bs-warning-rgb),var(--bs-border-opacity))!important}.border-danger{--bs-border-opacity:1;border-color:rgba(var(--bs-danger-rgb),var(--bs-border-opacity))!important}.border-light{--bs-border-opacity:1;border-color:rgba(var(--bs-light-rgb),var(--bs-border-opacity))!important}.border-dark{--bs-border-opacity:1;border-color:rgba(var(--bs-dark-rgb),var(--bs-border-opacity))!important}.border-black{--bs-border-opacity:1;border-color:rgba(var(--bs-black-rgb),var(--bs-border-opacity))!important}.border-white{--bs-border-opacity:1;border-color:rgba(var(--bs-white-rgb),var(--bs-border-opacity))!important}.border-primary-subtle{border-color:var(--bs-primary-border-subtle)!important}.border-secondary-subtle{border-color:var(--bs-secondary-border-subtle)!important}.border-success-subtle{border-color:var(--bs-success-border-subtle)!important}.border-info-subtle{border-color:var(--bs-info-border-subtle)!important}.border-warning-subtle{border-color:var(--bs-warning-border-subtle)!important}.border-danger-subtle{border-color:var(--bs-danger-border-subtle)!important}.border-light-subtle{border-color:var(--bs-light-border-subtle)!important}.border-dark-subtle{border-color:var(--bs-dark-border-subtle)!important}.border-1{border-width:1px!important}.border-2{border-width:2px!important}.border-3{border-width:3px!important}.border-4{border-width:4px!important}.border-5{border-width:5px!important}.border-opacity-10{--bs-border-opacity:0.1}.border-opacity-25{--bs-border-opacity:0.25}.border-opacity-50{--bs-border-opacity:0.5}.border-opacity-75{--bs-border-opacity:0.75}.border-opacity-100{--bs-border-opacity:1}.w-25{width:25%!important}.w-50{width:50%!important}.w-75{width:75%!important}.w-100{width:100%!important}.w-auto{width:auto!important}.mw-100{max-width:100%!important}.vw-100{width:100vw!important}.min-vw-100{min-width:100vw!important}.h-25{height:25%!important}.h-50{height:50%!important}.h-75{height:75%!important}.h-100{height:100%!important}.h-auto{height:auto!important}.mh-100{max-height:100%!important}.vh-100{height:100vh!important}.min-vh-100{min-height:100vh!important}.flex-fill{flex:1 1 auto!important}.flex-row{flex-direction:row!important}.flex-column{flex-direction:column!important}.flex-row-reverse{flex-direction:row-reverse!important}.flex-column-reverse{flex-direction:column-reverse!important}.flex-grow-0{flex-grow:0!important}.flex-grow-1{flex-grow:1!important}.flex-shrink-0{flex-shrink:0!important}.flex-shrink-1{flex-shrink:1!important}.flex-wrap{flex-wrap:wrap!important}.flex-nowrap{flex-wrap:nowrap!important}.flex-wrap-reverse{flex-wrap:wrap-reverse!important}.justify-content-start{justify-content:flex-start!important}.justify-content-end{justify-content:flex-end!important}.justify-content-center{justify-content:center!important}.justify-content-between{justify-content:space-between!important}.justify-content-around{justify-content:space-around!important}.justify-content-evenly{justify-content:space-evenly!important}.align-items-start{align-items:flex-start!important}.align-items-end{align-items:flex-end!important}.align-items-center{align-items:center!important}.align-items-baseline{align-items:baseline!important}.align-items-stretch{align-items:stretch!important}.align-content-start{align-content:flex-start!important}.align-content-end{align-content:flex-end!important}.align-content-center{align-content:center!important}.align-content-between{align-content:space-between!important}.align-content-around{align-content:space-around!important}.align-content-stretch{align-content:stretch!important}.align-self-auto{align-self:auto!important}.align-self-start{align-self:flex-start!important}.align-self-end{align-self:flex-end!important}.align-self-center{align-self:center!important}.align-self-baseline{align-self:baseline!important}.align-self-stretch{align-self:stretch!important}.order-first{order:-1!important}.order-0{order:0!important}.order-1{order:1!important}.order-2{order:2!important}.order-3{order:3!important}.order-4{order:4!important}.order-5{order:5!important}.order-last{order:6!important}.m-0{margin:0!important}.m-1{margin:.25rem!important}.m-2{margin:.5rem!important}.m-3{margin:1rem!important}.m-4{margin:1.5rem!important}.m-5{margin:3rem!important}.m-auto{margin:auto!important}.mx-0{margin-right:0!important;margin-left:0!important}.mx-1{margin-right:.25rem!important;margin-left:.25rem!important}.mx-2{margin-right:.5rem!important;margin-left:.5rem!important}.mx-3{margin-right:1rem!important;margin-left:1rem!important}.mx-4{margin-right:1.5rem!important;margin-left:1.5rem!important}.mx-5{margin-right:3rem!important;margin-left:3rem!important}.mx-auto{margin-right:auto!important;margin-left:auto!important}.my-0{margin-top:0!important;margin-bottom:0!important}.my-1{margin-top:.25rem!important;margin-bottom:.25rem!important}.my-2{margin-top:.5rem!important;margin-bottom:.5rem!important}.my-3{margin-top:1rem!important;margin-bottom:1rem!important}.my-4{margin-top:1.5rem!important;margin-bottom:1.5rem!important}.my-5{margin-top:3rem!important;margin-bottom:3rem!important}.my-auto{margin-top:auto!important;margin-bottom:auto!important}.mt-0{margin-top:0!important}.mt-1{margin-top:.25rem!important}.mt-2{margin-top:.5rem!important}.mt-3{margin-top:1rem!important}.mt-4{margin-top:1.5rem!important}.mt-5{margin-top:3rem!important}.mt-auto{margin-top:auto!important}.me-0{margin-right:0!important}.me-1{margin-right:.25rem!important}.me-2{margin-right:.5rem!important}.me-3{margin-right:1rem!important}.me-4{margin-right:1.5rem!important}.me-5{margin-right:3rem!important}.me-auto{margin-right:auto!important}.mb-0{margin-bottom:0!important}.mb-1{margin-bottom:.25rem!important}.mb-2{margin-bottom:.5rem!important}.mb-3{margin-bottom:1rem!important}.mb-4{margin-bottom:1.5rem!important}.mb-5{margin-bottom:3rem!important}.mb-auto{margin-bottom:auto!important}.ms-0{margin-left:0!important}.ms-1{margin-left:.25rem!important}.ms-2{margin-left:.5rem!important}.ms-3{margin-left:1rem!important}.ms-4{margin-left:1.5rem!important}.ms-5{margin-left:3rem!important}.ms-auto{margin-left:auto!important}.p-0{padding:0!important}.p-1{padding:.25rem!important}.p-2{padding:.5rem!important}.p-3{padding:1rem!important}.p-4{padding:1.5rem!important}.p-5{padding:3rem!important}.px-0{padding-right:0!important;padding-left:0!important}.px-1{padding-right:.25rem!important;padding-left:.25rem!important}.px-2{padding-right:.5rem!important;padding-left:.5rem!important}.px-3{padding-right:1rem!important;padding-left:1rem!important}.px-4{padding-right:1.5rem!important;padding-left:1.5rem!important}.px-5{padding-right:3rem!important;padding-left:3rem!important}.py-0{padding-top:0!important;padding-bottom:0!important}.py-1{padding-top:.25rem!important;padding-bottom:.25rem!important}.py-2{padding-top:.5rem!important;padding-bottom:.5rem!important}.py-3{padding-top:1rem!important;padding-bottom:1rem!important}.py-4{padding-top:1.5rem!important;padding-bottom:1.5rem!important}.py-5{padding-top:3rem!important;padding-bottom:3rem!important}.pt-0{padding-top:0!important}.pt-1{padding-top:.25rem!important}.pt-2{padding-top:.5rem!important}.pt-3{padding-top:1rem!important}.pt-4{padding-top:1.5rem!important}.pt-5{padding-top:3rem!important}.pe-0{padding-right:0!important}.pe-1{padding-right:.25rem!important}.pe-2{padding-right:.5rem!important}.pe-3{padding-right:1rem!important}.pe-4{padding-right:1.5rem!important}.pe-5{padding-right:3rem!important}.pb-0{padding-bottom:0!important}.pb-1{padding-bottom:.25rem!important}.pb-2{padding-bottom:.5rem!important}.pb-3{padding-bottom:1rem!important}.pb-4{padding-bottom:1.5rem!important}.pb-5{padding-bottom:3rem!important}.ps-0{padding-left:0!important}.ps-1{padding-left:.25rem!important}.ps-2{padding-left:.5rem!important}.ps-3{padding-left:1rem!important}.ps-4{padding-left:1.5rem!important}.ps-5{padding-left:3rem!important}.gap-0{gap:0!important}.gap-1{gap:.25rem!important}.gap-2{gap:.5rem!important}.gap-3{gap:1rem!important}.gap-4{gap:1.5rem!important}.gap-5{gap:3rem!important}.row-gap-0{row-gap:0!important}.row-gap-1{row-gap:.25rem!important}.row-gap-2{row-gap:.5rem!important}.row-gap-3{row-gap:1rem!important}.row-gap-4{row-gap:1.5rem!important}.row-gap-5{row-gap:3rem!important}.column-gap-0{-moz-column-gap:0!important;column-gap:0!important}.column-gap-1{-moz-column-gap:0.25rem!important;column-gap:.25rem!important}.column-gap-2{-moz-column-gap:0.5rem!important;column-gap:.5rem!important}.column-gap-3{-moz-column-gap:1rem!important;column-gap:1rem!important}.column-gap-4{-moz-column-gap:1.5rem!important;column-gap:1.5rem!important}.column-gap-5{-moz-column-gap:3rem!important;column-gap:3rem!important}.font-monospace{font-family:var(--bs-font-monospace)!important}.fs-1{font-size:calc(1.375rem + 1.5vw)!important}.fs-2{font-size:calc(1.325rem + .9vw)!important}.fs-3{font-size:calc(1.3rem + .6vw)!important}.fs-4{font-size:calc(1.275rem + .3vw)!important}.fs-5{font-size:1.25rem!important}.fs-6{font-size:1rem!important}.fst-italic{font-style:italic!important}.fst-normal{font-style:normal!important}.fw-lighter{font-weight:lighter!important}.fw-light{font-weight:300!important}.fw-normal{font-weight:400!important}.fw-medium{font-weight:500!important}.fw-semibold{font-weight:600!important}.fw-bold{font-weight:700!important}.fw-bolder{font-weight:bolder!important}.lh-1{line-height:1!important}.lh-sm{line-height:1.25!important}.lh-base{line-height:1.5!important}.lh-lg{line-height:2!important}.text-start{text-align:left!important}.text-end{text-align:right!important}.text-center{text-align:center!important}.text-decoration-none{text-decoration:none!important}.text-decoration-underline{text-decoration:underline!important}.text-decoration-line-through{text-decoration:line-through!important}.text-lowercase{text-transform:lowercase!important}.text-uppercase{text-transform:uppercase!important}.text-capitalize{text-transform:capitalize!important}.text-wrap{white-space:normal!important}.text-nowrap{white-space:nowrap!important}.text-break{word-wrap:break-word!important;word-break:break-word!important}.text-primary{--bs-text-opacity:1;color:rgba(var(--bs-primary-rgb),var(--bs-text-opacity))!important}.text-secondary{--bs-text-opacity:1;color:rgba(var(--bs-secondary-rgb),var(--bs-text-opacity))!important}.text-success{--bs-text-opacity:1;color:rgba(var(--bs-success-rgb),var(--bs-text-opacity))!important}.text-info{--bs-text-opacity:1;color:rgba(var(--bs-info-rgb),var(--bs-text-opacity))!important}.text-warning{--bs-text-opacity:1;color:rgba(var(--bs-warning-rgb),var(--bs-text-opacity))!important}.text-danger{--bs-text-opacity:1;color:rgba(var(--bs-danger-rgb),var(--bs-text-opacity))!important}.text-light{--bs-text-opacity:1;color:rgba(var(--bs-light-rgb),var(--bs-text-opacity))!important}.text-dark{--bs-text-opacity:1;color:rgba(var(--bs-dark-rgb),var(--bs-text-opacity))!important}.text-black{--bs-text-opacity:1;color:rgba(var(--bs-black-rgb),var(--bs-text-opacity))!important}.text-white{--bs-text-opacity:1;color:rgba(var(--bs-white-rgb),var(--bs-text-opacity))!important}.text-body{--bs-text-opacity:1;color:rgba(var(--bs-body-color-rgb),var(--bs-text-opacity))!important}.text-muted{--bs-text-opacity:1;color:var(--bs-secondary-color)!important}.text-black-50{--bs-text-opacity:1;color:rgba(0,0,0,.5)!important}.text-white-50{--bs-text-opacity:1;color:rgba(255,255,255,.5)!important}.text-body-secondary{--bs-text-opacity:1;color:var(--bs-secondary-color)!important}.text-body-tertiary{--bs-text-opacity:1;color:var(--bs-tertiary-color)!important}.text-body-emphasis{--bs-text-opacity:1;color:var(--bs-emphasis-color)!important}.text-reset{--bs-text-opacity:1;color:inherit!important}.text-opacity-25{--bs-text-opacity:0.25}.text-opacity-50{--bs-text-opacity:0.5}.text-opacity-75{--bs-text-opacity:0.75}.text-opacity-100{--bs-text-opacity:1}.text-primary-emphasis{color:var(--bs-primary-text-emphasis)!important}.text-secondary-emphasis{color:var(--bs-secondary-text-emphasis)!important}.text-success-emphasis{color:var(--bs-success-text-emphasis)!important}.text-info-emphasis{color:var(--bs-info-text-emphasis)!important}.text-warning-emphasis{color:var(--bs-warning-text-emphasis)!important}.text-danger-emphasis{color:var(--bs-danger-text-emphasis)!important}.text-light-emphasis{color:var(--bs-light-text-emphasis)!important}.text-dark-emphasis{color:var(--bs-dark-text-emphasis)!important}.link-opacity-10{--bs-link-opacity:0.1}.link-opacity-10-hover:hover{--bs-link-opacity:0.1}.link-opacity-25{--bs-link-opacity:0.25}.link-opacity-25-hover:hover{--bs-link-opacity:0.25}.link-opacity-50{--bs-link-opacity:0.5}.link-opacity-50-hover:hover{--bs-link-opacity:0.5}.link-opacity-75{--bs-link-opacity:0.75}.link-opacity-75-hover:hover{--bs-link-opacity:0.75}.link-opacity-100{--bs-link-opacity:1}.link-opacity-100-hover:hover{--bs-link-opacity:1}.link-offset-1{text-underline-offset:0.125em!important}.link-offset-1-hover:hover{text-underline-offset:0.125em!important}.link-offset-2{text-underline-offset:0.25em!important}.link-offset-2-hover:hover{text-underline-offset:0.25em!important}.link-offset-3{text-underline-offset:0.375em!important}.link-offset-3-hover:hover{text-underline-offset:0.375em!important}.link-underline-primary{--bs-link-underline-opacity:1;-webkit-text-decoration-color:rgba(var(--bs-primary-rgb),var(--bs-link-underline-opacity))!important;text-decoration-color:rgba(var(--bs-primary-rgb),var(--bs-link-underline-opacity))!important}.link-underline-secondary{--bs-link-underline-opacity:1;-webkit-text-decoration-color:rgba(var(--bs-secondary-rgb),var(--bs-link-underline-opacity))!important;text-decoration-color:rgba(var(--bs-secondary-rgb),var(--bs-link-underline-opacity))!important}.link-underline-success{--bs-link-underline-opacity:1;-webkit-text-decoration-color:rgba(var(--bs-success-rgb),var(--bs-link-underline-opacity))!important;text-decoration-color:rgba(var(--bs-success-rgb),var(--bs-link-underline-opacity))!important}.link-underline-info{--bs-link-underline-opacity:1;-webkit-text-decoration-color:rgba(var(--bs-info-rgb),var(--bs-link-underline-opacity))!important;text-decoration-color:rgba(var(--bs-info-rgb),var(--bs-link-underline-opacity))!important}.link-underline-warning{--bs-link-underline-opacity:1;-webkit-text-decoration-color:rgba(var(--bs-warning-rgb),var(--bs-link-underline-opacity))!important;text-decoration-color:rgba(var(--bs-warning-rgb),var(--bs-link-underline-opacity))!important}.link-underline-danger{--bs-link-underline-opacity:1;-webkit-text-decoration-color:rgba(var(--bs-danger-rgb),var(--bs-link-underline-opacity))!important;text-decoration-color:rgba(var(--bs-danger-rgb),var(--bs-link-underline-opacity))!important}.link-underline-light{--bs-link-underline-opacity:1;-webkit-text-decoration-color:rgba(var(--bs-light-rgb),var(--bs-link-underline-opacity))!important;text-decoration-color:rgba(var(--bs-light-rgb),var(--bs-link-underline-opacity))!important}.link-underline-dark{--bs-link-underline-opacity:1;-webkit-text-decoration-color:rgba(var(--bs-dark-rgb),var(--bs-link-underline-opacity))!important;text-decoration-color:rgba(var(--bs-dark-rgb),var(--bs-link-underline-opacity))!important}.link-underline{--bs-link-underline-opacity:1;-webkit-text-decoration-color:rgba(var(--bs-link-color-rgb),var(--bs-link-underline-opacity,1))!important;text-decoration-color:rgba(var(--bs-link-color-rgb),var(--bs-link-underline-opacity,1))!important}.link-underline-opacity-0{--bs-link-underline-opacity:0}.link-underline-opacity-0-hover:hover{--bs-link-underline-opacity:0}.link-underline-opacity-10{--bs-link-underline-opacity:0.1}.link-underline-opacity-10-hover:hover{--bs-link-underline-opacity:0.1}.link-underline-opacity-25{--bs-link-underline-opacity:0.25}.link-underline-opacity-25-hover:hover{--bs-link-underline-opacity:0.25}.link-underline-opacity-50{--bs-link-underline-opacity:0.5}.link-underline-opacity-50-hover:hover{--bs-link-underline-opacity:0.5}.link-underline-opacity-75{--bs-link-underline-opacity:0.75}.link-underline-opacity-75-hover:hover{--bs-link-underline-opacity:0.75}.link-underline-opacity-100{--bs-link-underline-opacity:1}.link-underline-opacity-100-hover:hover{--bs-link-underline-opacity:1}.bg-primary{--bs-bg-opacity:1;background-color:rgba(var(--bs-primary-rgb),var(--bs-bg-opacity))!important}.bg-secondary{--bs-bg-opacity:1;background-color:rgba(var(--bs-secondary-rgb),var(--bs-bg-opacity))!important}.bg-success{--bs-bg-opacity:1;background-color:rgba(var(--bs-success-rgb),var(--bs-bg-opacity))!important}.bg-info{--bs-bg-opacity:1;background-color:rgba(var(--bs-info-rgb),var(--bs-bg-opacity))!important}.bg-warning{--bs-bg-opacity:1;background-color:rgba(var(--bs-warning-rgb),var(--bs-bg-opacity))!important}.bg-danger{--bs-bg-opacity:1;background-color:rgba(var(--bs-danger-rgb),var(--bs-bg-opacity))!important}.bg-light{--bs-bg-opacity:1;background-color:rgba(var(--bs-light-rgb),var(--bs-bg-opacity))!important}.bg-dark{--bs-bg-opacity:1;background-color:rgba(var(--bs-dark-rgb),var(--bs-bg-opacity))!important}.bg-black{--bs-bg-opacity:1;background-color:rgba(var(--bs-black-rgb),var(--bs-bg-opacity))!important}.bg-white{--bs-bg-opacity:1;background-color:rgba(var(--bs-white-rgb),var(--bs-bg-opacity))!important}.bg-body{--bs-bg-opacity:1;background-color:rgba(var(--bs-body-bg-rgb),var(--bs-bg-opacity))!important}.bg-transparent{--bs-bg-opacity:1;background-color:transparent!important}.bg-body-secondary{--bs-bg-opacity:1;background-color:rgba(var(--bs-secondary-bg-rgb),var(--bs-bg-opacity))!important}.bg-body-tertiary{--bs-bg-opacity:1;background-color:rgba(var(--bs-tertiary-bg-rgb),var(--bs-bg-opacity))!important}.bg-opacity-10{--bs-bg-opacity:0.1}.bg-opacity-25{--bs-bg-opacity:0.25}.bg-opacity-50{--bs-bg-opacity:0.5}.bg-opacity-75{--bs-bg-opacity:0.75}.bg-opacity-100{--bs-bg-opacity:1}.bg-primary-subtle{background-color:var(--bs-primary-bg-subtle)!important}.bg-secondary-subtle{background-color:var(--bs-secondary-bg-subtle)!important}.bg-success-subtle{background-color:var(--bs-success-bg-subtle)!important}.bg-info-subtle{background-color:var(--bs-info-bg-subtle)!important}.bg-warning-subtle{background-color:var(--bs-warning-bg-subtle)!important}.bg-danger-subtle{background-color:var(--bs-danger-bg-subtle)!important}.bg-light-subtle{background-color:var(--bs-light-bg-subtle)!important}.bg-dark-subtle{background-color:var(--bs-dark-bg-subtle)!important}.bg-gradient{background-image:var(--bs-gradient)!important}.user-select-all{-webkit-user-select:all!important;-moz-user-select:all!important;user-select:all!important}.user-select-auto{-webkit-user-select:auto!important;-moz-user-select:auto!important;user-select:auto!important}.user-select-none{-webkit-user-select:none!important;-moz-user-select:none!important;user-select:none!important}.pe-none{pointer-events:none!important}.pe-auto{pointer-events:auto!important}.rounded{border-radius:var(--bs-border-radius)!important}.rounded-0{border-radius:0!important}.rounded-1{border-radius:var(--bs-border-radius-sm)!important}.rounded-2{border-radius:var(--bs-border-radius)!important}.rounded-3{border-radius:var(--bs-border-radius-lg)!important}.rounded-4{border-radius:var(--bs-border-radius-xl)!important}.rounded-5{border-radius:var(--bs-border-radius-xxl)!important}.rounded-circle{border-radius:50%!important}.rounded-pill{border-radius:var(--bs-border-radius-pill)!important}.rounded-top{border-top-left-radius:var(--bs-border-radius)!important;border-top-right-radius:var(--bs-border-radius)!important}.rounded-top-0{border-top-left-radius:0!important;border-top-right-radius:0!important}.rounded-top-1{border-top-left-radius:var(--bs-border-radius-sm)!important;border-top-right-radius:var(--bs-border-radius-sm)!important}.rounded-top-2{border-top-left-radius:var(--bs-border-radius)!important;border-top-right-radius:var(--bs-border-radius)!important}.rounded-top-3{border-top-left-radius:var(--bs-border-radius-lg)!important;border-top-right-radius:var(--bs-border-radius-lg)!important}.rounded-top-4{border-top-left-radius:var(--bs-border-radius-xl)!important;border-top-right-radius:var(--bs-border-radius-xl)!important}.rounded-top-5{border-top-left-radius:var(--bs-border-radius-xxl)!important;border-top-right-radius:var(--bs-border-radius-xxl)!important}.rounded-top-circle{border-top-left-radius:50%!important;border-top-right-radius:50%!important}.rounded-top-pill{border-top-left-radius:var(--bs-border-radius-pill)!important;border-top-right-radius:var(--bs-border-radius-pill)!important}.rounded-end{border-top-right-radius:var(--bs-border-radius)!important;border-bottom-right-radius:var(--bs-border-radius)!important}.rounded-end-0{border-top-right-radius:0!important;border-bottom-right-radius:0!important}.rounded-end-1{border-top-right-radius:var(--bs-border-radius-sm)!important;border-bottom-right-radius:var(--bs-border-radius-sm)!important}.rounded-end-2{border-top-right-radius:var(--bs-border-radius)!important;border-bottom-right-radius:var(--bs-border-radius)!important}.rounded-end-3{border-top-right-radius:var(--bs-border-radius-lg)!important;border-bottom-right-radius:var(--bs-border-radius-lg)!important}.rounded-end-4{border-top-right-radius:var(--bs-border-radius-xl)!important;border-bottom-right-radius:var(--bs-border-radius-xl)!important}.rounded-end-5{border-top-right-radius:var(--bs-border-radius-xxl)!important;border-bottom-right-radius:var(--bs-border-radius-xxl)!important}.rounded-end-circle{border-top-right-radius:50%!important;border-bottom-right-radius:50%!important}.rounded-end-pill{border-top-right-radius:var(--bs-border-radius-pill)!important;border-bottom-right-radius:var(--bs-border-radius-pill)!important}.rounded-bottom{border-bottom-right-radius:var(--bs-border-radius)!important;border-bottom-left-radius:var(--bs-border-radius)!important}.rounded-bottom-0{border-bottom-right-radius:0!important;border-bottom-left-radius:0!important}.rounded-bottom-1{border-bottom-right-radius:var(--bs-border-radius-sm)!important;border-bottom-left-radius:var(--bs-border-radius-sm)!important}.rounded-bottom-2{border-bottom-right-radius:var(--bs-border-radius)!important;border-bottom-left-radius:var(--bs-border-radius)!important}.rounded-bottom-3{border-bottom-right-radius:var(--bs-border-radius-lg)!important;border-bottom-left-radius:var(--bs-border-radius-lg)!important}.rounded-bottom-4{border-bottom-right-radius:var(--bs-border-radius-xl)!important;border-bottom-left-radius:var(--bs-border-radius-xl)!important}.rounded-bottom-5{border-bottom-right-radius:var(--bs-border-radius-xxl)!important;border-bottom-left-radius:var(--bs-border-radius-xxl)!important}.rounded-bottom-circle{border-bottom-right-radius:50%!important;border-bottom-left-radius:50%!important}.rounded-bottom-pill{border-bottom-right-radius:var(--bs-border-radius-pill)!important;border-bottom-left-radius:var(--bs-border-radius-pill)!important}.rounded-start{border-bottom-left-radius:var(--bs-border-radius)!important;border-top-left-radius:var(--bs-border-radius)!important}.rounded-start-0{border-bottom-left-radius:0!important;border-top-left-radius:0!important}.rounded-start-1{border-bottom-left-radius:var(--bs-border-radius-sm)!important;border-top-left-radius:var(--bs-border-radius-sm)!important}.rounded-start-2{border-bottom-left-radius:var(--bs-border-radius)!important;border-top-left-radius:var(--bs-border-radius)!important}.rounded-start-3{border-bottom-left-radius:var(--bs-border-radius-lg)!important;border-top-left-radius:var(--bs-border-radius-lg)!important}.rounded-start-4{border-bottom-left-radius:var(--bs-border-radius-xl)!important;border-top-left-radius:var(--bs-border-radius-xl)!important}.rounded-start-5{border-bottom-left-radius:var(--bs-border-radius-xxl)!important;border-top-left-radius:var(--bs-border-radius-xxl)!important}.rounded-start-circle{border-bottom-left-radius:50%!important;border-top-left-radius:50%!important}.rounded-start-pill{border-bottom-left-radius:var(--bs-border-radius-pill)!important;border-top-left-radius:var(--bs-border-radius-pill)!important}.visible{visibility:visible!important}.invisible{visibility:hidden!important}.z-n1{z-index:-1!important}.z-0{z-index:0!important}.z-1{z-index:1!important}.z-2{z-index:2!important}.z-3{z-index:3!important}@media (min-width:576px){.float-sm-start{float:left!important}.float-sm-end{float:right!important}.float-sm-none{float:none!important}.object-fit-sm-contain{-o-object-fit:contain!important;object-fit:contain!important}.object-fit-sm-cover{-o-object-fit:cover!important;object-fit:cover!important}.object-fit-sm-fill{-o-object-fit:fill!important;object-fit:fill!important}.object-fit-sm-scale{-o-object-fit:scale-down!important;object-fit:scale-down!important}.object-fit-sm-none{-o-object-fit:none!important;object-fit:none!important}.d-sm-inline{display:inline!important}.d-sm-inline-block{display:inline-block!important}.d-sm-block{display:block!important}.d-sm-grid{display:grid!important}.d-sm-inline-grid{display:inline-grid!important}.d-sm-table{display:table!important}.d-sm-table-row{display:table-row!important}.d-sm-table-cell{display:table-cell!important}.d-sm-flex{display:flex!important}.d-sm-inline-flex{display:inline-flex!important}.d-sm-none{display:none!important}.flex-sm-fill{flex:1 1 auto!important}.flex-sm-row{flex-direction:row!important}.flex-sm-column{flex-direction:column!important}.flex-sm-row-reverse{flex-direction:row-reverse!important}.flex-sm-column-reverse{flex-direction:column-reverse!important}.flex-sm-grow-0{flex-grow:0!important}.flex-sm-grow-1{flex-grow:1!important}.flex-sm-shrink-0{flex-shrink:0!important}.flex-sm-shrink-1{flex-shrink:1!important}.flex-sm-wrap{flex-wrap:wrap!important}.flex-sm-nowrap{flex-wrap:nowrap!important}.flex-sm-wrap-reverse{flex-wrap:wrap-reverse!important}.justify-content-sm-start{justify-content:flex-start!important}.justify-content-sm-end{justify-content:flex-end!important}.justify-content-sm-center{justify-content:center!important}.justify-content-sm-between{justify-content:space-between!important}.justify-content-sm-around{justify-content:space-around!important}.justify-content-sm-evenly{justify-content:space-evenly!important}.align-items-sm-start{align-items:flex-start!important}.align-items-sm-end{align-items:flex-end!important}.align-items-sm-center{align-items:center!important}.align-items-sm-baseline{align-items:baseline!important}.align-items-sm-stretch{align-items:stretch!important}.align-content-sm-start{align-content:flex-start!important}.align-content-sm-end{align-content:flex-end!important}.align-content-sm-center{align-content:center!important}.align-content-sm-between{align-content:space-between!important}.align-content-sm-around{align-content:space-around!important}.align-content-sm-stretch{align-content:stretch!important}.align-self-sm-auto{align-self:auto!important}.align-self-sm-start{align-self:flex-start!important}.align-self-sm-end{align-self:flex-end!important}.align-self-sm-center{align-self:center!important}.align-self-sm-baseline{align-self:baseline!important}.align-self-sm-stretch{align-self:stretch!important}.order-sm-first{order:-1!important}.order-sm-0{order:0!important}.order-sm-1{order:1!important}.order-sm-2{order:2!important}.order-sm-3{order:3!important}.order-sm-4{order:4!important}.order-sm-5{order:5!important}.order-sm-last{order:6!important}.m-sm-0{margin:0!important}.m-sm-1{margin:.25rem!important}.m-sm-2{margin:.5rem!important}.m-sm-3{margin:1rem!important}.m-sm-4{margin:1.5rem!important}.m-sm-5{margin:3rem!important}.m-sm-auto{margin:auto!important}.mx-sm-0{margin-right:0!important;margin-left:0!important}.mx-sm-1{margin-right:.25rem!important;margin-left:.25rem!important}.mx-sm-2{margin-right:.5rem!important;margin-left:.5rem!important}.mx-sm-3{margin-right:1rem!important;margin-left:1rem!important}.mx-sm-4{margin-right:1.5rem!important;margin-left:1.5rem!important}.mx-sm-5{margin-right:3rem!important;margin-left:3rem!important}.mx-sm-auto{margin-right:auto!important;margin-left:auto!important}.my-sm-0{margin-top:0!important;margin-bottom:0!important}.my-sm-1{margin-top:.25rem!important;margin-bottom:.25rem!important}.my-sm-2{margin-top:.5rem!important;margin-bottom:.5rem!important}.my-sm-3{margin-top:1rem!important;margin-bottom:1rem!important}.my-sm-4{margin-top:1.5rem!important;margin-bottom:1.5rem!important}.my-sm-5{margin-top:3rem!important;margin-bottom:3rem!important}.my-sm-auto{margin-top:auto!important;margin-bottom:auto!important}.mt-sm-0{margin-top:0!important}.mt-sm-1{margin-top:.25rem!important}.mt-sm-2{margin-top:.5rem!important}.mt-sm-3{margin-top:1rem!important}.mt-sm-4{margin-top:1.5rem!important}.mt-sm-5{margin-top:3rem!important}.mt-sm-auto{margin-top:auto!important}.me-sm-0{margin-right:0!important}.me-sm-1{margin-right:.25rem!important}.me-sm-2{margin-right:.5rem!important}.me-sm-3{margin-right:1rem!important}.me-sm-4{margin-right:1.5rem!important}.me-sm-5{margin-right:3rem!important}.me-sm-auto{margin-right:auto!important}.mb-sm-0{margin-bottom:0!important}.mb-sm-1{margin-bottom:.25rem!important}.mb-sm-2{margin-bottom:.5rem!important}.mb-sm-3{margin-bottom:1rem!important}.mb-sm-4{margin-bottom:1.5rem!important}.mb-sm-5{margin-bottom:3rem!important}.mb-sm-auto{margin-bottom:auto!important}.ms-sm-0{margin-left:0!important}.ms-sm-1{margin-left:.25rem!important}.ms-sm-2{margin-left:.5rem!important}.ms-sm-3{margin-left:1rem!important}.ms-sm-4{margin-left:1.5rem!important}.ms-sm-5{margin-left:3rem!important}.ms-sm-auto{margin-left:auto!important}.p-sm-0{padding:0!important}.p-sm-1{padding:.25rem!important}.p-sm-2{padding:.5rem!important}.p-sm-3{padding:1rem!important}.p-sm-4{padding:1.5rem!important}.p-sm-5{padding:3rem!important}.px-sm-0{padding-right:0!important;padding-left:0!important}.px-sm-1{padding-right:.25rem!important;padding-left:.25rem!important}.px-sm-2{padding-right:.5rem!important;padding-left:.5rem!important}.px-sm-3{padding-right:1rem!important;padding-left:1rem!important}.px-sm-4{padding-right:1.5rem!important;padding-left:1.5rem!important}.px-sm-5{padding-right:3rem!important;padding-left:3rem!important}.py-sm-0{padding-top:0!important;padding-bottom:0!important}.py-sm-1{padding-top:.25rem!important;padding-bottom:.25rem!important}.py-sm-2{padding-top:.5rem!important;padding-bottom:.5rem!important}.py-sm-3{padding-top:1rem!important;padding-bottom:1rem!important}.py-sm-4{padding-top:1.5rem!important;padding-bottom:1.5rem!important}.py-sm-5{padding-top:3rem!important;padding-bottom:3rem!important}.pt-sm-0{padding-top:0!important}.pt-sm-1{padding-top:.25rem!important}.pt-sm-2{padding-top:.5rem!important}.pt-sm-3{padding-top:1rem!important}.pt-sm-4{padding-top:1.5rem!important}.pt-sm-5{padding-top:3rem!important}.pe-sm-0{padding-right:0!important}.pe-sm-1{padding-right:.25rem!important}.pe-sm-2{padding-right:.5rem!important}.pe-sm-3{padding-right:1rem!important}.pe-sm-4{padding-right:1.5rem!important}.pe-sm-5{padding-right:3rem!important}.pb-sm-0{padding-bottom:0!important}.pb-sm-1{padding-bottom:.25rem!important}.pb-sm-2{padding-bottom:.5rem!important}.pb-sm-3{padding-bottom:1rem!important}.pb-sm-4{padding-bottom:1.5rem!important}.pb-sm-5{padding-bottom:3rem!important}.ps-sm-0{padding-left:0!important}.ps-sm-1{padding-left:.25rem!important}.ps-sm-2{padding-left:.5rem!important}.ps-sm-3{padding-left:1rem!important}.ps-sm-4{padding-left:1.5rem!important}.ps-sm-5{padding-left:3rem!important}.gap-sm-0{gap:0!important}.gap-sm-1{gap:.25rem!important}.gap-sm-2{gap:.5rem!important}.gap-sm-3{gap:1rem!important}.gap-sm-4{gap:1.5rem!important}.gap-sm-5{gap:3rem!important}.row-gap-sm-0{row-gap:0!important}.row-gap-sm-1{row-gap:.25rem!important}.row-gap-sm-2{row-gap:.5rem!important}.row-gap-sm-3{row-gap:1rem!important}.row-gap-sm-4{row-gap:1.5rem!important}.row-gap-sm-5{row-gap:3rem!important}.column-gap-sm-0{-moz-column-gap:0!important;column-gap:0!important}.column-gap-sm-1{-moz-column-gap:0.25rem!important;column-gap:.25rem!important}.column-gap-sm-2{-moz-column-gap:0.5rem!important;column-gap:.5rem!important}.column-gap-sm-3{-moz-column-gap:1rem!important;column-gap:1rem!important}.column-gap-sm-4{-moz-column-gap:1.5rem!important;column-gap:1.5rem!important}.column-gap-sm-5{-moz-column-gap:3rem!important;column-gap:3rem!important}.text-sm-start{text-align:left!important}.text-sm-end{text-align:right!important}.text-sm-center{text-align:center!important}}@media (min-width:768px){.float-md-start{float:left!important}.float-md-end{float:right!important}.float-md-none{float:none!important}.object-fit-md-contain{-o-object-fit:contain!important;object-fit:contain!important}.object-fit-md-cover{-o-object-fit:cover!important;object-fit:cover!important}.object-fit-md-fill{-o-object-fit:fill!important;object-fit:fill!important}.object-fit-md-scale{-o-object-fit:scale-down!important;object-fit:scale-down!important}.object-fit-md-none{-o-object-fit:none!important;object-fit:none!important}.d-md-inline{display:inline!important}.d-md-inline-block{display:inline-block!important}.d-md-block{display:block!important}.d-md-grid{display:grid!important}.d-md-inline-grid{display:inline-grid!important}.d-md-table{display:table!important}.d-md-table-row{display:table-row!important}.d-md-table-cell{display:table-cell!important}.d-md-flex{display:flex!important}.d-md-inline-flex{display:inline-flex!important}.d-md-none{display:none!important}.flex-md-fill{flex:1 1 auto!important}.flex-md-row{flex-direction:row!important}.flex-md-column{flex-direction:column!important}.flex-md-row-reverse{flex-direction:row-reverse!important}.flex-md-column-reverse{flex-direction:column-reverse!important}.flex-md-grow-0{flex-grow:0!important}.flex-md-grow-1{flex-grow:1!important}.flex-md-shrink-0{flex-shrink:0!important}.flex-md-shrink-1{flex-shrink:1!important}.flex-md-wrap{flex-wrap:wrap!important}.flex-md-nowrap{flex-wrap:nowrap!important}.flex-md-wrap-reverse{flex-wrap:wrap-reverse!important}.justify-content-md-start{justify-content:flex-start!important}.justify-content-md-end{justify-content:flex-end!important}.justify-content-md-center{justify-content:center!important}.justify-content-md-between{justify-content:space-between!important}.justify-content-md-around{justify-content:space-around!important}.justify-content-md-evenly{justify-content:space-evenly!important}.align-items-md-start{align-items:flex-start!important}.align-items-md-end{align-items:flex-end!important}.align-items-md-center{align-items:center!important}.align-items-md-baseline{align-items:baseline!important}.align-items-md-stretch{align-items:stretch!important}.align-content-md-start{align-content:flex-start!important}.align-content-md-end{align-content:flex-end!important}.align-content-md-center{align-content:center!important}.align-content-md-between{align-content:space-between!important}.align-content-md-around{align-content:space-around!important}.align-content-md-stretch{align-content:stretch!important}.align-self-md-auto{align-self:auto!important}.align-self-md-start{align-self:flex-start!important}.align-self-md-end{align-self:flex-end!important}.align-self-md-center{align-self:center!important}.align-self-md-baseline{align-self:baseline!important}.align-self-md-stretch{align-self:stretch!important}.order-md-first{order:-1!important}.order-md-0{order:0!important}.order-md-1{order:1!important}.order-md-2{order:2!important}.order-md-3{order:3!important}.order-md-4{order:4!important}.order-md-5{order:5!important}.order-md-last{order:6!important}.m-md-0{margin:0!important}.m-md-1{margin:.25rem!important}.m-md-2{margin:.5rem!important}.m-md-3{margin:1rem!important}.m-md-4{margin:1.5rem!important}.m-md-5{margin:3rem!important}.m-md-auto{margin:auto!important}.mx-md-0{margin-right:0!important;margin-left:0!important}.mx-md-1{margin-right:.25rem!important;margin-left:.25rem!important}.mx-md-2{margin-right:.5rem!important;margin-left:.5rem!important}.mx-md-3{margin-right:1rem!important;margin-left:1rem!important}.mx-md-4{margin-right:1.5rem!important;margin-left:1.5rem!important}.mx-md-5{margin-right:3rem!important;margin-left:3rem!important}.mx-md-auto{margin-right:auto!important;margin-left:auto!important}.my-md-0{margin-top:0!important;margin-bottom:0!important}.my-md-1{margin-top:.25rem!important;margin-bottom:.25rem!important}.my-md-2{margin-top:.5rem!important;margin-bottom:.5rem!important}.my-md-3{margin-top:1rem!important;margin-bottom:1rem!important}.my-md-4{margin-top:1.5rem!important;margin-bottom:1.5rem!important}.my-md-5{margin-top:3rem!important;margin-bottom:3rem!important}.my-md-auto{margin-top:auto!important;margin-bottom:auto!important}.mt-md-0{margin-top:0!important}.mt-md-1{margin-top:.25rem!important}.mt-md-2{margin-top:.5rem!important}.mt-md-3{margin-top:1rem!important}.mt-md-4{margin-top:1.5rem!important}.mt-md-5{margin-top:3rem!important}.mt-md-auto{margin-top:auto!important}.me-md-0{margin-right:0!important}.me-md-1{margin-right:.25rem!important}.me-md-2{margin-right:.5rem!important}.me-md-3{margin-right:1rem!important}.me-md-4{margin-right:1.5rem!important}.me-md-5{margin-right:3rem!important}.me-md-auto{margin-right:auto!important}.mb-md-0{margin-bottom:0!important}.mb-md-1{margin-bottom:.25rem!important}.mb-md-2{margin-bottom:.5rem!important}.mb-md-3{margin-bottom:1rem!important}.mb-md-4{margin-bottom:1.5rem!important}.mb-md-5{margin-bottom:3rem!important}.mb-md-auto{margin-bottom:auto!important}.ms-md-0{margin-left:0!important}.ms-md-1{margin-left:.25rem!important}.ms-md-2{margin-left:.5rem!important}.ms-md-3{margin-left:1rem!important}.ms-md-4{margin-left:1.5rem!important}.ms-md-5{margin-left:3rem!important}.ms-md-auto{margin-left:auto!important}.p-md-0{padding:0!important}.p-md-1{padding:.25rem!important}.p-md-2{padding:.5rem!important}.p-md-3{padding:1rem!important}.p-md-4{padding:1.5rem!important}.p-md-5{padding:3rem!important}.px-md-0{padding-right:0!important;padding-left:0!important}.px-md-1{padding-right:.25rem!important;padding-left:.25rem!important}.px-md-2{padding-right:.5rem!important;padding-left:.5rem!important}.px-md-3{padding-right:1rem!important;padding-left:1rem!important}.px-md-4{padding-right:1.5rem!important;padding-left:1.5rem!important}.px-md-5{padding-right:3rem!important;padding-left:3rem!important}.py-md-0{padding-top:0!important;padding-bottom:0!important}.py-md-1{padding-top:.25rem!important;padding-bottom:.25rem!important}.py-md-2{padding-top:.5rem!important;padding-bottom:.5rem!important}.py-md-3{padding-top:1rem!important;padding-bottom:1rem!important}.py-md-4{padding-top:1.5rem!important;padding-bottom:1.5rem!important}.py-md-5{padding-top:3rem!important;padding-bottom:3rem!important}.pt-md-0{padding-top:0!important}.pt-md-1{padding-top:.25rem!important}.pt-md-2{padding-top:.5rem!important}.pt-md-3{padding-top:1rem!important}.pt-md-4{padding-top:1.5rem!important}.pt-md-5{padding-top:3rem!important}.pe-md-0{padding-right:0!important}.pe-md-1{padding-right:.25rem!important}.pe-md-2{padding-right:.5rem!important}.pe-md-3{padding-right:1rem!important}.pe-md-4{padding-right:1.5rem!important}.pe-md-5{padding-right:3rem!important}.pb-md-0{padding-bottom:0!important}.pb-md-1{padding-bottom:.25rem!important}.pb-md-2{padding-bottom:.5rem!important}.pb-md-3{padding-bottom:1rem!important}.pb-md-4{padding-bottom:1.5rem!important}.pb-md-5{padding-bottom:3rem!important}.ps-md-0{padding-left:0!important}.ps-md-1{padding-left:.25rem!important}.ps-md-2{padding-left:.5rem!important}.ps-md-3{padding-left:1rem!important}.ps-md-4{padding-left:1.5rem!important}.ps-md-5{padding-left:3rem!important}.gap-md-0{gap:0!important}.gap-md-1{gap:.25rem!important}.gap-md-2{gap:.5rem!important}.gap-md-3{gap:1rem!important}.gap-md-4{gap:1.5rem!important}.gap-md-5{gap:3rem!important}.row-gap-md-0{row-gap:0!important}.row-gap-md-1{row-gap:.25rem!important}.row-gap-md-2{row-gap:.5rem!important}.row-gap-md-3{row-gap:1rem!important}.row-gap-md-4{row-gap:1.5rem!important}.row-gap-md-5{row-gap:3rem!important}.column-gap-md-0{-moz-column-gap:0!important;column-gap:0!important}.column-gap-md-1{-moz-column-gap:0.25rem!important;column-gap:.25rem!important}.column-gap-md-2{-moz-column-gap:0.5rem!important;column-gap:.5rem!important}.column-gap-md-3{-moz-column-gap:1rem!important;column-gap:1rem!important}.column-gap-md-4{-moz-column-gap:1.5rem!important;column-gap:1.5rem!important}.column-gap-md-5{-moz-column-gap:3rem!important;column-gap:3rem!important}.text-md-start{text-align:left!important}.text-md-end{text-align:right!important}.text-md-center{text-align:center!important}}@media (min-width:992px){.float-lg-start{float:left!important}.float-lg-end{float:right!important}.float-lg-none{float:none!important}.object-fit-lg-contain{-o-object-fit:contain!important;object-fit:contain!important}.object-fit-lg-cover{-o-object-fit:cover!important;object-fit:cover!important}.object-fit-lg-fill{-o-object-fit:fill!important;object-fit:fill!important}.object-fit-lg-scale{-o-object-fit:scale-down!important;object-fit:scale-down!important}.object-fit-lg-none{-o-object-fit:none!important;object-fit:none!important}.d-lg-inline{display:inline!important}.d-lg-inline-block{display:inline-block!important}.d-lg-block{display:block!important}.d-lg-grid{display:grid!important}.d-lg-inline-grid{display:inline-grid!important}.d-lg-table{display:table!important}.d-lg-table-row{display:table-row!important}.d-lg-table-cell{display:table-cell!important}.d-lg-flex{display:flex!important}.d-lg-inline-flex{display:inline-flex!important}.d-lg-none{display:none!important}.flex-lg-fill{flex:1 1 auto!important}.flex-lg-row{flex-direction:row!important}.flex-lg-column{flex-direction:column!important}.flex-lg-row-reverse{flex-direction:row-reverse!important}.flex-lg-column-reverse{flex-direction:column-reverse!important}.flex-lg-grow-0{flex-grow:0!important}.flex-lg-grow-1{flex-grow:1!important}.flex-lg-shrink-0{flex-shrink:0!important}.flex-lg-shrink-1{flex-shrink:1!important}.flex-lg-wrap{flex-wrap:wrap!important}.flex-lg-nowrap{flex-wrap:nowrap!important}.flex-lg-wrap-reverse{flex-wrap:wrap-reverse!important}.justify-content-lg-start{justify-content:flex-start!important}.justify-content-lg-end{justify-content:flex-end!important}.justify-content-lg-center{justify-content:center!important}.justify-content-lg-between{justify-content:space-between!important}.justify-content-lg-around{justify-content:space-around!important}.justify-content-lg-evenly{justify-content:space-evenly!important}.align-items-lg-start{align-items:flex-start!important}.align-items-lg-end{align-items:flex-end!important}.align-items-lg-center{align-items:center!important}.align-items-lg-baseline{align-items:baseline!important}.align-items-lg-stretch{align-items:stretch!important}.align-content-lg-start{align-content:flex-start!important}.align-content-lg-end{align-content:flex-end!important}.align-content-lg-center{align-content:center!important}.align-content-lg-between{align-content:space-between!important}.align-content-lg-around{align-content:space-around!important}.align-content-lg-stretch{align-content:stretch!important}.align-self-lg-auto{align-self:auto!important}.align-self-lg-start{align-self:flex-start!important}.align-self-lg-end{align-self:flex-end!important}.align-self-lg-center{align-self:center!important}.align-self-lg-baseline{align-self:baseline!important}.align-self-lg-stretch{align-self:stretch!important}.order-lg-first{order:-1!important}.order-lg-0{order:0!important}.order-lg-1{order:1!important}.order-lg-2{order:2!important}.order-lg-3{order:3!important}.order-lg-4{order:4!important}.order-lg-5{order:5!important}.order-lg-last{order:6!important}.m-lg-0{margin:0!important}.m-lg-1{margin:.25rem!important}.m-lg-2{margin:.5rem!important}.m-lg-3{margin:1rem!important}.m-lg-4{margin:1.5rem!important}.m-lg-5{margin:3rem!important}.m-lg-auto{margin:auto!important}.mx-lg-0{margin-right:0!important;margin-left:0!important}.mx-lg-1{margin-right:.25rem!important;margin-left:.25rem!important}.mx-lg-2{margin-right:.5rem!important;margin-left:.5rem!important}.mx-lg-3{margin-right:1rem!important;margin-left:1rem!important}.mx-lg-4{margin-right:1.5rem!important;margin-left:1.5rem!important}.mx-lg-5{margin-right:3rem!important;margin-left:3rem!important}.mx-lg-auto{margin-right:auto!important;margin-left:auto!important}.my-lg-0{margin-top:0!important;margin-bottom:0!important}.my-lg-1{margin-top:.25rem!important;margin-bottom:.25rem!important}.my-lg-2{margin-top:.5rem!important;margin-bottom:.5rem!important}.my-lg-3{margin-top:1rem!important;margin-bottom:1rem!important}.my-lg-4{margin-top:1.5rem!important;margin-bottom:1.5rem!important}.my-lg-5{margin-top:3rem!important;margin-bottom:3rem!important}.my-lg-auto{margin-top:auto!important;margin-bottom:auto!important}.mt-lg-0{margin-top:0!important}.mt-lg-1{margin-top:.25rem!important}.mt-lg-2{margin-top:.5rem!important}.mt-lg-3{margin-top:1rem!important}.mt-lg-4{margin-top:1.5rem!important}.mt-lg-5{margin-top:3rem!important}.mt-lg-auto{margin-top:auto!important}.me-lg-0{margin-right:0!important}.me-lg-1{margin-right:.25rem!important}.me-lg-2{margin-right:.5rem!important}.me-lg-3{margin-right:1rem!important}.me-lg-4{margin-right:1.5rem!important}.me-lg-5{margin-right:3rem!important}.me-lg-auto{margin-right:auto!important}.mb-lg-0{margin-bottom:0!important}.mb-lg-1{margin-bottom:.25rem!important}.mb-lg-2{margin-bottom:.5rem!important}.mb-lg-3{margin-bottom:1rem!important}.mb-lg-4{margin-bottom:1.5rem!important}.mb-lg-5{margin-bottom:3rem!important}.mb-lg-auto{margin-bottom:auto!important}.ms-lg-0{margin-left:0!important}.ms-lg-1{margin-left:.25rem!important}.ms-lg-2{margin-left:.5rem!important}.ms-lg-3{margin-left:1rem!important}.ms-lg-4{margin-left:1.5rem!important}.ms-lg-5{margin-left:3rem!important}.ms-lg-auto{margin-left:auto!important}.p-lg-0{padding:0!important}.p-lg-1{padding:.25rem!important}.p-lg-2{padding:.5rem!important}.p-lg-3{padding:1rem!important}.p-lg-4{padding:1.5rem!important}.p-lg-5{padding:3rem!important}.px-lg-0{padding-right:0!important;padding-left:0!important}.px-lg-1{padding-right:.25rem!important;padding-left:.25rem!important}.px-lg-2{padding-right:.5rem!important;padding-left:.5rem!important}.px-lg-3{padding-right:1rem!important;padding-left:1rem!important}.px-lg-4{padding-right:1.5rem!important;padding-left:1.5rem!important}.px-lg-5{padding-right:3rem!important;padding-left:3rem!important}.py-lg-0{padding-top:0!important;padding-bottom:0!important}.py-lg-1{padding-top:.25rem!important;padding-bottom:.25rem!important}.py-lg-2{padding-top:.5rem!important;padding-bottom:.5rem!important}.py-lg-3{padding-top:1rem!important;padding-bottom:1rem!important}.py-lg-4{padding-top:1.5rem!important;padding-bottom:1.5rem!important}.py-lg-5{padding-top:3rem!important;padding-bottom:3rem!important}.pt-lg-0{padding-top:0!important}.pt-lg-1{padding-top:.25rem!important}.pt-lg-2{padding-top:.5rem!important}.pt-lg-3{padding-top:1rem!important}.pt-lg-4{padding-top:1.5rem!important}.pt-lg-5{padding-top:3rem!important}.pe-lg-0{padding-right:0!important}.pe-lg-1{padding-right:.25rem!important}.pe-lg-2{padding-right:.5rem!important}.pe-lg-3{padding-right:1rem!important}.pe-lg-4{padding-right:1.5rem!important}.pe-lg-5{padding-right:3rem!important}.pb-lg-0{padding-bottom:0!important}.pb-lg-1{padding-bottom:.25rem!important}.pb-lg-2{padding-bottom:.5rem!important}.pb-lg-3{padding-bottom:1rem!important}.pb-lg-4{padding-bottom:1.5rem!important}.pb-lg-5{padding-bottom:3rem!important}.ps-lg-0{padding-left:0!important}.ps-lg-1{padding-left:.25rem!important}.ps-lg-2{padding-left:.5rem!important}.ps-lg-3{padding-left:1rem!important}.ps-lg-4{padding-left:1.5rem!important}.ps-lg-5{padding-left:3rem!important}.gap-lg-0{gap:0!important}.gap-lg-1{gap:.25rem!important}.gap-lg-2{gap:.5rem!important}.gap-lg-3{gap:1rem!important}.gap-lg-4{gap:1.5rem!important}.gap-lg-5{gap:3rem!important}.row-gap-lg-0{row-gap:0!important}.row-gap-lg-1{row-gap:.25rem!important}.row-gap-lg-2{row-gap:.5rem!important}.row-gap-lg-3{row-gap:1rem!important}.row-gap-lg-4{row-gap:1.5rem!important}.row-gap-lg-5{row-gap:3rem!important}.column-gap-lg-0{-moz-column-gap:0!important;column-gap:0!important}.column-gap-lg-1{-moz-column-gap:0.25rem!important;column-gap:.25rem!important}.column-gap-lg-2{-moz-column-gap:0.5rem!important;column-gap:.5rem!important}.column-gap-lg-3{-moz-column-gap:1rem!important;column-gap:1rem!important}.column-gap-lg-4{-moz-column-gap:1.5rem!important;column-gap:1.5rem!important}.column-gap-lg-5{-moz-column-gap:3rem!important;column-gap:3rem!important}.text-lg-start{text-align:left!important}.text-lg-end{text-align:right!important}.text-lg-center{text-align:center!important}}@media (min-width:1200px){.float-xl-start{float:left!important}.float-xl-end{float:right!important}.float-xl-none{float:none!important}.object-fit-xl-contain{-o-object-fit:contain!important;object-fit:contain!important}.object-fit-xl-cover{-o-object-fit:cover!important;object-fit:cover!important}.object-fit-xl-fill{-o-object-fit:fill!important;object-fit:fill!important}.object-fit-xl-scale{-o-object-fit:scale-down!important;object-fit:scale-down!important}.object-fit-xl-none{-o-object-fit:none!important;object-fit:none!important}.d-xl-inline{display:inline!important}.d-xl-inline-block{display:inline-block!important}.d-xl-block{display:block!important}.d-xl-grid{display:grid!important}.d-xl-inline-grid{display:inline-grid!important}.d-xl-table{display:table!important}.d-xl-table-row{display:table-row!important}.d-xl-table-cell{display:table-cell!important}.d-xl-flex{display:flex!important}.d-xl-inline-flex{display:inline-flex!important}.d-xl-none{display:none!important}.flex-xl-fill{flex:1 1 auto!important}.flex-xl-row{flex-direction:row!important}.flex-xl-column{flex-direction:column!important}.flex-xl-row-reverse{flex-direction:row-reverse!important}.flex-xl-column-reverse{flex-direction:column-reverse!important}.flex-xl-grow-0{flex-grow:0!important}.flex-xl-grow-1{flex-grow:1!important}.flex-xl-shrink-0{flex-shrink:0!important}.flex-xl-shrink-1{flex-shrink:1!important}.flex-xl-wrap{flex-wrap:wrap!important}.flex-xl-nowrap{flex-wrap:nowrap!important}.flex-xl-wrap-reverse{flex-wrap:wrap-reverse!important}.justify-content-xl-start{justify-content:flex-start!important}.justify-content-xl-end{justify-content:flex-end!important}.justify-content-xl-center{justify-content:center!important}.justify-content-xl-between{justify-content:space-between!important}.justify-content-xl-around{justify-content:space-around!important}.justify-content-xl-evenly{justify-content:space-evenly!important}.align-items-xl-start{align-items:flex-start!important}.align-items-xl-end{align-items:flex-end!important}.align-items-xl-center{align-items:center!important}.align-items-xl-baseline{align-items:baseline!important}.align-items-xl-stretch{align-items:stretch!important}.align-content-xl-start{align-content:flex-start!important}.align-content-xl-end{align-content:flex-end!important}.align-content-xl-center{align-content:center!important}.align-content-xl-between{align-content:space-between!important}.align-content-xl-around{align-content:space-around!important}.align-content-xl-stretch{align-content:stretch!important}.align-self-xl-auto{align-self:auto!important}.align-self-xl-start{align-self:flex-start!important}.align-self-xl-end{align-self:flex-end!important}.align-self-xl-center{align-self:center!important}.align-self-xl-baseline{align-self:baseline!important}.align-self-xl-stretch{align-self:stretch!important}.order-xl-first{order:-1!important}.order-xl-0{order:0!important}.order-xl-1{order:1!important}.order-xl-2{order:2!important}.order-xl-3{order:3!important}.order-xl-4{order:4!important}.order-xl-5{order:5!important}.order-xl-last{order:6!important}.m-xl-0{margin:0!important}.m-xl-1{margin:.25rem!important}.m-xl-2{margin:.5rem!important}.m-xl-3{margin:1rem!important}.m-xl-4{margin:1.5rem!important}.m-xl-5{margin:3rem!important}.m-xl-auto{margin:auto!important}.mx-xl-0{margin-right:0!important;margin-left:0!important}.mx-xl-1{margin-right:.25rem!important;margin-left:.25rem!important}.mx-xl-2{margin-right:.5rem!important;margin-left:.5rem!important}.mx-xl-3{margin-right:1rem!important;margin-left:1rem!important}.mx-xl-4{margin-right:1.5rem!important;margin-left:1.5rem!important}.mx-xl-5{margin-right:3rem!important;margin-left:3rem!important}.mx-xl-auto{margin-right:auto!important;margin-left:auto!important}.my-xl-0{margin-top:0!important;margin-bottom:0!important}.my-xl-1{margin-top:.25rem!important;margin-bottom:.25rem!important}.my-xl-2{margin-top:.5rem!important;margin-bottom:.5rem!important}.my-xl-3{margin-top:1rem!important;margin-bottom:1rem!important}.my-xl-4{margin-top:1.5rem!important;margin-bottom:1.5rem!important}.my-xl-5{margin-top:3rem!important;margin-bottom:3rem!important}.my-xl-auto{margin-top:auto!important;margin-bottom:auto!important}.mt-xl-0{margin-top:0!important}.mt-xl-1{margin-top:.25rem!important}.mt-xl-2{margin-top:.5rem!important}.mt-xl-3{margin-top:1rem!important}.mt-xl-4{margin-top:1.5rem!important}.mt-xl-5{margin-top:3rem!important}.mt-xl-auto{margin-top:auto!important}.me-xl-0{margin-right:0!important}.me-xl-1{margin-right:.25rem!important}.me-xl-2{margin-right:.5rem!important}.me-xl-3{margin-right:1rem!important}.me-xl-4{margin-right:1.5rem!important}.me-xl-5{margin-right:3rem!important}.me-xl-auto{margin-right:auto!important}.mb-xl-0{margin-bottom:0!important}.mb-xl-1{margin-bottom:.25rem!important}.mb-xl-2{margin-bottom:.5rem!important}.mb-xl-3{margin-bottom:1rem!important}.mb-xl-4{margin-bottom:1.5rem!important}.mb-xl-5{margin-bottom:3rem!important}.mb-xl-auto{margin-bottom:auto!important}.ms-xl-0{margin-left:0!important}.ms-xl-1{margin-left:.25rem!important}.ms-xl-2{margin-left:.5rem!important}.ms-xl-3{margin-left:1rem!important}.ms-xl-4{margin-left:1.5rem!important}.ms-xl-5{margin-left:3rem!important}.ms-xl-auto{margin-left:auto!important}.p-xl-0{padding:0!important}.p-xl-1{padding:.25rem!important}.p-xl-2{padding:.5rem!important}.p-xl-3{padding:1rem!important}.p-xl-4{padding:1.5rem!important}.p-xl-5{padding:3rem!important}.px-xl-0{padding-right:0!important;padding-left:0!important}.px-xl-1{padding-right:.25rem!important;padding-left:.25rem!important}.px-xl-2{padding-right:.5rem!important;padding-left:.5rem!important}.px-xl-3{padding-right:1rem!important;padding-left:1rem!important}.px-xl-4{padding-right:1.5rem!important;padding-left:1.5rem!important}.px-xl-5{padding-right:3rem!important;padding-left:3rem!important}.py-xl-0{padding-top:0!important;padding-bottom:0!important}.py-xl-1{padding-top:.25rem!important;padding-bottom:.25rem!important}.py-xl-2{padding-top:.5rem!important;padding-bottom:.5rem!important}.py-xl-3{padding-top:1rem!important;padding-bottom:1rem!important}.py-xl-4{padding-top:1.5rem!important;padding-bottom:1.5rem!important}.py-xl-5{padding-top:3rem!important;padding-bottom:3rem!important}.pt-xl-0{padding-top:0!important}.pt-xl-1{padding-top:.25rem!important}.pt-xl-2{padding-top:.5rem!important}.pt-xl-3{padding-top:1rem!important}.pt-xl-4{padding-top:1.5rem!important}.pt-xl-5{padding-top:3rem!important}.pe-xl-0{padding-right:0!important}.pe-xl-1{padding-right:.25rem!important}.pe-xl-2{padding-right:.5rem!important}.pe-xl-3{padding-right:1rem!important}.pe-xl-4{padding-right:1.5rem!important}.pe-xl-5{padding-right:3rem!important}.pb-xl-0{padding-bottom:0!important}.pb-xl-1{padding-bottom:.25rem!important}.pb-xl-2{padding-bottom:.5rem!important}.pb-xl-3{padding-bottom:1rem!important}.pb-xl-4{padding-bottom:1.5rem!important}.pb-xl-5{padding-bottom:3rem!important}.ps-xl-0{padding-left:0!important}.ps-xl-1{padding-left:.25rem!important}.ps-xl-2{padding-left:.5rem!important}.ps-xl-3{padding-left:1rem!important}.ps-xl-4{padding-left:1.5rem!important}.ps-xl-5{padding-left:3rem!important}.gap-xl-0{gap:0!important}.gap-xl-1{gap:.25rem!important}.gap-xl-2{gap:.5rem!important}.gap-xl-3{gap:1rem!important}.gap-xl-4{gap:1.5rem!important}.gap-xl-5{gap:3rem!important}.row-gap-xl-0{row-gap:0!important}.row-gap-xl-1{row-gap:.25rem!important}.row-gap-xl-2{row-gap:.5rem!important}.row-gap-xl-3{row-gap:1rem!important}.row-gap-xl-4{row-gap:1.5rem!important}.row-gap-xl-5{row-gap:3rem!important}.column-gap-xl-0{-moz-column-gap:0!important;column-gap:0!important}.column-gap-xl-1{-moz-column-gap:0.25rem!important;column-gap:.25rem!important}.column-gap-xl-2{-moz-column-gap:0.5rem!important;column-gap:.5rem!important}.column-gap-xl-3{-moz-column-gap:1rem!important;column-gap:1rem!important}.column-gap-xl-4{-moz-column-gap:1.5rem!important;column-gap:1.5rem!important}.column-gap-xl-5{-moz-column-gap:3rem!important;column-gap:3rem!important}.text-xl-start{text-align:left!important}.text-xl-end{text-align:right!important}.text-xl-center{text-align:center!important}}@media (min-width:1400px){.float-xxl-start{float:left!important}.float-xxl-end{float:right!important}.float-xxl-none{float:none!important}.object-fit-xxl-contain{-o-object-fit:contain!important;object-fit:contain!important}.object-fit-xxl-cover{-o-object-fit:cover!important;object-fit:cover!important}.object-fit-xxl-fill{-o-object-fit:fill!important;object-fit:fill!important}.object-fit-xxl-scale{-o-object-fit:scale-down!important;object-fit:scale-down!important}.object-fit-xxl-none{-o-object-fit:none!important;object-fit:none!important}.d-xxl-inline{display:inline!important}.d-xxl-inline-block{display:inline-block!important}.d-xxl-block{display:block!important}.d-xxl-grid{display:grid!important}.d-xxl-inline-grid{display:inline-grid!important}.d-xxl-table{display:table!important}.d-xxl-table-row{display:table-row!important}.d-xxl-table-cell{display:table-cell!important}.d-xxl-flex{display:flex!important}.d-xxl-inline-flex{display:inline-flex!important}.d-xxl-none{display:none!important}.flex-xxl-fill{flex:1 1 auto!important}.flex-xxl-row{flex-direction:row!important}.flex-xxl-column{flex-direction:column!important}.flex-xxl-row-reverse{flex-direction:row-reverse!important}.flex-xxl-column-reverse{flex-direction:column-reverse!important}.flex-xxl-grow-0{flex-grow:0!important}.flex-xxl-grow-1{flex-grow:1!important}.flex-xxl-shrink-0{flex-shrink:0!important}.flex-xxl-shrink-1{flex-shrink:1!important}.flex-xxl-wrap{flex-wrap:wrap!important}.flex-xxl-nowrap{flex-wrap:nowrap!important}.flex-xxl-wrap-reverse{flex-wrap:wrap-reverse!important}.justify-content-xxl-start{justify-content:flex-start!important}.justify-content-xxl-end{justify-content:flex-end!important}.justify-content-xxl-center{justify-content:center!important}.justify-content-xxl-between{justify-content:space-between!important}.justify-content-xxl-around{justify-content:space-around!important}.justify-content-xxl-evenly{justify-content:space-evenly!important}.align-items-xxl-start{align-items:flex-start!important}.align-items-xxl-end{align-items:flex-end!important}.align-items-xxl-center{align-items:center!important}.align-items-xxl-baseline{align-items:baseline!important}.align-items-xxl-stretch{align-items:stretch!important}.align-content-xxl-start{align-content:flex-start!important}.align-content-xxl-end{align-content:flex-end!important}.align-content-xxl-center{align-content:center!important}.align-content-xxl-between{align-content:space-between!important}.align-content-xxl-around{align-content:space-around!important}.align-content-xxl-stretch{align-content:stretch!important}.align-self-xxl-auto{align-self:auto!important}.align-self-xxl-start{align-self:flex-start!important}.align-self-xxl-end{align-self:flex-end!important}.align-self-xxl-center{align-self:center!important}.align-self-xxl-baseline{align-self:baseline!important}.align-self-xxl-stretch{align-self:stretch!important}.order-xxl-first{order:-1!important}.order-xxl-0{order:0!important}.order-xxl-1{order:1!important}.order-xxl-2{order:2!important}.order-xxl-3{order:3!important}.order-xxl-4{order:4!important}.order-xxl-5{order:5!important}.order-xxl-last{order:6!important}.m-xxl-0{margin:0!important}.m-xxl-1{margin:.25rem!important}.m-xxl-2{margin:.5rem!important}.m-xxl-3{margin:1rem!important}.m-xxl-4{margin:1.5rem!important}.m-xxl-5{margin:3rem!important}.m-xxl-auto{margin:auto!important}.mx-xxl-0{margin-right:0!important;margin-left:0!important}.mx-xxl-1{margin-right:.25rem!important;margin-left:.25rem!important}.mx-xxl-2{margin-right:.5rem!important;margin-left:.5rem!important}.mx-xxl-3{margin-right:1rem!important;margin-left:1rem!important}.mx-xxl-4{margin-right:1.5rem!important;margin-left:1.5rem!important}.mx-xxl-5{margin-right:3rem!important;margin-left:3rem!important}.mx-xxl-auto{margin-right:auto!important;margin-left:auto!important}.my-xxl-0{margin-top:0!important;margin-bottom:0!important}.my-xxl-1{margin-top:.25rem!important;margin-bottom:.25rem!important}.my-xxl-2{margin-top:.5rem!important;margin-bottom:.5rem!important}.my-xxl-3{margin-top:1rem!important;margin-bottom:1rem!important}.my-xxl-4{margin-top:1.5rem!important;margin-bottom:1.5rem!important}.my-xxl-5{margin-top:3rem!important;margin-bottom:3rem!important}.my-xxl-auto{margin-top:auto!important;margin-bottom:auto!important}.mt-xxl-0{margin-top:0!important}.mt-xxl-1{margin-top:.25rem!important}.mt-xxl-2{margin-top:.5rem!important}.mt-xxl-3{margin-top:1rem!important}.mt-xxl-4{margin-top:1.5rem!important}.mt-xxl-5{margin-top:3rem!important}.mt-xxl-auto{margin-top:auto!important}.me-xxl-0{margin-right:0!important}.me-xxl-1{margin-right:.25rem!important}.me-xxl-2{margin-right:.5rem!important}.me-xxl-3{margin-right:1rem!important}.me-xxl-4{margin-right:1.5rem!important}.me-xxl-5{margin-right:3rem!important}.me-xxl-auto{margin-right:auto!important}.mb-xxl-0{margin-bottom:0!important}.mb-xxl-1{margin-bottom:.25rem!important}.mb-xxl-2{margin-bottom:.5rem!important}.mb-xxl-3{margin-bottom:1rem!important}.mb-xxl-4{margin-bottom:1.5rem!important}.mb-xxl-5{margin-bottom:3rem!important}.mb-xxl-auto{margin-bottom:auto!important}.ms-xxl-0{margin-left:0!important}.ms-xxl-1{margin-left:.25rem!important}.ms-xxl-2{margin-left:.5rem!important}.ms-xxl-3{margin-left:1rem!important}.ms-xxl-4{margin-left:1.5rem!important}.ms-xxl-5{margin-left:3rem!important}.ms-xxl-auto{margin-left:auto!important}.p-xxl-0{padding:0!important}.p-xxl-1{padding:.25rem!important}.p-xxl-2{padding:.5rem!important}.p-xxl-3{padding:1rem!important}.p-xxl-4{padding:1.5rem!important}.p-xxl-5{padding:3rem!important}.px-xxl-0{padding-right:0!important;padding-left:0!important}.px-xxl-1{padding-right:.25rem!important;padding-left:.25rem!important}.px-xxl-2{padding-right:.5rem!important;padding-left:.5rem!important}.px-xxl-3{padding-right:1rem!important;padding-left:1rem!important}.px-xxl-4{padding-right:1.5rem!important;padding-left:1.5rem!important}.px-xxl-5{padding-right:3rem!important;padding-left:3rem!important}.py-xxl-0{padding-top:0!important;padding-bottom:0!important}.py-xxl-1{padding-top:.25rem!important;padding-bottom:.25rem!important}.py-xxl-2{padding-top:.5rem!important;padding-bottom:.5rem!important}.py-xxl-3{padding-top:1rem!important;padding-bottom:1rem!important}.py-xxl-4{padding-top:1.5rem!important;padding-bottom:1.5rem!important}.py-xxl-5{padding-top:3rem!important;padding-bottom:3rem!important}.pt-xxl-0{padding-top:0!important}.pt-xxl-1{padding-top:.25rem!important}.pt-xxl-2{padding-top:.5rem!important}.pt-xxl-3{padding-top:1rem!important}.pt-xxl-4{padding-top:1.5rem!important}.pt-xxl-5{padding-top:3rem!important}.pe-xxl-0{padding-right:0!important}.pe-xxl-1{padding-right:.25rem!important}.pe-xxl-2{padding-right:.5rem!important}.pe-xxl-3{padding-right:1rem!important}.pe-xxl-4{padding-right:1.5rem!important}.pe-xxl-5{padding-right:3rem!important}.pb-xxl-0{padding-bottom:0!important}.pb-xxl-1{padding-bottom:.25rem!important}.pb-xxl-2{padding-bottom:.5rem!important}.pb-xxl-3{padding-bottom:1rem!important}.pb-xxl-4{padding-bottom:1.5rem!important}.pb-xxl-5{padding-bottom:3rem!important}.ps-xxl-0{padding-left:0!important}.ps-xxl-1{padding-left:.25rem!important}.ps-xxl-2{padding-left:.5rem!important}.ps-xxl-3{padding-left:1rem!important}.ps-xxl-4{padding-left:1.5rem!important}.ps-xxl-5{padding-left:3rem!important}.gap-xxl-0{gap:0!important}.gap-xxl-1{gap:.25rem!important}.gap-xxl-2{gap:.5rem!important}.gap-xxl-3{gap:1rem!important}.gap-xxl-4{gap:1.5rem!important}.gap-xxl-5{gap:3rem!important}.row-gap-xxl-0{row-gap:0!important}.row-gap-xxl-1{row-gap:.25rem!important}.row-gap-xxl-2{row-gap:.5rem!important}.row-gap-xxl-3{row-gap:1rem!important}.row-gap-xxl-4{row-gap:1.5rem!important}.row-gap-xxl-5{row-gap:3rem!important}.column-gap-xxl-0{-moz-column-gap:0!important;column-gap:0!important}.column-gap-xxl-1{-moz-column-gap:0.25rem!important;column-gap:.25rem!important}.column-gap-xxl-2{-moz-column-gap:0.5rem!important;column-gap:.5rem!important}.column-gap-xxl-3{-moz-column-gap:1rem!important;column-gap:1rem!important}.column-gap-xxl-4{-moz-column-gap:1.5rem!important;column-gap:1.5rem!important}.column-gap-xxl-5{-moz-column-gap:3rem!important;column-gap:3rem!important}.text-xxl-start{text-align:left!important}.text-xxl-end{text-align:right!important}.text-xxl-center{text-align:center!important}}@media (min-width:1200px){.fs-1{font-size:2.5rem!important}.fs-2{font-size:2rem!important}.fs-3{font-size:1.75rem!important}.fs-4{font-size:1.5rem!important}}@media print{.d-print-inline{display:inline!important}.d-print-inline-block{display:inline-block!important}.d-print-block{display:block!important}.d-print-grid{display:grid!important}.d-print-inline-grid{display:inline-grid!important}.d-print-table{display:table!important}.d-print-table-row{display:table-row!important}.d-print-table-cell{display:table-cell!important}.d-print-flex{display:flex!important}.d-print-inline-flex{display:inline-flex!important}.d-print-none{display:none!important}}
+/*# sourceMappingURL=bootstrap.min.css.map */
\ No newline at end of file
diff --git a/scripts/addons/webgui/src/aim_webgui/static/vendor/htmx.min.js b/scripts/addons/webgui/src/aim_webgui/static/vendor/htmx.min.js
new file mode 100644
index 0000000..3b7ac1a
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/static/vendor/htmx.min.js
@@ -0,0 +1 @@
+var htmx=function(){"use strict";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=dn(e,t||"post");return n.values},remove:null,addClass:null,removeClass:null,toggleClass:null,takeClass:null,swap:null,defineExtension:null,removeExtension:null,logAll:null,logNone:null,logger:null,config:{historyEnabled:true,historyCacheSize:10,refreshOnHistoryMiss:false,defaultSwapStyle:"innerHTML",defaultSwapDelay:0,defaultSettleDelay:20,includeIndicatorStyles:true,indicatorClass:"htmx-indicator",requestClass:"htmx-request",addedClass:"htmx-added",settlingClass:"htmx-settling",swappingClass:"htmx-swapping",allowEval:true,allowScriptTags:true,inlineScriptNonce:"",inlineStyleNonce:"",attributesToSettle:["class","style","width","height"],withCredentials:false,timeout:0,wsReconnectDelay:"full-jitter",wsBinaryType:"blob",disableSelector:"[hx-disable], [data-hx-disable]",scrollBehavior:"instant",defaultFocusScroll:false,getCacheBusterParam:false,globalViewTransitions:false,methodsThatUseUrlParams:["get","delete"],selfRequestsOnly:true,ignoreTitle:false,scrollIntoViewOnBoost:true,triggerSpecsCache:null,disableInheritance:false,responseHandling:[{code:"204",swap:false},{code:"[23]..",swap:true},{code:"[45]..",swap:false,error:true}],allowNestedOobSwaps:true,historyRestoreAsHxRequest:true,reportValidityOfForms:false},parseInterval:null,location:location,_:null,version:"2.0.10"};Q.onLoad=j;Q.process=Ft;Q.on=ye;Q.off=xe;Q.trigger=ae;Q.ajax=Nn;Q.find=f;Q.findAll=y;Q.closest=g;Q.remove=z;Q.addClass=w;Q.removeClass=b;Q.toggleClass=G;Q.takeClass=W;Q.swap=_e;Q.defineExtension=_n;Q.removeExtension=zn;Q.logAll=$;Q.logNone=_;Q.parseInterval=d;Q._=e;const n={addTriggerHandler:St,bodyContains:se,canAccessLocalStorage:U,findThisElement:we,filterValues:yn,swap:_e,hasAttribute:s,getAttributeValue:a,getClosestAttributeValue:ne,getClosestMatch:A,getExpressionVars:Rn,getHeaders:mn,getInputValues:dn,getInternalData:oe,getSwapSpecification:bn,getTriggerSpecs:st,getTarget:Se,makeFragment:P,mergeObjects:le,makeSettleInfo:Sn,oobSwap:He,querySelectorExt:ce,settleImmediately:Yt,shouldCancel:ht,triggerEvent:ae,triggerErrorEvent:fe,withExtensions:Vt};const de=["get","post","put","delete","patch"];const R=de.map(function(e){return"[hx-"+e+"], [data-hx-"+e+"]"}).join(", ");function d(e){if(e==undefined){return undefined}let t=NaN;if(e.slice(-2)=="ms"){t=parseFloat(e.slice(0,-2))}else if(e.slice(-1)=="s"){t=parseFloat(e.slice(0,-1))*1e3}else if(e.slice(-1)=="m"){t=parseFloat(e.slice(0,-1))*1e3*60}else{t=parseFloat(e)}return isNaN(t)?undefined:t}function ee(e,t){return e instanceof Element&&e.getAttribute(t)}function s(e,t){return!!e.hasAttribute&&(e.hasAttribute(t)||e.hasAttribute("data-"+t))}function a(e,t){return ee(e,t)||ee(e,"data-"+t)}function c(e){const t=e.parentElement;if(!t&&e.parentNode instanceof ShadowRoot)return e.parentNode;return t}function te(){return document}function q(e,t){return e.getRootNode?e.getRootNode({composed:t}):te()}function A(e,t){while(e&&!t(e)){e=c(e)}return e||null}function o(e,t,n){const r=a(t,n);const o=a(t,"hx-disinherit");var i=a(t,"hx-inherit");if(e!==t){if(Q.config.disableInheritance){if(i&&(i==="*"||i.split(" ").indexOf(n)>=0)){return r}else{return null}}if(o&&(o==="*"||o.split(" ").indexOf(n)>=0)){return"unset"}}return r}function ne(t,n){let r=null;A(t,function(e){return!!(r=o(t,ue(e),n))});if(r!=="unset"){return r}}function h(e,t){return e instanceof Element&&e.matches(t)}function N(e){const t=/<([a-z][^\/\0>\x20\t\r\n\f]*)/i;const n=t.exec(e);if(n){return n[1].toLowerCase()}else{return""}}function I(e){if("parseHTMLUnsafe"in Document){return Document.parseHTMLUnsafe(e)}const t=new DOMParser;return t.parseFromString(e,"text/html")}function L(e,t){while(t.childNodes.length>0){e.append(t.childNodes[0])}}function r(e){const t=te().createElement("script");ie(e.attributes,function(e){t.setAttribute(e.name,e.value)});t.textContent=e.textContent;t.async=false;if(Q.config.inlineScriptNonce){t.nonce=Q.config.inlineScriptNonce}return t}function i(e){return e.matches("script")&&(e.type==="text/javascript"||e.type==="module"||e.type==="")}function D(e){Array.from(e.querySelectorAll("script")).forEach(e=>{if(i(e)){const t=r(e);const n=e.parentNode;try{n.insertBefore(t,e)}catch(e){H(e)}finally{e.remove()}}})}function P(e){const t=e.replace(/<head(\s[^>]*)?>[\s\S]*?<\/head>/i,"");const n=N(t);let r;if(n==="html"){r=new DocumentFragment;const i=I(e);L(r,i.body);r.title=i.title}else if(n==="body"){r=new DocumentFragment;const i=I(t);L(r,i.body);r.title=i.title}else{const i=I('<body><template class="internal-htmx-wrapper">'+t+"</template></body>");r=i.querySelector("template").content;r.title=i.title;var o=r.querySelector("title");if(o&&o.parentNode===r){o.remove();r.title=o.innerText}}if(r){if(Q.config.allowScriptTags){D(r)}else{r.querySelectorAll("script").forEach(e=>e.remove())}}return r}function re(e){if(e){e()}}function t(e,t){return Object.prototype.toString.call(e)==="[object "+t+"]"}function k(e){return typeof e==="function"}function M(e){return t(e,"Object")}function oe(e){const t="htmx-internal-data";let n=e[t];if(!n){n=e[t]={}}return n}function F(t){const n=[];if(t){for(let e=0;e<t.length;e++){n.push(t[e])}}return n}function ie(t,n){if(t){for(let e=0;e<t.length;e++){n(t[e])}}}function B(e){const t=e.getBoundingClientRect();const n=t.top;const r=t.bottom;return n<window.innerHeight&&r>=0}function se(e){return e.getRootNode({composed:true})===document}function X(e){return e.trim().split(/\s+/)}function le(e,t){for(const n in t){if(t.hasOwnProperty(n)){e[n]=t[n]}}return e}function v(e){try{return JSON.parse(e)}catch(e){H(e);return null}}function U(){const e="htmx:sessionStorageTest";try{sessionStorage.setItem(e,e);sessionStorage.removeItem(e);return true}catch(e){return false}}function V(e){try{const t=new URL(e,window.location.href);e=t.pathname+t.search}catch(e){}if(e!="/"){e=e.replace(/\/+$/,"")}return e}function e(e){return On(te().body,function(){return eval(e)})}function j(t){const e=Q.on("htmx:load",function(e){t(e.detail.elt)});return e}function $(){Q.logger=function(e,t,n){if(console){console.log(t,e,n)}}}function _(){Q.logger=null}function f(e,t){if(typeof e!=="string"){return e.querySelector(t)}else{return f(te(),e)}}function y(e,t){if(typeof e!=="string"){return e.querySelectorAll(t)}else{return y(te(),e)}}function x(){return window}function z(e,t){e=S(e);if(t){x().setTimeout(function(){z(e);e=null},t)}else{c(e).removeChild(e)}}function ue(e){return e instanceof Element?e:null}function J(e){return e instanceof HTMLElement?e:null}function K(e){return typeof e==="string"?e:null}function p(e){return e instanceof Element||e instanceof Document||e instanceof DocumentFragment?e:null}function w(e,t,n){e=ue(S(e));if(!e){return}if(n){x().setTimeout(function(){w(e,t);e=null},n)}else{e.classList&&e.classList.add(t)}}function b(e,t,n){let r=ue(S(e));if(!r){return}if(n){x().setTimeout(function(){b(r,t);r=null},n)}else{if(r.classList){r.classList.remove(t);if(r.classList.length===0){r.removeAttribute("class")}}}}function G(e,t){e=S(e);e.classList.toggle(t)}function W(e,t){e=S(e);ie(e.parentElement.children,function(e){b(e,t)});w(ue(e),t)}function g(e,t){e=ue(S(e));if(e){return e.closest(t)}return null}function l(e,t){return e.substring(0,t.length)===t}function Z(e,t){return e.substring(e.length-t.length)===t}function Y(e){const t=e.trim();if(l(t,"<")&&Z(t,"/>")){return t.substring(1,t.length-2)}else{return t}}function m(t,r,n){if(r.indexOf("global ")===0){return m(t,r.slice(7),true)}t=S(t);const o=[];{let t=0;let n=0;for(let e=0;e<r.length;e++){const l=r[e];if(l===","&&t===0){o.push(r.substring(n,e));n=e+1;continue}if(l==="<"){t++}else if(l==="/"&&e<r.length-1&&r[e+1]===">"){t--}}if(n<r.length){o.push(r.substring(n))}}const i=[];const s=[];while(o.length>0){const r=Y(o.shift());let e;if(r.indexOf("closest ")===0){e=g(ue(t),Y(r.slice(8)))}else if(r.indexOf("find ")===0){e=f(p(t),Y(r.slice(5)))}else if(r==="next"||r==="nextElementSibling"){e=ue(t).nextElementSibling}else if(r.indexOf("next ")===0){e=pe(t,Y(r.slice(5)),!!n)}else if(r==="previous"||r==="previousElementSibling"){e=ue(t).previousElementSibling}else if(r.indexOf("previous ")===0){e=ge(t,Y(r.slice(9)),!!n)}else if(r==="document"){e=document}else if(r==="window"){e=window}else if(r==="body"){e=document.body}else if(r==="root"){e=q(t,!!n)}else if(r==="host"){e=t.getRootNode().host}else{s.push(r)}if(e){i.push(e)}}if(s.length>0){const e=s.join(",");const u=p(q(t,!!n));i.push(...F(u.querySelectorAll(e)))}return i}var pe=function(t,e,n){const r=p(q(t,n)).querySelectorAll(e);for(let e=0;e<r.length;e++){const o=r[e];if(o.compareDocumentPosition(t)===Node.DOCUMENT_POSITION_PRECEDING){return o}}};var ge=function(t,e,n){const r=p(q(t,n)).querySelectorAll(e);for(let e=r.length-1;e>=0;e--){const o=r[e];if(o.compareDocumentPosition(t)===Node.DOCUMENT_POSITION_FOLLOWING){return o}}};function ce(e,t){if(typeof e!=="string"){return m(e,t)[0]}else{return m(te().body,e)[0]}}function S(e,t){if(typeof e==="string"){return f(p(t)||document,e)}else{return e}}function me(e,t,n,r){if(k(t)){return{target:te().body,event:K(e),listener:t,options:n}}else{return{target:S(e),event:K(t),listener:n,options:r}}}function ye(t,n,r,o){Gn(function(){const e=me(t,n,r,o);e.target.addEventListener(e.event,e.listener,e.options)});const e=k(n);return e?n:r}function xe(t,n,r){Gn(function(){const e=me(t,n,r);e.target.removeEventListener(e.event,e.listener)});return k(n)?n:r}const be=te().createElement("output");function ve(t,n){const e=ne(t,n);if(e){if(e==="this"){return[we(t,n)]}else{const r=m(t,e);const o=/(^|,)(\s*)inherit(\s*)($|,)/.test(e);if(o){const i=ue(A(t,function(e){return e!==t&&s(ue(e),n)}));if(i){r.push(...ve(i,n))}}if(r.length===0){H('The selector "'+e+'" on '+n+" returned no matches!");return[be]}else{return r}}}}function we(e,t){return ue(A(e,function(e){return a(ue(e),t)!=null}))}function Se(e){const t=ne(e,"hx-target");if(t){if(t==="this"){return we(e,"hx-target")}else{return ce(e,t)}}else{const n=oe(e);if(n.boosted){return te().body}else{return e}}}function Ee(e){return Q.config.attributesToSettle.includes(e)}function Ce(t,n){ie(Array.from(t.attributes),function(e){if(!n.hasAttribute(e.name)&&Ee(e.name)){t.removeAttribute(e.name)}});ie(n.attributes,function(e){if(Ee(e.name)){t.setAttribute(e.name,e.value)}})}function Oe(t,e){const n=Jn(e);for(let e=0;e<n.length;e++){const r=n[e];try{if(r.isInlineSwap(t)){return true}}catch(e){H(e)}}return t==="outerHTML"}function He(e,o,i,t){t=t||te();let n="#"+CSS.escape(ee(o,"id"));let s="outerHTML";if(e==="true"){}else if(e.indexOf(":")>0){s=e.substring(0,e.indexOf(":"));n=e.substring(e.indexOf(":")+1)}else{s=e}o.removeAttribute("hx-swap-oob");o.removeAttribute("data-hx-swap-oob");const r=m(t,n,false);if(r.length){ie(r,function(e){let t;const n=o.cloneNode(true);t=te().createDocumentFragment();t.appendChild(n);if(!Oe(s,e)){t=p(n)}const r={shouldSwap:true,target:e,fragment:t};if(!ae(e,"htmx:oobBeforeSwap",r))return;e=r.target;if(r.shouldSwap){Re(t);je(s,e,e,t,i);Te()}ie(i.elts,function(e){ae(e,"htmx:oobAfterSwap",r)})});o.parentNode.removeChild(o)}else{o.parentNode.removeChild(o);fe(te().body,"htmx:oobErrorNoTarget",{content:o,target:n})}return e}function Te(){const e=f("#--htmx-preserve-pantry--");if(e){for(const t of[...e.children]){const n=f("#"+t.id);n.parentNode.moveBefore(t,n);n.remove()}e.remove()}}function Re(e){ie(y(e,"[hx-preserve], [data-hx-preserve]"),function(e){const t=a(e,"id");const n=te().getElementById(t);if(n!=null){if(e.moveBefore){let e=f("#--htmx-preserve-pantry--");if(e==null){te().body.insertAdjacentHTML("afterend","<div id='--htmx-preserve-pantry--'></div>");e=f("#--htmx-preserve-pantry--")}e.moveBefore(n,null)}else{e.parentNode.replaceChild(n,e)}}})}function qe(i,e,s){ie(e.querySelectorAll("[id]"),function(t){const n=ee(t,"id");if(n&&n.length>0){const e=p(i);const r=e&&e.querySelector(CSS.escape(t.tagName)+"#"+CSS.escape(n));if(r&&r!==e){const o=t.cloneNode();Ce(t,r);s.tasks.push(function(){Ce(t,o)})}}})}function Ae(e){return function(){b(e,Q.config.addedClass);Ft(ue(e));Ne(p(e));ae(e,"htmx:load")}}function Ne(e){const t="[autofocus]";const n=J(h(e,t)?e:e.querySelector(t));if(n!=null){n.focus()}}function u(e,t,n,r){qe(e,n,r);while(n.childNodes.length>0){const o=n.firstChild;w(ue(o),Q.config.addedClass);e.insertBefore(o,t);if(o.nodeType!==Node.TEXT_NODE&&o.nodeType!==Node.COMMENT_NODE){r.tasks.push(Ae(o))}}}function Ie(e,t){let n=0;while(n<e.length){t=(t<<5)-t+e.charCodeAt(n++)|0}return t}function Le(t){let n=0;for(let e=0;e<t.attributes.length;e++){const r=t.attributes[e];if(r.value){n=Ie(r.name,n);n=Ie(r.value,n)}}return n}function De(t){const n=oe(t);if(n.onHandlers){for(let e=0;e<n.onHandlers.length;e++){const r=n.onHandlers[e];xe(t,r.event,r.listener)}delete n.onHandlers}}function Pe(e){const t=oe(e);if(t.timeout){clearTimeout(t.timeout)}if(t.listenerInfos){ie(t.listenerInfos,function(e){if(e.on){xe(e.on,e.trigger,e.listener)}})}De(e);ie(Object.keys(t),function(e){if(e!=="firstInitCompleted")delete t[e]})}function E(e){ae(e,"htmx:beforeCleanupElement");Pe(e);ie(e.children,function(e){E(e)})}function ke(t,e,n){if(t.tagName==="BODY"){return Ve(t,e,n)}let r;const o=t.previousSibling;const i=c(t);if(!i){return}u(i,t,e,n);if(o==null){r=i.firstChild}else{r=o.nextSibling}n.elts=n.elts.filter(function(e){return e!==t});while(r&&r!==t){if(r instanceof Element){n.elts.push(r)}r=r.nextSibling}E(t);t.remove()}function Me(e,t,n){return u(e,e.firstChild,t,n)}function Fe(e,t,n){return u(c(e),e,t,n)}function Be(e,t,n){return u(e,null,t,n)}function Xe(e,t,n){return u(c(e),e.nextSibling,t,n)}function Ue(e){E(e);const t=c(e);if(t){return t.removeChild(e)}}function Ve(e,t,n){const r=e.firstChild;u(e,r,t,n);if(r){while(r.nextSibling){E(r.nextSibling);e.removeChild(r.nextSibling)}E(r);e.removeChild(r)}}function je(t,e,n,r,o){switch(t){case"none":return;case"outerHTML":ke(n,r,o);return;case"afterbegin":Me(n,r,o);return;case"beforebegin":Fe(n,r,o);return;case"beforeend":Be(n,r,o);return;case"afterend":Xe(n,r,o);return;case"delete":Ue(n);return;default:var i=Jn(e);for(let e=0;e<i.length;e++){const s=i[e];try{const l=s.handleSwap(t,n,r,o);if(l){if(Array.isArray(l)){for(let e=0;e<l.length;e++){const u=l[e];if(u.nodeType!==Node.TEXT_NODE&&u.nodeType!==Node.COMMENT_NODE){o.tasks.push(Ae(u))}}}return}}catch(e){H(e)}}if(t==="innerHTML"){Ve(n,r,o)}else{je(Q.config.defaultSwapStyle,e,n,r,o)}}}function $e(e,n,r){var t=y(e,"[hx-swap-oob], [data-hx-swap-oob]");ie(t,function(e){if(Q.config.allowNestedOobSwaps||e.parentElement===null){const t=a(e,"hx-swap-oob");if(t!=null){He(t,e,n,r)}}else{e.removeAttribute("hx-swap-oob");e.removeAttribute("data-hx-swap-oob")}});return t.length>0}function _e(h,d,p,g){if(!g){g={}}let m=null;let n=null;let e=function(){re(g.beforeSwapCallback);h=S(h);const r=g.contextElement?q(g.contextElement,false):te();const e=document.activeElement;let t={};t={elt:e,start:e?e.selectionStart:null,end:e?e.selectionEnd:null};const o=Sn(h);if(p.swapStyle==="textContent"){h.textContent=d}else{let n=P(d);o.title=g.title||n.title;if(g.historyRequest){n=n.querySelector("[hx-history-elt],[data-hx-history-elt]")||n}if(g.selectOOB){const i=g.selectOOB.split(",");for(let t=0;t<i.length;t++){const s=i[t].split(":",2);let e=s[0].trim();if(e.indexOf("#")===0){e=e.substring(1)}const l=s[1]||"true";const u=n.querySelector("#"+e);if(u){He(l,u,o,r)}}}$e(n,o,r);ie(y(n,"template"),function(e){if(e.content&&$e(e.content,o,r)){e.remove()}});if(g.select){const c=te().createDocumentFragment();ie(n.querySelectorAll(g.select),function(e){c.appendChild(e)});n=c}Re(n);je(p.swapStyle,g.contextElement,h,n,o);Te()}if(t.elt&&!se(t.elt)&&ee(t.elt,"id")){const f=document.getElementById(ee(t.elt,"id"));const a={preventScroll:p.focusScroll!==undefined?!p.focusScroll:!Q.config.defaultFocusScroll};if(f){if(t.start&&f.setSelectionRange){try{f.setSelectionRange(t.start,t.end)}catch(e){}}f.focus(a)}}b(h,Q.config.swappingClass);ie(o.elts,function(e){if(e.classList){w(e,Q.config.settlingClass)}ae(e,"htmx:afterSwap",g.eventInfo)});re(g.afterSwapCallback);if(!p.ignoreTitle){Xn(o.title)}const n=function(){ie(o.tasks,function(e){e.call()});ie(o.elts,function(e){if(e.classList){b(e,Q.config.settlingClass)}ae(e,"htmx:afterSettle",g.eventInfo)});if(g.anchor){const e=ue(S("#"+g.anchor));if(e){e.scrollIntoView({block:"start",behavior:"auto"})}}En(o.elts,p);re(g.afterSettleCallback);re(m)};if(p.settleDelay>0){x().setTimeout(n,p.settleDelay)}else{n()}};let t=Q.config.globalViewTransitions;if(p.hasOwnProperty("transition")){t=p.transition}const r=g.contextElement||te();if(t&&ae(r,"htmx:beforeTransition",g.eventInfo)&&typeof Promise!=="undefined"&&document.startViewTransition){const o=new Promise(function(e,t){m=e;n=t});const i=e;e=function(){document.startViewTransition(function(){i();return o})}}try{if(p?.swapDelay&&p.swapDelay>0){x().setTimeout(e,p.swapDelay)}else{e()}}catch(e){fe(r,"htmx:swapError",g.eventInfo);re(n);throw e}}function ze(e,t,n){const r=e.getResponseHeader(t);if(r.indexOf("{")===0){const o=v(r);for(const i in o){if(o.hasOwnProperty(i)){let e=o[i];if(M(e)){n=e.target!==undefined?e.target:n}else{e={value:e}}ae(n,i,e)}}}else{const s=r.split(",");for(let e=0;e<s.length;e++){ae(n,s[e].trim(),[])}}}const Je=/\s/;const C=/[\s,]/;const Ke=/[_$a-zA-Z]/;const Ge=/[_$a-zA-Z0-9]/;const We=['"',"'","/"];const Ze=/[^\s]/;const Ye=/[{(]/;const Qe=/[})]/;function et(e){const t=[];let n=0;while(n<e.length){if(Ke.exec(e.charAt(n))){var r=n;while(Ge.exec(e.charAt(n+1))){n++}t.push(e.substring(r,n+1))}else if(We.indexOf(e.charAt(n))!==-1){const o=e.charAt(n);var r=n;n++;while(n<e.length&&e.charAt(n)!==o){if(e.charAt(n)==="\\"){n++}n++}t.push(e.substring(r,n+1))}else{const i=e.charAt(n);t.push(i)}n++}return t}function tt(e,t,n){return Ke.exec(e.charAt(0))&&e!=="true"&&e!=="false"&&e!=="this"&&e!==n&&t!=="."}function nt(r,o,i){if(o[0]==="["){o.shift();let e=1;let t=" return (function("+i+"){ return (";let n=null;while(o.length>0){const s=o[0];if(s==="]"){e--;if(e===0){if(n===null){t=t+"true"}o.shift();t+=")})";try{const l=On(r,function(){return Function(t)()},function(){return true});l.source=t;return l}catch(e){fe(te().body,"htmx:syntax:error",{error:e,source:t});return null}}}else if(s==="["){e++}if(tt(s,n,i)){t+="(("+i+"."+s+") ? ("+i+"."+s+") : (window."+s+"))"}else{t=t+s}n=o.shift()}}}function O(e,t){let n="";while(e.length>0&&!t.test(e[0])){n+=e.shift()}return n}function rt(e){let t;if(e.length>0&&Ye.test(e[0])){e.shift();t=O(e,Qe).trim();e.shift()}else{t=O(e,C)}return t}const ot="input, textarea, select";function it(e,t,n){const r=[];const o=et(t);do{O(o,Ze);const l=o.length;const u=O(o,/[,\[\s]/);if(u!==""){if(u==="every"){const c={trigger:"every"};O(o,Ze);c.pollInterval=d(O(o,/[,\[\s]/));O(o,Ze);var i=nt(e,o,"event");if(i){c.eventFilter=i}r.push(c)}else{const f={trigger:u};var i=nt(e,o,"event");if(i){f.eventFilter=i}O(o,Ze);while(o.length>0&&o[0]!==","){const a=o.shift();if(a==="changed"){f.changed=true}else if(a==="once"){f.once=true}else if(a==="consume"){f.consume=true}else if(a==="delay"&&o[0]===":"){o.shift();f.delay=d(O(o,C))}else if(a==="from"&&o[0]===":"){o.shift();if(Ye.test(o[0])){var s=rt(o)}else{var s=O(o,C);if(s==="closest"||s==="find"||s==="next"||s==="previous"){o.shift();const h=rt(o);if(h.length>0){s+=" "+h}}}f.from=s}else if(a==="target"&&o[0]===":"){o.shift();f.target=rt(o)}else if(a==="throttle"&&o[0]===":"){o.shift();f.throttle=d(O(o,C))}else if(a==="queue"&&o[0]===":"){o.shift();f.queue=O(o,C)}else if(a==="root"&&o[0]===":"){o.shift();f[a]=rt(o)}else if(a==="threshold"&&o[0]===":"){o.shift();f[a]=O(o,C)}else{fe(e,"htmx:syntax:error",{token:o.shift()})}O(o,Ze)}r.push(f)}}if(o.length===l){fe(e,"htmx:syntax:error",{token:o.shift()})}O(o,Ze)}while(o[0]===","&&o.shift());if(n){n[t]=r}return r}function st(e){const t=a(e,"hx-trigger");let n=[];if(t){const r=Q.config.triggerSpecsCache;n=r&&r[t]||it(e,t,r)}if(n.length>0){return n}else if(h(e,"form")){return[{trigger:"submit"}]}else if(h(e,'input[type="button"], input[type="submit"]')){return[{trigger:"click"}]}else if(h(e,ot)){return[{trigger:"change"}]}else{return[{trigger:"click"}]}}function lt(e){oe(e).cancelled=true}function ut(e,t,n){const r=oe(e);r.timeout=x().setTimeout(function(){if(se(e)&&r.cancelled!==true){if(!pt(n,e,Xt("hx:poll:trigger",{triggerSpec:n,target:e}))){t(e)}ut(e,t,n)}},n.pollInterval)}function ct(e){return location.hostname===e.hostname&&ee(e,"href")&&ee(e,"href").indexOf("#")!==0}function ft(e){return g(e,Q.config.disableSelector)}function at(t,n,e){if(t instanceof HTMLAnchorElement&&ct(t)&&(t.target===""||t.target==="_self")||t.tagName==="FORM"&&String(ee(t,"method")).toLowerCase()!=="dialog"){n.boosted=true;let r,o;if(t.tagName==="A"){r="get";o=ee(t,"href")}else{const i=ee(t,"method");r=i?i.toLowerCase():"get";o=ee(t,"action");if(o==null||o===""){o=location.href}if(r==="get"&&o.includes("?")){o=o.replace(/\?[^#]+/,"")}}e.forEach(function(e){gt(t,function(e,t){const n=ue(e);if(ft(n)){E(n);return}he(r,o,n,t)},n,e,true)})}}function ht(e,t){if(e.type==="submit"&&t.tagName==="FORM"){return true}else if(e.type==="click"){const n=t.closest('input[type="submit"], button');if(n&&n.form&&n.type==="submit"){return true}const r=t.closest("a");const o=/^#.+/;if(r&&r.href&&!o.test(r.getAttribute("href"))){return true}}return false}function dt(e,t){return oe(e).boosted&&e instanceof HTMLAnchorElement&&t.type==="click"&&(t.ctrlKey||t.metaKey)}function pt(e,t,n){const r=e.eventFilter;if(r){try{return r.call(t,n)!==true}catch(e){const o=r.source;fe(te().body,"htmx:eventFilter:error",{error:e,source:o});return true}}return false}function gt(l,u,e,c,f){const a=oe(l);let t;if(c.from){t=m(l,c.from)}else{t=[l]}if(c.changed){if(!("lastValue"in a)){a.lastValue=new WeakMap}t.forEach(function(e){if(!a.lastValue.has(c)){a.lastValue.set(c,new WeakMap)}a.lastValue.get(c).set(e,e.value)})}ie(t,function(i){const s=function(e){if(!se(l)){i.removeEventListener(c.trigger,s);return}if(dt(l,e)){return}if(f||ht(e,i)){e.preventDefault()}if(pt(c,l,e)){return}const t=oe(e);t.triggerSpec=c;if(t.handledFor==null){t.handledFor=[]}if(t.handledFor.indexOf(l)<0){t.handledFor.push(l);if(c.consume){e.stopPropagation()}if(c.target&&e.target){if(!h(ue(e.target),c.target)){return}}if(c.once){if(a.triggeredOnce){return}else{a.triggeredOnce=true}}if(c.changed){const n=e.target;const r=n.value;const o=a.lastValue.get(c);if(o.has(n)&&o.get(n)===r){return}o.set(n,r)}if(a.delayed){clearTimeout(a.delayed)}if(a.throttle){return}if(c.throttle>0){if(!a.throttle){ae(l,"htmx:trigger");u(l,e);a.throttle=x().setTimeout(function(){a.throttle=null},c.throttle)}}else if(c.delay>0){a.delayed=x().setTimeout(function(){ae(l,"htmx:trigger");u(l,e)},c.delay)}else{ae(l,"htmx:trigger");u(l,e)}}};if(e.listenerInfos==null){e.listenerInfos=[]}e.listenerInfos.push({trigger:c.trigger,listener:s,on:i});i.addEventListener(c.trigger,s)})}let mt=false;let yt=null;function xt(){if(!yt){yt=function(){mt=true};window.addEventListener("scroll",yt);window.addEventListener("resize",yt);setInterval(function(){if(mt){mt=false;ie(te().querySelectorAll("[hx-trigger*='revealed'],[data-hx-trigger*='revealed']"),function(e){bt(e)})}},200)}}function bt(e){if(!s(e,"data-hx-revealed")&&B(e)){e.setAttribute("data-hx-revealed","true");const t=oe(e);if(t.initHash){ae(e,"revealed")}else{e.addEventListener("htmx:afterProcessNode",function(){ae(e,"revealed")},{once:true})}}}function vt(e,t,n,r){const o=function(){if(!n.loaded){n.loaded=true;ae(e,"htmx:trigger");t(e)}};if(r>0){x().setTimeout(o,r)}else{o()}}function wt(t,n,e){let i=false;ie(de,function(r){if(s(t,"hx-"+r)){const o=a(t,"hx-"+r);i=true;n.path=o;n.verb=r;e.forEach(function(e){St(t,e,n,function(e,t){const n=ue(e);if(ft(n)){E(n);return}he(r,o,n,t)})})}});return i}function St(r,e,t,n){if(e.trigger==="revealed"){xt();gt(r,n,t,e);bt(ue(r))}else if(e.trigger==="intersect"){const o={};if(e.root){o.root=ce(r,e.root)}if(e.threshold){o.threshold=parseFloat(e.threshold)}const i=new IntersectionObserver(function(t){for(let e=0;e<t.length;e++){const n=t[e];if(n.isIntersecting){ae(r,"intersect");break}}},o);i.observe(ue(r));gt(ue(r),n,t,e)}else if(!t.firstInitCompleted&&e.trigger==="load"){if(!pt(e,r,Xt("load",{elt:r}))){vt(ue(r),n,t,e.delay)}}else if(e.pollInterval>0){t.polling=true;ut(ue(r),n,e)}else{gt(r,n,t,e)}}function Et(e){const t=ue(e);if(!t){return false}const n=t.attributes;for(let e=0;e<n.length;e++){const r=n[e].name;if(l(r,"hx-on:")||l(r,"data-hx-on:")||l(r,"hx-on-")||l(r,"data-hx-on-")){return true}}return false}const Ct=(new XPathEvaluator).createExpression('.//*[@*[ starts-with(name(), "hx-on:") or starts-with(name(), "data-hx-on:") or'+' starts-with(name(), "hx-on-") or starts-with(name(), "data-hx-on-") ]]');function Ot(e,t){if(Et(e)){t.push(ue(e))}const n=Ct.evaluate(e);let r=null;while(r=n.iterateNext())t.push(ue(r))}function Ht(e){const t=[];if(e instanceof DocumentFragment){for(const n of e.childNodes){Ot(n,t)}}else{Ot(e,t)}return t}function Tt(e){if(e.querySelectorAll){const n=", [hx-boost] a, [data-hx-boost] a, a[hx-boost], a[data-hx-boost]";const r=[];for(const i in jn){const s=jn[i];if(s.getSelectors){var t=s.getSelectors();if(t){r.push(t)}}}const o=e.querySelectorAll(R+n+", form, [type='submit'],"+" [hx-ext], [data-hx-ext], [hx-trigger], [data-hx-trigger]"+r.flat().map(e=>", "+e).join(""));return o}else{return[]}}function Rt(e){const t=At(e.target);const n=It(e);if(n){n.lastButtonClicked=t}}function qt(e){const t=It(e);if(t){t.lastButtonClicked=null}}function At(e){return g(ue(e),"button, input[type='submit']")}function Nt(e){return e.form||g(e,"form")}function It(e){const t=At(e.target);if(!t){return}const n=Nt(t);if(!n){return}return oe(n)}function Lt(e){e.addEventListener("click",Rt);e.addEventListener("focusin",Rt);e.addEventListener("focusout",qt)}function Dt(t,e,n){const r=oe(t);if(!Array.isArray(r.onHandlers)){r.onHandlers=[]}let o;const i=function(e){On(t,function(){if(ft(t)){return}if(!o){o=new Function("event",n)}o.call(t,e)})};t.addEventListener(e,i);r.onHandlers.push({event:e,listener:i})}function Pt(t){De(t);for(let e=0;e<t.attributes.length;e++){const n=t.attributes[e].name;const r=t.attributes[e].value;if(l(n,"hx-on")||l(n,"data-hx-on")){const o=n.indexOf("-on")+3;const i=n.slice(o,o+1);if(i==="-"||i===":"){let e=n.slice(o+1);if(l(e,":")){e="htmx"+e}else if(l(e,"-")){e="htmx:"+e.slice(1)}else if(l(e,"htmx-")){e="htmx:"+e.slice(5)}Dt(t,e,r)}}}}function kt(t){ae(t,"htmx:beforeProcessNode");const n=oe(t);const e=st(t);const r=wt(t,n,e);if(!r){if(ne(t,"hx-boost")==="true"){at(t,n,e)}else if(s(t,"hx-trigger")){e.forEach(function(e){St(t,e,n,function(){})})}}if(t.tagName==="FORM"||ee(t,"type")==="submit"&&s(t,"form")){Lt(t)}n.firstInitCompleted=true;ae(t,"htmx:afterProcessNode")}function Mt(e){if(!(e instanceof Element)){return false}const t=oe(e);const n=Le(e);if(t.initHash!==n){Pe(e);t.initHash=n;return true}return false}function Ft(e){e=S(e);if(ft(e)){E(e);return}const t=[];if(Mt(e)){t.push(e)}ie(Tt(e),function(e){if(ft(e)){E(e);return}if(Mt(e)){t.push(e)}});ie(Ht(e),Pt);ie(t,kt)}function Bt(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1-$2").toLowerCase()}function Xt(e,t){return new CustomEvent(e,{bubbles:true,cancelable:true,composed:true,detail:t})}function fe(e,t,n){ae(e,t,le({error:t},n))}function Ut(e){return e==="htmx:afterProcessNode"}function Vt(e,t,n){ie(Jn(e,[],n),function(e){try{t(e)}catch(e){H(e)}})}function H(e){console.error(e)}function ae(e,t,n){e=S(e);if(n==null){n={}}n.elt=e;const r=Xt(t,n);if(Q.logger&&!Ut(t)){Q.logger(e,t,n)}if(n.error){H(n.error+(n.target?", "+n.target:""));ae(e,"htmx:error",{errorInfo:n})}let o=e.dispatchEvent(r);const i=Bt(t);if(o&&i!==t){const s=Xt(i,r.detail);o=o&&e.dispatchEvent(s)}Vt(ue(e),function(e){o=o&&(e.onEvent(t,r)!==false&&!r.defaultPrevented)});return o}let jt;function $t(e){jt=e;if(U()){sessionStorage.setItem("htmx-current-path-for-history",e)}}$t(location.pathname+location.search);function _t(){const e=te().querySelector("[hx-history-elt],[data-hx-history-elt]");return e||te().body}function zt(t,e){if(!U()){return}const n=Kt(e);const r=te().title;const o=window.scrollY;if(Q.config.historyCacheSize<=0){sessionStorage.removeItem("htmx-history-cache");return}t=V(t);const i=v(sessionStorage.getItem("htmx-history-cache"))||[];for(let e=0;e<i.length;e++){if(i[e].url===t){i.splice(e,1);break}}const s={url:t,content:n,title:r,scroll:o};ae(te().body,"htmx:historyItemCreated",{item:s,cache:i});i.push(s);while(i.length>Q.config.historyCacheSize){i.shift()}while(i.length>0){try{sessionStorage.setItem("htmx-history-cache",JSON.stringify(i));break}catch(e){fe(te().body,"htmx:historyCacheError",{cause:e,cache:i});i.shift()}}}function Jt(t){if(!U()){return null}t=V(t);const n=v(sessionStorage.getItem("htmx-history-cache"))||[];for(let e=0;e<n.length;e++){if(n[e].url===t){return n[e]}}return null}function Kt(e){const t=Q.config.requestClass;const n=e.cloneNode(true);ie(y(n,"."+t),function(e){b(e,t)});ie(y(n,"[data-disabled-by-htmx]"),function(e){e.removeAttribute("disabled")});return n.innerHTML}function Gt(){const e=_t();let t=jt;if(U()){t=sessionStorage.getItem("htmx-current-path-for-history")}t=t||location.pathname+location.search;const n=te().querySelector('[hx-history="false" i],[data-hx-history="false" i]');if(!n){ae(te().body,"htmx:beforeHistorySave",{path:t,historyElt:e});zt(t,e)}if(Q.config.historyEnabled)history.replaceState({htmx:true},te().title,location.href)}function Wt(e){if(Q.config.getCacheBusterParam){e=e.replace(/org\.htmx\.cache-buster=[^&]*&?/,"");if(Z(e,"&")||Z(e,"?")){e=e.slice(0,-1)}}if(Q.config.historyEnabled){history.pushState({htmx:true},"",e)}$t(e)}function Zt(e){if(Q.config.historyEnabled)history.replaceState({htmx:true},"",e);$t(e)}function Yt(e){ie(e,function(e){e.call(undefined)})}function Qt(e){const t=new XMLHttpRequest;const n={swapStyle:"innerHTML",swapDelay:0,settleDelay:0};const r={path:e,xhr:t,historyElt:_t(),swapSpec:n};t.open("GET",e,true);if(Q.config.historyRestoreAsHxRequest){t.setRequestHeader("HX-Request","true")}t.setRequestHeader("HX-History-Restore-Request","true");t.setRequestHeader("HX-Current-URL",location.href);t.onload=function(){if(this.status>=200&&this.status<400){r.response=this.response;ae(te().body,"htmx:historyCacheMissLoad",r);_e(r.historyElt,r.response,n,{contextElement:r.historyElt,historyRequest:true});$t(r.path);ae(te().body,"htmx:historyRestore",{path:e,cacheMiss:true,serverResponse:r.response})}else{fe(te().body,"htmx:historyCacheMissLoadError",r)}};if(ae(te().body,"htmx:historyCacheMiss",r)){t.send()}}function en(e){Gt();e=e||location.pathname+location.search;const t=Jt(e);if(t){const n={swapStyle:"innerHTML",swapDelay:0,settleDelay:0,scroll:t.scroll};const r={path:e,item:t,historyElt:_t(),swapSpec:n};if(ae(te().body,"htmx:historyCacheHit",r)){_e(r.historyElt,t.content,n,{contextElement:r.historyElt,title:t.title});$t(r.path);ae(te().body,"htmx:historyRestore",r)}}else{if(Q.config.refreshOnHistoryMiss){Q.location.reload(true)}else{Qt(e)}}}function tn(e){let t=ve(e,"hx-indicator");if(t==null){t=[e]}ie(t,function(e){const t=oe(e);t.requestCount=(t.requestCount||0)+1;w(e,Q.config.requestClass)});return t}function nn(e){let t=ve(e,"hx-disabled-elt");if(t==null){t=[]}ie(t,function(e){const t=oe(e);t.requestCount=(t.requestCount||0)+1;if(!e.hasAttribute("disabled")){e.setAttribute("disabled","");e.setAttribute("data-disabled-by-htmx","")}});return t}function rn(e,t){ie(e.concat(t),function(e){const t=oe(e);t.requestCount=(t.requestCount||1)-1});ie(e,function(e){const t=oe(e);if(t.requestCount===0){b(e,Q.config.requestClass)}});ie(t,function(e){const t=oe(e);if(t.requestCount===0&&e.hasAttribute("data-disabled-by-htmx")){e.removeAttribute("disabled");e.removeAttribute("data-disabled-by-htmx")}})}function on(t,n){for(let e=0;e<t.length;e++){const r=t[e];if(r.isSameNode(n)){return true}}return false}function sn(e){const t=e;if(t.name===""||t.name==null||t.disabled||g(t,"fieldset[disabled]")){return false}if(t.type==="button"||t.type==="submit"||t.tagName==="image"||t.tagName==="reset"||t.tagName==="file"){return false}if(t.type==="checkbox"||t.type==="radio"){return t.checked}return true}function ln(t,e,n){if(t!=null&&e!=null){if(Array.isArray(e)){e.forEach(function(e){n.append(t,e)})}else{n.append(t,e)}}}function un(t,n,r){if(t!=null&&n!=null){let e=r.getAll(t);if(Array.isArray(n)){e=e.filter(e=>n.indexOf(e)<0)}else{e=e.filter(e=>e!==n)}r.delete(t);ie(e,e=>r.append(t,e))}}function cn(e){if(e instanceof HTMLSelectElement&&e.multiple){return F(e.querySelectorAll("option:checked")).map(function(e){return e.value})}if(e instanceof HTMLInputElement&&e.files){return F(e.files)}return e.value}function fn(t,n,r,e,o){if(e==null||on(t,e)){return}else{t.push(e)}if(sn(e)){const i=ee(e,"name");ln(i,cn(e),n);if(o){an(e,r)}}if(e instanceof HTMLFormElement){ie(e.elements,function(e){if(t.indexOf(e)>=0){un(e.name,cn(e),n)}else{t.push(e)}if(o){an(e,r)}});new FormData(e).forEach(function(e,t){if(e instanceof File&&e.name===""){return}ln(t,e,n)})}}function an(e,t){const n=e;if(n.willValidate){ae(n,"htmx:validation:validate");if(!n.checkValidity()){if(ae(n,"htmx:validation:failed",{message:n.validationMessage,validity:n.validity})&&!t.length&&Q.config.reportValidityOfForms){n.reportValidity()}t.push({elt:n,message:n.validationMessage,validity:n.validity})}}}function hn(n,e){for(const t of e.keys()){n.delete(t)}e.forEach(function(e,t){n.append(t,e)});return n}function dn(e,t){const n=[];const r=new FormData;const o=new FormData;const i=[];const s=oe(e);if(s.lastButtonClicked&&!se(s.lastButtonClicked)){s.lastButtonClicked=null}let l=e instanceof HTMLFormElement&&e.noValidate!==true||a(e,"hx-validate")==="true";if(s.lastButtonClicked){l=l&&s.lastButtonClicked.formNoValidate!==true}if(t!=="get"){fn(n,o,i,Nt(e),l)}fn(n,r,i,e,l);if(s.lastButtonClicked||e.tagName==="BUTTON"||e.tagName==="INPUT"&&ee(e,"type")==="submit"){const c=s.lastButtonClicked||e;const f=ee(c,"name");ln(f,c.value,o)}const u=ve(e,"hx-include");ie(u,function(e){fn(n,r,i,ue(e),l);if(!h(e,"form")){ie(p(e).querySelectorAll(ot),function(e){fn(n,r,i,e,l)})}});hn(r,o);return{errors:i,formData:r,values:kn(r)}}function pn(e,t,n){if(e!==""){e+="&"}if(String(n)==="[object Object]"){n=JSON.stringify(n)}const r=encodeURIComponent(n);e+=encodeURIComponent(t)+"="+r;return e}function gn(e){e=Dn(e);let n="";e.forEach(function(e,t){n=pn(n,t,e)});return n}function mn(e,t,n){const r={"HX-Request":"true","HX-Trigger":ee(e,"id"),"HX-Trigger-Name":ee(e,"name"),"HX-Target":a(t,"id"),"HX-Current-URL":location.href};Cn(e,"hx-headers",false,r);if(n!==undefined){r["HX-Prompt"]=n}if(oe(e).boosted){r["HX-Boosted"]="true"}return r}function yn(n,e){const t=ne(e,"hx-params");if(t){if(t==="none"){return new FormData}else if(t==="*"){return n}else if(t.indexOf("not ")===0){ie(t.slice(4).split(","),function(e){e=e.trim();n.delete(e)});return n}else{const r=new FormData;ie(t.split(","),function(t){t=t.trim();if(n.has(t)){n.getAll(t).forEach(function(e){r.append(t,e)})}});return r}}else{return n}}function xn(e){return!!ee(e,"href")&&ee(e,"href").indexOf("#")>=0}function bn(e,t){const n=t||ne(e,"hx-swap");const r={swapStyle:oe(e).boosted?"innerHTML":Q.config.defaultSwapStyle,swapDelay:Q.config.defaultSwapDelay,settleDelay:Q.config.defaultSettleDelay};if(Q.config.scrollIntoViewOnBoost&&oe(e).boosted&&!xn(e)){r.show="top"}if(n){const s=X(n);if(s.length>0){for(let e=0;e<s.length;e++){const l=s[e];if(l.indexOf("swap:")===0){r.swapDelay=d(l.slice(5))}else if(l.indexOf("settle:")===0){r.settleDelay=d(l.slice(7))}else if(l.indexOf("transition:")===0){r.transition=l.slice(11)==="true"}else if(l.indexOf("ignoreTitle:")===0){r.ignoreTitle=l.slice(12)==="true"}else if(l.indexOf("scroll:")===0){const u=l.slice(7);var o=u.split(":");const c=o.pop();var i=o.length>0?o.join(":"):null;r.scroll=c;r.scrollTarget=i}else if(l.indexOf("show:")===0){const f=l.slice(5);var o=f.split(":");const a=o.pop();var i=o.length>0?o.join(":"):null;r.show=a;r.showTarget=i}else if(l.indexOf("focus-scroll:")===0){const h=l.slice("focus-scroll:".length);r.focusScroll=h=="true"}else if(e==0){r.swapStyle=l}else{H("Unknown modifier in hx-swap: "+l)}}}}return r}function vn(e){return ne(e,"hx-encoding")==="multipart/form-data"||h(e,"form")&&ee(e,"enctype")==="multipart/form-data"}function wn(t,n,r){let o=null;Vt(n,function(e){if(o==null){o=e.encodeParameters(t,r,n)}});if(o!=null){return o}else{if(vn(n)){return hn(new FormData,Dn(r))}else{return gn(r)}}}function Sn(e){return{tasks:[],elts:[e]}}function En(e,t){const n=e[0];const r=e[e.length-1];if(t.scroll){var o=null;if(t.scrollTarget){o=ue(ce(n,t.scrollTarget))}if(t.scroll==="top"&&(n||o)){o=o||n;o.scrollTop=0}if(t.scroll==="bottom"&&(r||o)){o=o||r;o.scrollTop=o.scrollHeight}if(typeof t.scroll==="number"){x().setTimeout(function(){window.scrollTo(0,t.scroll)},0)}}if(t.show){var o=null;if(t.showTarget){let e=t.showTarget;if(t.showTarget==="window"){e="body"}o=ue(ce(n,e))}if(t.show==="top"&&(n||o)){o=o||n;o.scrollIntoView({block:"start",behavior:Q.config.scrollBehavior})}if(t.show==="bottom"&&(r||o)){o=o||r;o.scrollIntoView({block:"end",behavior:Q.config.scrollBehavior})}}}function Cn(r,e,o,i,s){if(i==null){i={}}if(r==null){return i}const l=a(r,e);if(l){let e=l.trim();let t=o;if(e==="unset"){return null}if(e.indexOf("javascript:")===0){e=e.slice(11);t=true}else if(e.indexOf("js:")===0){e=e.slice(3);t=true}if(e.indexOf("{")!==0){e="{"+e+"}"}let n;if(t){n=On(r,function(){if(s){return Function("event","return ("+e+")").call(r,s)}else{return Function("return ("+e+")").call(r)}},{})}else{n=v(e)}for(const u in n){if(n.hasOwnProperty(u)){if(i[u]==null){i[u]=n[u]}}}}return Cn(ue(c(r)),e,o,i,s)}function On(e,t,n){if(Q.config.allowEval){return t()}else{fe(e,"htmx:evalDisallowedError");return n}}function Hn(e,t,n){return Cn(e,"hx-vars",true,n,t)}function Tn(e,t,n){return Cn(e,"hx-vals",false,n,t)}function Rn(e,t){return le(Hn(e,t),Tn(e,t))}function qn(t,n,r){if(r!==null){try{t.setRequestHeader(n,r)}catch(e){t.setRequestHeader(n,encodeURIComponent(r));t.setRequestHeader(n+"-URI-AutoEncoded","true")}}}function An(t){if(t.responseURL){try{const e=new URL(t.responseURL);return e.pathname+e.search}catch(e){fe(te().body,"htmx:badResponseUrl",{url:t.responseURL})}}}function T(e,t){return t.test(e.getAllResponseHeaders())}function Nn(t,n,r){t=t.toLowerCase();if(r){if(r instanceof Element||typeof r==="string"){return he(t,n,null,null,{targetOverride:S(r)||be,returnPromise:true})}else{let e=S(r.target);if(r.target&&!e||r.source&&!e&&!S(r.source)){e=be}return he(t,n,S(r.source),r.event,{handler:r.handler,headers:r.headers,values:r.values,targetOverride:e,swapOverride:r.swap,select:r.select,returnPromise:true,push:r.push,replace:r.replace,selectOOB:r.selectOOB})}}else{return he(t,n,null,null,{returnPromise:true})}}function In(e){const t=[];while(e){t.push(e);e=e.parentElement}return t}function Ln(e,t,n){const r=new URL(t,location.protocol!=="about:"?location.href:window.origin);const o=location.protocol!=="about:"?location.origin:window.origin;const i=o===r.origin;if(Q.config.selfRequestsOnly){if(!i){return false}}return ae(e,"htmx:validateUrl",le({url:r,sameHost:i},n))}function Dn(e){if(e instanceof FormData)return e;const t=new FormData;for(const n in e){if(e.hasOwnProperty(n)){if(e[n]&&typeof e[n].forEach==="function"){e[n].forEach(function(e){t.append(n,e)})}else if(typeof e[n]==="object"&&!(e[n]instanceof Blob)){t.append(n,JSON.stringify(e[n]))}else{t.append(n,e[n])}}}return t}function Pn(r,o,e){return new Proxy(e,{get:function(t,e){if(typeof e==="number")return t[e];if(e==="length")return t.length;if(e==="push"){return function(e){t.push(e);r.append(o,e)}}if(typeof t[e]==="function"){return function(){t[e].apply(t,arguments);r.delete(o);t.forEach(function(e){r.append(o,e)})}}if(t[e]&&t[e].length===1){return t[e][0]}else{return t[e]}},set:function(e,t,n){e[t]=n;r.delete(o);e.forEach(function(e){r.append(o,e)});return true}})}function kn(o){return new Proxy(o,{get:function(e,t){if(typeof t==="symbol"){const r=Reflect.get(e,t);if(typeof r==="function"){return function(){return r.apply(o,arguments)}}else{return r}}if(t==="toJSON"){return()=>Object.fromEntries(o)}if(t in e){if(typeof e[t]==="function"){return function(){return o[t].apply(o,arguments)}}}const n=o.getAll(t);if(n.length===0){return undefined}else if(n.length===1){return n[0]}else{return Pn(e,t,n)}},set:function(t,n,e){if(typeof n!=="string"){return false}t.delete(n);if(e&&typeof e.forEach==="function"){e.forEach(function(e){t.append(n,e)})}else if(typeof e==="object"&&!(e instanceof Blob)){t.append(n,JSON.stringify(e))}else{t.append(n,e)}return true},deleteProperty:function(e,t){if(typeof t==="string"){e.delete(t)}return true},ownKeys:function(e){return Reflect.ownKeys(Object.fromEntries(e))},getOwnPropertyDescriptor:function(e,t){return Reflect.getOwnPropertyDescriptor(Object.fromEntries(e),t)}})}function he(t,n,r,o,i,k){let s=null;let l=null;i=i!=null?i:{};if(i.returnPromise&&typeof Promise!=="undefined"){var e=new Promise(function(e,t){s=e;l=t})}if(r==null){r=te().body}const M=i.handler||Vn;const F=i.select||null;if(!se(r)){re(s);return e}const u=i.targetOverride||ue(Se(r));if(u==null||u==be){fe(r,"htmx:targetError",{target:ne(r,"hx-target")});re(l);return e}let c=oe(r);const f=c.lastButtonClicked;if(f){const A=ee(f,"formaction");if(A!=null){n=A}const N=ee(f,"formmethod");if(N!=null){if(de.includes(N.toLowerCase())){t=N}else{re(s);return e}}}const a=ne(r,"hx-confirm");if(k===undefined){const K=function(e){return he(t,n,r,o,i,!!e)};const G={target:u,elt:r,path:n,verb:t,triggeringEvent:o,etc:i,issueRequest:K,question:a};if(ae(r,"htmx:confirm",G)===false){re(s);return e}}let h=r;let d=ne(r,"hx-sync");let p=null;let B=false;if(d){const I=d.split(":");const L=I[0].trim();if(L==="this"){h=we(r,"hx-sync")}else{h=ue(ce(r,L))}d=(I[1]||"drop").trim();c=oe(h);if(d==="drop"&&c.xhr&&c.abortable!==true){re(s);return e}else if(d==="abort"){if(c.xhr){re(s);return e}else{B=true}}else if(d==="replace"){ae(h,"htmx:abort")}else if(d.indexOf("queue")===0){const W=d.split(" ");p=(W[1]||"last").trim()}}if(c.xhr){if(c.abortable){ae(h,"htmx:abort")}else{if(p==null){if(o){const D=oe(o);if(D&&D.triggerSpec&&D.triggerSpec.queue){p=D.triggerSpec.queue}}if(p==null){p="last"}}if(c.queuedRequests==null){c.queuedRequests=[]}if(p==="first"&&c.queuedRequests.length===0){c.queuedRequests.push(function(){he(t,n,r,o,i)})}else if(p==="all"){c.queuedRequests.push(function(){he(t,n,r,o,i)})}else if(p==="last"){c.queuedRequests=[];c.queuedRequests.push(function(){he(t,n,r,o,i)})}re(s);return e}}const g=new XMLHttpRequest;c.xhr=g;c.abortable=B;const m=function(){c.xhr=null;c.abortable=false;if(c.queuedRequests!=null&&c.queuedRequests.length>0){const e=c.queuedRequests.shift();e()}};const X=ne(r,"hx-prompt");if(X){var y=prompt(X);if(y===null||!ae(r,"htmx:prompt",{prompt:y,target:u})){re(s);m();return e}}if(a&&!k){if(!confirm(a)){re(s);m();return e}}let x=mn(r,u,y);if(t!=="get"&&!vn(r)){x["Content-Type"]="application/x-www-form-urlencoded"}if(i.headers){x=le(x,i.headers)}const U=dn(r,t);let b=U.errors;const V=U.formData;if(i.values){hn(V,Dn(i.values))}const j=Dn(Rn(r,o));const v=hn(V,j);let w=yn(v,r);if(Q.config.getCacheBusterParam&&t==="get"){w.set("org.htmx.cache-buster",ee(u,"id")||"true")}if(n==null||n===""){n=location.href}const S=Cn(r,"hx-request");const $=oe(r).boosted;let E=Q.config.methodsThatUseUrlParams.indexOf(t)>=0;const C={boosted:$,useUrlParams:E,formData:w,parameters:kn(w),unfilteredFormData:v,unfilteredParameters:kn(v),headers:x,elt:r,target:u,verb:t,errors:b,withCredentials:i.credentials||S.credentials||Q.config.withCredentials,timeout:i.timeout||S.timeout||Q.config.timeout,path:n,triggeringEvent:o};if(!ae(r,"htmx:configRequest",C)){re(s);m();return e}n=C.path;t=C.verb;x=C.headers;w=Dn(C.parameters);b=C.errors;E=C.useUrlParams;if(b&&b.length>0){ae(r,"htmx:validation:halted",C);re(s);m();return e}const _=n.split("#");const z=_[0];const O=_[1];let H=n;if(E){H=z;const Z=!w.keys().next().done;if(Z){if(H.indexOf("?")<0){H+="?"}else{H+="&"}H+=gn(w);if(O){H+="#"+O}}}if(!Ln(r,H,C)){fe(r,"htmx:invalidPath",C);re(l);m();return e}g.open(t.toUpperCase(),H,true);g.overrideMimeType("text/html");g.withCredentials=C.withCredentials;g.timeout=C.timeout;if(S.noHeaders){}else{for(const P in x){if(x.hasOwnProperty(P)){const Y=x[P];qn(g,P,Y)}}}const T={xhr:g,target:u,requestConfig:C,etc:i,boosted:$,select:F,pathInfo:{requestPath:n,finalRequestPath:H,responsePath:null,anchor:O}};g.onload=function(){try{const t=In(r);T.pathInfo.responsePath=An(g);M(r,T);if(T.keepIndicators!==true){rn(R,q)}ae(r,"htmx:afterRequest",T);ae(r,"htmx:afterOnLoad",T);if(!se(r)){let e=null;while(t.length>0&&e==null){const n=t.shift();if(se(n)){e=n}}if(e){ae(e,"htmx:afterRequest",T);ae(e,"htmx:afterOnLoad",T)}}re(s)}catch(e){fe(r,"htmx:onLoadError",le({error:e},T));throw e}finally{m()}};g.onerror=function(){rn(R,q);fe(r,"htmx:afterRequest",T);fe(r,"htmx:sendError",T);re(l);m()};g.onabort=function(){rn(R,q);fe(r,"htmx:afterRequest",T);fe(r,"htmx:sendAbort",T);re(l);m()};g.ontimeout=function(){rn(R,q);fe(r,"htmx:afterRequest",T);fe(r,"htmx:timeout",T);re(l);m()};if(!ae(r,"htmx:beforeRequest",T)){re(s);m();return e}var R=tn(r);var q=nn(r);ie(["loadstart","loadend","progress","abort"],function(t){ie([g,g.upload],function(e){e.addEventListener(t,function(e){ae(r,"htmx:xhr:"+t,{lengthComputable:e.lengthComputable,loaded:e.loaded,total:e.total})})})});ae(r,"htmx:beforeSend",T);const J=E?null:wn(g,r,w);g.send(J);return e}function Mn(e,t){const n=t.xhr;let r=null;let o=null;if(T(n,/HX-Push:/i)){r=n.getResponseHeader("HX-Push");o="push"}else if(T(n,/HX-Push-Url:/i)){r=n.getResponseHeader("HX-Push-Url");o="push"}else if(T(n,/HX-Replace-Url:/i)){r=n.getResponseHeader("HX-Replace-Url");o="replace"}if(r){if(r==="false"){return{}}else{return{type:o,path:r}}}const i=t.pathInfo.finalRequestPath;const s=t.pathInfo.responsePath;let l=t.etc.push||ne(e,"hx-push-url");let u=t.etc.replace||ne(e,"hx-replace-url");if(l==="false")l=null;if(u==="false")u=null;const c=oe(e).boosted;let f=null;let a=null;if(l){f="push";a=l}else if(u){f="replace";a=u}else if(c){f="push";a=s||i}if(a){if(a==="true"){a=s||i}if(t.pathInfo.anchor&&a.indexOf("#")===-1){a=a+"#"+t.pathInfo.anchor}return{type:f,path:a}}else{return{}}}function Fn(e,t){var n=new RegExp(e.code);return n.test(t.toString(10))}function Bn(e){for(var t=0;t<Q.config.responseHandling.length;t++){var n=Q.config.responseHandling[t];if(Fn(n,e.status)){return n}}return{swap:false}}function Xn(e){if(e){const t=f("title");if(t){t.textContent=e}else{window.document.title=e}}}function Un(e,t){if(t==="this"){return e}const n=ue(ce(e,t));if(n==null){fe(e,"htmx:targetError",{target:t});throw new Error(`Invalid re-target ${t}`)}return n}function Vn(t,e){const n=e.xhr;let r=e.target;const o=e.etc;const i=e.select;if(!ae(t,"htmx:beforeOnLoad",e))return;if(T(n,/HX-Trigger:/i)){ze(n,"HX-Trigger",t)}if(T(n,/HX-Location:/i)){let e=n.getResponseHeader("HX-Location");var s={};if(e.indexOf("{")===0){s=v(e);e=s.path;delete s.path}s.push=s.push??"true";Nn("get",e,s);return}const l=T(n,/HX-Refresh:/i)&&n.getResponseHeader("HX-Refresh")==="true";if(T(n,/HX-Redirect:/i)){e.keepIndicators=true;Q.location.href=n.getResponseHeader("HX-Redirect");l&&Q.location.reload();return}if(l){e.keepIndicators=true;Q.location.reload();return}const u=Mn(t,e);const c=Bn(n);const f=c.swap;let a=!!c.error;let h=Q.config.ignoreTitle||c.ignoreTitle;let d=c.select;if(c.target){e.target=Un(t,c.target)}var p=o.swapOverride;if(p==null&&c.swapOverride){p=c.swapOverride}if(T(n,/HX-Retarget:/i)){e.target=Un(t,n.getResponseHeader("HX-Retarget"))}if(T(n,/HX-Reswap:/i)){p=n.getResponseHeader("HX-Reswap")}var g=n.response;var m=le({shouldSwap:f,serverResponse:g,isError:a,ignoreTitle:h,selectOverride:d,swapOverride:p},e);if(c.event&&!ae(r,c.event,m))return;if(!ae(r,"htmx:beforeSwap",m))return;r=m.target;g=m.serverResponse;a=m.isError;h=m.ignoreTitle;d=m.selectOverride;p=m.swapOverride;e.target=r;e.failed=a;e.successful=!a;if(m.shouldSwap){if(n.status===286){lt(t)}Vt(t,function(e){g=e.transformResponse(g,n,t)});if(u.type){Gt()}var y=bn(t,p);if(!y.hasOwnProperty("ignoreTitle")){y.ignoreTitle=h}w(r,Q.config.swappingClass);if(i){d=i}if(T(n,/HX-Reselect:/i)){d=n.getResponseHeader("HX-Reselect")}const x=o.selectOOB||ne(t,"hx-select-oob");const b=ne(t,"hx-select");_e(r,g,y,{select:d==="unset"?null:d||b,selectOOB:x,eventInfo:e,anchor:e.pathInfo.anchor,contextElement:t,afterSwapCallback:function(){if(T(n,/HX-Trigger-After-Swap:/i)){let e=t;if(!se(t)){e=te().body}ze(n,"HX-Trigger-After-Swap",e)}},afterSettleCallback:function(){if(T(n,/HX-Trigger-After-Settle:/i)){let e=t;if(!se(t)){e=te().body}ze(n,"HX-Trigger-After-Settle",e)}},beforeSwapCallback:function(){if(u.type){ae(te().body,"htmx:beforeHistoryUpdate",le({history:u},e));if(u.type==="push"){Wt(u.path);ae(te().body,"htmx:pushedIntoHistory",{path:u.path})}else{Zt(u.path);ae(te().body,"htmx:replacedInHistory",{path:u.path})}}}})}if(a){fe(t,"htmx:responseError",le({error:"Response Status Error Code "+n.status+" from "+e.pathInfo.requestPath},e))}}const jn={};function $n(){return{init:function(e){return null},getSelectors:function(){return null},onEvent:function(e,t){return true},transformResponse:function(e,t,n){return e},isInlineSwap:function(e){return false},handleSwap:function(e,t,n,r){return false},encodeParameters:function(e,t,n){return null}}}function _n(e,t){if(t.init){t.init(n)}jn[e]=le($n(),t)}function zn(e){delete jn[e]}function Jn(e,n,r){if(n==undefined){n=[]}if(e==undefined){return n}if(r==undefined){r=[]}const t=a(e,"hx-ext");if(t){ie(t.split(","),function(e){e=e.replace(/ /g,"");if(e.slice(0,7)=="ignore:"){r.push(e.slice(7));return}if(r.indexOf(e)<0){const t=jn[e];if(t&&n.indexOf(t)<0){n.push(t)}}})}return Jn(ue(c(e)),n,r)}var Kn=false;te().addEventListener("DOMContentLoaded",function(){Kn=true});function Gn(e){if(Kn||te().readyState==="complete"){e()}else{te().addEventListener("DOMContentLoaded",e)}}function Wn(){if(Q.config.includeIndicatorStyles!==false){const e=Q.config.inlineStyleNonce?` nonce="${Q.config.inlineStyleNonce}"`:"";const t=Q.config.indicatorClass;const n=Q.config.requestClass;te().head.insertAdjacentHTML("beforeend",`<style${e}>`+`.${t}{opacity:0;visibility: hidden} `+`.${n} .${t}, .${n}.${t}{opacity:1;visibility: visible;transition: opacity 200ms ease-in}`+"</style>")}}function Zn(){const e=te().querySelector('meta[name="htmx-config"]');if(e){return v(e.content)}else{return null}}function Yn(){const e=Zn();if(e){Q.config=le(Q.config,e)}}Gn(function(){Yn();Wn();let e=te().body;Ft(e);const t=te().querySelectorAll("[hx-trigger='restored'],[data-hx-trigger='restored']");e.addEventListener("htmx:abort",function(e){const t=e.detail.elt||e.target;const n=oe(t);if(n&&n.xhr){n.xhr.abort()}});const n=window.onpopstate?window.onpopstate.bind(window):null;window.onpopstate=function(e){if(e.state&&e.state.htmx){en();ie(t,function(e){ae(e,"htmx:restored",{document:te(),triggerEvent:ae})})}else{if(n){n(e)}}};x().setTimeout(function(){ae(e,"htmx:load",{});e=null},0)});return Q}();
\ No newline at end of file
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/layouts/base.html b/scripts/addons/webgui/src/aim_webgui/templates/layouts/base.html
new file mode 100644
index 0000000..6de5cf9
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/layouts/base.html
@@ -0,0 +1,59 @@
+<!doctype html>
+<html lang="en" data-theme="light" data-bs-theme="light">
+<head>
+  <meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
+  <meta name="color-scheme" content="light dark">
+  <title>{{ title }} | AIM Web</title>
+  <meta name="csrf-token" content="{{ csrf }}">
+  <meta name="htmx-config" content='{"allowEval":false,"allowScriptTags":false,"includeIndicatorStyles":false,"historyCacheSize":0,"selfRequestsOnly":true}'>
+  <script src="/static/js/theme.js?v={{ version }}"></script>
+  <link rel="stylesheet" href="/static/vendor/bootstrap.min.css">
+  <link rel="stylesheet" href="/static/css/tokens.css">
+  <link rel="stylesheet" href="/static/css/bootstrap-overrides.css">
+  <link rel="stylesheet" href="/static/css/aim.css?v={{ version }}">
+  <link rel="stylesheet" href="/static/css/experience.css?v={{ version }}">
+  <script src="/static/vendor/htmx.min.js" defer></script>
+  <script src="/static/js/aim.js?v={{ version }}" defer></script>
+  <script src="/static/js/experience.js?v={{ version }}" defer></script>
+  <link rel="stylesheet" href="/static/css/credentials.css?v={{ version }}">
+  <script src="/static/js/credentials.js?v={{ version }}" defer></script>
+  <link rel="stylesheet" href="/static/css/evidence.css?v={{ version }}">
+  <script src="/static/js/evidence.js?v={{ version }}" defer></script>
+</head>
+<body>
+{% from 'partials/navigation.html' import links, theme, account %}
+<a class="skip-link" href="#main">Skip to content</a>
+<header class="mobile-topbar">
+  <a class="mobile-brand" href="/" aria-label="AIM homepage"><span class="brand-mark" aria-hidden="true">A</span><strong>AIM</strong></a>
+  <div class="mobile-actions">{{ theme() }}
+    <details class="mobile-menu" data-mobile-menu>
+      <summary aria-label="Navigation menu" aria-controls="mobile-navigation"><svg viewBox="0 0 24 24" width="24" height="24" aria-hidden="true"><path d="M4 6h16M4 12h16M4 18h16"/></svg></summary>
+      <div class="mobile-menu-panel" id="mobile-navigation">
+        <p class="sidebar-caption">WORKSPACE</p>{{ links(nav,session) }}
+        <div class="mobile-account">{{ account(session,csrf) }}</div>
+      </div>
+    </details>
+  </div>
+</header>
+<div class="app-shell">
+  <aside class="sidebar" aria-label="Application navigation">
+    <a class="brand" href="/" aria-label="AIM homepage"><span class="brand-mark">A</span><span>AIM<span class="brand-subtitle">CONTROLLER WORKSPACE</span></span></a>
+    <div class="sidebar-caption">OPERATIONS</div>{{ links(nav,session) }}
+    <div class="sidebar-bottom"><span class="status-dot"></span> Independent add-on <strong>v{{ version }}</strong><p>AIM core 3.3.0rc8 / service v1<br>Core owns infrastructure. WebGUI owns the workspace.</p></div>
+  </aside>
+  <div class="workspace">
+    <header class="topbar">
+      <span class="environment-label"><span class="status-dot"></span> LOCAL CONTROLLER</span>
+      <div class="account-links">{{ theme() }}{{ account(session,csrf) }}</div>
+    </header>
+    <main id="main" class="main-content" tabindex="-1">
+      <div class="page-heading"><p class="eyebrow">AIM WEB / {{ nav|upper }}</p><h1>{{ title }}</h1>{% block subtitle %}{% endblock %}</div>
+      {% if error %}<div class="alert alert-danger" role="alert">{{ error }}</div>{% endif %}
+      {% block content %}{% endblock %}
+    </main>
+    <footer class="workspace-footer">AIM owns infrastructure data. This add-on owns presentation and login state.<span>WEB {{ version }} / WEB API v2</span></footer>
+  </div>
+</div>
+{% if session and session.user_id %}{% include 'partials/credential_dialog.html' %}{% endif %}
+</body>
+</html>
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/pages/activity.html b/scripts/addons/webgui/src/aim_webgui/templates/pages/activity.html
new file mode 100644
index 0000000..aa27fc6
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/pages/activity.html
@@ -0,0 +1,23 @@
+{% extends 'layouts/base.html' %}
+{% from 'partials/activity_macros.html' import stamp, outcome, filters, summary, records %}
+{% block subtitle %}<p class="text-secondary">Host activity &middot; <strong>{{ customer }}</strong>. Current membership from Core; execution history from this add-on only.</p>{% endblock %}
+{% block content %}
+<nav class="context-links" aria-label="Host workspace"><a href="{{ explorer_url(customer) }}">&larr; Inventory explorer</a><a href="/insights?customer={{ customer|urlencode }}">Customer insights</a><a href="#host-history">History</a><a href="#host-plans">Saved plans</a></nav>
+<section class="card host-identity">
+<div class="entity-symbol" aria-hidden="true">&#9635;</div>
+<div><span class="eyebrow">CURRENT INVENTORY MEMBERSHIP</span>
+{% if inventory_error %}<p class="mb-1">Current inventory is unavailable. Retained history is still shown below.</p><p class="small text-secondary">This is not an empty-inventory or offline-host result. Refresh after Core connectivity is restored.</p>
+{% elif current %}<div class="membership-links">{% for member in current.memberships %}<a href="{{ member.url }}" class="membership-chip">{{ member.label }}</a>{% else %}<span>No group membership</span>{% endfor %}</div><p class="small text-secondary mt-2 mb-1">{{ current.platforms|join(', ') or 'Platform not supplied' }} &middot; {{ current.address or 'Address not supplied' }}</p><span class="coverage-note">Retrieved {{ stamp(fetched_at) }}</span>
+{% else %}<p class="mb-1">Not in current inventory.</p><p class="small text-secondary">Historical records are retained under this logical customer/hostname identity; it is not a hardware identifier.</p>{% endif %}
+</div></section>
+<div class="section-heading mt-4"><div><p class="eyebrow">RETAINED WEBGUI HISTORY</p><h2 class="h4" id="host-history">Playbook activity</h2></div></div>
+{{ filters(data,outcome_labels,'/inventory/' + (customer|urlencode) + '/activity',host) }}
+<p class="coverage-note">{{ 'All retained history' if data.filters.days == 'all' else 'Rolling ' + data.filters.days + '-day window' }} &middot; {% if data.filters.mode == 'check' %}Check-mode results do not prove that changes were applied.{% elif data.filters.mode == 'all' %}Apply and check results are combined explicitly; each record is labeled.{% else %}Apply runs only.{% endif %} Deleted jobs and AIM terminal runs are not included.</p>
+{{ summary(data,outcome_labels) }}
+{% if data.book_stats %}<section class="card mt-3"><div class="card-header"><h2 class="h6 mb-0">Playbooks used on this host</h2></div><div class="book-summary-grid">{% for b in data.book_stats %}<a class="book-summary" href="{{ host_url(customer,host,playbook=b.playbook,mode=data.filters.mode,days=data.filters.days) }}"><strong>{{ b.playbook|replace('_',' ') }}</strong><span>{{ b.jobs }} runs &middot; {{ b.counts.successful }} succeeded &middot; {{ b.counts.unreachable }} unreachable</span><span>Latest: {{ outcome_labels[b.latest.outcome] }} &middot; {{ stamp(b.latest.recorded_at) }}</span></a>{% endfor %}</div></section>{% endif %}
+<section class="card mt-3"><div class="card-header"><h2 class="h6 mb-0">Run timeline</h2><span class="small text-secondary">{{ data.matched }} samples &middot; page {{ data.page }} / {{ data.pages }}</span></div>{{ records(data,outcome_labels) }}</section>
+<nav class="pagination-controls" aria-label="Host history pages">{% if previous_url %}<a class="btn btn-outline-secondary" href="{{ previous_url }}">Previous 25</a>{% endif %}{% if next_url %}<a class="btn btn-outline-secondary" href="{{ next_url }}">Next 25</a>{% endif %}</nav>
+<section class="card mt-4" id="host-plans"><div class="card-header"><h2 class="h6 mb-0">Your saved plans containing this host</h2></div><div class="history-list">{% for p in data.plans %}<a class="book-summary" href="/plans/{{ p.id }}"><strong>{{ p.name }}</strong><span>{{ p.playbook|replace('_',' ') }} &middot; {{ stamp(p.created_at) }}</span></a>{% else %}<p class="empty-state mb-0">None of your retained saved plans select this exact hostname.</p>{% endfor %}</div></section>
+<section class="card mt-4" id="host-reports"><div class="card-header"><h2 class="h6 mb-0">Recorded operation reports</h2><p class="coverage-note mb-0">Latest 20 retained report references for this exact host, across Apply/Check and all retained dates. These are dated WebGUI observations, not current inventory or health.</p></div><div class="history-list">{% for item in report_links %}<a class="book-summary" href="{{ item.url }}"><strong>{{ item.title }}</strong><span>{{ item.status|replace('_',' ') }} &middot; {{ item.retention|replace('_',' ') }} &middot; {{ 'CHECK' if item.check_mode else 'APPLY' }}</span><span>{{ stamp(item.stored_at) }} &middot; {{ item.job_id[:12] }}</span></a>{% else %}<p class="empty-state">No retained report references for this host.</p>{% endfor %}</div></section>
+<p class="coverage-note mt-3">Final Ansible outcomes are historical execution facts, not current software versions or application health. Renamed or recreated hosts are not automatically merged.</p>
+{% endblock %}
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/pages/audit.html b/scripts/addons/webgui/src/aim_webgui/templates/pages/audit.html
new file mode 100644
index 0000000..f90b4d2
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/pages/audit.html
@@ -0,0 +1,5 @@
+{% extends 'layouts/base.html' %}{% block content %}
+<p class="text-secondary">Security and workflow metadata only. No passwords, request bodies, parameter values or command output. This local audit store is not tamper-proof against its service owner or root.</p>
+<div class="audit-stack"><form class="filter-toolbar audit-filter" action="/audit" method="get"><label class="form-label mb-0"><span>Exact event name</span><input class="form-control mt-2" name="action" value="{{ action }}" placeholder="For example, login-failed"></label><div class="filter-actions"><button class="btn btn-outline-primary">Filter</button><a href="/audit" class="btn btn-outline-secondary">Reset</a></div></form>
+<div class="card"><div class="table-responsive"><table class="table mb-0"><thead><tr><th>Time</th><th>Actor</th><th>Event</th><th>Subject</th></tr></thead><tbody>{% for item in items %}<tr><td><time class="js-local-time" datetime="{{ item.occurred_at|utc_iso }}">{{ item.occurred_at|utc }}</time></td><td>{{ item.actor }}</td><td>{{ item.action }}</td><td class="text-break">{{ item.subject }}</td></tr>{% else %}<tr><td colspan="4">No events match.</td></tr>{% endfor %}</tbody></table></div></div></div>
+{% if items|length == 100 %}<a class="btn btn-outline-primary mt-3" href="/audit?before={{ items[-1].id }}&amp;action={{ action|urlencode }}">Older events</a>{% endif %}{% endblock %}
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/pages/credentials.html b/scripts/addons/webgui/src/aim_webgui/templates/pages/credentials.html
new file mode 100644
index 0000000..b4efe8b
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/pages/credentials.html
@@ -0,0 +1,7 @@
+{% extends 'layouts/base.html' %}
+{% block content %}
+<section class="card credential-fallback" hx-history="false"><div class="card-body p-4">
+  <p class="eyebrow">ONE RUN / PRIVATE CREDENTIAL CHANNEL</p><h2 class="h4">Unlock this run</h2>
+  {% include 'partials/credential_panel.html' %}
+</div></section>
+{% endblock %}
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/pages/customers.html b/scripts/addons/webgui/src/aim_webgui/templates/pages/customers.html
new file mode 100644
index 0000000..a7a46f8
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/pages/customers.html
@@ -0,0 +1,3 @@
+{% extends 'layouts/base.html' %}
+{% block subtitle %}<p class="text-secondary">Customer directories remain owned and managed by AIM.</p>{% endblock %}
+{% block content %}<section class="card">{% include 'partials/customers.html' %}</section>{% endblock %}
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/pages/error.html b/scripts/addons/webgui/src/aim_webgui/templates/pages/error.html
new file mode 100644
index 0000000..e90c7f1
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/pages/error.html
@@ -0,0 +1 @@
+{% extends 'layouts/base.html' %}{% block content %}<p>Return to the previous page, correct the selection, or sign in again if your session expired.</p><a class="btn btn-outline-primary" href="/">Back to overview</a>{% endblock %}
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/pages/explorer.html b/scripts/addons/webgui/src/aim_webgui/templates/pages/explorer.html
new file mode 100644
index 0000000..0f910b3
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/pages/explorer.html
@@ -0,0 +1,27 @@
+{% extends 'layouts/base.html' %}
+{% block subtitle %}<p class="text-secondary">{{ customer }} &middot; Core-provided groups and memberships. Explore a branch, then open a host's recorded playbook activity.</p>{% endblock %}
+{% block content %}
+<nav class="context-links" aria-label="Inventory workspaces"><a href="/customers">&larr; Customers</a><a href="/customers/{{ customer|urlencode }}/hosts">Host list</a><a href="/insights?customer={{ customer|urlencode }}">Playbook insights</a></nav>
+<div class="explorer-summary"><div><span class="eyebrow">CURRENT CORE SNAPSHOT</span><strong>{{ snap.host_count }}</strong> distinct hosts <span class="summary-separator">/</span> <strong>{{ snap.group_count }}</strong> groups</div><span class="coverage-note">Retrieved <time class="js-local-time" datetime="{{ snap.fetched_at|utc_iso }}">{{ snap.fetched_at|utc }}</time></span></div>
+<form action="{{ explorer_url(customer) }}" method="get" class="explorer-search"><label for="explorer-search">Find a host or subgroup</label><div><input type="search" id="explorer-search" class="form-control" name="q" value="{{ q }}" placeholder="Search all group paths, hostnames and addresses" maxlength="200"><button class="btn btn-outline-primary" type="submit">Search</button>{% if q %}<a class="btn btn-outline-secondary" href="{{ explorer_url(customer) }}">Clear</a>{% endif %}</div></form>
+{% if q %}<section class="card"><div class="card-header"><h2 class="h6 mb-0">{{ search_count }} search results</h2></div><div class="book-summary-grid">{% for item in search %}<a class="book-summary" href="{{ item.url }}"><span class="eyebrow">{{ item.kind }}</span><strong>{{ item.name }}</strong><span>{{ item.detail }}</span></a>{% else %}<p class="empty-state">No current inventory matches.</p>{% endfor %}</div></section><nav class="pagination-controls" aria-label="Inventory search pages">{% if search_prev %}<a class="btn btn-outline-secondary" href="{{ search_prev }}">Previous 50</a>{% endif %}{% if search_next %}<a class="btn btn-outline-secondary" href="{{ search_next }}">Next 50</a>{% endif %}</nav>
+{% else %}
+<nav class="inventory-breadcrumbs" aria-label="Inventory branch">{% for item in crumbs %}{% if not loop.first %}<span aria-hidden="true">/</span>{% endif %}<a href="{{ item.url }}" {% if loop.last %}aria-current="location"{% endif %}>{{ item.name }}</a>{% endfor %}</nav>
+<section class="card explorer-panel view-{{ view }}" data-explorer>
+<div class="card-header explorer-toolbar"><div><h2 class="h5 mb-1">{{ selected.name }}</h2><span class="small text-secondary">{{ selected.direct|length }} direct hosts &middot; {{ selected.members|length }} distinct hosts including subgroups</span></div><nav class="view-switch" aria-label="Inventory representation"><a class="btn btn-sm btn-outline-secondary" href="{{ map_url }}" {% if view == 'map' %}aria-current="page"{% endif %}>Map</a><a class="btn btn-sm btn-outline-secondary" href="{{ outline_url }}" {% if view == 'outline' %}aria-current="page"{% endif %}>Outline</a></nav></div>
+<div class="explorer-map">
+<div class="map-controls"><span class="coverage-note">&#9633; Group &nbsp; &#9635; Host &middot; Select a node to open it</span><div class="zoom-controls" data-graph-controls><button type="button" data-graph-zoom="out" aria-label="Zoom inventory map out">&minus;</button><button type="button" data-graph-zoom="reset">Fit</button><button type="button" data-graph-zoom="in" aria-label="Zoom inventory map in">+</button></div></div>
+<div class="inventory-canvas" tabindex="0" role="region" aria-label="Inventory relationship map. Scroll within this area or use the outline view.">
+<svg data-inventory-graph data-base-width="{{ graph_width }}" data-base-height="{{ graph_height }}" viewBox="0 0 {{ graph_width }} {{ graph_height }}" width="{{ graph_width }}" height="{{ graph_height }}" role="group" aria-label="{{ selected.name }} inventory membership graph">
+{% for x1,y1,x2,y2 in graph_edges %}<path class="graph-edge" d="M {{ x1 }} {{ y1 }} V {{ (y1+y2)/2 }} H {{ x2 }} V {{ y2 }}" aria-hidden="true"/>{% endfor %}
+{% for n in graph_nodes %}<a href="{{ n.url }}" class="graph-node graph-{{ n.kind }}" aria-label="{{ n.kind }}: {{ n.label }}. {{ n.detail }}"><title>{{ n.label }} - {{ n.detail }}</title><rect x="{{ n.x }}" y="{{ n.y }}" width="{{ n.w }}" height="{{ n.h }}" rx="10"/>
+<text class="graph-symbol" x="{{ n.x+14 }}" y="{{ n.y+29 }}" aria-hidden="true">{{ '&#9635;'|safe if n.kind == 'host' else '&#9633;'|safe }}</text><text class="graph-label" x="{{ n.x+42 }}" y="{{ n.y+28 }}">{{ n.label|truncate(25 if n.w < 300 else 38,true,'...') }}</text><text class="graph-detail" x="{{ n.x+14 }}" y="{{ n.y+50 }}">{{ n.detail|truncate(34 if n.w < 300 else 80,true,'...') }}</text></a>{% endfor %}
+</svg></div><p class="coverage-note px-3 pt-2">Groups show up to three direct host links in the map; open a group for all members and subgroups. Links show inventory membership, not network connections or live status.</p>
+</div>
+<div class="explorer-outline"><div class="inventory-group-grid">{% for g in groups %}<section class="inventory-group-card"><a class="group-card-title" href="{{ g.url }}"><span class="entity-symbol small-symbol" aria-hidden="true">&#9633;</span><strong>{{ g.name }}</strong><span aria-hidden="true">&rarr;</span></a><p class="coverage-note">{{ g.direct|length }} direct &middot; {{ g.members|length }} total distinct hosts &middot; {{ g.children|length }} subgroups</p><ul class="branch-hosts">{% for h in g.direct[:3] %}<li><a href="{{ host_url(customer,h) }}"><span aria-hidden="true">&#9635;</span> {{ h }}</a></li>{% else %}<li class="text-secondary small">{{ 'Hosts are nested in subgroups.' if g.children else 'This group is empty.' }}</li>{% endfor %}</ul><a href="{{ g.url }}" class="small">Explore group &rarr;</a></section>{% else %}<p class="empty-state mb-0">No subgroups in this branch.</p>{% endfor %}</div></div>
+<div class="inventory-direct"><h3 class="h6">Direct hosts <span class="text-secondary">{{ selected.direct|length }}</span></h3><div class="direct-host-grid">{% for h in direct_hosts %}<a class="host-node-link" href="{{ h.url }}"><span class="entity-symbol small-symbol" aria-hidden="true">&#9635;</span><span><strong>{{ h.name }}</strong><small>{{ h.platforms|join(', ') or 'Host' }} &middot; {{ h.address or 'Address not supplied' }}</small></span></a>{% else %}<p class="text-secondary small mb-0">No hosts are assigned directly to this branch. Open a subgroup to continue.</p>{% endfor %}</div></div>
+<div class="pagination-controls p-3"><span class="coverage-note">Groups {{ gpage }} / {{ group_pages }} &middot; direct hosts {{ hpage }} / {{ host_pages }}</span>{% if groups_prev %}<a class="btn btn-sm btn-outline-secondary" href="{{ groups_prev }}">Previous groups</a>{% endif %}{% if groups_next %}<a class="btn btn-sm btn-outline-secondary" href="{{ groups_next }}">Next groups</a>{% endif %}{% if hosts_prev %}<a class="btn btn-sm btn-outline-secondary" href="{{ hosts_prev }}">Previous hosts</a>{% endif %}{% if hosts_next %}<a class="btn btn-sm btn-outline-secondary" href="{{ hosts_next }}">Next hosts</a>{% endif %}</div>
+</section>
+{% endif %}
+<p class="coverage-note mt-3">Current metadata is read from Core on each request. A host may belong to multiple groups but has one activity page per customer. Opening this page never runs a playbook.</p>
+{% endblock %}
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/pages/hosts.html b/scripts/addons/webgui/src/aim_webgui/templates/pages/hosts.html
new file mode 100644
index 0000000..faae126
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/pages/hosts.html
@@ -0,0 +1,9 @@
+{% extends 'layouts/base.html' %}
+{% block subtitle %}<p class="text-secondary">Read-only inventory navigation. Host variables and Vault values are not exposed.</p>{% endblock %}
+{% block content %}<nav class="context-links" aria-label="Inventory views"><a href="{{ explorer_url(customer) }}">Inventory map &amp; outline</a><a href="/insights?customer={{ customer|urlencode }}">Playbook insights</a></nav><form class="filter-toolbar" method="get" action="/customers/{{ customer|urlencode }}/hosts" hx-get="/_partials/hosts" hx-target="#host-results">
+<input type="hidden" name="customer" value="{{ customer }}">
+<label for="search">Find hosts<input id="search" type="search" class="form-control" name="q" value="{{ q }}" placeholder="Hostname, address or group"></label>
+<label for="group-filter">Group<select id="group-filter" class="form-select" name="group"><option value="">All groups</option>{% for g in groups %}<option {% if g == group %}selected{% endif %}>{{ g }}</option>{% endfor %}</select></label>
+<label for="sort-hosts">Sort<select id="sort-hosts" name="sort" class="form-select">{% for v,label in [('name','Hostname'),('address','Address'),('group','Group')] %}<option value="{{ v }}" {% if v == sort %}selected{% endif %}>{{ label }}</option>{% endfor %}</select></label>
+<button type="submit" class="btn btn-outline-primary">Filter</button><a class="btn btn-primary" href="/plan?customer={{ customer|urlencode }}">Prepare selection</a></form>
+<section class="card" id="host-results" aria-live="polite">{% include 'partials/hosts.html' %}</section>{% endblock %}
\ No newline at end of file
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/pages/insights.html b/scripts/addons/webgui/src/aim_webgui/templates/pages/insights.html
new file mode 100644
index 0000000..7b9ad16
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/pages/insights.html
@@ -0,0 +1,15 @@
+{% extends 'layouts/base.html' %}
+{% from 'partials/activity_macros.html' import stamp, outcome, filters, summary %}
+{% block subtitle %}<p class="text-secondary">Connect the dots across retained WebGUI jobs. No terminal history collection, live monitoring or background host probes.</p>{% endblock %}
+{% block content %}
+{{ filters(data,outcome_labels,'/insights') }}
+<p class="coverage-note">{{ 'All retained history' if data.filters.days == 'all' else 'Rolling ' + data.filters.days + '-day window' }}. Visibility matches the source jobs: your jobs, or all jobs for an administrator. Deleting a job removes its contribution.</p>
+{{ summary(data,outcome_labels) }}
+<section class="card mt-4"><div class="card-header"><div><p class="eyebrow mb-1">HOST &times; PLAYBOOK</p><h2 class="h5 mb-0">Last recorded results</h2></div><span class="small text-secondary">{{ data.host_count }} hosts &middot; page {{ data.page }} / {{ data.matrix_pages }}</span></div>
+<p class="coverage-note px-3 pt-3">Latest matching record per customer/host/playbook, within the selected filter. {{ 'Select one mode to avoid mixing check and apply.' if data.filters.mode == 'all' else '' }} Empty cells mean no matching retained result, never success.{% if data.filters.outcome %} An outcome filter is active: this is the latest <strong>matching</strong> outcome, not necessarily the latest run.{% endif %}{% if data.omitted_columns %} Showing 12 playbooks; {{ data.omitted_columns }} more are available using the playbook filter.{% endif %}</p>
+<div class="table-responsive insights-matrix"><table class="table align-middle mb-0"><thead><tr><th scope="col">Host / customer</th>{% for book in data.columns %}<th scope="col">{{ book|replace('_',' ') }}</th>{% endfor %}</tr></thead><tbody>{% for row in data.matrix %}<tr><th scope="row"><a href="{{ row.url }}">{{ row.host }}</a><span class="row-meta d-block">{{ row.customer }}</span></th>{% for cell in row.cells %}<td>{% if cell %}<a class="matrix-result" href="/jobs/{{ cell.job_id }}">{{ outcome(cell.outcome,outcome_labels) }}<span>{{ stamp(cell.recorded_at) }}</span><span class="mode-tag">{{ cell.mode }}</span></a>{% else %}<span class="text-secondary small">No recorded result</span>{% endif %}</td>{% endfor %}</tr>{% else %}<tr><td colspan="{{ data.columns|length + 1 }}" class="empty-state">No retained WebGUI results match this filter.</td></tr>{% endfor %}</tbody></table></div>
+<div class="matrix-mobile">{% for row in data.matrix %}<article class="history-item"><a class="entity-link" href="{{ row.url }}">{{ row.host }}</a><span class="small text-secondary">{{ row.customer }}</span>{% for book in data.columns %}{% set cell=row.cells[loop.index0] %}<div class="mobile-cell"><strong>{{ book|replace('_',' ') }}</strong>{% if cell %}<a href="/jobs/{{ cell.job_id }}">{{ outcome(cell.outcome,outcome_labels) }}</a><span class="small text-secondary">{{ stamp(cell.recorded_at) }} &middot; {{ cell.mode }}</span>{% else %}<span class="small text-secondary">No recorded result</span>{% endif %}</div>{% endfor %}</article>{% else %}<p class="empty-state">No retained WebGUI results match this filter.</p>{% endfor %}</div>
+</section>
+<nav class="pagination-controls" aria-label="Host matrix pages">{% if previous_url %}<a class="btn btn-outline-secondary" href="{{ previous_url }}">Previous 20 hosts</a>{% endif %}{% if next_url %}<a class="btn btn-outline-secondary" href="{{ next_url }}">Next 20 hosts</a>{% endif %}</nav>
+<section class="card mt-4"><div class="card-header"><h2 class="h6 mb-0">By playbook</h2></div><div class="book-summary-grid">{% for b in data.book_stats %}<a class="book-summary" href="/insights?{{ {'customer':customer,'playbook':b.playbook,'mode':data.filters.mode,'days':data.filters.days}|urlencode }}"><strong>{{ b.playbook|replace('_',' ') }}</strong><span>{{ b.jobs }} jobs &middot; {{ b.samples }} host/run samples</span><span>{{ b.counts.successful }} succeeded &middot; {{ b.counts.failed }} failed &middot; {{ b.counts.unreachable }} unreachable</span></a>{% else %}<p class="empty-state">No recorded playbooks in this view.</p>{% endfor %}</div></section>
+{% endblock %}
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/pages/job.html b/scripts/addons/webgui/src/aim_webgui/templates/pages/job.html
new file mode 100644
index 0000000..d9c5174
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/pages/job.html
@@ -0,0 +1,7 @@
+{% extends 'layouts/base.html' %}
+{% block content %}
+<nav class="job-view-nav" aria-label="Job sections"><a href="#job-status">Summary</a><a href="#job-progress">Progress</a><a href="#job-targets">Targets</a><a href="#job-reports">Reports</a></nav>
+{% include 'partials/job.html' %}
+{% include 'partials/progress.html' %}
+{% include 'partials/reports.html' %}
+{% endblock %}
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/pages/jobs.html b/scripts/addons/webgui/src/aim_webgui/templates/pages/jobs.html
new file mode 100644
index 0000000..c380020
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/pages/jobs.html
@@ -0,0 +1,8 @@
+{% extends 'layouts/base.html' %}{% block content %}
+<div class="note mb-3">{{ 'Execution enabled for explicitly allowlisted operations.' if execution else 'Execution disabled. No job will execute in this configuration.' }} Running jobs remain protected from deletion.</div>
+{% include 'partials/attention.html' %}
+<form action="/jobs/bulk-delete" method="post" data-bulk-form data-confirm="Delete the selected finished job histories? Their audit deletion records remain.">
+<input type="hidden" name="_csrf" value="{{ csrf }}">
+<div class="overview-toolbar"><div><strong>Execution history</strong><span class="text-secondary small">State, scope and affected hosts at a glance.</span></div><button class="btn btn-sm btn-outline-danger" type="submit" data-bulk-submit disabled>Delete selected finished jobs</button></div>
+<div class="card overview-card"><div class="table-responsive"><table class="table align-middle mb-0 operational-table"><thead><tr><th class="selection-column"><input class="form-check-input" type="checkbox" data-bulk-select-all aria-label="Select all deletable jobs"></th><th>Job / operation</th><th>Targets</th><th>Mode</th><th>State</th><th>Not before</th></tr></thead><tbody>{% for item in items %}<tr><td class="selection-column">{% if item.status in ['successful','failed','canceled','timed_out','blocked','interrupted'] %}<input class="form-check-input" type="checkbox" name="job_ids" value="{{ item.id }}" data-bulk-item aria-label="Select job {{ item.id[:12] }}">{% endif %}</td><td><a class="operation-link" href="/jobs/{{ item.id }}">{{ item.customer }} / {{ item.playbook }}</a><div class="row-meta">{{ item.id[:12] }} · {{ item.username }}</div></td><td><strong>{{ item.target_count }}</strong>{% if item.target_preview %}<div class="host-preview">{% for h in item.target_preview %}<a href="{{ host_url(item.customer,h) }}">{{ h }}</a>{% if not loop.last %}, {% endif %}{% endfor %}{% if item.target_count > 2 %} <span>+{{ item.target_count-2 }} more</span>{% endif %}</div>{% endif %}</td><td><span class="mode-tag">{{ item.mode }}</span></td><td><span class="status-tag status-{{ 'waiting_credentials' if item.credential_phase == 'waiting' and item.status == 'running' else item.display_status }}"><span class="status-dot-mini" aria-hidden="true"></span>{{ 'Awaiting credentials' if item.credential_phase == 'waiting' and item.status == 'running' else item.display_status|replace('_',' ') }}</span>{% if item.target_summary and item.target_summary.complete %}<div class="row-meta outcome-summary">{{ item.target_summary.successful }} / {{ item.target_summary.requested }} successful{% if item.target_summary.unreachable %} · {{ item.target_summary.unreachable }} unreachable{% endif %}{% if item.target_summary.failed %} · {{ item.target_summary.failed }} failed{% endif %}{% if item.target_summary.not_started %} · {{ item.target_summary.not_started }} not started{% endif %}{% if item.target_summary.indeterminate %} · {{ item.target_summary.indeterminate }} indeterminate{% endif %}</div>{% endif %}</td><td><time class="js-local-time" datetime="{{ item.scheduled_at|utc_iso }}">{{ item.scheduled_at|utc }}</time></td></tr>{% else %}<tr><td colspan="6" class="empty-state">No jobs submitted. Start with New run; saving a plan is optional.</td></tr>{% endfor %}</tbody></table></div></div>
+</form>{% endblock %}
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/pages/login.html b/scripts/addons/webgui/src/aim_webgui/templates/pages/login.html
new file mode 100644
index 0000000..d3cbb5a
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/pages/login.html
@@ -0,0 +1,12 @@
+{% extends 'layouts/base.html' %}
+{% block subtitle %}<p class="text-secondary">Sign in to your controller workspace.</p>{% endblock %}
+{% block content %}
+<div class="login-layout"><section class="card login-card"><div class="card-body p-4">
+<p class="eyebrow">LOCAL ACCOUNT</p><h2 class="h4 mb-4">Welcome back</h2>
+<form action="/login" method="post">
+<input type="hidden" name="_csrf" value="{{ csrf }}">
+<div class="mb-3"><label class="form-label" for="username">Username</label><input class="form-control" id="username" name="username" autocomplete="username" maxlength="64" required autofocus></div>
+<div class="mb-4"><label class="form-label" for="password">Password</label><input class="form-control" id="password" type="password" name="password" autocomplete="current-password" maxlength="128" required></div>
+<button class="btn btn-primary w-100" type="submit">Sign in to AIM Web</button>
+</form></div></section><section class="login-note"><span class="section-index">01 / FIRST SIGN-IN</span><h2 class="h4">Built around your existing AIM installation.</h2><p>Retrieve the initial administrator password from the protected <code>.credentials</code> path printed by deployment. The file is local to your controller, not accessible through this website.</p><p>First login requires a password change. Your terminal workflow stays independent.</p></section></div>
+{% endblock %}
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/pages/overview.html b/scripts/addons/webgui/src/aim_webgui/templates/pages/overview.html
new file mode 100644
index 0000000..3ab7289
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/pages/overview.html
@@ -0,0 +1,9 @@
+{% extends 'layouts/base.html' %}
+{% block subtitle %}<p class="text-secondary">Run a reviewed job now. Save a plan only when you need to reuse it.</p>{% endblock %}
+{% block content %}{% if session.username == 'admin' %}<div class="note mb-3"><a href="/setup">Finish named-administrator onboarding and retire bootstrap admin.</a></div>{% endif %}
+<div class="mode-banner"><div><span class="pill">AIM 3.3.0rc8 / SERVICE API 1.0</span><h2>Select. Review. Run once.</h2><p>The core owns inventory, validation, credentials and native execution. This workspace owns your workflow.</p></div><a class="btn btn-primary" href="/plan">New run &rarr;</a></div>
+{% include 'partials/attention.html' %}
+<div class="experience-links"><a class="experience-link" href="/customers"><span class="entity-symbol" aria-hidden="true">&#9633;</span><span><strong>Explore your inventory</strong><small>Groups, subgroups and linked host workspaces. Current metadata, no host probes.</small></span></a><a class="experience-link" href="/insights"><span class="entity-symbol" aria-hidden="true">&#9636;</span><span><strong>Understand your run history</strong><small>Per-host outcomes and playbook insights from retained WebGUI jobs only.</small></span></a></div><div class="row g-3 stats-row">{% for label,value,note in [('Customers',customers|length,'Available to the configured core identity'),('Available operations',playbooks|length,'Union of customer-scoped catalogs'),('Execution', 'Enabled' if execution_enabled and core.execution.enabled else 'Disabled','Both WebGUI policy and core opt-in must allow runs')] %}<div class="col-md-4"><section class="card metric-card"><span class="metric-label">{{ label }}</span><strong class="metric-value">{{ value }}</strong><span class="text-secondary small">{{ note }}</span></section></div>{% endfor %}</div>
+<section class="card mt-4"><div class="card-header"><h2 class="h5 mb-0">Recent jobs</h2><a href="/jobs">All jobs &rarr;</a></div><div class="table-responsive"><table class="table align-middle mb-0"><thead><tr><th>Job</th><th>Requester</th><th>Mode</th><th>Status</th><th>Created</th></tr></thead><tbody>{% for j in recent_jobs %}<tr><td><a href="/jobs/{{ j.id }}">{{ j.id[:12] }}</a></td><td>{{ j.username }}</td><td>{{ j.mode }}</td><td><span class="status-tag status-{{ j.display_status }}"><span class="status-dot-mini" aria-hidden="true"></span>{{ j.display_status|replace('_',' ') }}</span></td><td><time class="js-local-time" datetime="{{ j.created_at|utc_iso }}">{{ j.created_at|utc }}</time></td></tr>{% else %}<tr><td colspan="5" class="empty-state">No jobs yet. Start with New run; a saved plan is not required.</td></tr>{% endfor %}</tbody></table></div></section>
+<div class="row g-4 mt-1"><section class="col-xl-8"><div class="card"><div class="card-header"><h2 class="h5 mb-0">Inventory workspaces</h2><a href="/customers">View inventory &rarr;</a></div>{% include 'partials/customers.html' %}</div></section><aside class="col-xl-4"><div class="card"><div class="card-body p-4"><h2 class="h5">Native inventory authentication</h2><p>Usernames and Vault references retain AIM's normal precedence. Custom credential overrides and raw module output are not exposed. Core 3.2 provides safety-filtered detailed play/task/host progress.</p><p class="form-text">Execution streams detailed play/task/host events plus structured stages and counters. Readiness and live SSH/WinRM acceptance remain separate checks.</p><a class="btn btn-outline-primary" href="/plans">Saved plans</a></div></div></aside></div>
+{% endblock %}
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/pages/password.html b/scripts/addons/webgui/src/aim_webgui/templates/pages/password.html
new file mode 100644
index 0000000..9696e0a
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/pages/password.html
@@ -0,0 +1,8 @@
+{% extends 'layouts/base.html' %}
+{% block subtitle %}<p class="text-secondary">{% if session.must_change_password %}Replace your temporary password before accessing the workspace.{% else %}Changing your password signs out every active session.{% endif %}</p>{% endblock %}
+{% block content %}<section class="card form-card"><div class="card-body p-4"><form action="/password" method="post">
+<input type="hidden" name="_csrf" value="{{ csrf }}">
+<label class="form-label" for="current">Current password</label><input class="form-control mb-3" id="current" type="password" name="current_password" autocomplete="current-password" required maxlength="128">
+<label class="form-label" for="new">New password</label><input class="form-control mb-2" id="new" type="password" name="password" autocomplete="new-password" minlength="15" maxlength="128" required aria-describedby="password-help"><p id="password-help" class="form-text">Use 15-128 characters. Passphrases and password-manager-generated passwords are supported.</p>
+<label class="form-label" for="confirm">Confirm new password</label><input class="form-control mb-4" id="confirm" type="password" name="confirm" autocomplete="new-password" minlength="15" maxlength="128" required>
+<button class="btn btn-primary" type="submit">Change password &amp; sign out</button></form></div></section>{% endblock %}
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/pages/plan.html b/scripts/addons/webgui/src/aim_webgui/templates/pages/plan.html
new file mode 100644
index 0000000..93e8660
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/pages/plan.html
@@ -0,0 +1,98 @@
+{% extends 'layouts/base.html' %}
+{% block subtitle %}<p class="text-secondary">Choose a customer, review explicit hosts and validate optional catalog inputs.</p>{% endblock %}
+{% block content %}{% if reused %}<div class="note mb-3">Loaded a saved plan as a reusable preset. Hosts no longer compatible are not selected. Validate again before saving a new snapshot or submitting a job.</div>{% endif %}
+<section class="card mb-4">
+  <div class="card-body p-4">
+    <form action="/plan" method="get" class="row g-3 align-items-end">
+      <div class="col-md-5">
+        <label class="form-label" for="customer">Customer</label>
+        <select id="customer" name="customer" class="form-select" required>
+          <option value="">Select customer</option>
+          {% for c in customers %}<option value="{{ c.name }}" {% if c.name == customer %}selected{% endif %}>{{ c.name }}</option>{% endfor %}
+        </select>
+      </div>
+      <div class="col-md-5">
+        <label class="form-label" for="playbook">Catalog operation</label>
+        <select id="playbook" name="playbook" class="form-select" required>
+          <option value="">Select operation</option>
+          {% for p in playbooks %}<option value="{{ p.key }}" {% if p.key == playbook %}selected{% endif %}>{{ p.category }} / {{ p.name }}</option>{% endfor %}
+        </select>
+      </div>
+      <div class="col-md-2"><button class="btn btn-primary w-100" type="submit">Load selection</button></div>
+    </form>
+  </div>
+</section>
+{% if spec %}
+<form action="/preflight" method="post" hx-post="/_partials/preflight" hx-target="#preflight-result" hx-disabled-elt="find button[type='submit']">
+<input type="hidden" name="_csrf" value="{{ csrf }}"><input type="hidden" name="customer" value="{{ customer }}"><input type="hidden" name="playbook" value="{{ playbook }}">
+<section class="card mb-4 host-selection-card">
+  <div class="card-header selection-card-header">
+    <div>
+      <h3 class="h6 mb-1">01 / Explicit targets</h3>
+      <span class="text-secondary small">{{ hosts|length }} compatible host(s) · <span data-selected-count>0 selected</span></span>
+    </div>
+    <span class="selection-limit">Maximum 500 explicit targets</span>
+  </div>
+  {% if groups %}
+  <div class="group-selector" aria-label="Select hosts by inventory group">
+    <div class="group-selector-heading"><span class="group-selector-label">Inventory groups</span><span class="group-selector-help">Core hierarchy; parent groups include descendant subgroups</span></div>
+    <div class="group-selector-items">
+      {% for group in groups %}
+      <label class="group-choice">
+        <input class="form-check-input" type="checkbox" value="{{ group.name }}" data-group-select>
+        <span class="group-name">{% if group.depth %}{{ "↳ " * group.depth }}{% endif %}{{ group.name }}</span><span class="group-count">{{ group.count }}</span>
+      </label>
+      {% endfor %}
+    </div>
+  </div>
+  {% endif %}
+  <div class="filter-toolbar">
+<label for="host-search">Find hosts<input id="host-search" type="search" class="form-control" data-host-search placeholder="Hostname, address or group"></label>
+<label for="host-group-filter">Filter group<select id="host-group-filter" class="form-select" data-host-group-filter><option value="">All groups</option>{% for g in groups %}<option>{{ g.name }}</option>{% endfor %}</select></label>
+<label for="host-sort">Sort<select id="host-sort" class="form-select" data-host-sort><option value="name">Hostname</option><option value="address">Address</option><option value="group">Group</option></select></label>
+<button class="btn btn-outline-secondary" type="button" data-clear-hosts>Clear selection</button></div>
+<p class="selection-help form-text"><span data-visible-count></span> Select-all affects visible rows; group buttons affect all compatible hosts in that group. <span data-selection-saved aria-live="polite">Selections are saved privately for seven days.</span></p>
+<div class="table-responsive">
+    <table class="table align-middle mb-0">
+      <thead><tr>
+        <th scope="col" class="selection-column">
+          <input class="form-check-input" id="select-all-hosts" type="checkbox" data-select-all-hosts aria-label="Select all compatible hosts" title="Select all compatible hosts">
+        </th>
+        <th scope="col">Host</th><th scope="col">Address</th><th scope="col">Groups</th>
+      </tr></thead>
+      <tbody>
+      {% for h in hosts %}
+        <tr data-host-row data-name="{{ h.name }}" data-address="{{ h.address or '' }}" data-group="{{ h.groups|join(' ') }}">
+          <td class="selection-column"><input class="form-check-input" type="checkbox" name="targets" value="{{ h.name }}" id="host-{{ loop.index }}" data-host-target {% if h.name in selected %}checked{% endif %} data-groups='{{ h.groups|tojson|forceescape }}'></td>
+          <td><label class="entity-name" for="host-{{ loop.index }}">{{ h.name }}</label></td>
+          <td><code>{{ h.address or '-' }}</code></td>
+          <td>{% for group in h.groups %}<span class="badge badge-neutral me-1">{{ group }}</span>{% else %}<span class="text-secondary">No group membership</span>{% endfor %}</td>
+        </tr>
+      {% else %}
+        <tr><td colspan="4" class="empty-state">No compatible hosts. Check the customer inventory in AIM.</td></tr>
+      {% endfor %}
+      </tbody>
+    </table>
+  </div>
+</section>
+{% if spec.result is defined and spec.result and spec.result.schema=='patch_summary_v1' %}
+<section class="note mb-4" aria-label="Patch-wave policy"><strong>Reboot and continuation are separate decisions</strong>
+<p class="mb-0 mt-1">Core installs Windows updates sequentially. An update-triggered reboot ends the wave unless post-reboot continuation is deliberately enabled. Review the catalog's continuation hint below; blank inputs remain inherited, not forced values. Reboot delay and message apply only to an AIM-initiated reboot. Linux keeps its native package-manager policy.</p></section>
+{% endif %}
+{% if spec.inputs %}
+<section class="card mb-4"><div class="card-header"><h3 class="h6 mb-0">02 / Optional inputs</h3><span class="text-secondary small">Blank values inherit inventory / role defaults; catalog hints are not resolved inventory values.</span></div><div class="card-body p-4"><div class="row g-3">
+{% for field in spec.inputs %}<div class="col-md-6"><label class="form-label" for="option-{{ loop.index }}">{{ field.label }}{% if field.platforms %} <span class="badge badge-neutral">{{ field.platforms|join(', ') }}</span>{% endif %}</label>
+{% if field.type in ['bool','choice'] %}<select class="form-select" id="option-{{ loop.index }}" name="option.{{ field.name }}" aria-describedby="option-help-{{ loop.index }}"><option value="">Inherit{% if field.default_hint %} (catalog hint: {{ field.default_hint }}){% endif %}</option>{% for choice in (['true','false'] if field.type == 'bool' else field.choices) %}<option value="{{ choice }}" {% if option_values.get(field.name) == choice %}selected{% endif %}>{{ choice }}</option>{% endfor %}</select>
+{% elif field.type in ['list','sequence'] %}<textarea class="form-control" id="option-{{ loop.index }}" name="option.{{ field.name }}" aria-describedby="option-help-{{ loop.index }}" rows="3" placeholder="Inherit default; or a JSON list">{{ option_values.get(field.name,'') }}</textarea>
+{% else %}<input class="form-control" id="option-{{ loop.index }}" name="option.{{ field.name }}" aria-describedby="option-help-{{ loop.index }}" value="{{ option_values.get(field.name,'') }}" {% if field.type == 'int' %}type="number" step="1" {% if field.minimum is not none %}min="{{ field.minimum }}"{% endif %} {% if field.maximum is not none %}max="{{ field.maximum }}"{% endif %}{% elif field.type == 'url' %}type="url"{% endif %} placeholder="{{ 'Vault variable name only, never its value' if field.type == 'secret_ref' else 'Inherit AIM default' }}" autocomplete="off">{% endif %}
+<div class="form-text" id="option-help-{{ loop.index }}">{{ field.help or field.name }}{% if field.default_hint %} Default hint: {{ field.default_hint }}.{% endif %}{% if field.choices %} Choices: {{ field.choices|join(', ') }}.{% endif %}</div></div>{% endfor %}
+</div></div></section>
+{% endif %}
+<section class="card mb-4"><div class="card-body p-4"><h3 class="h5">03 / Run settings</h3>
+<div class="workflow-grid"><label for="run-mode">Execution mode<select id="run-mode" name="mode" class="form-select"><option value="check" {% if run_mode == 'check' %}selected{% endif %}>Check mode</option><option value="apply" {% if run_mode == 'apply' %}selected{% endif %}>Apply</option></select></label>
+<label for="run-key-mode">SSH key handling<select id="run-key-mode" name="key_mode" class="form-select"><option value="none" {% if key_mode == 'none' %}selected{% endif %}>Native inventory (no added agent)</option><option value="customer" {% if key_mode == 'customer' %}selected{% endif %}>Load customer SSH key (Linux)</option></select></label></div>
+<p class="form-text">Usernames and password references come from AIM inventory. Customer key mode loads the canonical owner-only key under the core executor account. Custom username/password override is not supported by AIM 3.3.0rc8. Check mode is not a guarantee of zero changes.</p></div></section>
+<div class="toolbar"><p class="text-secondary mb-0">Review next, then run once. Saving a reusable plan is optional. No execution or credential collection occurs on review.</p><button type="submit" class="btn btn-primary">Review one-run job &rarr;</button></div>
+</form><section id="preflight-result" class="mt-4" aria-live="polite"></section>
+{% endif %}
+{% endblock %}
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/pages/plan_detail.html b/scripts/addons/webgui/src/aim_webgui/templates/pages/plan_detail.html
new file mode 100644
index 0000000..8503cd5
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/pages/plan_detail.html
@@ -0,0 +1,7 @@
+{% extends 'layouts/base.html' %}{% block content %}
+<section class="card"><div class="card-body p-4"><p class="eyebrow">REUSABLE NON-SECRET PLAN</p><dl class="system-facts"><dt>Customer</dt><dd>{{ saved.customer }}</dd><dt>Playbook</dt><dd>{{ saved.playbook }}</dd><dt>Targets</dt><dd>{{ result.targets|length }}</dd><dt>Created</dt><dd><time class="js-local-time" datetime="{{ saved.created_at|utc_iso }}">{{ saved.created_at|utc }}</time></dd></dl>
+{% if not result.core_request %}<div class="note">This plan was saved against the old rc18 adapter. Its data is retained. Review it under the new core before running; old credential modes are not reused.</div>{% endif %}
+<pre class="code-panel">{{ result.targets|join('
+') }}</pre><pre class="code-panel">{{ result.overrides|tojson(indent=2) }}</pre>
+<a class="btn btn-primary" href="/plan?saved={{ saved.id }}">Review and run once</a><p class="form-text">Loads these selections into New run. A fresh core revision, confirmation and any required one-run credentials are mandatory.</p></div></section>
+<form action="/plans/{{ saved.id }}/delete" method="post" class="mt-3" data-confirm="Delete this saved plan? Existing jobs and audit remain."><input type="hidden" name="_csrf" value="{{ csrf }}"><button class="btn btn-outline-danger" type="submit">Delete saved plan</button></form>{% endblock %}
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/pages/plans.html b/scripts/addons/webgui/src/aim_webgui/templates/pages/plans.html
new file mode 100644
index 0000000..b124f48
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/pages/plans.html
@@ -0,0 +1,7 @@
+{% extends 'layouts/base.html' %}{% block content %}
+<p class="text-secondary">Reusable reviewed selections with non-secret inputs only. Host scope is shown directly so you can recognize a plan before opening it.</p><a class="btn btn-primary mb-3" href="/plan">New run</a>
+<form action="/plans/bulk-delete" method="post" data-bulk-form data-confirm="Delete the selected saved plans? This cannot be undone.">
+<input type="hidden" name="_csrf" value="{{ csrf }}">
+<div class="overview-toolbar"><div><strong>Reusable selections</strong><span class="text-secondary small">Names are private to your account; blank names are generated uniquely.</span></div><button class="btn btn-sm btn-outline-danger" type="submit" data-bulk-submit disabled>Delete selected plans</button></div>
+<div class="card overview-card"><div class="table-responsive"><table class="table align-middle mb-0 operational-table"><thead><tr><th class="selection-column"><input class="form-check-input" type="checkbox" data-bulk-select-all aria-label="Select all saved plans"></th><th>Plan</th><th>Operation</th><th>Affected hosts</th><th>Saved</th></tr></thead><tbody>{% for item in items %}<tr><td class="selection-column"><input class="form-check-input" type="checkbox" name="plan_ids" value="{{ item.id }}" data-bulk-item aria-label="Select plan {{ item.name }}"></td><td><a class="operation-link" href="/plans/{{ item.id }}">{{ item.name }}</a><div class="row-meta">{{ item.customer }}</div></td><td>{{ item.playbook }}</td><td><strong>{{ item.target_count }}</strong>{% if item.target_preview %}<div class="host-preview">{% for h in item.target_preview %}<a href="{{ host_url(item.customer,h) }}">{{ h }}</a>{% if not loop.last %}, {% endif %}{% endfor %}{% if item.target_count > 2 %} <span>+{{ item.target_count-2 }} more</span>{% endif %}</div>{% endif %}</td><td><time class="js-local-time" datetime="{{ item.created_at|utc_iso }}">{{ item.created_at|utc }}</time></td></tr>{% else %}<tr><td colspan="5" class="empty-state">No saved plans yet. Run once without saving, or keep a reviewed selection for reuse.</td></tr>{% endfor %}</tbody></table></div></div>
+</form>{% endblock %}
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/pages/playbooks.html b/scripts/addons/webgui/src/aim_webgui/templates/pages/playbooks.html
new file mode 100644
index 0000000..a3ce0e6
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/pages/playbooks.html
@@ -0,0 +1,3 @@
+{% extends 'layouts/base.html' %}
+{% block subtitle %}<p class="text-secondary">Catalog metadata comes directly from AIM. Selecting a playbook does not run it.</p>{% endblock %}
+{% block content %}<div class="row g-3">{% for p in playbooks %}<div class="col-lg-6"><section class="card h-100"><div class="card-body p-4"><span class="eyebrow">{{ p.category }}</span><h2 class="h5">{{ p.name }}</h2><p class="text-secondary">{{ p.description }}</p><div class="d-flex gap-2 mb-3">{% for platform in p.platforms %}<span class="badge badge-neutral">{{ platform }}</span>{% endfor %}</div><p class="small text-secondary">{{ p.inputs|length }} declared input(s) &middot; {% if p.available is none %}Select a customer to check availability{% elif p.available %}Playbook file present{% else %}Playbook file missing{% endif %}</p>{% if p.result %}<p class="small">Report: <code>{{ p.result.schema }}</code> &middot; {{ 'required' if p.result.required else 'optional' }}</p>{% else %}<p class="small text-secondary">No structured report declared.</p>{% endif %}<a href="/plan?playbook={{ p.key|urlencode }}{% if customer %}&amp;customer={{ customer|urlencode }}{% endif %}" class="btn btn-outline-primary">Review operation &rarr;</a></div></section></div>{% endfor %}</div>{% endblock %}
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/pages/preflight.html b/scripts/addons/webgui/src/aim_webgui/templates/pages/preflight.html
new file mode 100644
index 0000000..5da5bd3
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/pages/preflight.html
@@ -0,0 +1 @@
+{% extends 'layouts/base.html' %}{% block content %}{% include 'partials/preflight.html' %}{% endblock %}
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/pages/progress.html b/scripts/addons/webgui/src/aim_webgui/templates/pages/progress.html
new file mode 100644
index 0000000..86c8021
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/pages/progress.html
@@ -0,0 +1,7 @@
+{% extends 'layouts/base.html' %}{% block content %}
+<nav class="context-links"><a href="/jobs/{{ job.id }}#job-progress">&larr; Job detail</a><a href="/jobs/{{ job.id }}/reports">Reports</a></nav>
+<p class="coverage-note">{{ job.plan.customer }} &middot; {{ job.plan.playbook }} &middot; {{ job.mode|upper }}. Chronological retained metadata, not raw console output.</p>
+{% if progress.omitted_events or progress.dropped_events or progress.capture_interrupted %}<p class="alert alert-warning">Coverage is incomplete: {{ progress.omitted_events }} older events omitted; {{ progress.dropped_events }} capture drops. {% if progress.capture_interrupted %}The last uncommitted batch may be absent.{% endif %}</p>{% endif %}
+<section class="card"><div class="card-body"><ol class="journal-timeline">{% for row in progress.events %}<li><time datetime="{{ row.event.timestamp }}" data-evidence-time>{{ row.event.timestamp }}</time><pre>{{ row.text }}</pre></li>{% else %}<li>{{ progress.message|default('No recorded events in this page.') }}</li>{% endfor %}</ol></div></section>
+<nav class="pagination-controls">{% if progress.has_older and progress.events %}<a class="btn btn-outline-secondary" href="?before={{ progress.events[0].cursor }}">Earlier 200 events</a>{% endif %}<a class="btn btn-outline-secondary" href="/jobs/{{ job.id }}/progress">Latest metadata</a></nav>
+{% endblock %}
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/pages/report.html b/scripts/addons/webgui/src/aim_webgui/templates/pages/report.html
new file mode 100644
index 0000000..cfdd5a3
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/pages/report.html
@@ -0,0 +1,31 @@
+{% extends 'layouts/base.html' %}{% block subtitle %}<p class="text-secondary">{{ job.plan.customer }} &middot; {{ item.slot or 'Global report' }} &middot; <strong>{{ 'CHECK' if item.check_mode else 'APPLY' }}</strong></p>{% endblock %}
+{% block content %}
+<nav class="job-view-nav" aria-label="Job sections"><a href="/jobs/{{ job.id }}#job-status">Summary</a><a href="/jobs/{{ job.id }}#job-progress">Progress</a><a href="/jobs/{{ job.id }}#job-targets">Targets</a><a href="/jobs/{{ job.id }}#job-reports" aria-current="page">Reports</a></nav>
+<section class="card"><div class="card-body p-4"><div class="section-heading"><div><p class="eyebrow">RECORDED OBSERVATION</p><h2 class="h4">{{ item.title }}</h2></div><span class="report-availability report-{{ item.status }}">{{ item.status|replace('_',' ') }}</span></div>
+<p class="coverage-note">Recorded <time class="js-local-time" datetime="{{ item.recorded_at|utc_iso }}">{{ item.recorded_at|utc }}</time> &middot; Job {{ job.id[:12] }} &middot; <code>{{ item.schema_id }}</code></p>
+<p class="report-semantic-note">{{ item.note }}</p>
+<dl class="system-facts"><dt>Core execution</dt><dd>{{ job.core_result.status }} / {{ job.core_result.stage }} / exit {{ job.core_result.exit_code if job.core_result.exit_code is not none else 'not supplied' }}</dd><dt>Report slots complete</dt><dd>{{ 'Yes' if item.complete else 'No' }} &mdash; this is availability, not execution success.</dd><dt>Local retention</dt><dd>{{ item.retention|replace('_',' ') }}</dd></dl>
+{% if item.check_mode %}<p class="alert alert-info">Check-mode report. Observations/predicted changes must not be presented as completed installation, patching, export or deletion.</p>{% endif %}
+<form method="get" class="report-host-select"><label for="report-host">Report host</label><select name="host" id="report-host" class="form-select">{% for slot in reports.slots %}<option value="{{ slot.slot }}" {% if slot.slot==item.slot %}selected{% endif %}>{{ slot.slot or 'Global report' }} &middot; {{ slot.status }}</option>{% endfor %}</select><button class="btn btn-outline-primary">Open</button></form>
+</div></section>
+{% if item.status != 'available' %}<section class="note mt-3"><h3 class="h5">Report {{ item.status|replace('_',' ') }}</h3><p>Core did not supply usable data for this slot. This is not an empty report, a negative detection result or proof that nothing happened.</p>{% if item.error %}<code>{{ item.error }}</code>{% endif %}</section>
+{% elif item.retention=='not_retained_limit' %}<p class="alert alert-warning mt-3">Core supplied an available report, but its content was not retained under the WebGUI byte budget. No truncated payload is presented as complete.</p>
+{% else %}
+{% if item.retention=='metadata_only' %}<p class="alert alert-warning mt-3">Core report available; full configuration sections were not retained by WebGUI policy. Only file and redaction metadata are shown. Enabling retention later cannot restore omitted content.</p>{% endif %}
+{% if view.patch %}{% include 'partials/patch_report.html' %}{% endif %}
+<section class="card mt-3 report-data"><div class="card-body p-4"><h3 class="h5">{{ 'Retained metadata' if item.retention=='metadata_only' else 'Report summary' }}</h3><p class="coverage-note">Sections show 50 entries per page and at most 40 columns. Long nested cells are marked when shortened; the retained JSON contains the full stored data.</p>
+{% if view.generic %}<p class="coverage-note">Generic renderer for a supported declared schema. No private Core parsing or custom executable renderer is used.</p>{% endif %}
+{% if view.facts %}<dl class="report-facts {% if item.schema_id=='host_capabilities_v1' %}capability-grid{% endif %}">{% for fact in view.facts %}<div><dt>{{ fact.title }}</dt><dd class="{% if fact.value is sameas true %}fact-yes{% elif fact.value is sameas false %}fact-no{% endif %}">{{ fact.value|report_cell }}</dd></div>{% endfor %}</dl>{% endif %}
+{% if view.is_scalar %}<pre class="code-panel">{{ view.scalar|report_cell }}</pre>{% endif %}
+</div></section>
+{% for section in view.sections %}<section class="card mt-3 report-section" id="report-{{ section.key }}"><div class="card-header"><h3 class="h6 mb-1">{{ section.title }}</h3><span class="coverage-note">{% if section.suppressed %}Final pending list not established{% else %}{{ section.total }} entries &middot; page {{ section.page }} / {{ section.pages }}{% endif %}</span></div>
+{% if section.note %}<p class="coverage-note px-3 pt-3">{{ section.note }}</p>{% endif %}
+{% if section.suppressed %}<p class="empty-state">{{ section.empty_text }}</p>
+{% elif section.kind=='object' %}<div class="report-key-values">{% for name,val in section.rows %}<div><strong>{{ name }}</strong><pre>{{ val|report_cell }}</pre></div>{% else %}<p class="empty-state">No entries reported.</p>{% endfor %}</div>
+{% elif section.headers %}<div class="table-responsive"><table class="table table-sm report-table mb-0"><thead><tr>{% for key in section.headers %}<th>{{ key|report_label }}</th>{% endfor %}</tr></thead><tbody>{% for row in section.rows %}<tr>{% for key in section.headers %}<td>{{ row.get(key)|report_cell }}</td>{% endfor %}</tr>{% endfor %}</tbody></table></div>
+{% else %}<ul class="report-values">{% for val in section.rows %}<li>{{ val|report_cell }}</li>{% else %}<li>{{ section.empty_text or 'No entries reported.' }}</li>{% endfor %}</ul>{% endif %}
+{% if section.previous or section.next %}<nav class="pagination-controls px-3" aria-label="{{ section.title }} pages">{% if section.previous %}<a class="btn btn-sm btn-outline-secondary" href="{{ section.previous }}">Previous 50</a>{% endif %}{% if section.next %}<a class="btn btn-sm btn-outline-secondary" href="{{ section.next }}">Next 50</a>{% endif %}</nav>{% endif %}
+</section>{% endfor %}
+<section class="card mt-3"><div class="card-body"><details data-report-json="{{ json_url }}"><summary>Show {{ 'retained metadata' if item.retention=='metadata_only' else 'report' }} JSON</summary><p class="coverage-note">Loaded on demand from this authorized job. No output is placed in browser storage.</p><button type="button" class="btn btn-sm btn-outline-secondary" data-json-copy disabled>Copy JSON</button><span role="status" data-json-status></span><pre class="code-panel report-json" data-json-output tabindex="0">Open to load retained JSON.</pre></details><noscript><a href="{{ json_url }}">Open authenticated JSON</a></noscript></div></section>
+{% endif %}
+{% endblock %}
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/pages/setup.html b/scripts/addons/webgui/src/aim_webgui/templates/pages/setup.html
new file mode 100644
index 0000000..fc90f09
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/pages/setup.html
@@ -0,0 +1,13 @@
+{% extends 'layouts/base.html' %}{% block content %}
+<div class="note mb-4">Keep recovery access until the named account has signed in successfully. No AIM or operating-system accounts are created here.</div>
+<div class="workflow-grid">
+<section class="card"><div class="card-body p-4"><p class="eyebrow">01 / CREATE</p><h2 class="h4">Create your named administrator</h2><p class="text-secondary">Choose a personal username and a temporary passphrase. First login requires a password change.</p>
+<form action="/setup" method="post"><input type="hidden" name="_csrf" value="{{ csrf }}"><input type="hidden" name="action" value="create">
+<label class="form-label" for="setup-name">Personal username</label><input id="setup-name" name="username" class="form-control mb-3" pattern="[a-z][a-z0-9._-]{2,63}" required autocomplete="off">
+<label class="form-label" for="setup-password">Temporary passphrase (15-128 characters)</label><input id="setup-password" type="password" name="password" class="form-control mb-3" minlength="15" maxlength="128" autocomplete="new-password" required>
+<label class="form-label" for="setup-confirm">Confirm temporary passphrase</label><input id="setup-confirm" type="password" name="confirm" class="form-control mb-3" minlength="15" maxlength="128" autocomplete="new-password" required>
+<button class="btn btn-primary" type="submit">Create named administrator</button></form></div></section>
+<section class="card"><div class="card-body p-4"><p class="eyebrow">02 / VERIFY &amp; RETIRE</p><h2 class="h4">Retire the bootstrap account</h2><p>Sign out, sign in with your new account, replace its temporary password, then return here.</p><p>Only a named administrator with a permanent password can disable the bootstrap account. Existing bootstrap sessions are revoked.</p>
+<form action="/setup" method="post"><input type="hidden" name="_csrf" value="{{ csrf }}"><input type="hidden" name="action" value="retire"><button class="btn btn-outline-primary" type="submit" {% if session.username == 'admin' or not setup.ready %}disabled{% endif %}>Disable bootstrap admin</button></form>
+<p class="form-text mt-3">Local recovery remains available through <code>aim-web user</code> under the service identity.</p></div></section></div>
+{% endblock %}
\ No newline at end of file
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/pages/system.html b/scripts/addons/webgui/src/aim_webgui/templates/pages/system.html
new file mode 100644
index 0000000..a47090f
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/pages/system.html
@@ -0,0 +1,5 @@
+{% extends 'layouts/base.html' %}{% block content %}
+<section class="card"><div class="card-body p-4"><h2 class="h4">Controller readiness</h2><dl class="system-facts">
+<dt>WebGUI</dt><dd>{{ system.version }}</dd><dt>AIM compatibility</dt><dd>{{ system.aim_compatibility|join(', ') }}</dd><dt>Schema</dt><dd>{{ system.schema }}</dd><dt>Listener</dt><dd>{{ system.listener }}</dd><dt>Public origin</dt><dd>{{ system.public_url }}</dd><dt>Trusted proxies</dt><dd>{{ system.trusted_proxies|join(', ') or 'None' }}</dd><dt>Execution</dt><dd>{{ 'Opt-in enabled' if system.execution_enabled else 'Disabled' }}</dd><dt>Runtime</dt><dd class="text-break">{{ system.runtime }}</dd></dl>
+<ul class="event-list">{% for check in system.checks %}<li><strong>{{ 'PASS' if check.ok else 'CHECK' }} / {{ check.name }}</strong><div class="text-secondary">{{ check.detail }}</div></li>{% endfor %}</ul>
+<div class="note">{{ system.transport_note }}</div></div></section>{% endblock %}
\ No newline at end of file
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/pages/users.html b/scripts/addons/webgui/src/aim_webgui/templates/pages/users.html
new file mode 100644
index 0000000..9d5275e
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/pages/users.html
@@ -0,0 +1,10 @@
+{% extends 'layouts/base.html' %}
+{% block subtitle %}<p class="text-secondary">These accounts grant WebGUI access only. Both roles can read all AIM customers and prepare selections; administrators can also manage WebGUI accounts.</p>{% endblock %}
+{% block content %}
+<section class="card mb-4"><div class="card-header"><h2 class="h5 mb-0">Local accounts</h2><span class="text-secondary small">{{ users|length }} accounts</span></div><div class="table-responsive"><table class="table align-middle"><thead><tr><th>Account</th><th>Role</th><th>Status</th><th>Actions</th></tr></thead><tbody>
+{% for u in users %}<tr><td class="entity-name">{{ u.username }}</td><td>{{ u.role }}</td><td><span class="badge {{ 'badge-success' if u.enabled else 'badge-neutral' }}">{{ 'Enabled' if u.enabled else 'Disabled' }}</span>{% if u.must_change_password %}<span class="badge badge-warning">Password change required</span>{% endif %}</td><td><form action="/users/{{ u.username|urlencode }}" method="post" class="d-flex flex-wrap gap-2"><input type="hidden" name="_csrf" value="{{ csrf }}"><button class="btn btn-sm btn-outline-secondary" name="action" value="{{ 'disable' if u.enabled else 'enable' }}">{{ 'Disable' if u.enabled else 'Enable' }}</button><button class="btn btn-sm btn-outline-secondary" name="action" value="{{ 'demote' if u.role == 'admin' else 'promote' }}">{{ 'Make viewer' if u.role == 'admin' else 'Make admin' }}</button><button class="btn btn-sm btn-outline-secondary" name="action" value="revoke">Revoke sessions</button></form><details class="mt-2"><summary class="small">Reset password</summary><form action="/users/{{ u.username|urlencode }}" method="post" class="reset-form mt-2"><input type="hidden" name="_csrf" value="{{ csrf }}"><input type="hidden" name="action" value="reset-password"><label class="form-label" for="reset-{{ u.id }}">New temporary password</label><input class="form-control mb-2" id="reset-{{ u.id }}" type="password" name="password" minlength="15" maxlength="128" autocomplete="new-password" required><label class="form-label" for="reset-confirm-{{ u.id }}">Confirm temporary password</label><input class="form-control mb-2" id="reset-confirm-{{ u.id }}" type="password" name="confirm" minlength="15" maxlength="128" autocomplete="new-password" required><button type="submit" class="btn btn-sm btn-outline-primary">Reset &amp; revoke sessions</button></form></details></td></tr>{% endfor %}
+</tbody></table></div></section>
+<section class="card"><div class="card-header"><h2 class="h5 mb-0">Add account</h2></div><div class="card-body p-4"><form action="/users" method="post" class="row g-3"><input type="hidden" name="_csrf" value="{{ csrf }}"><div class="col-md-6"><label class="form-label" for="new-user">Username</label><input class="form-control" id="new-user" name="username" minlength="3" maxlength="64" autocomplete="off" required></div><div class="col-md-6"><label class="form-label" for="role">Role</label><select class="form-select" name="role" id="role"><option value="viewer">Viewer</option><option value="admin">Administrator</option></select></div><div class="col-md-6"><label class="form-label" for="temporary">Temporary password</label><input class="form-control" id="temporary" type="password" name="password" minlength="15" maxlength="128" autocomplete="new-password" required></div><div class="col-md-6"><label class="form-label" for="confirm">Confirm temporary password</label><input class="form-control" id="confirm" type="password" name="confirm" minlength="15" maxlength="128" autocomplete="new-password" required></div><div class="col-12"><p class="form-text">Password change is mandatory at first login. Accounts are disabled rather than deleted. The last enabled administrator is protected.</p><button type="submit" class="btn btn-primary">Create account</button></div></form></div></section>
+<section class="card mt-4"><div class="card-body p-4"><h2 class="h4">Scoped execution grants</h2><p class="text-secondary">Viewer accounts can become operators for explicit customer/playbook pairs. Reading remains controller-wide. Only administrators approve jobs; an administrator cannot approve their own request.</p>
+<form action="/permissions" method="post"><input type="hidden" name="_csrf" value="{{ csrf }}"><div id="grant-fields">{% include 'partials/grant_fields.html' %}</div></form>
+<ul class="event-list">{% for g in grants %}<li>{{ g.username }} / {{ g.customer }} / {{ g.playbook }}<form action="/permissions" method="post"><input type="hidden" name="_csrf" value="{{ csrf }}"><input type="hidden" name="user_id" value="{{ g.user_id }}"><input type="hidden" name="customer" value="{{ g.customer }}"><input type="hidden" name="playbook" value="{{ g.playbook }}"><button class="btn btn-sm btn-outline-secondary" name="action" value="revoke">Revoke</button></form></li>{% else %}<li>No scoped grants. Administrators remain subject to the controller allowlist and approval policy.</li>{% endfor %}</ul></div></section>{% endblock %}
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/partials/activity_macros.html b/scripts/addons/webgui/src/aim_webgui/templates/partials/activity_macros.html
new file mode 100644
index 0000000..a5bdf54
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/partials/activity_macros.html
@@ -0,0 +1,35 @@
+{% macro stamp(value) %}{% if value is not none %}<time class="js-local-time" datetime="{{ value|utc_iso }}">{{ value|utc }}</time>{% else %}<span>No record</span>{% endif %}{% endmacro %}
+{% macro outcome(value,labels) %}<span class="status-tag target-status-{{ value }}"><span class="status-dot-mini" aria-hidden="true"></span>{{ labels.get(value,value|replace('_',' ')) }}</span>{% endmacro %}
+{% macro filters(data,labels,action,host='') %}
+<form class="history-filters" action="{{ action }}" method="get" aria-label="Filter retained WebGUI history">
+{% if host %}<input type="hidden" name="host" value="{{ host }}">{% else %}<label>Customer<input class="form-control" name="customer" value="{{ data.filters.customer }}" placeholder="All visible customers" maxlength="255"></label>{% endif %}
+<label>Playbook<input class="form-control" name="playbook" list="history-books" value="{{ data.filters.playbook }}" placeholder="All recorded playbooks" maxlength="255"></label>
+<datalist id="history-books">{% for book in data.playbooks %}<option value="{{ book }}">{% endfor %}</datalist>
+<label>Mode<select class="form-select" name="mode">{% for val,label in [('apply','Apply runs'),('check','Check runs'),('all','Apply + check')] %}<option value="{{ val }}" {% if val == data.filters.mode %}selected{% endif %}>{{ label }}</option>{% endfor %}</select></label>
+<label>Time range<select class="form-select" name="days">{% for val,label in [('7','Last 7 days'),('30','Last 30 days'),('90','Last 90 days'),('365','Last 365 days'),('all','All retained history')] %}<option value="{{ val }}" {% if val == data.filters.days %}selected{% endif %}>{{ label }}</option>{% endfor %}</select></label>
+<label>Target outcome<select class="form-select" name="outcome"><option value="">All outcomes</option>{% for val,label in labels.items() %}<option value="{{ val }}" {% if val == data.filters.outcome %}selected{% endif %}>{{ label }}</option>{% endfor %}</select></label>
+{% if not host %}<label>Host search<input class="form-control" type="search" name="q" value="{{ data.filters.q }}" placeholder="Logical hostname" maxlength="255"></label>{% endif %}
+<button class="btn btn-outline-primary" type="submit">Apply filters</button>
+</form>{% endmacro %}
+{% macro summary(data,labels) %}
+<div class="insight-metrics">
+<section class="card"><span class="eyebrow">RETAINED WEBGUI RUNS</span><strong>{{ data.jobs }}</strong><span>Visible jobs in this filter</span></section>
+<section class="card"><span class="eyebrow">TARGET OUTCOMES</span><strong>{{ data.samples }}</strong><span>One host per job = one sample</span></section>
+<section class="card"><span class="eyebrow">SUCCESSFUL / KNOWN</span><strong>{{ data.success_percent|string + '%' if data.success_percent is not none else 'No samples' }}</strong><span>{{ data.counts.successful }} / {{ data.eligible }} succeeded, failed or unreachable</span></section>
+</div>
+<section class="card distribution-card" aria-label="Outcome distribution">
+<div class="section-heading"><div><h2 class="h6">Recorded outcomes</h2><p class="small text-secondary mb-2">Not a live health or compliance measurement.</p></div><span class="mode-tag">{{ data.filters.mode }}</span></div>
+{% if data.samples %}<svg class="outcome-bar" viewBox="0 0 1000 18" preserveAspectRatio="none" role="img" aria-label="{{ data.counts.successful }} succeeded, {{ data.counts.failed }} failed, {{ data.counts.unreachable }} unreachable, {{ data.counts.not_started }} not started, {{ data.counts.indeterminate }} indeterminate, {{ data.counts.unavailable }} unavailable, {{ data.counts.outstanding }} not finished">
+{% set pos=namespace(x=0) %}{% for val,num in data.counts.items() %}{% if num %}{% set width=num*1000/data.samples %}<rect class="chart-{{ val }}" x="{{ pos.x }}" y="0" width="{{ width }}" height="18"/><title>{{ labels[val] }}: {{ num }}</title>{% set pos.x=pos.x+width %}{% endif %}{% endfor %}</svg>{% endif %}
+<div class="outcome-legend">{% for val,num in data.counts.items() %}<span><i class="legend-dot chart-{{ val }}" aria-hidden="true"></i>{{ labels[val] }} <strong>{{ num }}</strong></span>{% endfor %}</div>
+<p class="coverage-note">{{ data.changed_participations }} host/run samples reported changed tasks. Unknown, not-started, unavailable and unfinished samples are excluded from the success-rate denominator.</p>
+</section>
+{% endmacro %}
+{% macro records(data,labels) %}
+<div class="history-list">{% for r in data.records %}
+<article class="history-item">
+  <div class="history-item-main"><a class="operation-link" href="/jobs/{{ r.job_id }}">{{ r.playbook|replace('_',' ') }}</a><div class="row-meta">Job {{ r.job_id[:12] }} &middot; {{ r.username }} &middot; <span class="mode-tag">{{ r.mode }}</span></div><div class="small text-secondary">{{ stamp(r.recorded_at) }}{% if r.finished_at is none %} &middot; creation time{% endif %}</div></div>
+  <div class="history-item-result">{{ outcome(r.outcome,labels) }}<span class="small text-secondary">Whole job: {{ r.job_display_status|replace('_',' ') }}</span></div>
+  {% if r.counts is not none %}<details class="counter-details"><summary>Target task counters</summary><dl class="counter-grid">{% for k,n in r.counts.items() %}<div><dt>{{ k }}</dt><dd>{{ n }}</dd></div>{% endfor %}</dl></details>{% else %}<p class="small text-secondary mb-0">{{ 'This job has not finished.' if r.outcome == 'outstanding' else 'No authoritative per-target result is retained for this record.' }}</p>{% endif %}
+</article>{% else %}<div class="empty-state"><h3 class="h6">No retained runs match</h3><p>Try a wider time range or another mode. Terminal AIM runs and deleted jobs are not collected.</p></div>{% endfor %}</div>
+{% endmacro %}
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/partials/attention.html b/scripts/addons/webgui/src/aim_webgui/templates/partials/attention.html
new file mode 100644
index 0000000..9ad9de2
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/partials/attention.html
@@ -0,0 +1,8 @@
+<section id="attention" class="attention-section" hx-get="/_partials/attention{% if attention_expanded %}?all_items=true{% endif %}" hx-trigger="every 5s" hx-swap="outerHTML" aria-labelledby="attention-title">
+  <div class="section-heading"><div><h2 class="h5 mb-1" id="attention-title">Needs your attention</h2><p class="form-text mb-0">{{ attention.credentials }} awaiting your credentials{% if attention.approvals %} &middot; {{ attention.approvals }} awaiting your review{% endif %}</p></div>{% if attention.total %}<span class="attention-count">{{ attention.total }}</span>{% endif %}</div>
+  {% if attention['items'] %}<div class="attention-items">{% for item in attention['items'] %}
+    <article class="attention-item"><div><span class="status-tag status-waiting_credentials">{{ 'Credentials needed' if item.kind == 'credentials' else 'Review requested' }}</span><strong>{{ item.playbook|replace('_',' ') }}</strong><p>{{ item.customer }} &middot; {{ item.target_count }} {{ 'host' if item.target_count == 1 else 'hosts' }} &middot; {{ item.mode }}{% if item.kind == 'approval' %} &middot; {{ item.username }}{% endif %}</p>{% if item.deadline %}<small>Reservation ends <time class="js-local-time" datetime="{{ item.deadline|utc_iso }}">{{ item.deadline|utc }}</time></small>{% endif %}</div>
+    {% if item.kind == 'credentials' %}<a class="btn btn-primary btn-sm" href="/jobs/{{ item.id }}/credentials" data-credential-open data-job-id="{{ item.id }}">Unlock run</a>{% else %}<a class="btn btn-outline-primary btn-sm" href="/jobs/{{ item.id }}">Review job</a>{% endif %}</article>
+  {% endfor %}</div>{% else %}<p class="attention-empty">No jobs are waiting for your input. Submitted jobs continue normally.</p>{% endif %}
+  {% if attention.total > attention.shown %}<p class="form-text">Showing {{ attention.shown }} of {{ attention.total }} actionable jobs. <a href="/jobs#attention">Open Jobs</a> to review the remainder.</p>{% endif %}
+</section>
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/partials/credential_dialog.html b/scripts/addons/webgui/src/aim_webgui/templates/partials/credential_dialog.html
new file mode 100644
index 0000000..98f1b72
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/partials/credential_dialog.html
@@ -0,0 +1,4 @@
+<dialog class="credential-dialog" id="credential-dialog" aria-labelledby="credential-dialog-title" aria-describedby="credential-dialog-description" data-credential-dialog hx-history="false">
+  <header class="credential-dialog-header"><div><p class="eyebrow">ONE-RUN ACCESS</p><h2 id="credential-dialog-title" tabindex="-1" data-credential-title>Unlock this run</h2><p id="credential-dialog-description">Credentials for the reviewed job only.</p></div><button class="credential-close btn btn-outline-secondary" type="button" data-credential-close aria-label="Close credential dialog">&times;</button></header>
+  <div class="credential-dialog-body" data-credential-dialog-body></div>
+</dialog>
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/partials/credential_panel.html b/scripts/addons/webgui/src/aim_webgui/templates/partials/credential_panel.html
new file mode 100644
index 0000000..2aba32a
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/partials/credential_panel.html
@@ -0,0 +1,48 @@
+{% macro secret_field(name, label, hint, required, suffix) %}
+<div class="credential-field">
+  <label class="form-label" for="credential-{{ suffix }}">{{ label }} <span class="field-requirement">{{ 'Required' if required else 'Optional' }}</span></label>
+  <div class="credential-input-row">
+    <input class="form-control" type="password" id="credential-{{ suffix }}" name="{{ name }}" maxlength="2048" {% if required %}required{% endif %} autocomplete="off" spellcheck="false" autocapitalize="none" data-credential-secret aria-describedby="credential-{{ suffix }}-hint credential-{{ suffix }}-caps">
+    <button class="btn btn-outline-secondary credential-reveal" type="button" data-credential-reveal aria-controls="credential-{{ suffix }}" aria-pressed="false" aria-label="Show {{ label|lower }}" hidden>Show</button>
+  </div>
+  <p class="form-text mb-0" id="credential-{{ suffix }}-hint">{{ hint }}</p>
+  <p class="credential-caps" id="credential-{{ suffix }}-caps" data-credential-caps role="status" hidden>Caps Lock is on.</p>
+</div>
+{% endmacro %}
+<section class="credential-panel" data-credential-panel data-job-id="{{ job.id }}" data-server-now="{{ credential_server_now }}" data-deadline="{{ job.credential_deadline }}" hx-history="false">
+  <div class="credential-scope">
+    <span class="credential-scope-symbol" aria-hidden="true"><svg viewBox="0 0 24 24" width="24" height="24"><path d="M7 10V7a5 5 0 0 1 10 0v3M5 10h14v11H5zM12 14v3"/></svg></span>
+    <div><strong>{{ job.plan.playbook|replace('_', ' ')|capitalize }}</strong><span>{{ job.plan.customer }} <span aria-hidden="true">&middot;</span> {{ job.plan.targets|length }} {{ 'host' if job.plan.targets|length == 1 else 'hosts' }} <span aria-hidden="true">&middot;</span> <span class="mode-tag">{{ job.mode }}</span></span></div>
+  </div>
+  <div class="credential-reservation"><span class="status-tag status-waiting_credentials">Awaiting credentials</span><span data-credential-countdown role="timer" aria-label="Reservation time remaining" aria-live="off">Until <time class="js-local-time" datetime="{{ job.credential_deadline|utc_iso }}">{{ job.credential_deadline|utc }}</time></span></div>
+  <p class="credential-intro">Your reviewed scope and options stay unchanged.</p>
+  <div class="credential-feedback" data-credential-feedback role="status" aria-live="polite" tabindex="-1" hidden></div>
+  <form action="/jobs/{{ job.id }}/credentials" method="post" data-secret-form data-credential-form autocomplete="off">
+    <input type="hidden" name="_csrf" value="{{ csrf }}">
+    <fieldset class="credential-inputs" data-credential-inputs><legend class="visually-hidden">One-run credentials</legend>
+      {% if has_vault %}{{ secret_field('vault_password', 'Customer Vault password', 'Unlock the Vault for this customer. This is not your AIM Web sign-in password.', true, 'vault') }}{% endif %}
+      {% if has_connection %}{{ secret_field('connection_password', 'Default connection password', 'Requested by Core. Inventory-defined credentials take precedence; this is not a forced override.', true, 'connection') }}{% endif %}
+      {% if has_key %}
+      <fieldset class="credential-key-source"><legend>SSH key passphrase</legend>
+        {% if key_from_vault %}
+        <div class="credential-source-choice" data-key-source-choice hidden>
+          <div class="btn-group credential-segments" role="group" aria-label="SSH key passphrase source">
+            <input class="btn-check" type="radio" name="_key_source" id="credential-key-vault" value="vault" checked disabled autocomplete="off"><label class="btn btn-outline-secondary" for="credential-key-vault">Use customer Vault</label>
+            <input class="btn-check" type="radio" name="_key_source" id="credential-key-separate" value="separate" disabled autocomplete="off"><label class="btn btn-outline-secondary" for="credential-key-separate">Enter separately</label>
+          </div>
+          <p class="form-text" data-key-source-explanation>Uses the Vault's stored key passphrase, checked after submission.</p>
+        </div>
+        {% endif %}
+        <div data-key-passphrase-field data-optional-in-vault="{{ 'true' if key_from_vault else 'false' }}">{{ secret_field('ssh_key_passphrase', 'Separate SSH key passphrase', 'Leave blank to use the customer Vault value.' if key_from_vault else 'Unlock the encrypted customer private key for this run.', not key_from_vault, 'key') }}</div>
+      </fieldset>
+      {% endif %}
+    </fieldset>
+    <details class="credential-explanation"><summary>How credentials are used</summary><p>Used only for this job. AIM Web does not save passwords in plans, history or browser storage. Core performs Vault/key validation after the handoff; submission alone does not verify authentication.</p><p>Leaving this form does not cancel the job or extend its reservation. A submitted run continues independently.</p><p class="row-meta">Job {{ job.id[:12] }} &middot; {{ job.plan.targets|join(', ') }}</p></details>
+    <p class="credential-privacy"><span aria-hidden="true">&#9671;</span> One run only. Not saved by AIM Web.</p>
+    <div class="credential-submit-row">
+      <button class="btn btn-primary" type="submit" data-credential-submit>Submit credentials and continue</button>
+      <a class="btn btn-outline-secondary" href="/jobs/{{ job.id }}" data-credential-dismiss>Not now</a>
+    </div>
+    <p class="form-text credential-submit-note" data-credential-submit-note>Core validates the credentials next. No automatic retry.</p>
+  </form>
+</section>
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/partials/customers.html b/scripts/addons/webgui/src/aim_webgui/templates/partials/customers.html
new file mode 100644
index 0000000..146027a
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/partials/customers.html
@@ -0,0 +1,4 @@
+<div class="table-responsive"><table class="table align-middle mb-0"><thead><tr><th scope="col">Customer</th><th scope="col">Hosts</th><th scope="col">Inventory</th><th scope="col"><span class="visually-hidden">Action</span></th></tr></thead><tbody>
+{% for c in customers %}<tr><td><a class="entity-link" href="{{ explorer_url(c.name) }}">{{ c.name }}</a></td><td>{{ c.host_count if c.host_count is not none else '-' }}</td><td><span class="badge {% if c.status == 'Readable' %}badge-success{% else %}badge-warning{% endif %}">{{ c.status }}</span></td><td class="text-end"><a href="/plan?customer={{ c.name|urlencode }}">New run &rarr;</a></td></tr>
+{% else %}<tr><td colspan="4"><div class="empty-state"><h3 class="h6">No customers found</h3><p>Create or restore customer inventories using the existing AIM terminal application.</p></div></td></tr>{% endfor %}
+</tbody></table></div>
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/partials/error.html b/scripts/addons/webgui/src/aim_webgui/templates/partials/error.html
new file mode 100644
index 0000000..9e63428
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/partials/error.html
@@ -0,0 +1 @@
+<div class="alert alert-danger" role="alert">{{ error }}</div>
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/partials/grant_fields.html b/scripts/addons/webgui/src/aim_webgui/templates/partials/grant_fields.html
new file mode 100644
index 0000000..dbc3fd1
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/partials/grant_fields.html
@@ -0,0 +1,23 @@
+<div class="row g-3">
+  <label class="col-md-4" for="grant-account">Account
+    <select id="grant-account" name="user_id" class="form-select" required
+            hx-get="/_partials/grant-fields" hx-trigger="change" hx-target="#grant-fields" hx-swap="innerHTML"
+            hx-include="#grant-account,#grant-customer">
+      {% for u in users %}<option value="{{ u.id }}"{% if u.id == selected_user_id %} selected{% endif %}>{{ u.username }}</option>{% endfor %}
+    </select>
+  </label>
+  <label class="col-md-4" for="grant-customer">Customer
+    <select id="grant-customer" name="customer" class="form-select" required
+            hx-get="/_partials/grant-fields" hx-trigger="change" hx-target="#grant-fields" hx-swap="innerHTML"
+            hx-include="#grant-account,#grant-customer">
+      {% for c in customers %}<option value="{{ c.name }}"{% if c.name == selected_customer %} selected{% endif %}>{{ c.name }}</option>{% endfor %}
+    </select>
+  </label>
+  <label class="col-md-4" for="grant-playbook">Playbook
+    <select id="grant-playbook" name="playbook" class="form-select" required{% if not available_playbooks %} disabled{% endif %}>
+      {% for p in available_playbooks %}<option value="{{ p.key }}">{{ p.name }}</option>{% else %}<option value="">All playbooks are already granted for this account/customer.</option>{% endfor %}
+    </select>
+  </label>
+</div>
+<button class="btn btn-outline-primary mt-3" name="action" value="grant"{% if not available_playbooks %} disabled{% endif %}>Grant execution scope</button>
+{% if not available_playbooks %}<p class="form-text mb-0 mt-2">Revoke an existing scope below before granting it again.</p>{% endif %}
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/partials/hosts.html b/scripts/addons/webgui/src/aim_webgui/templates/partials/hosts.html
new file mode 100644
index 0000000..a814397
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/partials/hosts.html
@@ -0,0 +1,5 @@
+<div class="card-header"><span>{{ matched }} of {{ total }} hosts match</span><span class="text-secondary">Page {{ page }} of {{ pages }}</span></div><div class="table-responsive"><table class="table align-middle mb-0"><thead><tr><th scope="col">Host</th><th scope="col">Address</th><th scope="col">Memberships</th></tr></thead><tbody>
+{% for h in hosts %}<tr><td class="entity-name"><a class="entity-link" href="{{ host_url(customer,h.name) }}">{{ h.name }}</a></td><td><code>{{ h.address or '-' }}</code></td><td>{% for g in h.groups %}<span class="badge badge-neutral me-1">{{ g }}</span>{% else %}<span class="text-secondary">No group membership</span>{% endfor %}</td></tr>
+{% else %}<tr><td colspan="3" class="empty-state">No matching hosts.</td></tr>{% endfor %}
+</tbody></table></div>
+<div class="card-body workflow-actions">{% if previous_url %}<a class="btn btn-outline-secondary" href="{{ previous_url }}">Previous 100</a>{% endif %}{% if next_url %}<a class="btn btn-outline-secondary" href="{{ next_url }}">Next 100</a>{% endif %}</div>
\ No newline at end of file
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/partials/job.html b/scripts/addons/webgui/src/aim_webgui/templates/partials/job.html
new file mode 100644
index 0000000..ca82a94
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/partials/job.html
@@ -0,0 +1,15 @@
+<section id="job-status" class="card" data-job-id="{{ job.id }}" {% if job.status in ['pending','queued','running'] %}hx-get="/_partials/jobs/{{ job.id }}" hx-trigger="every 3s" hx-swap="outerHTML"{% endif %}>
+<div class="card-body p-4"><div class="section-heading"><h2 class="h4">{{ job.id[:12] }}</h2><span class="status-tag status-{{ 'waiting_credentials' if job.credential_phase == 'waiting' and job.status == 'running' else job.display_status }}"><span class="status-dot-mini" aria-hidden="true"></span>{{ 'Awaiting credentials' if job.credential_phase == 'waiting' and job.status == 'running' else job.display_status|replace('_',' ') }}</span></div><dl class="system-facts"><dt>Requester</dt><dd>{{ job.username }}</dd><dt>Customer / playbook</dt><dd>{{ job.plan.customer }} / {{ job.plan.playbook }}</dd>{% if job.plan.authentication %}<dt>Authentication</dt><dd>Native inventory{% if job.plan.core_request %} / {{ job.plan.core_request.key_mode }}{% endif %}{% if job.plan.authentication.username %} / {{ job.plan.authentication.username }}{% endif %}</dd>{% endif %}<dt>Mode</dt><dd>{{ job.mode }}</dd><dt>Targets</dt><dd>{{ job.plan.targets|length }}</dd><dt>Not before</dt><dd><time class="js-local-time" datetime="{{ job.scheduled_at|utc_iso }}">{{ job.scheduled_at|utc }}</time></dd><dt>Outcome</dt><dd>{{ job.reason or 'Waiting' }}</dd></dl>
+{% if job.core_result and job.core_result.stage == "result_validation" %}<div class="alert alert-warning">Native execution completed, but the required operation report could not be validated. Review report availability below. No automatic retry was made.</div>{% endif %}
+{% if job.core_result %}<section class="note my-3"><strong>Core result</strong><p>Status: {{ job.core_result.status }} / stage: {{ job.core_result.stage }} / exit: {{ job.core_result.exit_code if job.core_result.exit_code is not none else 'not supplied' }}</p><p>Remote work may have started: {{ 'yes' if job.core_result.remote_work_may_have_started else 'no, according to core' }}.</p>{% if job.core_result.counts %}<p>{% for name,value in job.core_result.counts.items() %}{{ name }}={{ value }} {% endfor %}</p>{% endif %}</section>
+{% if job.core_result.target_summary %}<section id="job-targets" class="target-outcomes my-3"><div class="section-heading"><div><strong>Target outcomes</strong><div class="row-meta">Core-owned final host accounting</div></div><span class="status-tag status-{{ job.display_status }}"><span class="status-dot-mini" aria-hidden="true"></span>{{ job.display_status|replace('_',' ') }}</span></div><div class="outcome-counters"><span><strong>{{ job.core_result.target_summary.successful }}</strong> successful</span><span><strong>{{ job.core_result.target_summary.failed }}</strong> failed</span><span><strong>{{ job.core_result.target_summary.unreachable }}</strong> unreachable</span><span><strong>{{ job.core_result.target_summary.not_started }}</strong> not started</span><span><strong>{{ job.core_result.target_summary.indeterminate }}</strong> indeterminate</span></div>{% if job.core_result.targets %}<div class="table-responsive mt-3"><table class="table table-sm align-middle mb-0 target-outcome-table"><thead><tr><th>Host</th><th>Outcome</th><th>Counts</th></tr></thead><tbody>{% for target in job.core_result.targets %}<tr><td class="entity-name"><a href="{{ host_url(job.plan.customer,target.host) }}">{{ target.host }}</a></td><td><span class="status-tag target-status-{{ target.outcome }}"><span class="status-dot-mini" aria-hidden="true"></span>{{ target.outcome|replace('_',' ') }}</span></td><td class="row-meta">{% for name,value in target.counts.items() %}{{ name }}={{ value }}{% if not loop.last %} · {% endif %}{% endfor %}</td></tr>{% endfor %}</tbody></table></div>{% endif %}</section>{% endif %}
+{% endif %}<details><summary>Reviewed targets and non-secret options</summary><pre class="code-panel">{{ job.plan.targets|join('
+') }}</pre><pre class="code-panel">{{ job.plan.overrides|tojson(indent=2) }}</pre></details>
+{% if job.status == 'running' and job.credential_phase == 'waiting' %}
+<div class="note my-3">This worker slot is reserved until <time class="js-local-time" datetime="{{ job.credential_deadline|utc_iso }}">{{ job.credential_deadline|utc }}</time>. No password has been stored.
+{% if job.owner_id == session.user_id %}<a class="btn btn-primary mt-2" href="/jobs/{{ job.id }}/credentials" data-credential-open data-job-id="{{ job.id }}">Unlock this run</a>{% else %}<p>The requesting account must supply credentials; approval does not grant access to their secrets.</p>{% endif %}</div>
+{% endif %}
+<ul class="event-list" aria-live="polite">{% for e in job.events %}<li><time class="js-local-time" datetime="{{ e.occurred_at|utc_iso }}">{{ e.occurred_at|utc }}</time><div>{{ e.event }}</div></li>{% endfor %}</ul><div class="workflow-actions">
+{% if job.status == 'pending' and session.role == 'admin' and session.user_id != job.owner_id %}<form action="/jobs/{{ job.id }}/approve" method="post"><input type="hidden" name="_csrf" value="{{ csrf }}"><button class="btn btn-primary">Approve reviewed job</button></form>{% endif %}
+{% if job.status in ['pending','queued','running'] %}<form action="/jobs/{{ job.id }}/cancel" method="post"><input type="hidden" name="_csrf" value="{{ csrf }}"><button class="btn btn-outline-secondary">Request cancellation</button></form>{% endif %}{% if job.status == 'failed' and job.owner_id == session.user_id %}<form action="/jobs/{{ job.id }}/retry" method="post"><input type="hidden" name="_csrf" value="{{ csrf }}"><button class="btn btn-outline-primary">Retry as new job</button></form>{% endif %}{% if job.status in ['successful','failed','canceled','timed_out','blocked','interrupted'] %}<form action="/jobs/{{ job.id }}/delete" method="post" data-confirm="Delete this finished job history? The audit deletion record remains."><input type="hidden" name="_csrf" value="{{ csrf }}"><button class="btn btn-outline-danger">Delete job history</button></form>{% endif %}</div>
+<p class="form-text mt-3">Approved progress metadata and retained operation reports stay with the job. Raw stdout/stderr and credentials are never stored. Completed remote changes are never automatically rolled back.</p></div></section>
\ No newline at end of file
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/partials/navigation.html b/scripts/addons/webgui/src/aim_webgui/templates/partials/navigation.html
new file mode 100644
index 0000000..a7cf553
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/partials/navigation.html
@@ -0,0 +1,17 @@
+{% macro links(nav, session) %}
+<nav class="nav flex-column primary-nav" aria-label="Primary navigation">
+{% for key,href,label,symbol in [('overview','/','Overview','01'),('plan','/plan','New run','02'),('jobs','/jobs','Jobs','03'),('plans','/plans','Saved plans','04'),('customers','/customers','Inventory explorer','05'),('insights','/insights','Playbook insights','06'),('playbooks','/playbooks','Playbook catalog','07')] %}
+<a class="nav-link {% if nav == key %}active{% endif %}" href="{{ href }}" {% if nav == key %}aria-current="page"{% endif %}><span class="nav-symbol" aria-hidden="true">{{ symbol }}</span>{{ label }}</a>
+{% endfor %}
+{% if session and session.role == 'admin' %}<div class="sidebar-caption">ADMINISTRATION</div>
+{% for key,href,label in [('users','/users','Users & access'),('setup','/setup','Named administrator'),('audit','/audit','Audit history'),('system','/system','System & diagnostics')] %}
+<a class="nav-link {% if nav == key %}active{% endif %}" href="{{ href }}" {% if nav == key %}aria-current="page"{% endif %}>{{ label }}</a>{% endfor %}{% endif %}
+</nav>{% endmacro %}
+{% macro theme() %}<div class="theme-control" role="group" aria-label="Display theme">
+<button class="theme-option" type="button" data-theme-option="light" aria-label="Use light mode" title="Light mode" aria-pressed="false"><span aria-hidden="true">&#9728;</span></button>
+<button class="theme-option" type="button" data-theme-option="dark" aria-label="Use dark mode" title="Dark mode" aria-pressed="false"><span aria-hidden="true">&#9790;</span></button>
+</div>{% endmacro %}
+{% macro account(session,csrf) %}{% if session and session.user_id %}
+<a href="/password" class="account-name">{{ session.username }}</a><span class="role-label">{{ session.role }}</span>
+<form action="/logout" method="post"><input type="hidden" name="_csrf" value="{{ csrf }}"><button class="btn btn-sm btn-outline-secondary" type="submit">Sign out</button></form>
+{% else %}<span class="text-secondary">Authorized operators only</span>{% endif %}{% endmacro %}
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/partials/patch_report.html b/scripts/addons/webgui/src/aim_webgui/templates/partials/patch_report.html
new file mode 100644
index 0000000..98e6f70
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/partials/patch_report.html
@@ -0,0 +1,14 @@
+<section class="card mt-3 patch-wave-panel" aria-labelledby="patch-wave-heading">
+  <div class="card-body p-4">
+    <p class="eyebrow">RECORDED PATCH POLICY AND OUTCOME</p>
+    <h3 id="patch-wave-heading" class="h5">{{ 'Windows patch wave' if view.patch.windows else 'Linux patch and reboot observations' }}</h3>
+    <p class="coverage-note">Execution status, installed-update evidence, reboot state and next-wave needs are separate facts. This report does not change the job verdict or authorize another operation.</p>
+    {% for notice in view.patch.notices %}
+    <div class="alert alert-{{ notice.tone }} patch-notice" data-patch-notice>
+      <strong>{{ notice.title }}</strong><p class="mb-0 mt-1">{{ notice.text }}</p>
+      {% if notice.code %}<code>{{ notice.code }}</code>{% endif %}
+    </div>
+    {% endfor %}
+    {% if view.patch.windows %}<p class="form-text mb-0">Core owns the sequential update queue and its reboot boundary. Reboot permission is not post-reboot continuation permission. A follow-up needs a fresh reviewed request and one-run credentials; this page never submits one.</p>{% endif %}
+  </div>
+</section>
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/partials/preflight.html b/scripts/addons/webgui/src/aim_webgui/templates/partials/preflight.html
new file mode 100644
index 0000000..c3db49c
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/partials/preflight.html
@@ -0,0 +1,25 @@
+<section class="card review-result"><div class="card-body p-4">
+<p class="eyebrow">CORE VALIDATED / REVIEW BEFORE RUNNING</p><h2 class="h4">Ready for your review</h2>
+<dl class="system-facts"><dt>Customer</dt><dd>{{ result.customer }}</dd><dt>Playbook</dt><dd>{{ result.playbook }}</dd><dt>Targets</dt><dd>{{ result.targets|length }}</dd><dt>Mode</dt><dd>{{ 'Check' if result.core_request.check else 'Apply' }}</dd><dt>SSH key handling</dt><dd>{{ result.core_request.key_mode }}</dd><dt>Credential requirements</dt><dd>{{ result.credential_requirements|join(', ') or 'None reported' }}</dd><dt>Required collections</dt><dd>{{ result.required_collections|join(', ') or 'None declared' }}</dd></dl>
+{% if result.result_contract %}<section class="note mb-3"><strong>Expected operation report</strong><p class="mb-1">{{ result.result_contract.schema }} &middot; {{ result.result_contract.scope|replace('_',' ') }} &middot; {{ 'Required' if result.result_contract.required else 'Optional' }}</p><p class="small mb-0">Reports arrive at finalization and are retained with this job. Native execution success and report availability are separate. Parsed Checkmk configuration sections require an explicit retention opt-in.</p></section>{% else %}<p class="form-text">No structured operation report is declared for this playbook.</p>{% endif %}
+{% if result.result_contract and result.result_contract.schema=='patch_summary_v1' %}
+<section class="note mb-3" aria-label="Reviewed patch-wave policy"><strong>Review patch and reboot scope</strong>
+<dl class="system-facts mt-2"><dt>Automatic reboot</dt><dd>{% if 'os_patching_reboot' in result.overrides %}{{ 'Enabled' if result.overrides.os_patching_reboot else 'Disabled' }} (explicit override){% else %}Inherited from inventory / role defaults{% endif %}</dd>
+<dt>Continue patching after reboot (Windows)</dt><dd>{% if 'os_patching_rescan_after_reboot' in result.overrides %}{{ 'Enabled' if result.overrides.os_patching_rescan_after_reboot else 'Disabled' }} (explicit override){% else %}Inherited from inventory / role defaults; not enabled by WebGUI{% endif %}</dd>
+<dt>Reboot delay (minutes)</dt><dd>{% if 'os_patching_reboot_delay_minutes' in result.overrides %}{{ result.overrides.os_patching_reboot_delay_minutes }} (explicit override){% else %}Inherited from inventory / role defaults{% endif %}</dd></dl>
+<p class="small mb-0">An enabled Windows continuation option allows Core to rediscover and install additional waves after an AIM-performed reboot, within its bounded run. It is not a new WebGUI job. With continuation disabled, a later wave requires a fresh reviewed run. Reboot permission alone does not opt in to continuation. Exact overrides, including any reboot message, follow below.</p></section>
+{% endif %}
+<details open><summary>Exact targets and options</summary><pre class="code-panel">{{ result.targets|join('
+') }}</pre><pre class="code-panel">{{ result.overrides|tojson(indent=2) }}</pre></details>
+<details><summary>Core warnings and review revision</summary><ul>{% for warning in result.warnings %}<li>{{ warning }}</li>{% endfor %}</ul><p class="small text-break">{{ result.core_revision }}</p><p class="form-text">{{ result.revision_coverage }}</p></details>
+<p class="note">Core validates the selection. Local readiness and credentials are checked when the worker claims the job. Review does not prove connectivity, authentication, or installed runtime readiness.</p>
+{% if result.review_id %}
+<form action="/jobs" method="post" class="mt-3" data-run-submit><input type="hidden" name="_csrf" value="{{ csrf }}"><input type="hidden" name="review_id" value="{{ result.review_id }}"><input type="hidden" name="submission_key" value="{{ result.review_id }}">
+<details class="mb-3"><summary>Schedule later (optional)</summary><label class="form-label mt-2" for="scheduled-at">Run once at (UTC)</label><input class="form-control" id="scheduled-at" type="datetime-local" name="scheduled_at"><p class="form-text">Leave blank for the next available slot. Maximum 30 days; credentials are collected only when the worker is ready.</p></details>
+<label class="d-flex gap-2 align-items-start my-3"><input class="form-check-input" name="confirm" type="checkbox" value="reviewed" required><span>I reviewed the explicit scope and change risk. Cancellation does not undo completed changes.</span></label>
+<button type="submit" class="btn btn-primary" {% if not execution_enabled %}disabled{% endif %}>{{ 'Submit one-run job for approval' if require_approval else 'Run once' }}</button>
+<a class="btn btn-outline-secondary" href="/plan?customer={{ result.customer|urlencode }}&amp;playbook={{ result.playbook|urlencode }}">Change selection</a>
+{% if not execution_enabled %}<p class="form-text">WebGUI execution is disabled. You may save this plan or continue in AIM terminal.</p>{% endif %}
+</form></div></section>
+<section class="card mt-3"><div class="card-body p-4"><h3 class="h5">Save as a reusable plan (optional)</h3><form action="/plans" method="post"><input type="hidden" name="_csrf" value="{{ csrf }}"><input type="hidden" name="review_id" value="{{ result.review_id }}"><label class="form-label" for="plan-name">Plan name <span class="text-secondary">Optional</span></label><div class="workflow-actions"><input id="plan-name" name="name" class="form-control" maxlength="100" placeholder="{{ result.suggested_name }}"><button class="btn btn-outline-primary" type="submit">Save plan</button></div><p class="form-text">Leave blank to generate a unique name. Existing titles in your account cannot be overwritten. Passwords are never saved.</p></form></div></section>
+{% else %}</div></section>{% endif %}
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/partials/progress.html b/scripts/addons/webgui/src/aim_webgui/templates/partials/progress.html
new file mode 100644
index 0000000..20a1f33
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/partials/progress.html
@@ -0,0 +1,21 @@
+<section id="job-progress" class="card mt-3" data-progress-journal data-job-id="{{ job.id }}" data-journal-cursor="{{ progress.cursor }}" data-journal-first="{{ progress.events[0].cursor if progress.events else 0 }}">
+<div class="card-body p-0">
+  <div class="console-toolbar"><div><p class="eyebrow mb-1">RECORDED EXECUTION METADATA</p><h2 class="h5 mb-0">Progress and timeline</h2></div>
+    <div class="console-controls"><span class="console-state" data-journal-state>{{ 'Finished' if progress.terminal else 'Following' }}</span>
+    <label class="form-check mb-0"><input class="form-check-input" type="checkbox" data-journal-follow checked> <span class="form-check-label">Follow output</span></label></div></div>
+  <div class="progress-checkpoint px-3 py-2" data-journal-checkpoint>
+    <span><strong>Stage:</strong> <span data-journal-stage>{{ progress.checkpoint.stage|default('Not observed') }}</span></span>
+    <span><strong>Most recent task:</strong> <span data-journal-task>{{ progress.checkpoint.last_task.label if progress.checkpoint.last_task else 'Not observed' }}</span></span>
+    <span><strong>Recorded task starts:</strong> <span data-journal-tasks>{{ progress.checkpoint.observed_task_starts|default(0) }}</span></span>
+    <span><strong>Last activity:</strong> <time data-journal-time datetime="{{ progress.checkpoint.last_timestamp|default('') }}">{{ progress.checkpoint.last_timestamp|default('Not observed') }}</time></span>
+  </div>
+  <p class="coverage-note px-3 mb-2">Observed metadata only, not a complete task plan or completion percentage. Multiple hosts/tasks may interleave; a quiet task is not proof of a stalled run.</p>
+  <details class="px-3 pb-2"><summary>Latest recorded host observations</summary><ul data-journal-hosts>{% for h in progress.checkpoint.hosts|default([]) %}{% if loop.index<=25 %}<li>{{ h.host }} &mdash; {{ h.observation }} ({{ h.task_id }})</li>{% endif %}{% endfor %}</ul><p class="coverage-note">Observations are not final host outcomes. The Targets section uses Core's authoritative final stats.</p></details>
+  <div data-journal-warning class="journal-warning px-3" {% if not progress.omitted_events and not progress.dropped_events and not progress.capture_interrupted %}hidden{% endif %}>
+    {% if progress.omitted_events %}{{ progress.omitted_events }} older events omitted by the retention limit. {% endif %}{% if progress.dropped_events %}{{ progress.dropped_events }} events were not recorded due to capture pressure. {% endif %}{% if progress.capture_interrupted %}Capture did not close cleanly; the last uncommitted batch may be absent.{% endif %}
+  </div>
+  <div class="px-3 pb-2"><a class="btn btn-sm btn-outline-secondary" href="/jobs/{{ job.id }}/progress" data-journal-older {% if not progress.has_older %}hidden{% endif %}>Load earlier metadata</a> <a class="small" href="/jobs/{{ job.id }}/progress">Paged timeline / no-JavaScript view</a></div>
+  <pre class="live-console journal-output" data-journal-output tabindex="0" aria-label="Recorded playbook progress">{% for row in progress.events %}{{ row.event.timestamp }}  {{ row.text }}
+{% else %}{{ progress.message|default('No progress metadata recorded yet.') }}{% endfor %}</pre>
+  <div class="console-footnote">Metadata is captured by the worker even with no open browser. Reload or another authorized device reads the committed history. Raw stdout/stderr, credentials and debug bodies are not recorded. Deleted jobs remove this journal.</div>
+</div></section>
diff --git a/scripts/addons/webgui/src/aim_webgui/templates/partials/reports.html b/scripts/addons/webgui/src/aim_webgui/templates/partials/reports.html
new file mode 100644
index 0000000..1d6e9ff
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/templates/partials/reports.html
@@ -0,0 +1,9 @@
+<section class="card mt-3" id="job-reports" {% if reports.job_status in ['pending','queued','running'] %}hx-get="/_partials/jobs/{{ reports.job }}/reports" hx-trigger="every 5s" hx-swap="outerHTML"{% endif %}>
+<div class="card-body p-4"><div class="section-heading"><div><p class="eyebrow">CORE-DECLARED OPERATION DATA</p><h2 class="h5">Reports</h2></div>{% if reports.recorded_at %}<time class="js-local-time" datetime="{{ reports.recorded_at|utc_iso }}">{{ reports.recorded_at|utc }}</time>{% endif %}</div>
+{% if not reports.recorded %}<p class="text-secondary">{% if reports.job_status in ['pending','queued','running'] %}Reports are available when Core finalizes. Progress metadata above is recorded while running.{% else %}No final operation report was captured. Historical jobs are not reconstructed or rerun.{% endif %}</p>
+{% elif not reports.declared %}<p class="text-secondary">No structured report was declared for this playbook.</p>
+{% else %}<p>{{ reports.title }} &middot; <code>{{ reports.schema }}</code> &middot; {{ 'Required' if reports.required else 'Optional' }}</p>
+<p class="coverage-note">Report availability is separate from execution success. {{ 'All declared slots are available.' if reports.complete else 'Some report slots are unavailable or incomplete.' }} All observations retain their recorded mode and date.</p>
+{% if reports.schema=='patch_summary_v1' %}<p class="report-semantic-note">A successful patch run may still need a reboot or another reviewed patch wave. Open each host report for its recorded continuation, remaining-update knowledge and failure details; nothing is scheduled automatically.</p>{% endif %}
+<div class="report-slot-list">{% for slot in reports.slots %}<a class="report-slot" href="{{ slot.url }}"><span class="entity-name">{{ slot.slot or 'Global report' }}</span><span class="report-availability report-{{ slot.status }}">{{ slot.status|replace('_',' ') }}</span><small>{{ slot.retention|replace('_',' ') }}</small><span class="report-open">View report &rarr;</span></a>{% endfor %}</div>
+{% endif %}</div></section>
diff --git a/scripts/addons/webgui/src/aim_webgui/worker.py b/scripts/addons/webgui/src/aim_webgui/worker.py
new file mode 100644
index 0000000..fc60c03
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/worker.py
@@ -0,0 +1,340 @@
+"""Single-controller, single-job worker. Never run inside an HTTP request.
+
+Credential hand-offs remain one-run and memory-only. Approved public progress
+metadata and final declared reports are retained with their job. Raw output is
+never captured; progress recording does not depend on an open browser.
+"""
+from __future__ import annotations
+
+import fcntl
+from datetime import datetime, timezone
+import json
+import os
+from pathlib import Path
+import signal
+import socket
+import resource
+import subprocess
+import sys
+import time
+
+from aim_webgui.adapters.core_v1 import CoreAdapter
+from aim_webgui.core.client import CoreClient
+import threading
+from aim_webgui.auth.service import Auth
+from aim_webgui.config import Settings
+from aim_webgui.errors import WebError
+from aim_webgui.db.store import audit, ensure_private_dir
+from aim_webgui.workflows import Workflows, allowed, event
+from aim_webgui.credentials import wire
+from aim_webgui.credentials.service import fields, valid_session, eligible, HANDOFF_SECONDS, WAIT_SECONDS
+
+
+def revalidate(flow, row):
+    plan = json.loads(row['plan'])
+    with flow.store.read() as db:
+        allowed(db, row['owner_id'], plan['customer'], plan['playbook'])
+        if flow.settings.execution_require_approval:
+            if not row['approver_id'] or row['approver_id'] == row['owner_id']:
+                raise WebError('approval_required', 'Independent administrator approval is required.', 403)
+            Auth.require_admin(db, row['approver_id'])
+    flow.execution_policy(plan)
+    current = CoreAdapter(flow.settings).reprepare(plan)
+    flow.assert_revision(plan, current)
+    if plan.get("authentication"):
+        current["authentication"] = plan["authentication"]
+    return current
+
+
+def execute_claimed(settings, ident, packet=None):
+    flow=Workflows(settings)
+    with flow.store.read() as db:
+        row=db.execute("SELECT * FROM jobs WHERE id=? AND status='running'",(ident,)).fetchone()
+    if not row or row['cancel_requested']:raise WebError('job_not_claimed','The worker no longer owns this job.',409)
+    plan=revalidate(flow,row)
+    requirements=plan['credential_requirements']
+    secrets={};deadline=None
+    if requirements:
+        if (not isinstance(packet,dict) or packet.get('job')!=ident or packet.get('user')!=row['owner_id']
+                or packet.get('deadline',0)<=time.monotonic()):
+            raise WebError('credential_expired','The one-run hand-off expired; review a new attempt.',409)
+        valid_session(flow,packet['session'],row['owner_id'])
+        secrets=fields(packet['credentials'],requirements);packet['credentials'].clear();deadline=packet['deadline']
+    from aim_webgui.journal import Capture
+    from aim_webgui.reports import persist
+    capture=Capture(settings,ident,plan['targets'])
+    cancelled=threading.Event();old_handlers={};execution_seen=False;last_stage=None
+    for sig in (signal.SIGINT,signal.SIGTERM):
+        old_handlers[sig]=signal.signal(sig,lambda *_:cancelled.set())
+    def on_event(value):
+        nonlocal execution_seen,last_stage
+        if value is None:return
+        capture.submit(value)
+        if value.get('kind')=='stage':
+            stage=value['stage']
+            if requirements and not execution_seen:valid_session(flow,packet['session'],row['owner_id'])
+            if stage=='execution':execution_seen=True
+            if stage!=last_stage:
+                with flow.store.transaction() as db:
+                    db.execute("UPDATE jobs SET credential_phase=? WHERE id=?",('executing' if execution_seen else 'preparing',ident))
+                    event(db,ident,'Core stage: '+stage+'.')
+                last_stage=stage
+    try:
+        # Last add-on authorization/revision check before native core execution.
+        with flow.store.read() as db:fresh=db.execute('SELECT * FROM jobs WHERE id=?',(ident,)).fetchone()
+        revalidate(flow,fresh)
+        if fresh['cancel_requested']:raise WebError('core_cancelled','Canceled before core execution.',409)
+        result=CoreClient(settings).request('execute',request=plan['core_request'],expected_revision=plan['core_revision'],
+                    credentials=secrets,event_sink=on_event,cancel=cancelled,deadline=deadline,
+                    result_contract=plan.get('result_contract'))
+        capture.close()
+        with flow.store.transaction() as db:
+            result=persist(db,settings,ident,plan,result)
+            db.execute('UPDATE jobs SET core_result=?,return_code=?,reason=? WHERE id=?',
+                (json.dumps(result,sort_keys=True),result.get('exit_code'),
+                 result['error']['message'] if result.get('error') else 'Core reported '+result['status']+'.',ident))
+        if result['status']!='succeeded':
+            raise WebError('core_execution_failed',result['error']['message'] if result.get('error') else 'Core execution did not succeed.',409)
+    except WebError as exc:
+        with flow.store.transaction() as db:
+            old=db.execute('SELECT core_result FROM jobs WHERE id=?',(ident,)).fetchone()
+            if old and not old[0]:
+                # An outer core error is pre-launch; transport loss is conservatively unknown.
+                known=getattr(exc,'core_error',None)
+                outcome={'status':'failed' if known else 'unknown','stage':known['stage'] if known else 'transport',
+                         'remote_work_may_have_started':execution_seen or known is None,
+                         'error':known or {'code':exc.code,'message':exc.message}}
+                db.execute('UPDATE jobs SET core_result=? WHERE id=?',(json.dumps(outcome),ident))
+        raise
+    finally:
+        secrets.clear();capture.close()
+        for sig,handler in old_handlers.items():signal.signal(sig,handler)
+
+
+def stop_group(process):
+    try:
+        os.killpg(process.pid, signal.SIGTERM)
+    except ProcessLookupError:
+        return
+    try:
+        process.wait(timeout=20)
+    except subprocess.TimeoutExpired:
+        os.killpg(process.pid, signal.SIGKILL)
+        process.wait()
+    # Kill any remaining descendants after the leader exits; no remote rollback.
+    try:
+        os.killpg(process.pid, signal.SIGKILL)
+    except ProcessLookupError:
+        pass
+
+
+class Worker:
+    def __init__(self, settings: Settings, config: Path):
+        self.settings, self.config = settings, config
+        self.flow = Workflows(settings)
+        self.stopping = False
+
+    def heartbeat(self):
+        with self.flow.store.transaction() as db:
+            db.execute("INSERT INTO metadata VALUES('worker_heartbeat',?) ON CONFLICT(key) DO UPDATE SET value=excluded.value",
+                       (str(int(time.time())),))
+
+    def finish(self, ident, status, reason, code=None):
+        with self.flow.store.transaction() as db:
+            db.execute("UPDATE jobs SET status=?,finished_at=?,return_code=?,reason=?,credential_phase='released',credential_deadline=NULL WHERE id=?",
+                       (status, int(time.time()), code, reason, ident))
+            event(db, ident, reason)
+            audit(db, 'worker', 'job-' + status, ident)
+
+    def wait_credentials(self, row):
+        """The worker owns the serialized slot before any secret may be posted."""
+        ident = row['id']
+        plan = json.loads(row['plan'])
+        path = self.settings.state_dir / '.credential.sock'
+        listener = wire.listen(path)
+        deadline = int(time.time()) + WAIT_SECONDS
+        monotonic_deadline = time.monotonic() + WAIT_SECONDS
+        with self.flow.store.transaction() as db:
+            db.execute("UPDATE jobs SET credential_phase='waiting',credential_deadline=?,started_at=NULL WHERE id=?", (deadline, ident))
+            event(db, ident, 'Worker ready: requesting account may submit credentials within five minutes. No secrets are stored while waiting.')
+        try:
+            while time.monotonic() < monotonic_deadline:
+                self.heartbeat()
+                with self.flow.store.read() as db:
+                    fresh = db.execute('SELECT * FROM jobs WHERE id=?', (ident,)).fetchone()
+                if fresh['cancel_requested'] or self.stopping:
+                    raise WebError('credential_cancelled', 'Credential wait canceled before execution.', 409)
+                try:
+                    conn, _ = listener.accept()
+                except socket.timeout:
+                    continue
+                with conn:
+                    conn.settimeout(2)
+                    packet = None
+                    try:
+                        wire.peer(conn)
+                        packet = wire.receive(conn, wire.SECRET_LIMIT)
+                        if set(packet) != {'job','user','session','credentials'} or packet['job'] != ident or packet['user'] != row['owner_id']:
+                            raise WebError('credential_scope', 'Credential hand-off scope mismatch.', 403)
+                        eligible(self.flow, row['owner_id'], ident)
+                        valid_session(self.flow, packet['session'], row['owner_id'])
+                        revalidate(self.flow, fresh)
+                        packet['credentials'] = fields(packet['credentials'], plan['credential_requirements'])
+                        packet['deadline'] = time.monotonic() + HANDOFF_SECONDS
+                        with self.flow.store.transaction() as db:
+                            changed = db.execute("UPDATE jobs SET credential_phase='claimed',credential_deadline=?,started_at=? WHERE id=? AND status='running' AND cancel_requested=0 AND credential_phase='waiting'",
+                                                 (int(time.time()) + HANDOFF_SECONDS, int(time.time()), ident)).rowcount
+                            if changed != 1:
+                                raise WebError('credential_race', 'Credential hand-off no longer available.', 409)
+                            event(db, ident, 'Single-run credential hand-off claimed; never stored in job records.')
+                        wire.send(conn, {'accepted': True})
+                        return packet
+                    except (WebError, ValueError, KeyError, OSError, TypeError):
+                        if packet:
+                            packet.clear()
+                        try:
+                            wire.send(conn, {'accepted': False})
+                        except OSError:
+                            pass
+            raise WebError('credential_wait_expired', 'No credentials supplied before the worker reservation expired. Submit a new job.', 409)
+        finally:
+            listener.close()
+            path.unlink(missing_ok=True)
+
+    def tick(self):
+        self.heartbeat()
+        if not self.settings.execution_enabled:
+            return False
+        hour = datetime.now(timezone.utc).hour
+        if not self.settings.execution_window_start_hour <= hour < self.settings.execution_window_end_hour:
+            return False
+        with self.flow.store.transaction() as db:
+            row = db.execute("SELECT * FROM jobs WHERE status='queued' AND scheduled_at<=? ORDER BY scheduled_at,created_at LIMIT 1",
+                             (int(time.time()),)).fetchone()
+            if not row:
+                return False
+            row = dict(row)
+            db.execute("UPDATE jobs SET status='running',started_at=? WHERE id=?", (int(time.time()), row['id']))
+            event(db, row['id'], 'Worker claimed job; rechecking approval, permissions and source revisions.')
+        ident = row['id']
+        try:
+            checked = revalidate(self.flow, row)
+            CoreAdapter(self.settings).readiness(checked)
+        except WebError as exc:
+            self.finish(ident, 'blocked', exc.message)
+            return True
+        packet = None
+        if json.loads(row['plan']).get('credential_requirements'):
+            try:
+                packet = self.wait_credentials(row)
+            except (WebError, OSError) as exc:
+                reason = exc.message if isinstance(exc, WebError) else 'Credential listener unavailable; no credentials saved.'
+                self.finish(ident, 'canceled' if getattr(exc, 'code', '') == 'credential_cancelled' else 'blocked', reason)
+                return True
+        # No credentials in argv, environment, stdout, stderr, job log or database.
+        # This environment excludes inherited proxy/password/Ansible overrides.
+        env = {'PATH': '/usr/bin:/bin', 'HOME': str(self.settings.state_dir), 'LANG': 'C.UTF-8',
+               'PYTHONDONTWRITEBYTECODE': '1', 'PYTHONNOUSERSITE': '1'}
+        command = [sys.executable, '-B', '-m', 'aim_webgui.worker', str(self.config), ident]
+        try:
+            process = subprocess.Popen(command, stdin=subprocess.PIPE if packet else subprocess.DEVNULL, stdout=subprocess.DEVNULL,
+                                       stderr=subprocess.DEVNULL, env=env, start_new_session=True)
+        except OSError:
+            if packet: packet.clear()
+            self.finish(ident, 'failed', 'Worker process could not start.')
+            return True
+        start = time.monotonic()
+        try:
+            if packet:
+                try:
+                    process.stdin.write(json.dumps(packet,ensure_ascii=False).encode('utf-8'))
+                    process.stdin.close()
+                except (BrokenPipeError, OSError):
+                    pass
+                finally:
+                    packet['credentials'].clear()
+                    packet.clear()
+            while process.poll() is None:
+                with self.flow.store.read() as db:
+                    cancel = db.execute('SELECT cancel_requested FROM jobs WHERE id=?', (ident,)).fetchone()[0]
+                if cancel or self.stopping:
+                    stop_group(process)
+                    self.finish(ident, 'interrupted' if self.stopping else 'canceled',
+                                'Execution stopped. Completed remote changes were not rolled back.', process.returncode)
+                    return True
+                if time.monotonic() - start >= self.settings.execution_timeout_seconds + 200:
+                    stop_group(process)
+                    self.finish(ident, 'timed_out', 'Execution timed out. Completed remote changes were not rolled back.', process.returncode)
+                    return True
+                self.heartbeat()
+                time.sleep(.5)
+            code = process.returncode
+            with self.flow.store.read() as db:
+                completed=db.execute('SELECT core_result,return_code FROM jobs WHERE id=?',(ident,)).fetchone()
+            native_code=completed['return_code'] if completed else None
+            self.finish(ident, 'successful' if code == 0 else 'failed',
+                        'AIM core reported success with final counters.' if code == 0 else self.child_failure(ident), native_code)
+        finally:
+            stop_group(process)
+        return True
+
+    def child_failure(self, ident):
+        with self.flow.store.read() as db:
+            row = db.execute('SELECT reason FROM jobs WHERE id=?', (ident,)).fetchone()
+        return row['reason'] or 'AIM run failed. Inspect prerequisites in the terminal; raw output is not retained.'
+
+    def run(self, *, once=False):
+        resource.setrlimit(resource.RLIMIT_CORE, (0, 0))
+        ensure_private_dir(self.settings.state_dir)
+        self.flow.store.check()
+        fd = os.open(self.settings.state_dir / '.worker.lock', os.O_CREAT | os.O_RDWR | os.O_NOFOLLOW, 0o600)
+        try:
+            try:
+                fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+            except BlockingIOError:
+                raise ValueError('Another worker owns this controller queue.') from None
+            # Crash recovery NEVER retries a job that might already have changed hosts.
+            with self.flow.store.transaction() as db:
+                for row in db.execute("SELECT id FROM jobs WHERE status='running'").fetchall():
+                    db.execute("UPDATE jobs SET status='interrupted',finished_at=?,reason=?,credential_phase='released',credential_deadline=NULL WHERE id=?",
+                               (int(time.time()), 'Worker restarted; execution outcome requires terminal review.', row['id']))
+                    event(db, row['id'], 'Interrupted job was not automatically retried.')
+            previous = {}
+            for sig in (signal.SIGTERM, signal.SIGINT):
+                previous[sig] = signal.signal(sig, lambda *_: setattr(self, 'stopping', True))
+            try:
+                while not self.stopping:
+                    self.tick()
+                    if once:
+                        break
+                    time.sleep(1)
+            finally:
+                for sig, handler in previous.items():
+                    signal.signal(sig, handler)
+        finally:
+            os.close(fd)
+
+
+if __name__ == '__main__':
+    os.umask(0o077)
+    sys.dont_write_bytecode = True
+    try:
+        resource.setrlimit(resource.RLIMIT_CORE, (0, 0))
+        config = Settings.load(Path(sys.argv[1]))
+        # stdin is an anonymous pipe for credential jobs, /dev/null otherwise.
+        data = sys.stdin.buffer.read(wire.SECRET_LIMIT + 1)
+        if len(data) > wire.SECRET_LIMIT:
+            raise ValueError('Credential packet limit.')
+        packet = json.loads(data) if data else None
+        execute_claimed(config, sys.argv[2], packet)
+    except WebError as exc:
+        # Only our fixed, sanitized WebError messages. Never raw subprocess exceptions.
+        try:
+            with Workflows(config).store.transaction() as db:
+                db.execute('UPDATE jobs SET reason=? WHERE id=?', (exc.message, sys.argv[2]))
+        except Exception:
+            pass
+        raise SystemExit(1) from None
+    except Exception:
+        # Do not dump exceptions which can contain YAML inventory or decrypted data.
+        raise SystemExit(1) from None
diff --git a/scripts/addons/webgui/src/aim_webgui/workflows.py b/scripts/addons/webgui/src/aim_webgui/workflows.py
new file mode 100644
index 0000000..7db42f0
--- /dev/null
+++ b/scripts/addons/webgui/src/aim_webgui/workflows.py
@@ -0,0 +1,448 @@
+"""Add-on-owned workflow records; never change AIM's source or inventory.
+
+All job authorization is checked again in the worker. A queued job is not a
+permission token. No request bodies, credentials or Ansible output are audited.
+"""
+from __future__ import annotations
+
+import json
+import time
+import uuid
+import hashlib
+import re
+import unicodedata
+from datetime import datetime, timezone
+from aim_webgui.names import name_key, suggested_name
+
+from aim_webgui.auth.service import Auth, HASHER, password_policy, username
+from aim_webgui.config import Settings
+from aim_webgui.db.store import Store, audit
+from aim_webgui.errors import WebError
+from aim_webgui.adapters.core_v1 import CoreAdapter
+
+TERMINAL = frozenset({'successful', 'failed', 'canceled', 'timed_out', 'blocked', 'interrupted'})
+
+
+def presentation_status(status, core_result):
+    if status != 'failed' or not isinstance(core_result, dict):
+        return status
+    summary = core_result.get('target_summary')
+    if not isinstance(summary, dict) or summary.get('schema') != 'target_outcome_summary_v1':
+        return status
+    requested = summary.get('requested')
+    successful = summary.get('successful')
+    if type(requested) is not int or type(successful) is not int or requested <= 0:
+        return status
+    unsuccessful = sum(summary.get(key, 0) for key in ('failed','unreachable','not_started','indeterminate')
+                       if type(summary.get(key, 0)) is int)
+    if successful > 0 and successful < requested and unsuccessful > 0:
+        return 'partially_succeeded'
+    return status
+
+
+def actor(db, user_id: int):
+    user = db.execute('SELECT * FROM users WHERE id=?', (user_id,)).fetchone()
+    if not user or not user['enabled'] or user['must_change_password']:
+        raise WebError('account_unavailable', 'An enabled account with a permanent password is required.', 403)
+    return user
+
+
+def allowed(db, user_id: int, customer: str, playbook: str):
+    user = actor(db, user_id)
+    if user['role'] == 'admin' or db.execute(
+            'SELECT 1 FROM grants WHERE user_id=? AND customer=? AND playbook=?',
+            (user_id, customer, playbook)).fetchone():
+        return user
+    raise WebError('execution_forbidden', 'This account has no execution grant for this customer and playbook.', 403)
+
+
+def event(db, job_id: str, message: str):
+    db.execute('INSERT INTO job_events(job_id,occurred_at,event) VALUES(?,?,?)',
+               (job_id, int(time.time()), message))
+
+
+def serialized(value):
+    return json.dumps(value, ensure_ascii=True, sort_keys=True, separators=(',', ':'))
+
+
+class Workflows:
+    def __init__(self, settings: Settings):
+        self.settings = settings
+        self.store = Store(settings.database)
+
+    def record(self, user_id: int, action: str, subject: str):
+        with self.store.transaction() as db:
+            user = actor(db, user_id)
+            audit(db, user['username'], action, subject)
+
+    def validated_plan(self, customer, playbook, targets, overrides, *, text_inputs=False, check=True, key_mode='none'):
+        return CoreAdapter(self.settings).preflight(customer,playbook,targets,overrides,
+                text_inputs=text_inputs,check=check,key_mode=key_mode)
+
+    def review(self, user_id, customer, playbook, targets, overrides, *, text_inputs=False, check=True, key_mode='none'):
+        with self.store.read() as db: actor(db,user_id)
+        plan=self.validated_plan(customer,playbook,targets,overrides,text_inputs=text_inputs,check=check,key_mode=key_mode)
+        ident=uuid.uuid4().hex
+        now=int(time.time())
+        plan['suggested_name']=suggested_name(playbook)
+        with self.store.transaction() as db:
+            who=actor(db,user_id)
+            db.execute('DELETE FROM run_reviews WHERE expires_at<?',(now,))
+            if db.execute('SELECT COUNT(*) FROM run_reviews WHERE owner_id=?',(user_id,)).fetchone()[0]>=100:
+                db.execute('DELETE FROM run_reviews WHERE id=(SELECT id FROM run_reviews WHERE owner_id=? ORDER BY created_at LIMIT 1)',(user_id,))
+            db.execute('INSERT INTO run_reviews VALUES(?,?,?,?,?)',(ident,user_id,serialized(plan),now,now+1800))
+            audit(db,who['username'],'run-reviewed',ident)
+        return {**plan,'review_id':ident}
+
+    def review_record(self,user_id,ident):
+        with self.store.read() as db:
+            actor(db,user_id)
+            row=db.execute('SELECT * FROM run_reviews WHERE id=? AND owner_id=?',(ident,user_id)).fetchone()
+        if not row or row['expires_at']<time.time():
+            raise WebError('review_expired','The review expired or is unavailable. Return to New run and review again.',409)
+        return json.loads(row['payload'])
+
+    def save_review(self,user_id,ident,name=''):
+        reviewed=self.review_record(user_id,ident)
+        current=CoreAdapter(self.settings).reprepare(reviewed)
+        self.assert_revision(reviewed,current)
+        return self._insert_plan(user_id,name,current,reviewed.get('suggested_name'))
+
+    def save_plan(self,user_id,name,customer,playbook,targets,overrides,*,text_inputs=False,check=True,key_mode='none'):
+        plan=self.validated_plan(customer,playbook,targets,overrides,text_inputs=text_inputs,check=check,key_mode=key_mode)
+        return self._insert_plan(user_id,name,plan)
+
+    def _insert_plan(self,user_id,name,plan,suggestion=None):
+        if name is None:name=''
+        if not isinstance(name,str):raise WebError('invalid_plan_name','Plan name must be text.')
+        explicit=bool(name.strip())
+        name=name.strip() or suggestion or suggested_name(plan['playbook'])
+        if len(name)>100 or any(unicodedata.category(c).startswith('C') for c in name):
+            raise WebError('invalid_plan_name','Use up to 100 printable characters; leave blank for an automatic unique name.')
+        ident=uuid.uuid4().hex
+        with self.store.transaction() as db:
+            user=actor(db,user_id)
+            rows=db.execute('SELECT name FROM plans WHERE owner_id=?',(user_id,)).fetchall()
+            if len(rows)>=100:raise WebError('plan_limit','Delete an old saved plan before creating another (100 per account).',409)
+            existing={name_key(row['name']) for row in rows}
+            if explicit and name_key(name) in existing:
+                raise WebError('plan_name_exists','A plan with this title already exists in your account. Choose another title; nothing was overwritten.',409)
+            while name_key(name) in existing:name=suggested_name(plan['playbook'])
+            db.execute('INSERT INTO plans(id,owner_id,name,customer,playbook,payload,created_at,name_key) VALUES(?,?,?,?,?,?,?,?)',
+                       (ident,user_id,name,plan['customer'],plan['playbook'],serialized(plan),int(time.time()),name_key(name)))
+            audit(db,user['username'],'plan-created',ident)
+        return ident
+
+    def plans(self, user_id):
+        with self.store.read() as db:
+            actor(db, user_id)
+            rows=list(db.execute('SELECT id,name,customer,playbook,payload,created_at FROM plans WHERE owner_id=? ORDER BY created_at DESC',(user_id,)))
+        result=[]
+        for row in rows:
+            item=dict(row); payload=json.loads(item.pop('payload'))
+            targets=payload.get('targets',[]) if isinstance(payload,dict) else []
+            item['target_count']=len(targets); item['target_preview']=targets[:2]
+            result.append(item)
+        return result
+
+    def plan(self, user_id, ident):
+        with self.store.read() as db:
+            actor(db, user_id)
+            row = db.execute('SELECT * FROM plans WHERE id=? AND owner_id=?', (ident, user_id)).fetchone()
+        if not row:
+            raise WebError('plan_not_found', 'Saved plan not found for this account.', 404)
+        result = dict(row)
+        result['payload'] = json.loads(result['payload'])
+        return result
+
+    def delete_plan(self, user_id, ident):
+        self.delete_plans(user_id, [ident])
+
+    def delete_plans(self, user_id, identifiers):
+        if (not isinstance(identifiers, list) or not 1 <= len(identifiers) <= 100
+                or len(set(identifiers)) != len(identifiers)
+                or any(not isinstance(ident, str) or len(ident) != 32 for ident in identifiers)):
+            raise WebError('invalid_plan_selection', 'Select between 1 and 100 saved plans to delete.')
+        with self.store.transaction() as db:
+            user = actor(db, user_id)
+            placeholders = ','.join('?' for _ in identifiers)
+            rows = list(db.execute(
+                f'SELECT id FROM plans WHERE owner_id=? AND id IN ({placeholders})',
+                (user_id, *identifiers)))
+            if {row['id'] for row in rows} != set(identifiers):
+                raise WebError('plan_not_found', 'One or more selected saved plans are unavailable for this account.', 404)
+            db.execute(
+                f'DELETE FROM plans WHERE owner_id=? AND id IN ({placeholders})',
+                (user_id, *identifiers))
+            for ident in identifiers:
+                audit(db, user['username'], 'plan-deleted', ident)
+
+    def save_selection(self, user_id, customer, playbook, targets):
+        adapter = CoreAdapter(self.settings)
+        spec = adapter.spec(playbook, customer)
+        compatible = {h['name'] for h in adapter.hosts(customer) if set(h['platforms']).intersection(spec.platforms)}
+        if (not isinstance(targets, list) or len(targets) > 500 or any(not isinstance(t, str) or t not in compatible for t in targets)
+                or len(set(targets)) != len(targets)):
+            raise WebError('invalid_selection', 'Use at most 500 distinct compatible explicit hosts.')
+        with self.store.transaction() as db:
+            actor(db, user_id)
+            db.execute('DELETE FROM selection_drafts WHERE updated_at<?', (int(time.time()) - 7 * 86400,))
+            db.execute('''INSERT INTO selection_drafts VALUES(?,?,?,?,?) ON CONFLICT(user_id,customer,playbook)
+                DO UPDATE SET targets=excluded.targets,updated_at=excluded.updated_at''',
+                (user_id, customer, playbook, serialized(targets), int(time.time())))
+        return {'saved': len(targets)}
+
+    def selection(self, user_id, customer, playbook):
+        with self.store.read() as db:
+            actor(db, user_id)
+            row = db.execute('SELECT targets FROM selection_drafts WHERE user_id=? AND customer=? AND playbook=? AND updated_at>?',
+                             (user_id, customer, playbook, int(time.time()) - 7 * 86400)).fetchone()
+        return json.loads(row[0]) if row else []
+
+    def onboarding(self, user_id):
+        with self.store.read() as db:
+            Auth.require_admin(db, user_id)
+            users = [dict(r) for r in db.execute("SELECT id,username,role,enabled,must_change_password FROM users ORDER BY username")]
+        return {'users': users, 'ready': any(u['role'] == 'admin' and u['enabled'] and not u['must_change_password']
+                                          and u['username'] != 'admin' for u in users)}
+
+    def named_admin(self, user_id, name, temporary_password):
+        name = username(name)
+        if name == 'admin':
+            raise WebError('named_account_required', 'Choose a personal administrator name other than admin.')
+        Auth(self.settings).create_user(name, temporary_password, 'admin', actor_id=user_id)
+
+    def retire_bootstrap(self, user_id):
+        with self.store.transaction() as db:
+            who = Auth.require_admin(db, user_id)
+            current = actor(db, user_id)
+            if current['username'] == 'admin':
+                raise WebError('named_signin_required', 'Sign in with the named administrator after changing its temporary password.', 403)
+            db.execute("UPDATE users SET enabled=0,updated_at=? WHERE username='admin'", (int(time.time()),))
+            db.execute("DELETE FROM sessions WHERE user_id IN (SELECT id FROM users WHERE username='admin')")
+            db.execute("INSERT INTO metadata VALUES('bootstrap_retired','1') ON CONFLICT(key) DO UPDATE SET value='1'")
+            audit(db, who, 'bootstrap-retired', 'admin')
+        Auth(self.settings).consume_bootstrap()
+
+    def grant(self, admin_id, user_id, customer, playbook, *, revoke=False):
+        adapter = CoreAdapter(self.settings)
+        adapter.customer_path(customer)
+        adapter.spec(playbook, customer)
+        with self.store.transaction() as db:
+            who = Auth.require_admin(db, admin_id)
+            target = db.execute('SELECT username FROM users WHERE id=?', (user_id,)).fetchone()
+            if not target:
+                raise WebError('user_not_found', 'Account not found.', 404)
+            if revoke:
+                db.execute('DELETE FROM grants WHERE user_id=? AND customer=? AND playbook=?', (user_id, customer, playbook))
+            else:
+                exists = db.execute('SELECT 1 FROM grants WHERE user_id=? AND customer=? AND playbook=?',
+                                    (user_id, customer, playbook)).fetchone()
+                if exists:
+                    raise WebError('grant_exists', 'This account already has that execution grant.', 409)
+                db.execute('INSERT INTO grants VALUES(?,?,?)', (user_id, customer, playbook))
+            audit(db, who, 'grant-revoked' if revoke else 'grant-created', target['username'])
+
+    def granted_playbooks(self, admin_id, user_id, customer):
+        CoreAdapter(self.settings).customer_path(customer)
+        with self.store.read() as db:
+            Auth.require_admin(db, admin_id)
+            target = db.execute('SELECT id FROM users WHERE id=?', (user_id,)).fetchone()
+            if not target:
+                raise WebError('user_not_found', 'Account not found.', 404)
+            return [r['playbook'] for r in db.execute(
+                'SELECT playbook FROM grants WHERE user_id=? AND customer=? ORDER BY playbook',
+                (user_id, customer))]
+
+    def grants(self, admin_id):
+        with self.store.read() as db:
+            Auth.require_admin(db, admin_id)
+            return [dict(r) for r in db.execute('SELECT grants.*,users.username FROM grants JOIN users ON users.id=grants.user_id')]
+
+    def execution_policy(self, plan):
+        s=self.settings
+        if not s.execution_enabled:raise WebError('execution_disabled','Browser execution is disabled. AIM terminal remains available.',501)
+        if plan['playbook'] not in s.execution_playbooks:raise WebError('playbook_not_enabled','This operation is not in the WebGUI execution allowlist.',403)
+        if len(plan['targets'])>s.execution_max_hosts:raise WebError('host_limit',f'Execution policy permits at most {s.execution_max_hosts} hosts.')
+        if not plan.get('core_request'):raise WebError('legacy_plan','Old-core plans require a fresh New run review.',409)
+        capabilities=CoreAdapter(s).capabilities
+        if capabilities.get('execution',{}).get('enabled') is not True:
+            raise WebError('core_execution_disabled','Core external execution is disabled. Review addons.execution_enabled with the AIM operator; WebGUI does not edit aim.yml.',409)
+        if capabilities.get('execution',{}).get('profile')!='same_uid_native_inventory':
+            raise WebError('core_profile','This core execution profile is not qualified by this add-on.',409)
+        if plan['credential_requirements'] and not s.credentials_enabled:
+            raise WebError('credentials_disabled','This run requires one-run credentials; credential collection is disabled.',409)
+
+    def queue_review(self,user_id,review_id,scheduled_at=None,*,idempotency_key):
+        if not isinstance(idempotency_key,str) or not re.fullmatch(r'[A-Za-z0-9_-]+',idempotency_key) or not 1<=len(idempotency_key)<=80:
+            raise WebError('submission_key','Supply a fresh alphanumeric/hyphen submission key up to 80 characters.')
+        fingerprint=hashlib.sha256(serialized({'review':review_id,'scheduled_at':scheduled_at}).encode()).hexdigest()
+        with self.store.read() as db:
+            actor(db,user_id)
+            previous=db.execute('SELECT job_id,request_hash FROM job_requests WHERE owner_id=? AND request_key=?',(user_id,idempotency_key)).fetchone()
+            if previous:
+                if previous['request_hash']!=fingerprint:raise WebError('idempotency_conflict','Submission key was already used for a different request.',409)
+                return previous['job_id']
+        reviewed=self.review_record(user_id,review_id)
+        current=CoreAdapter(self.settings).reprepare(reviewed)
+        self.assert_revision(reviewed,current)
+        self.execution_policy(current)
+        now=int(time.time());when=now if scheduled_at is None else scheduled_at
+        if type(when)is not int or not now-60<=when<=now+30*86400:raise WebError('invalid_schedule','Choose a time within the next 30 days.')
+        ident=uuid.uuid4().hex
+        status='pending' if self.settings.execution_require_approval else 'queued'
+        mode='check' if current['core_request']['check'] else 'apply'
+        with self.store.transaction() as db:
+            who=allowed(db,user_id,current['customer'],current['playbook'])
+            old=db.execute('SELECT job_id,request_hash FROM job_requests WHERE owner_id=? AND request_key=?',(user_id,idempotency_key)).fetchone()
+            if old:
+                if old['request_hash']!=fingerprint:raise WebError('idempotency_conflict','Submission key was reused with a different request.',409)
+                return old['job_id']
+            fresh=db.execute('SELECT expires_at FROM run_reviews WHERE id=? AND owner_id=?',(review_id,user_id)).fetchone()
+            if not fresh or fresh['expires_at']<time.time():raise WebError('review_expired','Review expired before submission.',409)
+            if db.execute("SELECT COUNT(*) FROM jobs WHERE status IN ('pending','queued','running')").fetchone()[0]>=100:
+                raise WebError('queue_full','Queue limit reached (100 outstanding jobs).',409)
+            db.execute('INSERT INTO jobs(id,owner_id,plan,mode,status,created_at,scheduled_at) VALUES(?,?,?,?,?,?,?)',
+                       (ident,user_id,serialized(current),mode,status,now,when))
+            db.execute('INSERT INTO job_requests(owner_id,request_key,job_id,request_hash) VALUES(?,?,?,?)',(user_id,idempotency_key,ident,fingerprint))
+            event(db,ident,'Submitted for independent approval.' if status=='pending' else 'Queued as one-run job. No saved plan was required.')
+            audit(db,who['username'],'job-submitted',ident)
+        return ident
+
+    @staticmethod
+    def assert_revision(saved,current):
+        if not saved.get('core_revision') or saved.get('core_revision')!=current.get('core_revision') or saved.get('core_request')!=current.get('core_request'):
+            raise WebError('plan_stale','AIM sources or reviewed options changed. Review a new run; a saved plan is optional.',409)
+
+    def job(self, user_id, ident):
+        with self.store.read() as db:
+            user = actor(db, user_id)
+            row = db.execute('SELECT jobs.*,users.username FROM jobs JOIN users ON users.id=jobs.owner_id WHERE jobs.id=?', (ident,)).fetchone()
+            if not row or (row['owner_id'] != user_id and user['role'] != 'admin'):
+                raise WebError('job_not_found', 'Job not found for this account.', 404)
+            result = dict(row)
+            result['events'] = [dict(r) for r in db.execute('SELECT occurred_at,event FROM job_events WHERE job_id=? ORDER BY id', (ident,))]
+        result['plan'] = json.loads(result['plan'])
+        result['core_result'] = json.loads(result['core_result']) if result.get('core_result') else None
+        result['display_status'] = presentation_status(result['status'], result['core_result'])
+        return result
+
+    def jobs(self, user_id):
+        with self.store.read() as db:
+            user = actor(db, user_id)
+            rows=list(db.execute('''SELECT jobs.id,owner_id,users.username,mode,status,credential_phase,credential_deadline,cancel_requested,jobs.plan,jobs.core_result,jobs.created_at,scheduled_at
+                FROM jobs JOIN users ON users.id=jobs.owner_id WHERE (?='admin' OR owner_id=?) ORDER BY jobs.created_at DESC LIMIT 100''',
+                (user['role'], user_id)))
+        result=[]
+        for row in rows:
+            item=dict(row); plan=json.loads(item.pop('plan'))
+            targets=plan.get('targets',[]) if isinstance(plan,dict) else []
+            item['customer']=plan.get('customer',''); item['playbook']=plan.get('playbook','')
+            item['target_count']=len(targets); item['target_preview']=targets[:2]
+            core_result=json.loads(item['core_result']) if item.get('core_result') else None
+            item['core_result']=core_result
+            item['display_status']=presentation_status(item['status'],core_result)
+            item['target_summary']=core_result.get('target_summary') if isinstance(core_result,dict) else None
+            result.append(item)
+        return result
+
+    def retry_job(self, user_id, ident):
+        # Manual retries create a new job and never replay/mutate the failed row.
+        # One-run credentials are not retained and must be supplied again.
+        with self.store.read() as db:
+            actor(db, user_id)
+            row = db.execute('SELECT * FROM jobs WHERE id=?', (ident,)).fetchone()
+            if not row or row['owner_id'] != user_id:
+                raise WebError('job_not_found', 'Only the original requester can retry this job.', 404)
+            if row['status'] != 'failed':
+                raise WebError('job_state', 'Only failed jobs can be retried.', 409)
+            previous = dict(row)
+        saved = json.loads(previous['plan'])
+        current = CoreAdapter(self.settings).reprepare(saved)
+        self.assert_revision(saved, current)
+        if saved.get('authentication'):
+            current['authentication'] = dict(saved['authentication'])
+        self.execution_policy(current)
+        now = int(time.time())
+        status = 'pending' if self.settings.execution_require_approval else 'queued'
+        new_ident = uuid.uuid4().hex
+        with self.store.transaction() as db:
+            who = allowed(db, user_id, current['customer'], current['playbook'])
+            latest = db.execute('SELECT status,owner_id FROM jobs WHERE id=?', (ident,)).fetchone()
+            if not latest or latest['owner_id'] != user_id or latest['status'] != 'failed':
+                raise WebError('job_state', 'The failed job changed while retrying. Reload and try again.', 409)
+            if db.execute("SELECT COUNT(*) FROM jobs WHERE status IN ('pending','queued','running')").fetchone()[0] >= 100:
+                raise WebError('queue_full', 'The queue is full (100 outstanding jobs).', 409)
+            db.execute('INSERT INTO jobs(id,owner_id,plan,mode,status,created_at,scheduled_at) VALUES(?,?,?,?,?,?,?)',
+                       (new_ident, user_id, serialized(current), previous['mode'], status, now, now))
+            if status == 'pending':
+                event(db, new_ident, f'Retry of {ident[:12]} submitted; awaiting independent administrator approval.')
+            else:
+                event(db, new_ident, f'Queued as manual retry of {ident[:12]}.')
+            audit(db, who['username'], 'job-retried', f'{ident}:{new_ident}')
+        return new_ident
+
+    def delete_jobs(self, user_id, identifiers):
+        if (not isinstance(identifiers, list) or not 1 <= len(identifiers) <= 100
+                or len(set(identifiers)) != len(identifiers)
+                or any(not isinstance(ident, str) or len(ident) != 32 for ident in identifiers)):
+            raise WebError('invalid_job_selection', 'Select between 1 and 100 finished jobs to delete.')
+        with self.store.transaction() as db:
+            who = actor(db, user_id)
+            placeholders = ','.join('?' for _ in identifiers)
+            rows = list(db.execute(
+                f'SELECT id,owner_id,status FROM jobs WHERE id IN ({placeholders})', identifiers))
+            if {row['id'] for row in rows} != set(identifiers):
+                raise WebError('job_not_found', 'One or more selected jobs are unavailable.', 404)
+            if any(row['owner_id'] != user_id and who['role'] != 'admin' for row in rows):
+                raise WebError('job_not_found', 'One or more selected jobs are unavailable.', 404)
+            if any(row['status'] not in TERMINAL for row in rows):
+                raise WebError('job_state', 'Only finished jobs can be deleted.', 409)
+            for row in rows:
+                subject = f"{row['id']}:{row['status']}"
+                db.execute('DELETE FROM job_events WHERE job_id=?', (row['id'],))
+                db.execute('DELETE FROM job_requests WHERE job_id=?', (row['id'],))
+                db.execute('DELETE FROM jobs WHERE id=?', (row['id'],))
+                audit(db, who['username'], 'job-deleted', subject)
+
+    def job_action(self, user_id, ident, action):
+        with self.store.transaction() as db:
+            who = actor(db, user_id)
+            row = db.execute('SELECT * FROM jobs WHERE id=?', (ident,)).fetchone()
+            if not row or (row['owner_id'] != user_id and who['role'] != 'admin'):
+                raise WebError('job_not_found', 'Job not found.', 404)
+            if action == 'approve':
+                Auth.require_admin(db, user_id)
+                if row['owner_id'] == user_id:
+                    raise WebError('independent_approval', 'A different administrator must approve this job.', 403)
+                if row['status'] != 'pending':
+                    raise WebError('job_state', 'Only pending jobs can be approved.', 409)
+                db.execute("UPDATE jobs SET status='queued',approver_id=? WHERE id=?", (user_id, ident))
+                event(db, ident, 'Approved by a different administrator; waiting for scheduled time and worker.')
+            elif action == 'cancel':
+                if row['status'] in TERMINAL:
+                    raise WebError('job_finished', 'This job has already finished.', 409)
+                if row['status'] == 'running':
+                    db.execute('UPDATE jobs SET cancel_requested=1 WHERE id=?', (ident,))
+                    event(db, ident, 'Cancellation requested. Completed remote changes cannot be rolled back.')
+                else:
+                    db.execute("UPDATE jobs SET status='canceled',finished_at=? WHERE id=?", (int(time.time()), ident))
+                    event(db, ident, 'Canceled before execution.')
+            elif action == 'delete':
+                if row['status'] not in TERMINAL:
+                    raise WebError('job_state', 'Only finished jobs can be deleted.', 409)
+                subject = f"{ident}:{row['status']}"
+                db.execute('DELETE FROM job_events WHERE job_id=?', (ident,))
+                db.execute('DELETE FROM job_requests WHERE job_id=?', (ident,))
+                db.execute('DELETE FROM jobs WHERE id=?', (ident,))
+                audit(db, who['username'], 'job-deleted', subject)
+                return
+            else:
+                raise WebError('invalid_action', 'Choose approve, cancel or delete.')
+            audit(db, who['username'], 'job-' + action, ident)
+
+    def audit(self, admin_id, *, before=None, action=''):
+        with self.store.read() as db:
+            Auth.require_admin(db, admin_id)
+            return [dict(r) for r in db.execute('''SELECT * FROM audit WHERE id<? AND (?='' OR action=?)
+                ORDER BY id DESC LIMIT 100''', (before or 2**63-1, action, action))]
diff --git a/scripts/addons/webgui/tests/benchmark_journal.py b/scripts/addons/webgui/tests/benchmark_journal.py
new file mode 100644
index 0000000..0281167
--- /dev/null
+++ b/scripts/addons/webgui/tests/benchmark_journal.py
@@ -0,0 +1,46 @@
+"""Synthetic local metadata retention benchmark; no Core calls or managed hosts."""
+from pathlib import Path
+import argparse,json,resource,sys,tempfile,time
+sys.path.insert(0,str(Path(__file__).resolve().parents[1]/'src'))
+from aim_webgui.auth.service import Auth
+from aim_webgui.config import Settings
+from aim_webgui.journal import Journal,project
+from evidence_fixtures import job,ev
+
+
+def main():
+    parser=argparse.ArgumentParser()
+    parser.add_argument('--events',type=int,default=25000)
+    parser.add_argument('--out',type=Path,required=True)
+    args=parser.parse_args()
+    if not 1<=args.events<=200000:parser.error('events must be 1..200000')
+    with tempfile.TemporaryDirectory(prefix='aim-journal-benchmark-') as directory:
+        settings=Settings(state_dir=Path(directory)/'state',public_url='https://example.test')
+        auth=Auth(settings);auth.bootstrap()
+        with auth.store.transaction() as db:
+            db.execute('UPDATE users SET must_change_password=0')
+            owner=db.execute('SELECT id FROM users').fetchone()[0]
+        ident=job(auth,owner);journal=Journal(settings);journal.begin(ident)
+        begin=time.perf_counter()
+        for start in range(1,args.events+1,128):
+            batch=[(*project(ev(i),{'test01.example'}),time.time()) for i in range(start,min(start+128,args.events+1))]
+            journal.append(ident,batch)
+        journal.append(ident,[],closed=True)
+        elapsed=time.perf_counter()-begin
+        t=time.perf_counter();snapshot=journal.snapshot(owner,ident);read=time.perf_counter()-t
+        assert snapshot['cursor']==args.events
+        assert snapshot['retained_events']<=settings.journal_max_events
+        assert snapshot['retained_bytes']<=settings.journal_max_bytes
+        assert snapshot['checkpoint']['observed_task_starts']==args.events
+        assert len(snapshot['events'])<=200
+        result={'synthetic_only':True,'events':args.events,'batch_events':128,
+                'write_seconds':round(elapsed,4),'latest_snapshot_seconds':round(read,4),
+                'retained_events':snapshot['retained_events'],'omitted_events':snapshot['omitted_events'],
+                'retained_metadata_bytes':snapshot['retained_bytes'],'response_events':len(snapshot['events']),
+                'checkpoint_tasks':len(snapshot['checkpoint']['tasks']),
+                'process_peak_rss_kib':resource.getrusage(resource.RUSAGE_SELF).ru_maxrss,
+                'database_bytes':settings.database.stat().st_size,'core_calls':0,
+                'limits':'20,000 event / 8 MiB tail, using synchronous 128-event batches; not executor/load qualification'}
+        args.out.write_text(json.dumps(result,indent=2)+'\n');print(json.dumps(result,indent=2))
+
+if __name__=='__main__':main()
diff --git a/scripts/addons/webgui/tests/benchmark_read_history.py b/scripts/addons/webgui/tests/benchmark_read_history.py
new file mode 100644
index 0000000..c4c0b32
--- /dev/null
+++ b/scripts/addons/webgui/tests/benchmark_read_history.py
@@ -0,0 +1,65 @@
+"""Optional synthetic read-projection benchmark; never pass a production DB.
+
+python tests/benchmark_read_history.py --jobs 20000 --out /tmp/aim-history-benchmark.json
+Uses an automatically cleaned temporary database and only retained WebGUI fixtures.
+"""
+from pathlib import Path
+import argparse
+import json
+import resource
+import statistics
+import sys
+import tempfile
+import time
+sys.path.insert(0,str(Path(__file__).resolve().parents[1]/'src'))
+from aim_webgui.activity import Activity, HistoryFilter
+from aim_webgui.auth.service import Auth
+from aim_webgui.config import Settings
+
+
+def main():
+    parser=argparse.ArgumentParser()
+    parser.add_argument('--jobs',type=int,default=20000)
+    parser.add_argument('--out',type=Path,required=True)
+    args=parser.parse_args()
+    if not 1 <= args.jobs <= 100000:parser.error('--jobs must be 1..100000')
+    counts=('ok','changed','failures','unreachable','skipped','rescued','ignored')
+    now=int(time.time())
+    with tempfile.TemporaryDirectory(prefix='aim-read-benchmark-') as tmp:
+        auth=Auth(Settings(state_dir=Path(tmp)/'state',public_url='https://fixture.invalid').validate())
+        auth.bootstrap()
+        with auth.store.transaction() as db:
+            db.execute('UPDATE users SET must_change_password=0')
+            actor=db.execute('SELECT id FROM users WHERE username=?',('admin',)).fetchone()[0]
+            for i in range(args.jobs):
+                hosts=[f'host-{(i+j)%200:04d}.example' for j in range(4)]
+                outcome='unreachable' if i%5==0 else 'successful'
+                targets=[]
+                for j,h in enumerate(hosts):
+                    c=dict.fromkeys(counts,0);c['ok']=30;c['changed']=1
+                    state=outcome if j==3 else 'successful'
+                    if state=='unreachable':c['unreachable']=1
+                    targets.append({'host':h,'outcome':state,'counts':c})
+                unreachable=int(outcome=='unreachable')
+                result={'status':'failed' if unreachable else 'succeeded','targets':targets,
+                        'target_summary':{'schema':'target_outcome_summary_v1','requested':4,'accounted':4,'complete':True,
+                        'successful':4-unreachable,'failed':0,'unreachable':unreachable,'indeterminate':0,'not_started':0}}
+                plan={'customer':'synthetic','playbook':f'debug_fixture_{i%8}','targets':hosts}
+                db.execute('INSERT INTO jobs(id,owner_id,plan,mode,status,created_at,scheduled_at,finished_at,core_result) VALUES(?,?,?,?,?,?,?,?,?)',
+                           (f'{i:032x}',actor,json.dumps(plan),'apply','failed' if unreachable else 'successful',now-i-1,now-i-1,now-i-1,json.dumps(result)))
+        reader=Activity(auth.settings);durations=[]
+        for _ in range(3):
+            start=time.perf_counter();report=reader.report(actor,HistoryFilter(days='all'),now=now)
+            durations.append(time.perf_counter()-start)
+            assert report['jobs']==args.jobs and report['samples']==args.jobs*4
+            assert len(report['records'])==min(25,args.jobs*4) and len(report['matrix'])<=20
+        result={'synthetic_only':True,'jobs':args.jobs,'host_run_samples':report['samples'],
+                'distinct_customer_hosts':report['host_count'],'playbooks':len(report['playbooks']),
+                'runs_seconds':durations,'median_seconds':statistics.median(durations),
+                'process_peak_rss_kib':resource.getrusage(resource.RUSAGE_SELF).ru_maxrss,
+                'sqlite_bytes':auth.settings.database.stat().st_size,'output_records':len(report['records']),
+                'matrix_rows':len(report['matrix']),'core_calls':0,'projection_tables_added':0}
+        args.out.write_text(json.dumps(result,indent=2)+'\n')
+        print(json.dumps(result,indent=2))
+
+if __name__=='__main__':main()
diff --git a/scripts/addons/webgui/tests/browser_credentials_qa.py b/scripts/addons/webgui/tests/browser_credentials_qa.py
new file mode 100644
index 0000000..80e1cf2
--- /dev/null
+++ b/scripts/addons/webgui/tests/browser_credentials_qa.py
@@ -0,0 +1,200 @@
+"""Chromium about:blank fixtures bridged to real ASGI endpoints; synthetic worker handoffs.
+
+This is not live systemd/Core/SSH qualification. Bootstrap may be a declared
+substitute. HTMX is deliberately not loaded when unavailable: status replacements
+are driven explicitly and labeled as synthetic lifecycle coverage, not HTMX proof.
+Never install fixture assets into production static/vendor.
+"""
+from pathlib import Path
+import argparse
+import json
+import re
+import sys
+import tempfile
+import time
+from urllib.parse import urlsplit
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]/'src'))
+
+import pytest
+from fastapi.testclient import TestClient
+from playwright.sync_api import sync_playwright
+from aim_webgui.app import create_app
+from aim_webgui.credentials import wire
+from test_credential_ux import authz as auth_fixture, make_job, SYNTHETIC
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--out', type=Path, required=True)
+    parser.add_argument('--bootstrap', type=Path, default=Path('/opt/imagemagick/share/doc/ImageMagick-7/www/assets/bootstrap.min.css'))
+    args = parser.parse_args(); args.out.mkdir(parents=True, exist_ok=True)
+    cases = []
+    with tempfile.TemporaryDirectory(prefix='aim-credential-qa-') as tmp, pytest.MonkeyPatch.context() as monkey:
+        auth, users = auth_fixture.__wrapped__(Path(tmp), monkey)
+        fixture = (auth, users)
+        packets = []
+        class Sock:
+            def __enter__(self): return self
+            def __exit__(self, *args): pass
+        monkey.setattr(wire, 'connect', lambda *a, **k: Sock())
+        monkey.setattr(wire, 'send', lambda sock, packet, limit: packets.append(json.loads(json.dumps(packet))))
+        def claimed(*args):
+            ident = packets[-1]['job']
+            with auth.store.transaction() as db:
+                db.execute("UPDATE jobs SET credential_phase='claimed' WHERE id=?", (ident,))
+            return {'accepted': True}
+        monkey.setattr(wire, 'receive', claimed)
+        origin = auth.settings.public_url
+        with TestClient(create_app(auth.settings), base_url=origin, follow_redirects=False) as server, sync_playwright() as pw:
+            browser = pw.chromium.launch(executable_path='/usr/bin/chromium', args=['--no-sandbox', '--disable-dev-shm-usage'])
+            try:
+                for width, height in ((320,750),(390,844),(760,900),(1440,1000),(740,390)):
+                    for theme in ('light','dark'):
+                        # Independent viewport fixtures must not share the live five/minute bucket.
+                        # Production throttle remains enabled and is covered in unit tests.
+                        with auth.store.transaction() as db: db.execute('DELETE FROM rate_limits')
+                        token, session = auth.new_session(users['operator'])
+                        context = browser.new_context(viewport={'width':width,'height':height}, locale='en-GB', timezone_id='Europe/Berlin', reduced_motion='reduce')
+                        context.add_cookies([{'name':auth.settings.cookie_name, 'value':token, 'url':origin,'secure':True,'httpOnly':True,'sameSite':'Lax'}])
+                        errors = []
+                        mode = {'drop_post':False}
+                        def bridge(url, options):
+                            path = urlsplit(url).path
+                            method = options.get('method', 'GET')
+                            if mode['drop_post'] and method == 'POST' and path.endswith('/credentials'):
+                                mode['post_count'] = mode.get('post_count',0)+1
+                                return {'network_error': True}
+                            headers = {**options.get('headers', {}), 'Origin': origin}
+                            response = server.request(method, path, headers=headers, content=options.get('body'))
+                            return {'status': response.status_code, 'body': response.text}
+                        server.cookies.set(auth.settings.cookie_name, token)
+                        page = context.new_page(); page.on('pageerror', lambda e: errors.append(str(e)))
+                        page.expose_function('_fixtureHTTP', bridge)
+                        def mount(path):
+                            page.goto('about:blank')
+                            content = server.get(path).text
+                            content = re.sub(r'<script[^>]+src="[^"]+"[^>]*></script>', '', content)
+                            content = re.sub(r'<link[^>]+rel="stylesheet"[^>]*>', '', content)
+                            css = args.bootstrap.read_text() + '\n' + '\n'.join((ROOT/'src/aim_webgui/static/css'/n).read_text() for n in ('tokens.css','bootstrap-overrides.css','aim.css','experience.css','credentials.css','evidence.css'))
+                            fixture_js = """
+window.fetch = async function(url, options) {
+ const r=await window._fixtureHTTP(url, options||{});
+ if(r.network_error) throw new TypeError('Synthetic lost response');
+ return new Response(r.body,{status:r.status,headers:{'Content-Type':'application/json'}});
+};
+window.EventSource=class { constructor(){} addEventListener(){} close(){} };
+"""
+                            js='\n'.join((ROOT/'src/aim_webgui/static/js'/n).read_text() for n in ('theme.js','aim.js','experience.js','credentials.js','evidence.js'))
+                            content=content.replace('</head>','<style>'+css+'</style></head>').replace('</body>','<script>'+fixture_js+js+'</script></body>')
+                            page.set_content(content, wait_until='load')
+                        try:
+                            ident = make_job(fixture)
+                            mount('/jobs/'+ident)
+                            page.locator('[data-theme-option='+theme+']:visible').click()
+                            opener = page.locator('[data-credential-open]')
+                            opener.click()
+                            panel = page.locator('dialog [data-credential-panel]'); panel.wait_for()
+                            assert page.locator('dialog').evaluate('(e)=>e.open')
+                            assert page.locator('#credential-dialog-title').evaluate('(e)=>e===document.activeElement')
+                            assert page.locator('[data-key-source-choice]').is_visible()
+                            assert not page.locator('[name="ssh_key_passphrase"]').is_visible()
+                            assert not page.locator('dialog').evaluate('(e)=>e.scrollWidth>e.clientWidth+1')
+                            assert page.evaluate('document.documentElement.scrollWidth<=innerWidth')
+                            box=page.locator('dialog').bounding_box(); assert box['x']>=0 and box['y']>=0 and box['x']+box['width']<=width+1 and box['y']+box['height']<=height+1
+                            # Native modal keeps background inert and cycles focus within dialog.
+                            for _ in range(12):
+                                page.keyboard.press('Tab')
+                                assert page.evaluate("document.querySelector('dialog').contains(document.activeElement)")
+                            page.locator('[name="vault_password"]').fill(SYNTHETIC)
+                            page.locator('button[aria-controls="credential-vault"]').click()
+                            assert page.locator('[name="vault_password"]').get_attribute('type')=='text'
+                            # Poll replacement cannot replace the modal or its typed/revealed input.
+                            page.evaluate("async (job)=>{const r=await fetch('/_partials/jobs/'+job);const html=await r.text();document.getElementById('job-status').outerHTML=html;document.dispatchEvent(new CustomEvent('htmx:afterSwap',{detail:{target:document.getElementById('job-status')}}));}", ident)
+                            assert page.locator('[name="vault_password"]').input_value()==SYNTHETIC
+                            page.locator('label[for="credential-key-separate"]').click()
+                            page.locator('[name="ssh_key_passphrase"]').fill('Synthetic separate key')
+                            page.locator('label[for="credential-key-vault"]').click()
+                            assert page.locator('[name="ssh_key_passphrase"]').input_value()==''
+                            # Revealed input must be cleared on Escape, not just hidden visually.
+                            page.keyboard.press('Escape')
+                            assert not page.locator('dialog').evaluate('(e)=>e.open')
+                            assert page.locator('[data-credential-secret]').count()==0
+                            assert page.locator('[data-credential-open]').evaluate('(e)=>e===document.activeElement')
+                            page.locator('[data-credential-open]').click(); panel.wait_for()
+                            assert page.locator('[name="vault_password"]').input_value()==''
+                            if theme=='dark' and width in (390,1440):
+                                page.screenshot(path=str(args.out/f'credential-dialog-{width}.png'), full_page=False)
+                            start=len(packets)
+                            page.locator('[name="vault_password"]').fill(SYNTHETIC)
+                            page.locator('[data-credential-submit]').click()
+                            page.locator('[data-credential-feedback][data-tone="accepted"]').wait_for()
+                            assert len(packets)==start+1 and packets[-1]['credentials']['vault_password']==SYNTHETIC
+                            assert 'ssh_key_passphrase' not in packets[-1]['credentials']
+                            assert page.locator('[name="vault_password"]').input_value()==''
+                            assert 'accepted' in page.locator('[data-credential-feedback]').inner_text().lower()
+                            assert page.url=='about:blank'
+                            page.locator('[data-credential-dismiss]').click()
+                            assert not page.locator('dialog').evaluate('(e)=>e.open')
+                            # Attention action belongs to this viewer; choose only their credentials.
+                            ident2=make_job(fixture, requirements=['vault_password'])
+                            mount('/jobs')
+                            page.locator('#attention [data-job-id="'+ident2+'"]').click(); panel.wait_for()
+                            assert page.locator('[data-key-source-choice]').count()==0
+                            # Lost acknowledgement: only one POST, then GET reconciliation; no replay.
+                            mode['drop_post']=True;mode['post_count']=0
+                            page.locator('[name="vault_password"]').fill(SYNTHETIC)
+                            page.locator('[data-credential-submit]').click()
+                            page.wait_for_function("document.querySelector('[data-credential-feedback]').textContent.includes('not confirmed')")
+                            page.wait_for_timeout(3500)
+                            assert mode['post_count']==1 and page.locator('[name="vault_password"]').input_value()==''
+                            page.locator('[data-credential-dismiss]').click()
+                            page.locator('#attention [data-job-id="'+ident2+'"]').click();panel.wait_for()
+                            page.wait_for_function("document.querySelector('[data-credential-feedback]').textContent.includes('not been confirmed')")
+                            assert page.locator('[data-credential-submit]').is_hidden()
+                            page.keyboard.press('Escape');mode['drop_post']=False
+                            # Server cancels while the form is open: input is cleared without POST.
+                            ident3=make_job(fixture)
+                            mount('/jobs/'+ident3);page.locator('[data-credential-open]').click();panel.wait_for()
+                            page.locator('[name="vault_password"]').fill(SYNTHETIC)
+                            with auth.store.transaction() as db: db.execute('UPDATE jobs SET cancel_requested=1 WHERE id=?',(ident3,))
+                            page.wait_for_function("document.querySelector('[data-credential-feedback]').textContent.includes('cancellation')")
+                            assert page.locator('[name="vault_password"]').input_value()==''
+                            page.keyboard.press('Escape')
+                            # Short visual viewport is internally scrollable; footer stays reachable.
+                            ident4=make_job(fixture)
+                            mount('/jobs/'+ident4);page.locator('[data-credential-open]').click();panel.wait_for()
+                            page.set_viewport_size({'width':width,'height':min(360,height)})
+                            page.wait_for_timeout(100)
+                            assert page.locator('.credential-dialog-body').evaluate('(e)=>e.scrollHeight>e.clientHeight')
+                            page.locator('[data-credential-submit]').scroll_into_view_if_needed()
+                            box=page.locator('dialog').bounding_box();assert box['y']>=-1 and box['y']+box['height']<=min(360,height)+1
+                            # Page hide clears revealed secrets too. BFCache style re-init never restores them.
+                            page.locator('[name="vault_password"]').fill(SYNTHETIC)
+                            page.locator('button[aria-controls="credential-vault"]').click()
+                            page.evaluate("window.dispatchEvent(new PageTransitionEvent('pagehide'))")
+                            assert page.locator('[data-credential-secret]').count()==0
+                            assert not errors, errors
+                            cases.append({'width':width,'height':height,'theme':theme,'passed':True})
+                            print('Credential QA passed',width,height,theme,flush=True)
+                        finally: context.close()
+                # No-JS native markup and a plain HTTP form POST are verified separately.
+                with auth.store.transaction() as db: db.execute('DELETE FROM rate_limits')
+                token, session = auth.new_session(users['operator'])
+                server.cookies.set(auth.settings.cookie_name, token)
+                ident=make_job(fixture,requirements=['vault_password'])
+                r=server.get('/jobs/'+ident+'/credentials')
+                assert r.status_code==200 and 'method="post"' in r.text
+                r=server.post('/jobs/'+ident+'/credentials', data={'_csrf':session['csrf'],'vault_password':SYNTHETIC},headers={'Origin':origin})
+                assert r.status_code==303 and r.headers['location']=='/jobs/'+ident
+                cases.append({'plain_http_form_fallback':True,'passed':True})
+            finally: browser.close()
+    report={'fixture_only':True,'cases':cases,'asgi_auth_csrf_endpoints':True,'browser_network':'about:blank fetch bridge to real TestClient; no real browser CSP/TLS/cookie transport qualification',
+            'bootstrap_source':str(args.bootstrap),'bootstrap_substitution':'5.3.6, production pin 5.3.8',
+            'htmx_loaded':False,'htmx_swap':'synthetic replacement + lifecycle event',
+            'real_worker_core_execution':False,'browser':'Chromium via Playwright'}
+    (args.out/'results.json').write_text(json.dumps(report,indent=2))
+    print(len(cases),'browser scenario groups passed')
+
+if __name__=='__main__': main()
diff --git a/scripts/addons/webgui/tests/browser_evidence_qa.py b/scripts/addons/webgui/tests/browser_evidence_qa.py
new file mode 100644
index 0000000..24b09fd
--- /dev/null
+++ b/scripts/addons/webgui/tests/browser_evidence_qa.py
@@ -0,0 +1,136 @@
+"""Chromium fixture evidence QA. ASGI GET with simulated EventSource, no native tasks.
+
+Default CSS is the explicitly identified Bootstrap 5.3.6 fixture substitute.
+No fixture stylesheet is copied into the release. HTMX is deliberately unavailable
+unless the operator supplies the pinned asset; this is not proxy/HTTPS acceptance.
+"""
+from pathlib import Path
+import argparse,json,os,socket,sys,tempfile,time,re
+sys.path.insert(0,str(Path(__file__).resolve().parents[1]/'src'))
+from dataclasses import replace
+from fastapi.testclient import TestClient
+from playwright.sync_api import sync_playwright
+from aim_webgui.app import create_app
+from aim_webgui.auth.service import Auth
+from aim_webgui.config import Settings
+from aim_webgui.journal import Journal,project
+from aim_webgui.reports import persist, TITLES
+from evidence_fixtures import declared,sample,plan,result,job,ev
+
+
+def main():
+    p=argparse.ArgumentParser();p.add_argument('--out',type=Path,required=True);p.add_argument('--bootstrap',type=Path,default=Path('/opt/imagemagick/share/doc/ImageMagick-7/www/assets/bootstrap.min.css'));args=p.parse_args();args.out.mkdir(parents=True,exist_ok=True)
+    with tempfile.TemporaryDirectory(prefix='aim-evidence-browser-')as td:
+        state=Path(td)/'state'
+        sock=socket.socket();sock.bind(('127.0.0.1',0));port=sock.getsockname()[1];sock.close()
+        url=f'http://127.0.0.1:{port}'
+        s=Settings(state_dir=state,public_url=url,core_transport='stdio');a=Auth(s);a.bootstrap()
+        with a.store.transaction()as db:
+            db.execute('UPDATE users SET must_change_password=0');uid=db.execute('SELECT id FROM users').fetchone()[0]
+        paths={};jobs={}
+        for name in TITLES:
+            d=declared(name);data=sample(d['data_schema'])
+            if name=='host_capabilities_v1':data['is_unifi_controller']=True
+            if name=='filesystem_usage_v1':
+                data={'platform':'linux','filesystems':[{'name':'/dev/synthetic1','mount':'/','filesystem_type':'ext4','used_bytes':42949672960,'total_bytes':128849018880,'available_bytes':85899345920,'used_percent':33.3,'status':'available'},{'name':'/dev/synthetic2','mount':'/srv/archive','filesystem_type':None,'used_bytes':None,'total_bytes':None,'available_bytes':None,'used_percent':None,'status':'unavailable'}]}
+            ident=job(a,uid,plan(d),status='successful');r=result(d,report_data=data)
+            with a.store.transaction()as db:
+                small=persist(db,s,ident,plan(d),r)
+                db.execute('UPDATE jobs SET core_result=?,finished_at=? WHERE id=?',(json.dumps(small),time.time(),ident))
+            paths[name]='/jobs/'+ident+'/reports';jobs[name]=ident
+        running=job(a,uid,plan(declared()),status='running');j=Journal(s);j.begin(running)
+        def add(start,end):j.append(running,[(*project(ev(i),{'test01.example'}),time.time())for i in range(start,end+1)])
+        add(1,300)
+        paths['progress']='/jobs/'+running
+        client=TestClient(create_app(s),base_url=url)
+        token,_=a.new_session(uid);client.cookies.set(s.cookie_name,token);records=[]
+        static=Path(__file__).resolve().parents[1]/'src/aim_webgui/static'
+        def html(path):
+            response=client.get(path);assert response.status_code==200,(path,response.text[:400])
+            text=response.text
+            def css(m):
+                name=m.group(1).split('?')[0]
+                source=args.bootstrap if 'bootstrap.min.css' in name else static/name.removeprefix('/static/')
+                return '<style>'+source.read_text()+'</style>'
+            def js(m):
+                name=m.group(1).split('?')[0]
+                if 'htmx.min.js'in name:return ''
+                source=static/name.removeprefix('/static/')
+                return '<script>'+source.read_text()+'</script>'
+            text=re.sub(r'<link[^>]+href="(/static/[^"]+\.css(?:\?[^"]*)?)"[^>]*>',css,text)
+            text=re.sub(r'<script[^>]+src="(/static/[^"]+\.js(?:\?[^"]*)?)"[^>]*></script>',js,text)
+            return text
+        def bridge_read(source,path):
+            response=client.get(path)
+            return {'status':response.status_code,'text':response.text}
+        fixture_js="""
+            window.__sources=[];
+            window.fetch=async function(url,opts){const r=await window.fixtureRead(String(url));return {ok:r.status>=200&&r.status<300,status:r.status,json:async()=>JSON.parse(r.text),text:async()=>r.text};};
+            window.EventSource=class{constructor(url){this.url=url;this.listeners={};window.__sources.push(this);setTimeout(()=>this.emit('open',{}),0);}addEventListener(k,f){this.listeners[k]=f;}close(){this.closed=true;}emit(k,d){if(this.listeners[k]&&!this.closed)this.listeners[k]({data:JSON.stringify(d)});}};
+            window.__emit=function(kind,data){window.__sources.forEach(s=>s.emit(kind,data));};
+        """
+        def mount(page,path):
+            content=html(path)
+            page.set_content(content.replace('<head>','<head><script>'+fixture_js+'</script>'),wait_until='domcontentloaded')
+        def emit(page,start):
+            data=j.snapshot(uid,running,after=start)
+            page.evaluate('(d)=>window.__emit("snapshot",d)',data)
+            for row in data['events']:page.evaluate('(r)=>window.__emit("line",{record:r,text:r.text})',row)
+        try:
+            with sync_playwright()as p:
+                browser=p.chromium.launch(executable_path=os.environ.get('AIM_BROWSER_EXECUTABLE','/usr/bin/chromium'),args=['--no-sandbox'])
+                for w,h in ((320,750),(390,844),(760,900),(1440,1000),(740,390)):
+                    for theme in ('light','dark'):
+                        ctx=browser.new_context(viewport={'width':w,'height':h},reduced_motion='reduce')
+                        ctx.add_cookies([{'name':s.cookie_name,'value':token,'url':url}])
+                        ctx.add_init_script("localStorage.setItem('aim-web-display-theme',"+json.dumps(theme)+");")
+                        page=ctx.new_page();page.expose_binding("fixtureRead",bridge_read);errors=[];page.on('pageerror',lambda e:errors.append(str(e)))
+                        for name,path in paths.items():
+                            print('Browser',name,w,h,theme,flush=True)
+                            mount(page,path);page.evaluate("(t)=>document.querySelectorAll('[data-theme-option]').forEach(b=>{if(b.dataset.themeOption===t)b.click()})",theme);page.wait_for_timeout(120)
+                            assert page.locator('h1').count()==1,(name,page.content()[:300])
+                            assert page.evaluate('document.documentElement.scrollWidth<=innerWidth+1'),(name,w,h,'horizontal overflow')
+                            if name=='progress':
+                                page.wait_for_function("document.querySelector('[data-journal-output]').textContent.includes('Synthetic task 300')")
+                                box=page.locator('[data-journal-output]');height=box.evaluate('(e)=>e.clientHeight')
+                                assert height<h and box.evaluate('(e)=>e.scrollHeight>e.clientHeight')
+                            else:
+                                box=page.locator('[data-report-json]');box.locator('summary').click();page.wait_for_function("document.querySelector('[data-json-status]').textContent.includes('Retained')")
+                                assert page.locator('[data-json-output]').inner_text() not in ('','null'),name
+                                if name=='checkmk_user_config_v1':assert 'full configuration sections were not retained' in page.locator('body').inner_text()
+                            records.append({'page':name,'width':w,'height':h,'theme':theme,'passed':True})
+                            if (w==1440 and theme=='dark' and name in ('host_capabilities_v1','filesystem_usage_v1')) or(w==390 and theme=='dark' and name in ('host_capabilities_v1','progress')):
+                                page.evaluate('window.scrollTo(0,0)');page.wait_for_timeout(80);page.screenshot(path=str(args.out/f'{name}-{w}-{theme}.png'),full_page=True)
+                        assert not errors,errors
+                        ctx.close()
+                # Two independent browser sessions, HTTP snapshots and real EventSource.
+                ctx1=browser.new_context();ctx2=browser.new_context()
+                for ctx in (ctx1,ctx2):ctx.add_cookies([{'name':s.cookie_name,'value':token,'url':url}])
+                one=ctx1.new_page();two=ctx2.new_page()
+                for page in(one,two):page.expose_binding('fixtureRead',bridge_read)
+                for page in (one,two):mount(page,paths['progress'])
+                for page in (one,two):page.wait_for_function("document.querySelector('[data-journal-output]').textContent.includes('Synthetic task 300')")
+                add(301,310)
+                for page in(one,two):emit(page,300)
+                for page in(one,two):page.wait_for_function("document.querySelector('[data-journal-output]').textContent.includes('Synthetic task 310')")
+                mount(one,paths['progress']);one.wait_for_function("document.querySelector('[data-journal-output]').textContent.includes('Synthetic task 310')")
+                add(311,320)
+                for page in(one,two):emit(page,310)
+                for page in(one,two):page.wait_for_function("document.querySelector('[data-journal-output]').textContent.includes('Synthetic task 320')")
+                assert one.locator('[data-journal-output]').inner_text().count('Synthetic task 320')==1
+                # Manual upward scrolling pauses following without moving the page.
+                one.locator('[data-journal-output]').evaluate('(e)=>{e.scrollTop=0;e.dispatchEvent(new Event("scroll"));}')
+                assert not one.locator('[data-journal-follow]').is_checked()
+                position=one.evaluate('scrollY');add(321,321);emit(one,320);emit(two,320);one.wait_for_timeout(700)
+                assert one.evaluate('scrollY')==position
+                with a.store.transaction()as db:db.execute("UPDATE jobs SET status='successful',finished_at=? WHERE id=?",(time.time(),running))
+                for page in(one,two):page.evaluate('()=>window.__emit("end",{cursor:321,job_status:"successful"})')
+                for page in(one,two):page.wait_for_function("document.querySelector('[data-journal-state]').textContent.includes('Ended')")
+                mount(one,paths['progress']);one.wait_for_function("document.querySelector('[data-journal-output]').textContent.includes('Synthetic task 321')")
+                records.append({'scenario':'two fixture views remount replay final reread internal follow','passed':True})
+                ctx1.close();ctx2.close();browser.close()
+        finally:client.close()
+        (args.out/'results.json').write_text(json.dumps({'fixture':'ASGI-backed reads, synthetic EventSource/remount; Bootstrap5.3.6 substitute; no HTMX/HTTPS/native operations','results':records},indent=2))
+        print(len(records),'browser cases passed')
+
+if __name__=='__main__':main()
diff --git a/scripts/addons/webgui/tests/browser_patch_qa.py b/scripts/addons/webgui/tests/browser_patch_qa.py
new file mode 100644
index 0000000..a8845c8
--- /dev/null
+++ b/scripts/addons/webgui/tests/browser_patch_qa.py
@@ -0,0 +1,137 @@
+"""New rc4 ASGI-backed browser fixtures with synthetic retained reports.
+
+Bootstrap5.3.6 is a declared fixture substitute; HTMX is not loaded. This does not
+qualify production HTTPS/proxy traffic or native Ansible/Windows Update behavior.
+No substituted browser asset is copied to the release static/vendor directory.
+"""
+from __future__ import annotations
+from dataclasses import replace
+from pathlib import Path
+import argparse
+import json
+import re
+import sys
+import tempfile
+import time
+
+ROOT=Path(__file__).resolve().parents[1]
+sys.path.insert(0,str(ROOT/'src'))
+from playwright.sync_api import sync_playwright
+from fastapi.testclient import TestClient
+from aim_webgui.app import create_app
+from aim_webgui.auth.service import Auth
+from aim_webgui.reports import persist
+from conftest import core_root as core_fixture, settings as settings_fixture
+from evidence_fixtures import declared, plan, result, job
+from patch_fixtures import patch_data, update_failure
+
+
+def main():
+    parser=argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--out',type=Path,required=True)
+    parser.add_argument('--bootstrap',type=Path,default=Path('/opt/imagemagick/share/doc/ImageMagick-7/www/assets/bootstrap.min.css'))
+    args=parser.parse_args();args.out.mkdir(parents=True,exist_ok=True)
+    records=[]
+    with tempfile.TemporaryDirectory(prefix='aim-rc4-patch-browser-') as tmp:
+        root=Path(tmp);core=core_fixture.__wrapped__(root);base=settings_fixture.__wrapped__(root,core)
+        url=base.public_url
+        settings=replace(base,public_url=url,execution_enabled=False,execution_transport_verified=False,credentials_enabled=False)
+        a=Auth(settings);a.bootstrap()
+        with a.store.transaction() as db:
+            db.execute('UPDATE users SET must_change_password=0');uid=db.execute('SELECT id FROM users').fetchone()[0]
+        d=declared('patch_summary_v1');paths={}
+        scenarios={
+            'next-wave':patch_data(),
+            'pending':patch_data(remaining_updates_known=True,reboot_performed=False,pending=[
+                {'name':'Synthetic security update','identifier':'fixture-pending','kb':['KB0000002']}]),
+            'failed-update':patch_data(complete=False,blocked_reason='install_not_allowed',failed_updates=[update_failure()]),
+            'reboot-deferred':patch_data(reboot_deferred=True,reboot_performed=False,reboot_required=True,reboot_required_after=True),
+        }
+        for name,content in scenarios.items():
+            p=plan(d,['win01.example']);p['playbook']='maintenance_patch_os';p['core_request']['playbook']=p['playbook']
+            failed=name=='failed-update'
+            ident=job(a,uid,p,status='failed' if failed else 'successful')
+            r=result(d,hosts=p['targets'],report_data=content,status='failed' if failed else 'succeeded')
+            if failed:
+                r.update(stage='execution',exit_code=2,error={'code':'playbook_failed','message':'Synthetic task failed','stage':'execution'})
+                r['targets'][0]['outcome']='failed';r['targets'][0]['counts']['failures']=1;r['counts']['failures']=1
+                r['target_summary'].update(successful=0,failed=1)
+            with a.store.transaction() as db:
+                small=persist(db,settings,ident,p,r)
+                db.execute('UPDATE jobs SET core_result=?,finished_at=? WHERE id=?',(json.dumps(small),time.time(),ident))
+            paths[name]=f'/jobs/{ident}/reports'
+        client=TestClient(create_app(settings),base_url=url)
+        token,_=a.new_session(uid);client.cookies.set(settings.cookie_name,token)
+        pages={}
+        def bridge_read(source,path):
+            response=client.get(path)
+            return {'status':response.status_code,'text':response.text}
+        def mount(page,path):
+            if path not in pages:
+                response=client.get(path);assert response.status_code==200,(path,response.text[:500])
+                content=response.text
+                def css(match):
+                    name=match.group(1).split('?')[0]
+                    source=args.bootstrap if name.endswith('bootstrap.min.css') else ROOT/'src/aim_webgui'/name.lstrip('/')
+                    return '<style>'+source.read_text()+'</style>'
+                def js(match):
+                    name=match.group(1).split('?')[0]
+                    if 'htmx.min.js' in name:return ''
+                    return '<script>'+(ROOT/'src/aim_webgui'/name.lstrip('/')).read_text()+'</script>'
+                content=re.sub(r'<link[^>]+href="(/static/[^"]+\.css(?:\?[^"]*)?)"[^>]*>',css,content)
+                content=re.sub(r'<script[^>]+src="(/static/[^"]+\.js(?:\?[^"]*)?)"[^>]*></script>',js,content)
+                fixture="""<script>window.fetch=async function(url,opts){const r=await window.fixtureRead(String(url));return {ok:r.status>=200&&r.status<300,status:r.status,json:async()=>JSON.parse(r.text),text:async()=>r.text};};</script>"""
+                pages[path]=content.replace('<head>','<head>'+fixture)
+            page.set_content(pages[path],wait_until='domcontentloaded')
+        try:
+            with sync_playwright() as pw:
+                browser=pw.chromium.launch(executable_path='/usr/bin/chromium',args=['--no-sandbox','--disable-dev-shm-usage'])
+                try:
+                    for width,height in ((320,750),(390,844),(760,900),(1440,1000),(740,390)):
+                        for theme in ('light','dark'):
+                            context=browser.new_context(viewport={'width':width,'height':height},locale='en-GB',timezone_id='Europe/Berlin',reduced_motion='reduce')
+                            page=context.new_page();page.expose_binding('fixtureRead',bridge_read);errors=[];page.on('pageerror',lambda exc:errors.append(str(exc)))
+                            for name,path in paths.items():
+                                mount(page,path)
+                                page.locator('[data-theme-option='+theme+']:visible').click()
+                                assert page.evaluate('document.documentElement.scrollWidth<=innerWidth+1'),(name,width,height)
+                                assert page.locator('.patch-wave-panel').is_visible()
+                                if name=='next-wave':
+                                    assert 'Another patch run needs review' in page.locator('.patch-wave-panel').inner_text()
+                                    assert 'Final pending list not established' in page.locator('#report-pending').inner_text()
+                                    assert '0 entries' not in page.locator('#report-pending').inner_text()
+                                elif name=='pending':
+                                    assert 'final read-only discovery' in page.locator('#report-pending').inner_text()
+                                    assert 'Synthetic security update' in page.locator('#report-pending').inner_text()
+                                elif name=='failed-update':
+                                    assert '0x80240016' in page.locator('#report-failed_updates').inner_text()
+                                    assert 'does not by itself prove a pending reboot' in page.locator('.patch-wave-panel').inner_text()
+                                page.locator('[data-report-json] summary').click()
+                                page.wait_for_function("document.querySelector('[data-json-status]').textContent.includes('Retained')")
+                                stored=json.loads(page.locator('[data-json-output]').inner_text())
+                                assert stored==scenarios[name] or stored.get('data')==scenarios[name]
+                                if name=='next-wave' and width in(390,1440) and theme=='dark':
+                                    page.locator('[data-report-json] summary').click();page.evaluate('window.scrollTo(0,0)')
+                                    page.screenshot(path=str(args.out/f'patch-wave-{width}-dark.png'),full_page=True)
+                                records.append({'page':name,'width':width,'height':height,'theme':theme,'passed':True})
+                            mount(page,'/plan?customer=example&playbook=maintenance_patch_os')
+                            page.locator('[data-theme-option='+theme+']:visible').click()
+                            option=page.locator('[name="option.os_patching_rescan_after_reboot"]')
+                            assert option.input_value()=='' and 'catalog hint: false' in option.inner_text()
+                            option.select_option('false')
+                            page.locator('[name="option.os_patching_reboot_delay_minutes"]').fill('10')
+                            page.locator('[name="option.os_patching_reboot_message"]').fill('Synthetic approved maintenance')
+                            assert page.evaluate('document.documentElement.scrollWidth<=innerWidth+1')
+                            records.append({'page':'catalog patch options','width':width,'height':height,'theme':theme,'passed':True})
+                            assert not errors,errors
+                            context.close()
+                finally:browser.close()
+        finally:
+            client.close()
+    evidence={'cases':records,'count':len(records),'real_local_http_and_fetch':False,'asgi_bridge':True,'production_https_tested':False,
+        'bootstrap_substitute':'5.3.6 for pinned5.3.8','htmx_loaded':False,'native_updates_executed':False,
+        'source':'synthetic retained data; real public Core catalog/discovery; about:blank fetch bridge to ASGI TestClient'}
+    (args.out/'results.json').write_text(json.dumps(evidence,indent=2)+'\n')
+    print(len(records),'patch UI cases passed')
+
+if __name__=='__main__':main()
diff --git a/scripts/addons/webgui/tests/browser_qa.py b/scripts/addons/webgui/tests/browser_qa.py
new file mode 100644
index 0000000..99ab204
--- /dev/null
+++ b/scripts/addons/webgui/tests/browser_qa.py
@@ -0,0 +1,191 @@
+"""Optional Chromium fixture QA, not deployment/remote/production-HTMX acceptance.
+
+Uses the real supplied Core for discovery against a temporary synthetic inventory.
+The external assets are embedded only in about:blank test documents. With no pinned
+assets available, --bootstrap (or the local default) is a declared substitute.
+No substitutions are written into production static/vendor.
+"""
+from pathlib import Path
+import argparse
+import json
+import re
+import sys
+import tempfile
+import time
+sys.path.insert(0,str(Path(__file__).resolve().parents[1]/'src'))
+from fastapi.testclient import TestClient
+from playwright.sync_api import sync_playwright
+from aim_webgui.app import create_app
+from aim_webgui.auth.service import Auth
+from conftest import core_root as core_fixture, settings as settings_fixture
+from test_read_experience import add_job
+
+ROOT=Path(__file__).resolve().parents[1]
+
+
+def main():
+    parser=argparse.ArgumentParser()
+    parser.add_argument('--out',type=Path,required=True)
+    parser.add_argument('--bootstrap',type=Path,default=Path('/opt/imagemagick/share/doc/ImageMagick-7/www/assets/bootstrap.min.css'))
+    args=parser.parse_args();args.out.mkdir(parents=True,exist_ok=True)
+    results=[];screenshots=[]
+    with tempfile.TemporaryDirectory(prefix='aim-browser-readonly-') as tmp:
+        tmp=Path(tmp);core=core_fixture.__wrapped__(tmp);settings=settings_fixture.__wrapped__(tmp,core)
+        (core/'inventories/example/hosts.yml').write_text('''all:
+  children:
+    example:
+      hosts:
+        edge-01.example:
+          ansible_host: 192.0.2.1
+      children:
+        linux:
+          hosts:
+            api-01.example:
+              ansible_host: 192.0.2.10
+            api-02.example:
+              ansible_host: 192.0.2.11
+          children:
+            database:
+              hosts:
+                db-01.example:
+                  ansible_host: 192.0.2.12
+                db-02.example:
+                  ansible_host: 192.0.2.13
+        windows:
+          hosts:
+            desktop-01.example:
+              ansible_host: 192.0.2.20
+          children:
+            servers:
+              hosts:
+                mail-01.example:
+                  ansible_host: 192.0.2.21
+                app-01.example:
+                  ansible_host: 192.0.2.22
+        staging:
+          hosts:
+            api-02.example: {}
+''')
+        print('Fixture core ready',flush=True)
+        auth=Auth(settings);auth.bootstrap()
+        print('Fixture auth ready',flush=True)
+        with auth.store.transaction() as db:
+            db.execute("UPDATE users SET must_change_password=0 WHERE username='admin'")
+            uid=db.execute("SELECT id FROM users WHERE username='admin'").fetchone()[0]
+        now=int(time.time())
+        hosts=['api-01.example','api-02.example','db-01.example','db-02.example','desktop-01.example','mail-01.example','app-01.example']
+        for i in range(18):
+            facts={h:('unreachable' if i%4==0 and h=='db-02.example' else 'successful') for h in hosts}
+            add_job(auth,owner='admin',book=['checkmk_install_agent','debug_test_connection','maintenance_patch_os'][i%3],
+                    hosts=facts,status='failed' if i%4==0 else 'successful',when=now-3600*(i+1))
+        active=add_job(auth,owner='admin',status='running',hosts={'api-01.example':'successful'})
+        token,session=auth.new_session(uid)
+        paths={'overview':'/','new-run':'/plan?customer=example&playbook=debug_test_connection',
+               'explorer':'/inventory/example/explore','map':'/inventory/example/explore?view=map',
+               'branch':'/inventory/example/explore?view=map&branch=%5B%22linux%22%5D',
+               'activity':'/inventory/example/activity?host=api-01.example',
+               'insights':'/insights?customer=example','audit':'/audit'}
+        pages={}
+        with TestClient(create_app(settings),base_url=settings.public_url) as client:
+            client.cookies.set(settings.cookie_name,token)
+            for name,path in paths.items():
+                print('Render',name,path,flush=True)
+                response=client.get(path);assert response.status_code==200,(name,response.text)
+                pages[name]=response.text
+            # Every SVG host link really points to an authenticated host page, not an action.
+            import html
+            links=re.findall(r'<a href="([^"]+)" class="graph-node graph-host"',pages['map'])
+            assert links
+            for link in links:
+                assert client.get(html.unescape(link)).status_code==200
+        (args.out/'html').mkdir(exist_ok=True)
+        for name,content in pages.items(): (args.out/'html'/(name+'.html')).write_text(content)
+        def inline(content):
+            def css(m):
+                path=m.group(1).split('?')[0]
+                file=args.bootstrap if path.endswith('bootstrap.min.css') else ROOT/'src/aim_webgui'/path.lstrip('/')
+                return '<style>'+file.read_text()+'</style>'
+            content=re.sub(r'<link rel="stylesheet" href="([^"]+)"[^>]*>',css,content)
+            content=re.sub(r'<script src="[^"]+"[^>]*></script>','',content)
+            fixture='''window.fetch=async()=>({ok:true,json:async()=>({saved:true})});
+window.__sources=[]; window.EventSource=class {
+  static CLOSED=2; constructor(url){this.url=url;this.readyState=1;this.handlers={};window.__sources.push(this);}
+  addEventListener(k,fn){this.handlers[k]=fn;} close(){this.readyState=2;}
+  emit(k,text){if(this.handlers[k])this.handlers[k]({data:JSON.stringify({text})});}
+};'''
+            script='\n'.join((ROOT/'src/aim_webgui/static/js'/x).read_text() for x in ('theme.js','aim.js','experience.js','credentials.js'))
+            return content.replace('</body>','<script>'+fixture+script+'</script></body>')
+        with sync_playwright() as pw:
+            browser=pw.chromium.launch(executable_path='/usr/bin/chromium',headless=True,args=['--no-sandbox','--disable-dev-shm-usage'])
+            try:
+                for width,height in ((320,750),(390,844),(760,900),(1440,1000),(740,390)):
+                    for theme in ('light','dark'):
+                        context=browser.new_context(viewport={'width':width,'height':height},locale='de-DE',timezone_id='Europe/Berlin',reduced_motion='reduce')
+                        errors=[]
+                        for name,content in pages.items():
+                            print('QA',width,height,theme,name,flush=True)
+                            page=context.new_page();page.on('pageerror',lambda e:errors.append(str(e)))
+                            page.set_content(inline(content),wait_until='load')
+                            page.locator('[data-theme-option='+theme+']:visible').click()
+                            page.wait_for_timeout(100)
+                            assert page.evaluate('document.documentElement.scrollWidth<=innerWidth'),(name,width,height,'overflow')
+                            if width<=760:
+                                assert not page.locator('.sidebar').is_visible()
+                                toggle=page.locator('[data-mobile-menu] summary');toggle.focus();page.keyboard.press('Enter')
+                                assert page.locator('[data-mobile-menu]').get_attribute('open') is not None
+                                assert page.locator('#mobile-navigation').get_by_role('link',name='Playbook insights',exact=True).is_visible()
+                                page.keyboard.press('Escape')
+                                assert page.locator('[data-mobile-menu]').get_attribute('open') is None
+                                assert toggle.evaluate('(e)=>e===document.activeElement')
+                                a=page.locator('.mobile-brand').bounding_box();b=page.locator('.mobile-actions .theme-control').bounding_box();c=toggle.bounding_box()
+                                assert abs((a['y']+a['height']/2)-(c['y']+c['height']/2))<2
+                                assert abs((b['y']+b['height']/2)-(c['y']+c['height']/2))<2
+                                assert b['x']+b['width']<=c['x'] and c['x']+c['width']<=width
+                                assert page.locator('.mobile-topbar').bounding_box()['height']<80
+                                assert page.locator('[data-nav-forward]').count()==0
+                            else:
+                                assert page.locator('.sidebar').is_visible() and not page.locator('.mobile-topbar').is_visible()
+                            if name=='explorer':
+                                assert page.locator('.explorer-map').is_visible()==(width>760)
+                            if name=='map':
+                                graph=page.locator('[data-inventory-graph]');old=float(graph.get_attribute('width'))
+                                page.locator('[data-graph-zoom="in"]').click()
+                                assert float(graph.get_attribute('width'))>old
+                                page.locator('[data-graph-zoom="reset"]').click()
+                                assert page.locator('svg .graph-host').count()>0
+                                assert page.locator('.inventory-canvas').evaluate('(e)=>e.scrollHeight>=e.clientHeight')
+                            if name=='insights':
+                                assert page.locator('.matrix-mobile').is_visible()==(width<=760)
+                            if name=='new-run':
+                                page.locator('[data-select-all-hosts]').check()
+                                assert page.locator('[data-host-target]:checked').count()==7
+                            if name=='job':
+                                output=page.locator('[data-console-output]');output.scroll_into_view_if_needed();before=page.evaluate('scrollY')
+                                page.evaluate("()=>{for(let i=0;i<240;i++)window.__sources[0].emit('line','TASK [Synthetic fixture '+i+']');}")
+                                page.wait_for_timeout(100)
+                                assert output.evaluate('(e)=>e.scrollTop>0 && e.scrollHeight>e.clientHeight')
+                                assert abs(page.evaluate('scrollY')-before)<3
+                                output.evaluate('(e)=>e.scrollTop=0');page.wait_for_timeout(100)
+                                assert not page.locator('[data-console-autoscroll]').is_checked()
+                                page.locator('[data-console-autoscroll]').check();page.wait_for_timeout(100)
+                                assert output.evaluate('(e)=>e.scrollTop>0')
+                            if name in ('map','activity','insights','explorer') and width in (390,1440) and theme=='dark':
+                                page.evaluate('scrollTo(0,0)');file=f'{name}-{width}-{theme}.png';page.screenshot(path=str(args.out/file),full_page=True);screenshots.append(file)
+                                if name=='activity':
+                                    shot=f'activity-{width}-viewport.png';page.screenshot(path=str(args.out/shot),full_page=False);screenshots.append(shot)
+                            if name=='overview' and width==390 and theme=='dark':
+                                page.locator('[data-mobile-menu] summary').click();page.screenshot(path=str(args.out/'mobile-menu.png'),full_page=False);screenshots.append('mobile-menu.png')
+                            # Formatter includes an HTMX-replaced <time> root itself.
+                            page.evaluate("()=>{let t=document.createElement('time');t.className='js-local-time';t.dateTime='2026-09-19T07:00:00Z';t.textContent='UTC-FALLBACK';document.querySelector('main').append(t);document.dispatchEvent(new CustomEvent('htmx:afterSwap',{detail:{target:t}}));}")
+                            assert 'UTC-FALLBACK' not in page.locator('main > time').last.inner_text()
+                            results.append({'page':name,'width':width,'height':height,'theme':theme,'passed':True});page.close()
+                        assert not errors,errors
+                        context.close()
+            finally:browser.close()
+    report={'fixture_only':True,'bootstrap_source':str(args.bootstrap),'htmx_loaded':False,'real_remote_execution':False,
+            'cases':results,'screenshots':screenshots}
+    (args.out/'results.json').write_text(json.dumps(report,indent=2))
+    print(f'{len(results)} browser fixture cases passed. No live HTMX/TLS/remote qualification.')
+
+if __name__=='__main__':
+    main()
diff --git a/scripts/addons/webgui/tests/conftest.py b/scripts/addons/webgui/tests/conftest.py
new file mode 100644
index 0000000..b587939
--- /dev/null
+++ b/scripts/addons/webgui/tests/conftest.py
@@ -0,0 +1,57 @@
+from pathlib import Path
+from dataclasses import replace
+import grp
+import os
+import shutil
+import sys
+import pytest
+
+from aim_webgui.config import Settings
+from aim_webgui.auth.service import Auth
+
+@pytest.fixture
+def core_root(tmp_path):
+    source=os.environ.get('AIM_TEST_CORE_ROOT')
+    if not source: pytest.skip('Set AIM_TEST_CORE_ROOT to the extracted unmodified AIM 3.3.0rc8 source bundle.')
+    root=tmp_path/'core'
+    shutil.copytree(source,root,ignore=shutil.ignore_patterns('__pycache__','*.pyc'))
+    config=root/'scripts/aim.yml'
+    config.write_text(f'root_dir: {root}\nservice_user: svc_bf-ansible\nrequired_group: {grp.getgrgid(os.getegid()).gr_name}\naddons:\n  execution_enabled: true\n')
+    customer=root/'inventories/example';customer.mkdir(parents=True)
+    (customer/'hosts.yml').write_text('''all:
+  children:
+    example:
+      children:
+        linux:
+          children:
+            lab:
+              hosts:
+                test01.example:
+                  ansible_host: 192.0.2.1
+        windows:
+          hosts:
+            win01.example:
+              ansible_host: 192.0.2.2
+''')
+    (customer/'group_vars/all').mkdir(parents=True)
+    (customer/'group_vars/linux/.ssh').mkdir(parents=True)
+    return root
+
+@pytest.fixture
+def settings(tmp_path,core_root):
+    return Settings(aim_scripts=core_root/'scripts', state_dir=tmp_path/'state',
+          core_transport='stdio',core_command=(sys.executable,str(core_root/'scripts/aimctl.py')),
+          core_config=core_root/'scripts/aim.yml',host='127.0.0.1',public_url='https://aim.example.test',
+          execution_enabled=True,execution_playbooks=('debug_test_connection','debug_detect_host_roles'),
+          execution_require_approval=False,execution_transport_verified=True,credentials_enabled=True).validate()
+
+@pytest.fixture
+def auth(settings):
+    a=Auth(settings);a.bootstrap()
+    with a.store.transaction() as db:
+        db.execute("UPDATE users SET must_change_password=0 WHERE username='admin'")
+    return a
+
+@pytest.fixture
+def admin(auth):
+    with auth.store.read() as db:return db.execute("SELECT id FROM users WHERE username='admin'").fetchone()[0]
diff --git a/scripts/addons/webgui/tests/evidence_fixtures.py b/scripts/addons/webgui/tests/evidence_fixtures.py
new file mode 100644
index 0000000..6f5f526
--- /dev/null
+++ b/scripts/addons/webgui/tests/evidence_fixtures.py
@@ -0,0 +1,68 @@
+"""Synthetic fixture data only; no controller inventory or real report observations."""
+from pathlib import Path
+import json,os,time,uuid
+from ruamel.yaml import YAML
+from aim_webgui.core.protocol import COUNTS
+
+
+def declared(name='host_capabilities_v1',scope='per_host'):
+    source=Path(os.environ['AIM_TEST_CORE_ROOT'])/'playbooks/schemas'/f'{name}.yml'
+    schema=YAML(typ='safe').load(source.read_text())
+    return {'protocol':'aim_output_v1','schema':name,'scope':scope,'required':True,'sensitivity':'safe',
+            'max_bytes_per_host':1048576,'data_schema':schema}
+
+
+def sample(schema):
+    t=schema['type']
+    if isinstance(t,list):t='null' if 'null' in t else t[0]
+    if 'enum' in schema:return schema['enum'][0]
+    if t=='object':return {k:sample(v) for k,v in schema['properties'].items()}
+    if t=='array':return []
+    if t=='boolean':return False
+    if t=='integer':return int(schema.get('minimum',0))
+    if t=='number':return float(schema.get('minimum',0))
+    if t=='null':return None
+    return 'synthetic'
+
+
+def plan(declaration=None,hosts=None):
+    hosts=hosts or ['test01.example']
+    req={'customer':'example','playbook':'debug_detect_host_roles','hosts':hosts,'overrides':{},'check':False,
+         'key_mode':'none','become_password':False,'timeout_seconds':30,'progress_mode':'detail'}
+    return {'customer':'example','playbook':req['playbook'],'targets':hosts,'overrides':{},'result_contract':declaration,
+            'core_request':req,'core_version':'3.3.0rc8','core_api':'1.0','core_revision':'a'*64,'inventory_revision':'a'*64,
+            'credential_requirements':[],'authentication':{'mode':'inventory','key_mode':'none'}}
+
+
+def result(declaration=None,hosts=None,*,availability='available',status='succeeded',report_data=None):
+    hosts=hosts or ['test01.example'];counts=dict.fromkeys(COUNTS,0);counts['ok']=3
+    report=None
+    if declaration is not None:
+        data=sample(declaration['data_schema']) if report_data is None else report_data
+        entry={'schema':declaration['schema'],'status':availability,'data':data if availability=='available' else None,'error':None}
+        report={'protocol':'aim_operation_result_v1','schema':declaration['schema'],'scope':declaration['scope'],
+                'required':True,'complete':availability=='available','check_mode':False,
+                'hosts':{h:dict(entry) for h in hosts} if declaration['scope']=='per_host' else {},
+                'global':dict(entry) if declaration['scope']=='global' else None}
+    return {'api_version':'1.0','run_id':'fixture-run','status':status,'stage':'completed' if status=='succeeded' else 'result_validation',
+            'exit_code':0,'remote_work_may_have_started':True,'counts':counts,
+            'error':None if status=='succeeded' else {'code':'operation_result_missing','message':'Required report missing','stage':'result_validation'},
+            'target_summary':{'schema':'target_outcome_summary_v1','requested':len(hosts),'accounted':len(hosts),
+                'successful':len(hosts),'failed':0,'unreachable':0,'not_started':0,'indeterminate':0,'complete':True},
+            'targets':[{'host':h,'outcome':'successful','counts':dict(counts)} for h in hosts],'operation_result':report}
+
+
+def job(auth,owner,p=None,*,status='running'):
+    ident=uuid.uuid4().hex;p=p or plan()
+    with auth.store.transaction() as db:
+        db.execute('''INSERT INTO jobs(id,owner_id,plan,mode,status,scheduled_at,created_at) VALUES(?,?,?,?,?,?,?)''',
+            (ident,owner,json.dumps(p),'apply',status,int(time.time()),int(time.time())))
+    return ident
+
+
+def ev(seq,kind='task_started',**extra):
+    data={'event_version':'1.0','run_id':'fixture-run','sequence':seq,'timestamp':'2026-09-20T10:00:00Z','kind':kind}
+    if kind=='task_started':data.update(play_id='p1',task_id='t'+str(seq),label='Synthetic task '+str(seq),label_redacted=False,handler=False)
+    if kind=='host_result':data.update(play_id='p1',task_id='t1',host='test01.example',host_redacted=False,status='ok',changed=False,ignored=False,details_redacted=False,error=None)
+    if kind=='stage':data['stage']='execution'
+    data.update(extra);return data
diff --git a/scripts/addons/webgui/tests/fixtures/patch-summary-rc1.json b/scripts/addons/webgui/tests/fixtures/patch-summary-rc1.json
new file mode 100644
index 0000000..a22c024
--- /dev/null
+++ b/scripts/addons/webgui/tests/fixtures/patch-summary-rc1.json
@@ -0,0 +1,214 @@
+{
+  "type": "object",
+  "properties": {
+    "platform": {
+      "type": "string",
+      "maxLength": 128,
+      "enum": [
+        "windows",
+        "debian",
+        "redhat"
+      ]
+    },
+    "mode": {
+      "type": "string",
+      "maxLength": 128,
+      "enum": [
+        "apply",
+        "check"
+      ]
+    },
+    "evidence": {
+      "type": "string",
+      "maxLength": 128,
+      "enum": [
+        "package_snapshots",
+        "windows_update_result"
+      ]
+    },
+    "complete": {
+      "type": "boolean"
+    },
+    "updates": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "maxLength": 1024
+          },
+          "identifier": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "maxLength": 1024
+          },
+          "architecture": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "maxLength": 1024
+          },
+          "old_versions": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "maxLength": 1024
+            },
+            "maxItems": 100
+          },
+          "new_versions": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "maxLength": 1024
+            },
+            "maxItems": 100
+          },
+          "action": {
+            "type": "string",
+            "maxLength": 128,
+            "enum": [
+              "updated",
+              "installed",
+              "removed"
+            ]
+          },
+          "kb": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "maxLength": 1024
+            },
+            "maxItems": 100
+          }
+        },
+        "required": [
+          "name",
+          "identifier",
+          "architecture",
+          "old_versions",
+          "new_versions",
+          "action",
+          "kb"
+        ],
+        "additionalProperties": false
+      },
+      "maxItems": 20000
+    },
+    "updated_count": {
+      "type": "integer",
+      "minimum": 0
+    },
+    "installed_count": {
+      "type": "integer",
+      "minimum": 0
+    },
+    "removed_count": {
+      "type": "integer",
+      "minimum": 0
+    },
+    "pending": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "maxLength": 1024
+          },
+          "identifier": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "maxLength": 1024
+          },
+          "kb": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "maxLength": 1024
+            },
+            "maxItems": 100
+          }
+        },
+        "required": [
+          "name",
+          "identifier",
+          "kb"
+        ],
+        "additionalProperties": false
+      },
+      "maxItems": 20000
+    },
+    "failed_updates": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "maxLength": 1024
+          },
+          "identifier": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "maxLength": 1024
+          },
+          "native_code": {
+            "type": [
+              "integer",
+              "null"
+            ],
+            "minimum": 0
+          },
+          "reason": {
+            "type": "string",
+            "maxLength": 128,
+            "enum": [
+              "update_failed"
+            ]
+          }
+        },
+        "required": [
+          "name",
+          "identifier",
+          "native_code",
+          "reason"
+        ],
+        "additionalProperties": false
+      },
+      "maxItems": 20000
+    },
+    "reboot_required": {
+      "type": [
+        "boolean",
+        "null"
+      ]
+    },
+    "reboot_performed": {
+      "type": "boolean"
+    }
+  },
+  "required": [
+    "platform",
+    "mode",
+    "evidence",
+    "complete",
+    "updates",
+    "updated_count",
+    "installed_count",
+    "removed_count",
+    "pending",
+    "failed_updates",
+    "reboot_required",
+    "reboot_performed"
+  ],
+  "additionalProperties": false
+}
diff --git a/scripts/addons/webgui/tests/patch_fixtures.py b/scripts/addons/webgui/tests/patch_fixtures.py
new file mode 100644
index 0000000..032270d
--- /dev/null
+++ b/scripts/addons/webgui/tests/patch_fixtures.py
@@ -0,0 +1,24 @@
+"""Synthetic report scenarios; never native Windows Update acceptance."""
+def patch_data(**extra):
+    payload = {
+        'platform': 'windows', 'mode': 'apply', 'evidence': 'windows_update_result',
+        'complete': True,
+        'updates': [{'name': 'Synthetic cumulative update', 'identifier': 'fixture-update-1',
+                     'architecture': None, 'old_versions': [], 'new_versions': [],
+                     'action': 'installed', 'kb': ['KB0000001']}],
+        'updated_count': 0, 'installed_count': 1, 'removed_count': 0,
+        'pending': [], 'failed_updates': [],
+        'reboot_required': False, 'reboot_required_before': False,
+        'reboot_required_after': False, 'reboot_performed': True,
+        'reboot_deferred': False, 'reboot_delay_minutes': 5, 'blocked_reason': None,
+        'rescan_after_reboot': False, 'patch_cycles': 1,
+        'continuation_required': True, 'remaining_updates_known': False,
+    }
+    payload.update(extra)
+    return payload
+
+
+def update_failure(reason='install_not_allowed'):
+    return {'name': 'Synthetic failed update', 'identifier': 'fixture-update-2',
+            'native_code': 2149842966, 'native_code_hex': '0x80240016',
+            'reason': reason, 'message': 'Installation is not allowed in the observed Windows Update state.'}
diff --git a/scripts/addons/webgui/tests/run_release_tests.py b/scripts/addons/webgui/tests/run_release_tests.py
new file mode 100644
index 0000000..107909c
--- /dev/null
+++ b/scripts/addons/webgui/tests/run_release_tests.py
@@ -0,0 +1,53 @@
+"""Run release tests in bounded file groups using a disposable test environment.
+
+Set AIM_TEST_CORE_ROOT to a pristine Core source extraction, not a live controller.
+Artifacts go to --out; this does not install dependencies or contact real hosts.
+"""
+from __future__ import annotations
+import argparse
+import concurrent.futures
+import json
+import os
+from pathlib import Path
+import re
+import subprocess
+import sys
+import time
+
+
+def main() -> int:
+    parser=argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--out',type=Path,required=True)
+    parser.add_argument('--workers',type=int,default=3,choices=range(1,5))
+    parser.add_argument('--timeout',type=int,default=180)
+    args=parser.parse_args()
+    if args.timeout<30:parser.error('timeout must be at least 30 seconds')
+    core=os.environ.get('AIM_TEST_CORE_ROOT','')
+    if not core or not (Path(core)/'scripts/aimctl.py').is_file():
+        parser.error('Set AIM_TEST_CORE_ROOT to the pristine supplied Core source extraction.')
+    root=Path(__file__).resolve().parents[1];args.out.mkdir(parents=True,exist_ok=True)
+    env={**os.environ,'PYTEST_DISABLE_PLUGIN_AUTOLOAD':'1'}
+    def run(path: Path) -> dict:
+        started=time.monotonic()
+        try:
+            p=subprocess.run([sys.executable,'-m','pytest',str(path),'-q','-p','no:cacheprovider'],
+                cwd=root,env=env,capture_output=True,text=True,timeout=args.timeout)
+            output=p.stdout+p.stderr;code=p.returncode
+        except subprocess.TimeoutExpired as exc:
+            output=(exc.stdout or b'').decode(errors='replace') if isinstance(exc.stdout,bytes) else (exc.stdout or '')
+            output+='\nRelease test-file timeout; not a pass.\n';code=124
+        (args.out/(path.stem+'.log')).write_text(output)
+        summary=next((line for line in reversed(output.splitlines()) if re.search(r'\d+ (passed|failed|skipped|error)',line)),'No test summary')
+        counts={k:int(n) for n,k in re.findall(r'(\d+) (passed|failed|skipped|errors?)',summary)}
+        return {'file':path.name,'returncode':code,'seconds':round(time.monotonic()-started,3),'summary':summary,'counts':counts}
+    with concurrent.futures.ThreadPoolExecutor(max_workers=args.workers) as pool:
+        results=list(pool.map(run,sorted((root/'tests').glob('test_*.py'))))
+    totals={k:sum(x['counts'].get(k,0) for x in results) for k in ('passed','failed','skipped','error','errors')}
+    value={'mode':'independent bounded test-file groups','files':results,'totals':totals,
+           'all_passed':all(x['returncode']==0 for x in results),'native_managed_hosts_tested':False}
+    (args.out/'results.json').write_text(json.dumps(value,indent=2)+'\n')
+    for result in results:print(result['file']+': '+result['summary'],flush=True)
+    print(json.dumps(totals),flush=True)
+    return 0 if value['all_passed'] else 1
+
+if __name__=='__main__':raise SystemExit(main())
diff --git a/scripts/addons/webgui/tests/test_auth.py b/scripts/addons/webgui/tests/test_auth.py
new file mode 100644
index 0000000..3769912
--- /dev/null
+++ b/scripts/addons/webgui/tests/test_auth.py
@@ -0,0 +1,178 @@
+import concurrent.futures
+import json
+import os
+import sqlite3
+import stat
+import time
+import pytest
+
+from aim_webgui.auth.service import Auth, HASHER, digest
+from aim_webgui.errors import WebError
+
+from aim_webgui.config import Settings
+
+@pytest.fixture
+def settings(tmp_path):
+    state=tmp_path/'state';state.mkdir(mode=0o700)
+    return Settings(state_dir=state)
+
+@pytest.fixture
+def auth(settings):
+    auth=Auth(settings);auth.bootstrap();return auth
+
+@pytest.fixture
+def password(auth):return json.loads(auth.settings.credentials.read_text())['password']
+
+NEW = 'Independent-test-passphrase-2026'
+
+
+def test_bootstrap_secure_and_idempotent(auth, password):
+    assert stat.S_IMODE(auth.settings.credentials.stat().st_mode) == 0o600
+    assert stat.S_IMODE(auth.settings.database.stat().st_mode) == 0o600
+    assert len(password) >= 32
+    with auth.store.read() as db:
+        row = db.execute('SELECT * FROM users').fetchone()
+        assert row['password_hash'].startswith('$argon2id$')
+        assert HASHER.verify(row['password_hash'], password)
+        assert row['must_change_password'] == 1
+    auth.settings.credentials.unlink()
+    assert auth.bootstrap() is False
+    assert not auth.settings.credentials.exists()
+    assert len(auth.users()) == 1
+
+
+def test_bootstrap_concurrent(settings):
+    with concurrent.futures.ThreadPoolExecutor(2) as pool:
+        results = list(pool.map(lambda _: Auth(settings).bootstrap(), range(2)))
+    assert sorted(results) == [False, True]
+    assert len(Auth(settings).users()) == 1
+
+
+def test_missing_database_not_rebootstrapped(auth):
+    auth.settings.database.unlink()
+    with pytest.raises(ValueError, match='missing'):
+        auth.bootstrap()
+
+
+def test_password_change_revokes_and_consumes(auth, password):
+    anon, _ = auth.new_session()
+    token, s = auth.login('admin', password, anon, 'test-peer')
+    assert s['must_change_password']
+    assert token != anon
+    assert auth.session(anon) is None
+    with auth.store.read() as db:
+        assert db.execute('SELECT token_hash FROM sessions').fetchone()[0] == digest(token)
+        assert token.encode() not in auth.settings.database.read_bytes()
+    auth.change_password(s['user_id'], password, NEW)
+    assert auth.session(token) is None
+    assert not auth.settings.credentials.exists()
+    assert password not in (auth.settings.state_dir / '.credentials.used').read_text()
+    anon, _ = auth.new_session()
+    _, active = auth.login('admin', NEW, anon, 'test-peer')
+    assert not active['must_change_password']
+
+
+def test_last_admin_guard(auth):
+    for action in ('disable', 'demote'):
+        with pytest.raises(WebError, match='last enabled'):
+            auth.manage_user('admin', action)
+    auth.create_user('second-admin', NEW, 'admin')
+    auth.manage_user('admin', 'disable')
+    with pytest.raises(WebError):
+        auth.manage_user('second-admin', 'disable')
+
+
+def test_role_authorization_rechecked(auth):
+    auth.create_user('viewer', NEW)
+    viewer = next(u for u in auth.users() if u['username'] == 'viewer')
+    with pytest.raises(WebError) as result:
+        auth.manage_user('admin', 'revoke', actor_id=viewer['id'])
+    assert result.value.status == 403
+
+
+def test_disabled_and_reset_sessions(auth, password):
+    auth.create_user('reader', NEW)
+    reader = next(u for u in auth.users() if u['username'] == 'reader')
+    token, _ = auth.new_session(reader['id'])
+    auth.manage_user('reader', 'disable')
+    assert auth.session(token) is None
+    with pytest.raises(WebError, match='Invalid username'):
+        auth.login('reader', NEW, '', 'peer')
+    auth.manage_user('reader', 'enable')
+    token, _ = auth.new_session(reader['id'])
+    auth.manage_user('reader', 'reset-password', password=NEW + '-reset')
+    assert auth.session(token) is None
+
+
+def test_expired_sessions(auth):
+    token, _ = auth.new_session()
+    with auth.store.transaction() as db:
+        db.execute('UPDATE sessions SET expires_at=?', (int(time.time()) - 1,))
+    assert auth.session(token) is None
+
+
+def test_throttle(auth):
+    for _ in range(10):
+        with pytest.raises(WebError) as e:
+            auth.login('admin', 'bad', '', 'test-peer')
+        assert e.value.status == 401
+    with pytest.raises(WebError) as e:
+        auth.login('admin', 'bad', '', 'test-peer')
+    assert e.value.status == 429
+
+
+def test_migration_backup_and_future_schema(auth, tmp_path):
+    auth.store.migrate()
+    out = tmp_path / 'auth-backup.sqlite3'
+    auth.store.backup(out)
+    assert stat.S_IMODE(out.stat().st_mode) == 0o600
+    db = sqlite3.connect(out)
+    assert db.execute('PRAGMA integrity_check').fetchone()[0] == 'ok'
+    assert db.execute('SELECT COUNT(*) FROM users').fetchone()[0] == 1
+    db.close()
+    with auth.store.transaction() as db:
+        db.execute('PRAGMA user_version=999')
+    with pytest.raises(ValueError, match='newer'):
+        auth.store.migrate()
+
+
+def test_credentials_symlink_rejected(settings, tmp_path):
+    other = tmp_path / 'other'
+    other.write_text('do not overwrite')
+    settings.credentials.symlink_to(other)
+    with pytest.raises(ValueError):
+        Auth(settings).bootstrap()
+    assert other.read_text() == 'do not overwrite'
+
+
+def test_short_window_does_not_clear_long_window(auth, monkeypatch):
+    import aim_webgui.auth.service as module
+    monkeypatch.setattr(module.time, 'time', lambda:10000)
+    auth.throttle([('long',1)],window=300)
+    monkeypatch.setattr(module.time, 'time', lambda:10070)
+    auth.throttle([('short',1)],window=60)
+    with pytest.raises(WebError) as e:
+        auth.throttle([('long',1)],window=300)
+    assert e.value.status == 429
+
+
+def test_bootstrap_repairs_missing_post_commit_marker_without_reset(auth, password):
+    marker = auth.settings.state_dir / '.initialized'
+    marker.unlink()
+    before = auth.settings.credentials.read_bytes()
+    assert auth.bootstrap() is False
+    assert marker.is_file()
+    assert auth.settings.credentials.read_bytes() == before
+    auth.settings.database.unlink()
+    with pytest.raises(ValueError, match='missing'):
+        auth.bootstrap()
+
+
+def test_local_recovery_can_reenable_out_of_band_disabled_admin(auth):
+    with auth.store.transaction() as db:
+        db.execute("UPDATE users SET enabled=0 WHERE username='admin'")
+    with pytest.raises(ValueError, match='administrator'):
+        auth.store.check()
+    auth.store.check(require_admin=False)
+    auth.manage_user('admin', 'enable')
+    auth.store.check()
diff --git a/scripts/addons/webgui/tests/test_core_contract.py b/scripts/addons/webgui/tests/test_core_contract.py
new file mode 100644
index 0000000..368aec3
--- /dev/null
+++ b/scripts/addons/webgui/tests/test_core_contract.py
@@ -0,0 +1,134 @@
+from dataclasses import replace
+from pathlib import Path
+import json
+import os
+import stat
+import pytest
+from aim_webgui.adapters.core_v1 import CoreAdapter
+from aim_webgui.core.client import CoreClient
+from aim_webgui.core.protocol import request_message,validate_request,validate_secrets,safe_event,response_result,COUNTS
+from aim_webgui.errors import WebError
+
+
+def test_real_core_capabilities_and_customers(settings):
+    core=CoreAdapter(settings)
+    assert core.version=='3.3.0rc8'
+    assert core.capabilities['execution']['profile']=='same_uid_native_inventory'
+    assert 'custom_password_override' in core.capabilities['unsupported']
+    assert core.capabilities['target_outcomes']['schema']=='target_outcome_summary_v1'
+    assert core.capabilities['inventory_hierarchy']['schema']=='inventory_hierarchy_v1'
+    assert core.capabilities['controller_staging']['profile']=='native_defaults_preflight_v2'
+    assert core.capabilities['collection_baselines']['ansible.windows']=='>=3.8.0,<4.0.0'
+    assert [x['name'] for x in core.customers()]==['example']
+
+
+def test_real_core_hosts_and_catalog(settings):
+    a=CoreAdapter(settings)
+    hosts=a.hosts('example')
+    assert {x['name'] for x in hosts}=={'test01.example','win01.example'}
+    assert next(x for x in hosts if x['name']=='test01.example')['groups']==['linux','linux/lab']
+    assert len(a.playbooks('example'))==13 # customer-specific Sophos file is absent
+
+def test_real_core_inventory_hierarchy(settings):
+    a=CoreAdapter(settings)
+    hierarchy=a.inventory_hierarchy('example')
+    assert hierarchy['schema']=='inventory_hierarchy_v1'
+    linux=next(x for x in hierarchy['groups'] if x['name']=='linux')
+    lab=next(x for x in linux['children'] if x['name']=='lab')
+    assert linux['hosts']==[] and lab['hosts']==['test01.example']
+    groups={x['name']:x for x in a.hierarchy_groups('example')['groups']}
+    assert groups['linux']['hosts']==['test01.example']
+    assert groups['linux/lab']['direct_hosts']==['test01.example']
+
+
+def test_real_prepare_typed_options_and_invalid_target(settings):
+    a=CoreAdapter(settings)
+    p=a.preflight('example','debug_test_connection',['test01.example'],{'aim_debug':'false'},text_inputs=True)
+    assert p['core_request']['overrides']=={'aim_debug':False}
+    assert p['core_request']['check'] is True
+    assert len(p['core_revision'])==64
+    with pytest.raises(WebError) as e:a.preflight('example','debug_test_connection',['missing.example'],{})
+    assert e.value.code=='core_invalid_target'
+
+
+def test_real_core_invalid_option_error(settings):
+    with pytest.raises(WebError) as e:
+        CoreAdapter(settings).preflight('example','debug_test_connection',['test01.example'],{'not_declared':True})
+    assert e.value.code=='core_invalid_options'
+
+
+def test_real_core_conservative_vault_requirements(settings,core_root):
+    (core_root/'inventories/example/group_vars/all/vault.yml').write_text('$ANSIBLE_VAULT;1.1;AES256\n'+('a'*80)+'\n')
+    result=CoreAdapter(settings).preflight('example','debug_test_connection',['test01.example'],{})
+    assert result['credential_requirements']==['vault_password']
+    assert result['credential_requirement_reasons']['vault_password']==['customer_vault_present']
+
+
+def test_real_core_key_ownership_policy_stays_core_owned(settings,core_root):
+    key=core_root/'inventories/example/group_vars/linux/.ssh/svc_bf-ansible'
+    key.write_text('synthetic-only');key.chmod(0o640)
+    with pytest.raises(WebError) as e:
+        CoreAdapter(settings).preflight('example','debug_test_connection',['test01.example'],{},key_mode='customer')
+    assert e.value.code=='core_key_access_policy'
+    assert stat.S_IMODE(key.stat().st_mode)==0o640
+
+
+def test_request_has_no_paths_actors_or_credentials():
+    for field in ('actor','credentials','vault_password','command','inventory_path'):
+        with pytest.raises(WebError):validate_request({'api_version':'1.0','operation':'prepare','request':{'customer':'x','playbook':'x','hosts':['x'],field:'bad'}})
+
+
+def test_literal_secret_channel_validation():
+    val='Synthetic +% ! {{ literal }} end '
+    assert validate_secrets({'vault_password':val})['vault_password']==val
+    for val in ('line\nfeed','NUL\x00', 'x'*2049):
+        with pytest.raises(WebError):validate_secrets({'vault_password':val})
+    with pytest.raises(WebError):validate_secrets({'become_password':'out-of-scope'})
+
+
+def test_structured_events_drop_raw_fields():
+    e=safe_event({'event_version':'1.0','run_id':'x','timestamp':'now','sequence':1,'kind':'progress','status':'ok','task_name':'DO NOT FORWARD','raw':'secret'})
+    assert 'task_name' not in e and 'raw' not in e
+    assert safe_event({'event_version':'1.0','sequence':2,'kind':'future'}) is None
+
+
+def test_missing_stats_never_means_success():
+    with pytest.raises(WebError):response_result({'type':'response','api_version':'1.0','ok':True,'result':{'status':'succeeded','remote_work_may_have_started':True,'counts':{}}},'execute')
+
+
+
+def test_target_outcome_projection_is_authoritative():
+    counts=dict.fromkeys(COUNTS,0)
+    counts['ok']=38
+    result={'type':'response','api_version':'1.0','ok':False,'result':{
+        'status':'failed','stage':'execution','exit_code':4,'remote_work_may_have_started':True,
+        'error':{'code':'host_unreachable','message':'withheld','stage':'execution','retryable':False},
+        'counts':dict(counts,unreachable=1),
+        'target_summary':{'schema':'target_outcome_summary_v1','requested':2,'successful':1,'failed':0,'unreachable':1,'not_started':0,'indeterminate':0,'complete':True,'accounted':2},
+        'targets':[{'host':'host01.example','outcome':'successful','counts':counts},
+                   {'host':'host25.example','outcome':'unreachable','counts':dict(counts,unreachable=1)}]}}
+    projected=response_result(result,'execute')
+    assert projected['target_summary']['successful']==1
+    assert projected['targets'][1]['outcome']=='unreachable'
+
+def test_unknown_error_fails_safely():
+    with pytest.raises(WebError) as e:
+        response_result({'type':'response','api_version':'1.0','ok':False,'error':{'code':'new_error','message':'secret-looking upstream message'}},'prepare')
+    assert 'secret-looking' not in e.value.message
+
+
+def test_detail_progress_contract_and_projection(settings):
+    a=CoreAdapter(settings)
+    assert a.capabilities['execution_progress']['detail_schema']=='play_task_host_v1'
+    plan=a.preflight('example','debug_test_connection',['test01.example'],{})
+    assert plan['core_request']['progress_mode']=='detail'
+    play=safe_event({'event_version':'1.0','run_id':'r','timestamp':'now','sequence':1,'kind':'play_started','play_id':'p1','label':'Debug | Linux manageability','label_redacted':False})
+    task=safe_event({'event_version':'1.0','run_id':'r','timestamp':'now','sequence':2,'kind':'task_started','play_id':'p1','task_id':'t1','label':'Linux | Test SSH and Python','label_redacted':False,'handler':False})
+    host=safe_event({'event_version':'1.0','run_id':'r','timestamp':'now','sequence':3,'kind':'host_result','play_id':'p1','task_id':'t1','host':'test01.example','host_redacted':False,'status':'ok','changed':False,'ignored':False,'details_redacted':False,'error':None})
+    assert play['label'].startswith('Debug') and task['label'].startswith('Linux') and host['host']=='test01.example'
+    assert 'raw' not in host and 'module' not in host
+
+
+def test_staging_operation_is_public_contract(settings):
+    assert 'staging_check' in CoreAdapter(settings).capabilities['operations']
+    assert request_message('staging_check')=={'api_version':'1.0','operation':'staging_check'}
diff --git a/scripts/addons/webgui/tests/test_core_execution.py b/scripts/addons/webgui/tests/test_core_execution.py
new file mode 100644
index 0000000..ce5d668
--- /dev/null
+++ b/scripts/addons/webgui/tests/test_core_execution.py
@@ -0,0 +1,76 @@
+"""Real core wire/process, FAKE native Ansible commands: no target contacted."""
+from dataclasses import replace
+from pathlib import Path
+import os
+import sys
+
+from aim_webgui.adapters.core_v1 import CoreAdapter
+from aim_webgui.core.client import CoreClient
+
+
+def native_fixture(core_root):
+    directory=core_root/'fakebin';directory.mkdir()
+    source='''#!EXE
+import json,os,sys
+from pathlib import Path
+name=Path(sys.argv[0]).name
+if '--version' in sys.argv:
+ print(name+' [core 2.19.11]')
+ print('python version = synthetic-qualified-runtime')
+ print('ansible python module location = /synthetic/runtime')
+elif name=='ansible-galaxy':
+ print(json.dumps({'/synthetic':{'ansible.windows':{'version':'3.8.0'}}}))
+elif '--syntax-check' in sys.argv:
+ print('SYNTHETIC-RAW-OUTPUT-MUST-NOT-LEAVE-CORE')
+else:
+ fd=int(os.environ['AIM_EVENT_FD'])
+ counts={'ok':1,'changed':0,'failures':0,'unreachable':0,'skipped':0,'rescued':0,'ignored':0}
+ events=[
+  {'kind':'started'},
+  {'kind':'detail_begin','schema':'play_task_host_v1'},
+  {'kind':'detail','event':'play_started','play_id':'p1','label':'Synthetic play','label_redacted':False},
+  {'kind':'detail','event':'task_started','play_id':'p1','task_id':'t1','label':'Synthetic task','label_redacted':False,'handler':False},
+  {'kind':'task'},
+  {'kind':'detail','event':'host_result','play_id':'p1','task_id':'t1','host':'test01.example','host_redacted':False,'status':'ok','changed':False,'ignored':False,'details_redacted':False,'error_code':None},
+  {'kind':'ok'},
+  {'kind':'target_recap','target_index':0,'counts':counts},
+  {'kind':'detail','event':'host_recap','host':'test01.example','host_redacted':False,'counts':counts},
+  {'kind':'detail_end','complete':True},
+  {'kind':'stats','counts':counts},
+ ]
+ for sequence,event in enumerate(events,1):
+  os.write(fd,(json.dumps({'bridge_sequence':sequence,**event})+'\\n').encode())
+ print('SYNTHETIC-RAW-OUTPUT-MUST-NOT-LEAVE-CORE')
+'''.replace('EXE',sys.executable)
+    for name in ('ansible-playbook','ansible-vault','ansible-galaxy'):
+        p=directory/name;p.write_text(source);p.chmod(0o755)
+    config=core_root/'scripts/aim.yml'
+    with config.open('a')as f:f.write(f'runtime:\n  ansible_playbook: {directory}/ansible-playbook\n')
+    return directory
+
+
+def test_real_core_wire_execute_with_fake_native(settings,core_root):
+    native_fixture(core_root)
+    adapter=CoreAdapter(settings)
+    plan=adapter.preflight('example','debug_test_connection',['test01.example'],{},check=True)
+    ready=adapter.readiness(plan)
+    assert ready['ready'] is True
+    events=[]
+    result=CoreClient(settings).request('execute',request=plan['core_request'],expected_revision=plan['core_revision'],event_sink=events.append)
+    assert result['status']=='succeeded'
+    assert result['exit_code']==0 and result['counts']['ok']==1
+    assert result['remote_work_may_have_started'] is True
+    assert {e['kind']for e in events}>={'stage','progress','stats','result'}
+    assert [e['status'] for e in events if e['kind']=='result']==['succeeded']
+    assert 'SYNTHETIC-RAW-OUTPUT' not in repr(events)+repr(result)
+
+
+def test_missing_core_runtime_is_not_success(settings,core_root):
+    config=core_root/'scripts/aim.yml'
+    with config.open('a')as f:f.write('runtime:\n  ansible_playbook: /nonexistent/ansible-playbook\n')
+    adapter=CoreAdapter(settings)
+    plan=adapter.preflight('example','debug_test_connection',['test01.example'],{},check=True)
+    result=CoreClient(settings).request('execute',request=plan['core_request'],expected_revision=plan['core_revision'])
+    assert result['status']=='failed'
+    assert result['error']['code']=='runtime_missing'
+    assert result['remote_work_may_have_started'] is False
diff --git a/scripts/addons/webgui/tests/test_core_rc8_patch.py b/scripts/addons/webgui/tests/test_core_rc8_patch.py
new file mode 100644
index 0000000..ebb7e42
--- /dev/null
+++ b/scripts/addons/webgui/tests/test_core_rc8_patch.py
@@ -0,0 +1,236 @@
+"""Public Core rc8 discovery/prepare and WebGUI patch/report presentation/persistence.
+
+All data and inventory are synthetic. No updates, reboots or managed hosts run.
+"""
+from copy import deepcopy
+from dataclasses import replace
+import base64
+import json
+from pathlib import Path
+import re
+
+import pytest
+from fastapi.testclient import TestClient
+from aim_webgui.adapters.core_v1 import CoreAdapter
+from aim_webgui.app import create_app
+from aim_webgui.core.client import CoreClient
+from aim_webgui.core.reports import contract, data, operation_result
+from aim_webgui.errors import WebError
+from aim_webgui.patch_view import patch_view
+from aim_webgui.reports import Reports, persist, presentation
+from aim_webgui.workflows import Workflows, presentation_status
+from evidence_fixtures import declared, plan, result, job
+from patch_fixtures import patch_data, update_failure
+from test_core_execution import native_fixture
+
+
+def patch_plan(d, host='win01.example'):
+    p=plan(d, [host]);p['playbook']='maintenance_patch_os'
+    p['core_request']['playbook']=p['playbook']
+    return p
+
+
+def retained(settings, auth, admin, payload, *, status='succeeded', declaration=None, host='win01.example'):
+    d=declaration or declared('patch_summary_v1');p=patch_plan(d, host)
+    r=result(d,hosts=p['targets'],report_data=payload,status=status)
+    ident=job(auth,admin,p,status='successful' if status=='succeeded' else 'failed')
+    with auth.store.transaction() as db:
+        small=persist(db,settings,ident,p,r)
+        db.execute('UPDATE jobs SET core_result=? WHERE id=?',(json.dumps(small),ident))
+    return ident, Reports(settings).slot(admin,ident), small
+
+
+def client_for(auth, admin):
+    token,session=auth.new_session(admin)
+    c=TestClient(create_app(auth.settings),base_url=auth.settings.public_url)
+    c.cookies.set(auth.settings.cookie_name,token)
+    c.headers.update({'Origin':auth.settings.public_url,'X-CSRF-Token':session['csrf']})
+    return c
+
+
+def test_rc8_public_catalog_options_not_hardcoded_defaults(settings):
+    a=CoreAdapter(settings);spec=a.spec('maintenance_patch_os','example')
+    fields={i.name:i for i in spec.inputs}
+    assert fields['os_patching_rescan_after_reboot'].type=='bool'
+    assert fields['os_patching_rescan_after_reboot'].default_hint=='false'
+    assert list(fields['os_patching_rescan_after_reboot'].platforms)==['windows']
+    delay=fields['os_patching_reboot_delay_minutes']
+    assert delay.minimum==0 and delay.maximum==1440 and delay.default_hint=='0'
+    assert fields['os_patching_reboot_message'].type=='text'
+    p=a.preflight('example',spec.key,['win01.example'],{},check=False)
+    assert p['overrides']=={} and p['core_request']['overrides']=={}
+    assert p['result_contract']['schema']=='patch_summary_v1'
+    assert 'remaining_updates_known' in p['result_contract']['data_schema']['properties']
+
+
+@pytest.mark.parametrize('choice',['true','false'])
+def test_explicit_continuation_bool_survives_public_prepare(settings, choice):
+    p=CoreAdapter(settings).preflight('example','maintenance_patch_os',['win01.example'],
+        {'os_patching_rescan_after_reboot':choice,'os_patching_reboot_delay_minutes':'5',
+         'os_patching_reboot_message':'Approved fixture maintenance'},text_inputs=True,check=False)
+    assert p['core_request']['overrides']=={
+        'os_patching_rescan_after_reboot':choice=='true',
+        'os_patching_reboot_delay_minutes':5,
+        'os_patching_reboot_message':'Approved fixture maintenance'}
+
+
+@pytest.mark.parametrize('delay',[-1,1441])
+def test_rc8_core_rejects_delay_outside_catalog(settings,delay):
+    with pytest.raises(WebError) as e:
+        CoreAdapter(settings).preflight('example','maintenance_patch_os',['win01.example'],
+            {'os_patching_reboot_delay_minutes':delay})
+    assert e.value.code=='core_invalid_options'
+
+
+def test_new_report_schema_and_old_core_gate(settings):
+    a=CoreAdapter(settings);caps=a.capabilities
+    assert caps['collection_baselines']['ansible.windows']=='>=3.8.0,<4.0.0'
+    class Old:
+        def request(self,*args,**kwargs):return {**caps,'core_version':'3.3.0rc1'}
+    with pytest.raises(WebError) as e:CoreAdapter(settings,Old()).capabilities
+    assert e.value.code=='core_incompatible'
+    class WrongBaseline:
+        def request(self,*args,**kwargs):return {**caps,'collection_baselines':{'ansible.windows':'>=3.2.0'}}
+    with pytest.raises(WebError) as e:CoreAdapter(settings,WrongBaseline()).capabilities
+    assert e.value.code=='core_incompatible'
+    d=declared('patch_summary_v1')
+    assert data(patch_data(),contract(d)['data_schema'])==patch_data()
+    bad=patch_data();del bad['reboot_required_before']
+    with pytest.raises(WebError):data(bad,contract(d)['data_schema'])
+    enriched=patch_data(reboot_reasons_before=[{'source':'fixture_source','description':'Synthetic reboot source'}])
+    assert data(enriched,contract(d)['data_schema'])['reboot_reasons_before'][0]['source']=='fixture_source'
+
+
+def test_historical_rc1_patch_schema_remains_usable(settings,auth,admin):
+    d=declared('patch_summary_v1')
+    d['data_schema']=json.loads((Path(__file__).parent/'fixtures/patch-summary-rc1.json').read_text())
+    old={k:v for k,v in patch_data().items() if k in d['data_schema']['properties']}
+    old['failed_updates']=[{'name':'Old synthetic update','identifier':None,'native_code':None,'reason':'update_failed'}]
+    ident,item,small=retained(settings,auth,admin,old,declaration=d,status='failed')
+    assert item['data']==old and 'remaining_updates_known' not in item['data']
+    assert any(n['title']=='Historical patch-report format' for n in patch_view(item)['notices'])
+    assert presentation_status('failed',small)=='failed'
+    with client_for(auth,admin) as c:
+        text=c.get(f'/jobs/{ident}/reports').text
+        assert 'Historical patch-report format' in text and 'newer remaining-update knowledge' in text
+        assert c.get(f'/api/v2/runs/{ident}/report').json()['data']==old
+    # Never silently validate newly added fields with an old recorded contract.
+    with pytest.raises(WebError):data(patch_data(),contract(d)['data_schema'])
+
+
+def test_successful_wave_does_not_become_failure_or_new_job(settings,auth,admin):
+    ident,item,small=retained(settings,auth,admin,patch_data())
+    assert presentation_status('successful',small)=='successful'
+    p=patch_view(item)
+    assert any(n['title']=='Another patch run needs review' for n in p['notices'])
+    assert p['pending']['suppressed'] is True
+    with client_for(auth,admin) as c:
+        for _ in range(2):
+            response=c.get(f'/jobs/{ident}/reports');assert response.status_code==200
+            assert 'Another patch run needs review' in response.text
+            assert 'Remaining updates not established' in response.text
+            assert 'Final pending list not established' in response.text
+        assert c.get(f'/api/v2/runs/{ident}/report').json()['data']==patch_data()
+    with auth.store.read() as db:assert db.execute('SELECT count(*) FROM jobs').fetchone()[0]==1
+
+
+def test_unknown_pending_does_not_show_old_queue_as_next_wave(settings,auth,admin):
+    payload=patch_data(pending=[{'name':'DO-NOT-DISPLAY-AS-FINAL-QUEUE','identifier':None,'kb':[]}])
+    ident,item,_=retained(settings,auth,admin,payload)
+    section=next(s for s in presentation(item)['sections'] if s['key']=='pending')
+    assert section['rows']==[] and section['total'] is None
+    with client_for(auth,admin) as c:
+        assert 'DO-NOT-DISPLAY-AS-FINAL-QUEUE' not in c.get(f'/jobs/{ident}/reports').text
+        assert c.get(f'/api/v2/runs/{ident}/report').json()['data']['pending']==payload['pending']
+
+
+@pytest.mark.parametrize('pending',[[],[{'name':'Synthetic pending update','identifier':'fixture-pending','kb':['KB0000002']} ]])
+def test_known_remaining_is_dated_discovery_not_install(settings,auth,admin,pending):
+    payload=patch_data(remaining_updates_known=True,pending=pending,continuation_required=bool(pending),reboot_performed=False)
+    ident,item,_=retained(settings,auth,admin,payload)
+    section=next(s for s in presentation(item)['sections'] if s['key']=='pending')
+    assert not section['suppressed'] and section['total']==len(pending)
+    with client_for(auth,admin) as c:
+        text=c.get(f'/jobs/{ident}/reports').text
+        assert 'Pending updates - final read-only discovery' in text
+        assert 'not a live compliance check' in text
+        assert ('Synthetic pending update' if pending else 'No pending updates reported by that final discovery') in text
+
+
+@pytest.mark.parametrize('reason',[None,'preexisting_reboot_required','install_not_allowed','cycle_limit_reached'])
+def test_reboot_stop_reason_is_explicit_and_never_inferred(settings,auth,admin,reason):
+    payload=patch_data(blocked_reason=reason,reboot_required=True,reboot_required_after=True,reboot_deferred=True,
+                       failed_updates=[update_failure()] if reason=='install_not_allowed' else [])
+    ident,item,_=retained(settings,auth,admin,payload,status='failed' if reason else 'succeeded')
+    text=' '.join(n['title']+' '+n['text'] for n in patch_view(item)['notices'])
+    assert 'Reboot deferred' in text
+    assert ('Pending reboot observed before patching' in text)==(reason=='preexisting_reboot_required')
+    with client_for(auth,admin) as c:
+        html=c.get(f'/jobs/{ident}/reports').text
+        if reason=='install_not_allowed':
+            assert '0x80240016' in html and '2149842966' in html
+            assert 'does not by itself prove a pending reboot' in html
+
+
+def test_check_report_and_linux_optional_flags_not_invented(settings,auth,admin):
+    item={'schema_id':'patch_summary_v1','status':'available','check_mode':True,'data':patch_data(mode='check')}
+    assert patch_view(item)['notices'][0]['title']=='Check mode: no installation claim'
+    item['data']['platform']='debian'
+    for key in ('rescan_after_reboot','remaining_updates_known','continuation_required','patch_cycles'):
+        item['data'].pop(key)
+    view=patch_view(item)
+    assert not view['windows'] and not any(n['title']=='Historical patch-report format' for n in view['notices'])
+    item['status']='missing';item['data']=None
+    assert patch_view(item) is None
+
+
+def test_failure_details_are_escaped_and_retained_no_raw_fields(settings,auth,admin):
+    f=update_failure();f['message']='<script>fixture()</script>'
+    payload=patch_data(failed_updates=[f],blocked_reason='install_not_allowed')
+    ident,_,_=retained(settings,auth,admin,payload,status='failed')
+    with client_for(auth,admin) as c:
+        text=c.get(f'/jobs/{ident}/reports').text
+        assert '<script>fixture()</script>' not in text and '&lt;script&gt;' in text
+    f['failure_msg']='must not be accepted'
+    with pytest.raises(WebError):data(patch_data(failed_updates=[f]),contract(declared('patch_summary_v1'))['data_schema'])
+
+
+def test_option_form_and_review_platform_hint_and_no_auto_opt_in(settings,auth,admin):
+    cfg=replace(settings,execution_playbooks=(*settings.execution_playbooks,'maintenance_patch_os'))
+    token,sess=auth.new_session(admin)
+    with TestClient(create_app(cfg),base_url=cfg.public_url) as c:
+        c.cookies.set(cfg.cookie_name,token);c.headers.update({'Origin':cfg.public_url,'X-CSRF-Token':sess['csrf']})
+        page=c.get('/plan?customer=example&playbook=maintenance_patch_os')
+        assert page.status_code==200 and 'Continue patching after reboot' in page.text
+        select=re.search(r'<select[^>]+name="option.os_patching_rescan_after_reboot"[^>]*>(.*?)</select>',page.text,re.S).group(1)
+        assert 'catalog hint: false' in select and 'selected' not in select
+        assert 'Reboot delay (minutes)' in page.text and 'Reboot message' in page.text
+        form={'customer':'example','playbook':'maintenance_patch_os','targets':'win01.example','mode':'apply','key_mode':'none',
+              'option.os_patching_reboot':'true','option.os_patching_rescan_after_reboot':''}
+        reviewed=c.post('/_partials/preflight',data=form,headers={'HX-Request':'true'})
+        assert reviewed.status_code==200,reviewed.text
+        assert 'not enabled by WebGUI' in reviewed.text and 'Enabled (explicit override)' in reviewed.text
+        rid=re.search('name="review_id" value="([a-f0-9]+)"',reviewed.text).group(1)
+        record=Workflows(cfg).review_record(admin,rid)
+        assert record['core_request']['overrides']=={'os_patching_reboot':True}
+        assert record['core_request']['check'] is False
+        assert record['result_contract']['schema']=='patch_summary_v1'
+
+
+def test_real_core_rc8_patch_finalization_through_fake_native(settings,core_root):
+    directory=native_fixture(core_root)
+    raw=json.dumps({'protocol':'aim_output_v1','schema':'patch_summary_v1','data':patch_data()}).encode()
+    frames=[]
+    for i,pos in enumerate(range(0,len(raw),2048)):
+        frames.append({'kind':'output_chunk','target_index':0,'part':i,'content':base64.b64encode(raw[pos:pos+2048]).decode()})
+    for path in directory.iterdir():
+        old=path.read_text();marker="  {'kind':'stats','counts':counts},"
+        assert marker in old
+        path.write_text(old.replace(marker,','.join(repr(f) for f in frames)+",\n  {'kind':'output_end','target_index':0},\n  {'kind':'outputs_end'},\n"+marker))
+    adapter=CoreAdapter(settings);p=adapter.preflight('example','maintenance_patch_os',['win01.example'],{},check=False)
+    events=[]
+    out=CoreClient(settings).request('execute',request=p['core_request'],expected_revision=p['core_revision'],
+              result_contract=p['result_contract'],event_sink=events.append)
+    assert out['status']=='succeeded' and out['operation_result']['hosts']['win01.example']['data']==patch_data()
+    assert len([e for e in events if e['kind']=='result'])==1
+    assert all('operation_result' not in e for e in events)
diff --git a/scripts/addons/webgui/tests/test_core_reports.py b/scripts/addons/webgui/tests/test_core_reports.py
new file mode 100644
index 0000000..a026699
--- /dev/null
+++ b/scripts/addons/webgui/tests/test_core_reports.py
@@ -0,0 +1,39 @@
+"""Actual uploaded public Core plus explicitly simulated native publishers."""
+import base64,json
+from aim_webgui.adapters.core_v1 import CoreAdapter
+from aim_webgui.core.client import CoreClient
+from aim_webgui.core.reports import contract
+from test_core_execution import native_fixture
+
+
+def test_real_core_nine_catalog_contracts_and_schema_revision(settings,core_root):
+    adapter=CoreAdapter(settings)
+    catalogs=adapter.playbooks('example');declared=[p for p in catalogs if p.get('result')]
+    assert len(declared)==9
+    for p in declared:assert contract(p['result'])==p['result']
+    p=adapter.preflight('example','debug_detect_host_roles',['test01.example'],{})
+    assert p['result_contract']['schema']=='host_capabilities_v1'
+    assert p['result_contract']['required']is True
+    path=core_root/'playbooks/schemas/host_capabilities_v1.yml'
+    path.write_text(path.read_text()+'\ndescription: Synthetic schema revision change\n')
+    new=adapter.preflight('example','debug_detect_host_roles',['test01.example'],{})
+    assert new['core_revision']!=p['core_revision']
+
+
+def test_actual_core_report_finalization_with_fake_native(settings,core_root):
+    directory=native_fixture(core_root)
+    keys=['is_dc','is_dhcp_server','is_hyperv_host','has_veeam_vbr','has_veeam_vbo','has_veeam_em','is_unifi_controller','is_unifi_os_server']
+    data={k:False for k in keys};data['is_unifi_controller']=True
+    raw=json.dumps({'protocol':'aim_output_v1','schema':'host_capabilities_v1','data':data}).encode()
+    frame={'kind':'output_chunk','target_index':0,'part':0,'content':base64.b64encode(raw).decode()}
+    for path in directory.iterdir():
+        s=path.read_text();s=s.replace("  {'kind':'stats','counts':counts},",repr(frame)+",\n  {'kind':'output_end','target_index':0},\n  {'kind':'outputs_end'},\n  {'kind':'stats','counts':counts},")
+        path.write_text(s)
+    adapter=CoreAdapter(settings);p=adapter.preflight('example','debug_detect_host_roles',['test01.example'],{},check=False)
+    events=[]
+    r=CoreClient(settings).request('execute',request=p['core_request'],expected_revision=p['core_revision'],result_contract=p['result_contract'],event_sink=events.append)
+    assert r['status']=='succeeded'
+    assert r['operation_result']['hosts']['test01.example']['data']==data
+    assert r['operation_result']['complete']is True
+    assert len([e for e in events if e['kind']=='result'])==1
+    assert all('operation_result'not in e for e in events)
diff --git a/scripts/addons/webgui/tests/test_credential_ux.py b/scripts/addons/webgui/tests/test_credential_ux.py
new file mode 100644
index 0000000..7a25684
--- /dev/null
+++ b/scripts/addons/webgui/tests/test_credential_ux.py
@@ -0,0 +1,289 @@
+"""Credential modal/read status/attention boundaries; synthetic secrets, no Core run."""
+from dataclasses import replace
+import json
+import time
+import uuid
+from pathlib import Path
+
+import pytest
+from fastapi.testclient import TestClient
+from aim_webgui.app import create_app
+from aim_webgui.auth.service import Auth
+from aim_webgui.config import Settings
+from aim_webgui.workflows import Workflows
+from aim_webgui.credentials import presentation, service, wire
+from aim_webgui.errors import WebError
+
+SYNTHETIC = 'fixture-only +%! {{ 7 * 7 }} " snowman \u2603'
+
+
+@pytest.fixture
+def authz(tmp_path, monkeypatch):
+    settings = Settings(state_dir=tmp_path/'state', public_url='https://aim.example.test',
+                        execution_enabled=True, execution_require_approval=False,
+                        execution_playbooks=('checkmk_install_agent',),
+                        execution_transport_verified=True, credentials_enabled=True).validate()
+    auth = Auth(settings); auth.bootstrap()
+    for name, role in [('operator', 'viewer'), ('another', 'viewer'), ('admin2', 'admin')]:
+        auth.create_user(name, 'Synthetic-fixture-password-2026', role)
+    with auth.store.transaction() as db:
+        db.execute('UPDATE users SET must_change_password=0')
+        users = {row['username']: row['id'] for row in db.execute('SELECT id,username FROM users')}
+        for user in ('operator', 'another'):
+            db.execute('INSERT INTO grants(user_id,customer,playbook) VALUES(?,?,?)',
+                       (users[user], 'example', 'checkmk_install_agent'))
+    # New UX must not prepare/execute/decrypt/probe remotely on page load.
+    from aim_webgui.adapters.core_v1 import CoreAdapter
+    def forbidden(*args, **kwargs):
+        raise AssertionError('Credential UX must not call Core')
+    for name in ('preflight', 'readiness', 'reprepare'):
+        monkeypatch.setattr(CoreAdapter, name, forbidden)
+    return auth, users
+
+
+def make_job(authz, owner='operator', *, requirements=None, status='running', phase='waiting', deadline=None, canceled=False, when=None):
+    auth, users = authz
+    now = int(time.time())
+    ident = uuid.uuid4().hex
+    plan = {'customer': 'example', 'playbook': 'checkmk_install_agent', 'targets': ['lab.example'],
+            'overrides': {}, 'core_request': {'key_mode': 'customer'},
+            'credential_requirements': requirements if requirements is not None else ['vault_password', 'ssh_key_passphrase_or_customer_vault_value']}
+    with auth.store.transaction() as db:
+        db.execute('''INSERT INTO jobs(id,owner_id,plan,mode,status,created_at,scheduled_at,
+                      credential_phase,credential_deadline,cancel_requested)
+                      VALUES(?,?,?,?,?,?,?,?,?,?)''',
+                   (ident, users[owner], json.dumps(plan), 'apply', status, when or now, now, phase,
+                    now+240 if deadline is None else deadline, canceled))
+    return ident
+
+
+def client(authz, user='operator'):
+    auth, users = authz
+    token, session = auth.new_session(users[user])
+    browser = TestClient(create_app(auth.settings), base_url=auth.settings.public_url, follow_redirects=False)
+    browser.cookies.set(auth.settings.cookie_name, token)
+    browser.headers.update({'Origin': auth.settings.public_url, 'X-CSRF-Token': session['csrf']})
+    return browser
+
+
+def test_modal_fragment_is_eligible_owner_only_and_full_page_fallback(authz):
+    ident = make_job(authz)
+    with client(authz) as b:
+        r = b.get('/jobs/'+ident)
+        assert r.status_code == 200
+        assert 'data-credential-open' in r.text and '<dialog' in r.text
+        assert 'name="vault_password"' not in r.text  # Lazy-loaded, outside pollable fragment.
+        r = b.get('/_partials/jobs/'+ident+'/credentials')
+        assert r.status_code == 200
+        assert 'Use customer Vault' in r.text and 'Enter separately' in r.text
+        assert 'type="radio"' in r.text and 'btn-check' in r.text
+        assert 'data-credential-secret' in r.text and 'hx-history="false"' in r.text
+        assert 'value="'+SYNTHETIC+'"' not in r.text
+        assert 'no-store' in r.headers['cache-control']
+        r = b.get('/jobs/'+ident+'/credentials')
+        assert r.status_code == 200 and 'data-credential-form' in r.text
+        assert 'action="/jobs/'+ident+'/credentials"' in r.text
+    for user in ('another', 'admin2'):
+        with client(authz, user) as b:
+            assert b.get('/_partials/jobs/'+ident+'/credentials').status_code in (403, 404)
+            assert b.get('/api/v2/runs/'+ident+'/credential-status').status_code in (403, 404)
+
+
+def test_only_core_reported_fields_shown(authz):
+    vault = make_job(authz, requirements=['vault_password'])
+    key = make_job(authz, requirements=['ssh_key_passphrase_or_customer_vault_value'])
+    conn = make_job(authz, requirements=['connection_password'])
+    unsupported = make_job(authz, requirements=['become_password'])
+    with client(authz) as b:
+        v = b.get('/_partials/jobs/'+vault+'/credentials').text
+        assert 'name="vault_password"' in v and 'name="ssh_key_passphrase"' not in v
+        k = b.get('/_partials/jobs/'+key+'/credentials').text
+        assert 'Use customer Vault' not in k
+        assert 'name="ssh_key_passphrase" maxlength="2048" required' in k
+        c = b.get('/_partials/jobs/'+conn+'/credentials').text
+        assert 'name="connection_password"' in c and 'name="vault_password"' not in c
+        assert b.get('/_partials/jobs/'+unsupported+'/credentials').status_code == 409
+
+
+@pytest.mark.parametrize('status,phase,canceled,expired', [
+    ('queued', '', False, False), ('running', 'claimed', False, False),
+    ('running', 'waiting', True, False), ('running', 'waiting', False, True),
+    ('failed', 'released', False, False)])
+def test_reservation_state_changes_never_keep_form_eligible(authz, status, phase, canceled, expired):
+    ident = make_job(authz, status=status, phase=phase, canceled=canceled,
+                     deadline=int(time.time())-1 if expired else None)
+    with client(authz) as b:
+        r = b.get('/api/v2/runs/'+ident+'/credential-status')
+        assert r.status_code == 200 and not r.json()['can_submit']
+        assert b.get('/_partials/jobs/'+ident+'/credentials').status_code == 409
+        r = b.post('/api/v2/runs/'+ident+'/credentials', json={'vault_password': SYNTHETIC})
+        assert r.status_code == 409 and SYNTHETIC not in r.text
+
+
+def test_status_get_is_read_only_and_does_not_renew(authz):
+    ident = make_job(authz)
+    auth, users = authz
+    flow = Workflows(auth.settings)
+    before = flow.job(users['operator'], ident)
+    with client(authz) as b:
+        for _ in range(3):
+            r = b.get('/api/v2/runs/'+ident+'/credential-status')
+            assert r.json()['can_submit']
+            assert set(r.json()) == {'job_id','status','phase','can_submit','cancel_requested','server_now','deadline'}
+        b.get('/_partials/jobs/'+ident+'/credentials')
+    after = flow.job(users['operator'], ident)
+    assert before['credential_deadline'] == after['credential_deadline']
+    assert before['events'] == after['events'] and before['status'] == after['status']
+
+
+def test_revoked_grant_and_session_denied(authz):
+    ident = make_job(authz)
+    auth, users = authz
+    with client(authz) as b:
+        with auth.store.transaction() as db:
+            db.execute('DELETE FROM grants WHERE user_id=?', (users['operator'],))
+        assert b.get('/api/v2/runs/'+ident+'/credential-status').status_code == 403
+        assert b.get('/_partials/jobs/'+ident+'/credentials').status_code == 403
+        assert b.post('/api/v2/runs/'+ident+'/credentials', json={'vault_password': SYNTHETIC}).status_code == 403
+        with auth.store.transaction() as db: db.execute('DELETE FROM sessions')
+        assert b.get('/api/v2/runs/'+ident+'/credential-status').status_code == 401
+
+
+@pytest.mark.parametrize('route', ['/api/v2/runs/', '/api/v2/jobs/'])
+def test_submit_keeps_one_run_wire_and_literal_secret_semantics(authz, monkeypatch, route):
+    ident = make_job(authz)
+    auth, users = authz
+    packets = []
+    class Sock:
+        def __enter__(self): return self
+        def __exit__(self, *args): pass
+    monkeypatch.setattr(wire, 'connect', lambda *a, **k: Sock())
+    monkeypatch.setattr(wire, 'send', lambda sock, value, limit: packets.append(json.loads(json.dumps(value))))
+    monkeypatch.setattr(wire, 'receive', lambda *a: {'accepted': True})
+    with client(authz) as b:
+        r = b.post(route+ident+'/credentials', json={'vault_password': SYNTHETIC})
+        assert r.status_code == 202 and r.json()['accepted']
+        assert 'not remote authentication verification' in r.json()['notice']
+        assert SYNTHETIC not in r.text
+    assert packets[0]['credentials']['vault_password'] == SYNTHETIC
+    assert packets[0]['job'] == ident and packets[0]['user'] == users['operator']
+    assert SYNTHETIC.encode() not in auth.settings.database.read_bytes()
+
+
+def test_submission_unknown_does_not_claim_it_was_not_received(authz, monkeypatch):
+    ident = make_job(authz)
+    monkeypatch.setattr(wire, 'connect', lambda *a, **k: (_ for _ in ()).throw(OSError('synthetic internal detail')))
+    with client(authz) as b:
+        r = b.post('/api/v2/runs/'+ident+'/credentials', json={'vault_password': SYNTHETIC})
+        assert r.status_code == 409 and 'could not be confirmed' in r.json()['error']['message']
+        assert 'synthetic internal' not in r.text and SYNTHETIC not in r.text
+
+
+def test_csrf_origin_body_limit_duplicate_and_forbidden_fields(authz):
+    ident = make_job(authz)
+    with client(authz) as b:
+        path = '/api/v2/runs/'+ident+'/credentials'
+        assert b.post(path, json={'vault_password': SYNTHETIC}, headers={'Origin':'https://other.invalid'}).status_code == 403
+        csrf = b.headers.pop('X-CSRF-Token')
+        assert b.post(path, json={'vault_password': SYNTHETIC}).status_code == 403
+        b.headers['X-CSRF-Token'] = csrf
+        assert b.post(path, json={'vault_password': 'x'*9000}).status_code == 413
+        for value in ({'vault_password': '\n'}, {'vault_password': 'x'*2049}, {'username': 'root'},
+                      {'become_password': 'x'}, {'vault_password': SYNTHETIC, 'scope': 'all'}):
+            r = b.post(path, json=value)
+            assert r.status_code == 400 and SYNTHETIC not in r.text
+        r = b.post('/jobs/'+ident+'/credentials', content='_csrf='+csrf+'&vault_password=x&vault_password=y',
+                   headers={'Content-Type': 'application/x-www-form-urlencoded'})
+        assert r.status_code == 400
+
+
+def test_required_key_without_vault_and_no_new_auth_override():
+    with pytest.raises(WebError): service.fields({}, ['ssh_key_passphrase_or_customer_vault_value'])
+    assert service.fields({'ssh_key_passphrase': SYNTHETIC}, ['ssh_key_passphrase_or_customer_vault_value']) == {'ssh_key_passphrase': SYNTHETIC}
+    with pytest.raises(WebError): service.fields({}, ['ssh_key_passphrase'])
+    with pytest.raises(WebError): service.fields({'ssh_key_passphrase': SYNTHETIC}, ['vault_password'])
+
+
+def test_attention_scope_not_latest_100_and_no_auto_approval(authz):
+    auth, users = authz
+    own = make_job(authz, when=1)
+    others = make_job(authz, owner='another')
+    pending = make_job(authz, owner='another', status='pending', phase='')
+    admin_own = make_job(authz, owner='admin2', status='pending', phase='')
+    for _ in range(101): make_job(authz, status='failed', phase='released')
+    data = presentation.attention(Workflows(auth.settings), users['operator'])
+    assert data['total'] == 1 and data['items'][0]['id'] == own
+    admin_data = presentation.attention(Workflows(auth.settings), users['admin2'])
+    assert admin_data['total'] == 1 and admin_data['items'][0]['id'] == pending
+    assert others not in repr(admin_data) and admin_own not in repr(admin_data)
+    with client(authz) as b:
+        text = b.get('/_partials/attention').text
+        assert 'data-credential-open' in text and own in text and others not in text
+        r = b.get('/jobs')
+        assert 'Credentials needed' in r.text and own in r.text
+    assert Workflows(auth.settings).job(users['admin2'],pending)['status'] == 'pending'
+
+
+def test_modal_is_outside_status_poll_and_no_custom_toggle():
+    root = Path(__file__).resolve().parents[1]/'src/aim_webgui'
+    partial = (root/'templates/partials/job.html').read_text()
+    assert '<dialog' not in partial and '<input' not in partial.replace('<input type="hidden" name="_csrf" value="{{ csrf }}">','')
+    js = (root/'static/js/credentials.js').read_text()
+    assert 'localStorage' not in js and 'sessionStorage' not in js
+    assert 'dialog.showModal()' in js and 'performance.now()' in js
+    assert 'data-credential-secret' in js and 'credentials: \'same-origin\'' in js
+    assert "'Use custom credentials'" not in js
+
+
+def test_real_worker_socket_claim_is_single_use_and_never_persisted(authz, monkeypatch):
+    """Exercise the actual existing worker wait/claim; never call Core execution."""
+    import threading
+    import aim_webgui.worker as worker_module
+    ident = make_job(authz)
+    auth, users = authz
+    worker = worker_module.Worker(auth.settings, Path('/synthetic-unused-config.toml'))
+    monkeypatch.setattr(worker_module, 'revalidate', lambda *args: None)
+    with auth.store.read() as db:
+        row = dict(db.execute('SELECT * FROM jobs WHERE id=?',(ident,)).fetchone())
+    result, errors = [], []
+    def wait():
+        try: result.append(worker.wait_credentials(row))
+        except Exception as error: errors.append(error)
+    thread = threading.Thread(target=wait, daemon=True);thread.start()
+    until = time.monotonic()+3
+    while not (auth.settings.state_dir/'.credential.sock').exists() and time.monotonic()<until:
+        time.sleep(.01)
+    assert (auth.settings.state_dir/'.credential.sock').exists()
+    with client(authz) as b:
+        r = b.post('/api/v2/runs/'+ident+'/credentials', json={'vault_password': SYNTHETIC})
+        assert r.status_code == 202 and r.json()['accepted']
+        thread.join(timeout=3)
+        assert not thread.is_alive() and not errors
+        assert result[0]['credentials']['vault_password'] == SYNTHETIC
+        assert b.post('/api/v2/runs/'+ident+'/credentials', json={'vault_password': SYNTHETIC}).status_code == 409
+        state = b.get('/api/v2/runs/'+ident+'/credential-status').json()
+        assert state['phase'] == 'claimed' and not state['can_submit']
+    assert SYNTHETIC.encode() not in auth.settings.database.read_bytes()
+    result[0]['credentials'].clear();result.clear()
+
+
+def test_explicit_key_requirement_is_not_downgraded_when_vault_also_required(authz):
+    ident = make_job(authz, requirements=['vault_password', 'ssh_key_passphrase'])
+    with client(authz) as b:
+        r = b.get('/_partials/jobs/'+ident+'/credentials')
+        assert r.status_code == 200
+        assert 'data-key-source-choice' not in r.text
+        assert 'name="ssh_key_passphrase" maxlength="2048" required' in r.text
+        r = b.post('/api/v2/runs/'+ident+'/credentials', json={'vault_password': SYNTHETIC})
+        assert r.status_code == 400
+
+
+def test_credential_rate_limit_is_preserved_across_api_aliases(authz, monkeypatch):
+    ident = make_job(authz)
+    # This fixture isolates throttling; actual wire/claim is covered separately.
+    monkeypatch.setattr(service, 'submit', lambda *args: {'accepted': True})
+    with client(authz) as b:
+        for i in range(5):
+            route = '/api/v2/'+('runs' if i % 2 else 'jobs')+'/'+ident+'/credentials'
+            assert b.post(route, json={'vault_password': SYNTHETIC}).status_code == 202
+        assert b.post('/api/v2/runs/'+ident+'/credentials', json={'vault_password': SYNTHETIC}).status_code == 429
diff --git a/scripts/addons/webgui/tests/test_deployment_v2.py b/scripts/addons/webgui/tests/test_deployment_v2.py
new file mode 100644
index 0000000..e7449c0
--- /dev/null
+++ b/scripts/addons/webgui/tests/test_deployment_v2.py
@@ -0,0 +1,131 @@
+import importlib.util
+from pathlib import Path
+import sys
+import tomllib
+
+ROOT=Path(__file__).resolve().parents[1]
+sys.path.insert(0,str(ROOT/'deploy'))
+spec=importlib.util.spec_from_file_location('deployment_v2',ROOT/'deploy/deploy.py')
+deployment=importlib.util.module_from_spec(spec);sys.modules[spec.name]=deployment;spec.loader.exec_module(deployment)
+
+def test_units_have_no_sudo_or_root_runtime():
+    for mode,executor,user in [('serve',False,'aim-web'),('worker',False,'aim-web'),('executor',True,'svc_bf-ansible')]:
+        text=deployment.unit_text(user,991,Path('/etc/ansible/scripts/config/webgui.toml'),mode,executor=executor,executor_group=1001 if executor else None,supplementary_group=991 if executor else None,executor_local_home='/home/svc_bf-ansible' if executor else None)
+        assert f'User={user}\n'in text
+        assert 'NoNewPrivileges=true' in text
+        assert 'CapabilityBoundingSet=\n'in text
+        assert 'CAP_SETUID'not in text and 'sudo'not in text
+        assert 'RuntimeDirectory=aim-web-executor' in text if executor else 'RuntimeDirectory='not in text
+        if executor: assert 'RuntimeDirectoryMode=0711' in text
+        if executor:
+            assert 'Group=1001\n' in text
+            assert 'SupplementaryGroups=991\n' in text
+            assert 'Environment=HOME=/var/lib/aim-web-executor' in text
+            assert 'ReadWritePaths=/var/lib/aim-web-executor /var/lib/aim-web-executor/.ansible/tmp /home/svc_bf-ansible/.ansible/tmp -/etc/ansible/inventories' in text
+            assert 'core-staging-check' in text
+
+
+def test_no_private_core_import_and_no_old_stage_bridge():
+    text=(ROOT/'deploy/deploy.py').read_text()
+    assert 'from aim.config'not in text and 'sys.path.insert'not in text
+    assert 'key_export.py'not in text
+    assert 'core_transport="stdio"'in text
+    assert '--migrate-core'in text
+    assert "'db','migrate'"in text
+    assert text.index("os.replace(stage, target)")<text.index('atomic_bytes(EXECUTOR_UNIT')
+
+
+def test_site_profile_and_versions():
+    from aim_webgui.config import Settings
+    from aim_webgui import __version__,SCHEMA_VERSION,HTTP_API_VERSION
+    settings=Settings.load(ROOT/'deploy/webgui.example.toml')
+    assert settings.core_transport=='unix' and settings.core_executor_user=='svc_bf-ansible'
+    assert settings.host=='127.0.0.1' and settings.execution_require_approval is False
+    assert len(settings.execution_playbooks)==14
+    assert __version__=='2.1.0rc9' and SCHEMA_VERSION==5 and HTTP_API_VERSION==2
+    metadata=tomllib.loads((ROOT/'pyproject.toml').read_text())
+    assert metadata['tool']['aim-web']['http-api']==2
+
+
+def test_stage_and_rollback_preserve_modes(tmp_path):
+    target=tmp_path/'file';deployment.atomic_bytes(target,b'first',0o640)
+    deployment.atomic_bytes(target,b'second',0o600)
+    assert target.read_bytes()==b'second' and target.stat().st_mode&0o777==0o600
+    link=tmp_path/'link';link.symlink_to(target)
+    import pytest
+    with pytest.raises(ValueError):deployment.atomic_bytes(link,b'unsafe')
+    assert target.read_bytes()==b'second'
+
+
+def test_release_manifest_detects_changed_or_traversing_payload(tmp_path):
+    import hashlib
+    import pytest
+    files={'pyproject.toml':b'project','deploy/deploy.py':b'installer','src/aim_webgui/__init__.py':b'version'}
+    for name,data in files.items():
+        p=tmp_path/name;p.parent.mkdir(parents=True,exist_ok=True);p.write_bytes(data)
+    manifest=tmp_path/'MANIFEST.sha256'
+    original=''.join(hashlib.sha256(data).hexdigest()+'  '+name+'\n'for name,data in files.items())
+    manifest.write_text(original);deployment.verify_release(tmp_path)
+    dotted=''.join(hashlib.sha256(data).hexdigest()+'  ./'+name+'\n' for name,data in files.items())
+    manifest.write_text(dotted);deployment.verify_release(tmp_path)
+    manifest.write_text(original)
+    (tmp_path/'pyproject.toml').write_bytes(b'changed')
+    with pytest.raises(ValueError,match='integrity'):deployment.verify_release(tmp_path)
+    manifest.write_text('0'*64+'  ../outside\n')
+    with pytest.raises(ValueError,match='manifest'):deployment.verify_release(tmp_path)
+
+
+def test_home_and_direct_profile_defaults():
+    from aim_webgui.config import Settings
+    from dataclasses import replace
+    import pytest
+    settings=Settings.load(ROOT/'deploy/webgui.example.toml')
+    assert settings.core_home==Path('/var/lib/aim-web-executor')
+    with pytest.raises(ValueError):replace(settings,core_home=settings.state_dir).validate()
+    browsing=Settings.load(ROOT/'deploy/profiles/direct-npm.toml')
+    assert not browsing.execution_enabled and not browsing.credentials_enabled
+
+
+def test_executor_identity_preserves_primary_gid_and_scopes_web_group():
+    text=(ROOT/'deploy/deploy.py').read_text()
+    assert 'os.setgid(account.pw_gid)' in text
+    assert "os.getgrouplist(user,account.pw_gid) + [web.pw_gid]" in text
+    executor=(ROOT/'src/aim_webgui/core/executor.py').read_text()
+    assert 'os.chown(parent,-1,client_gid)' not in executor
+    assert "stat.S_IMODE(st.st_mode)!=0o711" in executor
+    assert 'os.chown(path,-1,client_gid)' in executor
+
+
+def test_executor_socket_readiness_waits_for_type_simple_bind(monkeypatch,tmp_path):
+    attempts=[]
+    def fake_validate(*args,**kwargs):
+        attempts.append(1)
+        if len(attempts)<3:
+            raise ValueError('Managed executor socket is missing or a symlink')
+    class Result:
+        returncode=0
+    monkeypatch.setattr(deployment,'validate_executor_runtime_permissions',fake_validate)
+    monkeypatch.setattr(deployment.subprocess,'run',lambda *a,**k: Result())
+    monkeypatch.setattr(deployment.time,'sleep',lambda *_: None)
+    deployment.wait_executor_runtime_permissions('aim-web','svc-bf',tmp_path/'core.sock',timeout=1)
+    assert len(attempts)==3
+
+
+def test_executor_socket_readiness_fails_if_service_exits(monkeypatch,tmp_path):
+    import pytest
+    monkeypatch.setattr(deployment,'validate_executor_runtime_permissions',lambda *a,**k: (_ for _ in ()).throw(ValueError('missing socket')))
+    class Result:
+        returncode=3
+    monkeypatch.setattr(deployment.subprocess,'run',lambda *a,**k: Result())
+    with pytest.raises(ValueError,match='exited before'):
+        deployment.wait_executor_runtime_permissions('aim-web','svc-bf',tmp_path/'core.sock',timeout=1)
+
+def test_restore_guard_probes_restored_adapter_as_executor_before_start(monkeypatch,tmp_path):
+    d=deployment.Deployment(tmp_path,'root',0);calls=[]
+    monkeypatch.setattr(d,'as_executor',lambda user,cmd,**kw:calls.append((user,cmd)))
+    assert d.restored_core_compatible({'venv':str(tmp_path/'old'),'executor_user':'nobody'})
+    assert calls[0][0]=='nobody' and str(tmp_path/'old/bin/python')==str(calls[0][1][0])
+    assert 'core_transport="stdio"'in calls[0][1][3]
+    def fail(*args,**kwargs):raise deployment.subprocess.CalledProcessError(1,['fixture'])
+    monkeypatch.setattr(d,'as_executor',fail)
+    assert not d.restored_core_compatible({'venv':str(tmp_path/'old')})
diff --git a/scripts/addons/webgui/tests/test_executor_unix.py b/scripts/addons/webgui/tests/test_executor_unix.py
new file mode 100644
index 0000000..b201547
--- /dev/null
+++ b/scripts/addons/webgui/tests/test_executor_unix.py
@@ -0,0 +1,75 @@
+"""Linux local socket/UID integration. Synthetic core inventory, no remote hosts."""
+from dataclasses import replace
+from pathlib import Path
+import grp
+import json
+import os
+import pwd
+import shutil
+import signal
+import socket
+import struct
+import subprocess
+import sys
+import tempfile
+import time
+import pytest
+from aim_webgui.config import Settings
+from aim_webgui.core.client import CoreClient
+from aim_webgui.credentials import wire
+
+
+def test_nonroot_executor_public_core_and_peer_rejection(core_root):
+    if os.geteuid()!=0 or not hasattr(socket,'SO_PEERCRED'):
+        pytest.skip('Needs Linux root in the isolated test container to exercise different local UIDs.')
+    account=pwd.getpwnam('nobody')
+    base=Path(tempfile.mkdtemp(prefix='aim-exec-'));base.chmod(0o755)
+    process=None
+    try:
+        core=base/'core';shutil.copytree(core_root,core)
+        for p in [core,*core.rglob('*')]:
+            if p.is_dir():p.chmod(0o755)
+            else:p.chmod(0o644)
+        config=core/'scripts/aim.yml'
+        config.write_text(f'root_dir: {core}\nservice_user: synthetic\nrequired_group: {grp.getgrgid(account.pw_gid).gr_name}\n')
+        runtime=base/'socket';runtime.mkdir(mode=0o711);os.chown(runtime,account.pw_uid,account.pw_gid)
+        home=base/'home';home.mkdir(mode=0o700);os.chown(home,account.pw_uid,account.pw_gid)
+        cfg=base/'web.toml'
+        cfg.write_text('[core]\ntransport="unix"\n'+f'command=[{json.dumps(sys.executable)},{json.dumps(str(core/"scripts/aimctl.py"))}]\n'+
+                      f'config={json.dumps(str(config))}\nhome={json.dumps(str(home))}\nsocket={json.dumps(str(runtime/"core.sock"))}\nexecutor_user="nobody"\nclient_user="root"\n')
+        cfg.chmod(0o644)
+        settings=Settings.load(cfg)
+        source=Path(__file__).resolve().parents[1]/'src'
+        def drop():os.setgroups([0,account.pw_gid]);os.setgid(account.pw_gid);os.setuid(account.pw_uid)
+        process=subprocess.Popen([sys.executable,'-B','-m','aim_webgui','--config',str(cfg),'executor'],
+                    env={**os.environ,'PYTHONPATH':str(source)},stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL,preexec_fn=drop)
+        for _ in range(200):
+            if settings.core_socket.exists():break
+            if process.poll()is not None:pytest.fail('Executor fixture exited before opening socket')
+            time.sleep(.05)
+        assert settings.core_socket.exists()
+        assert settings.core_socket.stat().st_uid==account.pw_uid
+        assert runtime.stat().st_gid==account.pw_gid
+        assert settings.core_socket.stat().st_gid==0
+        assert settings.core_socket.stat().st_mode&0o777==0o660
+        client=CoreClient(settings)
+        assert client.request('capabilities')['core_version']=='3.3.0rc8'
+        assert client.request('list_customers')==['example']
+        # A direct local client cannot smuggle an execution executable/path field.
+        with socket.socket(socket.AF_UNIX)as conn:
+            conn.connect(str(settings.core_socket));wire.send(conn,{'request':{'api_version':'1.0','operation':'list_customers','command':'id'},'credential_frame':False,'start_seconds':None})
+            assert wire.receive(conn)['type']=='transport_error'
+        # Make only this synthetic endpoint reachable to a different UID, so the
+        # SO_PEERCRED check, rather than DAC alone, is exercised.
+        runtime.chmod(0o755);settings.core_socket.chmod(0o666)
+        script='''import socket,sys
+s=socket.socket(socket.AF_UNIX);s.connect(sys.argv[1]);s.settimeout(3)
+assert s.recv(4)==b''
+'''
+        other=pwd.getpwnam('daemon')
+        def other_drop():os.setgroups([]);os.setgid(other.pw_gid);os.setuid(other.pw_uid)
+        result=subprocess.run([sys.executable,'-c',script,str(settings.core_socket)],preexec_fn=other_drop,capture_output=True,timeout=5)
+        assert result.returncode==0
+    finally:
+        if process and process.poll()is None:process.send_signal(signal.SIGTERM);process.wait(timeout=20)
+        shutil.rmtree(base)
diff --git a/scripts/addons/webgui/tests/test_journal_v5.py b/scripts/addons/webgui/tests/test_journal_v5.py
new file mode 100644
index 0000000..8b0a56b
--- /dev/null
+++ b/scripts/addons/webgui/tests/test_journal_v5.py
@@ -0,0 +1,138 @@
+from dataclasses import replace
+import json,sqlite3,time,threading
+import pytest
+from fastapi.testclient import TestClient
+from aim_webgui.config import Settings
+from aim_webgui.auth.service import Auth
+from aim_webgui.journal import Journal,Capture,project
+from aim_webgui.app import create_app
+from aim_webgui.workflows import Workflows
+from aim_webgui.errors import WebError
+from evidence_fixtures import job,ev
+
+@pytest.fixture
+def local(tmp_path):
+    s=Settings(state_dir=tmp_path/'state',public_url='https://aim.example.test');a=Auth(s);a.bootstrap()
+    with a.store.transaction()as db:db.execute('UPDATE users SET must_change_password=0');uid=db.execute('SELECT id FROM users').fetchone()[0]
+    return s,a,uid
+
+def batch(*items):return [(*project(e,{'test01.example'}),time.time())for e in items]
+
+def test_committed_snapshot_duplicate_sequences_and_metadata_only(local):
+    s,a,u=local;ident=job(a,u);j=Journal(s);j.begin(ident)
+    e=ev(1,raw='SYNTHETIC-SECRET-CANARY',msg={'password':'HIDDEN'})
+    j.append(ident,batch(e,e,ev(3,'host_result')))
+    snap=j.snapshot(u,ident)
+    assert snap['cursor']==2 and len(snap['events'])==2 and snap['dropped_events']==0
+    assert snap['checkpoint']['observed_task_starts']==1
+    assert snap['checkpoint']['hosts'][0]['task_id']=='t1'
+    with a.store.read()as db:assert 'SYNTHETIC-SECRET-CANARY'not in ''.join(r[0] for r in db.execute('SELECT payload FROM job_progress_events'))
+    j.append(ident,batch(e));assert j.snapshot(u,ident)['cursor']==2
+
+def test_retention_cursor_gap_and_checkpoint(local):
+    s,a,u=local;s=replace(s,journal_max_events=100);ident=job(a,u);j=Journal(s);j.begin(ident)
+    j.append(ident,batch(*(ev(i)for i in range(1,251))))
+    snap=j.snapshot(u,ident,after=0)
+    assert snap['first_cursor']==151 and snap['cursor']==250 and snap['omitted_events']==150 and snap['gap_before']
+    assert snap['checkpoint']['observed_task_starts']==250 and len(snap['checkpoint']['tasks'])==64
+    assert len(j.snapshot(u,ident,before=201,limit=20)['events'])==20
+    with pytest.raises(WebError):j.snapshot(u,ident,after=9999)
+
+def test_byte_limit_and_deletion(local):
+    s,a,u=local;s=replace(s,journal_max_bytes=65536);ident=job(a,u,status='failed');j=Journal(s);j.begin(ident)
+    j.append(ident,batch(*(ev(i,label='X'*200)for i in range(1,400))),closed=True)
+    snap=j.snapshot(u,ident);assert snap['retained_bytes']<=65536 and snap['omitted_events']>0
+    Workflows(s).delete_jobs(u,[ident])
+    with a.store.read()as db:
+        assert db.execute('SELECT COUNT(*) FROM job_progress_events').fetchone()[0]==0
+        assert db.execute('SELECT COUNT(*) FROM job_progress_state').fetchone()[0]==0
+
+def test_capture_independent_of_viewers_and_end(local):
+    s,a,u=local;ident=job(a,u);c=Capture(s,ident,['test01.example'])
+    for i in range(1,31):c.submit(ev(i))
+    assert c.close()
+    snap=Journal(s).snapshot(u,ident);assert len(snap['events'])==30 and snap['capture_state']=='closed'
+    with a.store.transaction()as db:db.execute("UPDATE jobs SET status='successful' WHERE id=?",(ident,))
+    token,_=a.new_session(u)
+    with TestClient(create_app(s),base_url=s.public_url)as client:
+        client.cookies.set(s.cookie_name,token)
+        first=client.get('/api/v2/runs/'+ident+'/progress').json()
+        replay=client.get('/api/v2/runs/'+ident+'/progress/stream?after=0',headers={'Last-Event-ID':'20'})
+        assert replay.status_code==200 and replay.text.count('event: line\n')==10
+        assert 'id: 21\n'in replay.text and 'id: 20\n'not in replay.text
+        assert 'event: end'in replay.text
+        second=client.get('/api/v2/runs/'+ident+'/progress').json();assert first['cursor']==second['cursor']==30
+
+def test_owner_scope_active_delete_and_crash_marker(local):
+    s,a,u=local;a.create_user('viewer','Synthetic-password-value-2026','viewer')
+    with a.store.transaction()as db:db.execute('UPDATE users SET must_change_password=0');v=db.execute("SELECT id FROM users WHERE username='viewer'").fetchone()[0]
+    ident=job(a,u);j=Journal(s);j.begin(ident);j.append(ident,batch(ev(1)))
+    with pytest.raises(WebError):j.snapshot(v,ident)
+    with pytest.raises(WebError):Workflows(s).delete_jobs(u,[ident])
+    with a.store.transaction()as db:db.execute("UPDATE jobs SET status='interrupted' WHERE id=?",(ident,))
+    assert j.snapshot(u,ident)['capture_interrupted']
+
+def test_queue_pressure_is_bounded_and_disclosed(local,monkeypatch):
+    s,a,u=local;ident=job(a,u)
+    monkeypatch.setattr('aim_webgui.journal.QUEUE_EVENTS',2)
+    original=Journal.append
+    def slow(self,*args,**kwargs):time.sleep(.05);return original(self,*args,**kwargs)
+    monkeypatch.setattr(Journal,'append',slow)
+    c=Capture(s,ident,['test01.example']);start=time.monotonic()
+    for i in range(1,301):c.submit(ev(i))
+    assert time.monotonic()-start<1
+    c.close();snap=Journal(s).snapshot(u,ident)
+    assert snap['dropped_events']>0 and snap['capture_state']=='closed_with_gaps'
+
+def test_storage_failure_does_not_throw_from_sink(local,monkeypatch):
+    s,a,u=local;ident=job(a,u)
+    def fail(*args,**kwargs):raise sqlite3.OperationalError('SYNTHETIC disk full; never logged')
+    monkeypatch.setattr(Journal,'append',fail)
+    c=Capture(s,ident,['test01.example']);c.submit(ev(1));c.close()
+    with a.store.transaction()as db:db.execute("UPDATE jobs SET status='failed' WHERE id=?",(ident,))
+    assert Journal(s).snapshot(u,ident)['capture_interrupted']
+
+def test_core_result_event_is_not_final_success(local):
+    s,a,u=local;ident=job(a,u);j=Journal(s);j.begin(ident)
+    j.append(ident,batch(ev(1,'result',result={'status':'succeeded','operation_result':{'raw':'NOT-STORED'}})))
+    snap=j.snapshot(u,ident);assert snap['job_status']=='running' and not snap['terminal']
+    assert snap['checkpoint']['result_event_observed'] and 'NOT-STORED'not in json.dumps(snap)
+
+def test_legacy_and_new_no_events_are_explicit(local):
+    s,a,u=local;ident=job(a,u,status='successful')
+    snap=Journal(s).snapshot(u,ident);assert not snap['available'] and 'not captured'in snap['message']
+
+def test_wrong_identity_and_unknown_additive_payloads(local):
+    s,a,u=local;ident=job(a,u);c=Capture(s,ident,['test01.example'])
+    c.submit(ev(1,'host_result',host='someone-else.example'))
+    c.submit(ev(2,'progress',status='ok',msg='NO-SAVE'))
+    c.submit(ev(3,'task_started',environment={'secret':'NO-SAVE'}))
+    c.close();snap=Journal(s).snapshot(u,ident)
+    assert snap['dropped_events']==1 and len(snap['events'])==1 and 'NO-SAVE'not in json.dumps(snap)
+
+def test_two_live_authorized_streams_share_committed_cursor_and_revocation(local):
+    s,a,u=local;ident=job(a,u);j=Journal(s);j.begin(ident);j.append(ident,batch(ev(1)))
+    tokens=[a.new_session(u)[0] for _ in range(2)];responses=[];errors=[]
+    def view(token):
+        try:
+            with TestClient(create_app(s),base_url=s.public_url)as client:
+                client.cookies.set(s.cookie_name,token)
+                responses.append(client.get('/api/v2/runs/'+ident+'/progress/stream').text)
+        except Exception as e:errors.append(type(e).__name__)
+    threads=[threading.Thread(target=view,args=(t,),daemon=True)for t in tokens]
+    for t in threads:t.start()
+    time.sleep(.3);j.append(ident,batch(ev(2),ev(3)))
+    time.sleep(.3)
+    with a.store.transaction()as db:db.execute("UPDATE jobs SET status='successful' WHERE id=?",(ident,))
+    for t in threads:t.join(timeout=5)
+    assert not errors and len(responses)==2
+    for text in responses:
+        assert text.count('event: line\n')==3 and text.count('id: 3\n')==1 and 'event: end'in text
+    # A separate active stream must stop when its server-side session is revoked.
+    ident=job(a,u);j.begin(ident);responses.clear()
+    token=a.new_session(u)[0];thread=threading.Thread(target=view,args=(token,),daemon=True);thread.start()
+    time.sleep(.3)
+    with a.store.transaction()as db:db.execute('DELETE FROM sessions')
+    thread.join(timeout=5)
+    assert responses and '"clear":true'in responses[0]
+    assert not thread.is_alive()
diff --git a/scripts/addons/webgui/tests/test_migration_v4.py b/scripts/addons/webgui/tests/test_migration_v4.py
new file mode 100644
index 0000000..6ffb648
--- /dev/null
+++ b/scripts/addons/webgui/tests/test_migration_v4.py
@@ -0,0 +1,41 @@
+import json
+from pathlib import Path
+import sqlite3
+import pytest
+from aim_webgui.db.store import Store
+from aim_webgui.config import Settings
+from aim_webgui.workflows import Workflows
+from aim_webgui.errors import WebError
+
+
+def test_v3_migration_keeps_auth_history_and_duplicate_titles(tmp_path):
+    state=tmp_path/'state';state.mkdir(mode=0o700)
+    path=state/'webgui.sqlite3';path.touch(mode=0o600)
+    db=sqlite3.connect(path)
+    migrations=Path(__import__('aim_webgui.db.store',fromlist=['x']).__file__).parent/'migrations'
+    for version in (1,2,3):db.executescript(next(migrations.glob(f'{version:04d}_*.sql')).read_text())
+    db.execute('PRAGMA user_version=3')
+    db.execute("INSERT INTO users(username,password_hash,role,enabled,must_change_password,created_at,updated_at) VALUES('old-admin','SYNTHETIC-HASH','admin',1,0,1,1)")
+    uid=db.execute("SELECT id FROM users").fetchone()[0]
+    db.execute("INSERT INTO metadata VALUES('initialized','1')")
+    for name,ident in [('Duplicate','plan-a'),('duplicate','plan-b')]:
+        db.execute('INSERT INTO plans VALUES(?,?,?,?,?,?,?)',(ident,uid,name,'example','debug_test_connection','{"legacy":true}',1))
+    for ident,status in [('oldq','queued'),('oldp','pending'),('oldr','running'),('oldf','failed')]:
+        db.execute('INSERT INTO jobs(id,owner_id,status,plan,created_at,scheduled_at,mode) VALUES(?,?,?,?,?,?,?)',(ident,uid,status,'{"legacy":true}',1,1,'check'))
+        db.execute('INSERT INTO job_events(job_id,occurred_at,event) VALUES(?,?,?)',(ident,1,'Historical event'))
+    db.execute("INSERT INTO audit(occurred_at,actor,action,subject) VALUES(1,'old-admin','old-action','old')")
+    db.commit();db.close()
+    store=Store(path);store.migrate();store.check()
+    with store.read()as db:
+        assert db.execute('PRAGMA user_version').fetchone()[0]==5
+        assert db.execute('SELECT password_hash FROM users').fetchone()[0]=='SYNTHETIC-HASH'
+        assert [r[0]for r in db.execute('SELECT name FROM plans ORDER BY id')]==['Duplicate','duplicate']
+        assert dict(db.execute('SELECT id,status FROM jobs'))=={'oldq':'blocked','oldp':'blocked','oldr':'interrupted','oldf':'failed'}
+        assert db.execute('SELECT COUNT(*) FROM job_events').fetchone()[0]==4
+        assert db.execute("SELECT COUNT(*) FROM audit WHERE action='legacy-job-stopped'").fetchone()[0]==3
+    flow=Workflows(Settings(state_dir=state))
+    with pytest.raises(WebError)as error:
+        flow._insert_plan(uid,' DUPLICATE ',{'customer':'example','playbook':'debug_test_connection'})
+    assert error.value.code=='plan_name_exists'
+    store.migrate()
+    with store.read()as db:assert db.execute("SELECT COUNT(*) FROM audit WHERE action='legacy-job-stopped'").fetchone()[0]==3
diff --git a/scripts/addons/webgui/tests/test_migration_v5.py b/scripts/addons/webgui/tests/test_migration_v5.py
new file mode 100644
index 0000000..26118aa
--- /dev/null
+++ b/scripts/addons/webgui/tests/test_migration_v5.py
@@ -0,0 +1,30 @@
+"""Additive v4 -> v5 migration, not a running managed DB."""
+import json,sqlite3
+from pathlib import Path
+from aim_webgui.db.store import Store
+
+
+def test_schema4_history_and_accounts_preserved_old_work_stopped_once(tmp_path):
+    state=tmp_path/'state';state.mkdir(mode=0o700);path=state/'webgui.sqlite3';path.touch(mode=0o600)
+    directory=Path(__import__('aim_webgui.db.store',fromlist=['x']).__file__).parent/'migrations'
+    db=sqlite3.connect(path)
+    for version in range(1,5):db.executescript(next(directory.glob(f'{version:04d}_*.sql')).read_text())
+    db.execute('PRAGMA user_version=4')
+    db.execute("INSERT INTO users(username,password_hash,role,enabled,must_change_password,created_at,updated_at) VALUES('admin','SYNTHETIC-only','admin',1,0,1,1)")
+    user=db.execute('SELECT id FROM users').fetchone()[0]
+    db.execute("INSERT INTO metadata VALUES('initialized','1')")
+    for status in ('successful','failed','blocked','interrupted','queued','pending','running'):
+        db.execute('INSERT INTO jobs(id,owner_id,status,plan,created_at,scheduled_at,mode,core_result) VALUES(?,?,?,?,?,?,?,?)',
+                   (status,user,status,'{"targets":["fixture.example"]}',1,1,'apply','{"fixture":"keep"}' if status=='successful' else None))
+    db.commit();db.close()
+    store=Store(path);store.migrate();store.migrate();store.check()
+    with store.read()as db:
+        assert db.execute('PRAGMA user_version').fetchone()[0]==5
+        assert db.execute('SELECT password_hash FROM users').fetchone()[0]=='SYNTHETIC-only'
+        assert dict(db.execute('SELECT id,status FROM jobs'))=={k:('blocked' if k in ('queued','pending') else 'interrupted' if k=='running' else k)for k in ('successful','failed','blocked','interrupted','queued','pending','running')}
+        assert db.execute("SELECT core_result FROM jobs WHERE id='successful'").fetchone()[0]=='{"fixture":"keep"}'
+        assert db.execute("SELECT COUNT(*) FROM audit WHERE action='core33-job-stopped'").fetchone()[0]==3
+        assert db.execute('SELECT COUNT(*) FROM job_progress_events').fetchone()[0]==0
+        assert db.execute('SELECT COUNT(*) FROM job_operation_reports').fetchone()[0]==0
+    backup=tmp_path/'schema5-backup';store.backup(backup)
+    with sqlite3.connect(backup)as db:assert db.execute('PRAGMA user_version').fetchone()[0]==5
diff --git a/scripts/addons/webgui/tests/test_read_experience.py b/scripts/addons/webgui/tests/test_read_experience.py
new file mode 100644
index 0000000..3640333
--- /dev/null
+++ b/scripts/addons/webgui/tests/test_read_experience.py
@@ -0,0 +1,228 @@
+"""Read-only projections and mobile shell; no Ansible, keys or remote hosts."""
+from dataclasses import replace
+from pathlib import Path
+import json
+import time
+import uuid
+import pytest
+from fastapi.testclient import TestClient
+from aim_webgui.activity import Activity, HistoryFilter, host_url
+from aim_webgui.explorer import Explorer
+from aim_webgui.auth.service import Auth
+from aim_webgui.config import Settings
+from aim_webgui.app import create_app
+from aim_webgui.errors import WebError
+from aim_webgui.workflows import Workflows
+
+COUNTS=('ok','changed','failures','unreachable','skipped','rescued','ignored')
+
+@pytest.fixture
+def local_auth(tmp_path):
+    s=Settings(state_dir=tmp_path/'state',public_url='https://aim.example.test').validate()
+    a=Auth(s);a.bootstrap()
+    a.create_user('operator','Fixture-only-long-password-2026','viewer')
+    a.create_user('other','Fixture-only-other-password-2026','viewer')
+    with a.store.transaction() as db:
+        db.execute('UPDATE users SET must_change_password=0')
+    return a
+
+
+def uid(auth,name):
+    with auth.store.read() as db:return db.execute('SELECT id FROM users WHERE username=?',(name,)).fetchone()[0]
+
+
+def add_job(auth,owner='operator',customer='example',book='debug_test_connection',hosts=None,status='successful',mode='apply',when=None,legacy=False):
+    hosts=hosts or {'test01.example':'successful'}
+    when=int(time.time())-60 if when is None else when
+    target_list=[];summ=dict.fromkeys(('successful','failed','unreachable','not_started','indeterminate'),0)
+    for host,outcome in hosts.items():
+        counts=dict.fromkeys(COUNTS,0);counts['ok']=4
+        if outcome=='unreachable':counts['unreachable']=1
+        if outcome=='failed':counts['failures']=1
+        if outcome=='successful':counts['changed']=1
+        summ[outcome]+=1
+        target_list.append({'host':host,'outcome':outcome,'counts':counts})
+    ident=uuid.uuid4().hex
+    result={'status':'failed' if status=='failed' else 'succeeded','targets':target_list,
+            'target_summary':{'schema':'target_outcome_summary_v1','requested':len(hosts),'accounted':len(hosts),'complete':True,**summ}}
+    plan={'customer':customer,'playbook':book,'targets':list(hosts),'overrides':{'ignored_fixture_field':'MUST-NOT-LEAVE-PROJECTION'}}
+    with auth.store.transaction() as db:
+        db.execute('''INSERT INTO jobs(id,owner_id,plan,mode,status,created_at,scheduled_at,finished_at,core_result)
+                      VALUES(?,?,?,?,?,?,?,?,?)''',(ident,uid(auth,owner),json.dumps(plan),mode,status,when,when,
+                      when if status not in ('queued','running','pending') else None,None if legacy else json.dumps(result)))
+    return ident
+
+
+def test_mixed_target_semantics_and_no_task_count_inference(local_auth):
+    a=local_auth;ident=add_job(a,hosts={'test01.example':'successful','test02.example':'unreachable'},status='failed')
+    data=Activity(a.settings).report(uid(a,'operator'),HistoryFilter(customer='example',days='all'))
+    assert data['jobs']==1 and data['samples']==2
+    assert data['counts']['successful']==1 and data['counts']['unreachable']==1
+    assert data['success_percent']==50 and data['eligible']==2
+    assert data['records'][0]['job_display_status']=='partially_succeeded'
+    assert 'MUST-NOT-LEAVE' not in repr(data)
+
+
+def test_all_history_not_last_100_and_pagination(local_auth):
+    a=local_auth
+    for i in range(135):add_job(a,when=int(time.time())-1000-i)
+    data=Activity(a.settings).report(uid(a,'operator'),HistoryFilter(host='test01.example',days='all',page=5))
+    assert data['jobs']==135 and data['samples']==135 and data['pages']==6
+    assert len(data['records'])==25
+
+
+def test_visibility_for_totals_filters_and_matrix(local_auth):
+    a=local_auth
+    add_job(a);add_job(a,owner='other',customer='secret-customer',book='secret-book',hosts={'secret-host.example':'failed'},status='failed')
+    data=Activity(a.settings).report(uid(a,'operator'),HistoryFilter(days='all'))
+    assert data['samples']==1 and 'secret-' not in repr(data)
+    admin=Activity(a.settings).report(uid(a,'admin'),HistoryFilter(days='all'))
+    assert admin['samples']==2
+
+
+def test_mode_range_and_unknown_outcomes(local_auth):
+    a=local_auth
+    add_job(a,mode='check');add_job(a,legacy=True);add_job(a,status='queued')
+    add_job(a,hosts={'test01.example':'not_started'});add_job(a,hosts={'test01.example':'indeterminate'})
+    add_job(a,when=int(time.time())-86400*100)
+    data=Activity(a.settings).report(uid(a,'operator'),HistoryFilter(days='30'))
+    assert data['samples']==4 and data['eligible']==0 and data['success_percent'] is None
+    assert data['counts']['unavailable']==1 and data['counts']['outstanding']==1
+    check=Activity(a.settings).report(uid(a,'operator'),HistoryFilter(mode='check',days='all'))
+    assert check['samples']==1 and check['counts']['successful']==1
+
+
+def test_customer_identity_deletion_and_bad_facts(local_auth):
+    a=local_auth
+    ident=add_job(a);add_job(a,customer='second')
+    s=Activity(a.settings)
+    assert s.report(uid(a,'operator'),HistoryFilter(customer='example',days='all'))['samples']==1
+    Workflows(a.settings).delete_jobs(uid(a,'operator'), [ident])
+    assert s.report(uid(a,'operator'),HistoryFilter(customer='example',days='all'))['samples']==0
+    ident=add_job(a)
+    with a.store.transaction() as db:db.execute('UPDATE jobs SET core_result=? WHERE id=?',(json.dumps({'targets':[],'target_summary':{}}),ident))
+    assert s.report(uid(a,'operator'),HistoryFilter(customer='example',days='all'))['counts']['unavailable']==1
+
+
+def test_plan_visibility_is_owner_only(local_auth):
+    a=local_auth
+    with a.store.transaction() as db:
+        for name in ('admin','operator','other'):
+            db.execute('INSERT INTO plans(id,owner_id,name,customer,playbook,payload,created_at) VALUES(?,?,?,?,?,?,?)',
+                       (uuid.uuid4().hex,uid(a,name),name+' plan','example','debug_test_connection',json.dumps({'targets':['test01.example']}),int(time.time())))
+    data=Activity(a.settings).report(uid(a,'admin'),HistoryFilter(customer='example',host='test01.example',days='all'))
+    assert [p['name'] for p in data['plans']]==['admin plan']
+
+
+class FakeCore:
+    operations=[]
+    def __init__(self,*args,**kwargs):self.client=self
+    def request(self,operation,**kwargs):
+        self.operations.append(operation)
+        assert operation=='list_hosts'
+        return [{'name':h,'address':'192.0.2.'+str(i+1),'platforms':['linux']} for i,h in enumerate(('direct.example','shared.example','leaf.example'))]
+    def inventory_hierarchy(self,customer):
+        self.operations.append('inventory_hierarchy')
+        def node(name,path,hosts,children=None):return dict(name=name,path=path,hosts=hosts,children=children or [])
+        return {'schema':'inventory_hierarchy_v1','customer':customer,'hosts':['direct.example'],'groups':[
+            node('linux',['linux'],['shared.example'],[node('servers',['linux','servers'],['shared.example','leaf.example'])]),
+            node('lab',['lab'],[],[node('servers',['lab','servers'],['shared.example'])]),node('empty',['empty'],[])]}
+
+
+def test_explorer_distinct_counts_paths_root_members_and_search(local_auth,monkeypatch):
+    monkeypatch.setattr('aim_webgui.explorer.CoreAdapter',FakeCore)
+    e=Explorer(local_auth.settings)
+    p=e.page('example')
+    assert p['snap']['host_count']==3 and len(p['direct_hosts'])==1
+    assert len(p['snap']['groups'][('linux',)]['members'])==2
+    assert len(p['snap']['hosts']['shared.example']['memberships'])==3
+    p=e.page('example',branch='["lab","servers"]')
+    assert p['selected']['path']==['lab','servers'] and len(p['direct_hosts'])==1
+    assert 'activity?host=' in p['direct_hosts'][0]['url']
+    assert e.page('example',q='shared')['search_count']==1
+    with pytest.raises(WebError):e.page('example',branch='["missing"]')
+
+
+def test_explorer_map_is_bounded(local_auth,monkeypatch):
+    class Large(FakeCore):
+        def request(self,op,**kwargs):return []
+        def inventory_hierarchy(self,customer):return {'schema':'inventory_hierarchy_v1','customer':customer,'hosts':[],
+           'groups':[{'name':str(n),'path':[str(n)],'hosts':[],'children':[]}for n in range(50)]}
+    monkeypatch.setattr('aim_webgui.explorer.CoreAdapter',Large)
+    page=Explorer(local_auth.settings).page('example')
+    assert len(page['groups'])==12 and page['group_pages']==5 and len(page['graph_nodes'])<=49
+    assert page['groups_next']
+
+
+def test_new_get_views_are_read_only_and_survive_core_outage(local_auth,monkeypatch):
+    a=local_auth;add_job(a);FakeCore.operations=[]
+    monkeypatch.setattr('aim_webgui.explorer.CoreAdapter',FakeCore)
+    token,_=a.new_session(uid(a,'operator'))
+    with TestClient(create_app(a.settings),base_url=a.settings.public_url) as c:
+        c.cookies.set(a.settings.cookie_name,token)
+        for path in ('/inventory/example/explore','/inventory/example/explore?view=map',
+                     '/inventory/example/explore?q=shared',host_url('example','test01.example'),
+                     '/insights','/api/v2/insights','/api/v2/activity?customer=example&host=test01.example',
+                     '/api/v2/inventory/example/explore'):
+            r=c.get(path); assert r.status_code==200,(path,r.text[:2000])
+            assert r.headers['cache-control']=='no-store'
+        assert set(FakeCore.operations)=={'inventory_hierarchy','list_hosts'}
+        before=Activity(a.settings).report(uid(a,'operator'),HistoryFilter(days='all'))['jobs']
+        assert before==1
+        def down(*a,**k):raise WebError('core_offline','Do not echo sensitive path',503)
+        monkeypatch.setattr(FakeCore,'inventory_hierarchy',down)
+        r=c.get(host_url('example','test01.example'))
+        assert r.status_code==200 and 'Current inventory is unavailable' in r.text
+        assert 'Do not echo sensitive path' not in r.text
+        assert c.get('/inventory/example/explore').status_code==503
+
+
+def test_filters_bad_input_and_anonymous_access(local_auth):
+    a=local_auth
+    for f in (HistoryFilter(mode='invalid'),HistoryFilter(page=0),HistoryFilter(days='-1'),HistoryFilter(outcome='fake'),HistoryFilter(q='x'*256)):
+        with pytest.raises(WebError):Activity(a.settings).report(uid(a,'operator'),f)
+    with TestClient(create_app(a.settings),base_url=a.settings.public_url,follow_redirects=False) as c:
+        assert c.get('/api/v2/insights').status_code==401
+        assert c.get('/insights').status_code==303
+
+
+def test_menu_markup_and_escaped_history(local_auth,monkeypatch):
+    a=local_auth;add_job(a,book='<script>alert(1)</script>')
+    monkeypatch.setattr('aim_webgui.explorer.CoreAdapter',FakeCore)
+    token,_=a.new_session(uid(a,'operator'))
+    with TestClient(create_app(a.settings),base_url=a.settings.public_url) as c:
+        c.cookies.set(a.settings.cookie_name,token)
+        r=c.get('/insights?days=all')
+        assert '<script>alert(1)</script>' not in r.text
+        assert '&lt;script&gt;' in r.text
+        assert 'data-mobile-menu' in r.text and 'aria-controls="mobile-navigation"' in r.text
+        assert 'data-nav-forward' not in r.text and 'Swipe or use arrows' not in r.text
+        assert 'No terminal history collection' in r.text
+
+
+def test_public_core_explorer_with_execution_disabled(settings):
+    # Real public Core discovery only; no Ansible or remote execution.
+    s=replace(settings,execution_enabled=False,credentials_enabled=False)
+    page=Explorer(s).page('example')
+    assert page['snap']['host_count']==2
+    assert ('linux','lab') in page['snap']['groups']
+    assert page['snap']['hosts']['test01.example']['memberships'][0]['label']=='linux / lab'
+    assert 'activity?host=test01.example' in page['snap']['hosts']['test01.example']['url']
+
+
+def test_real_core_read_pages_with_empty_history(settings):
+    s=replace(settings,execution_enabled=False,credentials_enabled=False)
+    a=Auth(s);a.bootstrap()
+    with a.store.transaction() as db:db.execute('UPDATE users SET must_change_password=0')
+    token,_=a.new_session(uid(a,'admin'))
+    with TestClient(create_app(s),base_url=s.public_url) as c:
+        c.cookies.set(s.cookie_name,token)
+        for path in ('/inventory/example/explore',host_url('example','test01.example'),'/insights'):
+            r=c.get(path)
+            assert r.status_code==200,(path,r.text[:200])
+        r=c.get(host_url('example','old-host.example'))
+        assert 'Not in current inventory.' in r.text
+        assert 'No retained runs match' in r.text
+    with a.store.read() as db:
+        assert db.execute('SELECT COUNT(*) FROM jobs').fetchone()[0]==0
+        assert db.execute('SELECT COUNT(*) FROM run_reviews').fetchone()[0]==0
diff --git a/scripts/addons/webgui/tests/test_report_transport.py b/scripts/addons/webgui/tests/test_report_transport.py
new file mode 100644
index 0000000..ad05346
--- /dev/null
+++ b/scripts/addons/webgui/tests/test_report_transport.py
@@ -0,0 +1,88 @@
+"""Public-result framing with synthetic JSONL commands; no Ansible or remote calls."""
+from dataclasses import replace
+import json,os,pwd,socket,struct,sys,threading,time
+from pathlib import Path
+import pytest
+from aim_webgui.config import Settings
+from aim_webgui.core.client import CoreClient
+from aim_webgui.core.executor import Executor
+from aim_webgui.core.jsonio import loads
+from aim_webgui.core.reports import encoded
+from aim_webgui.credentials import wire
+from aim_webgui.errors import WebError
+from evidence_fixtures import result,plan
+
+
+def large_fixture(tmp_path, *, full_budget=False):
+    decl={'protocol':'aim_output_v1','schema':'synthetic_rows_v1','scope':'per_host','required':True,'sensitivity':'safe',
+          'max_bytes_per_host':1048576,'data_schema':{'type':'object','properties':{'rows':{'type':'array','maxItems':20000,
+          'items':{'type':'string','maxLength':8192}}},'required':['rows'],'additionalProperties':False}}
+    hosts=['test'+str(i)+'.example' for i in range(16 if full_budget else 4)]
+    rows=['\u2603'*2600]*128 if full_budget else ['synthetic-\u2603'*90]*500
+    final=result(decl,hosts,report_data={'rows':rows})
+    assert 1024*1024<len(encoded(final))<16*1024*1024
+    script=tmp_path/'wire_fixture.py';payload=tmp_path/'fixture-result.json';payload.write_bytes(encoded(final))
+    script.write_text('''import os,sys,json
+request=json.load(sys.stdin)
+fd=int(sys.argv[sys.argv.index('--credentials-fd')+1])
+with os.fdopen(fd) as stream: credentials=json.load(stream)
+assert credentials['vault_password']=='SYNTHETIC-PRIVATE-ONLY'
+assert 'credentials' not in request
+r=json.load(open('''+repr(str(payload))+'''))
+e={'event_version':'1.0','run_id':'fixture-run','sequence':1,'timestamp':'2026-09-20T10:00:00Z','kind':'result','status':'succeeded','result':r}
+for value in [{'type':'event','event':e},{'type':'response','api_version':'1.0','ok':True,'result':r}]:
+ raw=(json.dumps(value,ensure_ascii=False)+'\\n').encode()
+ for i in range(0,len(raw),16381):os.write(1,raw[i:i+16381])
+''')
+    if full_budget:script.write_text(script.read_text().replace('ensure_ascii=False','ensure_ascii=True'))
+    settings=Settings(core_transport='stdio',core_command=(sys.executable,str(script)),core_config=tmp_path/'synthetic.yml')
+    return settings,decl,hosts,final
+
+
+def test_large_result_stdio_and_duplicate_event_is_not_report_sample(tmp_path):
+    settings,decl,hosts,expected=large_fixture(tmp_path);events=[]
+    r=CoreClient(settings).request('execute',request=plan(decl,hosts)['core_request'],expected_revision='a'*64,
+        credentials={'vault_password':'SYNTHETIC-PRIVATE-ONLY'},result_contract=decl,event_sink=events.append)
+    assert r['operation_result']==expected['operation_result']
+    assert len(events)==1 and 'operation_result'not in events[0] and 'result'not in events[0]
+
+
+def test_large_result_through_executor_socket_and_unchanged_secret_limits(tmp_path):
+    settings,decl,hosts,expected=large_fixture(tmp_path)
+    path=tmp_path/'core.sock'
+    who=pwd.getpwuid(os.geteuid()).pw_name
+    settings=replace(settings,core_transport='unix',core_socket=path,core_executor_user=who,core_client_user=who)
+    server=socket.socket(socket.AF_UNIX);server.bind(str(path));path.chmod(0o660);server.listen(1)
+    executor=Executor(settings)
+    def run():
+        conn,_=server.accept();executor.handle(conn)
+    thread=threading.Thread(target=run);thread.start()
+    try:
+        r=CoreClient(settings).request('execute',request=plan(decl,hosts)['core_request'],expected_revision='a'*64,
+            result_contract=decl,credentials={'vault_password':'SYNTHETIC-PRIVATE-ONLY'})
+        assert r['operation_result']==expected['operation_result']
+    finally:thread.join(timeout=10);server.close()
+    assert not thread.is_alive()
+    assert wire.SECRET_LIMIT==8192 and wire.MAX_MESSAGE==1048576
+
+
+@pytest.mark.parametrize('raw',[b'{"a":1,"a":2}',b'{"a":NaN}',b'['*49+b'0'+b']'*49,b'{"a":"\xff"}',b'{"a":'])
+def test_strict_decoder_rejects_ambiguous_or_torn_json(raw):
+    with pytest.raises((ValueError,UnicodeError)):loads(raw)
+
+
+def test_frame_bounds_before_allocation_and_torn_frames():
+    for body in (struct.pack('!I',33*1024*1024),struct.pack('!I',30)+b'{}'):
+        a,b=socket.socketpair()
+        try:
+            a.sendall(body);a.shutdown(socket.SHUT_WR)
+            with pytest.raises(ValueError):wire.receive(b,32*1024*1024,decoder=loads)
+        finally:a.close();b.close()
+
+
+def test_near_run_limit_with_escaped_unicode_and_repeated_final(tmp_path):
+    settings,decl,hosts,expected=large_fixture(tmp_path,full_budget=True)
+    assert 15*1024*1024<len(encoded(expected))<16*1024*1024
+    r=CoreClient(settings).request('execute',request=plan(decl,hosts)['core_request'],expected_revision='a'*64,
+        result_contract=decl,credentials={'vault_password':'SYNTHETIC-PRIVATE-ONLY'})
+    assert r['operation_result']==expected['operation_result']
diff --git a/scripts/addons/webgui/tests/test_reports_v33.py b/scripts/addons/webgui/tests/test_reports_v33.py
new file mode 100644
index 0000000..11f2592
--- /dev/null
+++ b/scripts/addons/webgui/tests/test_reports_v33.py
@@ -0,0 +1,130 @@
+from copy import deepcopy
+from dataclasses import replace
+import json,os,time
+from pathlib import Path
+import pytest
+from fastapi.testclient import TestClient
+from aim_webgui.app import create_app
+from aim_webgui.auth.service import Auth
+from aim_webgui.config import Settings
+from aim_webgui.core.reports import contract,data,operation_result,encoded,RUN_BYTES
+from aim_webgui.core.protocol import response_result
+from aim_webgui.reports import persist,Reports,presentation,TITLES
+from aim_webgui.workflows import Workflows,presentation_status
+from aim_webgui.errors import WebError
+from evidence_fixtures import declared,sample,plan,result,job
+
+@pytest.fixture
+def local(tmp_path):
+    s=Settings(state_dir=tmp_path/'state',public_url='https://aim.example.test')
+    a=Auth(s);a.bootstrap()
+    with a.store.transaction()as db:db.execute('UPDATE users SET must_change_password=0');uid=db.execute('SELECT id FROM users').fetchone()[0]
+    return s,a,uid
+
+@pytest.mark.parametrize('schema',sorted(TITLES))
+def test_all_nine_real_schema_contracts_and_retained_views(local,schema):
+    s,a,u=local;decl=declared(schema);p=plan(decl);r=result(decl);ident=job(a,u,p,status='successful')
+    assert contract(decl)['schema']==schema
+    projected=response_result({'type':'response','api_version':'1.0','ok':True,'result':r},'execute',declaration=decl,request=p['core_request'])
+    with a.store.transaction()as db:
+        small=persist(db,s,ident,p,projected)
+        db.execute('UPDATE jobs SET core_result=? WHERE id=?',(json.dumps(small),ident))
+    index=Reports(s).index(u,ident);item=Reports(s).slot(u,ident)
+    assert index['recorded'] and item['status']=='available'
+    if schema=='checkmk_user_config_v1':assert item['retention']=='metadata_only' and 'sections'not in item['data']
+    else:assert item['data']==r['operation_result']['hosts']['test01.example']['data']
+    assert 'data'not in small['operation_result']['hosts']['test01.example']
+    view=presentation(item);assert isinstance(view['facts'],list)
+    token,session=a.new_session(u)
+    with TestClient(create_app(s),base_url=s.public_url)as c:
+        c.cookies.set(s.cookie_name,token)
+        for path in (f'/jobs/{ident}',f'/jobs/{ident}/reports',f'/api/v2/runs/{ident}/reports',f'/api/v2/runs/{ident}/report'):
+            response=c.get(path);assert response.status_code==200,response.text
+
+@pytest.mark.parametrize('state',['missing','withheld','invalid','not_started','indeterminate'])
+def test_unavailable_is_not_empty_data(local,state):
+    s,a,u=local;decl=declared();p=plan(decl);r=result(decl,availability=state,status='failed')
+    clean=operation_result(r['operation_result'],decl,targets=p['targets'],check=False)
+    assert clean['hosts']['test01.example']['data']is None
+    ident=job(a,u,p,status='failed')
+    with a.store.transaction()as db:persist(db,s,ident,p,r)
+    item=Reports(s).slot(u,ident);assert item['status']==state and item['data']is None
+
+@pytest.mark.parametrize('mutation',[
+ lambda r:r.update(schema='wrong_v1'),lambda r:r.update(scope='global'),lambda r:r.update(check_mode=True),
+ lambda r:r['hosts'].update({'other.example':r['hosts']['test01.example']}),
+ lambda r:r['hosts']['test01.example']['data'].update(is_dc='false'),
+ lambda r:r['hosts']['test01.example']['data'].update(unrecognized='secret'),
+ lambda r:r['hosts']['test01.example'].update(status='withheld'),
+ lambda r:r['hosts']['test01.example'].update(error={'message':'RAW'})])
+def test_mismatched_or_invalid_report_rejected(mutation):
+    decl=declared();value=result(decl)['operation_result'];mutation(value)
+    with pytest.raises(WebError):operation_result(value,decl,targets=['test01.example'],check=False)
+
+def test_required_report_failure_preserves_native_success(local):
+    s,a,u=local;decl=declared();r=result(decl,availability='missing',status='failed');p=plan(decl)
+    out=response_result({'type':'response','api_version':'1.0','ok':False,'result':r},'execute',declaration=decl,request=p['core_request'])
+    assert out['stage']=='result_validation' and out['exit_code']==0
+    assert out['targets'][0]['outcome']=='successful' and presentation_status('failed',out)=='failed'
+    assert out['operation_result']['hosts']['test01.example']['status']=='missing'
+
+def test_global_and_unknown_supported_schema():
+    decl=declared(scope='global');decl['schema']='future_capabilities_v1'
+    r=result(decl)['operation_result'];out=operation_result(r,decl,targets=['test01.example'],check=False)
+    assert out['hosts']=={} and out['global']['status']=='available'
+
+@pytest.mark.parametrize('badshape',[{'$ref':'https://evil.invalid/schema'}, {'type':'string'}, {'type':'array','items':{'type':'boolean'},'maxItems':50000}])
+def test_unsupported_schema_language_rejected(badshape):
+    decl=declared();decl['data_schema']=badshape
+    with pytest.raises(WebError):contract(decl)
+
+def test_null_false_zero_and_redacted_metadata(local):
+    s,a,u=local;decl=declared('checkmk_user_config_v1');content=sample(decl['data_schema'])
+    content['sections']={'plugins':{'enabled':False,'count':0,'missing':None,'password':'[REDACTED]','normal':'fixture-config'}}
+    content['redacted_paths']=['sections.plugins.password'];p=plan(decl)
+    for full in (False,True):
+        cfg=replace(s,reports_retain_configuration=full);ident=job(a,u,p,status='successful')
+        with a.store.transaction()as db:persist(db,cfg,ident,p,result(decl,report_data=content))
+        item=Reports(cfg).slot(u,ident)
+        if full:assert item['data']==content
+        else:assert 'sections'not in item['data'] and item['data']['redacted_paths']==content['redacted_paths']
+
+def test_secret_canary_and_nonfinite_rejected():
+    decl=declared('checkmk_user_config_v1');content=sample(decl['data_schema']);content['sections']={'value':'FIXTURE-SECRET'}
+    with pytest.raises(WebError):data(content,decl['data_schema'],secrets=['FIXTURE-SECRET'])
+    content['sections']={'password':'PLAIN'}
+    with pytest.raises(WebError):data(content,decl['data_schema'])
+    content['sections']={'value':float('nan')}
+    with pytest.raises(WebError):data(content,decl['data_schema'])
+
+def test_deletion_and_owner_admin_scope(local):
+    s,a,admin=local;a.create_user('viewer','Synthetic-fixture-password-2026','viewer')
+    with a.store.transaction()as db:db.execute('UPDATE users SET must_change_password=0');viewer=db.execute("SELECT id FROM users WHERE username='viewer'").fetchone()[0]
+    decl=declared();p=plan(decl);ident=job(a,admin,p,status='failed')
+    with a.store.transaction()as db:persist(db,s,ident,p,result(decl))
+    with pytest.raises(WebError):Reports(s).index(viewer,ident)
+    assert Reports(s).host_links(viewer,'example','test01.example')==[]
+    assert len(Reports(s).host_links(admin,'example','test01.example'))==1
+    Workflows(s).delete_jobs(admin,[ident])
+    with a.store.read()as db:
+        assert db.execute('SELECT count(*) FROM job_operation_results').fetchone()[0]==0
+        assert db.execute('SELECT count(*) FROM job_operation_reports').fetchone()[0]==0
+        assert db.execute("SELECT count(*) FROM audit WHERE action='job-deleted'").fetchone()[0]==1
+
+def test_json_escaped_html_and_lazy_report_content(local):
+    s,a,u=local;decl=declared('event_log_export_v1');content=sample(decl['data_schema']);content['files']=['<script>alert(1)</script>','javascript:alert(1)'];ident=job(a,u,plan(decl),status='successful')
+    with a.store.transaction()as db:
+        small=persist(db,s,ident,plan(decl),result(decl,report_data=content));db.execute('UPDATE jobs SET core_result=? WHERE id=?',(json.dumps(small),ident))
+    token,_=a.new_session(u)
+    with TestClient(create_app(s),base_url=s.public_url)as c:
+        c.cookies.set(s.cookie_name,token)
+        r=c.get('/jobs/'+ident+'/reports')
+        assert '<script>alert(1)</script>'not in r.text and '&lt;script&gt;'in r.text
+        assert 'href="javascript:'not in r.text
+        assert 'alert(1)'not in c.get('/api/v2/runs/'+ident).text
+
+def test_smaller_local_budget_does_not_truncate(local):
+    s,a,u=local;decl=declared('event_log_export_v1');data=sample(decl['data_schema']);data['files']=['x'*1000]*90
+    ident=job(a,u,plan(decl),status='successful');s=replace(s,reports_max_bytes=65536)
+    with a.store.transaction()as db:persist(db,s,ident,plan(decl),result(decl,report_data=data))
+    item=Reports(s).slot(u,ident);assert item['status']=='available' and item['retention']=='not_retained_limit' and item['data']is None
diff --git a/scripts/addons/webgui/tests/test_routes_v2.py b/scripts/addons/webgui/tests/test_routes_v2.py
new file mode 100644
index 0000000..5c03f3b
--- /dev/null
+++ b/scripts/addons/webgui/tests/test_routes_v2.py
@@ -0,0 +1,91 @@
+"""HTTP/HTMX flows against the real core metadata/prepare protocol, no execution."""
+import json
+import re
+import pytest
+from fastapi.testclient import TestClient
+from aim_webgui.app import create_app
+from aim_webgui.workflows import Workflows
+
+@pytest.fixture
+def browser(auth,admin):
+    token,session=auth.new_session(admin)
+    with TestClient(create_app(auth.settings),base_url=auth.settings.public_url,follow_redirects=False) as client:
+        client.cookies.set(auth.settings.cookie_name,token)
+        client.headers.update({'Origin':auth.settings.public_url,'X-CSRF-Token':session['csrf']})
+        yield client
+
+
+def test_html_new_run_review_queue_and_save_optional(browser,auth,admin):
+    response=browser.get('/plan?customer=example&playbook=debug_test_connection')
+    assert response.status_code==200, response.text
+    assert 'Load customer SSH key' in response.text
+    response=browser.post('/_partials/preflight',data={'customer':'example','playbook':'debug_test_connection',
+                       'targets':'test01.example','mode':'check','key_mode':'none'},headers={'HX-Request':'true'})
+    assert response.status_code==200,response.text
+    assert 'Run once' in response.text and 'Save as a reusable plan (optional)' in response.text
+    review=re.search(r'name="review_id" value="([a-f0-9]+)"',response.text).group(1)
+    assert 'name="name"' in response.text and not re.search('name="name"[^>]+required',response.text)
+    response=browser.post('/jobs',data={'review_id':review,'submission_key':review,'confirm':'reviewed'})
+    assert response.status_code==303,response.text
+    path=response.headers['location']
+    response=browser.get(path)
+    assert response.status_code==200,response.text
+    assert 'queued' in response.text
+    assert Workflows(auth.settings).plans(admin)==[]
+    saved=browser.post('/plans',data={'review_id':review,'name':''})
+    assert saved.status_code==303,saved.text
+    assert len(Workflows(auth.settings).plans(admin))==1
+    title=Workflows(auth.settings).plans(admin)[0]['name']
+    conflict=browser.post('/plans',data={'review_id':review,'name':title.upper()})
+    assert conflict.status_code==409
+    assert 'nothing was overwritten' in conflict.text
+    assert len(Workflows(auth.settings).plans(admin))==1
+
+
+def test_json_one_run_idempotency_and_api_version(browser,auth,admin):
+    r=browser.post('/api/v2/preflight',json={'customer':'example','playbook':'debug_test_connection','targets':['test01.example'],'overrides':{}})
+    assert r.status_code==200,r.text
+    data={'review_id':r.json()['review_id'],'confirm':True}
+    r=browser.post('/api/v2/runs',json=data,headers={'Idempotency-Key':'test-run-once'})
+    assert r.status_code==202,r.text
+    ident=r.json()['id']
+    repeat=browser.post('/api/v2/runs',json=data,headers={'Idempotency-Key':'test-run-once'})
+    assert repeat.json()['id']==ident
+    assert browser.get('/api/v2/runs/'+ident).json()['plan']['core_request']['check'] is True
+    assert browser.get('/api/v1/runs/'+ident).status_code==404
+
+
+def test_security_and_private_review(browser,auth,admin):
+    response=browser.post('/api/v2/preflight',headers={'Origin':'https://evil.invalid'},json={})
+    assert response.status_code==403
+    browser.headers.pop('X-CSRF-Token')
+    assert browser.post('/jobs',data={}).status_code==403
+    assert browser.get('/users').status_code==200
+    auth.create_user('viewer','Long-fixture-password-2026','viewer')
+    with auth.store.transaction()as db:
+        db.execute("UPDATE users SET must_change_password=0 WHERE username='viewer'")
+        user=db.execute("SELECT id FROM users WHERE username='viewer'").fetchone()[0]
+    token,session=auth.new_session(user)
+    browser.cookies.set(auth.settings.cookie_name,token)
+    browser.headers['X-CSRF-Token']=session['csrf']
+    assert browser.get('/users').status_code==403
+    assert browser.post('/api/v2/runs',json={'review_id':'not-mine','confirm':True},headers={'Idempotency-Key':'x'}).status_code in(403,409)
+
+
+def test_core_outage_keeps_local_login_recovery(auth,admin,monkeypatch):
+    from aim_webgui.adapters.core_v1 import CoreAdapter
+    from aim_webgui.errors import WebError
+    def down(*args,**kwargs):raise WebError('executor_unavailable','Offline',503)
+    monkeypatch.setattr(CoreAdapter,'customers',down)
+    with TestClient(create_app(auth.settings),base_url=auth.settings.public_url)as client:
+        assert client.get('/login').status_code==200
+        assert client.get('/healthz').status_code==200
+        assert client.get('/readyz').status_code==503
+
+
+def test_retained_overviews_and_admin_pages(browser):
+    for path in ('/','/customers','/customers/example/hosts','/playbooks','/jobs','/plans','/users','/setup','/audit','/system','/password'):
+        response=browser.get(path)
+        assert response.status_code==200,(path,response.status_code,response.text[:500])
+    response=browser.get('/users')
+    assert response.text.count('Scoped execution grants')==1
diff --git a/scripts/addons/webgui/tests/test_transport.py b/scripts/addons/webgui/tests/test_transport.py
new file mode 100644
index 0000000..1a99725
--- /dev/null
+++ b/scripts/addons/webgui/tests/test_transport.py
@@ -0,0 +1,84 @@
+"""Protocol robustness tests against a synthetic command, never a real remote host."""
+from dataclasses import replace
+import json
+import os
+from pathlib import Path
+import sys
+import threading
+import time
+import pytest
+from aim_webgui.core.client import CoreClient
+from aim_webgui.config import Settings
+from aim_webgui.core.protocol import validate_secrets, response_result, COUNTS
+from aim_webgui.errors import WebError
+
+@pytest.fixture
+def transport(tmp_path):
+    script=tmp_path/'fake.py'
+    settings=Settings(core_transport='stdio',core_command=(sys.executable,str(script)),core_config=tmp_path/'core.yml')
+    return script,settings
+
+
+def script_write(script,body):
+    script.write_text('import sys,json,os,time,stat\n'+body)
+
+
+def test_credentials_go_only_to_nonstandard_pipe_fd(transport):
+    script,settings=transport
+    script_write(script,"""
+line=sys.stdin.buffer.readline(); request=json.loads(line)
+assert 'credentials' not in request
+fd=int(sys.argv[sys.argv.index('--credentials-fd')+1]);assert fd>=3 and stat.S_ISFIFO(os.fstat(fd).st_mode)
+with os.fdopen(fd,'rb')as stream:secret=json.load(stream)
+assert secret['vault_password']=='fixture+%!{{data}}'
+assert secret['vault_password'].encode() not in line
+assert all(secret['vault_password']not in x for x in os.environ.values())
+assert all(secret['vault_password']not in x for x in sys.argv)
+print(json.dumps({'type':'response','api_version':'1.0','ok':False,'result':{
+ 'status':'failed','stage':'credentials','exit_code':None,'remote_work_may_have_started':False,
+ 'error':{'code':'vault_unlock_failed'},'counts':{},
+ 'target_summary':{'schema':'target_outcome_summary_v1','requested':1,'successful':0,'failed':0,'unreachable':0,'not_started':1,'indeterminate':0,'complete':True,'accounted':1},
+ 'targets':[{'host':'h','outcome':'not_started','counts':{'ok':0,'changed':0,'failures':0,'unreachable':0,'skipped':0,'rescued':0,'ignored':0}}]}}),flush=True)
+""")
+    request={'customer':'a','playbook':'p','hosts':['h']}
+    result=CoreClient(settings).request('execute',request=request,expected_revision='a'*64,credentials={'vault_password':'fixture+%!{{data}}'})
+    assert result['status']=='failed' and result['error']['code']=='vault_unlock_failed'
+
+@pytest.mark.parametrize('body,code',[
+ ("print('not-json',flush=True)",'core_protocol'),
+ ("print(json.dumps({'type':'event','event':{'event_version':'1.0','kind':'stage','sequence':1,'stage':'execution'}}),flush=True)",'core_outcome_unknown'),
+ ("print(json.dumps({'type':'response','api_version':'9','ok':True,'result':{}}),flush=True)",'core_protocol'),
+ ("print('X'*1048577,flush=True)",'core_protocol'),
+])
+def test_invalid_wire_is_not_success(transport,body,code):
+    script,settings=transport;script_write(script,body)
+    with pytest.raises(WebError)as e:CoreClient(settings).request('capabilities')
+    assert e.value.code==code
+
+
+def test_cancellation_stops_child(transport):
+    script,settings=transport;script_write(script,'time.sleep(60)')
+    cancel=threading.Event();timer=threading.Timer(.25,cancel.set);timer.start()
+    try:
+        with pytest.raises(WebError)as e:CoreClient(settings).request('capabilities',cancel=cancel)
+        assert e.value.code=='core_cancelled'
+    finally:timer.cancel()
+
+
+def test_start_deadline_cancels_preparation(transport):
+    script,settings=transport;script_write(script,'time.sleep(60)')
+    with pytest.raises(WebError)as e:
+        CoreClient(settings).request('execute',request={'customer':'a','playbook':'p','hosts':['h']},
+                          expected_revision='a'*64,deadline=time.monotonic()+.3)
+    assert e.value.code=='credential_expired'
+
+@pytest.mark.parametrize('secret',[{'vault_password':'x\n'},{'username':'admin'},{'vault_password':'\ud800'},{'become_password':'x'}])
+def test_invalid_secrets_rejected(secret):
+    with pytest.raises(WebError):validate_secrets(secret)
+
+
+def test_success_needs_valid_complete_counters():
+    result={'type':'response','api_version':'1.0','ok':True,'result':{'status':'succeeded','exit_code':0,'remote_work_may_have_started':True,'counts':dict.fromkeys(COUNTS,0),'target_summary':{'schema':'target_outcome_summary_v1','requested':0,'successful':0,'failed':0,'unreachable':0,'not_started':0,'indeterminate':0,'complete':True,'accounted':0},'targets':[]}}
+    assert response_result(result,'execute')['status']=='succeeded'
+    result['result']['counts']['ok']=-1
+    with pytest.raises(WebError):response_result(result,'execute')
diff --git a/scripts/addons/webgui/tests/test_worker_v2.py b/scripts/addons/webgui/tests/test_worker_v2.py
new file mode 100644
index 0000000..3039936
--- /dev/null
+++ b/scripts/addons/webgui/tests/test_worker_v2.py
@@ -0,0 +1,27 @@
+from dataclasses import replace
+from pathlib import Path
+import json
+import time
+from aim_webgui.auth.service import Auth
+from aim_webgui.workflows import Workflows
+from aim_webgui.worker import execute_claimed
+from test_core_execution import native_fixture
+
+
+def test_worker(settings,core_root):
+    native_fixture(core_root)
+    auth=Auth(settings);auth.bootstrap()
+    with auth.store.transaction()as db:
+        db.execute("UPDATE users SET must_change_password=0 WHERE username='admin'")
+        uid=db.execute("SELECT id FROM users WHERE username='admin'").fetchone()[0]
+    flow=Workflows(settings)
+    review=flow.review(uid,'example','debug_test_connection',['test01.example'],{})
+    ident=flow.queue_review(uid,review['review_id'],idempotency_key='worker-proof')
+    with flow.store.transaction()as db:
+        db.execute("UPDATE jobs SET status='running' WHERE id=?",(ident,))
+    execute_claimed(settings,ident)
+    result=flow.job(uid,ident)['core_result']
+    assert result['status']=='succeeded' and result['counts']['ok']==1
+    assert result['remote_work_may_have_started'] is True
+    assert not list(settings.state_dir.glob('.console-*'))
+    assert not flow.plans(uid)
diff --git a/scripts/addons/webgui/tests/test_workflows_v2.py b/scripts/addons/webgui/tests/test_workflows_v2.py
new file mode 100644
index 0000000..773a45f
--- /dev/null
+++ b/scripts/addons/webgui/tests/test_workflows_v2.py
@@ -0,0 +1,104 @@
+import json
+import concurrent.futures
+import sqlite3
+import time
+from dataclasses import replace
+import pytest
+from aim_webgui.workflows import Workflows, presentation_status
+from aim_webgui.errors import WebError
+
+
+def reviewed(flow,admin,**kw):
+    return flow.review(admin,'example','debug_test_connection',['test01.example'],{},**kw)
+
+
+
+def test_partial_success_presentation_uses_core_target_summary():
+    core={'target_summary':{'schema':'target_outcome_summary_v1','requested':25,'successful':24,'failed':0,'unreachable':1,'not_started':0,'indeterminate':0,'complete':True,'accounted':25}}
+    assert presentation_status('failed',core)=='partially_succeeded'
+    assert presentation_status('successful',core)=='successful'
+    core['target_summary']['successful']=0;core['target_summary']['failed']=24
+    assert presentation_status('failed',core)=='failed'
+
+def test_one_run_without_saving(settings,admin):
+    f=Workflows(settings);r=reviewed(f,admin)
+    ident=f.queue_review(admin,r['review_id'],idempotency_key='OneRun1')
+    assert f.job(admin,ident)['status']=='queued'
+    assert f.plans(admin)==[]
+    assert f.queue_review(admin,r['review_id'],idempotency_key='OneRun1')==ident
+    with pytest.raises(WebError):f.queue_review(admin,r['review_id'],scheduled_at=int(time.time())+60,idempotency_key='OneRun1')
+
+
+def test_optional_plan_names_and_collision(settings,admin):
+    f=Workflows(settings);r=reviewed(f,admin)
+    a=f.save_review(admin,r['review_id'],'');b=f.save_review(admin,r['review_id'],'')
+    assert a!=b and f.plan(admin,a)['name']!=f.plan(admin,b)['name']
+    p=f.save_review(admin,r['review_id'],'My Plan')
+    with pytest.raises(WebError) as e:f.save_review(admin,r['review_id'],'  MY PLAN ')
+    assert e.value.code=='plan_name_exists'
+    assert f.plan(admin,p)['name']=='My Plan'
+    assert len(f.plans(admin))==3
+
+
+def test_unicode_name_equivalence(settings,admin):
+    f=Workflows(settings);r=reviewed(f,admin)
+    f.save_review(admin,r['review_id'],'Plan A')
+    with pytest.raises(WebError):f.save_review(admin,r['review_id'],'Plan \uff21')
+
+
+def test_concurrent_saves_do_not_overwrite(settings,admin):
+    f=Workflows(settings);r=reviewed(f,admin)
+    def save():
+        try:return f.save_review(admin,r['review_id'],'concurrent')
+        except WebError as e:return e.code
+    with concurrent.futures.ThreadPoolExecutor(max_workers=2) as ex:results=list(ex.map(lambda _:save(),range(2)))
+    assert results.count('plan_name_exists')==1
+    assert len(f.plans(admin))==1
+
+
+def test_stale_review_rejected(settings,admin,core_root):
+    f=Workflows(settings);r=reviewed(f,admin)
+    with (core_root/'inventories/example/hosts.yml').open('a') as file:file.write('# external edit\n')
+    with pytest.raises(WebError) as e:f.queue_review(admin,r['review_id'],idempotency_key='fresh1')
+    assert e.value.code=='plan_stale'
+
+
+def test_mode_and_authentication_bound_to_revision(settings,admin):
+    f=Workflows(settings);r=reviewed(f,admin,check=False)
+    ident=f.queue_review(admin,r['review_id'],idempotency_key='mode1')
+    job=f.job(admin,ident)
+    assert job['mode']=='apply' and job['plan']['core_request']['check'] is False
+    assert job['plan']['authentication']['mode']=='inventory'
+
+
+def test_pending_approval_when_enabled(settings,admin):
+    f=Workflows(replace(settings,execution_require_approval=True));r=reviewed(f,admin)
+    ident=f.queue_review(admin,r['review_id'],idempotency_key='approval1')
+    assert f.job(admin,ident)['status']=='pending'
+    with pytest.raises(WebError):f.job_action(admin,ident,'approve')
+
+
+def test_core_opt_in_separate(settings,admin,core_root):
+    config=core_root/'scripts/aim.yml';config.write_text(config.read_text().replace('execution_enabled: true','execution_enabled: false'))
+    f=Workflows(settings);r=reviewed(f,admin)
+    with pytest.raises(WebError) as e:f.queue_review(admin,r['review_id'],idempotency_key='disabled1')
+    assert e.value.code=='core_execution_disabled'
+
+
+def test_retry_creates_fresh_job_and_bulk_delete_preserves_audit(settings,admin):
+    f=Workflows(settings);r=reviewed(f,admin)
+    one=f.queue_review(admin,r['review_id'],idempotency_key='retry1')
+    with f.store.transaction() as db:db.execute("UPDATE jobs SET status='failed' WHERE id=?",(one,))
+    two=f.retry_job(admin,one)
+    assert two!=one and f.job(admin,two)['status']=='queued'
+    with pytest.raises(WebError):f.delete_jobs(admin,[one,two])
+    f.delete_jobs(admin,[one])
+    with f.store.read() as db:assert db.execute("SELECT 1 FROM audit WHERE action='job-deleted'").fetchone()
+
+
+def test_legacy_plan_requires_fresh_review(settings,admin):
+    f=Workflows(settings)
+    with f.store.transaction() as db:
+        db.execute('INSERT INTO plans(id,owner_id,name,customer,playbook,payload,created_at) VALUES(?,?,?,?,?,?,?)',('a'*32,admin,'legacy','example','debug_test_connection',json.dumps({'customer':'example','playbook':'debug_test_connection','targets':['test01.example'],'overrides':{}}),0))
+    assert f.plan(admin,'a'*32)['name']=='legacy'
+    assert 'core_request' not in f.plan(admin,'a'*32)['payload']
diff --git a/scripts/aim.yml b/scripts/aim.yml
new file mode 100644
index 0000000..5fb008e
--- /dev/null
+++ b/scripts/aim.yml
@@ -0,0 +1,33 @@
+# AIM controller-wide configuration.
+# Installed location: /etc/ansible/scripts/aim.yml
+root_dir: /etc/ansible
+service_user: svc_bf-ansible
+required_group: aim-operators
+
+platform_groups:
+  - linux
+  - windows
+  - sophosxgs
+  - pfsense
+
+addons:
+  execution_enabled: true
+
+runtime:
+  private_key_owner: svc_bf-ansible
+
+ui:
+  clear_screen: true
+  ascii: false
+  output: compact
+
+maintenance:
+  checkmk_agent:
+    protocol: https
+    base_url: "monitoring.desq-gaming.de"
+    site_name: "monitoring"
+    version: "2.4.0"
+    patchlevel: "21"
+    revision: 1
+    role_files_dir: /etc/ansible/roles/checkmk_agent/files
+  checkmk_monitoring_scripts_dir: /etc/checkmk_monitoring_scripts
\ No newline at end of file
diff --git a/scripts/aimctl.py b/scripts/aimctl.py
new file mode 100644
index 0000000..3ed3f72
--- /dev/null
+++ b/scripts/aimctl.py
@@ -0,0 +1,8 @@
+#!/usr/bin/env python3
+"""Source-tree entry point for operators who have not refreshed console scripts."""
+from pathlib import Path
+import sys
+sys.path.insert(0, str(Path(__file__).resolve().parent / 'src'))
+from aim.ctl import main
+if __name__ == '__main__':
+    raise SystemExit(main())
diff --git a/scripts/config/webgui.toml b/scripts/config/webgui.toml
new file mode 100644
index 0000000..9a39a79
--- /dev/null
+++ b/scripts/config/webgui.toml
@@ -0,0 +1,75 @@
+# AIM WebGUI 2.1.0rc9 release-managed configuration
+# Replaced on every managed install/update/rollback.
+# AIM core configuration is never modified.
+
+[server]
+host = "127.0.0.1"
+port = 8080
+public_url = "https://aim.desq-gaming.de"
+
+[proxy]
+proxy_headers = true
+forwarded_allow_ips = ["127.0.0.1"]
+
+[session]
+session_hours = 8
+idle_minutes = 30
+
+[aim]
+scripts_path = "/etc/ansible/scripts"
+
+# Public core protocol, not an Ansible executable or private source import.
+[core]
+transport = "unix"
+command = ["/usr/local/bin/aimctl"]
+config = "/etc/ansible/scripts/aim.yml"
+socket = "/run/aim-web-executor/core.sock"
+executor_user = "svc_bf-ansible"
+client_user = "aim-web"
+# Dedicated writable process HOME for native caches; SSH trust uses effective SSH configuration.
+home = "/var/lib/aim-web-executor"
+
+[state]
+state_dir = "/var/lib/aim/webgui"
+
+# Browser -> NPM 192.168.20.3 -> HTTPS 192.168.20.46:8443 -> local nginx -> 127.0.0.1:8080.
+# This release does not create, replace or renew the separately installed TLS certificates.
+[execution]
+enabled = true
+playbooks = [
+    "checkmk_install_agent",
+    "checkmk_update_scripts_config",
+    "checkmk_read_windows_config",
+    "checkmk_cleanup_scripts",
+    "debug_test_connection",
+    "debug_show_disk_usage",
+    "debug_detect_host_roles",
+    "maintenance_export_event_logs",
+    "maintenance_start_stopped_services",
+    "maintenance_patch_os",
+    "maintenance_reboot_hosts",
+    "sophos_apply_baseline",
+    "sophos_apply_customer",
+    "pfsense_apply_baseline",
+]
+max_hosts = 25
+timeout_seconds = 1800
+require_approval = false
+# WebGUI policy only; core addons.execution_enabled is a separate operator opt-in.
+# Operator attestation for this deployment profile: backend CA trust has been established.
+transport_verified = true
+window_start_hour = 0
+window_end_hour = 24
+
+[credentials]
+enabled = true
+
+# Retained public metadata, not raw Ansible stdout/stderr. Deleted with the job.
+[journal]
+max_events = 20000
+max_bytes = 8388608
+
+[reports]
+max_bytes = 16777216
+# Expanded configuration content retention requires explicit operator opt-in.
+retain_configuration = false
diff --git a/scripts/config/webgui.toml.valid b/scripts/config/webgui.toml.valid
new file mode 100644
index 0000000..f0329c7
--- /dev/null
+++ b/scripts/config/webgui.toml.valid
@@ -0,0 +1,54 @@
+# AIM WebGUI 1.1.0rc5 release-managed configuration
+# Replaced on every managed install/update/rollback.
+# AIM core configuration is never modified.
+
+[server]
+host = "127.0.0.1"
+port = 8080
+public_url = "https://aim.desq-gaming.de"
+
+[proxy]
+proxy_headers = true
+forwarded_allow_ips = ["127.0.0.1"]
+
+[session]
+session_hours = 8
+idle_minutes = 30
+
+[aim]
+scripts_path = "/etc/ansible/scripts"
+
+[state]
+state_dir = "/var/lib/aim/webgui"
+
+# Browser -> NPM 192.168.20.3 -> HTTPS 192.168.20.46:8443 -> local nginx -> 127.0.0.1:8080.
+# This release does not create, replace or renew the separately installed TLS certificates.
+[execution]
+enabled = true
+ansible_bin = "/usr/bin"
+playbooks = [
+    "checkmk_install_agent",
+    "checkmk_update_scripts_config",
+    "checkmk_read_windows_config",
+    "checkmk_cleanup_scripts",
+    "debug_test_connection",
+    "debug_show_disk_usage",
+    "debug_detect_host_roles",
+    "maintenance_export_event_logs",
+    "maintenance_start_stopped_services",
+    "maintenance_patch_os",
+    "maintenance_reboot_hosts",
+    "sophos_apply_baseline",
+    "sophos_apply_customer",
+    "pfsense_apply_baseline",
+]
+max_hosts = 25
+timeout_seconds = 1800
+require_approval = false
+# Operator attestation for this deployment profile: backend CA trust has been established.
+transport_verified = true
+window_start_hour = 0
+window_end_hour = 24
+
+[credentials]
+enabled = true
diff --git a/scripts/docs/ADDON_AGENTS.md b/scripts/docs/ADDON_AGENTS.md
new file mode 100644
index 0000000..59680e4
--- /dev/null
+++ b/scripts/docs/ADDON_AGENTS.md
@@ -0,0 +1,105 @@
+# AIM add-on development contract
+
+**Core 3.3.0rc8; service/wire/event 1.0 (stable additive 1.x); Ansible Core 2.19.11.**
+AIM is the independently usable Source of Truth. Add-ons own presentation, sessions,
+authorization at their application boundary, approvals, queues and persistence.
+They never patch Core, scrape terminal output or duplicate inventory/execution rules.
+
+## Integration sequence
+
+Use `aim.services.v1` or one `aimctl request` process per JSON-lines request. Discover
+capabilities, current customers/hosts/hierarchy and catalog. Prepare explicit hosts and
+declared options, show the normalized request and result contract for review, check
+readiness under the actual worker identity, acquire a worker slot, collect fresh
+credentials, and execute using the prepared revision. A stale revision requires review.
+Omit unchanged options to preserve inventory/role-default precedence.
+
+The published API is in `scripts/docs/ADDON_API.md`; the complete new result contract
+is in `scripts/docs/OPERATION_RESULTS.md`. Current support and qualification are in
+`ADDON_SUPPORT.md` and `VALIDATION.md`. Never infer feature support from product version
+alone. `capabilities.collection_baselines` declares collection floors that add-on installers/operators must satisfy; Core does not upgrade them. Unknown optional response fields may be ignored; unknown errors fail safely.
+
+## Purposeful output: new in this candidate
+
+Check `capabilities.operation_results`. Catalog `result` is null or a declaration with
+schema, scope, required flag, limits and resolved `data_schema`. No new execute request
+field is needed. Reports are available in summary and detail mode through the final
+`RunResult.operation_result` and the existing final result event. There is no new raw
+stdout event. Parse final JSON without scraping PLAY/TASK text or debug bodies.
+
+A result contains `hosts[host]` with `status`, `schema`, `data`, `error`, plus optional
+`global`. Render data only when status is `available`. Missing/withheld/invalid/null is
+not an empty valid report. `complete` means all declared report slots arrived and passed
+validation; it does not mean the operation succeeded. Partial native runs can contain
+useful data from successful or failed targets. Preserve overall status/stage/exit,
+`remote_work_may_have_started`, target summary and report availability as separate facts.
+Never automatically retry a `result_validation` failure: remote changes may be complete.
+
+Use a generic bounded JSON/table renderer for unknown schemas, with optional richer
+views for known schemas. Escape text/HTML/Rich markup. Do not treat null versions as
+zero, pending updates as installed, excluded services as failed starts, or redacted
+configuration values as absent settings. Config reports expose sections but redact
+recognized secret/command fields; restrict report visibility and retention accordingly.
+
+## Safety and identity
+
+Core checks active OS group membership and filesystem access. This is same-UID local
+execution, not per-browser-user RBAC or an untrusted-tenant sandbox. The execution
+account owns its 0600 keys and private staging. `service_user` is not a local UID switch.
+`runtime.private_key_owner` affects new keys only. Do not relax permissions, export keys,
+add generic sudo wrappers or run the web frontend as root to bypass the boundary.
+
+Hardened service installers must provision both applicable staging locations (process
+HOME and passwd home) and narrow ReadWritePaths exceptions. Retain ProtectHome/read-only,
+ProtectSystem/strict and private tmp protections. Run `aimctl staging-check` inside the
+actual sandbox. Core does not create accounts, modify units or restart add-on services.
+
+Use OneRunCredentials or a private inherited FD, never passwords in request JSON, argv,
+environment, URLs, logs, queue records or databases. Queue plans, not secrets. Fresh
+credentials are required for each attempt. Password inputs are native defaults, not
+Custom overrides or proof of password-only authentication. Cross-UID execution is not
+provided by Core; independently managed executors must already have authorized access.
+
+## Progress and final outcomes
+
+`progress_mode: detail` is negotiated before preparation. Correlate play/task IDs,
+handle withheld names and fixed error hints, and ignore anonymous progress to avoid
+duplicate rows. Keep bounded queues and responsive sinks. Raw module/exception/debug
+output remains unsupported. Purposeful data is a separate final schema, not an expansion
+of host_result. Target outcomes come from Core's final native per-host stats, not task
+counts. An interrupted/incomplete stream must not become partial success by inference.
+
+## Ownership and handoff
+
+Core and add-ons release independently. Core deployment preserves add-on code/state,
+operator aim.yml, inventories, Vaults and keys; add-ons preserve Core in return.
+Use ZIP + checksum + the deployer, not Git or patches. Coordinate active jobs before
+source replacement. Only documented retired Core files are removed on upgrade.
+
+The nine current report schemas are documented in OPERATION_RESULTS.md and advertised
+by the catalog. This candidate has local regression coverage, not new managed-host
+certification. Record independent acceptance under your actual identity/sandbox/runtime.
+Request new schemas/capabilities from Core instead of adding private output workarounds.
+
+
+## OS patch-wave presentation (3.3.0rc8)
+
+Patch options remain catalog-driven. Interfaces should render the advertised reboot
+message/delay and the Windows-only `os_patching_rescan_after_reboot` option. Its catalog
+default is false; do not silently enable "fully patch" behavior in an add-on.
+
+Windows submits the current selected categories as one native `win_updates` wave with
+module-managed Windows Update sequencing and `reboot: false`. AIM evaluates reboot policy
+after the wave returns; it does not expose or own a per-update scheduler. With post-reboot
+continuation disabled, an AIM-performed reboot can still be a successful Core run while
+`continuation_required: true` tells the operator another patch run is needed.
+`remaining_updates_known: false` means the client must not invent or persist a next-wave
+list. If a final read-only search was performed, `remaining_updates_known: true` makes
+`pending` authoritative for that observation only.
+
+Render `failed_updates[].reason/message/native_code_hex` instead of parsing fatal text or
+Windows event logs. `install_not_allowed` deliberately does not mean "reboot required" by
+itself. If Core reports `blocked_reason: preexisting_reboot_required`, that is the separate
+preflight observation. Never auto-enable reboot, post-reboot continuation, or automatic job
+replay.
+
diff --git a/scripts/docs/ADDON_API.md b/scripts/docs/ADDON_API.md
new file mode 100644
index 0000000..9f0b3cf
--- /dev/null
+++ b/scripts/docs/ADDON_API.md
@@ -0,0 +1,153 @@
+# AIM public service API
+
+**Core 3.3.0rc8; API/wire/event 1.0, stable additive 1.x; Ansible Core 2.19.11.**
+Supported Python imports: `aim.services.v1` only. `aimctl` is a separate-process JSONL
+interface in the AIM Python environment. No HTTP service, privilege broker or add-on
+runtime is introduced. Core keeps its built-in terminal independently usable.
+
+## Authorization and discovery
+
+Protected calls check active primary/supplementary membership in configured
+`required_group` plus normal local access. capabilities is unguarded non-sensitive
+metadata. Caller-provided actor/user fields cannot authorize a request and are not
+accepted. `--config` is a trusted operator path, never user input to a privileged wrapper.
+
+| Operation | Python | Wire fields in addition to api_version/operation |
+|---|---|---|
+| capabilities | capabilities() | none |
+| list_customers | list_customers() | none |
+| list_hosts | list_hosts(customer) | customer |
+| inventory_hierarchy | inventory_hierarchy(customer) | customer |
+| list_playbooks | list_playbooks(customer) | customer |
+| prepare | prepare(request) | request |
+| readiness | readiness(request) | request |
+| staging_check | staging_check() | none |
+| execute | execute(request, expected_revision=..., credentials=..., event_sink=..., cancel=...) | request, expected_revision; secrets on separate FD |
+
+Catalog metadata includes typed inputs and `result` (null or a resolved declaration
+including data_schema). prepare returns normalized request, revision, credential
+requirements/reasons, warnings, revision coverage and result_contract. Discovery and
+prepare do not contact hosts or acquire secrets. readiness performs bounded local runtime
+and staging checks; it does not prove remote authentication. staging_check is a bounded
+local filesystem probe that may create missing private staging directories and deletes
+its own test file, not operator contents. It invokes no Ansible or remote commands.
+
+## RunRequest
+
+```json
+{"customer":"CUSTOMER","playbook":"debug_detect_host_roles","hosts":["HOST"],"overrides":{},"check":false,"key_mode":"none","become_password":false,"timeout_seconds":3600,"progress_mode":"summary"}
+```
+
+customer, playbook and hosts are required. Host count 1-1000; explicit unique inventory
+names only, never arbitrary group/limit patterns. Core revalidates membership/platforms
+and declared typed options. Omit options to inherit; 64 KiB maximum JSON overrides.
+Secret-reference inputs are variable references, not passwords. Customer/host/catalog
+code is trusted executable controller input, not an untrusted-tenant sandbox.
+
+key_mode none preserves native inventory handling without importing the caller's agent.
+customer loads only the canonical customer key into an owned agent: Linux target scope,
+0600 key owned by execution UID, ssh-agent/ssh-add required. It never exports the key.
+become_password true permits a default escalation password for a compatible catalog
+scope; it does not independently turn on escalation. check uses native check mode, not
+a guarantee of no effects for every plugin. timeout_seconds 10-86400 bounds the launched
+playbook; preflight stages have their own deadlines. progress_mode summary/detail is
+negotiated and part of the revision. Operation reports need no new request field.
+
+## Lifecycle and revisions
+
+Show prepared scope/options/key mode, result_contract and warnings before approval.
+Check readiness in the real worker sandbox, obtain a slot, then fresh credentials.
+execute re-prepares and checks revision before consuming secrets and before launch.
+Known source/config/key bytes and metadata are hashed with limits, not a complete atomic
+snapshot of dynamic includes, collections, external assets or arbitrary lookups. Stable
+customer locks cover cooperating writers, not direct shell edits. Quiesce source updates.
+
+`customer_vault_present` is conservative: a Vault can be needed by inventory credentials
+even when catalog require_vault is false. Other reason codes include catalog_requires_vault,
+catalog_requests_connection_password, request_requires_become_password and
+encrypted_customer_key_selected. This is not exhaustive templated variable analysis.
+
+## Private credentials
+
+Accepted keys only: vault_password, connection_password, become_password,
+ssh_key_passphrase. Literal single-line UTF-8 <=8192 bytes per value; no CR/LF/NUL;
+nonempty Vault/connection/become passwords. No trimming, hashing or recursive templating.
+Unencrypted keys need no passphrase. If selected encrypted key has no supplied phrase,
+Core can read the literal vault_linux_ssh_key_passphrase after Vault unlock.
+
+Python: use OneRunCredentials(values, ttl_seconds=120) and close in finally; TTL 1-300
+seconds before consume. Custom providers implement bounded single-run consume(run_id).
+Never prompt unattended or reuse a provider across jobs. Native executable password
+sources use private same-UID sockets; helper files hold no secret material. No password
+in argv/environment/request JSON/events. Native processes necessarily hold it in memory;
+cleanup is not a memory-erasure guarantee. Supplied passwords are native defaults, not
+forced Custom overrides or proof of password-only authentication.
+
+Machine: one newline-terminated JSON object on stdin <=128 KiB within ten seconds.
+Use `aimctl request --credentials-fd N` for execute, inheriting a private pipe/socket FD
+>=3 with one EOF-terminated JSON object <=64 KiB. Close writer after sending. Ordinary
+files/terminal/stdin/out/err FDs are rejected. Read deadline is five seconds when consumed.
+Send request/secrets concurrently with event consumption; avoid filling a pipe before
+starting the receiver. Pass FD using subprocess pass_fds, never shell text with passwords.
+Cross-UID launcher transport is outside the Core-supported profile.
+
+```bash
+aimctl capabilities
+printf '%s\n' '{"api_version":"1.0","operation":"list_customers"}' | aimctl request
+printf '%s\n' '{"api_version":"1.0","operation":"prepare","request":{"customer":"CUSTOMER","playbook":"debug_detect_host_roles","hosts":["HOST"]}}' | aimctl request
+```
+
+## Events and final results
+
+Each event has event_version, run_id, increasing sequence, UTC timestamp and kind.
+Summary kinds stage/progress/stats/result stay. Detail adds negotiated play/task/host
+metadata; see DETAILED_PROGRESS.md. Wire events are `{"type":"event","event":{...}}`.
+Final response is `{"type":"response","api_version":"1.0","ok":true,"result":{...}}`
+or ok:false with result/error. A final result event and final response are one job,
+not two. Missing final response is unknown outcome, not success. Stdout is JSONL only.
+
+RunResult fields: api_version, run_id, status (succeeded/failed/cancelled), stage,
+nullable exit_code, remote_work_may_have_started, nullable error, aggregate task counts,
+target_summary, targets, and operation_result (null when not declared). Target accounting
+is in TARGET_OUTCOMES.md. Purposeful report availability, schemas, limits and errors are
+in OPERATION_RESULTS.md. Native failures are preserved. A required report validation
+failure after native exit 0 yields status failed/stage result_validation/exit_code 0;
+native target stats remain unchanged. Never infer application data from ok/skipped counts.
+
+Error fields: code, fixed message, stage, retryable, required_credentials. Handle unknown
+codes safely, not by parsing message text. Pre-run ServiceError can occur without a
+RunResult. No fake report or target success is synthesized for a rejected request.
+
+| Error family | Action |
+|---|---|
+| access_denied / execution_disabled | Correct operator authorization/enablement, not bypass |
+| invalid_request / invalid_target / invalid_options / unknown_playbook | Correct request, re-prepare |
+| source_invalid / playbook_unavailable / source_symlink_unsupported | Repair trusted source |
+| resource_busy / review_stale | Wait or re-review; retain no stale secrets |
+| runtime_missing / runtime_version_unsupported / collections_missing | Repair approved native runtime |
+| controller_staging_* | Repair scoped worker staging inside sandbox; no password loop |
+| runtime_credential_defaults_unsupported | Resolve unsupported global Vault sources explicitly |
+| credential_required / credentials_expired / invalid_credential_channel | Fresh bounded provider/channel |
+| vault_unlock_failed / key_load_failed | Correct secret/access/format before launch |
+| syntax_check_failed | Authorized native diagnostics, no raw fallback |
+| host_unreachable / playbook_failed | Inspect outcomes; no automatic replay |
+| operation_result_* | Inspect report availability; remote work may be finished; never replay automatically |
+| invalid_event_stream / event_bridge_* / event_limit | Incomplete stream is not success |
+| timeout / cancelled / event_sink_failed / internal_error | Explicit recovery decision, preserve remote-work flag |
+
+Cancel with threading.Event in Python or SIGINT/SIGTERM to aimctl. Core stops owned
+process groups/agents, not completed remote changes or asynchronous external work.
+Use a bounded nonblocking event sink; slow browsers must not stall execution.
+
+## Runtime and detailed contracts
+
+The configured ansible-playbook plus sibling Vault/Galaxy must report canonical 2.19.11
+and consistent native Python/module identity. Collections, roles, local staging, remote
+Python/PowerShell, HOME/known-hosts and service restrictions need actual acceptance.
+The service selects root_dir/ansible.cfg or its fallback; it does not inherit arbitrary
+shell environment/credential/debug settings. Supported collection search path is explicit.
+No auto-install, recursive ownership repair, remote_tmp override or service-unit edit.
+
+See EXECUTOR_STAGING.md (both applicable homes), INVENTORY_HIERARCHY.md, TARGET_OUTCOMES.md,
+DETAILED_PROGRESS.md and OPERATION_RESULTS.md. ADDON_SUPPORT.md lists deliberate exclusions.
+VALIDATION.md records present evidence; SANITY.md is the only current acceptance checklist.
diff --git a/scripts/docs/ADDON_SUPPORT.md b/scripts/docs/ADDON_SUPPORT.md
new file mode 100644
index 0000000..7398f3d
--- /dev/null
+++ b/scripts/docs/ADDON_SUPPORT.md
@@ -0,0 +1,49 @@
+# AIM 3.3.0rc8 support matrix
+
+Service/wire/event 1.0 is stable and additive. Implementation status and controller
+qualification are different. Use live capabilities; the JSON file alongside this guide
+is only a default capability snapshot. [VALIDATION.md](VALIDATION.md) is the sole current
+evidence record.
+
+| Capability | Implementation | Activation/qualification |
+|---|---|---|
+| Discovery/catalog/explicit prepare | Supported | Required OS group/filesystem access |
+| Inventory hierarchy v1 | Supported, read-only | No independent inventory semantics in add-ons |
+| Staging preflight v2 | Supported | Test both applicable homes inside the real sandbox |
+| Native execution | Supported same-UID profile | Explicit config opt-in; ansible-core 2.19.11 and ansible.windows >=3.8.0,<4.0.0 |
+| Private credentials | Supported one-run provider/FD | Not generic request JSON; no native prompt automation |
+| Detailed progress v1 | Supported opt-in | Canonical callback/target acceptance required |
+| Per-target outcomes v1 | Supported summary/detail | Native final stats, not application-completion inference |
+| Purposeful operation reports v1 | Implemented candidate | Nine per-host schemas; native acceptance pending |
+| Global operation report transport | Implemented candidate | No shipped global publisher; separate native qualification |
+| Parsed Checkmk user config | Implemented candidate | Restricted basename/size; recognized secrets and commands redacted |
+| Custom credentials / password-only verification | Unsupported | Supplied passwords remain native defaults |
+| Cross-UID broker, key export, automatic owner migration | Unsupported | Independent execution identity must already be authorized |
+| API inventory/Vault mutation or bootstrap | Unsupported | Existing terminal workflows remain available |
+| Arbitrary debug/stdout/stderr/results | Unsupported | Only explicitly declared validated report data |
+| Automatic replay after launch | Unsupported | Explicit new operator decision required |
+
+A structured result is operational data and can reveal host inventory/configuration
+choices even after credential redaction. Add-ons must restrict access, safely render
+text and bound retention. Core does not implement their browser RBAC/CSRF/session policy.
+
+## OS patch presentation in 3.3.0rc8
+
+Add-ons obtain reboot delay/message and Windows post-reboot continuation from normal catalog
+metadata; no private UI contract is required. The `os_patching_rescan_after_reboot` default
+is false. A normal Windows patch run submits one selected update wave to native
+`ansible.windows.win_updates` with `reboot: false`, then applies AIM reboot policy after the
+wave returns. Show `continuation_required: true` as a request for
+a new operator-approved run, not as a Core failure and not as permission to submit another
+job automatically.
+
+If `remaining_updates_known` is false, do not infer the post-reboot patch state from the
+pre-reboot queue. If true, `pending` is a read-only final discovery. For Windows Update
+failures, render the bounded `failed_updates` fields; do not parse raw task/event text.
+`install_not_allowed` can mean an active installer or mandatory reboot, while
+`preexisting_reboot_required` is a distinct AIM preflight result.
+
+
+## Veeam O365 plugin relocation
+
+The Checkmk Veeam O365 script destination changed in Core 3.3.0rc8, but this is not an add-on API change. Consumers continue to use Core catalog/execution/results and must not reconstruct Checkmk filesystem paths independently.
diff --git a/scripts/docs/AGENTS.md b/scripts/docs/AGENTS.md
new file mode 100644
index 0000000..765c705
--- /dev/null
+++ b/scripts/docs/AGENTS.md
@@ -0,0 +1,99 @@
+# AIM authoritative development guidelines
+
+**Baseline: 3.3.0rc8.** This is the current Core guide. Operator instructions take
+precedence over earlier project documentation. Keep the built-in terminal in AIM.
+
+## Product and release ownership
+
+Core owns domain/execution truth, storage, reusable services and both first-party
+interfaces. Dependencies point interface -> services/domain/runtime; services must
+not import `aim.ui` or any add-on. Add-ons consume only `aim.services.v1` or `aimctl`.
+No Core change may require inspecting or editing an independent add-on's codebase.
+
+Release complete source ZIPs with SHA-256 sidecars and the operational deployer. No
+Git/patch dependency, `.patch` file, release manifest, bundled test/validator machinery,
+cache, inventory, Vault, private key, environment, downloaded package or collection.
+Do not mutate a published candidate. Every source change updates the product version
+and CHANGELOG. Service/wire/event 1.0 evolves additively; breaking changes require a
+separately versioned contract. Product and API versions are not interchangeable.
+
+## Layout and preservation
+
+`/etc/ansible/scripts` contains source, pyproject, global `aim.yml`, docs and the WinRM
+helper. `playbooks` contains the catalog, schemas and report filter plugins. `roles`
+contains execution roles. Customer `.aim.yml` remains in its customer directory.
+
+Deployment preserves operator config, inventory/Vault/keys, add-ons, environments and
+customer assets. Preview first; quiesce writers/runners; maintain source/launcher
+recovery. Retire only explicitly named old Core documents, never arbitrary Markdown.
+Do not reset LDAP groups, permissions or ownership recursively. Stable lock inodes and
+metadata-preserving atomic replacement apply. Source rollback cannot undo remote work.
+
+## Execution and credentials
+
+Canonical native runtime: ansible-core 2.19.11. AIM and add-on Python environments may
+be separate; do not install/upgrade Ansible during discovery or deployment. New service
+profiles stay opt-in. Require the actual execution UID/groups, owner-only private keys,
+usable collections and sandbox staging. Check both process/config HOME and passwd/NSS
+home paths where local delegation expands `~account`. Never override remote_tmp globally,
+switch UIDs or edit service units to hide a staging/access failure.
+
+Credentials use bounded one-run providers/private descriptors/sockets, never request
+JSON, argv, environment, output, examples or persisted plans. Supplied passwords remain
+native defaults, not forced inventory overrides. Existing Vault unlock retries are
+pre-launch only. Preserve selection on typos and Ctrl+C cancellation; never replay a
+launched editor/playbook automatically. Source and prepared revisions are change
+detectors, not authorization tokens or isolation from uncooperative shell edits.
+
+## Structured purposeful results
+
+Use `ansible.builtin.set_stats` with `data.aim_output`, `protocol: aim_output_v1`, a static
+schema ID, `per_host` matching the declaration and `aggregate: false`. Exactly one
+publication per host (or one global publication) per execution. Result normalization
+belongs in runbook roles/filter plugins, not hard-coded playbook branches in Core.
+
+Declare result shape/scope/required/sensitivity in the catalog. Define bounded types in
+`playbooks/schemas/`. The generic validator owns type/field/size/lifecycle enforcement;
+new schemas require no Core dispatch additions. Revalidate at the callback and public
+boundary. Preserve no_log provenance: final custom stats alone are not authorization
+to expose data. Unknown custom stats/debug/module results remain private.
+
+Operation reports, target outcomes and progress are separate. A required missing or
+invalid report can fail result validation after native exit 0; preserve exit_code and
+native target stats, and never replay. Interrupted output is indeterminate. On native
+failure retain available final reports without replacing the original failure.
+
+Declare operational field meanings precisely: bytes, observed versions, nullable
+unknowns, bounded fixed error codes. Never guess an installed version from a staged
+filename, imply a start return means a service stayed running, or call check-mode
+predictions completed changes. Patch reports must not silently truncate update lists.
+Checkmk config is parsed and redacted before publication; the filename alone does
+not make passphrases/MRPE command credentials safe. Raw configuration diffs stay private.
+
+Windows patching is operator-wave controlled: let the supported `win_updates` module process the currently approved update wave with module reboot disabled, then treat any resulting reboot as the boundary. Post-reboot rediscovery/continuation must be an explicit catalog option defaulting false; never turn a normal patch run into an implicit "keep patching until current" workflow. Preserve bounded per-update HRESULT reporting and never equate `0x80240016` alone with a proven pending reboot.
+
+## Existing compatibility and Checkmk boundaries
+
+Keep HTTPS WinRM 5986 and guarded legacy certificate fallback. Preserve standalone
+local-account token handling. Do not add legacy-only external bootstrap dependencies.
+Windows bootstrap compatibility is separate from collection/module requirements;
+never claim every new playbook was tested on Server 2012 R2/PowerShell 4.
+
+AIM owns catalogued check filenames, not whole directories. Unknown files stay.
+Windows configuration management owns only `plugins:`; preserve `local`, `mrpe`,
+`global`, unknown sections and comments. Keep the first-line notice plus section
+ownership marker. Unmanaged sections are not empty generated mappings. Avoid unmatched
+quote characters even in inline free-form shell comments. No unrelated firewall policy
+changes or cleanup expansions in a reporting release.
+
+AIM-managed persistent Windows Checkmk files use the shared `checkmk_windows_acl` role: enable parent inheritance per file and guarantee well-known SID access for SYSTEM/local Administrators (FullControl) and both application-package principals (ReadAndExecute). Do not add customer-specific administrator/user ACEs, recurse over whole Checkmk directories, or rewrite unknown/operator-file ACLs.
+
+## Verification and documentation
+
+Tests live outside the shipped release. Parse/compile sources, validate YAML/Jinja,
+exercise credential/process/output boundaries and installer rollback. Use native
+Ansible/collections when available and label simulations distinctly. Record failures,
+missing dependencies and platform acceptance honestly in `scripts/docs/VALIDATION.md`.
+Keep exactly one current API, release notes, handoff, sanity checklist and validation
+record; the documentation index names the authority for each topic. Historical
+CHANGELOG entries are retained, not represented as present-day capability guarantees.
diff --git a/scripts/docs/CHANGELOG.md b/scripts/docs/CHANGELOG.md
new file mode 100644
index 0000000..efac8eb
--- /dev/null
+++ b/scripts/docs/CHANGELOG.md
@@ -0,0 +1,268 @@
+# Changelog
+
+## 3.3.0rc8
+
+- Normalize ACLs on persistent AIM-managed Windows Checkmk scripts and `check_mk.user.yml` after creation/update.
+- Re-enable parent ACL inheritance per managed file and guarantee locale-independent well-known principals by SID: SYSTEM and local Administrators with FullControl; ALL APPLICATION PACKAGES and ALL RESTRICTED APPLICATION PACKAGES with ReadAndExecute.
+- Do not add customer-specific administrator/user ACEs and do not recursively rewrite Checkmk directories or unknown/operator files. Existing intentional parent/explicit ACEs are not blindly purged.
+- Add the reusable `checkmk_windows_acl` role and apply it only to the exact AIM-managed persistent file paths.
+- Keep Checkmk script placement, structured-result contracts, service/wire/event API 1.0, and Ansible Core 2.19.11 unchanged.
+
+## 3.3.0rc7
+
+- Move `veeam_o365_status.ps1` from the Windows Checkmk local-check directory to `C:\ProgramData\checkmk\agent\plugins`.
+- If an earlier rc7 build placed that file under the Checkmk built-in plugin directory, selected deployment removes that known stale copy after the custom plugin is staged.
+- Add the exact `$CUSTOM_PLUGINS_PATH$\veeam_o365_status.ps1` execution rule when Veeam VBO is detected, ahead of the built-in plugin deny catch-all.
+- Remove the legacy AIM-managed local copy after selected deployment and teach explicit cleanup to remove the current custom-plugin path plus both known legacy locations without touching unknown files.
+- Keep Checkmk public structured-result schemas and service/wire/event API 1.0 unchanged.
+
+- Replaced the Windows disk-usage PowerShell/Get-PSDrive collector with `community.windows.win_disk_facts`; Windows capacity reports now describe attached local volumes and intentionally exclude mapped/network drives.
+- Kept the public `filesystem_usage_v1` result schema stable while normalizing native disk/partition/volume facts into the existing fields.
+
+- Audited the complete playbook/role tree for native Ansible module coverage.
+- Replaced custom Windows pending-reboot registry probing with `ansible.windows.win_reboot_info` and added bounded reboot-source reporting.
+- Raised the supported ansible.windows baseline to >=3.8.0,<4.0.0 and added explicit readiness/terminal version checks.
+- Replaced Checkmk Windows config file shell reads with `win_stat` + `slurp`.
+- Replaced Linux package snapshot/version commands with `package_facts` and Linux Checkmk final service-state command reporting with `service_facts`.
+- Documented reviewed custom command/PowerShell/raw call sites that remain because native modules do not preserve the required behavior.
+
+## 3.3.0rc3
+
+- Change Windows OS patching from one broad `win_updates` install request to an explicit discovery queue with one update installed per invocation. The queue is deterministic and places drivers last.
+- Add Windows-only catalog option `os_patching_rescan_after_reboot` (`false` by default). A patch-triggered reboot ends the run by default; post-reboot discovery/install continuation requires explicit operator opt-in.
+- Preserve one operator-approved patch wave per run by default. A completed reboot boundary reports `continuation_required: true` and does not perform a post-reboot search unless continuation was enabled.
+- After a wave completes without reboot, perform one read-only final discovery for reporting only; do not append newly applicable updates to the already-approved install queue.
+- Expand `patch_summary_v1` with Windows patch-cycle/continuation facts and bounded per-update HRESULT classification. `0x80240016` is reported as `install_not_allowed`, not treated as proof of a reboot.
+- Stop the Windows wave on an individual update failure, publish already completed updates plus the bounded failure, and never replay the update/job automatically.
+- Keep reboot notification/delay, Linux patching, service/wire/event API 1.0, Ansible Core 2.19.11 and the generic operation-result transport unchanged.
+- Native Windows controller acceptance of the sequential queue and post-reboot continuation remains required before stable promotion.
+
+## 3.3.0rc2
+
+- Improve OS patch reboot handling without changing Core API/wire/event 1.0: expose a cross-platform reboot delay (minutes) and reboot notification message through catalog metadata.
+- Windows patching now disables win_updates implicit reboot and uses an explicit win_reboot so the configured message/delay is honored; Linux uses the corresponding reboot module message/delay semantics.
+- Detect a pre-existing pending reboot before starting new patch work where the platform provides a supported signal. If automatic reboot is disabled, publish a structured blocked patch result and fail with an explicit reboot-required message instead of a generic later fatal.
+- When a patch run newly requires reboot and automatic reboot is disabled, keep the successful update run successful but report reboot_required/reboot_deferred in patch_summary_v1. A later run remains blocked until the host is rebooted.
+- Extend patch_summary_v1 with pre/post/deferred reboot facts, configured delay and a typed preexisting_reboot_required block reason; package/update reporting remains unchanged.
+- Add the current fresh-install INSTALLATION.md to the consolidated documentation set.
+- Native Windows/Linux controller acceptance for these rc2 patching changes remains pending; see VALIDATION.md and SANITY.md.
+
+## 3.2.1rc2 - inventory hierarchy, split-home staging and per-target outcomes
+
+- Adds read-only `inventory_hierarchy` discovery with nested parent/subgroup relationships and direct host membership. The public tree exposes group names/paths and host names only; variables remain private and execution still requires explicit reviewed host names.
+- Corrects controller staging preflight for hardened executors whose process `$HOME` differs from the execution account passwd home. Core now probes controller `local_tmp` using the process/config home and the default delegated `connection: local` POSIX temp path using the passwd/NSS account home. No home, permission or service-unit mutation is performed.
+- Adds additive `target_outcome_summary_v1` data to every execution `RunResult`. Overall Core status/exit semantics remain unchanged; consumers receive requested-target accounting plus per-target `successful`, `failed`, `unreachable`, `not_started` or `indeterminate` outcomes derived from native final host stats.
+- Target summaries are available in both summary and detail progress modes and do not require consumers to reconstruct task events. Incomplete/cancelled execution without final stats never fabricates target success.
+- Keeps service/wire/event API 1.0, canonical Ansible Core 2.19.11, credentials, playbooks, roles, WinRM and remote execution semantics unchanged. This is an additive discovery/readiness/result candidate.
+
+## 3.2.1rc1 - controller staging preflight and hardened-executor default
+
+- Makes a writable, private controller staging directory an always-checked service requirement. Readiness and execution validate staging before credentials/native runtime inspection, with a second check before playbook launch. Failures return fixed readiness errors rather than late delegated-task unreachable results.
+- Adds protected `staging_check` / `AimService.staging_check()` and `aimctl staging-check`, plus additive capability/readiness fields. No credentials, customer inventory or native Ansible command is needed for the local probe.
+- Performs real create/write/flush/read/remove operations under the current UID and sandbox, bounded to ten seconds. Missing directories are privately created; existing permissions, owners and contents are never repaired or purged.
+- Preserves native controller temporary configuration and remote-host settings. Checks the default POSIX local-connection staging path; explicitly warns when global remote_tmp overrides or inventory-specific settings are outside probe coverage.
+- Establishes the generic add-on deployment default: provision private staging, append a directory-specific ReadWritePaths exception and an in-sandbox startup check while retaining ProtectHome/ProtectSystem/PrivateTmp/NoNewPrivileges. Core never edits independent service units or add-on code.
+- Records operator confirmation that the narrow staging exception allowed the Checkmk service job to install successfully on a Windows 11 client. New candidate acceptance and detailed-progress/other-target qualification remain separate.
+- Keeps API/wire/event 1.0, Ansible Core 2.19.11, existing roles/playbooks, WinRM, credentials, terminal behavior and deployment logic unchanged. Full replacement ZIP plus checksum; no patches or bundled validators.
+
+## 3.2.0 - safe detailed execution progress
+
+- Adds optional `progress_mode: detail` to the stable service/wire/event 1.0 contract. The default `summary` mode retains anonymous progress and existing consumers. Capabilities advertise `play_task_host_v1`; clients opt in before requesting it.
+- Detailed events expose plays, no-host skips, tasks/handlers, per-host outcomes, retry/poll notices and recaps, with run/play/task correlation. Native first-party terminal output remains unchanged.
+- Uses bounded unexpanded source labels, explicit reviewed host names and fixed diagnostic hints. Suppresses unsafe/template/no_log labels and protected result details; never forwards raw stdout/stderr, module arguments, variable/config dumps, exception fields or loop-item payloads.
+- Revalidates native frames, sequences and recap totals before public emission. Missing, incomplete, malformed or over-limit detailed progress cannot silently become a successful result. No automatic replay or rollback of remote work is introduced.
+- Keeps Ansible Core 2.19.11 canonical, external execution disabled by default, and existing credential/ownership/deployment policies. No playbook, role, WinRM helper, inventory, key, add-on or deployment behavior is changed.
+- Updates release notes, additive API contract, support metadata, renderer guidance and the controller acceptance checklist. Local tests use simulated Ansible callbacks/CLIs; new detailed execution still requires native controller/target acceptance.
+
+## 3.1.0 - accepted service-v1 baseline
+
+- Promotes the controller-accepted 3.0.0rc21 candidate to the stable 3.1.0 minor release without changing playbook, role, credential, WinRM, Checkmk, deployment, or service behavior.
+- Freezes AIM service/wire/event API **1.0** for additive 1.x evolution. AIM continues to ship the built-in terminal plus `aimctl`; add-ons consume only the documented service boundary.
+- Records real-controller acceptance of Windows 11 terminal management, Vault retry behavior, group/subgroup select-all, launcher deployment, `aimctl` discovery/preparation, and native Ansible Core 2.19.11 readiness.
+- External non-interactive execution remains disabled by default and requires separate acceptance by the chosen add-on/runtime identity. Unsupported boundaries remain unchanged: cross-UID execution, forced Custom password override, private-key export, API inventory/Vault mutation, raw sensitive task output, and automatic replay after remote work may have started.
+- Release delivery remains a complete replacement ZIP plus SHA-256 sidecar; no Git, `.patch`, release manifest, or bundled development validator is used.
+
+## 3.0.0rc21 - launcher symlink deployment hotfix
+
+- Fixes the rc20 ZIP deployer rejecting an existing `/usr/local/bin/aim` symlink before it could refresh the installed `aim` and `aimctl` launchers.
+- Allows only recognized existing AIM launcher symlinks at the final launcher path; symlinked parent directories, broken links, non-regular targets, and unrecognized launcher contents remain rejected.
+- Deployment now backs up the symlink itself, atomically replaces it with the managed launcher, verifies `aim` and `aimctl`, and restores the original symlink target during rollback.
+- No service API, terminal workflow, playbook, role, WinRM, Checkmk, credential, or remote-execution behavior changes from rc20. Service API / wire / event remain 1.0 and Ansible Core 2.19.11 remains canonical.
+- Records the operator-observed rc20 deployment failure as the regression target. Local disposable testing passed dry-run, symlink replacement, installed command verification, and rollback restoration.
+
+## 3.0.0rc20 - terminal stabilization and stable services v1 handoff
+
+- Adds interface-supplied, operation-scoped Vault unlock/retry before terminal Vault edits, reads and normal catalog playbook launches. A rejected password keeps the selected workflow. Empty/invalid input re-prompts; Ctrl+C cancels. Only the native Vault decryption rejection from a bounded local `ansible-vault view` preflight is retried, never an editor or launched playbook.
+- Reuses the private same-UID password-client channel for the validated operation: no password in argv/environment/helper contents and no second Vault prompt after successful prevalidation. Terminal Vault-password input preserves literal whitespace. Legacy internal manager callers without terminal interaction retain native prompts. Additional/inline Vault files are not exhaustively prevalidated; late failures are never automatically replayed. Vault create/new-encryption prompts remain native.
+- Adds "Select all hosts in this group/subgroup" versus individual selection after group selection. Parent scopes include descendant subgroups; overlapping memberships are deduplicated. Execution still uses explicit host names and the existing final run review/confirmation.
+- ZIP deployment now installs/refreshes and smoke-tests both `aim` and `aimctl` launchers with the existing AIM Python, without pip, dependency installation or changes to the Ansible environment. Adds `--aim-python` and `--bin-dir`, conservative interpreter discovery, previewed launcher changes and launcher recovery alongside source recovery. Unknown commands/symlinks are refused. A separate target requires its own explicit command directory.
+- Returns safe `invalid_target` and `invalid_options` service errors for known validation failures; actual inaccessible/invalid source remains `source_invalid`. Error-code fallback remains required for v1 clients.
+- Adds optional `credential_requirement_reasons` to prepared results and advertises `credential_requirements_policy`. A present conventional customer Vault remains conservatively required even with `require_vault: false`; this is not a claim of full effective-variable credential analysis.
+- Freezes the documented service/wire/event 1.0 contract as the supported additive 1.x boundary. AIM keeps its built-in terminal and machine client; internal managers remain private. No add-on source or interface framework is required.
+- Records operator-reported rc19 Windows 11 terminal onboarding/service-account authentication, targeting, interruption, metadata/prepare and native 2.19.11 readiness results separately from rc20 local regression evidence and pending controller re-tests. External execution remains opt-in/disabled by default; neither readiness nor CLI success proves the non-interactive execution path.
+- Updates add-on guidelines, API/support contract, deployment instructions, `RC20_SANITY_TESTS.md` and `RC20_HANDOFF.md`. No WinRM/Checkmk/other remote playbook or role behavior is changed. No Git/patches/release manifest/development validators are shipped.
+
+## 3.0.0rc19 - independent add-on service foundation and ZIP deployment
+
+- Adds `aim.services.v1`, `aimctl` and a source-tree machine wrapper. Generic API/wire/event version 1.0; no add-on/web-framework imports or need to inspect an add-on codebase.
+- Adds capabilities, authorized metadata reads, typed explicit-host/catalog preparation, bounded known-source revisions, local readiness and opt-in same-UID native Ansible execution. Shared target validation now protects direct CLI manager calls as well as the UI.
+- Establishes **ansible-core 2.19.11** as the canonical supported runtime, separately from the AIM/add-on Python environments. Native sibling CLI identity and required collections are checked without installation side effects.
+- Adds private one-run credential providers, inherited credential-FD support, native executable password sources and safe progress/results. Keeps native inventory/Vault precedence: supplied connection/become passwords are defaults, not a forced Custom override. Existing terminal `@prompt` behavior is retained; `--ask-vault-pass` is also interactive and does not solve unattended input.
+- Adds bounded Vault preflight, owned per-run SSH agents/process groups, cancellation and conservative remote-work reporting. Unencrypted keys no longer require a Vault passphrase. CLI agent probing rejects stale sockets and no longer transports key passphrases through environment values.
+- Preserves owner/group/mode/attributes before atomic replacements, including inventory/configuration/Vault publication and restore paths. Existing non-root shared-group writers retain their legacy owner-transfer exception with a warning; full managed single-writer ownership is not claimed.
+- Makes cooperative customer locks persistent and reentrant instead of unlinking their inode. Extends locking across key/Vault/config mutations and playbook execution. Direct shell edits and arbitrary external writers remain outside advisory-lock guarantees.
+- Adds optional `runtime.private_key_owner` for new keys only, with exclusive staged keypair publication. Does not rename keys, change remote `service_user`, re-own existing keys, switch UIDs or migrate permissions automatically.
+- Adds the operator-approved standard-library `deploy/deploy.py`, dry-run-first source replacement, explicit quiescence and protected source recovery. Delivers a ZIP plus SHA-256 sidecar without Git, patches, release manifests or bundled development validators. Existing aim.yml, add-ons/runtime state, inventories/Vaults/keys, environments and unknown customer files are preserved.
+- Publishes `ADDON_AGENTS.md`, `ADDON_API.md`, `ADDON_SUPPORT.md`, `addon-support-v1.json`, and `RC19_HANDOFF.md`. Exposes unsupported capabilities explicitly: Custom overrides, cross-UID launchers, key export, API mutations and raw sensitive task results.
+- External execution defaults to disabled. Development validation includes real Python/Unix IPC/filesystem/process tests and simulated native CLI contract fixtures, **not** live Ansible 2.19.11, SSH or WinRM acceptance. See the handoff for evidence and controller gates.
+- No Checkmk task/template, WinRM bootstrap or remote configuration behavior was changed. The earlier question about a remote Checkmk configuration backup remains separate and unimplemented.
+
+## 3.0.0rc18 - Checkmk Windows config parser hotfix
+
+- Fixes the `checkmk_configure_agent` Windows plugins-section update task failing during Ansible argument parsing before reaching the managed host.
+- Removes an unmatched apostrophe from an embedded `win_shell` PowerShell comment; Ansible free-form shell argument parsing still scans quote characters inside the script text, including comments.
+- Does not change Checkmk configuration behavior: AIM still replaces only the marked top-level `plugins:` section and preserves all other `check_mk.user.yml` content.
+
+## 3.0.0rc17 - read-only Windows Checkmk configuration inspection
+
+- Adds `checkmk_read_windows_config.yml`, a read-only Windows playbook that displays the current `check_mk.user.yml` without changing the host.
+- Reports the resolved configuration path, file size, UTC last-write timestamp, and complete current file contents; a missing file is reported without failing or creating it.
+- Adds an optional `checkmk_windows_user_cfg` path override for nonstandard agent layouts while retaining `C:\ProgramData\checkmk\agent\check_mk.user.yml` as the default.
+- Exposes the operation in the AIM Checkmk catalog and documents it as a safe pre/post-rollout inspection tool.
+- Uses the standard Windows shell path rather than `win_powershell`, keeping this inspection operation usable on legacy PowerShell 4 hosts such as Windows Server 2012 R2.
+
+## 3.0.0rc16 - section-scoped Checkmk user configuration
+
+- Changes Windows `check_mk.user.yml` handling from full-file rendering to section-scoped editing. AIM now replaces or appends only the top-level `plugins:` section.
+- Preserves existing `global`, `winperf`, `fileinfo`, `logwatch`, `local`, `mrpe`, unknown top-level sections, and unrelated comments instead of resetting them to AIM defaults.
+- Keeps an AIM ownership notice on the first line and adds a dedicated ownership comment immediately before the AIM-managed `plugins:` section so the management boundary is explicit.
+- Removes the rc15 `checkmk_manage_local_execution` / `checkmk_extra_local_patterns` rollout controls: local-check execution is no longer managed by this role at all. Existing local execution policy is preserved.
+- Preserves existing MRPE configuration instead of writing `mrpe.config: []`.
+- Retains the existing AIM plugin execution ordering and role-based plugin rules; unknown local/plugin files remain untouched.
+- Existing hosts already overwritten by an earlier full-file rollout cannot have lost settings reconstructed automatically; restore those settings from the host's previous configuration/backup if needed, then rc16 will preserve them on subsequent runs.
+
+## 3.0.0rc15 - Checkmk local execution inheritance hotfix
+
+- Fixes Windows Checkmk user configuration generation so `checkmk_manage_local_execution: false` omits the `local` section instead of writing `local: {}`.
+- This preserves the effective local-check execution policy inherited from Checkmk default/bakery configuration and prevents custom files in `C:\ProgramData\checkmk\agent\local` from becoming non-executable merely because AIM rendered the user configuration.
+- When `checkmk_manage_local_execution: true`, AIM now explicitly writes `local.enabled: true` together with the managed `local.execution` rules.
+- Does not change Checkmk script-file ownership: unknown local/plugin files remain untouched, while known AIM-managed filenames may still be replaced.
+- The Checkmk user configuration file remains fully rendered by AIM in this hotfix; merge-preserving ownership of arbitrary pre-existing user-config keys is a separate design change.
+
+## 3.0.0rc14 - clean replacement bundle layout
+
+- Changed release packaging to a complete replacement/fresh-install model instead of shipping patch/merge deployment mechanics.
+- Removed `release-manifest.json`, release updater/deployer tooling, bundled release-validation tooling, historical migration guides, `.patch` artifacts, and generated Python caches from the distributable archive.
+- Moved the controller-wide AIM configuration from `/etc/ansible/aim.yml` to `/etc/ansible/scripts/aim.yml` and included a clean default `scripts/aim.yml` in the bundle.
+- Moved the maintained one-time WinRM bootstrap helper to `scripts/AIM-WinRM-OneTime.ps1`.
+- Retained operational documentation, changelog, playbooks, roles, collection requirements, and the complete AIM application source required for a new installation.
+
+
+## 3.0.0rc13 - forgiving WinRM password prompts
+
+- Temporary/bootstrap WinRM credentials are validated before the requested Windows access operation begins.
+- A failed WinRM credential probe now re-prompts for the password instead of consuming/skipping the host operation. Ctrl+C still cancels normally.
+- Empty temporary passwords are re-prompted instead of failing the workflow.
+- Service-account password entry now loops on empty values or confirmation mismatches instead of aborting back to the menu.
+- Introduces a dedicated `WinRMConnectionFailed` error so only an actual WinRM probe failure triggers credential re-entry; missing commands and unrelated controller errors still fail normally.
+
+## 3.0.0rc12 - Windows Server 2012 R2 WinRM certificate hotfix
+
+- Fixes `New-SelfSignedCertificate` on Windows Server 2012 R2 / PowerShell 4 systems that expose `-CertStoreLocation` but reject `Cert:\LocalMachine\My` with `InvalidStorePathException`.
+- Certificate creation now retries only that specific failure from inside `Cert:\LocalMachine\My`, preserving normal behavior and error reporting on newer Windows versions.
+- Keeps capability detection for optional `-FriendlyName` and `-TextExtension` parameters and applies the friendly name after creation when required.
+- Adds `scripts/tools/AIM-WinRM-OneTime.ps1` as the maintained standalone one-time WinRM HTTPS bootstrap script using the same compatibility logic.
+- Adds top-level `AGENTS.md` as the authoritative development/release/compatibility guideline for continued AIM development.
+
+## 3.0.0rc11 - Windows local host_vars credential-model repair hotfix
+
+- `Prepare local account` now inspects every selected host's `host_vars/<fqdn>/main.yml` before prompting for credentials.
+- Empty legacy host-vars files and partial overrides are explicitly identified as incomplete when `ansible_user` or `ansible_password` is missing/blank.
+- The operator chooses the desired local credential model: shared-local, host-specific local, or retain complete existing overrides.
+- `Retain existing` is rejected while any selected host has incomplete credential overrides, preventing a successful account bootstrap from leaving an unusable empty/partial host-vars file behind.
+- After the local account bootstrap and independent WinRM verification succeed, AIM reapplies the selected shared-local or host-specific model to `host_vars`, preserving unrelated custom variables/comments.
+
+## 3.0.0rc10 - legacy inventory consolidation/template comments hotfix
+
+- Template consolidation now creates missing platform `group_vars/<platform>/` directories and `main.yml` files, matching the existing preview message instead of silently skipping absent parent directories.
+- Existing group-vars values/custom variables remain non-destructively preserved; malformed YAML continues to be skipped rather than repaired implicitly.
+- Windows shared-local and host-specific credential overrides now write a clear AIM ownership/context comment as the first line of `host_vars/<host>/main.yml`.
+- Template validation/consolidation also detects older AIM local-credential `host_vars/<host>/main.yml` files that lack that header and adds it without changing existing credential values or custom variables.
+- Switching a host back to the domain credential model removes only AIM's known local-credential header while preserving unrelated custom comments/keys.
+
+## 3.0.0rc9 - Standalone Windows WinRM local-admin hotfix
+
+- `Prepare local account` now idempotently sets `LocalAccountTokenFilterPolicy=1` before the service-account WinRM verification.
+- Keeps the existing bare `svc_bf-ansible` username behavior because that is known to work once remote UAC token filtering is disabled.
+- Domain-account and domain-GPO behavior are unchanged.
+- The GPO WinRM payload retains direct `Get-NetIPAddress` discovery and optional additional SANs for Hyper-V/complex networking cases.
+
+## 3.0.0rc8 - Consolidation permission handling hotfix
+
+- Treat existing shared inventory mode `0660` as already correct and avoid redundant chmod attempts.
+- Template consolidation uses best-effort permission normalization after a successful content update.
+- `EPERM`/`EACCES` during consolidation permission normalization is reported as a warning instead of failing the operation.
+- Security-sensitive permission operations outside template consolidation remain strict.
+
+
+## 3.0.0rc7 - WinRM certificate compatibility hotfix
+
+- Makes the generated `AIM-WinRM-Setup.ps1` compatible with PKI cmdlet implementations that do not expose `New-SelfSignedCertificate -TextExtension` and/or `-FriendlyName`.
+- Builds the certificate call from the parameters actually supported by the target host. The base `-DnsName` + `CertStoreLocation` path remains an SSL server certificate; the explicit Server Authentication EKU extension is added when `TextExtension` is available.
+- Applies the `WinRM` friendly name after creation when it could not be supplied as a cmdlet parameter, preserving AIM's existing certificate-reuse behavior.
+- Does not change listener, firewall, GPO link, scheduled-task timing, service-account or access-policy behavior.
+
+## 3.0.0rc6 - coordinated playbook/role migration candidate
+
+- Adds top-level `Multi-customer operations` next to `Open customer`; it is never launched from inside a customer context.
+- Adds multi-customer catalog playbook execution with per-customer `hosts.yml` target selection, shared typed run options and one isolated Ansible invocation per customer.
+- Runs selected customers sequentially, keeps native Ansible/Vault/password prompts live, continues with the next customer after an ordinary playbook failure, and stops the remaining batch when the operator interrupts the current command.
+- Adds clear per-customer live-output separators and a final summary with target counts, result and duration, plus failure/skip details.
+- Keeps customer-specific inventories, Vault IDs, SSH preparation and target limits isolated; inventories are never merged.
+- Changes multi-select `a` into a filter-aware toggle: when all currently matching items are selected it clears them; otherwise it selects all currently matching items. Selections outside the active filter are unchanged.
+
+## 3.0.0rc5 - coordinated playbook/role migration candidate
+
+- Stores the controller-wide Checkmk agent source as structured settings in `/etc/ansible/aim.yml`: protocol, base URL/host, site name, version, patchlevel and revision. AIM always appends `/check_mk/agents` and builds the package version as `<version>p<patchlevel>-<revision>`. Legacy complete URL/version settings are migrated in memory and normalized on the next save.
+- Moves `Save settings` to the bottom of the Settings menu.
+- Adds `a` to every multi-select selector to select all items matching the current filter (across all filtered pages).
+
+## 3.0.0rc4 - coordinated playbook/role migration candidate
+
+- Expanded `debug_show_disk_usage` to Windows and Linux. Windows reports all filesystem drives visible to the WinRM session; Linux reports common operational mounts and network/storage filesystems while excluding pseudo/system mounts.
+
+Breaking source layout / entrypoint changes from AIM 2.2.2. AIM and its catalog,
+playbooks and roles must be installed together. No legacy wrappers are shipped.
+
+- Introduces `playbooks/aim_catalog.yml` with descriptions, targets, dependencies,
+  risk notices and typed, opt-in run parameters. Unchanged inputs remain inherited.
+- Standardizes runnable names as `<category>_<verb>_<purpose>.yml`; retains standard
+  role entrypoints such as `tasks/main.yml` and `defaults/main.yml`.
+- Removes the deprecated `gebhardt` customer playbook and empty `_sample` role.
+- Preserves firewall task arguments/order and per-customer policy identities;
+  extracts reusable role entrypoints and adds preflight validation.
+- Adds `aim_debug` for selected diagnostics without enabling `ANSIBLE_DEBUG` or
+  disabling secret protections. Normal reports remain visible.
+- Routes AlmaLinux/Rocky through RedHat-family patching; does not install an
+  alternate Python interpreter automatically.
+- Repairs optional Windows Checkmk YAML generation, configurable variable
+  precedence, and installed-but-stopped agent service handling.
+- Adds known monitoring-script selections and a single managed UniFi configuration
+  with Vault-backed password references, safe shell quoting and mode-specific URLs.
+- Keeps removal of the opposite UniFi check during mode replacement; other cleanup
+  is a separately approved preview/delete operation.
+- Preserves existing controller maintenance, GPO/WinRM provisioning, UI styling,
+  pagination and inventory/SSH/Vault paths.
+- Adds guarded source-only migration and controller-side validation tools.
+- Updates the migration guard so operator-approved differences in `scripts/` and `requirements.yml` are backed up and replaced instead of blocking deployment; playbook/role mismatch protection remains strict.
+- Adopts the operator-provided unpinned collection baseline and includes `pfsensible.core`.
+- Uses staged-role isolation for syntax checks so refactored playbooks cannot accidentally validate against old live roles.
+
+See the migration document for intentionally changed behavior and verification limits.
+
+### Final rc7 Checkmk/script classification hotfix
+- Classify `citrix_sessions_customized.ps1`, `veeam_o365_status.ps1`, and `veeam_backup_status.ps1` as AIM-managed Checkmk custom plugins under `$CUSTOM_PLUGINS_PATH$` (`C:\ProgramData\checkmk\agent\plugins`).
+- Add `veeam_backup_license_status.ps1` as a VBR-detected Windows local check under `$CUSTOM_LOCAL_PATH$`.
+- Stop enabling the Veeam backup status file from `$BUILTIN_PLUGINS_PATH$`; its exact managed rule now targets `$CUSTOM_PLUGINS_PATH$` and follows `want_windows_veeam_backup`.
+- Selected custom-plugin deployment removes only known legacy AIM copies from the local directory, plus known historic built-in copies for Veeam O365/backup status.
+- Centralize AIM documentation under `scripts/docs/`. The deployment source no longer owns or replaces the installation-root `README.md`.
diff --git a/scripts/docs/CHECKMK.md b/scripts/docs/CHECKMK.md
new file mode 100644
index 0000000..b025e6b
--- /dev/null
+++ b/scripts/docs/CHECKMK.md
@@ -0,0 +1,247 @@
+# Checkmk deployment and UniFi settings
+
+## 1. Controller maintenance versus host deployment
+
+AIM's top-level Maintenance downloads agent packages and updates the external
+monitoring repository directly. No separate Bash helper is installed or required. These operations are separate from customer playbooks.
+The package directory and stable filenames remain:
+
+```text
+/etc/ansible/roles/checkmk_agent/files/
+  check_mk_agent.msi
+  check-mk-agent.deb
+  check-mk-agent.rpm
+```
+
+`checkmk_install_agent.yml` installs the selected platform package, then deploys
+checks/configuration and ensures the agent service is running.
+`checkmk_update_scripts_config.yml` does not install packages.
+`checkmk_cleanup_scripts.yml` previews obsolete managed paths by default.
+
+AIM passes its two non-secret controller paths through environment variables used
+at role-default precedence. Inventory overrides still win. Manual execution uses
+the documented `/etc/...` defaults unless you configure the role variables.
+
+
+## Controller-wide Checkmk agent source
+
+AIM stores controller-wide settings in `/etc/ansible/scripts/aim.yml`. The Checkmk agent source is structured rather than stored as a complete URL:
+
+```yaml
+maintenance:
+  checkmk_agent:
+    protocol: https
+    base_url: monitoring.domain.de
+    site_name: monitoring
+    version: 2.4.0
+    patchlevel: 46
+    revision: 1
+    role_files_dir: /etc/ansible/roles/checkmk_agent/files
+```
+
+AIM builds the download root as `https://monitoring.domain.de/monitoring/check_mk/agents` and the package version as `2.4.0p46-1`. `/check_mk/agents` is always appended automatically. These values are edited in the top-level Settings menu and reused by Maintenance without asking again.
+
+## 2. Known external script sources
+
+The repository remains `/etc/checkmk_monitoring_scripts`. AIM performs the Git update itself.
+Because this is a managed shadow checkout, AIM uses `git fetch --prune` followed by
+`git reset --hard @{u}` rather than invoking an external `git pull` wrapper. Tracked
+local drift is discarded after explicit confirmation; untracked files are retained.
+
+File contents are not
+included in this bundle and were not supplied for this review; they are not
+rewritten, renamed, or executed by the build tests.
+
+| File | Selection |
+| --- | --- |
+| `Scripts Windows/check-ping.ps1` | Detected domain controller, as before |
+| `Scripts Windows/veeam_config_backup_status.ps1` | Detected Veeam VBR, as before |
+| `Scripts Windows/veeam_backup_license_status.ps1` | Detected Veeam VBR; local check → `$CUSTOM_LOCAL_PATH$` |
+| `Scripts Windows/veeam_o365_status.ps1` | Detected Veeam VBO; custom plugin → `$CUSTOM_PLUGINS_PATH$` |
+| `Scripts Windows/citrix_sessions_customized.ps1` | `want_windows_citrix`; custom plugin → `$CUSTOM_PLUGINS_PATH$` |
+| `Scripts Windows/veeam_surebackup_status.ps1` | `want_windows_surebackup` |
+| `Scripts Windows/windows-backup.ps1` | `want_windows_backup` |
+| `Scripts Windows/check-nsp-mailqueue.ps1` | `want_windows_nsp_mailqueue` |
+| `Scripts Windows/win_check_cert.ps1` | `want_windows_certificate` |
+| `Scripts Windows/veeam_cloud_connect_status.ps1` | `want_windows_veeam_cloud_connect` |
+| `Scripts Windows/veeam_backup_status.ps1` | `want_windows_veeam_backup`; custom plugin → `$CUSTOM_PLUGINS_PATH$` |
+| `Scripts Linux/check_certificate_directory.sh` | `want_linux_check_certificate` |
+| `Scripts Linux/check_unifi-controller/check_unifi-controller.sh` | UniFi network mode |
+| `Scripts Linux/check_unifi-controller/check_unifi-os.sh` | UniFi OS mode |
+
+All optional switches default to false. Auto-detected existing behavior is retained.
+The repository Veeam backup local check is a separate opt-in from the built-in
+agent plugin to avoid silently duplicating it.
+
+`citrix_sessions_customized.ps1`, `veeam_o365_status.ps1`, and `veeam_backup_status.ps1` are custom plugins, not local checks. AIM enables their exact `$CUSTOM_PLUGINS_PATH$` rules before the general
+custom-plugin deny rule. When selected, deployment removes the legacy AIM-managed
+copy from `C:\ProgramData\checkmk\agent\local` after the plugin copy is in place.
+Unknown files remain untouched.
+
+Source-file preflight checks that each selected file exists before deployment.
+A filename does not establish the check's internal parameters, privileges or
+credentials: configure those according to the maintained script repository. No
+new script-specific credential format was guessed from the filenames.
+
+## 3. Single UniFi configuration
+
+```yaml
+# host_vars/<fqdn>/main.yml
+checkmk_unifi_mode: network     # auto, network, os, disabled
+checkmk_unifi_username: bf-monitoring
+checkmk_unifi_password: "{{ vault_checkmk_unifi_password }}"
+```
+
+In the encrypted customer Vault, set:
+
+```yaml
+vault_checkmk_unifi_password: "REPLACE_WITH_THE_REAL_MONITORING_PASSWORD"
+```
+
+This is the UniFi monitoring password, not the Ansible Windows/SSH login password.
+Existing Vaults are not silently modified. Vault creation/consolidation can prepare
+an empty optional key; an empty value or `CHANGEME` fails deployment preflight.
+
+Different hosts can override the reference, without exposing the secret in AIM:
+
+```yaml
+checkmk_unifi_password: "{{ vault_unifi_site_a_password }}"
+```
+
+The AIM run-option field accepts the **variable name** `vault_unifi_site_a_password`,
+not a password value. Persist long-lived per-host choices in host vars; run options
+are temporary extra variables for the selected execution only.
+
+### Mode and endpoint defaults
+
+| Mode | Check | Default BASEURL |
+| --- | --- | --- |
+| `network` | `check_unifi-controller.sh` | `https://127.0.0.1:8443` |
+| `os` | `check_unifi-os.sh` | `https://127.0.0.1:11443` |
+| `auto` | Detected variant; OS wins if both are detected | Variant default |
+| `disabled` | Neither selected for deployment | No config replacement |
+
+An explicit `checkmk_unifi_baseurl` overrides the endpoint. In selected network/OS
+mode, the role writes one `/etc/check_mk/unifi.cfg`, deploys the matching check,
+and removes only the opposite UniFi check. An explicitly disabled mode does not
+silently remove existing files during a normal update: review the cleanup action.
+
+### Supplied config schema preserved
+
+```yaml
+checkmk_unifi_curl_options: " --insecure --tlsv1.2"
+checkmk_unifi_status_provisioning: 1
+checkmk_unifi_status_upgrading: 1
+checkmk_unifi_status_upgradable: 0
+checkmk_unifi_status_heartbeat_missed: 1
+checkmk_unifi_status_noautobackup: 0
+```
+
+Statuses are 0 OK, 1 WARN, 2 CRIT, 3 UNKNOWN. The template emits USERNAME, PASSWORD,
+BASEURL, CURLOPTS and the five STATUS_* settings with shell-safe quoting, validates
+shell syntax and sets mode `0600`. Secret-bearing tasks have `no_log: true` and
+`diff: false`. The source repository's `unifi.cfg` is no longer copied to the host.
+The supplied insecure TLS option remains unchanged; enabling certificate validation
+is a separate operational decision, not hidden in this refactor.
+
+## 4. Read current Windows user configuration
+
+Before or after a rollout, `checkmk_read_windows_config.yml` can display the host's current `check_mk.user.yml` without changing it. This is intended for verifying existing `global`, `local`, `mrpe`, plugin, or custom sections before AIM touches the managed `plugins:` section.
+
+```bash
+ansible-playbook -i inventories/CUSTOMER/hosts.yml \
+  playbooks/checkmk_read_windows_config.yml --limit HOST \
+  --vault-id CUSTOMER@prompt
+```
+
+The default path is `C:\ProgramData\checkmk\agent\check_mk.user.yml`. Set `checkmk_windows_user_cfg` only for hosts using a different location. The playbook reports a missing file without creating it and makes no Checkmk changes.
+
+## 5. Cleanup
+
+AIM always starts cleanup in preview mode. It requires explicit deletion enablement
+and a second confirmation before running with `checkmk_cleanup_enabled=true`.
+Only the known managed filenames are considered; unrelated custom files stay.
+The preview is a list of paths considered obsolete by the selected desired state,
+not proof each path currently exists. This is distinct from the approved opposite-
+UniFi removal during normal mode replacement.
+
+Manual examples:
+
+```bash
+ansible-playbook -i inventories/CUSTOMER/hosts.yml \
+  playbooks/checkmk_cleanup_scripts.yml --limit HOST \
+  --vault-id CUSTOMER@prompt
+
+# Destructive: enable only after reviewing the intended checks/mode.
+ansible-playbook -i inventories/CUSTOMER/hosts.yml \
+  playbooks/checkmk_cleanup_scripts.yml --limit HOST \
+  --vault-id CUSTOMER@prompt -e '{"checkmk_cleanup_enabled": true}'
+```
+
+## 6. Windows execution policy
+
+AIM now treats `C:\ProgramData\checkmk\agent\check_mk.user.yml` as a shared
+operator configuration file, not as an AIM-owned file. On Windows, AIM owns only the
+top-level `plugins:` section. The existing `global`, `winperf`, `fileinfo`, `logwatch`,
+`local`, `mrpe`, unknown top-level sections, and their comments are preserved. This is
+important for older or manually customized Checkmk agents where those sections may
+contain host-specific behavior.
+
+AIM keeps an ownership notice on the first line and places another ownership comment
+immediately before the `plugins:` section. Only the marked `plugins:` section may be
+replaced on later runs. If no `plugins:` section exists, AIM appends one without
+rewriting the rest of the file.
+
+The effective AIM plugin timeout remains 120 seconds. Settings live in role defaults so
+host/group overrides work. Optional plugin rules are typed list entries such as:
+
+```yaml
+checkmk_extra_plugin_patterns:
+  - pattern: '$CUSTOM_PLUGINS_PATH$\example.ps1'
+    run: true
+    async: true
+    timeout: 90
+    cache_age: 600
+```
+
+AIM deliberately does not manage `local:` or `mrpe:`. Existing local-check execution
+policy and MRPE definitions remain exactly under operator/Checkmk control. The same
+applies to any other non-plugin user configuration.
+
+The `plugins:` section retains the standard AIM ordering: explicit/custom rules first,
+then known built-in rules, custom-plugin catch-alls, the built-in deny rule, and the
+final safety deny. Checkmk reads the user configuration after default and Bakery
+configuration, so section-scoped ownership avoids unintentionally overriding unrelated
+settings.
+
+Actual behavior of the Windows agent and external checks still requires a representative
+pilot.
+
+## Structured reports in 3.3.0rc8
+
+Install reports query registry/package database version and current service state after
+the existing management roles. Config-update reports list changed sections/check files
+and the narrowly approved opposite-UniFi deletion. They do not expose raw config diffs,
+guess unknown-file counts or alter unmanaged sections. The reporting-only checkmk_report
+role does not install/configure services itself.
+
+The read playbook now limits paths to basename check_mk.user.yml and 512 KiB. Native
+terminal readout remains explicit; API reports parse sections and redact recognized
+secret/command fields, including MRPE commands. Comments are not parsed YAML data.
+See OPERATION_RESULTS.md for exact semantics and VALIDATION.md for acceptance limits.
+
+
+## Windows AIM-managed file ACLs
+
+AIM normalizes ACLs only on persistent files it manages directly: selected Windows Checkmk scripts in `$CUSTOM_LOCAL_PATH$` / `$CUSTOM_PLUGINS_PATH$` and `check_mk.user.yml`. Unknown files are not touched and directory trees are not rewritten recursively.
+
+For each AIM-managed persistent file, `checkmk_windows_acl` enables parent inheritance and guarantees these well-known SID permissions independent of Windows display language:
+
+| SID | Principal | Rights |
+|---|---|---|
+| `S-1-5-18` | SYSTEM | FullControl |
+| `S-1-5-32-544` | local Administrators | FullControl |
+| `S-1-15-2-1` | ALL APPLICATION PACKAGES | ReadAndExecute |
+| `S-1-15-2-2` | ALL RESTRICTED APPLICATION PACKAGES | ReadAndExecute |
+
+AIM does not add customer-specific administrator/user ACEs. Parent or explicit ACEs that already exist are not blindly purged; the goal is to guarantee the standard Checkmk-style administrative/application access while preserving operator ACL intent.
diff --git a/scripts/docs/DETAILED_PROGRESS.md b/scripts/docs/DETAILED_PROGRESS.md
new file mode 100644
index 0000000..e36de28
--- /dev/null
+++ b/scripts/docs/DETAILED_PROGRESS.md
@@ -0,0 +1,284 @@
+# AIM 3.3.0rc8: safe play/task/host progress
+
+**Service / wire / event version:** 1.0, stable additive 1.x.
+**Detail schema:** `play_task_host_v1`. **Canonical Ansible Core:** 2.19.11.
+**Qualification:** locally tested with simulated native command/callback fixtures;
+real Ansible 2.19.11 and managed-host acceptance is still required for this feature.
+
+## 1. Select the feature without breaking existing clients
+
+Clients receive anonymous progress and aggregate counters by omitting
+`progress_mode`. Current Core accepts `summary` (the default) or `detail` in
+`RunRequest`. There is no `-vvv`, debug-output forwarding or raw-output option.
+
+Inspect `aimctl capabilities` / `AimService.capabilities()` first:
+
+```json
+{
+  "execution_progress": {
+    "modes": ["summary", "detail"],
+    "default": "summary",
+    "request_field": "progress_mode",
+    "detail_schema": "play_task_host_v1",
+    "detail_event_kinds": ["play_started", "play_skipped", "play_stopped", "task_started", "host_result", "task_retry", "task_async_poll", "host_recap"],
+    "static_source_labels_only": true,
+    "raw_output": false,
+    "error_policy": "fixed_diagnostic_hints",
+    "qualification": "controller_acceptance_required"
+  }
+}
+```
+
+This is the relevant capability fragment, not the entire response. Servers without
+the advertised detail capability can reject unknown request fields: do not send
+`progress_mode` to them. Absence of the capability means use the legacy default or
+explain that detailed progress needs a newer core. Administrative enablement and
+same-UID runtime readiness remain separate checks.
+
+For a known inventory host, prepare a request with detail selected:
+
+```bash
+printf '%s\n' '{"api_version":"1.0","operation":"prepare","request":{"customer":"CUSTOMER","playbook":"debug_test_connection","hosts":["HOST"],"progress_mode":"detail"}}' | aimctl request
+```
+
+Substitute real catalog/customer/host identifiers. Input to `aimctl request` is
+**one JSON object on one line**, not pretty-printed multiline JSON. Preparation
+collects no password and contacts no managed host. Use the same normalized request
+(including the mode) and its revision for execution. Changing the mode changes the
+reviewed request and requires preparation/review again. An ordinary request never
+contains credentials; use the private provider/FD documented in `ADDON_API.md`.
+
+Detailed mode still emits existing `stage`, `progress`, `stats`, and `result` events.
+A detail renderer should ignore anonymous `progress` events to avoid duplicate task
+lines. An existing summary client can ignore unfamiliar event kinds. Product version
+is 3.3.0rc8; API, wire and event version strings stay 1.0.
+
+## 2. Public event envelope and fields
+
+Every event has `event_version`, `run_id`, increasing `sequence`, UTC `timestamp`,
+and `kind`. On the wire it is wrapped as `{"type":"event","event":{...}}`.
+IDs (`play_id`, `task_id`) are opaque strings scoped to a run. Correlate with IDs,
+not names or the last task that happened to arrive. Results can interleave across
+hosts under a free strategy. Serial batches can enter the same play again and get
+new IDs. Repeated task labels are not unique identities.
+
+| Kind | Additional fields | Meaning |
+|---|---|---|
+| `play_started` | `play_id`, `label`, `label_redacted` | A play occurrence began; label is unexpanded source text or a fixed placeholder |
+| `play_skipped` | `play_id`, `reason: "no_hosts_matched"` | Native no-matching-host callback; not an authentication failure |
+| `play_stopped` | `play_id`, `reason: "no_hosts_remaining"` | Native no-hosts-remaining callback; not equivalent to a harmless no-match skip |
+| `task_started` | `play_id`, `task_id`, `label`, `label_redacted`, `handler` | A task/handler started; no arguments, module name, role path, source path or templated name |
+| `host_result` | `play_id`, `task_id`, `host`, `host_redacted`, `status`, `changed`, `ignored`, `details_redacted`, `error` | One aggregate host/task outcome |
+| `task_retry` | `play_id`, `task_id`, `host`, `host_redacted`, `attempt`, `details_redacted` | Native task retry, not AIM replay of the playbook |
+| `task_async_poll` | Same fields as `task_retry` | Async poll notification; no job ID or result payload |
+| `host_recap` | `host`, `host_redacted`, `counts` | Final counts for one logical inventory host |
+
+`host_result.status` is `ok`, `changed`, `skipped`, `failed`, or `unreachable`.
+`changed` is a boolean and can also be true on a failed task. `ignored` reflects
+native ignore-error/ignore-unreachable handling; a failed event is not by itself
+proof that the whole run failed. Rescue and ignored counts remain in final stats.
+`attempt` is an integer or null; it is always null when details are withheld.
+
+`host` is a reviewed logical inventory name, never a resolved connection address,
+delegation target, loop label or variable. Out-of-scope/unsafe names are represented
+as null with `host_redacted: true`. This can occur for trusted delegated/dynamic
+inventory work: host limits are an operational selection, not a security sandbox.
+A host name containing a supplied credential is also withheld.
+
+Every `counts` mapping has nonnegative integers for `ok`, `changed`, `failures`,
+`unreachable`, `skipped`, `rescued`, `ignored`. Host recaps are followed by the
+existing aggregate `stats` and final run result. Do not count progress lines to
+calculate a recap, assume one task header per host, or infer success from a zero
+process exit without the authoritative final response/result. A failure followed
+by rescue can still result in a successful native run.
+
+There is no invented `play_completed` event: use the actual following play/final
+stats boundary. Loops produce aggregate host/task outcomes, not item values/events.
+Async poll and retry are optional native notifications; fire-and-forget async work
+is not thereby certified complete. The console's exact visual layout is not the API.
+
+Example host outcome (IDs/timestamp illustrative):
+
+```json
+{
+  "event_version": "1.0",
+  "run_id": "example-run",
+  "sequence": 12,
+  "timestamp": "2026-09-19T12:00:00+00:00",
+  "kind": "host_result",
+  "play_id": "p2",
+  "task_id": "t1",
+  "host": "host01.example.test",
+  "host_redacted": false,
+  "status": "unreachable",
+  "changed": false,
+  "ignored": false,
+  "details_redacted": false,
+  "error": {
+    "code": "connection_refused",
+    "message": "The connection was refused. Check the target listener, port and firewall.",
+    "classification": "diagnostic_hint"
+  }
+}
+```
+
+## 3. Failure information without raw error text
+
+A host failure carries `error: {code, message, classification}`. Success/skip events
+carry `error: null`. Messages are fixed strings owned by core. They never contain
+the original result's `msg`, module arguments, exception, stdout or stderr.
+
+| Code | Interpretation |
+|---|---|
+| `connection_refused` | Native unreachable message matched a connection-refusal signature; check listener, port and firewall |
+| `connection_timeout` | Native unreachable message matched a connection timeout |
+| `name_resolution_failed` | Native unreachable message matched a DNS/name-resolution error |
+| `tls_verification_failed` | Native unreachable message matched certificate verification failure |
+| `authentication_failed` | Native unreachable message matched a recognized authentication rejection |
+| `permission_denied` | Failed task message matched an access/permission denial |
+| `host_unreachable` | No narrower supported hint; transport/authentication details remain withheld |
+| `task_failed` | No narrower supported hint; arbitrary module error text remains withheld |
+| `details_withheld` | Sensitive/no_log result; no diagnostic classification is exposed |
+
+Hints are derived from bounded native message signatures, **not a definitive root
+cause or proof that a supplied password was used**. Localized/unrecognized messages
+can produce generic errors. Never drive automatic credential retries, disable TLS
+validation, open firewall rules or replay operations from these hints. The existing
+RunResult error/remote-work flag remains authoritative for lifecycle decisions.
+Preflight errors still use the existing fixed service error codes; this is not a
+raw syntax-error/traceback channel. More detail may require an authorized operator's
+trusted terminal diagnostics, handled as potentially sensitive data.
+
+## 4. Safety contract and unavoidable trust boundary
+
+Core reads the original parsed play/task `name` field, not Ansible's templated
+`get_name()` or rendered task fields. Missing, templated, overlong, control-bearing,
+URL-bearing or credential-assignment-like labels are replaced by fixed labels.
+Known supplied credential values matching a label are also withheld at the public
+boundary. Labels have at most 200 characters / 800 UTF-8 bytes; public host names
+at most 255 characters. Longer valid inventory identifiers can execute, but their
+name is withheld in the detail stream.
+
+Known true or potentially true `no_log` on a task, block, role or play suppresses
+its label. For dynamic no_log expressions core does not attempt to render the
+expression. Results marked `no_log`, censored, or containing hidden loop results
+retain only status/changed/ignored, allowed host and IDs. Their failures use
+`details_withheld`. Retry attempts are hidden for these results.
+
+**Static source labels and inventory names must themselves be non-secret.** No
+filter can identify every secret literally hard-coded in a name. A runtime-only
+sensitivity flag also cannot retroactively retract a static header already sent.
+This is a trusted controller/source contract, not a general secret-scanning engine
+or malicious-playbook sandbox. Add-on authors must never put credentials or
+variable values in labels. Dynamic names deliberately lose their expansion.
+
+Nothing here authorizes raw `debug` values, Checkmk configuration contents,
+registered variables, `invocation`, environment/command strings, loop items,
+exceptions, custom stats, module stdout/stderr, or `-v/-vv/-vvv/-vvvv` output.
+`raw_task_output` remains unsupported. Known password masking is defense in depth,
+not permission to pass arbitrary output through a redactor.
+
+Core validates the private callback schema, IDs, sequences and counts before
+building public events. Detail collection is bounded to 200,000 private frames
+(including legacy counters/handshakes), 50,000 play occurrences and 50,000 task IDs.
+These are safety bounds, not an estimated progress denominator. Malformed, truncated,
+out-of-order or incomplete streams cannot produce a successful run. Typical core
+errors are `invalid_event_stream`, `event_limit`, `event_bridge_unavailable`, and
+`event_bridge_incomplete`. A native failure may end before a complete recap: retain
+received events and show failure/unknown, never fabricate the missing recap.
+
+The event sink must remain responsive or enqueue into a bounded queue; it must not
+block on slow browsers. Core still uses the established process deadlines and
+cancellation. No output detail mode changes account permissions, credential
+precedence, execution enablement, or automatic retry policy.
+
+## 5. Example plain-text renderer for an independent client
+
+This is an illustrative client function, not a new core CLI command. Feed it
+validated public event objects from your client after version/capability checks.
+Use text nodes/HTML escaping in a browser, not `innerHTML`; escape rich terminal
+markup as well. Treat labels as text, not as commands or markup. Persist only the
+minimal events your deployment policy needs and restrict job-log visibility.
+
+```python
+class ProgressText:
+    def __init__(self):
+        self.tasks = {}
+        self.active_task = None
+        self.recap_started = False
+
+    def __call__(self, event):
+        kind = event.get('kind')
+        if kind == 'play_started':
+            print('\nPLAY [' + event['label'] + ']', flush=True)
+            self.active_task = None
+        elif kind == 'play_skipped':
+            print('skipping: no hosts matched', flush=True)
+        elif kind == 'play_stopped':
+            print('stopped: no hosts remaining', flush=True)
+        elif kind == 'task_started':
+            self.tasks[event['task_id']] = event['label']
+            self.active_task = event['task_id']
+            prefix = 'HANDLER' if event['handler'] else 'TASK'
+            print('\n' + prefix + ' [' + event['label'] + ']', flush=True)
+        elif kind == 'host_result':
+            task_id = event['task_id']
+            # Results can interleave: repeat the correct header, not the last name.
+            if self.active_task != task_id:
+                print('\nTASK [' + self.tasks.get(task_id, 'Task') + ']', flush=True)
+                self.active_task = task_id
+            host = event['host'] or 'host withheld'
+            suffix = ' (ignored)' if event['ignored'] else ''
+            error = event.get('error')
+            if error:
+                suffix += ' => ' + error['message']
+            print(event['status'] + ': [' + host + ']' + suffix, flush=True)
+        elif kind in ('task_retry', 'task_async_poll'):
+            print(kind + ': [' + (event['host'] or 'host withheld') + ']', flush=True)
+        elif kind == 'host_recap':
+            if not self.recap_started:
+                print('\nPLAY RECAP', flush=True)
+                self.recap_started = True
+            counts = ' '.join(k + '=' + str(v) for k, v in event['counts'].items())
+            print((event['host'] or 'host withheld') + ' : ' + counts, flush=True)
+        # Ignore legacy anonymous progress to avoid duplicate lines in detail mode.
+        # The caller handles stage/stats/result and the authoritative final response.
+```
+
+A GUI timeline should key results by `(run_id, play_id, task_id, host)` where the
+host is visible. It must not merge all withheld-host records as one known machine.
+Keep the original event sequence for audit; a display regrouping is presentation
+only. The built-in `aim` terminal still uses its existing native Ansible output,
+not this example renderer. No add-on source was changed for this feature.
+
+## 6. Native contracts consulted (not proof of native execution)
+
+Implementation targets Ansible Core 2.19.11 callback entry points, original source
+mappings and CallbackTaskResult public properties. Any dependence on these internals
+stays in the core-owned adapter, not in an add-on.
+
+- https://docs.ansible.com/projects/ansible-core/2.19/plugins/callback.html
+- https://docs.ansible.com/projects/ansible-core/2.19/reference_appendices/logging.html
+- https://raw.githubusercontent.com/ansible/ansible/v2.19.11/lib/ansible/plugins/callback/default.py
+- https://raw.githubusercontent.com/ansible/ansible/v2.19.11/lib/ansible/executor/task_result.py
+- https://raw.githubusercontent.com/ansible/ansible/v2.19.11/lib/ansible/executor/playbook_executor.py
+- https://raw.githubusercontent.com/ansible/ansible/v2.19.11/lib/ansible/playbook/base.py
+
+Follow `SANITY.md` for exact-runtime/controller acceptance before treating the
+new timeline as qualified in an installed service or add-on deployment.
+
+## Final target outcomes
+
+Do not reconstruct final requested-target success from this live detail stream.
+`RunResult.target_summary` and `RunResult.targets` now provide Core-owned final
+accounting under `target_outcome_summary_v1` in both summary and detail modes. The
+detail stream remains for live presentation and diagnostics; the final target
+summary is authoritative for per-request host outcomes. See `TARGET_OUTCOMES.md`.
+
+## Purposeful data is separate
+
+The 3.3.0rc8 `operation_result` channel does not loosen this host/task event contract.
+Only explicitly catalogued, typed and validated set_stats data is returned in the
+final result; see OPERATION_RESULTS.md. Arbitrary debug output and configuration
+bodies remain excluded from progress events. The Checkmk reader now publishes parsed
+redacted sections through its own declared report, not raw debug text.
diff --git a/scripts/docs/EXECUTOR_STAGING.md b/scripts/docs/EXECUTOR_STAGING.md
new file mode 100644
index 0000000..46aef11
--- /dev/null
+++ b/scripts/docs/EXECUTOR_STAGING.md
@@ -0,0 +1,176 @@
+# Controller staging and hardened executors
+
+**AIM 3.3.0rc8 / API 1.0. Profile: native_defaults_preflight_v2.**
+This is a generic executor deployment requirement, not an add-on-specific policy.
+
+## Required default
+
+Core separately checks the process/config HOME used by controller local_tmp and the
+passwd/NSS account home used by default POSIX local/delegated-local tilde expansion.
+When these differ, both private `.ansible/tmp` locations may need narrow writable
+exceptions inside the service sandbox. A successful ordinary shell check is not proof
+of in-service access. Configured absolute local_tmp paths are checked separately.
+
+Keep owner-only 0700 directories owned by the executor (an inherited setgid bit is
+accepted without repair). Do not grant group/other access, writable whole-home trees
+or disable ProtectSystem/ProtectHome. Core does not fix ownership, ACLs, units or mounts.
+
+The profile creates/writes/reads/removes its own probe files and may create missing
+private staging directories. It does not purge existing content. Both paths must be
+traversable without symlink components. Inventory-specific connection/become/remote_tmp
+overrides remain separate qualification work; this is not a complete Ansible variable
+resolver. See VALIDATION.md for the scope of historical controller evidence.
+
+## Always-on Core preflight
+
+Core now checks staging during `readiness` and `execute` before native-runtime
+inspection and before consuming any credentials. It checks again immediately
+before playbook launch. A local failure returns a specific readiness error rather
+than launching remote work and discovering it at a delegated controller task.
+Neither `capabilities`, metadata discovery nor `prepare` performs the probe.
+
+The protected local operation is also available without a customer or Ansible:
+
+```bash
+aimctl staging-check
+printf '%s\n' '{"api_version":"1.0","operation":"staging_check"}' | aimctl request
+```
+
+Python: `AimService().staging_check()`. It requires the configured active AIM group
+and ordinary filesystem access, but not `addons.execution_enabled`. It does not
+accept credentials, path overrides, a customer, target or arbitrary command.
+
+The probe uses the selected AIM Ansible configuration and filtered service
+environment. It runs as an isolated Python child under the **same UID, groups and
+namespace**, bounded to ten seconds. It creates missing directory components with
+0700 access, then creates a unique scratch child, writes/flushes/reads a fixed
+non-secret file and removes that file and scratch child. Newly created base
+directories remain, as native Ansible also needs them. No existing contents are
+listed, read, deleted or chmod/chowned. On abrupt process/storage failure a random
+`.aim-staging-check-*` child containing only the fixed non-secret marker may remain;
+Core never cleans up another process's children recursively.
+
+Success returns `api_version`, `profile: native_defaults_preflight_v2`, `ready`,
+`uid`, `gids`, `directories`, `process_home`, `account_home`, `home_paths_differ`,
+`remote_connected: false`, `credentials_read: false`, `remote_paths_overridden: false`,
+and coverage warnings. Each directory has a
+`purpose`, `source`, resolved `path`, `writable`, `private`, and
+`created_directories` flag. If two purposes use one path it is probed once but both
+purposes are reported. Paths are operator metadata; do not place credentials in
+path names. Readiness nests this report under `runtime.controller_staging`.
+
+Fixed errors have `stage: readiness`, `retryable: false`, and no required secrets:
+
+| Code | Action |
+|---|---|
+| `controller_staging_unavailable` | Review disk/mount/access restrictions and allow the exact private staging directory in the executor sandbox |
+| `controller_staging_unsafe` | Review ownership, owner-only access, directory type or symlinks; no automatic repair is attempted |
+| `controller_staging_config_unsupported` | Use supported literal configuration paths; do not assume unresolved expressions were checked |
+| `controller_staging_timeout` | Inspect local storage/sandbox before a fresh attempt |
+| `controller_staging_probe_failed` | Inspect interpreter/sandbox availability; no raw child errors are forwarded |
+
+An `execute` failure at this gate has `remote_work_may_have_started: false`, null
+native `exit_code`, and no fabricated unreachable counts. A bad staging path is
+not a password rejection. A second check after credential/syntax preflight can
+fail without replaying or launching the playbook. No automatic retry is added.
+
+## What is and is not resolved
+
+For the native controller temporary directory, the probe honors literal
+`[defaults] local_tmp` in the selected `ANSIBLE_CONFIG`; otherwise it uses
+`[defaults] home` plus `/tmp`, or the native `~/.ansible/tmp` default. Supported
+paths are absolute, `~/...`, `$HOME/...`, `${HOME}/...` and literal configuration-
+relative paths. Matching outer quotes are removed. Relative controller paths are
+relative to the configuration file. Jinja, other environment expansions, `~user`,
+parent traversal, wildcard/control-bearing and root/shared-system-root paths are
+rejected instead of guessed. The configuration is never rewritten.
+
+The probe also checks the default POSIX `connection: local` module-staging path when `[defaults] remote_tmp` is absent or explicitly has that default. Ansible local connection expands `~user` from the execution account database, so Core resolves this second purpose from the account passwd/NSS home rather than process `$HOME`. When those homes differ, both paths are reported and probed separately. If a different global `remote_tmp` exists, Core reports that its
+controller-delegation use is **not probed**. It must not create a possibly remote
+path on the controller. Inventory-specific `ansible_remote_tmp`, delegated
+connection/shell/interpreter/escalation overrides, caches, async directories and
+module execution permissions are not fully resolved by this credential-free
+probe. Passing it is not complete playbook or sandbox qualification.
+
+No environment, Ansible command, inventory or remote path is changed. In
+particular, Core does not set global `ANSIBLE_REMOTE_TEMP`, force local connection,
+enable local become, redirect HOME or inherit arbitrary environment variables.
+The established service filter still drops inherited `ANSIBLE_LOCAL_TEMP` and
+`ANSIBLE_REMOTE_TEMP`; a unit environment assignment alone is not configuration
+of this execution profile. Use the operator-owned selected Ansible configuration
+for supported local_tmp changes and explicitly review local delegation separately.
+
+## Standard systemd deployment recipe for add-on owners
+
+New add-on installers that provision an AIM executor should apply the equivalent
+of this recipe by default. Core publishes the requirement; it does **not** discover,
+edit, reload or restart independently managed service units. Do not install it on
+a browser/frontend process that does not execute AIM. Never give a frontend private
+key access just to satisfy an executor check.
+
+1. Resolve the actual executor account's home with NSS/getpwnam. Do not assume that
+   a system unit's `%h` denotes its `User=` account: use the resolved absolute path.
+2. Before activating the sandbox, provision the private staging location as that
+   account, or run the following local probe from its ordinary administrative context:
+
+```bash
+# Replace EXECUTOR_USER and the AIM launcher/config paths for the deployment.
+sudo -u EXECUTOR_USER -H /usr/local/bin/aimctl staging-check
+```
+
+This can create the missing private directories if their parents permit it. It
+will not fix pre-existing ownership or permissions. Outside-unit success only
+checks provisioning; it does not qualify the service sandbox.
+
+3. Preserve existing unit settings and add an operator-owned drop-in like:
+
+```ini
+[Service]
+# Required default for AIM controller-local and implicit-localhost staging.
+# Substitute the real absolute executor home; do not copy the placeholder.
+ReadWritePaths=/home/EXECUTOR_USER/.ansible/tmp
+# If process HOME is deliberately elsewhere and staging-check reports a second
+# controller_local_tmp path, permit that exact private path too unless it is
+# already covered by an existing writable StateDirectory/ReadWritePaths entry.
+# Use the actual core launcher, and --config before staging-check if nondefault.
+ExecStartPre=/usr/local/bin/aimctl staging-check
+```
+
+These nonempty assignments append to existing lists. Do **not** insert blank
+`ReadWritePaths=` or `ExecStartPre=` assignments that reset existing protections or
+startup checks. Do not prepend `-` to the staging path/check: a missing/unusable
+required directory must fail visibly. Provision it before systemd constructs the
+write exception. Keep `ProtectHome=read-only`, `ProtectSystem=strict`,
+`PrivateTmp=yes`, `NoNewPrivileges=yes`, and other existing hardening.
+
+`ExecStartPre` runs with the service's identity/sandbox; allow the real AIM Python
+and probe subprocesses in any syscall/exec restrictions. No escalation is needed.
+If a non-systemd orchestrator is used, provide the equivalent writable mount and
+run the same check in the actual worker context.
+
+4. Quiesce jobs, reload the unit and restart it in an approved window. Never restart
+   a worker in the middle of a deployment. Check its startup result and mount view,
+   then run one explicitly reviewed controller-delegated operation. Do not globally
+   remount the home, enable root execution, relax key permissions or chown the tree.
+
+## Existing corrected deployments
+
+Keep the successful narrow write exception. Installing this Core release does
+not remove it, duplicate it, or write an add-on unit. The new preflight becomes
+automatic on the next API readiness/execution call. Add the optional startup check
+through your service's owner so a bad deployment fails at worker startup as well.
+Do not remove the exception to test a failure on an active controller. Use a
+separate fixture/unit for negative acceptance.
+
+Rollback Core source normally; service overrides are independently managed and
+are not changed by Core rollback. Retaining the narrow exception is needed by
+older Core releases too. No rollback undoes a completed Checkmk installation.
+
+## Primary references
+
+Consulted native contracts; not evidence of live testing in the release builder:
+
+- https://raw.githubusercontent.com/ansible/ansible/v2.19.11/lib/ansible/config/base.yml
+- https://raw.githubusercontent.com/ansible/ansible/v2.19.11/lib/ansible/plugins/doc_fragments/shell_common.py
+- https://raw.githubusercontent.com/ansible/ansible/v2.19.11/lib/ansible/config/manager.py
+- https://raw.githubusercontent.com/systemd/systemd/v257/man/systemd.exec.xml
diff --git a/scripts/docs/INSTALLATION.md b/scripts/docs/INSTALLATION.md
new file mode 100644
index 0000000..8c3b73f
--- /dev/null
+++ b/scripts/docs/INSTALLATION.md
@@ -0,0 +1,484 @@
+# AIM Fresh Installation
+
+**Applies to:** AIM 3.3.0rc8\
+**Canonical Ansible Core:** 2.19.11\
+**Default controller root:** `/etc/ansible`\
+**Supported AIM Python:** Python 3.11+
+
+This guide is for a new AIM controller with no existing AIM source tree.
+It installs the complete source bundle, AIM's Python runtime
+dependencies, the separate canonical Ansible runtime, and the required
+Ansible collections.
+
+The AIM deployer deliberately does **not** install operating-system
+packages, Python dependencies, Ansible, collections, accounts, groups,
+services, or add-on executors. Provision those explicitly, then use the
+bundled deployer in `install` mode.
+
+AIM remains usable as a standalone product through the built-in `aim`
+terminal. Add-on execution is optional and disabled by default.
+
+## 1. Obtain and verify the release
+
+Transfer both files through a trusted channel:
+
+``` text
+AIM-Ansible-3.3.0rc8.zip
+AIM-Ansible-3.3.0rc8.zip.sha256
+```
+
+The SHA-256 sidecar verifies file integrity; it is not a publisher
+signature.
+
+Stage the release outside `/etc/ansible`:
+
+``` bash
+cd /var/tmp
+sha256sum -c AIM-Ansible-3.3.0rc8.zip.sha256
+unzip AIM-Ansible-3.3.0rc8.zip
+cd aim-core-3.3.0rc8
+```
+
+Do not extract the release directly over `/etc/ansible`.
+
+## 2. Provision the controller prerequisites
+
+The controller needs:
+
+-   Linux
+-   Python 3.11 or newer for AIM
+-   a separate Ansible runtime containing exactly
+    `ansible-core==2.19.11`
+-   the collections declared by `requirements.yml`
+-   an operator-approved execution/service account and group policy
+-   network and remote authentication prerequisites appropriate to the
+    managed systems
+
+For the default configuration shipped in this release, review
+`scripts/aim.yml` before installation. In particular, these values are
+environment-specific and must not be accepted blindly:
+
+``` yaml
+root_dir: /etc/ansible
+service_user: svc_bf-ansible
+required_group: srv_debsansible01_admins@bitformer.lan
+```
+
+Set them to the intended controller values after installation, or
+prepare a reviewed configuration before first operational use.
+
+## 3. Create the AIM Python environment
+
+Keep AIM's Python environment separate from the canonical Ansible
+runtime and from add-on environments.
+
+Example:
+
+``` bash
+sudo python3.11 -m venv /opt/aim/venv
+sudo /opt/aim/venv/bin/python -m pip install --upgrade pip
+sudo /opt/aim/venv/bin/python -m pip install \
+  'ruamel.yaml>=0.18,<0.19' \
+  'rich>=13,<15'
+```
+
+Verify it:
+
+``` bash
+/opt/aim/venv/bin/python --version
+/opt/aim/venv/bin/python -c 'import ruamel.yaml, rich; print("AIM dependencies OK")'
+```
+
+The deployer uses this interpreter for the `aim` and `aimctl` launchers.
+It does not install or upgrade these dependencies itself.
+
+## 4. Create the canonical Ansible runtime
+
+AIM 3.3.0rc8 is qualified against **ansible-core 2.19.11**.
+
+One clean layout is a separate virtual environment:
+
+``` bash
+sudo python3.11 -m venv /opt/ansible/venv
+sudo /opt/ansible/venv/bin/python -m pip install --upgrade pip
+sudo /opt/ansible/venv/bin/python -m pip install 'ansible-core==2.19.11'
+```
+
+Verify the exact version:
+
+``` bash
+/opt/ansible/venv/bin/ansible-playbook --version
+```
+
+The first version line must report Ansible Core 2.19.11.
+
+Do not silently substitute a newer Ansible Core release.
+
+## 5. Install the required Ansible collections
+
+The source bundle declares:
+
+``` yaml
+collections:
+  - ansible.netcommon
+  - name: ansible.windows
+    version: ">=3.8.0,<4.0.0"
+  - ansible.posix
+  - community.windows
+  - community.general
+  - sophos.sophos_firewall
+  - pfsensible.core
+```
+
+Install them with the canonical Ansible runtime:
+
+``` bash
+sudo /opt/ansible/venv/bin/ansible-galaxy collection install \
+  -r requirements.yml
+```
+
+AIM 3.3.0rc8 requires `ansible.windows>=3.8.0,<4.0.0` for native reboot-state discovery. Other collection versions remain operator-approved and must be compatible with Ansible Core 2.19.11. AIM does not download or upgrade collections during source deployment.
+
+Verify collection discovery:
+
+``` bash
+/opt/ansible/venv/bin/ansible-galaxy collection list
+```
+
+If collections are installed into a nonstandard path, configure
+`runtime.ansible_collections_path` in `scripts/aim.yml` after
+installation.
+
+## 6. Preview the fresh installation
+
+For a fresh controller use `install`, not `update`.
+
+The default installation root is `/etc/ansible`, and the default
+launcher directory for a fresh installation is `/usr/local/bin`.
+
+Run a dry-run first:
+
+``` bash
+sudo python3 deploy/deploy.py install \
+  --aim-python /opt/aim/venv/bin/python \
+  --dry-run
+```
+
+Review the complete plan. It should show source installation under
+`/etc/ansible` and creation of the `aim` and `aimctl` launchers.
+
+If using a nondefault controller root, provide both an explicit target
+and a dedicated command directory:
+
+``` bash
+sudo python3 deploy/deploy.py install \
+  --target /srv/aim-controller \
+  --bin-dir /usr/local/libexec/aim-controller \
+  --aim-python /opt/aim/venv/bin/python \
+  --dry-run
+```
+
+Do not use a production launcher directory for a second development/test
+installation.
+
+## 7. Apply the installation
+
+For a genuinely fresh tree there should be no active AIM jobs, but the
+deployer still requires explicit acknowledgement that source
+writers/runners are quiesced:
+
+``` bash
+sudo python3 deploy/deploy.py install \
+  --aim-python /opt/aim/venv/bin/python \
+  --apply \
+  --quiesced
+```
+
+Then refresh shell command discovery:
+
+``` bash
+hash -r
+command -v aim
+command -v aimctl
+aim --version
+aimctl --version
+```
+
+Expected product version:
+
+``` text
+3.3.0rc8
+```
+
+The deployer verifies the installed launchers and source before
+reporting success.
+
+## 8. Configure AIM
+
+Edit the installed controller configuration:
+
+``` bash
+sudoedit /etc/ansible/scripts/aim.yml
+```
+
+At minimum review:
+
+``` yaml
+root_dir: /etc/ansible
+service_user: <approved execution account>
+required_group: <approved local/NSS group>
+
+runtime:
+  ansible_playbook: /opt/ansible/venv/bin/ansible-playbook
+  ansible_collections_path: ""
+  private_key_owner: ""
+
+addons:
+  execution_enabled: false
+```
+
+Keep `addons.execution_enabled: false` until add-on/service execution
+has been deliberately provisioned and accepted.
+
+`runtime.private_key_owner` affects newly generated keys only. It does
+not switch the execution UID, migrate existing keys, or grant filesystem
+access.
+
+Checkmk-specific controller settings under `maintenance.checkmk_agent`
+should be configured only when that functionality is required.
+
+## 9. Establish inventories and customer data
+
+A fresh source installation does not create production inventories,
+Vault data, SSH keys, customer credentials, or customer-local
+configuration.
+
+The standard controller layout is:
+
+``` text
+/etc/ansible/
+├── scripts/
+│   ├── aim.yml
+│   └── ...
+├── playbooks/
+├── roles/
+├── inventories/
+└── requirements.yml
+```
+
+Customer inventories, Vault files, keys, and `.aim.yml` files are
+runtime/operator data and are intentionally absent from the release
+archive.
+
+Create or migrate them through the approved AIM/operator workflow. Never
+copy credentials into the source release or documentation.
+
+## 10. Verify Core discovery
+
+Run:
+
+``` bash
+aimctl capabilities
+```
+
+Confirm that the product/API information is correct and that expected
+capabilities are advertised.
+
+Then inspect the installed documentation:
+
+``` text
+/etc/ansible/scripts/docs/README.md
+/etc/ansible/scripts/docs/SANITY.md
+/etc/ansible/scripts/docs/VALIDATION.md
+```
+
+`VALIDATION.md` records release-development evidence. It is not proof
+that this newly installed controller has passed managed-host acceptance.
+
+## 11. Verify controller staging
+
+Before service/add-on execution, check controller-local Ansible staging:
+
+``` bash
+aimctl staging-check
+```
+
+For a normal interactive/native installation, AIM checks the relevant
+controller staging paths.
+
+For a hardened service executor, run this check **inside the actual
+service sandbox under the real execution identity**. A successful
+`sudo -u` shell test does not reproduce systemd mount restrictions.
+
+With native defaults, both of these may matter:
+
+``` text
+<process HOME>/.ansible/tmp
+<execution account passwd/NSS home>/.ansible/tmp
+```
+
+If the service uses `ProtectHome=read-only`, retain that hardening and
+add only the narrow writable exception required for the private staging
+directory. Do not make the whole home writable, recursively change
+ownership, or disable service hardening.
+
+See:
+
+``` text
+scripts/docs/EXECUTOR_STAGING.md
+```
+
+## 12. Test the built-in terminal first
+
+AIM is an independent product. Validate the native terminal before
+introducing an add-on:
+
+``` bash
+aim
+```
+
+Use a controlled test customer/host and follow `scripts/docs/SANITY.md`.
+
+Confirm inventory discovery, credentials/Vault handling, target
+selection, and an approved low-risk playbook before broader production
+use.
+
+## 13. Optional add-on/service execution
+
+Add-on execution is **disabled by default**.
+
+Only after the controller and executor identity have been accepted
+should the operator deliberately enable it:
+
+``` yaml
+addons:
+  execution_enabled: true
+
+runtime:
+  ansible_playbook: /opt/ansible/venv/bin/ansible-playbook
+```
+
+The public integration boundary is:
+
+``` text
+aim.services.v1
+aimctl
+```
+
+Do not have an add-on:
+
+-   import `aim.ui`
+-   parse AIM terminal output
+-   patch Core
+-   rewrite native Ansible commands
+-   read/export private keys
+-   invent its own inventory hierarchy or target outcomes
+-   reconstruct structured operation results from debug/stdout
+
+The current add-on contracts are documented in:
+
+``` text
+scripts/docs/ADDON_API.md
+scripts/docs/ADDON_SUPPORT.md
+scripts/docs/OPERATION_RESULTS.md
+ADDON_AGENTS.md
+```
+
+The v1 execution profile is same-UID. Cross-UID execution is not
+provided by this release.
+
+## 14. Run the controller acceptance checklist
+
+Use the current checklist:
+
+``` text
+scripts/docs/SANITY.md
+```
+
+For 3.3.0rc8, acceptance should include the structured operation-result
+path in addition to ordinary execution.
+
+A useful first reporting test is host-role detection. Confirm that the
+final result exposes the declared structured capability booleans without
+requiring the client to parse task output.
+
+Also exercise, as applicable:
+
+-   inventory hierarchy
+-   target outcome summaries
+-   controller staging
+-   summary and detail progress
+-   disk-usage reporting
+-   service recovery reporting
+-   Checkmk reporting
+-   Linux/Windows patch reporting
+-   successful and mixed-result multi-host runs
+
+Do not promote a release candidate based only on source parsing or local
+simulated callback tests.
+
+## 15. Recovery
+
+Fresh installation still creates protected deployment recovery data. The
+deployer prints its exact recovery directory under the default:
+
+``` text
+/var/backups/aim-core/
+```
+
+If installation validation fails, use the same release deployer and
+printed recovery directory:
+
+``` bash
+sudo python3 deploy/deploy.py rollback \
+  --from-backup /var/backups/aim-core/RECOVERY-DIRECTORY \
+  --dry-run
+
+sudo python3 deploy/deploy.py rollback \
+  --from-backup /var/backups/aim-core/RECOVERY-DIRECTORY \
+  --apply \
+  --quiesced
+```
+
+A source rollback does not reverse remote Ansible work, dependency
+installation, account/group changes, or add-on state.
+
+## Fresh-install completion checklist
+
+A fresh controller is not complete merely because `aim --version` works.
+Before production use confirm:
+
+-   release ZIP checksum verified
+-   AIM Python 3.11+ environment provisioned
+-   AIM Python dependencies installed
+-   canonical Ansible Core 2.19.11 provisioned separately
+-   required Ansible collections installed and discoverable
+-   full source installed with `deploy.py install`
+-   `aim` and `aimctl` resolve to the intended installation
+-   `scripts/aim.yml` reviewed for this controller
+-   approved execution identity/group configured
+-   inventory/Vault/key data established separately
+-   `aimctl capabilities` succeeds
+-   `aimctl staging-check` succeeds in every execution context
+-   built-in terminal workflow accepted
+-   managed-host sanity tests completed
+-   add-on execution remains disabled unless separately provisioned and
+    accepted
+-   recovery location recorded and protected
+
+## Related documentation
+
+-   existing root `README.md` --- operator-owned and preserved; AIM does not overwrite it
+-   `deploy/README.md` --- deployment and rollback mechanics
+-   `scripts/docs/README.md` --- current documentation index
+-   `scripts/docs/SANITY.md` --- controller acceptance checklist
+-   `scripts/docs/VALIDATION.md` --- release-development evidence and
+    limits
+-   `scripts/docs/EXECUTOR_STAGING.md` --- hardened executor staging
+    requirements
+-   `scripts/docs/ADDON_API.md` --- public add-on API
+-   `scripts/docs/ADDON_SUPPORT.md` --- current add-on support matrix
+-   `scripts/docs/OPERATION_RESULTS.md` --- structured operation-result
+    contract
+-   `scripts/docs/PLAYBOOKS.md` --- catalog/playbook behavior
+-   `scripts/docs/CHECKMK.md` --- Checkmk-specific behavior
diff --git a/scripts/docs/INVENTORY_HIERARCHY.md b/scripts/docs/INVENTORY_HIERARCHY.md
new file mode 100644
index 0000000..d8c60fc
--- /dev/null
+++ b/scripts/docs/INVENTORY_HIERARCHY.md
@@ -0,0 +1,69 @@
+# AIM inventory hierarchy discovery
+
+**AIM 3.3.0rc8 / service API 1.0.** `inventory_hierarchy_v1` is a read-only,
+additive discovery capability. It exists so interfaces can present AIM's actual
+inventory group/subgroup structure without duplicating Ansible-inventory parsing.
+
+## Public operation
+
+Python:
+
+```python
+result = AimService().inventory_hierarchy('CUSTOMER')
+```
+
+Machine interface:
+
+```bash
+printf '%s\n' '{"api_version":"1.0","operation":"inventory_hierarchy","customer":"CUSTOMER"}' | aimctl request
+```
+
+Query `capabilities.inventory_hierarchy` before relying on this operation.
+
+The result has this shape:
+
+```json
+{
+  "api_version": "1.0",
+  "schema": "inventory_hierarchy_v1",
+  "customer": "CUSTOMER",
+  "hosts": ["direct-customer-host.example"],
+  "groups": [
+    {
+      "name": "windows",
+      "path": ["windows"],
+      "hosts": ["win01.example"],
+      "children": [
+        {
+          "name": "servers",
+          "path": ["windows", "servers"],
+          "hosts": ["win02.example"],
+          "children": []
+        }
+      ]
+    }
+  ]
+}
+```
+
+`hosts` on each node means **direct membership in that node**, not recursively
+expanded membership. A client can render descendants without guessing whether a
+host came from the parent or a subgroup. Group nesting is preserved to a bounded
+64 levels / 10,000 group nodes; malformed mappings, aliases/cycles or larger
+structures fail as invalid source rather than being silently flattened.
+
+## Safety and execution boundary
+
+Only customer/group names, group paths and inventory host names are returned.
+Variables, addresses, credentials, Vault values, connection settings and group
+vars are not part of this tree. `list_hosts` remains the flat host/address/platform
+metadata operation.
+
+The hierarchy is presentation/discovery metadata only. It does **not** add group
+patterns to `RunRequest`, change `--limit`, authorize targets, or skip preparation
+and review. Execution still accepts explicit host names and Core revalidates them
+against current inventory/catalog compatibility.
+
+Interfaces should not persist a competing hierarchy or derive execution authority
+from a previously fetched tree. Fetch current hierarchy when presenting inventory,
+then prepare the final explicit host request through Core.
diff --git a/scripts/docs/OPERATION_RESULTS.md b/scripts/docs/OPERATION_RESULTS.md
new file mode 100644
index 0000000..fdc7555
--- /dev/null
+++ b/scripts/docs/OPERATION_RESULTS.md
@@ -0,0 +1,276 @@
+# Purposeful operation results
+
+**AIM 3.3.0rc8. Publisher `aim_output_v1`; public `aim_operation_result_v1`.**
+This is independent of `play_task_host_v1` progress and `target_outcome_summary_v1`.
+The service, wire and event versions remain 1.0. It is not a raw-output/debug option.
+
+## Capability and catalog negotiation
+
+`capabilities.operation_results` advertises publisher/result protocols, scopes, modes,
+limits and qualification. Each catalog operation has `result: null` or a declaration:
+
+```yaml
+result:
+  protocol: aim_output_v1
+  schema: host_capabilities_v1
+  scope: per_host
+  required: true
+  sensitivity: safe
+  max_bytes_per_host: 1048576
+  schema_file: host_capabilities_v1.yml
+```
+
+`schema_file` is a basename under the catalog's `schemas/` directory. Core resolves it
+into `data_schema` for public `list_playbooks` and `PreparedRun.result_contract` output.
+Clients never pass a schema file or payload in an execute request. Schema/source bytes
+participate in the review revision. A changed schema requires preparation/review again.
+No hard-coded playbook dispatch exists in Core.
+
+## Publisher convention
+
+```yaml
+- name: AIM | Publish operation result
+  ansible.builtin.set_stats:
+    per_host: true
+    aggregate: false
+    data:
+      aim_output:
+        protocol: aim_output_v1
+        schema: host_capabilities_v1
+        data:
+          is_dc: '{{ is_dc | default(false) | bool }}'
+          is_dhcp_server: '{{ is_dhcp_server | default(false) | bool }}'
+          is_hyperv_host: '{{ is_hyperv_host | default(false) | bool }}'
+          has_veeam_vbr: '{{ has_veeam_vbr | default(false) | bool }}'
+          has_veeam_vbo: '{{ has_veeam_vbo | default(false) | bool }}'
+          has_veeam_em: '{{ has_veeam_em | default(false) | bool }}'
+          is_unifi_controller: '{{ is_unifi_controller | default(false) | bool }}'
+          is_unifi_os_server: '{{ is_unifi_os_server | default(false) | bool }}'
+```
+
+Use exactly one publication per requested host/run. Do not loop publishers, publish
+preliminary values under the same key, or aggregate dictionaries accidentally. For a
+global declaration use `per_host: false` and exactly one global publication (beware
+run_once with serial batches). The bundled schemas are all per-host.
+
+The callback observes only an actual set_stats result with a matching declaration,
+false aggregation and matching scope. It records sensitivity provenance and reconciles
+that value with final custom statistics. An unrelated custom stat, a debug task named
+"Publish", or a forged final statistic is not an output source. `no_log` publishers
+are withheld; custom stats alone cannot erase their provenance. Report from a reviewed
+normalizer with selected non-secret fields, not arbitrary registered result dictionaries.
+
+Publishing set_stats is controller-side and adds no remote package/module dependency.
+Native console rendering remains unchanged; use the existing debug summaries for CLI
+operators. External clients obtain reports only at finalization, not through debug text.
+
+## Final public object
+
+Every RunResult adds `operation_result`, null for an undeclared operation. Otherwise:
+
+```json
+{
+  "protocol": "aim_operation_result_v1",
+  "schema": "host_capabilities_v1",
+  "scope": "per_host",
+  "required": true,
+  "complete": true,
+  "check_mode": false,
+  "hosts": {
+    "host01.example": {
+      "schema": "host_capabilities_v1",
+      "status": "available",
+      "data": {"is_dc": false, "is_dhcp_server": false, "is_hyperv_host": false,
+        "has_veeam_vbr": false, "has_veeam_vbo": false, "has_veeam_em": false,
+        "is_unifi_controller": false, "is_unifi_os_server": false},
+      "error": null
+    }
+  },
+  "global": null
+}
+```
+
+For global scope, `hosts` is empty and `global` holds the same entry shape. Schema and
+scope come from the catalog, not client input. Host keys come from reviewed targets.
+The existing final result event contains the same object as the final response. There
+is no separate live operation-data event; read final authoritative results in either
+summary or detail mode.
+
+Entry status:
+
+| Status | Meaning |
+|---|---|
+| available | Complete final data received, schema/limit/safety validation passed |
+| missing | Final accounting arrived but this report slot was not published |
+| withheld | Sensitive publisher or known supplied secret matched output |
+| invalid | Schema, provenance or size validation rejected the publication |
+| not_started | Execution did not start; there is no operation data |
+| indeterminate | Work may have started but no complete final report stream exists |
+
+Unavailable entries have `data: null`; never replace them with `{}`/zero/false in a UI.
+`complete` describes report availability, not execution success or payload-specific
+completeness. A patch report has its own `data.complete` for update evidence. A failed
+service-start operation can have an available, complete report listing failed services.
+
+If native exit is nonzero, preserve the native/Core failure and retain any valid reports
+from the final stats. If native execution exits 0 but required output is missing,
+withheld, invalid or incomplete, Core returns failed/result_validation with native
+exit_code 0. Native target outcomes still describe their Ansible stats. This is an
+intentional additional report-contract check, not a redefinition of native stats.
+Optional missing reports do not fail an otherwise successful run; invalid submitted
+reports do. Never replay automatically after result-validation failure.
+
+## Generic schema subset and safety
+
+The schema validator is standard-library-only, shared by callback and Core. Supported
+JSON Schema keywords: `type` (including nullable type arrays), `properties`, `required`,
+boolean `additionalProperties`, `items`, `enum`, `maxItems`, `maxLength`, `minimum`,
+`maximum`, and documentation `description`. `$ref`, arbitrary validators and executable
+schema extensions are not supported. Objects are closed unless explicitly declared open.
+The only shipped open subtree is already parsed/redacted Checkmk `sections`.
+
+Limits: maximum depth 20, 200,000 nodes per value, 20,000 items per collection, 8,192
+characters per string, 1 MiB encoded envelope per host/global slot and 16 MiB per run.
+Catalogs can lower the per-host byte cap. Data is chunked privately into <=2,048-byte
+pieces; malformed sequences, duplicate publications, torn frames and oversize data are
+rejected, never silently truncated. NaN/Infinity, binary objects, cycles and unknown
+closed-object properties are rejected. Schemas and output labels must be static public
+controller source.
+
+Obvious secret field names are disallowed in schemas; redacted dynamic config keys
+can only hold the exact `[REDACTED]` marker. Known supplied credentials matching public
+strings are withheld again at the Core boundary. These measures are defense in depth,
+not a general secret scanner. Config/other strings literally containing an undisclosed
+secret remain an author/operator responsibility. Never publish environments, invocation,
+exception objects, arbitrary debug values, commands or private keys.
+
+`checkmk_user_config_v1` preserves parsed sections but redacts recognized password/token/
+passphrase/credential/community fields, command/argument/environment bodies, MRPE
+commands, URL credentials and obvious inline secrets. `redacted_paths` explains what
+was withheld. Comments/formatting are not YAML data. The operation may read only basename
+`check_mk.user.yml`, <=512 KiB, from a trusted configured path. It never modifies the file.
+Unknown settings remain visible unless filtered; do not advertise this as guaranteed
+secret-free content. No general arbitrary-file reader is added.
+
+## Current schemas and exact semantic boundaries
+
+Normative field shapes: `playbooks/schemas/<schema>.yml` (also in catalog metadata).
+
+| Schema | Data meaning |
+|---|---|
+| host_capabilities_v1 | Eight booleans, source detection facts; no inventory membership edits |
+| filesystem_usage_v1 | Selected operational mounts/volumes; byte quantities and nullable observations; Windows uses attached storage volumes from community.windows.win_disk_facts and excludes mapped/network drives |
+| event_log_export_v1 | Channel names, age and target file paths; no log contents or controller download; check mode has no exported paths |
+| service_start_summary_v1 | Before stopped services, policy eligibility, attempts, exclusions, actual after observations and fixed per-attempt failures |
+| patch_summary_v1 | Per-package net version-set changes on Debian/RedHat, or Windows update IDs/titles/KBs with installed flags; never arbitrary manager dictionaries |
+| managed_cleanup_preview_v1 | Managed filename candidates and observed deletions; no unknown-file purge |
+| checkmk_user_config_v1 | Parsed/redacted sections and file metadata, not raw YAML/debug output |
+| checkmk_agent_state_v1 | Installed status/version from registry/package query, actual service states, package/config/check changes |
+| checkmk_agent_config_v1 | Named section/config/check change actions; no raw before/after values or file diffs |
+
+### Services
+
+`initially_stopped` is the observation before action. `eligible` applies auto/delayed-start
+and configured include/exclude policy. `attempted` excludes skipped and check-mode actions.
+`newly_running` is the observed stopped-to-started transition, including a concurrent
+external start; `started_count` counts only attempted services now running. It is not
+proof that the start return alone kept a service alive. `still_stopped` includes excluded
+services; `unobserved` means missing after observations. Non-running attempted services
+appear in `failed_to_start` with name, fixed reason/message and nullable numeric native
+code. Failed reasons include dependency_failed, permission_denied, service_disabled,
+start_timeout, service_not_found, logon_failed, start_failed, not_running_after_start and
+state_unavailable. Localized unrecognized errors use generic start_failed; no raw text.
+An unavailable post-query fails the run instead of inventing a successful observation.
+
+### Packages and Checkmk
+
+Linux queries native package databases before/after the update/reboot policy, preserving
+architecture and parallel installed version sets. `updates` lists updated/installed/
+removed rows and separate counters. Old/new arrays are empty where the package did not
+exist. Snapshots cannot identify an intermediate reinstall with unchanged final versions
+or attribute concurrent external package changes; do not run another package manager
+concurrently. Check mode reports no completed changes, not predicted upgrade versions.
+No silently shortened list: exceeding limits becomes explicit validation failure.
+
+Windows reports native updates marked installed, pending/failed records and numeric
+failure codes. A mismatch between native installed count and detailed records marks
+`data.complete: false`, rather than fabricating records. Supported scope remains Windows
+Update under configured categories, not every third-party package installer. Reboot
+facts retain their observed meaning; check mode never claims a performed reboot.
+
+Checkmk versions can be null (unavailable/ambiguous); do not fall back to the filename.
+Config changes are section/file-level, not field-level raw diffs. `deployed_checks` means
+selected file-copy tasks completed; `changed_checks` identifies changed copy results.
+Check-mode changes are predictions; mode is always explicit. Unknown files are neither
+counted nor scanned: policy is `untouched_not_enumerated`, not an invented preserved count.
+
+## Errors and consumer behavior
+
+Report errors: operation_result_missing, operation_result_invalid,
+operation_result_withheld, operation_result_limit, operation_result_incomplete.
+Messages contain no payload/exception content. Preserve final Core/native status;
+show report issues separately; no credential retry or task replay is implied.
+
+Treat this candidate as an implementation awaiting native 2.19.11/managed-host acceptance.
+Upstream interfaces consulted: Ansible 2.19.11 `plugins/action/set_stats.py`,
+`executor/stats.py`, and callback result contracts; ansible.windows >=3.8.0,<4.0.0 win_updates and
+win_service_info return definitions. Consultation is not native testing.
+
+
+## Patch wave and reboot semantics (3.3.0rc8)
+
+`patch_summary_v1` reports package/update evidence independently from reboot policy. Linux
+retains the rc2 package-manager transaction model. Windows delegates each selected patch
+wave to one native `ansible.windows.win_updates` `state: installed` invocation with
+`reboot: false`. The collection and Windows Update Agent own update ordering/coordination
+inside that wave; AIM does not schedule updates individually.
+
+The returned update dictionary is normalized into reviewed installed/failed records. A
+module-level failure with no per-update records becomes a bounded generic failed-wave record;
+raw failure text, exceptions and arbitrary module dictionaries are not published.
+
+A newly required reboot with `os_patching_reboot: false` does not invalidate successful
+installation: `reboot_required`/`reboot_required_after` are true and `reboot_deferred` is
+true. The run stops. On a later run, a detected pre-existing reboot with automatic reboot
+still disabled publishes `evidence: preflight_reboot_state`, `complete: false`,
+`blocked_reason: preexisting_reboot_required`, then fails before new patch work starts.
+
+When automatic reboot is enabled, AIM waits for the native update wave to return before
+performing its reviewed message/delay/reboot. By default
+`os_patching_rescan_after_reboot: false`; any AIM-performed reboot ends the run with
+`continuation_required: true` and `remaining_updates_known: false`. This includes a reboot
+that was already required before patching began. A new operator-approved run owns discovery
+of the next patch state.
+
+If the operator explicitly sets post-reboot continuation true, AIM may invoke another native
+Windows update wave after reboot. Continuation is bounded to 12 wave invocations per run. A
+failed wave is never automatically replayed or used as authority to continue.
+
+When a Windows wave completes without reboot, AIM performs one final read-only search. This
+does not install newly applicable updates. `remaining_updates_known` is then true and
+`pending` contains that final observation; `continuation_required` indicates whether another
+operator-approved run has applicable work.
+
+`patch_cycles` counts native Windows install-wave invocations entered in the run and
+`rescan_after_reboot` echoes the reviewed option. Those fields are Windows-specific and are
+optional in the closed schema so existing Linux result shape remains stable.
+
+Windows `failed_updates` contains only bounded safe fields: update identity/title, normalized
+unsigned HRESULT and hex form, a fixed reason and fixed message. Known reasons include
+`operation_in_progress`, `install_not_allowed`, `not_applicable`,
+`exclusive_install_conflict`, `self_update_in_progress`, `no_connection`, and `timeout`.
+Raw Windows Update failure strings are not published. `0x80240016` maps to
+`install_not_allowed`; it does not prove a reboot was pending because Windows also uses that
+HRESULT while another installation is active. Only the independent preflight can report
+`preexisting_reboot_required`.
+
+`reboot_required_before` records the pre-run observation. `reboot_performed` is true when
+AIM completed an approved reboot. `reboot_required_after` and the legacy
+`reboot_required` field describe the final pending state represented by the report.
+`reboot_delay_minutes` echoes the reviewed delay. The user-facing reboot message itself is
+not copied into the structured result.
+
+Windows, Debian and RedHat use platform-native reboot-required signals; RedHat preflight
+is conservative when `needs-restarting` is not already present. Report fields never imply
+that every possible vendor-specific reboot indicator was discovered.
+
diff --git a/scripts/docs/PLAYBOOKS.md b/scripts/docs/PLAYBOOKS.md
new file mode 100644
index 0000000..b2f826f
--- /dev/null
+++ b/scripts/docs/PLAYBOOKS.md
@@ -0,0 +1,83 @@
+# Playbooks and reporting contracts
+
+**Current AIM 3.3.0rc8.** The catalog is authoritative for typed inputs, requirements and report declarations.
+
+Run options omitted by a caller remain inherited from inventory/role defaults. Core
+requires explicit compatible hosts and final scope review; group shortcuts expand to
+deduplicated explicit hosts. `aim_debug` adds only selected diagnostics, not raw API output.
+
+Normal terminal operations validate existing Vault passwords before launch and retain
+the workflow on a typo. New-encryption/create prompts stay native. Catalog connections
+use inventory/Vault credentials; automatic replay is never performed after launch.
+
+## Catalog audit
+
+| Key | Platforms | Report schema |
+|---|---|---|
+| `checkmk_install_agent` | linux, windows | `checkmk_agent_state_v1` |
+| `checkmk_update_scripts_config` | linux, windows | `checkmk_agent_config_v1` |
+| `checkmk_read_windows_config` | windows | `checkmk_user_config_v1` |
+| `checkmk_cleanup_scripts` | linux, windows | `managed_cleanup_preview_v1` |
+| `debug_test_connection` | linux, windows | None; native target outcomes/progress |
+| `debug_show_disk_usage` | linux, windows | `filesystem_usage_v1` |
+| `debug_detect_host_roles` | linux, windows | `host_capabilities_v1` |
+| `maintenance_export_event_logs` | windows | `event_log_export_v1` |
+| `maintenance_start_stopped_services` | windows | `service_start_summary_v1` |
+| `maintenance_patch_os` | linux, windows | `patch_summary_v1` |
+| `maintenance_reboot_hosts` | linux, windows | None; native target outcomes/progress |
+| `sophos_apply_baseline` | sophosxgs | None; native target outcomes/progress |
+| `sophos_apply_customer` | sophosxgs | None; native target outcomes/progress |
+| `pfsense_apply_baseline` | pfsense | None; native target outcomes/progress |
+
+Customer Sophos profiles share the catalogued customer operation; their five concrete
+playbooks remain unchanged and publish no operation payload. Firewall policies, connection
+test and reboot behavior were not redesigned for reporting.
+
+## Schema and operational details
+
+See [OPERATION_RESULTS.md](OPERATION_RESULTS.md) for field meanings and missing/partial/
+check-mode behavior. Read [CHECKMK.md](CHECKMK.md) for managed filename/section ownership.
+Role READMEs retain local default settings. `list_playbooks` exposes the current typed
+input definitions and resolved report schemas; add-ons need not keep copies of this table.
+
+## OS patch reporting
+
+The catalog exposes `os_patching_reboot`, `os_patching_reboot_delay_minutes`,
+`os_patching_reboot_message`, Windows categories, and the Windows-only
+`os_patching_rescan_after_reboot` flag. The message/delay apply only when AIM initiates a
+reboot.
+
+Windows delegates each current patch wave to one native `ansible.windows.win_updates`
+`state: installed` invocation with `reboot: false`. The module/WUA owns selection and
+sequencing inside that selected category wave; AIM does not loop individual updates or use
+`accept_list` to manufacture its own scheduler. Per-update records returned by the module
+are normalized for reporting.
+
+If the completed wave requires reboot, AIM either defers it or performs the reviewed
+message/delay/reboot. By default (`os_patching_rescan_after_reboot: false`) that reboot ends
+the run, so another wave requires a new operator-approved execution. When explicitly
+enabled, AIM may start another native wave after reboot; continuation is defensively bounded
+to 12 wave invocations. A failed wave is never automatically replayed.
+
+If a wave finishes without reboot, AIM performs one final read-only discovery for reporting
+only. Windows reports expose individual installed and failed updates, bounded HRESULT
+classifications, `continuation_required`, and whether the reported pending list is
+authoritative.
+
+Linux snapshots use dpkg-query/RPM before and after the existing operation, retaining
+architecture and parallel installed version sets. Every net difference is published;
+intermediate no-net-change transactions are not observable from snapshots. No package
+stdout scraping or guessed versions. Check mode never claims installation.
+
+## Service recovery
+
+Initial stopped/eligible/excluded states, actual attempts and post-start observations
+are all separate. `failed_to_start` gives fixed reasons and numeric codes where known.
+The default fail-on-error policy still fails the run after a report is published.
+
+## Security
+
+Catalogs, roles and inventory are trusted controller code. Report schemas are reviewed
+public data contracts, not automatic secret scanners. Operator-owned Checkmk config
+can contain credentials; its reader filters known secret/command fields and publishes
+redacted paths. No general raw-file/data export was enabled.
diff --git a/scripts/docs/README.md b/scripts/docs/README.md
new file mode 100644
index 0000000..ea4231a
--- /dev/null
+++ b/scripts/docs/README.md
@@ -0,0 +1,34 @@
+# Current documentation index
+
+**AIM 3.3.0rc8.** These files supersede previous release-specific handoffs/checklists.
+Do not copy an old validation status into a new release. Archive history externally;
+keep the reverse-chronological CHANGELOG in the distribution.
+
+| Topic | Authoritative document |
+|---|---|
+| Release changes | [RELEASE_NOTES.md](RELEASE_NOTES.md) |
+| Current evidence and limits | [VALIDATION.md](VALIDATION.md) |
+| Operator acceptance procedure | [SANITY.md](SANITY.md) |
+| Fresh installation | [INSTALLATION.md](INSTALLATION.md) |
+| Update and recovery | [deploy/README.md](../../deploy/README.md) |
+| Core development | [AGENTS.md](AGENTS.md) |
+| Add-on implementation responsibilities | [ADDON_AGENTS.md](ADDON_AGENTS.md) |
+| API request/response lifecycle | [ADDON_API.md](ADDON_API.md) |
+| Purposeful data and schema authoring | [OPERATION_RESULTS.md](OPERATION_RESULTS.md) |
+| Safe execution progress | [DETAILED_PROGRESS.md](DETAILED_PROGRESS.md) |
+| Native target outcomes | [TARGET_OUTCOMES.md](TARGET_OUTCOMES.md) |
+| Inventory tree | [INVENTORY_HIERARCHY.md](INVENTORY_HIERARCHY.md) |
+| Hardened execution environment | [EXECUTOR_STAGING.md](EXECUTOR_STAGING.md) |
+| Implemented/deferred boundary | [ADDON_SUPPORT.md](ADDON_SUPPORT.md) |
+| Current handoff checklist | [RELEASE_HANDOFF.md](RELEASE_HANDOFF.md) |
+| Playbook options and reports | [PLAYBOOKS.md](PLAYBOOKS.md) |
+| Checkmk-specific operational settings | [CHECKMK.md](CHECKMK.md) |
+
+`addon-support-v1.json` is a snapshot of default capabilities, not a release manifest
+or runtime acceptance certificate. `aimctl capabilities` reports the installed state.
+The nine files in `playbooks/schemas/` are normative data shapes; schema definitions
+are also resolved into catalog metadata so add-ons need not access the filesystem.
+
+- [CHANGELOG.md](CHANGELOG.md) — retained release history.
+- `roles/*/README.md` — role-specific reference documentation stays beside each role.
+- `deploy/README.md` — deployer/update/rollback mechanics stay beside the deployer.
diff --git a/scripts/docs/RELEASE_HANDOFF.md b/scripts/docs/RELEASE_HANDOFF.md
new file mode 100644
index 0000000..a183036
--- /dev/null
+++ b/scripts/docs/RELEASE_HANDOFF.md
@@ -0,0 +1,91 @@
+# AIM 3.3.0rc8 Core and add-on handoff
+- AIM-owned documentation is centralized under `scripts/docs/`; the installation-root `README.md` is operator-owned and preserved.
+
+
+## 3.3.0rc8 final Windows Checkmk script placement
+
+- `citrix_sessions_customized.ps1`, `veeam_o365_status.ps1`, and `veeam_backup_status.ps1` are AIM-managed custom plugins under `$CUSTOM_PLUGINS_PATH$`.
+- `veeam_backup_license_status.ps1` is a VBR-detected local check under `$CUSTOM_LOCAL_PATH$`.
+- AIM emits exact custom-plugin rules before the generic plugin rules and no longer needs to place these custom scripts in Checkmk's built-in plugin tree.
+- Selected custom-plugin deployment removes only known legacy AIM-managed copies from the historical local directory and, where applicable, the historical built-in plugin directory. Unknown/custom files remain untouched.
+- Service/wire/event API 1.0 and the existing Checkmk structured result schemas are unchanged.
+
+## Release status
+
+Candidate implementation is complete for the nine agreed reporting operations. Local
+validation and limitations are maintained only in [VALIDATION.md](VALIDATION.md).
+No new native controller/Windows/Linux acceptance is claimed. The remaining operator
+gate is [SANITY.md](SANITY.md). Do not relabel older successful runs as candidate tests.
+
+## What independent teams consume
+
+The stable boundary remains `aim.services.v1` / `aimctl`, not private callbacks or UI
+modules. Inspect `operation_results`, then catalog `result`/prepared `result_contract`.
+Consume final `operation_result` in either progress mode. No add-on source was inspected,
+modified or required. Existing adapters continue to receive previous fields; an updated
+adapter renders the additional data without reconstructing it from task events.
+
+Read the authoritative [add-on guide](ADDON_AGENTS.md), [API](ADDON_API.md),
+[result protocol](OPERATION_RESULTS.md) and [support matrix](ADDON_SUPPORT.md). Exact
+payload shapes live in `playbooks/schemas/` and are included in public catalog metadata.
+
+Keep overall Core status, native per-target outcomes and report availability separate.
+A native exit 0 plus missing required output yields Core result_validation failure.
+A native failed job can still provide useful report data. Do not replay either case
+without an explicit new operator decision, approval and fresh credentials.
+
+## Implementation map for future Core work
+
+- `integrations/output_policy.py`: standalone JSON schema subset and data validator.
+- `playbooks/catalog.py`: resolve/validate catalog-owned schemas.
+- `integrations/callbacks/aim_safe_events.py`: verify set_stats provenance/no_log,
+  reconcile final custom stats and send bounded private chunks.
+- `runtime/outputs.py`: reassemble/revalidate, apply known-secret suppression and
+  construct final report availability. Independent of detail/summary mode.
+- `services/v1`: optional metadata/final result fields and unchanged lifecycle controls.
+- `playbooks/filter_plugins/aim_reports.py`: runbook-owned normalizers, no Core dispatch.
+- `playbooks/schemas`: nine static data shapes. Add new schemas without Core branches.
+
+## Deployment
+
+Use the full replacement ZIP and checksum with the normal operational deployer. Prefer
+automatic existing-interpreter discovery; do not require a remembered AIM_PYTHON variable.
+Review retirement/removal entries as well as writes. Quiesce before apply and preserve
+recovery data. The narrow executor staging exceptions remain necessary. Core does not
+modify unit files or prove another service account can use its paths/keys/collections.
+
+## Open qualification and limits
+
+Native set_stats/callback behavior on 2.19.11, real Windows/Linux reports and package
+manager tests remain controller gates. Global transport is implemented but no bundled
+operation uses it; native global/serial-run_once behavior needs separate qualification.
+Config filtering is an explicit safety subset, not a universal secret scanner. Package
+snapshots describe net observed changes, not an exhaustive transaction journal. No raw
+result API, Custom credential overrides, key export or automatic permission migration.
+
+
+## 3.3.0rc8 native-module baseline
+
+The canonical controller remains ansible-core 2.19.11, but Windows playbooks now require ansible.windows >=3.8.0,<4.0.0 so Core can use the collection-owned `win_reboot_info` detector. Existing 3.2.x installations must update that collection explicitly before rc5 acceptance. `aimctl capabilities` advertises the floor and readiness rejects older versions.
+
+The audit also moved Checkmk file reads to `win_stat`/`slurp`, Linux package snapshots/version queries to `package_facts`, and Linux Checkmk final service reporting to `service_facts`. Reviewed custom commands remain only where current native modules do not preserve AIM's required semantics. See RELEASE_NOTES.md.
+
+## 3.3.0rc8 patch-runbook delta
+
+The public Core API remains 1.0. `os_patching_rescan_after_reboot` and the additive Windows
+fields in `patch_summary_v1` remain catalog/result-driven. Do not hard-code UI defaults.
+
+rc4 removes rc3's AIM-owned per-update queue. Each Windows patch wave is one native
+`ansible.windows.win_updates` install invocation with the selected categories and
+`reboot: false`. This intentionally delegates update ordering/coordination inside the wave
+to the collection and Windows Update Agent while preserving AIM ownership of the reviewed
+reboot message, delay, and whether another post-reboot wave is authorized.
+
+The default continuation remains false. After any AIM-performed reboot, including a
+pre-existing-reboot preflight, the run stops unless the operator explicitly enabled
+post-reboot continuation. A failed wave is never automatically replayed. Explicit
+continuation remains defensively capped at 12 waves.
+
+Per-update records returned by `win_updates` are still normalized into bounded installed and
+failed records. `0x80240016` remains `install_not_allowed`, not proof of a reboot; the
+independent preflight remains the source for `preexisting_reboot_required`.
diff --git a/scripts/docs/RELEASE_NOTES.md b/scripts/docs/RELEASE_NOTES.md
new file mode 100644
index 0000000..bf79d84
--- /dev/null
+++ b/scripts/docs/RELEASE_NOTES.md
@@ -0,0 +1,72 @@
+# AIM 3.3.0rc8 release notes
+
+3.3.0rc8 is a focused Windows Checkmk ACL hardening release on top of the final rc7 script-placement baseline. AIM-managed persistent Checkmk files now remain readable/manageable by the standard local administrative principals even when created by a service account.
+
+## Windows Checkmk managed-file ACLs
+
+After AIM creates or updates a persistent Windows Checkmk script or `check_mk.user.yml`, the reusable `checkmk_windows_acl` role enables parent ACL inheritance and guarantees these locale-independent well-known SID entries:
+
+- SYSTEM (`S-1-5-18`): FullControl
+- local Administrators (`S-1-5-32-544`): FullControl
+- ALL APPLICATION PACKAGES (`S-1-15-2-1`): ReadAndExecute
+- ALL RESTRICTED APPLICATION PACKAGES (`S-1-15-2-2`): ReadAndExecute
+
+AIM does not add a customer-specific administrator/user ACE such as the example `bitformer` account. ACL normalization is per exact AIM-managed file; it does not recurse through Checkmk directories or modify unknown/operator files. Existing intentional inherited/explicit ACEs are not blindly purged.
+
+
+## Final Windows Checkmk script placement
+
+`citrix_sessions_customized.ps1`, `veeam_o365_status.ps1`, and `veeam_backup_status.ps1` are now consistently deployed as Checkmk custom plugins under `C:\ProgramData\checkmk\agent\plugins` (`$CUSTOM_PLUGINS_PATH$`). Their managed execution rules use the custom-plugin path; AIM no longer needs to overwrite Checkmk's built-in plugin tree. `veeam_backup_license_status.ps1` is added as a VBR-detected local check under `$CUSTOM_LOCAL_PATH$`. Selected plugin deployment removes only known historical AIM copies from the old local/built-in locations; unknown files remain untouched.
+
+## Windows disk facts
+
+- `debug_show_disk_usage` now uses `community.windows.win_disk_facts` instead of a custom `Get-PSDrive` PowerShell collector.
+- Windows results represent attached local volumes. Mapped/network drives are intentionally outside this host-capacity report.
+- `filesystem_usage_v1` is unchanged, so existing add-on renderers do not need a schema migration.
+Baseline: complete AIM 3.3.0rc8 replacement bundle. Service/wire/event API remains 1.0 and canonical Ansible Core remains 2.19.11.
+
+## Native-module audit
+
+This candidate reviews the complete bundled playbook/role tree with a native-module-first rule: if the supported Ansible runtime already exposes the required semantics, AIM delegates to that module instead of maintaining its own shell/PowerShell implementation.
+
+Changes made:
+
+- Windows pending-reboot detection now uses `ansible.windows.win_reboot_info` and publishes its bounded reboot sources instead of AIM-maintained registry heuristics.
+- `checkmk_read_windows_config` now uses `ansible.windows.win_stat` plus `ansible.windows.slurp`; no PowerShell is used to stat/read the file.
+- Debian and RedHat package before/after snapshots use `ansible.builtin.package_facts` instead of direct `dpkg-query`/`rpm -qa` commands.
+- Linux Checkmk installed-package reporting uses `package_facts`; Linux Checkmk runtime state reporting uses `service_facts` instead of `dpkg-query`/`rpm` and `systemctl show` for the final report.
+- Core/service and terminal dependency preflights now reject `ansible.windows` older than 3.8.0 before a playbook can rely on `win_reboot_info`.
+
+## Collection baseline change
+
+`ansible.windows.win_reboot_info` was introduced in ansible.windows 3.8.0. The release requirements therefore declare:
+
+```yaml
+- name: ansible.windows
+  version: ">=3.8.0,<4.0.0"
+```
+
+Existing controllers that still have ansible.windows 3.2.x must deliberately update the collection before accepting rc8. AIM still does not install or upgrade collections automatically.
+
+## Reboot-state behavior
+
+The Windows preflight now trusts the collection's reboot detector, which covers Windows Update, Component Based Servicing, pending file rename, pending computer rename, domain join and Server Manager sources. The public patch report can include `reboot_reasons_before` entries containing bounded `source` and `description` fields.
+
+Overall patch-wave/reboot policy is unchanged from rc4: one native `win_updates` wave, AIM-controlled reboot message/delay, and no post-reboot patch wave unless `os_patching_rescan_after_reboot` was explicitly enabled.
+
+## Reviewed custom operations intentionally retained
+
+The audit did not replace custom code where a native module would lose required behavior:
+
+- Windows disk reporting now uses `community.windows.win_disk_facts` and reports attached local storage volumes. Mapped/network drives are intentionally excluded from Windows host-capacity reporting.
+- Windows event-log export keeps a bounded `win_powershell` wrapper around the native Windows event export utility because the supported collection does not provide EVTX export with the required time filter.
+- Checkmk's Windows `plugins:` section editor remains custom because AIM must preserve every unmanaged section/comment while replacing only its marked section.
+- Windows Checkmk installed-version discovery retains a bounded read-only uninstall-registry query because no supported module exposes arbitrary installed MSI/application inventory with the required product matching semantics.
+- RedHat reboot-required checks retain `needs-restarting -r`; no supported ansible-core module exposes that host state.
+- Linux Checkmk unit discovery retains `systemctl show LoadState` because AIM supports socket activation and `service_facts` is service-oriented and is not a reliable replacement for arbitrary socket-unit existence discovery.
+- pfSense's two `raw sysctl` operations remain intentionally bootstrap-safe and do not add a Python/runtime dependency merely to replace two appliance-native calls.
+
+This is therefore a native-first policy, not a prohibition on all commands.
+
+
+All AIM-owned Markdown/JSON documentation is centralized under `scripts/docs/`. The release no longer owns the installation-root `README.md`; an existing root README is preserved during update.
diff --git a/scripts/docs/SANITY.md b/scripts/docs/SANITY.md
new file mode 100644
index 0000000..acc94b2
--- /dev/null
+++ b/scripts/docs/SANITY.md
@@ -0,0 +1,105 @@
+# AIM 3.3.0rc8 controller acceptance
+
+Run on disposable/approved targets under the actual execution UID, groups, HOME and
+service sandbox, using native ansible-core 2.19.11 and declared collections. Do not use
+an ordinary root shell as evidence for another worker. Do not send raw Vaults/config
+secrets in test feedback. Keep the staging exceptions from the accepted deployment.
+
+## Installation and unchanged controls
+
+Verify checksum, preview the deployer, confirm only named obsolete Core docs are removed,
+quiesce jobs/writers and apply. Verify `aim --version`, `aimctl --version`, capabilities,
+independent terminal startup, Vault wrong-then-correct retry and cancellation. Confirm
+operator aim.yml/inventory/keys/add-on state are unchanged. `aimctl staging-check` must
+pass inside the executor, including differing process and passwd homes when relevant.
+
+## Discover the new contract without credentials
+
+```bash
+aimctl capabilities
+printf '%s\n' '{"api_version":"1.0","operation":"list_playbooks","customer":"CUSTOMER"}' | aimctl request
+printf '%s\n' '{"api_version":"1.0","operation":"prepare","request":{"customer":"CUSTOMER","playbook":"debug_detect_host_roles","hosts":["HOST"]}}' | aimctl request
+```
+
+Replace identifiers. Request JSON is one line. Expect operation_results capability and
+prepared result_contract with host_capabilities_v1; unchanged explicit targets/revision.
+Nonreporting `debug_test_connection` must advertise result:null. Unknown options/hosts
+must still fail before launch. Schema changes must stale an earlier preparation.
+
+## Fresh approved execution matrix
+
+Supply credentials through the established one-run provider/private FD. Use summary
+and detail on separate newly approved runs; compare reports rather than event ordering.
+Do not cache the password or reuse a provider/revision after source changes.
+
+| Operation | Evidence required |
+|---|---|
+| Detect roles | Eight booleans agree with authorized native report; no inventory mutation |
+| Disk usage | Compare Windows/Linux observed byte counts; handle unavailable/empty mounts |
+| Export event logs | Paths exist after apply; existing logs not cleared; check creates no export |
+| Start services | Disposable services: one recoverable, one failing dependency/disabled/race case, one excluded; compare before/after states and fixed reasons |
+| Patch OS | Disposable snapshots: verify Linux net package/version changes; Windows uses one native win_updates wave per approved patch stage; IDs/KBs/HRESULTs; user-visible reboot message/delay; default stops after reboot with continuation_required; explicit post-reboot continuation starts another wave |
+| Checkmk cleanup | Preview removes nothing; approved deletion lists only managed files actually changed |
+| Read Checkmk user config | Plugins/local/unknown sections preserved in report; dummy passphrase and MRPE command data redacted; reject other basenames; no timestamp/content write |
+| Checkmk install | Installed version agrees with registry/package DB; services observed; idempotent rerun shows no package/config changes |
+| Checkmk config update | One approved rule/file change reported; second run no change; unrelated local/MRPE/unknown files untouched |
+
+New reporting tasks change task counts. Compare effects, failure states and payloads,
+not historical exact ok/skipped totals. For patching, protect against concurrent package
+management and record starting snapshot/selected categories. A partial update still
+requires explicit recovery decisions; never repeat automatically.
+
+### Windows patch-wave acceptance
+
+Use a disposable Windows target with several applicable updates. Confirm the normal apply
+path contains one `win_updates state=installed` task for the selected categories rather than
+one task per update. Windows/collection-native sequencing inside that wave is expected; AIM
+should not emit `accept_list` selectors for individual discovered updates.
+
+Record the structured result and compare it to Windows Update history. Installed and failed
+updates should retain bounded IDs/titles/KBs/HRESULT classifications. A mixed native result
+must not lose successful updates merely because another update failed. Raw failure messages
+or exception text must not enter the operation result.
+
+With `os_patching_rescan_after_reboot: false` (catalog default), allow the current wave to
+finish and require reboot. The user should receive the reviewed message/delay. After
+reconnect the run must end without another install/search wave. Expect
+`continuation_required: true` and `remaining_updates_known: false`; a new approved run owns
+the next patch state.
+
+Also test a host that begins with an already-pending reboot. With automatic reboot enabled
+and post-reboot continuation false, AIM should reboot and stop before patch installation.
+With continuation true, it may begin the first native update wave after reboot. With
+automatic reboot disabled, it must fail preflight before new installs.
+
+Repeat with `os_patching_rescan_after_reboot: true`. After a patch-triggered reboot AIM may
+start another native update wave. Do not infer this opt-in from the reboot flag. Explicit
+continuation remains bounded to 12 waves. A failed wave must stop and must never be replayed
+automatically.
+
+For a failed update, confirm `failed_updates` contains only bounded title/ID, unsigned/hex
+HRESULT, reason and fixed message. If `0x80240016` can be reproduced, expect
+`install_not_allowed`; do not expect `preexisting_reboot_required` unless the separate
+preflight actually observed a pending reboot.
+
+## Fail-closed fixtures (disposable catalog/playbook only)
+
+After each fixture edit, prepare/review anew. Test missing required publisher; wrong
+schema/type/extra fields; publisher under no_log; duplicate publication; >limit data;
+and a supplied secret canary in an output string. Expect no rejected payload in public
+JSON/logs. Native exit 0 with invalid/missing required data must fail at result_validation,
+retain exit_code 0/native target facts and never replay. No declaration must export
+nothing even if unrelated debug/custom stats contain a secret.
+
+Test two targets with one unreachable and one completed report. Overall native failure
+remains; one available report does not imply all-target success. Test Ctrl+C mid-run:
+report must not claim earlier observations are completed output. Ensure no residual
+credential/helper process and a subsequent fresh operation works. Test chunked output
+beyond a single private frame; a torn stream must fail, never silently truncate.
+
+## Sign-off
+
+Record version, execution UID/group context, runtime/collection versions, platform and
+which cases were tested, separately for native terminal and service. Do not mark global
+transport, another OS, Server 2012 R2 or another service identity accepted from one Windows
+11 test. Report final status/exit/target facts/report availability with credentials removed.
diff --git a/scripts/docs/TARGET_OUTCOMES.md b/scripts/docs/TARGET_OUTCOMES.md
new file mode 100644
index 0000000..b353c0b
--- /dev/null
+++ b/scripts/docs/TARGET_OUTCOMES.md
@@ -0,0 +1,108 @@
+# AIM per-target final execution outcomes
+
+**AIM 3.3.0rc8 / service API 1.0. Capability:** `target_outcome_summary_v1`.
+
+Core's overall execution result remains authoritative and unchanged. An Ansible run
+with one unreachable target still returns, for example, `status: failed`, execution
+stage and the native nonzero exit code. The additive target summary answers a
+different question: what final Ansible outcome did each **requested target** have?
+
+## Result fields
+
+Every `RunResult` now contains:
+
+```json
+{
+  "target_summary": {
+    "schema": "target_outcome_summary_v1",
+    "requested": 25,
+    "successful": 24,
+    "failed": 0,
+    "unreachable": 1,
+    "not_started": 0,
+    "indeterminate": 0,
+    "complete": true,
+    "accounted": 25
+  },
+  "targets": [
+    {
+      "host": "host01.example",
+      "outcome": "successful",
+      "counts": {
+        "ok": 38,
+        "changed": 0,
+        "failures": 0,
+        "unreachable": 0,
+        "skipped": 22,
+        "rescued": 0,
+        "ignored": 0
+      }
+    }
+  ]
+}
+```
+
+The `targets` list is in the reviewed request order. `accounted` always equals
+`requested`. Capability discovery advertises the schema, state vocabulary and that
+the data is available in both `summary` and `detail` progress modes.
+
+## Outcome semantics
+
+Core derives these states from Ansible's **final per-host stats callback**, not from
+aggregate task counters or a client's interpretation of progress events:
+
+- `unreachable`: final host stats contain one or more unreachable results.
+- `failed`: no unreachable count, but final host stats contain unresolved failures.
+- `successful`: final host stats were emitted for the requested host and contain
+  neither unresolved failures nor unreachable results. Changed/skipped/rescued/
+  ignored task counts do not by themselves make the host unsuccessful.
+- `not_started`: a complete final stats set was received, but the requested host
+  had no final host stats; or execution ended before remote work could start.
+- `indeterminate`: remote execution may have started but Core did not receive a
+  complete final stats set (for example cancellation, process loss or invalid
+  event stream). Core deliberately does not infer success from earlier task events.
+
+If both failure and unreachable counters exist for one host, `unreachable` takes
+precedence because the target did not remain reachable through the execution.
+Per-target `counts` are task counters for diagnostics; the `outcome` field is the
+Core-owned final classification.
+
+This describes Ansible execution truth, not arbitrary application-level semantics.
+A playbook that intentionally ignores a module error or reports a domain-specific
+problem without failing remains subject to the playbook's own Ansible semantics.
+
+## Overall status remains separate
+
+A mixed run can therefore be represented as:
+
+```text
+Core RunResult: failed / execution / exit 4
+Target facts:   24 successful, 1 unreachable
+```
+
+An interface may choose a presentation label such as `Partially succeeded`, but
+that label is not a Core status and must not replace or hide the authoritative
+Core result.
+
+Pre-execution `ServiceError` responses remain errors rather than fake partial
+success. When `execute` returns a `RunResult` before launch, targets are accounted
+as `not_started` and `remote_work_may_have_started` remains false.
+
+## Transport and safety
+
+The native callback sends only target indexes and numeric recap counts through the
+private event bridge. Public host names come from the already reviewed request,
+not arbitrary callback payloads. No raw module output, variable data, credentials,
+exception text or task result dictionaries are added.
+
+Consumers should use this result instead of reconstructing final target outcomes
+from `play_task_host_v1`. Detailed events remain useful for live presentation; the
+final target summary is the authoritative end-state accounting.
+
+## Report validation is a separate layer
+
+A native exit 0 and successful target stats do not prove a required operation report
+was published. 3.3.0rc8 can fail the Core result at result_validation while preserving
+those native target facts and exit_code 0. See OPERATION_RESULTS.md. Do not convert a
+missing report into fake target success, nor rewrite native counts to express a
+report-contract error.
diff --git a/scripts/docs/VALIDATION.md b/scripts/docs/VALIDATION.md
new file mode 100644
index 0000000..644d7ba
--- /dev/null
+++ b/scripts/docs/VALIDATION.md
@@ -0,0 +1,64 @@
+# AIM 3.3.0rc8 validation record
+
+This record distinguishes source/local validation from native controller acceptance.
+
+## Candidate scope
+
+3.3.0rc8 is a focused Windows Checkmk ACL hardening release on top of the final rc7 source state. It retains the native-module, disk-facts, patch-wave, Checkmk placement, and public API behavior while normalizing access on AIM-managed persistent Windows Checkmk files.
+
+## Local checks
+
+Passed for this source tree:
+
+- all bundled Python files parsed successfully;
+- all YAML/YML files parsed successfully;
+- report filters compile and the package-facts normalizer accepts Debian/RPM-shaped fact dictionaries;
+- `patch_summary_v1` accepts the additive bounded `reboot_reasons_before` field;
+- Windows patch source contains `ansible.windows.win_reboot_info` and no custom reboot-registry PowerShell probe;
+- Checkmk config reading contains `win_stat` + `slurp` and no `win_shell` reader;
+- Linux patch package snapshots contain `package_facts` and no `dpkg-query`/`rpm -qa` snapshot command;
+- Linux Checkmk final reporting contains `package_facts`/`service_facts` instead of direct package/systemctl queries;
+- Core/service and terminal preflight reject an ansible.windows version below 3.8.0.
+- Windows disk usage uses `community.windows.win_disk_facts`; the PowerShell `Get-PSDrive` collector is absent. A local normalizer fixture verified drive-letter and no-drive-letter attached volumes against the unchanged `filesystem_usage_v1` shape.
+
+- the new `checkmk_windows_acl` role uses `win_acl_inheritance` plus `win_acl` with well-known SIDs and is called only for exact AIM-managed script/config paths;
+- no customer-specific principal name such as `bitformer` is present in the ACL role;
+- no recursive ACL task targets the whole Checkmk local/plugins/config directories.
+
+The remaining command/PowerShell/raw call sites were individually reviewed and retained only where current supported modules do not preserve AIM's required semantics; see RELEASE_NOTES.md.
+
+A wheel build with `pip wheel --no-deps --no-build-isolation ./scripts` succeeded. After removing generated build residue, a disposable fresh full-source installation succeeded with both installed launchers reporting AIM 3.3.0rc8. A disposable rc7→rc8 replacement update also succeeded while preserving an operator root README, unknown operator documentation, and operator `scripts/aim.yml`.
+
+## Exact-runtime limitation
+
+This build environment cannot install the canonical external Ansible runtime/collections from package repositories, so no native `ansible-playbook --syntax-check`, `win_reboot_info`, WinRM, package-manager, or managed-host execution is claimed here.
+
+The release therefore requires controller qualification with:
+
+- ansible-core 2.19.11;
+- ansible.windows >=3.8.0,<4.0.0;
+- the remaining collections from requirements.yml;
+- an approved Windows target and Linux package-manager targets as applicable.
+
+## Required controller acceptance
+
+Before stable promotion verify at minimum:
+
+1. `ansible-galaxy collection list ansible.windows` reports 3.8.x and AIM readiness succeeds;
+2. a Windows host with no pending reboot reports `reboot_required_before=false`;
+3. a Windows host with a real pending reboot reports the native reason(s), and false-positive behavior is improved relative to the old registry probe;
+4. the current Windows update wave/reboot/no-rescan policy from rc4 remains unchanged;
+5. `checkmk_read_windows_config` returns the same bounded/redacted report using stat/slurp;
+6. Debian/RedHat patch reports still list actual net package changes using package_facts snapshots;
+7. Checkmk Linux install/update reporting still returns installed version and service state correctly;
+8. a Windows Checkmk deployment created by the service account leaves each AIM-managed script and `check_mk.user.yml` readable/manageable by local Administrators and SYSTEM and readable/executable by both application-package principals.
+
+Previous rc4 Windows patch success is historical evidence only and is not relabeled as an rc8 test.
+
+## Final Windows Checkmk placement checks
+
+Local release validation confirms the Windows script catalog marks `citrix_sessions_customized.ps1`, `veeam_o365_status.ps1`, and `veeam_backup_status.ps1` for `$CUSTOM_PLUGINS_PATH$`, while `veeam_backup_license_status.ps1` is selected automatically as a local check when VBR is detected. The rendered plugin template targets the exact custom-plugin paths, and migration/cleanup touches only the documented AIM-managed legacy filenames. Documentation-source validation also confirms no release Markdown/JSON remains outside `scripts/docs/`, and update planning leaves the installation-root `README.md` untouched. Native Windows/Checkmk execution still requires controller acceptance.
+
+## Documentation placement
+
+Validated that only root/scripts-root AIM-owned documentation is centralized under `scripts/docs/`; `deploy/README.md` and role READMEs remain component-local. The root `README.md` is not part of the release payload and remains operator-owned during update planning.
diff --git a/scripts/docs/addon-support-v1.json b/scripts/docs/addon-support-v1.json
new file mode 100644
index 0000000..888299c
--- /dev/null
+++ b/scripts/docs/addon-support-v1.json
@@ -0,0 +1,135 @@
+{
+  "api_version": "1.0",
+  "event_version": "1.0",
+  "core_version": "3.3.0rc8",
+  "canonical_ansible_core": "2.19.11",
+  "contract_stability": "stable_1.x",
+  "credential_requirements_policy": "conservative_customer_vault",
+  "operations": [
+    "capabilities",
+    "list_customers",
+    "list_hosts",
+    "inventory_hierarchy",
+    "list_playbooks",
+    "prepare",
+    "readiness",
+    "execute",
+    "staging_check"
+  ],
+  "execution": {
+    "implemented": true,
+    "enabled": false,
+    "profile": "same_uid_native_inventory",
+    "qualification": "controller_acceptance_required"
+  },
+  "execution_progress": {
+    "modes": [
+      "summary",
+      "detail"
+    ],
+    "default": "summary",
+    "request_field": "progress_mode",
+    "detail_schema": "play_task_host_v1",
+    "detail_event_kinds": [
+      "play_started",
+      "play_skipped",
+      "play_stopped",
+      "task_started",
+      "host_result",
+      "task_retry",
+      "task_async_poll",
+      "host_recap"
+    ],
+    "static_source_labels_only": true,
+    "raw_output": false,
+    "error_policy": "fixed_diagnostic_hints",
+    "qualification": "controller_acceptance_required"
+  },
+  "inventory_hierarchy": {
+    "schema": "inventory_hierarchy_v1",
+    "read_only": true,
+    "nested_groups": true,
+    "direct_hosts_only_per_node": true,
+    "execution_targets_remain_explicit_hosts": true
+  },
+  "target_outcomes": {
+    "schema": "target_outcome_summary_v1",
+    "states": [
+      "successful",
+      "failed",
+      "unreachable",
+      "not_started",
+      "indeterminate"
+    ],
+    "source": "native_final_host_stats",
+    "available_in_progress_modes": [
+      "summary",
+      "detail"
+    ],
+    "overall_status_unchanged": true
+  },
+  "operation_results": {
+    "protocol": "aim_output_v1",
+    "result_protocol": "aim_operation_result_v1",
+    "catalog_field": "result",
+    "scopes": [
+      "per_host",
+      "global"
+    ],
+    "available_in_progress_modes": [
+      "summary",
+      "detail"
+    ],
+    "raw_output": false,
+    "max_bytes_per_host": 1048576,
+    "max_bytes_per_run": 16777216,
+    "qualification": "controller_acceptance_required"
+  },
+  "controller_staging": {
+    "profile": "native_defaults_preflight_v2",
+    "operation": "staging_check",
+    "default_directory": "~/.ansible/tmp",
+    "passwd_home_local_connection_directory": "~account/.ansible/tmp",
+    "required_before_credentials": true,
+    "rechecked_before_launch": true,
+    "probe": "create_write_read_remove",
+    "service_units_modified": false,
+    "remote_paths_overridden": false,
+    "coverage": "native_local_tmp_and_passwd_home_posix_local_default"
+  },
+  "credential_fields": [
+    "vault_password",
+    "connection_password",
+    "become_password",
+    "ssh_key_passphrase"
+  ],
+  "credential_semantics": "native_defaults_not_inventory_overrides",
+  "unsupported": [
+    "cross_uid_execution",
+    "custom_password_override",
+    "private_key_export",
+    "inventory_mutation",
+    "vault_mutation",
+    "bootstrap",
+    "raw_task_output",
+    "automatic_permission_migration",
+    "automatic_retry_after_launch",
+    "untrusted_tenant_sandbox"
+  ],
+  "limits": {
+    "request_bytes": 131072,
+    "credential_bytes": 65536,
+    "hosts": 1000,
+    "timeout_seconds": 86400,
+    "credential_ttl_seconds": 300,
+    "detail_events": 200000,
+    "progress_label_characters": 200,
+    "progress_host_characters": 255
+  },
+  "document_type": "default_capability_snapshot",
+  "qualification_record": "VALIDATION.md",
+  "contract_index": "README.md",
+  "collection_baselines": {
+    "ansible.windows": ">=3.8.0,<4.0.0"
+  }
+}
diff --git a/scripts/pyproject.toml b/scripts/pyproject.toml
index ca1118c..d829277 100644
--- a/scripts/pyproject.toml
+++ b/scripts/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "aim-inventory-manager"
-version = "2.2.2"
+version = "3.3.0rc8"
 description = "AIM - Ansible Inventory Manager"
 requires-python = ">=3.11"
 dependencies = [
@@ -14,6 +14,10 @@ dependencies = [
 
 [project.scripts]
 aim = "aim.__main__:main"
+aimctl = "aim.ctl:main"
 
 [tool.setuptools.packages.find]
 where = ["src"]
+
+[tool.setuptools.package-data]
+aim = ["integrations/ansible.cfg"]
diff --git a/scripts/src/aim/__init__.py b/scripts/src/aim/__init__.py
index ba51ced..5946603 100644
--- a/scripts/src/aim/__init__.py
+++ b/scripts/src/aim/__init__.py
@@ -1 +1 @@
-__version__ = "2.2.2"
+__version__ = "3.3.0rc8"
diff --git a/scripts/src/aim/__main__.py b/scripts/src/aim/__main__.py
index cd2070c..819107e 100644
--- a/scripts/src/aim/__main__.py
+++ b/scripts/src/aim/__main__.py
@@ -25,7 +25,7 @@ def main() -> None:
         try:
             app = App(no_clear=args.no_clear, plain=args.plain, live_output=args.live_output)
         except (AIMError, OSError, ValueError, YAMLError) as exc:
-            print(f'AIM startup error ({type(exc).__name__}). Check aim.yml and access permissions.', file=sys.stderr)
+            print(f'AIM startup error ({type(exc).__name__}). Check /etc/ansible/scripts/aim.yml and access permissions.', file=sys.stderr)
             raise SystemExit(1)
         try:
             raise SystemExit(app.run())
diff --git a/scripts/src/aim/__pycache__/__init__.cpython-313.pyc b/scripts/src/aim/__pycache__/__init__.cpython-313.pyc
deleted file mode 100644
index 9b6bb8f85c37089e1e11dea13bc59fbcdb9705ef..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 163
zcmey&%ge<81kYx!%n}3Ak3k$5V1zP0a{w7r8G;##7}6OvnW|Wg^nlP$lkpaJe0*7I
zQE_H|UVQvYhR-1Nw>0!qOOo{y^NKT*a#Hn+lZ!G7N{aQ1i-2O8x%%<(nR%Hd@$q^E
nmA5!-a`RJ4b5iY!*nk>AwiSaM^MRR>k?{tfXd`zK3y=!{4&x|C

diff --git a/scripts/src/aim/__pycache__/__main__.cpython-313.pyc b/scripts/src/aim/__pycache__/__main__.cpython-313.pyc
deleted file mode 100644
index 9c33233aa82e29553a0e684fd777be5afa24a97d..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 2629
zcma)8O>7%Q6rTODz5cJ$hBRqNwx*3^s2xx#kkC@1HiaalfEV-U!fI<zoNd<Q)$DGl
zEg?ln2*d>;K%@eRB2^*?4sha%L@RN08c<+qP9UV-BGLn*7v8MBagYEpiROLt&6_uG
z-kUex?RY$bp#65~vkOOq2>rqae&gGK+kO$i`$$0wH;ZOC%E=7#vpnTJDNw<aA{9Xj
zvw@i)4T4Tk5eLu(k%rDmN?_u7gft1EbD=ak*4aTuRldq+LpRwt%ehgFkh-nedYxEj
z*;rMVFtuQ)s^!iaPlTWs5aPBA(7%sLJ9CAO&pQNwH2AIXiZIR-R78cq?zuKrL?xgE
zOK|>nOQ55?5*ioef76$guo6+C|Dh2Bjrf0RBtRp%qY?J^?n*yOgj4n?DHc`2Lsa)D
zJ+q-1iGX*2_s)iAB1Du?=?;HoVZV>MGQE3#pv(K{7}rK5pzIq!B)H4kj$L1uMReEv
zKUgaUk9G1OqapY!3Tag23WHq>J_2^g$6X1m+#UHy=^YnHXb6?=^O<6(aMZ_L>Br4K
z6Xp)0B40}T8l^)%DvI}uA*7u|h)AW3&nkD6vOX?KzLmn=KG&5Ar1TvXN=JOAkoQqn
zD*MMFYh9m}e%~VI6xerCn&;-x31Jw`gP*1Q{gvQX9HGCh9Pn2v2=lwv>}060gM2Ih
zBUgcLu6&!>17}@9(`(J)$>}*cCr=VfKW|`pnk->r*J(qZ(}-5ZG|Ri9N$XWNTESMC
z>Lx4QW;mDYl&u@;fTqYSfqGCYGabtAdoz;Dk$SFdV2!#F3k+k`rVeh7%wlZHHl{V5
zXod`y>xOY&D=*6DvHc3hM6O}tSXrL3$IBHLuwgbsxtwWeI%(crw6Hv>oSL4N%L^KX
z4dD%u=j&89^qOwt%8q5L8PDYmeF^94j%_-2Gp*PZYc*Lj3>ja9b!_``y;jpmMQ-a*
zcC+DalHfp7l-4O=VbU}~gkPAPd&1+&o$K$VL4<xUd#u<^hsUZ@Y6zaCBFX{hrxkNq
z{_M?VV8B>JX;?O{O<mM&7B)+-5~t<{=BZZ07Ber)?&uh{%VSzQJ7etxSYs9iPOpur
zY7N4ns(G{FhC9KuvD?Sk{BfgR)(q>B{LaKauxX{BTSmVo_OI++S-Ld1o)~FKBilft
ztl&zduC|jE@FML-S?ttK?Dnz@Tee1R$CNRPj6B*L&F1A(3m7s79_1S~LuQfG%4KX>
zvdI!`vFF{&!->Ut-M}|lbZ)-JHay@;8m*cdwXmC*q*Vu!Za>9_)QxGCiVCwHM_Gj3
zh^NU&%T2J|@WnFrE~G`Fl0boxj-J;{lO`CEq7DSp$Tzf_k@q~NNydA@)(kgX#WssO
zz>qTi*fUdwIob~jls$R$08<S;sdx!@BhPAvgWEV@Qk~eYXg5skN~%g=7gcoyt6_m{
zy8>I$9=2Mb4slbnxN*L&(aJP|Tu{ffvtc*r9frChJC5hR=W^RWscuwMmN&}k9V*o{
zT>(yOv7(awMtj+$$g)iz1jr^W6T-WUZp3>x;)kxs53L?<op^aIt}dVXQH*SeeQRRh
zN_2Jln|)Uozj>*3QfV>jneJR{^<3-G1&`IcY<TrZ>xAyH7rJcn%UJ7F)ngZajHWiC
zgKN>j_2|&@=}j@SDGqIl_uNSKZX}1VCx@>DKTUj+SWk{EKmI$<2Qs&UC=h*P?zOr1
zMn1^DlfRt(UOckJM+5h6@nTs1si$|v{`l2PuYP&@>zS`+zB|3~#JM&2?|JFXQ(KY{
zK60aHa7Fp}xl7M|_`-TmrWMQlu@y$C{*N+OCRQ7*<oGt?!}5(-s<kikg}ADG9^M$8
zSR0*aWgc!lTyFJLzF#C8i_Y4jb3L}iY(4#Mt`!@;y%m6Ew{Jzzo`c(n>umGx*k!vF
zyJt%P;x_mlPQD#~EB@a62jm@cdEp0X>`&_fi2S#yk<%&k?L+-jhtbtk&s18tde_9%
zox-&{1Awokg{hP1+Tp&b<HEJ$9zK~lGXf>&7cqMSD7GC+T=8t3V7Ma@Rh@T$fxAWF
zGYHXP){U@^{SHy~IpdXvmww7#n$Hkr9|!HLAsw&PD~^F5p(lW2b!RahI0?sXqVz8)
n`7?_Dj3S%pz^&i_ckk8&5@T;R*M<I{MCtW2TLKaXJac~mgBw?R

diff --git a/scripts/src/aim/__pycache__/auth.cpython-313.pyc b/scripts/src/aim/__pycache__/auth.cpython-313.pyc
deleted file mode 100644
index 56328c52bb793481f1636ec4d8e8bf0cad952555..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 2050
zcmZ8i|8Epk5PxrX@7wlzRE{qd68gZZT!VKZ(1c1QP-_YlYtp3&+KZd*-n;9<-R?1O
zui6VSL=*H!#SrjUHL<9PCi(;Z%3lB>CS<{c#Aw2AXRb!0zc}yRo`p_w@6CMP%)FVo
zH?!TrL6ac;{@Km*KN^JmDuq5JVy4?h<{GhxMP~{0b_x__ZB{$2gU%$T&l;x_kYJ>&
z?<1CBB_`-FK`yzASgCQX=W9H62}yO9#<NU0F|PMuNLgk%Z4H!@hYc&ci<~zgQ=^5!
z$MSftK%-2>2_3iY2!TTS#HrU`0|?+O3dt%2ZSK3Vf3?M4Np}pzYottM%%E8m^yf+0
zC?_oKMLa1dk<%q-8IY<a3dtycq7^O&;I*C53;cO5TJ`X88Z{!b20^Q7`%Z&Ldd;ic
z#JJK?+E$2dN2YBzf=a8-k<Z%p#g<c-x+rb2?WzYNtb0E90|aytf<ztP4?=a3kf`T}
z(RSMw5^`-P48dD!g&fad03+z)k3^#-9=avR7v55xmxK#mGZZBOh<S~YgV7h8tB^uf
zwaCy#7MBmnqoMo<Z`{vhubhN!{o|*qMiG_NmB&w4&C<ZA=>;R&`c!??pYS+`>MFvy
zLIUJnFen!VZ;@QSuh6@AyA*f!7pW%XgS$c^Bi++bhZ)48B=E2WzT1xtF(Q+b|8RE>
z(Q9N6S(K=v`S`W<Wx4Mo3uHXD_vr$imo?c$zP_lsLBjJgg-x`N^xy9jdNT4&w4rxU
zdqQ()lNyQ}nir^VoI89JBXqD(i!wV!ma#x4wH&b$3p%dJLy3MCoG!|eDmtfIsR?bA
z>?MoX#XU+9X9pp^_Jl7Q`_c~SeJ=|d*DT%FPH0tHC9misq)H3v_RsVDV#@>08oaT@
zK`eVs=J_mK=FAQJs#j|PudsUHI`z_=WxWJk1oah!RDTpr^DJsAo;93Rw!~Qzf)%fV
z8cVA^J684TTpVDQWlbMo?|A-_=T{D}0GNXfvCM&?V>32`BAY@`1%Qytg+Py9!+}*c
zb7~q*DonJR%{p&zKa{AtTrdZ7aF@Azfme!Vdn`_?!f<%R@wq{(USW8pjIy7{%dCB<
z$X=C(GK`W8vJ}UtE|ZmzKKj*A4P2aS@0K9+iYGQzubpK3Ww7ldg(7=1XaRFu02nV5
zm=8`GRtdOJp)5Nq9FujzI7r70y%k<8XdoK`<TEXpIDw!UrE5H_0Zy4HJ<C^BGpfFd
zk~Oe#L`7O4kVhrtQ@C@<WRw-oGNC2}_N?l(geqI4^LO1S8>dlGUIuz0NM5K;Ws*R)
zaWouj+REDAcrzf!>Q?-TA8@%$I@x3*|8OXOJ$p5K<E?u``#(x_a%9`H*C#)jynN<i
ze*5)_s}r9d{ZjkN{M`H^duQvhZ{fR3Utjv>J!CJ>K1${9rCxZLWA}4~wXvIfzF)aj
zzx8&9&@*(J;x;%<ySl!`><~R;uA3w~vNm>iVCIf7^Y{7)$!_Zs1Fx6nM{e!<DTfv_
z^tduS9vddfP`;DWGx>izI_mx-<Pds)$CN>C8|KugemnQf)QEn2B!PUvgxz=wBe+BZ
z|9_ge06CYU9FF25){!^mM?`>Z%-%>=gH28YRUS1oH)dj#p6q==j)DAc$&n@Iap~xk
z(g(zRKr+9Oy}yy?{zwvS;N#J|bmw21Mh80tm#$8<;f@s7O-eI2hSv#ho%Bw6lCI@D
OMDBMEPXDPGb?1M9SnL4+

diff --git a/scripts/src/aim/__pycache__/config.cpython-313.pyc b/scripts/src/aim/__pycache__/config.cpython-313.pyc
deleted file mode 100644
index 39aed3d5a391668e8702ea1a11a401137cdc9603..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 9174
zcmc&)du$s=df(+P-xMi{67`l=Z_(Dvkz`4J#j@o`^t8F6?O0A(id@OG$R%%fX-mpE
z=l@Q=`@{BK1ItKID@A~lfdkF~t~do~ksi=1d}vZEv%ZqqD1i^{wYdM3ItLd{|L8YM
zElDv_>_h+P2%4Sw=9_Q6nfYes`_1raL4k#U@E`XcT#1zv#J}N;7WC-^`SeGSc$;7e
zmK-HUNJKI?tsB*iP>33#5v}H_Q9aTFof<VD1AOUG<A@2F)H403dBlP&YT7Vr9kC&s
znl_FWjM$MK(kA5SB3ScT5*1#e%83SowNw(UwNIDUp)dU*P|+Oaw*3+3+@xal^L$kF
zi=iklxOIv-=okHguwM`q{cMN}2Pc4sKI0cJ<L~Q3<74nGJ|5*~LvwMYRy%=E6alru
zAB%+-eGxzJpW}kQ7>6PuLBMjCS_E{}7vyFHKQDx4!d&-0pFbE0@xsxWkT@Gf5e{{R
z{k)r2^x+U6Ur>zKLVPfKO;F52G<G>EEX)atF*Yl3yubyv`k{X4bcTG|M&j|kL?DtS
zkd7r0)l6KXVGMMAP=W)DEOp7i(yfqY^~lH?AZNt6OD1Gib0#%sfm&u5Im;l4tgIEd
zY-*hXWMl1+bEvsORG{XH)Lb#Ls}h`Qt^_&MT<KP>P|dk;PSvR_qf?QpQ+cMOB2!YV
zmQ<=GPPU${swA$^nK>-EglW~=Xr-52Yy;cK)?(@vGQ(TOHnDY>hRRt6Rm|16n-xQP
z3jbIHDlOT%I5E(*H8;orB*lcHQPCF+p(VR;HQ<|>?bs?-C_zMuP2kYgP=NErA)(k2
z_q})s!KBZjXgs!Uf+&y%|Kw8!5^odJTa!T$(_3aq5L%a;hzH~Z*dQGa38GRoeB$Jg
zcWlacW^8Ec<fLbueLy?~8HCc3t8SMNK%tl@bO{K$5Q=mKRNL%~Eh?r%VSi*M=s%)3
z(!K4}2rdvK;6;0b_&f3Ou=nw+=TIeN!HOM0Zq^?Ui@sTZK#ZcrB{SA$8an-k;)sR)
zs=227DNHH!Of(u+9PyAZ5a#^I2g-09e^N04#V-UxA;lPoMq(gJF#{<Y7h`czArx2O
zG8dSS%==)e@S<<VFThZuuu{66ew9Ob0X^T|V-yW@Lf1CVuGtXKl<I9nA7=EaC3q&E
z*Qw*Cu|%SL2s#+z=djjz2$kC1%dmhzX6|69@a*NxtC#QqAwRHWhm|0j2)AxRv4;4o
z&{t@Y6CRKV8{PxhQUoqMD`3G4s)AT4(AXAnlS;|f%x$CA1EYWi+#sGfoVTvuyuNZh
z;b@mk?dmN4pY&WZf)RBtM#88Q8bDpRsT}pJY4h^MU`N#U!Ok37^S4!7OgP#kQ=6*V
zL?C1Jz*qwR>KHZ{@!IghmaQ#XUgsqblWo9&L(m4}LwI#NjWJJpNe^CSc|ntukpV4x
zbxlMqF}-yt!8S;;x<QhsKmurxA6SZ|2T2{l(_YGB&MyUNw6=0{G=)|eqMP9HF$RCy
z;lmKqU<v7PUOx@}Ne8Vwqa|=nJG4?(ueHFD(|E$wFzwV*UcIMOOJ~2V0Y(Zh@w}k5
zrODL3yy1lsjUW+@_WY19(SuDmFKF|?8(-Lp30kSns}9*es}<8OV`2u`wY$r966ef<
zu8R<KPU7?-g5b?L+M2bI`mX+EW)Li3yb)$GJ4-KB|BP<@2tioEdUy+O_8K$twp)Zn
z(}g3wrd@cfIXsqKcx*X5J6lmfcV^^wuy1SDp1szWwr6{`)tvFM?r6mhwlII@d7Ib9
z79E8B$iID5inDTAC(K|s%wWNV&kw?c2l0HsS(nxK!r$W!V4BgaL2E@DDZe&@*>zar
zEwB@8X%Cfc2hY?lw&wcIk+Wwt@!DT{<T5T3%scFp7v{Vsuf@Cb$d$7dTAy~|sAQ`$
z9JZX9u<tk%)ohK%t@Z!AR>BMA)&80CcG~%N*0hdg@-@{o-f{ojSxP<Iu$vUNanRaC
z)D!K5W-URm##tRh)PX%P#3|jxpAJ)X#4ITQP0;b?S>T>-&}_{}_{+dH9n<)rR0G@O
zCBe3uy$(CklQ~hm4o=4c-;iULoF&o{-7OQ~FZgFUaMLJpG4@;^7iT*Lz>6?(d>|SG
zS7ynbK8v@Y34^^@CK4A!W`<+@48|`^1aJzlsvZc!n-s$5Fsg%SsW#WIO;-eTge!BA
zn7FvaZ1;3`;ONTp5z{Q7mFN%gj9+BHPXu+MJjbZcvZ9NJmP+EG94)sLR19f%5y56k
z9Dy}SV9yv_LY!Z!kB2(b<(ZmWo+cAT4CVt*+Lr5;Dtgr;U811ok}Fe7L~#yRne~SS
zPO(NnO_AgMe1Kc3$;o8+{h0xL74(=wM<G6mS|CPvP7wwy$c-axA!sj-_CVye?lj`4
z9+zYDKutJO<zz+R+DqWQ$HPGePeeHC4>Hen2N<^#^+K6q;1<9=7Z7$|6gnE?co-yL
zQY;|>@TG|Rq0qq)IN+9Z{&1XA(W;7ZP%*AU&2eH@F+~rKekhi;2*h9}^NEE37sD7C
znIP{jRH#5$P-xW)G;SdVg<kYW!ioVTaQ+B13P@U^u?1$WOd%IkLql-H66i3NZ4@|B
z#P&FZa}>7_5DFp1<OS6`Mkg?j^>`ZM;C|wP7AzEYg@0dM`qSoRW6I%7I`-VYmMq(o
zDBH74L;lvAH{Zlwa>`k`Jh7>3HBXWo&a#!031{Q-aH^>EZpEF7)l;`C5=HF~4XLuK
zyNh=gS6y;hTe7Tk?bvPl8ATL#{JXPeCHVeu(&<h(-5V}OsvnbG<5J-`h<cY=8NPq|
z-s#ng56hDKh7$XR<mzK``El7fyga;7Rl6eIU%0ohW?wfZ2gVWuV{+ZNTs4ubno3kn
z$yMi;$2Mx1)sml;zgI5pIk0{zdB~GE<dN%Hxn?R^b1_kKQLeePJdx@@_^X8v7NnzR
zCH7*Hy^>(BJno;DYv1~`fBs?p<0z5@QI5uw(Ki#(H<Qup@4WS{u)6P^tM|Wu@B4rK
zR-%7?c~Yu<>q}>ys{N4cIwln!`_fsjW{=CRVX1KVOJ{?c^~f$(DrE8Cl;0^|X<F6E
zMUBZK_bOUGwgDqC^L|s(*_v>+s@(muYd|U-*eESuDZcNz=UO$bx#fypxwLQjWXe%0
z)pW~_Zk2ObcAbz4Pkdh0d)o-p@%G`LS3W%U!RSAhB;6-v_sNaQrd46Bf6XoRye2h|
z$d#i~$>>*lqPlO>KvdP;Z@bsFdiY_3T-lebJh)!GJc@Oh|9NlH*`08vTR1AahNQxw
z&z!DQMa`qy6w{Sr8h&PY&#?N|Ls4c9r7Ega6^(19az)qr{*Bf>YX^Vv>VsFMgRJB|
zFYmn|x4xci^(9(;a;tx%#l5!o7hMm!qysSOUU|<sx#fJa<&8wk8*+<pqhsGM8z0X9
zD*8cGIvLy~h&ggn_mm*|&)~S{ERH)px{a=$Umjn#e&qPjA)USqZ1dz8E*c!iao+@v
zyC-#D6`4!yn}oT*{;UrS?q7@A|L4E#MBNX_|Ni;_QCRVmAhF>VH?98Qq4;oi{n)y&
z&PmO~a`A~rJ(6wWn@tKcJQvQun)uuD@ebnG1y$oN>ep?@D<Sh6UBh@A{hPKLi2q4{
ztQAO)x=SJct$El6pHEzt@n+*EOaV@JSSIY$C;i0}X6j$edPr}>lz0z-B}YD8fx8ln
z+jhcbJ7F@wTNrWam>dk2!3R+0CBq;$9Y88>Cog!w@5>LG1iatk;D@V>U1}GkIdWsI
z_9V$tfI4*<DGW#<JsBS`TL+Lt#v{p6+05Ckc^s1@;6TbtVa$tDIerl}jn7;)Xr6}F
zZV-F6;3K3%E&>D;TA|Ui-{}nI+Ib!{ZJ=}qYz5REP!Uj>Yztb7H4M_=^HQEhjgtMc
z#;niF(>Xn*U%ICzO;hl2>79BCTH!M?F8~!Ent1`J+JNSiu;xK(*B)4MdZ5qgf&Qg?
zkc+$YyYv9N0(k*+ZO<b?cH6w-yO_M7jn+24?mQ;QYJ98>&))Pa8ixn_4|xGDehWaG
zJSxtz_CZ}7>^L?z-LDmUjhbxU1h*;!8r^e1OJ%<egcmN3S(+^zq~J!y3@Zzt{(0fT
zptc%dmdqaPVC4mEwL(v_?H$cyf-JOW_8k8<U8}EY4$lS@{>y3i|6|{=T=<&<*S1h?
zcI_8wTEguQ_I%WE;l@rYHmiTmxSZ7LWWRtMZ|t<MX6x4yUXy1uTSH61&RsG{GQ=FU
zJNlWppGGQxcus5e0P%p2%Ug5yv|_L^lUAPn0t#|^t=mwL6;KexTZgP!6jc8L{W55&
zbm`PMhvqnDo{wJRnJqU{ILO2hhhYxK0APr~m8`({`5+VL(|iFyOHp``Vf?{hNPQOS
zoB}9ejQJ7f1+0ZVZeMhM0u6%hOYJ9c9voN@m-8x=hF&2-b=xzT!A)m<?Hnf?d&5h6
zGJ*gNZI|^eF%-gU10BT?UPr3)ywsDCkPBR1Ad21*bJ#lJ8n`1}wFA0ufI*uLEhrSe
zlqRnsyu_FGAK%vFz-2!VFJBC|AaaQJhr^2p0WYeMWrl-SE{+lWS20M<0W?727<3Gz
z0jRa84`y&7ADwr%r~{?wBlFN=8s0dxiSvCg9u+x3ML-BIa>W9WBj}r1#8ed{7=j!i
zVh-UYfKK5E8=PW@#{iaaD)h;s5*3mt7O;>lDDx7iOfiW7iSgrtVvNiSIFo)k(nSTu
zFdIxmv0ywBgNMX$T(}G$VUZ6&8PwsU2wx~GM#KSL28d>yWL0Da8uIW2IPbP0yqBX%
z%w>W{gSillC_0O2Dt1!Ql5RGr(7Zpw!F>R<j~zdFaET*qsmKdC0bexdA}JL{;ah~O
zfOXT;*NHP1F!Ot`!NZe+$#$#YW<k<al`vJU4nORbaB5(~;r#JcfKzpi%k*PYb*gtD
z**l!*9ZvR+CVEGcz2k}A@!Q~tHv+0kIy)22&d1Jfi9Nq;`f~q~W%1VH&Bc}S`*ru~
z*2?6HeUBZl{KGMjW_8>=lya5=N^(@JG`&wJ9nA?xGdQ_YGb<NQNw%pJsAIipeU}A*
zRP$bqT+_84Odgp`9GOftwk8|*CmQ!ZqLZgDB~D-3qzH4#SKuc91^J|)=$7xMZ)Ixr
z6}g~gS%<|pyc<k98WWC2Rs31G*dy6IDU;=v`KEbAOxE=z>U!3DKRW#3Vd<<ldDfRW
z>svM_On;ejRo;!>iLOQ-0xB9<wqjX(-xrgPc6fAAWnGkurzP8T%H&L%DifwkRkI_B
z#v`eQmSn@BM8lyCcl+8@vST9AF(JDrH}-a}iODWcqRS)iWjD=)x#}xIZ?=4GBTA}a
z2tRc;t{qtyKf3<m^@MZ$rU~@77vJvv@s(w2Q&(Va+bDA0t@ugB$}20v+WAk5`qo{k
z!jik@JLZ+9$Azt_Lf2i}9ot{oHwugIntozhaow-ESMyHY<3jf{BT>A6(?kp$O7@>h
z^q)%hPbB&$lKp2A{bz0mldhJ8t0n2$mvHTS?CO!uU0gnua=2s%V8S-Z?U!9MQsK;o
zt$8(&+<PRk_sC=0s~a}^t&ty%+!m76?TPC4-`P4qd_m!@k((o{P0J&n+FGAgK%2iS
z>ig#FVxq7NqnK$8#iW&x_Md*Fd(`u&S!zBb7oU~RUzBVYRWvhAegn8~o3!Tw+>#TI
zXxEs9cvLxL7#*a3%N#R7?w<!OV@Bi0lo8S&TP$OJ)W;>&W8Kup-Flqvqs9h^j|Ymz
z%@o3JG~Uz@C&m$<z74?-Ca^t^!)M8gAN-l`GZS!4g|1?XsWrV=THQL8pwPI?U8$IS
zKD+>ZKE>kmMWVqtJURLln-BIVe|W3J;e%I5B#5xEVdeXL=>{=|P@pL12MAE)#8j8|
z_Uk!u*87_0#IWy_XVQBnePZZ=BYlbT;=3co6hp8RA#oAy!`0L~BdhxRh6pEKjt14;
z5{bCcQlAg*i^NdC=NI7;XeJJuDJX=;N`1Ra-@srzgm8q_7e0aLhs5toD^@z?QumG1
z%R!lTr^?%IjNNXO>9$m5_l=3$$7Q<vv-*}q|G7l{`5TkBUzh3gPpTP6P02KqDy>Y{
zt4x*F-gs?Ukm=ed4NVeVxdIiNQuU1zU9r+5(~Y0GJEYEYvirP5GpkJ?<g>k9QukST
zuScRAR)=NU^F&|pR7dJNo>GLtzKK&{J_b9cxid63rWO53*RG!=F|lY<O+LFsy7lQ-
zO0|FPVmza>aj+1WQG{`+V$J+I1kM>6C`g@*S)2-D2JjNZ%i+*W`Y5oXIG9Gb6W@!a
zk1#uaT!kyH^ktfmK9n4onDcWH^=LrXu~7WxrfQQn4e+*~wzVVZhrmL@zkts@xB?)_
zFNlW!B-%bF%%2mEFNpF#5Y>MmI=&$Ko>UA;gi9$oDiK9620H6AU6dr-HVGWVNa(Cz
JsRVVl{}+Zbgi`<j

diff --git a/scripts/src/aim/__pycache__/exceptions.cpython-313.pyc b/scripts/src/aim/__pycache__/exceptions.cpython-313.pyc
deleted file mode 100644
index 11392c4992cf56b6c781e7fb93fdebaa233ecf10..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 2358
zcmb7_OK;Oa5XaYfv`(9}=?hX2$h?Gt)CLJ5A%PH3wQ4DZLj>YbY2`ZGU~qQB?ix~V
zTo6Yt73CxJD@ELpka9z6xwA8FVyloM`!L@9&3OLf@p|{LRGJ{>`uXkP^~Ve$KVUMr
z^2dY2qD9CasgTR0LC%qewMA}cBcHU8W(>`4SwosZnlm(?pjo72hK?s_4ykQuAwly<
zCk&lT&@rS%LrV!dj&#b<=>)ZrmJOXr&;rs~L+2870_nV=3kf=j^o*fr6SUZ>R2RKL
zkKk^)gV$lj-1f*8kyeAqOv94dMn>iuS($I;s`;M%aO3H!ltT95i4RvExr#Yn;40<p
z2<fnHhk2Sc9TVm-h*Qf4q<%2gvnl0nn^D@EptLQTVF2SIrEfzwIQC3ay5mcw1D`W4
zjC-8Yrtr*Qfl{Si?R(VKTKe0eW{Oe?U-uB|?%k*{?bTea{Oy3%lqda;Ry8FJ^V>Dn
z^;k#yf~)1uu7vN723|oyj!)!!Zb_B~{NJ6KH}1bX)5=zJy{VN@Y0+kKwd*Ub`j8Wg
zs~_a$I81CX1u(EyWf2TUq39G$%L9XN6_wS?*-=^GOkGxaP*z>&H4*Y=A1i>=bvX-i
zCrVfV1_tBiV21SpO08a87fKJ6G0$jaSauQ&#>L8jQY)7?_&Yc7o94#27IL>g1L;Sr
zp9eP>jEmI)rB<IA%B~2$6ZoF)V_!$hUj%tD7#GU}N-aM<lz$?;H>}xTgzTfmFM%5j
z#>L`*Qj0IFb~TgS4OT?E?egZD>j$QU3#XTG72IGjE-nF3>JrK?;M1GELhxgCe8bTV
zxDM)IFfLXHlv;g0R^Q;BXm<jpS^pYHjIQ7YxWQmtTmhie70kk_^IM_B7DRh>^>qCu
zaD&0PSRc^8_5X89%s%U|NPorU9t&U%K(Y@Ho+~CDZvY+r%A6jdl;$^e#Ne5`j$}HN
z+|k1EwQ|IJ?(>$@W;|Rz?&26!3=NI;C)_`8!W0ZB4Y&2jQ3UXMwbU!D4vvE87=V2h
zcRbvDa1X#g5&sBWlejeS>tKse;e>S0z89Tn_vI~<&jS6g#{9}!mUWb|tmV(UN5tHY
xY|AQqc?sh}H0~zGcM{_S-?tO|RXpBbkH=q<@rgY9m0`@LwO{#dgf}hh$R8?1r)B^E

diff --git a/scripts/src/aim/__pycache__/external.cpython-313.pyc b/scripts/src/aim/__pycache__/external.cpython-313.pyc
deleted file mode 100644
index 444a78a279869b627717ab201a07c1ec507d0292..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 5730
zcmc&&YfK#16}~gG?>Crb!Px9TaN@OiqzR6LUzh-Pco@43Yr7`ZcGw;8m}O>tXU4`T
zYDxQ}IE`wjO%z*66St~VN3E)~i4^xARvamRDlMiFWK1kqO<Uz3E>;>j`O$Ol&dvg*
zY5J=d_Rg6z=bZaG=X_^oB^dM}Xn(u%=IMnHLVqDQ#pW##%*vNQyo>}SFny?(!3<Am
zwvX-QFh^;w&(Z6|PD(raT-XKA9er->rdJR4(5n}F;p*)3_4=`&%DVajy+ItLw7W0V
z8^+<@2#)aR8D~8bJc2{;wz0VE8BXwRMmw!};c_7=R0{sh=(OWBgEt8=AwXzcAq0g`
zGb2<9Vfu{4Q6aJ!;YzR*wEoI~E*Ca6duq{F{R!1Vg=Hf)=16S*l#HEVOuwiosxIoX
zs%UT<N~?-4P3jY(B92KIIKIvT=a`5G;MQ?e)K9_HBS>cqNl8ly){J&f>JnDOY^OQ_
zikX9=oRu<W`H`H2spU=)1ha%!DasQmuusKPIV@=sj7P?CXQWZl$m(gv+7)tf!tWu3
zn3dNl!NZ{q6FzN&T#+hWlW3=<uQ0W6yl2tN48K~3SX|eVOi_nNV@%!uAU%rqad9-t
z?BYh51Uq%8N6~aKo8_%_(Y5oi3A~ugW#x3?-rC_t9`>D=6@J9fWJS_6-r94mc_6`=
zzS8EHoF?g}lkAlayY01i&2;MOxTI(-EQsgL?Jbg?ZV?qt9?42AS{lnaU2D-W@Z^b>
z;-)v}&YRKVO>q!9GrS4xl)+DHgYHu_jqbZpFm`d^!ocOW`M|d6?q!y9^0z&~Pdw!d
zo~k)d)#d1ip7`f4_*UJ0sa1pa_bWSs%oWGu=x2m@JJ#XjZumGL*Bq}4B;gR5mAgQ^
zjFM>BK77GGlvM{#7P_w0+flSimn|M>i$h_O%qH}7JwghbWYb{bum?e;B-z0YT%j0|
z+pSSV2Lefr<xvAV+<=fDfisonXphr?z-`ECXmcZ?$D=qpydR;WlO(u-sle(ZGMScy
z0~0ONaY~(#OqZ;sGBP&ZM}%&SRSa%G4trF>7(&OFhR~8TqAqEsw?va5;CUXG6FWZe
zKREnU`dkKY0Y(k{v@_66qs8)?*M_b(&u{(4JFV}w{l4w(JvSY*!h7C)S?_f3?Pz?)
zyXdc&^KbbmP_fK9yk(2ws)cZTE*xJ7*Ug3N7GwOa2!D@5k@|aHRLS3upg`mj_oKGF
zqvG@XP85l)AjVr}1|rKGTpwt}k>0KBh_g51zK$m6jYbCgHK$KzPEY?aAl3x-hUZ)g
zZ2|Q&4d_i~0HVRAoicPeYdX)JlG7wHxzmLtq>*E?wx!JCrNpz4n#c}ea0o<BS*wI@
z8ZG(DF7ADP?`8MApTFkF`y2C)#ua#i4uVPN7*>s(J$GW5_zs=>ewZuq+(Fwbh*qH$
zy=erVjX^p}GPYlJAvA2SauB>_eG}N-ClC@JT_b0ESV_8`j13;Wz710pB;3Kk`ez93
zw8rMqkqGFAH;}McJh4yCa$OTR!O_N836uC9ZG#m>s&s{DP)IcVpH@%KcU@bzdXlf!
zwc^SBr`4C9$Khm$Hy71mt&l{&o|c^#oKpt}B{9c~JVbQ?Cwa?Z_wX5&;zT+NIh@y3
z-cW#ZPQ~NAs_<BvP<4sd&TG0f0k~m0bE+m!eo7*Xgn}+lNUEVHLZ&09X0s-%YNkUG
zNvau_v)SC3$>rn>#E?7&=xw@%o<l?3gNIEoK=OpFK&mkv=R{eDykd;xu$l&#GDAZJ
ztKE}1ndBv+)z{PCZ#sxgv;1g5u3uHhja(s*v8LP7#tkqv3$O|)E1>CW4seJX$4|oJ
zMk4YSbkpdrJM_b6pL_NP-<@;UEqX%BY|t6I<Bz;F_{#AYk6(4qM;}=Vgf8|x-*ai~
zmGKwHfBD3(_WykUhk?iL1~x4Ow$25%{wWY&^n@=4E(9)rb0%;Lz-q}KUGO)|`5RV{
z^J^Qs*ngq_g#pXbk3&oTt&r`UF`EH7&l!6_k?*CB9UblHMtetl*B0(3swRC613keW
zyV=NhA6WlA_YK=vRmy^`%%c!fUCa}V!cshQ+tzKO=%)sZooii%q#I<6dbH6ffRlD6
zvCX0rtvjupH5@E*lQtR>v;;id@QLm9%+%9eg^G{2ye-R*NT<ZJvWgp_E=p&OjI50D
z;Dz#8iO-3e25z5ekutKbVh{i=F-_{$=7bv)2r->U)tsc5j;yTdrk{k6p^&OeG9#Vp
zL@q1oQpWO5(}yM9z)D)pNYv>PPSYXcF%2T)9J%6M#G*^nGY~-Z3Mj0RV*s!%!mV4H
zl+p%Fq!aiD;HRaan?|36sun`Ew?ehA=~ug6otg`^UONWe^r2<e>8xF><`=3P=c*g$
ztD7%`W?W0*>V@!*Tj3qQX?@G_>)mgiTiDezx2xxaC+5Q^p#t+pFCG8Tv-R^A0`&So
z^TQaw*xRuK-PjTA*u@RO#0_0dcuWppA1Zh;2P>0OFz*~pJ**iyQZZ^NYc00G2KTT=
z(?RNglarLQrrVHH6R<-z^bxlqKMH+!!KncH*zLd|EdvgibQJGI0EHxH-@&9;6;5_>
zCoxG1!&HB*jO|VmGfWa1ZKYa0=@PhRR`Dj?BjAcB&I^u5K%z7ou?g<H8x?t_LTy9f
zv_W>Gr-HMM1<>5NYMlUiUu`kz6<lO)M>en84}ghPS{sB|Q7h@R_i(L_r?4Zdd(d%{
zk!sPf4f<aN?uswzv#mb_`{jcqV1s=r)tvarKD%_uz$x)?&Z{`!2f%TjcvA4RIUCS0
z%(Ku=c#BX=6M|hF08B!1;L&ibC@FZ0CA)wmcDSm@2T71o{KKS@rA_c9k>DqR7($QR
zK9clHtN?Ny{!wO_RKB!<HbC<l?LbLe2qyht!%-Z0wGBH>g$AbD)<zT$WjMbssCW@e
z{Dh$!@b-6}mnI>3X^^$1;vEXyL4p8yEn+$^YXID53<91B7I(u;aWCompaVt+p`Rk1
zO(i&dkT4FBt{=LoL*4&ol_W%L<RHg2^LDx`mI$<BfPu+7Cx%i$%J3s%dc1jR%b+zC
zdwN7<RE0WYH;>_D(NuY-YGgB1)yjAL6uX;GgiYTuF>6Q^<LT>$=`wQU1*MRV9Y=eP
zcAM_5?qdVV{(em0z~sgx9q%E_=p?sgebV_6Rm7Q|;_NZ`Mq`#8gf9pKs(z5nqhO!7
zJ0^aS2;g=?(~T=_%hQC{Lppmi=~m$bgcpGha@u5CBY{CvxYb!z2sRY^y97Q4GUPP0
zE{3G@&wR)md%gL$>QbmGUp+J*O6EPuJN_`e-8~=LllSadipH;UKTTcB%mp8xKDg-i
zJ@>uEs+t+&Lhz0|3Z=`%;Dz98C*Me2NxgIO-PG?=Gr?P)?mOPtQq8tE+OM?FxMn7A
zd8+PstAMdk(==DpL|E{O4eG08fU(T_okPr0MeQpCFAmICG|YJK_$xlzv<2So8eTnl
zt#aW2&JTWv^clR^wD%szR2*TJ5fePZd=jp_q|b*N@}35$gSL<w<}9-m;`4Q<=R@Q9
zGe+KHSp4I_e<=U(Q?sofFgJG1Ch`sa^P$6e;aJ{t?29FTInjk#5Sb^hS6mnW5WDW3
zEuZb2-I;IbnGf~mj|zE@@C7N1hL{K14%p520{gn6=%&v{`e?kniM!ca-tFSvcLjld
ze^a!3JNN!}C(yVS#NpkTROS!-<ckykEI*(sP`4Ifo4z%JKphCc=Mf!acv*ti=n+-T
zCR`M|ry`}AwV4(MwD!a&LC}&W784cJo2G)r?^(lO?b`+CI!;8XhfyUOeUzfUMk(rW
zl%ifoDdIU((TtqdiLFMS7_{bJ@W^i!r!ZBsYL0fyS|v)N3O)j*Mj@#Hn5Qs-K==kw
z_!yU!M=&YCNR<PTGpU~yv4%-f#AK&&oOI2kqlJ+>2U|#V2)3Cn{d^88E9@pWA$YH7
zhPaS&^b;VaVMbz*#w-0KL_?dtFw;tjMlKDJHxUNVK!phM?1f6f$V&Th8h8*lNc$sn
z-~bHsF{=M7+6Mh?<h_l8^uO$5RP`~c`8(?Rb1;^#dh~k3T(EuGx9mb}<R0r{_!SPQ
zWkP*c?qj0&H#1DrvIp(&Wd4cDnAktIdzjkgO0=(oS=`<<YmiP_tgWA|SmYnR=Z!N%
z%wpZPWsVXDx(dWy;5Z5AZhL2efbpufEV~I0$Q|t#=|MHM%hU)A*?5TgjM8+u{{m)7
B$i@Hw

diff --git a/scripts/src/aim/__pycache__/locking.cpython-313.pyc b/scripts/src/aim/__pycache__/locking.cpython-313.pyc
deleted file mode 100644
index c4d03bfd4a0112b6794a0da306a41a0bca4dc7e8..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 4953
zcmdTITWl29_0D784=?r_8yoBa6Ne44U2JH1naE%qjLjPF#32cV(Rz2*p0GRP+?j=#
ziYV$w1yv$&CFIab#Zf;}q)6eTKanD(f#87D53e9vXG)|<Q7ffiTZ{yPpPn=OV7*xr
zHOfz}<#QkB+%xCid!D=G^SKGMe_y)t`gJEE-{Pd$`22ub8iv6|A`+1qA_p1D2smbk
zSjt*GM>*)ZA^xC^+AJJDWIyPj4uLe14Memx5z)Sl&2yv92{z>T4ksbT^h8xvGopr~
zsd^aZ{NboE34P6=dQw&mjZP11u@iDUmfxI*1y0P;c9>rzzb2Fs3CO~L94zHUm&i4d
z*Li9a`6fc`_<iaS-J;!Eb&3w^nsA0Zrf=CtzQc=%vJ4?%P3;&@!gm#QLWsssDmus^
z;DV6QsGzB`5KHTZmXfKU6y@x6yI-1=3sg!{78G5ea!NZX$AxIZ08#_cQ&cnLm;r0r
zluWI23#TS!RZulS0|F}a4IXj>RZP}(VKS-<(byYlg~A5K=oI>pfrT<Aqec;@TdXbl
z6xAB1<fv*WDcP-^QgtDgglT$8&=M9hfznwYRSdmMj+mC3O3H?;ce-PRE4J<%#~dNd
z(oXBT$C!w<yc~#3hlh|cl7#!qHxXwgJ`*IwhEKaXqe`k1B@J<=eJV=fjZJ<E-rRIZ
zx<Tb=D#V(+E+-SFt8}$GauEdc*)G|LbwyQO8BfYxdW<SlhTf%9SW{A6g$L`Lnl_!1
zq^OD^N#^QhPuy8tuLXvBGk~|rVsKqHxG@vlIQN@Ou=_0kj%%@@`7HmgcL|RXD;)<W
zHu$$L;y<u@5sp{wA|j<D<Nkb$;LeIBGVsUlV1<?VI4U;4ROCcnwC!NwVhgrONDDb?
zSuj#Zyx-rm0r`VvSGGt^<q9F&3QJ`i1K+1A!{R+wv<{HFXzO^kjbuGJ8Y~hyNK_<5
zWmb@>p-A_nFUo{|rTpAS*A!_)`~UG0O~qYLdOzu5w-w%bjFG{osZ1Y}U=pO4Yb6OL
z<Osh6TItBEt8O~wHx=EGv=fim=;lYZw2|o8euaT$HKxVEWt`qqQaW@3u{1?BPfiQt
zGCGtL5G52a=<#VG3eK-!^hL|wDTMqKOo>o@R@0U`5m%_mgS${EKCfv@#DE)gsPLv8
zty$Gf$MDF$A!+|Bg+X|)S+lob5rZT9Db=WHizPK(rl^Z1uSQdHh^0Q9aPph6f{jts
z3ezP?AhArrfEr3?8HUe+0TmFdflj{$04&JqJ?}c_$~qe}&c>{>CF5+FGp@!LaI_1I
zX?A*MdiJfEx8~wkk6d_bp`jOy%$s8!u7<nbRp*C(KlC1d*?Y;GZQPt`+<d#S<HPhv
zXRe(2B>m}`kI!VfhVOU}<@_WNJnMOQ-$w$iOT^}CSo8+Y51$*(dRsEymOEZyvAOkZ
z|2xBXYu7K<9$pw7%Z|R58GS7~8qJJGv!jX3Xky{;#6n<liDT>h-_)(n*;rr0<D3In
zJ<?GpKC|`t_tukZ_3nM$+_ly||Gp0HdWQ`rv686)8ICO%@CXJgxq$KGgd8oofk^p&
z*oDn9%KUH{j8rlDq5+g~tYXgPCRf!hp-NS>BIkl>m9St=s23IO2{rg~CLD5D>PXiD
z8C{2<1wcXl#=>+1&elkU*dwLYv@XXbR7nX{HpJ(34~!`$8PgC9H{u4?7}xQ>1Za6(
z1YZvJR@Im1*V}+x4+8*A^wgZ+eQtNg)AlsYy5sF#L481zv(EO6v;9lwCW^jonftfH
zLf-v@gcrf_uHbfnrm~@{7r7m*%Cw-vMow0%=9ob@n8;IJt88}_cVC9}7r*kPU+$bi
zlExw~QpGX;kR(N?sX{=is&l9o6|Ja6DmTVPP-7|@tO^xNFx|?IaaF0g>eM@5fm99x
z#0qku%2YJbCfau}!cX}+Rf1!gl`@g12D=F!!X{dR)gWwwRtcn)Oz_391o%>L20WY?
z@jsz<JyrgZKt)(D$Tw1w5489PPFQx5@{|6&Pg0)h6z(Ma;K@mUKJQbMIpjD!5U~mw
zNLK_U4#fj{aUowuD8{6gHlPfGbRi*AOmI%YTD8oklVZ|9Q7I_;9muK})16Xu9d<!F
z6{^kWJ(!o9s|FxQgf(M8ORI4!f2oKxv=#XX2-YLm1i*BRh<REo`mmY~X_5}*C6p8h
z?U1&`<&##gK+<GSt4T#YQH(`^#tOuAB;rtv0KE$<6Kl9UDA5pp?AeOcXr)m191!dO
zfCTexlH)m7-D3Tk*;i*?ojpEte6IiMuPz*4sNZ#VAZM?2HRo8)*KjvbKkNB}=e>c;
zhb|rZ)5wQoA04}L?31xik9~YB({b=lU?}J0fvRck<xPLwH22F7df)H;%L})gdM-E?
z*9w;hFAZJ}Ukcw|`}_r0&Q4Y}&iZHkbB+)E@B0^Ox~>jpxAteY_WxbU4!oQhczL1c
z$nBaVi-F**YsQrg2$_KJ*Zu|Uw}7m^`l_<r3G4#SzB<gn-VHyzA0mPEON4RNedVpq
zanL`$?<T=ESn@S223F^SD>3>qu<PO7x+Wy7|0)oKy}tTK-*{{DjB~B9|M7h<2|iO|
z<@}MX>MT}%5^P@fvBx>vk7M{q{~NsOZ=3qJkU#hF`x)|C+n#}Ta&3K|=Rh;L-qCZw
zLq6Z)?%%_G-pc^I!MF$7xEme@us3`?0}Ppm6+bucV-Rj&06X8t0d~IKeZa}h{{kuJ
zyL(=2CttL?U+m$&=w<-kbTELu=|sw#9`}Jp?q&mnu$dX`=5DU*8C=ER3gGzGD)(TE
z<5n|^<8=&<TY@l#q#x4;%hbX!!7PEI`-Kw6PGuuaRg;HbK;)1c>u9VKpbT(J64Wi}
zB#yn3^hP?GEMRIR$mghTfFVI00%(UM#kH6uQH)OX83fNGuxzGYvdl?|Nm0X~%6J-n
zZjhua#LBj;gpXnhYyqr)tRnq)<iD)V=DhD`ZENp2J+|PzCYvqvz~5+V&hNu5Ar}gn
zNW%d@ND8i(<UK|=jIek!CX>pzbyCxhzd}IbDNk8HJXs}C{=5CS4Fg{x`P`j9^&WZv
n*1&{`jyVe`D#LtDHhfFG|0J%jN#noBa}Vs>ndW;0fVKaBdk4XN

diff --git a/scripts/src/aim/__pycache__/permissions.cpython-313.pyc b/scripts/src/aim/__pycache__/permissions.cpython-313.pyc
deleted file mode 100644
index 4c05f182adc9343e70d29f9e1d23e2da94070080..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1606
zcma)6O>7%Q6n?Wm_IeZBG^s@63NlTD$_mv!ROtaIl2uYcB0?JDT!Q4T?XkV7y}O!O
z6H@gMaX_LHN-mMYm0Kka+&Q4$dNc|ZXh{)L1yXMYM-Y_*yjgn<R6Q`3-@JWq-kW*v
z`(_5|v<WzV`RwlIq6Y9te#Ao^DrB&Z%085!M3!NRa6+Z7EGt}zW|gZrtIOJw&h^Nr
zEhm<eJc)X$q~~B$<3=fgzhqu1nI%J7HWi*~D%Qkfxrs%>3EOqOzz!VG6)X6yt=d5g
z=c%in+i;p)9=R4d_jrxSn9<O2#)Fc<$EfVXi?9)UU`-jTV`UD?urP{W!-Ah4^KcF}
z60tQ2_Gti@Y@}jKiIgD&my|e1nJ{dEONyjH8gNCOg$A*dm0K^x$7Xff<X+dOwWvT^
zWt21FwLf6>SE;3kYLok+(PTlByLKl`G<l`z)I(#LZAZm&S)iqaW|XCZYgnkV4{Jge
zM``#<fd#dK?Fy&bW(85>jvt7E;AnF?1)uSbBZO>f-ro*0wNW!!UGBm&m_y<(7E$a#
zUs3fN<S09}d;8AqgQdglh3~TYZ?gHGkv}<_m>vL;?hNgnf9rnk{$%f5`7pEId%w~%
zDu4D>>3kxlFw;k~bMU!Y1oeyTYwA}zD%Y@rRNdjM7I=I+ObAxvc<vY=Igf$-4L|l_
zV+?Yc#Lad!gg1_XXTc}oMToS85qBw+m6tJ}95x=U3~OU3hgK;|V>l@^wX*s@BGmXy
zQN**e{%6fow8HaIn1z+qF=_N$Ul)D9y-ka6zjHy1NaJm}jEk1z)2$YBX#{5wAg8L^
zG-xsUZYgh?*PJ#J)aGm$bdfW=Zc8?7aVL-p?Yg)^&|%lFyvMsNPv0D&;f!JhQqZZJ
z!lN$R!ebynw%iFR6EHWRHyQIqwCO)2qISLGxWjGp=HtI`I420C^ChCUV(AgVLd6rI
zUTa}3VRm&)$cWw2-tp>q4>TX|JD)%_cvgz%P~hco>OvBO%E8mpHe<^!RXVn7H<8Bw
zVmO~c|0(<nhGGYfCt+gdAa`ia?_BLGx}H8V%w6M-v3GipA6)v@nEl-Z<J9-Y<gWRN
zxp(=2k^3=~jXxJ27&AYOTv9(do`%V@15ow!uL(${`$^QE2)W&-XNnfwv&`aU_1*$O
zX=za*p(+9%CXnb|?uM%42A0X6#{e!Lo?)#ysmX#vt?GI0sBHd%G@gx&E1t_NGc+re
zMi<ktN`*^m^Q08ha!FD)uI*H#q+teceIB0&=0`7S^m;@nM9sMi0}O#-BaPRw^W8Rk
zgU_Q)UN@0Pfft#OhcNdD%pV~25YGGz7mpJfxk36FxK7qduW|Dam?F8p6#P7f{0({%
Bc6R^(

diff --git a/scripts/src/aim/__pycache__/structure.cpython-313.pyc b/scripts/src/aim/__pycache__/structure.cpython-313.pyc
deleted file mode 100644
index 9c50bd93e71ed5a7a2c0394971fc0c2175ac3e2b..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 10677
zcmbVSdvF`adA|b=?<c{R_&&ZQK_*376l0OH<xmnI;!6sT$54VO2n3E4DDXh<0g^~r
z4%K90vaTyCiX*CVYj&E>Q0*U~r<snNbf$_snNd3J6cA_uxzKhxZQAia9l2DdvGPy9
z-NOM8MawhV87%hp_PyW!zTfxlZQ5*R3c`Qgx;^#F9TfE+_(2UiB|&dKhQvD*M{#r?
z)k`Cq#c55SrdNx!y$oW=v$jvyt4Dg0X8H`hMr0&uU7rb=puE1%+-pG=l4t0%_S%q*
zq>X*{UI%iJw5iY8n}_mxUC7m&kMddSv~~woLviL(inFw8l<~AGe-tW6zqP_!+f#1~
zxkAofN=-4Sh%4e8Bvs56b54@l!R_GkNUDS@;antD%9V2YBvr<haRnq*KB;q;e};Q>
z)3U`Uis6Va5)6xyTO*qSzKG8s@=21cn+OV_02DED5fl_Bj~$0JbHW!nH;5A_I|lmU
z-#Ow71)&nu@A3sh0<KWvo0$pCdZ&G&Z&C<&X9P4IlqAxFR?eS9;pmL_f)9Bk!t_kY
z7ZD^mf24!&ANCG+4xH%k81D4;b)Mwp;w_n6=aJ!K#|Jroda=l#R(YT|yCCrnb(%sn
zM<ESIBW*ow=xK)2?t(WY#gLQ^={P;)8_1Ip>B&12c`_pdERIDs9t}=R^an-ZGY3?b
zwNeDh`e`3JFCdwT2$v#*bLOBJVP9tl!=fNFAt)*{L2)81Gv|Y1;5Owp%0{nO^i2z1
zuWa^ur^A702&b)H?`u(CDE-Fa^-ctl6u}LMVR#K0IXmL@q5>EID#D{E^m-+{Q+}^6
z0y{Dug_VN>#qe$uew6HP5+eR4pC|>#Lqe0}N5Pqh)FdIu3r;t|9HRb66bXB0W)Yqi
ziEu(<A$pVgjn(n(zLeSa?PICpviYM6dlF1p%2@=d+6PP#s#L2yvHlF?LZCNCA^!69
zKdq~wPU|_QjYbAe2dl3q>uo?r&InIr^-r5PD?S!eOy)S4IXGUE2DeQ%c7br=UHJ^p
z7a1UunHdm9kT*v_nD9kI5$}Z09|@z`IeRE5MLg;rj>$T_yb|mgtbw{`R%up@_%3+`
zgu=*ALwjn#Qv$J~H-{kc4&}+b<Ef$ac~y(z|5xbU>BoSTqF4$_r57c)RBO7GI_fq(
z=+?^2csLwFJD~`whX|i2NeE3yxEPD7AeQate3CaHTnH+sQ!ZAQVDFPJDxk1b4$(aI
zpN{;cqsfB$ctL%#pk=k-$ECMR6OR2c<9=oP@Y=yC*CPQ0K}2r+Xhi^$6e__{DUQl;
zgxf<HEwOOJvf)9J;mXDt6ow-mnME()Jls2xL8S*ga#XEGxIbwhL?B&e`?q_4RbIVT
z7cYNlzH{MFf_W)bRXg9m1aemU8=Y-aL+e^MwUpjYQc82Ur6)E=4;f^0L|CbJsAfu}
zpV*)@9zdx~P^F2ZRY1+BdcIFlQP|9xT3)MepYLUg;<ZC~(p!Ss!Vng_ErHXhTdTGc
zfc50HShX<JkZDVCcvM?c%llv)1HBaGA!-Yk9|A$z8bD=ed96AFk>MG&egM~>f<Boc
ze44iem^GFu2t0idQl#`%iW;r{s`B`R4*Y<kEEEfM>nJxf_!(|WrfcVl&g}MdG@kM`
z&NVl-dG|Jsz2H7A?P&+pGYMjJT0j8nvRRr51qrlCvOWYt6r6#)hz~`ii^0e_*#KH$
z#^)Dg4H9JCv@ha6C+moMaO+S$?g<1{f`ct<#IOQ{ZICPB9b$1%&WYK3UYPZgBaU8y
zS2eiI+YrrDsfw!ku8o3<<-mL4Tj4}y(^}qxf|f<&g60!ADUq9(uV21#C0X1QFK$}X
zCX4sSi}&AQ?hM`W-7zK)^u!PJBoFk)5A^=ZTCm}C-86pB7%SPgb~NE^ThM)KaW1qj
z@i#r!Ju7)P&a8gzqrw+c^}Ci@ZyvmUaQU?xhZ5GB&n;Bp{)bk|>Y5)Q^6bwQPrThk
zl&1hMp2Qh-%S0`pNp2meg2Pr33cyJQ(cK1jwi8)TMkqO&(}19AThleweqqD4br{Jk
zN`JXA$8fqfT4X9Ik4??z^qirM-cI~@Mr|_(CqZCYd~|i5JhcU0=W(fNRmd{}4x{iC
zs&6@?+M+<i7%={jknKq{@bnM{qAfvPHPOf$)wX>Na1_3S4~7rq{rT3AH^Lg4wpl~X
zQ1zA}z@s_}0HGhJLFms$-ytJtdhQXJ?7%2_^UE4L)q<gCn;jj1vom@UpB>RM`qTD{
zX(%`feHw;ppB^V~QrB6uKG(Wf_$NliTRH1CYxG=Fn{L^n%y;{i2i{LZm+mWe;aGYX
z{(SU%8Gr-;ey%yw>5<v+$T(XI^Hpoh*`HpMfxh&};S5$&9!&m7Fi<{F%c9<cbu|gR
zUfm;J8_JwUUMp#;z@8EH9s0WT{{%fjy`rt6CTO=~P^Mp)+cN=#iY3HcoIJ>O92;O&
zKF(eYM?(SDj|4z*HW-l&>0*y{(a1#Of!kmc2%<k60IL9Ki*G^z`l5}@&dil!tAIt}
zaD)v?EEpE7kDUf<02eg)!_(7(7<sH|XJxt(ObwOV%oVU~E$fd;k??c_3*5v9bS)t3
zl^nN=@CjKjTmm8@5hfz*p;18$5DF`sV4wl8CN4#g5taoQOV}5X%|R(Bg0>Ms!7zcK
zKO&pKR*4FonDEJ_&P#q_2AeGiW01ncu=bF3ilWj5VL2pOJ1Iomc7)G|><})^2>u9|
zH0Pj0Fa?Zi2JT>DLeW_aHlbv#aLJz@YPzr%w3KXDYk&a+V}V79A_R+qfO|mKBvZ0O
z8mqT#P!ydDR&d6L1TR=kLD4(wn+~C~P__|%((eGm=BW(}5Wu$%%^yu!9M=vm9=!I-
z;wvem^_qFnoHUlijV15yUTKN#9*&Kiik%h`r4#GM$&@31!Gg;lT0FG!(!!yb<%Rj9
z4>fvS!G<G$Ss!;)B^`BfN8QSB!m%gmXkHy(U^W~j%XL3ul8*Ygqkh9x9;;|exY}dZ
z_J>-^x$}{kvK22y64vth&Xlb@X{(9bY7(}(`L0h4wxyj3SKU)%TGg*HYr#b6*Vm05
zsj6M?y>aV}2USgRW7&c>WwF2YYRc-o*1Oo7v{uBe74M!~kyfQuVQt@<7;o*4HT2x8
zi=8-`s64f9^?<TYxr(m47Yr$j>my5DDzE5f$@P-umK&7|hrg<sntSJ!R=%v@<oljj
zL&x2HcP}R@xd+za&+{m@`Jsy{F1tB(ed-6HMKc-jN0!PjYe9JbWbDvTtbvR1r;_}c
zIDaPQ9Z&H7m@u8F6dzc_pX;dN+J}0|>YVTU{i9u!wQ!Ttz-E+Jt!RJPv%styOJK|1
zw*29t4zeFhSkwKyw1e)kQunOpo_*STMR`4q+IzcboNm-X?9XKen8X67pf@!T=kg9!
zGl>jG^GpZ?N(op~a~e?(eBc@6IHOSq06VGecn7D&2B4^~#8frILDXKLRtC+s<q8>c
z3tYje)_RI7z~RZ^B?g`XjhLb60?ipg`)h_UyWA4g*@IpNCPIvZv|c8Z88pJ^U-OEa
zfEJAdV3#Yzc&KnoL-44!C0ab#1R{aAWM}1r{a~rlzsLGUMR3rv8CDVi9OJF(iUy$6
zq%n*7nbvLDGCp9vyln{EZd(Fyp$tdLzEa!ZOc*`XF|c@NwqZ`AW9m9X32KPVwxg!D
zV-UbDY0liHA$982lG%S4FSaqZgv`jWv_M@Ca9bseX3QU!nxsK9W(+3KjIhq4A!p}x
zc;`7iZ-D*Ja8TYL0N)i29fllzXc-)qDbxXdpu-T&Igg2e!@&Sclvz+@Q8&)6$m+If
zP*v=>z-E+NJKH7GX0WUc7@x(6gjEA*D{uI`yHHU|jv26J1av_F_fHr+HwctGh2X4E
zXb?x(*?{n&K*w=(0!PC*;&6o50Abr#)?GxPnZPnq)D#nlPS41CrCTtf&If`>Hj^?$
zBg#flU_`ATyjp2hhDLCE-^5WnZj>Rq<RnfS!zefz6n!Cd3O^eB=X@e~@z7~p*oz|%
z&bNp{Ru5{!(a4u-ts+0T7Q@6z_=M(?pcy=U$phkzHJ9V9uYukwtC~N$&g@88Z1CX7
zo9{^(EN@=Edil*OSFfb<i*FvferWZjr9-j&mIdQOjn*_s<J`9EZOfyH{GG}ChSi#d
zqmT5Ivou#h)x_!#-`#(AXRP*E!qpqI_NMIl^WCYU%A4YK@j=nfG;F{9YHCNtQvTwx
zR8i?4cYki6ig!IUQuc}*4YuJbTDp)dKCrSgUUMMfYMbx-#NzskgDFSBhS~Mjp7|r6
z7+fi%<(g^HwA7Sz?T)*4CtQ10hvTjn*Nyv9jPcE5SC1_O@Dw54ceO9c6vmmt<-qE2
z45vtu<5!O_9l6<mz5mAG>Nn?)$C=g*28`HsW)JA;-#>Cw&XP@vhPiLJU}mjrfwhr4
z`|kMf@Uhw>3D?nkwK40!A0BFPiN_K~pr4g?R#3mFFn1o({$iJ_vrYSpHXWq>V2Nb{
zAe^EXehP_Pz2E^op#(mI6nw^+B5D9npP?7>sS)i6Goq82CQ8x(y0QwoidurPogS=@
zNEp>Nf~ChZS^JdNsmRot9>WRE03aPkUWpNPA|nDvmH;KxrwIyS*aQaxG({=gjvS-2
z_z|Bfw_dg>%u+yJOjTtoK9@ni;Eh5;HmNii$R83yMBEWR8WKK#3MW(eSaGHqwTc(h
zKncx4!D(Cr_Xncwto_lERa>I&Yj>;(XXpH}ls}a8qqrZf`y(G&qWArgc)$1Fk@z>f
zv7ym*YvuBlc-6kOu75asx8P^J53JpBe<Wdv#+c|A>y{{SfBem^jw0g|-UQGX%I?j<
zae9YpqC_qH7<{;t@a$cD_73*I>BqYz>d2l=j_UAEVLN&VFUpp%oo-iAJ)_g0wE<8)
zV8P>!B4PBqS^VY=>dx~T)k0G1`apYwb(Y}+YJJGf_y$;N0LDCUMv;}#{rfe<mdfx3
z&={bRMAP<8u$;BZSi$OeSc=$IrVi7<+i<Y}ZFHEj+C-5)(^lyN_Z+1lK88I7-TQG0
zBfi^=qBwm4M;MRM3`DX)Iv)fpCx9;DER4ED42dm5z*)kGzST&m%!S*h1XMz=<96UD
z{Vhb`AuBBh94slD@7}1|_mh^jD~XoQyRRpzhLcsN;#H>}RGlUqeDTb}M9NVfchoE}
zKt8WsUc8)iRL33FNk?tmQ45^=p@uQlZ#e2#0zWx=r{M2;@9L6{uDGKs<t)BwziwZS
zJaE>14#q(@4PG&Jj0VnZ&5v2iVocfZAL%G3ivg`ZWzD}fxH$N3%d+&t14(P$eQO=T
zvHHgn_EP`6sNt|h^P$CjxLx;QVd>#k-G{9@NI&5s&hXp+Atxbw0#q5?&ZCw^Hj(CO
zjElszoWV7o_GBbo<wB}F20((dn3Z)13((Sb9yE0vfQ*_Et)y*Ma1nSHIbF3mry#>z
z!J$m|(>V+hMh3h}%W2yuDaxxEs8%E$5K$v)J=laK0s7F5=q2roN*}N`q>m9^7t{=Z
z@L?ns4S=MW-DkXUYV9nOg?5aRCfy25JiPEM4$T`5LKB2HV`sSWS!H1yd(z`D0irNj
zPhZxf$D8)6IIk78qGm$De66S#b?LN5G){nvdamz;4@rW;-TYxNuKkhF>_Han?l5GB
z#n3E!!H0rAxFTcmC7i_i!~hF7k&)RZF)TKc6pJs~guR1v-6Qy7iG?#20b0jqi60?@
zY1hU<)_+d$pJ$0P8`_(Q2uO8%K-CcNA2bf@;kFPesPMfk%fk?$P(9*_u;Iu3I3mn%
zFRo}t0D0--pCMwho{UmLUGPq(y|Vqh7``Za(|#6-c+6#^`nWAxlw2SeXTT+uyFu>+
z3QsGpls|%2ufk9ISBT(h3G*}TQUJT&QV!hAV7dA_5H#=wSPGW{?;cHBs^gaG4SQv*
z>RiGej2VNe{uBS!`^(;c>0h^<{OA4;rtbLv#J^Pg*12Wf%5ZFlJGr9`On7wr{C#`d
zFZ<`a;<l3?H+QcW_S|po{>wcpyKYRzo4e-+<ApsbcjJ$%Zda|l+Y^ql`|kFYf`6R)
zVCrX~dt&_1=^NH1=BD|&`3KgxyM4YV<`_#^^1i=+S%2f@l^rpQJI1)b*fdb~Q}h?V
zF6{Y2c8n=d;@Wv+r~X66exyPF;jZE%`<Q>y6hQn0CBgs;#Dm`a4#c^XC<iVyIm#k)
z*Aj*DGyB28odFQ_&~IlL1DT?sCkWu&!{R^!ug@AdTOr3ckZb1h`t0473QFWQOAp7^
zAZgM71EK^bQbuj&s960_Mlq_r!z~n+xh)}EhtuGxaoR?R0e+g5BP?k|!*Lp*)93*M
zSqa-Xx_1F6XofP5O|>NSnQ?7q^E?@&mScGQ*@aFe1nQ~*5SrC_6VL%AI{H`GxW?}N
z=j_Rh&BqpeJz{vezk&16LpxppwO?|J2O9jjdNcC4H&crSpmG~yoj0p9<;>fR<$Y!C
zc?MQmfIWtb01v*cCjqYlSrgcIAWhF~J$Ejg<v7h*May%|havN^@fMhs9h~4_H7mz9
zvjVk794tWG2*C%*0)Tf8%9@ZLfqtgYi#U1}M;HO;9PMmP4fZ6bz18UJkSo*Gb7kra
zVuAyV!>1F(IV}khSr--YpBADy1NK<s#15#jCml$W3Xy7H=ge6LHR^@--A?7U8>8iR
z=q?-JvL1i0p_n4y!NmxI6PT~ZkAw%}Q;B#SVKWRa<!j+jwg&`1nw`NeXX4%-#RcBL
zZ**Y<9%zICnppo5ILztuvMChyE1wIHH6dLodLk-GxaBNeRIg8qRj=|ERe-KR@jr#1
z^j#349M|$j<x6+$iOTLcQ#RkVbYR1l_twZY&!T6!GGW^d*R7q$V<$$|M^7g^$Ksu1
z>*K-L)JzOrNRD5Ok6-*?XTsU>)17PI_<sJ<H*ORy7rj?<tK_|kTNNv>B}&|@)$x*s
z)z{)B&G++~KiGNS*%7<)t@&f0?r2)H5`S*OQuDN5wR>&&PFtd~bKTnYsl~p~l5)5b
z4mRa1z-l4std2XYf3$nGWvykce(hVa=I(n1_hu6{Cm%RZrSghzmi@c4;5XZqjlDD!
zYX&dvnIu0R=f`9Ii3C3x3(h2JUVGp~pBGXk&6`D(vyeD^*NfaAS=_10y7#7TO|9nR
z>*nkHTH8X`)58VFb*!cDUe~<?F>Wl@a3*#(m^?cjKRX>0UrU@tvB>L*$}117Z-D#3
zSqSb2><9khf2*my!!$8Le_qkr^$O!=6iz@m0|wzaJHF)bfGTfb;oGD!w^6Yafbvm_
zzlRjXPM^nl*`nd`DWFJW2sc4Q8OR2fJ+w_dw1i&}3nkO7@)3z%v0z9YV#Z|Nr$5F~
zzg@w@ie{S67JahOx$;PKCM0;scRcu$v#|!2q+xbrV^2^01*Ld)R`~0h+&T^TSmU*U
z+WMUNE#jeM#;VM}0)MYH5yhWM!RJ+=$idr{`790`cMPtBp<mVn!-`W5+<uXBq2Rc(
zXa`6Y6a{t}+DklZMx0}Zudw#QwUBb{BoWh3cHqpMFXV`qPPXA()u|vU#w0$yh@b|+
zifa6bFRaj691*h;`yCVmkH8T=z*|1ek&Q1aU!omCx8N-tY)ZNe5%`K|`eUl*zp33H
zQ^g-sJAO@>eoK}AmU`i1s`XRK6Q?|IBcZYUpN64}A5su)YT*%#K6tc~7Y4fZAq7$T
q1*9Go7-`p|q6*si=<Bo+Yv>E~BeRt*e^hCv_x!H3fOe7(BmN&<B7Ld=

diff --git a/scripts/src/aim/__pycache__/templates.cpython-313.pyc b/scripts/src/aim/__pycache__/templates.cpython-313.pyc
deleted file mode 100644
index 582a1fe52b7d787ee578d6c09ec8ada4af7ae5e5..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 2219
zcmaJ?-H+2o5MSrRxyxOS+#Mx%B*2oK02dO2098T==}JT4xEyVLp;Uk@pS{T$9NXG;
z?js1b>c3D?iHEB6t-STQ|3Y~P<t4J(r>d2B3%$Pdt+S4ugb&q{?U|jK-_Fd=&g^9}
zX#~$-kDuQAc><w7I1@dI0U_*N1>zA>kRn`1D*_cTr(@S+D{&eJI;F%9qI(INP!cqG
zM=T;Gc@W)6&ZF}o(s^M(&{R{DCSGzz68tI6wjEFNOvh$VfxSTuLW%K_se5`XwB$eT
zU>qS~?^__i4dHeOhrkIXUKh^AltdlPz_xW^2Az!qFDfZH8Ep&v#F)*bl2)da>CiGG
zi(`5-BRv@@`#u%MWZ97{3Jj2ED~Tl}&8>A7N_f?@+dEjsigFciY1Gs<EW*-K%%9V2
zW&)$?j%^d2hwR50+w`X+L7NfkFGQS6%`MF%>V2}SHcX3ja&nV8ZC3?UCR=<PxdQew
zU}qyE;8j;+tW$jO07r{kTHEr}z(S1_@WY2-_g<v3L3F1@)E4nJ9m7wsw&8RNCH%Q*
z8_qU^aDe)(_F6zR1xMj0w@sV20BRV8>rl_!$ieZ({9J?|XsI3rp3D7&?OEJv>2(E2
zz!ssZPN)ZATBZ?HhA)~;+o1&Xhk^1Sw;gJ9mLSkUfUpO5R*fJd6$rI+q=Xg6-E`Qk
zkCifWiEcJbeLS3`6r+<tK$_7qZQyu#oy8EWViONC)N<^~rsuhuYl1U}qn*N~$YnTU
z2!LGymHlt31lhSW8)Ro#5daRc+*cje$+N)C%HRhFPsz4sSryg*;h_?C8w#-*d1nlX
z&f;4Y($Y-3vfHvc`7u$LDS0S7G$tJEywhYO@wlzqVBCSBkn#=zk!JKZ^Pq+()Sm}M
z&5zR5iOP$b@vDrnFUgQaIZTPnbZWXDlNp6Ivn6|^<yuhjtm5wa^Fxo+;W{k<j0i9L
z4nAL@zKAj>ew)tqvgO|Fktc<2w$htD`BUb{FT0oO-J2WTy521t-7M*4S9;kq{V8#A
zW)F#(ef{L*v2_0c%A5+U<zDt!FMGC^{cs4AUF~O5Tsy_J(<jpX1(cCN`)@P`@_xF%
zA4%7QXD5FtcaPtCwJaQ+7W?REQrrUvkt9m7PH}XL%Ghvt%5j(*tm(Sbwmtvw{}(Wz
zoEb-PT;4o13$slPnkBXzoil@k4?&k+2Mv_ox*Gs}Y8=`nv<$bz3o%0nu>-e~ng(HO
zU~r*?t2-K;6}b@Jyr{^d8>ez#2t9p9B?Cp(((DVkSmfqV#DgAL#ujO6`fkuFBU8T+
zfxWA1fjJ(ThaIvE9TIbUcav(2MA;nmJKjM@a(y^C;D}(Rpc0=e7Xt#rY^kGpbaf7)
zHWaNpSC5?l34aXWYcmMdV_WD^5~JFFgr*QiP4q#$AxOg7QzXUxSmm@YsD2#wWE>o0
zO!M&fCoeXMO?F&*i5>_39K37+J};q=yZPF$mFf>yo-99`|Niph%fS50U=pLRGX>$B
z$%3#ZiF6To7#JR<2Z5s8EnlR>Yg4-;8!#|$gX|Rc+Hf!fa%`9m7MzWHFnI3Xy(>-l
zX;p2s!I-Ej<&OGOx?@>`xx{FaZ^5sdpS!tSUtL$%tF=#7m)EPRQoX!>?Z%qoCxe~*
z`8VX(t6wM-Qi|vy{t05AxY%-xwnZ*c8P<6ISs6b4xF86>qvD^a^p98+#Qutq%E!7W
a_i7I13eWSk=auS<eC@@7+H*7?!2JgsdZ}pu

diff --git a/scripts/src/aim/backup/__pycache__/__init__.cpython-313.pyc b/scripts/src/aim/backup/__pycache__/__init__.cpython-313.pyc
deleted file mode 100644
index 9520dfee568f3d621de6399697a86cda79406eb0..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 144
zcmey&%ge<81kYx!%mUGmK?DpiLK&Y~fQ+dO=?t2Tek&P@n1H;`AgNpW`l%(!`iXhP
znMpaR`o+mbnFS@q`o%>+vCLfkq{QUx(gOYX_{_Y_lK6PNg34PQHo5sJr8%i~MXW&m
SAoGhsjE~HWjEqIhKo$T3Y9aRk

diff --git a/scripts/src/aim/backup/__pycache__/session.cpython-313.pyc b/scripts/src/aim/backup/__pycache__/session.cpython-313.pyc
deleted file mode 100644
index 94dab77ea112717f356fe455df286efe6385bdf9..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 3744
zcmbssT~8d>_0G<I%ziPj>|%_uJ$z?tU~v^ka_f%}85F=?q8(G=Y}C=PI|~z*neClf
zCm=ugsUlV@lT?;*Tgk5a(D<qO32oI#dFTThsFseg6e((@yrE#pRi1jz%+Br_Q1Z|V
zy7%0B&OLj+@0o*WG(=$h=h4&me-|L+YuvcQ>j2Eb5&#c~NJM6aOf!@b5cbS?sK;Je
z%G#@!dhOLmeXz1K{^<Y>*tFgmZaPSVHtd@TO^0b%Af2R_i2g1j1}=D<U!svkPm=ov
zH%Z0{%bKQ}vZ?Btk%qnZ9obxhHF{evs(IN|q*ZyPhzC>JZACM6x_VvDE$19w&dfRs
zbMOuT56F9jG9m%784%e6;<8<Y`rh-4A<^4K-uGUp-K7CBEc)<-a$*F91Slv*#efZk
zM2?0RgUJ>vE-Hor0=^~Zmdm9ZvL-Jo^qVNKS(}(ql#-xpicq4;NN!2i78QXiIsLXm
zSB0EjS`|tP6;xMtp`cU2Tv82TeCh_=(R09hG{@9L!UfF)8ZigG06ZYsI?k1Qjuh)>
zi{vSjPI@fXP)sW%Er5hdUMiQ+l7><&7)U8tqbbGArDV-e7m7;C$WgUq8YzRqnYxm~
zTjf&9aI_pPty-KUshVm^l6Cqx-A7$?D{wc$Fx@441F!vYZr%H9{s6Y*6^$^&Y>nmt
zctGYzrY=9yIs;B?0pgzEDl#K51FjaP%{atdsB!8iNl$vMbrjSYarIb`my@g&{6ICA
zBu!pXz#^uyV)>17p`d;U77Etg;+To@z|jgj=8#Gdh?a1y`b`w=aK(5Hrn}@TzO%~r
zR`}j07yoqS4_CHcpRDvvesQuob*lpZeYdvxcel8AX$**S&8pVT^8zqn9_BdnxX#y@
z`PSnM^;5W;Pk^bIj1Ry=!@Z4y;>d&97SXIw4Gxbv#x<(u$#O0>V^<J&=d8VCKIUe%
zfZUq3s*z?eO%9F5FTgENKcN^w$$%B0ilG-FbMTJkS3Xn?)1aO9##kzwYSHpxO8wYk
z<$ONL(iT9`6E@y)iGig+5QJAfscSjq`#p&i$jA6OOn1p{{B$)wP>Bz0$A{K~yW#j_
z{t>?&9{O~(nz~v^U9G0ZE2;6__7l5piE3L<rLE^la=UGK-M`1R+>hLgY~0%6hIYBg
zef}f9%AKlkr#7c{xWQdMu^v6@f0Wryk9z?8KmNbWxc-&Tf*H^w$HYRz`p0?SjTF}_
zUU~|ovOQvZf_B3;>1mkWK&QJFk1ffDRLeiR7?n%b(6K3Wlu!UZ#v3plu|MDWc=pk3
zg+Ev2Z+_;jj=fnKd-E?Rx5s9xW0}fWW_#@B7I*ViyJA_u*tYHZ4-oN(?F!aHPaGNz
zYq_?~L$qe=b`|T{qA)+0Pi!{mvY%t!EE7l;<KG^QU-N+fvJv+@gOPq{z`N=ZS;%)R
z!iR?Fy~vh9>(WFP%Z)uUaTjW=y=2bYBnPH|J?4DwspdaJvY3MQ$aJ|-V}&a4MpG4F
zGN&6j7jmP@wV`|&DwRJ2QF?e}1@|P=>q3nc<Yh8FjlB!G{4@RTNn>?2aaXWw!zP0b
zIu`<c<R*RmnWT$ptfEi!Ut|Pw274s<YtT1&xE>jhiEKaVL5;tMSAkq+&yoVuLxzcK
zC#=&2k3h~sGzcV}aww94^xE~b-sm%&;wO9{8$ymM&@|;6eMbF_gC+zz4@Jn8DTPML
zZa`|Ox)!w`PAI?7UnwJN-qBU)xme2&O$|Jiv;#D^*t|+_!mAltQK1{s7A1W-nQ*ED
zTHR`!REtVlHz)P7mY<+hr%u7ZRH1&P;NbZ!6@bbLtSsYOT!LSaQ5egk8&KPex}i`n
z(qjzKGdN+r0o2lpp2r7VHm!gtP2HHiHem$}Q-Wh)N0m}hh9d7TYeiLCP6itF$>MTl
zP-{h@R6tgqLf#7EZ`XPP1Pv?|@ND34o(_D9&=ywrvDK@FMZJw6_~>ZKYOnHx6@Ku^
zYL!1<;m_~I`nLM%cFfp{7)KwC#71F<JG~d}+PwJB=)higf3<t~%kJUNX1|!+nwP8d
zOBML<RzJG2{?=Zk<^J3E-rmUk>iS;$iOt||uC8C(_xPhDd#xQ0BcDVzf40;5quuuI
zYI|R$y|3CnP-!37jdwnr{&@QL=HolRz4PhRpVLp%+ryWt!`CXq*S612?8GPcT4N7G
zpM*AF-)TMfRcriV_~Y;sb0hp^>+s72X&HRcL4q9{>JBH^PuPF=eWWeXMD(3a1)_gv
zU_$-%<hXYt!T#;c_>~F9^Y?BZHlH(X6EWZCF&5!OXreEWWb9WZo%GsIxb1h#PZhIF
zHG9*HpqGH}S{OeLggZhS8tx-l%e$cK#iYN%jpAzpt+7e%>kiWhHn-RgLUS9EFn-EK
zgd>vli?Up-VR%U@sMIhaniNe3bU>2wdQOrkR$D8AfvDzI6mv<>J7L}f=M)2i{sbu!
zlH|}xvT0Ivp=>IKBt0eeGiApZ<&YRBY<G+?n0`tA<(>W3%lOXi`-wkx;9-1O=70ro
z-v(d!1HO(IF^_MKdCA3m9S$>Ok&L1;g)$fql%e>L(NUc2L^_YqIhd>fcC|%y!LjxU
zXqQLp1!A=J$pwjvISZd=fGxtu79_i!z>dU|$P6o}lPTOK$Ankt44gqO5Mv0YeU@RE
l=cM;*5`0FY&q(+g;h&Svf0Ogi$-qm0lIi#sKK~pI{s%kW1&ROw

diff --git a/scripts/src/aim/backup/session.py b/scripts/src/aim/backup/session.py
index 2bd1221..8046018 100644
--- a/scripts/src/aim/backup/session.py
+++ b/scripts/src/aim/backup/session.py
@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+from aim.permissions import preserve_replacement_metadata
+
 import os
 import shutil
 import stat
@@ -25,7 +27,15 @@ class SessionBackupManager:
         if inventory in self._backed_up or not inventory.exists():
             return None
         backup = self.backup_path(inventory)
-        shutil.copy2(inventory, backup)
+        fd, temp_name = tempfile.mkstemp(prefix=".aim-backup-", dir=inventory.parent)
+        os.close(fd)
+        staged = Path(temp_name)
+        try:
+            shutil.copy2(inventory, staged)
+            preserve_replacement_metadata(staged, inventory)
+            os.replace(staged, backup)
+        finally:
+            staged.unlink(missing_ok=True)
         self._backed_up.add(inventory)
         return backup
 
@@ -46,7 +56,7 @@ class SessionBackupManager:
             try:
                 shutil.copy2(backup, temp)
                 if inventory.exists():
-                    temp.chmod(stat.S_IMODE(inventory.stat().st_mode))
+                    preserve_replacement_metadata(temp, inventory)
                 os.replace(temp, inventory)
             finally:
                 temp.unlink(missing_ok=True)
diff --git a/scripts/src/aim/config.py b/scripts/src/aim/config.py
index 524bda9..fca016d 100644
--- a/scripts/src/aim/config.py
+++ b/scripts/src/aim/config.py
@@ -1,7 +1,10 @@
 from __future__ import annotations
 
+from aim.permissions import preserve_replacement_metadata
+
 from dataclasses import dataclass, field
 import os
+import re
 import tempfile
 from pathlib import Path
 
@@ -21,22 +24,47 @@ class Config:
     required_group: str = DEFAULT_REQUIRED_GROUP
     platform_groups: list[str] = field(default_factory=lambda: list(DEFAULT_PLATFORMS))
 
+    # Local add-on execution is explicit; no UID switching or automatic migration.
+    addon_execution_enabled: bool = False
+    ansible_playbook: str = "ansible-playbook"
+    ansible_collections_path: str = ""
+    private_key_owner: str = ""  # explicit local key owner, never a UID switch
+
     ui_clear_screen: bool = True
     ui_ascii: bool = False
     ui_output: str = "compact"
 
-    checkmk_agent_base_url: str = ""
-    checkmk_agent_version: str = ""
+    checkmk_agent_protocol: str = "https"
+    checkmk_agent_base_url: str = ""  # host only, for example monitoring.domain.de
+    checkmk_agent_site_name: str = ""
+    checkmk_agent_version: str = ""  # product version, for example 2.4.0
+    checkmk_agent_patchlevel: str = ""
+    checkmk_agent_revision: str = "1"
     checkmk_agent_role_files_dir: Path = Path("/etc/ansible/roles/checkmk_agent/files")
     checkmk_monitoring_scripts_dir: Path = Path("/etc/checkmk_monitoring_scripts")
 
+    @property
+    def checkmk_agent_download_base_url(self) -> str:
+        if not (self.checkmk_agent_base_url and self.checkmk_agent_site_name):
+            return ""
+        return (
+            f"{self.checkmk_agent_protocol}://{self.checkmk_agent_base_url.strip().strip('/')}"
+            f"/{self.checkmk_agent_site_name.strip().strip('/')}/check_mk/agents"
+        )
+
+    @property
+    def checkmk_agent_package_version(self) -> str:
+        if not (self.checkmk_agent_version and self.checkmk_agent_patchlevel and self.checkmk_agent_revision):
+            return ""
+        return f"{self.checkmk_agent_version}p{self.checkmk_agent_patchlevel}-{self.checkmk_agent_revision}"
+
     @property
     def inventory_dir(self) -> Path:
         return self.root_dir / "inventories"
 
     @property
     def config_path(self) -> Path:
-        return self.root_dir / "aim.yml"
+        return self.root_dir / "scripts" / "aim.yml"
 
     @classmethod
     def load(cls, path: Path | None = None) -> "Config":
@@ -72,19 +100,73 @@ class Config:
             maintenance = data.get("maintenance", {}) or {}
             if not isinstance(maintenance, dict):
                 raise ValueError("maintenance must be a mapping")
+            addons = data.get("addons", {}) or {}
+            runtime = data.get("runtime", {}) or {}
+            if not isinstance(addons, dict) or not isinstance(runtime, dict):
+                raise ValueError("addons and runtime must be mappings")
+            enabled = addons.get("execution_enabled", False)
+            if type(enabled) is not bool:
+                raise ValueError("addons.execution_enabled must be true or false")
+            executable = runtime.get("ansible_playbook", "ansible-playbook")
+            collections = runtime.get("ansible_collections_path", "")
+            if not isinstance(executable, str) or not executable or not isinstance(collections, str):
+                raise ValueError("runtime paths must be strings")
+            owner = runtime.get("private_key_owner", "")
+            if not isinstance(owner, str) or any(c in owner for c in ("\n", "\r", "\0")):
+                raise ValueError("runtime.private_key_owner must be a local/NSS account name")
             return cls(
+                private_key_owner=owner, addon_execution_enabled=enabled, ansible_playbook=executable,
+                ansible_collections_path=collections,
                 root_dir=root, service_user=service_user, required_group=required_group,
                 platform_groups=platform_groups,
                 ui_clear_screen=ui.get("clear_screen", True),
                 ui_ascii=ui.get("ascii", False), ui_output=output,
-                checkmk_agent_base_url=str(maintenance.get("checkmk_agent_base_url", "")).strip(),
-                checkmk_agent_version=str(maintenance.get("checkmk_agent_version", "")).strip(),
-                checkmk_agent_role_files_dir=Path(str(maintenance.get("checkmk_agent_role_files_dir", "/etc/ansible/roles/checkmk_agent/files"))),
+                **cls._load_checkmk_settings(maintenance),
                 checkmk_monitoring_scripts_dir=Path(str(maintenance.get("checkmk_monitoring_scripts_dir", "/etc/checkmk_monitoring_scripts"))),
             )
         except Exception as exc:
             raise ConfigurationError(f"Could not load {path}: {exc}") from exc
 
+    @classmethod
+    def _load_checkmk_settings(cls, maintenance: dict) -> dict:
+        """Load the structured Checkmk source and migrate legacy URL/version keys in memory."""
+        checkmk = maintenance.get("checkmk_agent", {}) or {}
+        if not isinstance(checkmk, dict):
+            raise ValueError("maintenance.checkmk_agent must be a mapping")
+
+        protocol = str(checkmk.get("protocol", "https")).strip().lower() or "https"
+        base_url = str(checkmk.get("base_url", "")).strip()
+        site_name = str(checkmk.get("site_name", "")).strip()
+        version = str(checkmk.get("version", "")).strip()
+        patchlevel = str(checkmk.get("patchlevel", "")).strip()
+        revision = str(checkmk.get("revision", "1")).strip() or "1"
+        role_dir = Path(str(checkmk.get("role_files_dir", maintenance.get(
+            "checkmk_agent_role_files_dir", "/etc/ansible/roles/checkmk_agent/files"))))
+
+        # 2.2.x/early 3.0 RC compatibility: split the old complete URL and package version.
+        legacy_url = str(maintenance.get("checkmk_agent_base_url", "")).strip().rstrip("/")
+        if legacy_url and not (base_url and site_name):
+            match = re.fullmatch(r"(https?)://([^/]+)/([^/]+)/check_mk/agents", legacy_url)
+            if match:
+                protocol, base_url, site_name = match.groups()
+        legacy_version = str(maintenance.get("checkmk_agent_version", "")).strip()
+        if legacy_version and not (version and patchlevel):
+            match = re.fullmatch(r"(\d+\.\d+\.\d+)p(\d+)-(\d+)", legacy_version)
+            if match:
+                version, patchlevel, revision = match.groups()
+
+        if protocol not in {"http", "https"}:
+            raise ValueError("maintenance.checkmk_agent.protocol must be http or https")
+        return dict(
+            checkmk_agent_protocol=protocol,
+            checkmk_agent_base_url=base_url,
+            checkmk_agent_site_name=site_name,
+            checkmk_agent_version=version,
+            checkmk_agent_patchlevel=patchlevel,
+            checkmk_agent_revision=revision,
+            checkmk_agent_role_files_dir=role_dir,
+        )
+
     def save(self) -> None:
         """Merge known settings; preserve comments and unknown customer additions."""
         self.root_dir.mkdir(parents=True, exist_ok=True)
@@ -105,13 +187,33 @@ class Config:
         maintenance = data.setdefault("maintenance", {})
         if not isinstance(maintenance, dict):
             raise ConfigurationError("Existing maintenance configuration is not a mapping")
-        maintenance.update(
-            checkmk_agent_base_url=self.checkmk_agent_base_url,
-            checkmk_agent_version=self.checkmk_agent_version,
-            checkmk_agent_role_files_dir=str(self.checkmk_agent_role_files_dir),
-            checkmk_monitoring_scripts_dir=str(self.checkmk_monitoring_scripts_dir),
+        checkmk = maintenance.setdefault("checkmk_agent", {})
+        if not isinstance(checkmk, dict):
+            raise ConfigurationError("Existing maintenance.checkmk_agent configuration is not a mapping")
+        checkmk.update(
+            protocol=self.checkmk_agent_protocol,
+            base_url=self.checkmk_agent_base_url,
+            site_name=self.checkmk_agent_site_name,
+            version=self.checkmk_agent_version,
+            patchlevel=int(self.checkmk_agent_patchlevel) if self.checkmk_agent_patchlevel else "",
+            revision=int(self.checkmk_agent_revision) if self.checkmk_agent_revision else 1,
+            role_files_dir=str(self.checkmk_agent_role_files_dir),
         )
-        fd, name = tempfile.mkstemp(prefix=".aim-config-", dir=self.root_dir)
+        # Remove AIM's superseded flat keys after a successful structured save.
+        for legacy_key in ("checkmk_agent_base_url", "checkmk_agent_version", "checkmk_agent_role_files_dir"):
+            maintenance.pop(legacy_key, None)
+        maintenance["checkmk_monitoring_scripts_dir"] = str(self.checkmk_monitoring_scripts_dir)
+        # Preserve omitted opt-in settings in legacy configuration; write them only
+        # when explicitly configured or changed through this Config instance.
+        if "addons" in data or self.addon_execution_enabled:
+            data.setdefault("addons", {})["execution_enabled"] = self.addon_execution_enabled
+        if "runtime" in data or self.ansible_playbook != "ansible-playbook" or self.ansible_collections_path or self.private_key_owner:
+            runtime = data.setdefault("runtime", {})
+            runtime.update(ansible_playbook=self.ansible_playbook, ansible_collections_path=self.ansible_collections_path)
+            if self.private_key_owner or "private_key_owner" in runtime:
+                runtime["private_key_owner"] = self.private_key_owner
+        self.config_path.parent.mkdir(parents=True, exist_ok=True)
+        fd, name = tempfile.mkstemp(prefix=".aim-config-", dir=self.config_path.parent)
         tmp = Path(name)
         try:
             with os.fdopen(fd, "w", encoding="utf-8") as stream:
@@ -121,7 +223,10 @@ class Config:
             current = self.config_path.read_bytes() if self.config_path.exists() else None
             if current != original:
                 raise ConfigurationError("Configuration changed externally; reload before saving")
-            apply_managed_permissions(tmp, self.required_group)
+            if self.config_path.exists():
+                preserve_replacement_metadata(tmp, self.config_path)
+            else:
+                apply_managed_permissions(tmp, self.required_group)
             os.replace(tmp, self.config_path)
         except OSError as exc:
             raise ConfigurationError(f"Could not save {self.config_path}: {exc}") from exc
diff --git a/scripts/src/aim/ctl.py b/scripts/src/aim/ctl.py
new file mode 100644
index 0000000..5ae65f7
--- /dev/null
+++ b/scripts/src/aim/ctl.py
@@ -0,0 +1,135 @@
+"""Additive JSON-lines machine interface. `aim` remains the interactive product."""
+from __future__ import annotations
+import argparse
+import json
+import os
+import selectors
+import time
+from pathlib import Path
+import signal
+import sys
+import threading
+from aim import __version__
+from aim.config import Config
+from aim.services.v1 import API_VERSION, AimService, FDCredentials, ServiceError
+
+
+def write(value):
+    try:
+        print(json.dumps(value, ensure_ascii=False, allow_nan=False), flush=True)
+    except BrokenPipeError:
+        # A disconnected consumer must not trigger repeated writes/tracebacks.
+        raise ServiceError('event_sink_failed', 'The machine-interface consumer disconnected.') from None
+
+
+def read_request(cancel, timeout=10):
+    """One bounded JSON line; no prompt and no unbounded wait for a writer."""
+    fd = sys.stdin.fileno()
+    data = bytearray()
+    deadline = time.monotonic() + timeout
+    # PollSelector also supports redirected regular files on Linux.
+    with selectors.PollSelector() as selector:
+        selector.register(fd, selectors.EVENT_READ)
+        while True:
+            if cancel.is_set():
+                raise ServiceError('cancelled', 'Request cancelled.')
+            if time.monotonic() >= deadline:
+                raise ServiceError('request_timeout', 'Send one JSON request line within ten seconds.')
+            if not selector.select(0.05):
+                continue
+            block = os.read(fd, min(8192, 131073 - len(data)))
+            data.extend(block)
+            if len(data) > 131072:
+                raise ServiceError('request_limit', 'Request exceeds 128 KiB.')
+            if b'\n' in data:
+                line, _, remainder = data.partition(b'\n')
+                if remainder.strip():
+                    raise ServiceError('invalid_request', 'Only one JSON request is accepted per process.')
+                return json.loads(line)
+            if not block:
+                return json.loads(data)
+
+
+
+def dispatch(service, message, *, credentials=None, sink=None, cancel=None):
+    if not isinstance(message, dict) or message.get('api_version') != API_VERSION:
+        raise ServiceError('api_version_unsupported', 'Specify api_version 1.0.')
+    operation = message.get('operation')
+    fields = {
+        'capabilities': set(), 'staging_check': set(), 'list_customers': set(), 'list_hosts': {'customer'},
+        'inventory_hierarchy': {'customer'}, 'list_playbooks': {'customer'}, 'prepare': {'request'}, 'readiness': {'request'},
+        'execute': {'request', 'expected_revision'},
+    }
+    if operation not in fields or set(message) != {'api_version', 'operation'} | fields[operation]:
+        raise ServiceError('invalid_request', 'Unknown operation, missing field or extra request field.')
+    if operation == 'capabilities':
+        return service.capabilities()
+    if operation == 'staging_check':
+        return service.staging_check(cancel=cancel)
+    if operation == 'list_customers':
+        return service.list_customers()
+    if operation in ('list_hosts', 'inventory_hierarchy', 'list_playbooks'):
+        return getattr(service, operation)(message['customer'])
+    if operation == 'prepare':
+        return service.prepare(message['request']).to_dict()
+    if operation == 'readiness':
+        return service.readiness(message['request'])
+    return service.execute(message['request'], expected_revision=message['expected_revision'],
+                           credentials=credentials, event_sink=sink, cancel=cancel).to_dict()
+
+
+def main():
+    parser = argparse.ArgumentParser(prog='aimctl', description='AIM local service API; JSON requests and results, no terminal prompts')
+    parser.add_argument('--version', action='version', version=f'AIM {__version__} / service API {API_VERSION}')
+    parser.add_argument('--config', type=Path, help='Trusted operator configuration path (not an authorization bypass for a privileged service)')
+    parser.add_argument('--credentials-fd', type=int, help='Private inherited pipe/socket descriptor; never stdin or a password value')
+    parser.add_argument('command', choices=('capabilities', 'staging-check', 'request'))
+    args = parser.parse_args()
+    cancelled = threading.Event()
+    def on_signal(signum, frame):
+        cancelled.set()
+    old = {s: signal.signal(s, on_signal) for s in (signal.SIGTERM, signal.SIGINT)}
+    provider = None
+    try:
+        service = AimService(Config.load(args.config))
+        if args.command in ('capabilities', 'staging-check'):
+            if args.credentials_fd is not None:
+                raise ServiceError('invalid_request', 'This local operation does not accept credentials.')
+            message = {'api_version': API_VERSION, 'operation': args.command.replace('-', '_')}
+        else:
+            # One line only: callers need not keep a stdin pipe open until execution ends.
+            message = read_request(cancelled)
+            if args.credentials_fd is not None:
+                if not isinstance(message, dict) or message.get('operation') != 'execute':
+                    raise ServiceError('invalid_request', 'Only execute accepts a credential channel.')
+                provider = FDCredentials(args.credentials_fd)
+        result = dispatch(service, message, credentials=provider, sink=lambda event: write({'type': 'event', 'event': event}), cancel=cancelled)
+        write({'type': 'response', 'api_version': API_VERSION, 'ok': not (isinstance(result, dict) and result.get('status') in ('failed', 'cancelled')), 'result': result})
+        return 1 if isinstance(result, dict) and result.get('status') in ('failed', 'cancelled') else 0
+    except ServiceError as exc:
+        if exc.code == 'event_sink_failed':
+            return 2
+        write({'type': 'response', 'api_version': API_VERSION, 'ok': False, 'error': exc.to_dict()})
+        return 2
+    except (ValueError, TypeError, OSError, RecursionError):
+        write({'type': 'response', 'api_version': API_VERSION, 'ok': False,
+               'error': {'code': 'invalid_request', 'message': 'Request/configuration is invalid or inaccessible.'}})
+        return 2
+    except Exception:
+        # No exception repr/traceback: malformed input may include secrets.
+        write({'type': 'response', 'api_version': API_VERSION, 'ok': False,
+               'error': {'code': 'internal_error', 'message': 'Core operation failed; no unsafe diagnostic output was forwarded.'}})
+        return 2
+    finally:
+        if args.credentials_fd is not None and (provider is None or not provider.used):
+            if args.credentials_fd >= 3:
+                try:
+                    os.close(args.credentials_fd)
+                except OSError:
+                    pass
+        for signum, previous in old.items():
+            signal.signal(signum, previous)
+
+
+if __name__ == '__main__':
+    raise SystemExit(main())
diff --git a/scripts/src/aim/customers/__pycache__/__init__.cpython-313.pyc b/scripts/src/aim/customers/__pycache__/__init__.cpython-313.pyc
deleted file mode 100644
index 875ff51e911c17a48ba9ebec0ad819a2f8da06ce..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 147
zcmey&%ge<81kYx!%mUGmK?DpiLK&Y~fQ+dO=?t2Tek&P@n1H;`AgNnM`l%(!`iXhP
znMpaR`o+mbnFS@q`o%>+vCLfk<kI4j{M^){V*U8|%)HE!_;|g7%3B;Zx%nxjIjMF<
VtUx0`RuqF6ADI~$8H<>KEC7zrBWVBt

diff --git a/scripts/src/aim/customers/__pycache__/manager.cpython-313.pyc b/scripts/src/aim/customers/__pycache__/manager.cpython-313.pyc
deleted file mode 100644
index 745b3797f8e3e5b58eee08962b386c6d96c23924..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 20499
zcmcJ1Yj9Inp6Av3ZOM}S#`g6CY+-C;8xw33hymN!#s+jPFbJX+l57-Y$$hU3*mQO>
zQ(HZDQnQ#&XE2rCjWg9XF}oka?9NPkX1c0jG67OuH6tM>^4xa1n3~LN<;#{cP{j`U
zvj6|Nx>vH0fpm6`;oNi2J@41=|2lePGU+LB|9a!*8^Jb;`e%F*ok|GE9{nE(yhkw<
zBO9a!WUP$FuzXO?%E?o~D#%mGD#=sDs^F;@R1aua4N0pU)DGxa9SN%j^#cahK*H)l
z<A8}Z4dk(T17_At;xvPnfqXWfgtdd#0UK*0Vcnp8pnxqPVf|p?KoMI+Q)d*;onmv-
z&uWS>w9ABdw&aYan1UE%DaDxD<w9(GDluD1zU9F;v-piI8<#sQUt<b~j5m10;YidQ
z4MxJ;Fud#h-l*3X@^T!!D35ug=ka-}d+3Nm!RH;E;-Zm>0NZmp$VEBcBEAntqP>x+
zu%EY_@P>j=1Qgfn4Tb`K$gRC7#04O1>JMKGgrgC5`bflg0U}Dglarxo&xAMZ9S`_D
zlL2-j$Z^;j_-GqvBU6)}i(b|f4NOdiywLzRv*mSncjIYq<IK*+j<e}tlc(|Q_F7-6
z<K&?bUSyBXK;S*<48_VA3MN&?Dz?G|!*nXns2F7(e1$hPc~hm{G~`X4def3OP3lcY
z-n8UR$Lh!R4nuk<4h6=%Q=usLwH=D(DPF-vS>EK2On8G~4>vV77QD=x!-43f2z$Zf
z_50ZX$MG77nDBBJc$3%f@rOB&ke<(nSNL=;7!jjxQo~T2*5e6#CjuT1ulIN+BL1lm
zhK(N252w7L)EBeIGZtjIXebyCgd-jgYr_UXY{ra3EH;xZK(7$JB1}}^@o=~%d>(H!
z$_CF(!MH=xV)*t5{!@HQb0F$#_J+COxlo{)^RdCnDA&xf5Eq<i_N7({*DOpc+cY`N
znjs(YutE+O=pRxKOUm9Fnr}-e%T~+E-#R+aB$VZ=wt~0%W+7Ctn*Lf|8B-R_b6+Sc
z*-EjT4O5+3_p(QS4WBnoH6t&jV5$okMJe@$683H(qa-0UQ^cr9NW&B}Y7){iC5(oI
zbWACuB_Tai#^^}M0Hx?j$jEGA3?yWN9I*GG<UFRFF_Dm&sbFBwL7W9bW)jM0Dj5q2
zS)ty160$*gRuZx^Hnw2g?x1<IxTl85mSDdwhaUM-{evJyVHlRS?2!cm?@^<c5XKTW
zPTiCZ-<0ucUnD#h9CyfhB^L;dvA9$@%tzBK4G&yE!Ei7Ni>5fMz9#WY1?JI!_ZGEU
zxaE%wWaM)<WEZ4*k8)8?cxF3iX46w2U9v_4Mb%R5R)}!ON%MG9P&^tu{vdl(&ep?6
zUWu!DL(`R$a47Ni>}F$Z73AP>1w)g~wyRg>t|ZO%adZ9BuDH25rfn9wkUBXb8ATxm
zkg@z31inib!ZMf4nL-dONOa=Ki;YL;hwe8+SKT<0#4)l`3i9g2_w-ZDYoo-Fc*@tp
zC=L5E8?J<G0BEvD{~ZD~6ipg$qYn2|R3zV-nKD(rSY&3yhDs=GN{$)I)is6^n<JLt
zg`7iOo0V~qdQU}DLxU7$fcA~cUQvw69P+2CCO9J+hXGF1K{(ZdEZYQ4<n?gkuu<+(
z5D-Vs%bRxcvdIneuG>2v2nQ}tvitbD?8y%S95w9?MSR{6x35V`i0$MMK);3+5i1z`
zlkj5xue5)q{gwXRvHLCmu=}&!$-y)6!85V5{^Vfb-LZM^^|3#ORR7N5*7}3uZkz1C
zRe*PgvVreVk%h|cz~-t00tBkL2pbLfc}*}HV4*Xxnz2@1$wng44eeKABcENj7+VWD
zxIN%yt=m~;Y8hXBbM8$z7-##}%mwj+u|@w!p$|hp4<`!766Ud(cI?@`iP%RL_AmtA
zquk&N&WT^LoJ*EHvwqm0ZfSWl()WOD9GBwEAmBKnI_*oH^)&9&CfdaX=ujXEW5Mm9
z!&4LINWc$6v4aNs0N#8NK)fAvgr(0<Po58ixh7Z%hJ!9<<mgb3)8p*nbz@VZ(1bVY
zJJ0KZoR|vquxx~78==t~1~d-{143*B2pIAe*{fpX_wAS;NBS*l&0Lx^*T&7Yiz7+%
z_PBZbnsrO8{EdY5Ld<w!T|rqIgaOSQD(R#+2Svb1A<MPNTtHkf@(wvoxuv|L7N-)j
zWI3lgD*|3c3Jo?3<xmViRZT_58u!3)t__5J5q~f|?ojgjODrrkpocC;StDc;4$nL`
z@WZJf3ltO~nH&nT3fX2zz-s^uqCj+U*d$s+0JVn{#1}p@Y9t=_WNNflwZ^OFIrD;M
zsczOB*S4-{s}^fNHrzBM>kq{14}7jY_?+d3qfXA%97j@m*)b_Vz@??d^Py>aA_N4W
zCe<x*S82uNwqYTd{3)8tL!hBNyGI*7w_?YT)DiaDkLG@~a5!P!x}=YrTVvYRXS;%f
z3?nCdbQ$~?cO@)$$#d<oXU<=J<_;6TZUhQgO0uv5%F6*3jDk^i$mCR5=~6ghw`Mz+
zQry$8%Ea>;!HA}IQek9Z;4i)4+$J&qNtHWK42$2T{P4w{FMefIE_oi+CKu}o$kHc<
z8;MQgTq<XQ7*0PKHKP$r&u$-lNi7y9VtJMmN6HD<mF*a<nDd48>%MROFRVfTA6|pu
z`_}M1$I$qF>t{?Is#>aw+CfPx3}${zPE(bzPHC!7HazsIqLKo-A#WH+S??I~kc#N^
zB-;mb&mIQv>2`6u)8am-CjgY_a{<~*BjZX>0FMcWXD3ZqAQl%eFKf!h`P@_qNpdhn
z4ik&yE!&A6VP^0I=arGkK$usCB3?hQ4|2gUkTGFjfLHp1z9@ST6I(HzVmuJ#Rlo}d
zCwX;<JRNG`kUoxy$Vsi7_D+O&HGB<tC!h#m#W}164sCD(<!-{NJYrY*XAZj!pK-Hr
zLolY~uuGb&;^wNw`h>Y*17)#ht4Y|l#*ACn%(ew}+*}D?P5D<(&7E4*%$|yy>X&*~
zZAI5Ru5~P&NZ4wVw(U#u*+WkhRG#B2bIC&O&y`8@*0^~qqG)CR{o4D5vGQXH>+zWJ
z_?o$Lt+af>|H1hi=NEr(S)QoqN>+3)vx(9J$<o8|(!+_;fn@3Nc<J$&)0HSav9_gh
zQTdVfLv75_xqKi&?@!V_w_6iidXrm@#J3ztY#Cm&7cD41(B9B4mMk4e6gMY}+i$fd
z?7Nfpy>a{Agni$4tFHpE?4$Y*>thZ3Zp#zZ2b0zPx7kF+K(gXkyy94*!ugFsZPBk&
zYMuUx4m$jWss1U4kZ?y=*1KJCce}o~L*oNvken7m@Gg5)3?#!#;DsVhDu`zroaxG(
z6gUtUKwv036f^~=zQj^UbxVwcxSza0$U@2-_#xJH6l5ZR2T)^3qW4@XDL)PQl}-sA
z(lx=kj=LbsF)Hx{7N19DfH!KF8aYP{rSZe1cH`C{PQ(JSUOysDf%uhCyA&Id#-+}M
z4S<v=qsVg3vaASr6?^YQ?mElCsRla+9h8S$aF%;sd60w7N)E3t$Wi^>a=ft3wco8g
zM%yIK8W67A#N1ACGQ<dYf}l|c>j|m4EXU|O<Wn%mlb78{sT1dt@Hniipxj7P5|>-3
z>C!L;M#UIA6hPJJVbuYDo9#y55LXK90KHS3#*AcQ6!aur-|mbAsbDqc?|3#|%rCA1
zB9PrcEB$}nd4|!y=)6QxUgWn5#MXcyH?;zRrUL$2aHI3iy<#~1bnZ)s#ZY>TGRELF
z@oV~7O^v>rPV3S+5wEfwqh#_rWH8!_=OOj*I|5EuQO_@Bj7s6TdH8EsEY#P?8UX{S
zNntdv<$#d^b|=8ABV%J+AUYyI{Ygm2j-q!8yqP>AL=aK1@ur+tPqG1&ttx;C=Vg}&
zZ7|dMEN$RB?+t^bnFjtTz=pk{&~z8g1`suYVi*JFl;*q_k=2s%dLoJrk9#5)9MuB)
z6U<i!fs+kK2`Rwq0jvF<bJHLq<;~CrF2G(4fE+dg5iGLZyxJcC?k&Kg6q-GY9v;WM
zdTJ5?J|GYr9*q70dO1iBUW?N2F%YN2I9=fI1-k2Hu?=`;^YRGCtH=BTDdL}k&#JM|
z6n7pT+;rFn-ym-|lI9m#5Xt~!$Ob^Bjzc{a1}X6chcQi%@LF+j32DN5F@rY32FHUi
zXsnM^JLc!Lq-fy%fh?PtWY3XueN!wpj^Ly~y9j=Yf`I`JJcokW@VOTX<koXiFhH%m
za}h`tU{4KmhK24W*{!NsLtMLSwSEV(ryrYcn&x+1-+yiYimi5e*Q|E6vSwDfqTTY_
z-TP*vSEuKu7m7cqyivJSlqhLgF}L160EHRMb9+(Ja%gQMWm6s7dNg)y<o?B2&54Bd
zWXyOnRqtx~)?|5Gyu2-0-VrbFNR)Ra%MZlM58Q4`l=rPx)+H-niC4aotb8?I`D&ta
z|7uZXvZyXzRF^Djj2AT~ikhEaK$Rm|)fKPmN>+8ptGW|a2Z0_b&_4!x#PB$eDyE^Z
z2Ss(U=KZ%v?z!){<3-2kjI;8!JnQ_PcfzxZb-6)Tzm{*iUh<QYh1Lab>Ewg__T|D=
zi~YLpnr@+X#ZtFwDZFmHX8dX1n#Fou`xEU#;Roe6%HOYCu{fS+DC_QZEwy9k$6YtO
zK7RG)tMmTrk!z8a!n$SuY~QN6Fk!A<E8G^V^Cb%XF^hlAxOLHoX_E~-@rIriWAB<V
z@9MzY1M}R9vFf4Ge05-MV6k>~Aa1M!(blZtNfFfWd4Bu1>vqay5x+h#);;AAhwiEi
z`}a_Hw{)xf>lF8@yLZ9cXLb7icFkuk8Vv8rAJ8c_2&IuIBIK6^_UentFF4q!T<m&U
zHbEGAi8O-JQ%(d55hcAyvPdKu1M=Z4l7(_=#k}dK6T|@7E*H54gr6J;KRHbSkV=FX
zwEZQ^+$1H+IkOzpqeKET4M%Pimk^hWyaJLyg?(kzZHi55$<aqf(;*2C!ivm3jqc3Z
zr{}bk(K5PbIU$;Jkb0=G*`!@t#D1lp&&u9`05H6Kene|8aF{^8pr$IzF-8&CVcjV~
zTn~#VtQu`cbqEs4&!749ypR6iyN=P&D}orFF)?{$w#;pcowBgTT_rZrT_c8E(#&kq
z?;HfCNJcp8#8T2vai>6kuTaz!;C@(z{^T5EVe(P$9oEBolgLIfeb~TQU51b(1aj%C
zCBi*ybQzs3={m$vn&gBLRx!3tpc%+~<V?-jGv>pPi{NyNjRC?&OzSd=y@fiAP8iv2
zCuSO*!r>TtQy6=f<^`hz<Q*B8v%-pSqDmmk<zfrP+QgFx#e75X0<(w9G0O>MyChoy
zP|*Mhi7FbGf+-*?F)w#cR~}PH)=p8IB0U1`SH%iO|A{FkvTunbb-pHkOFx0=Y)$8O
z$&su~GlCk*3nU>5fcoUa2SjoaQXCLVfE2JIV7(j?W1L7NWH})36>yT3V0!|TSdOD~
zc&0?634x9Q+HD$0L9}M*q(^{^)ChDH2Qqhz1=0`X?>e9<13t7`V38-`WsPhIo-=up
zeFE1Elq9b^AAu|vy`bfgWwZz2NYK^ofIx<>4vxhzaNhz@q_kxqTFBIv%@{JO7$zEc
zkcA^V!>h=bOhGt{>xFL<`<GH6H~FBKpfLcc(v&Yc#RhUH$}T}h4h5=2QC9K#g9B%m
z3l__kTuXhQSMGwhf9H@;{{yRC#;br-oVq+ykkK#_)7->y=VyvCqG3qD0w5ShVg5`-
z4ZX=H8mMlXm+4tpwrG-~Wk5<69`8TeJ5!#Kg^NtW@LnEAs{*0SsgsbQCS`>HvVV>P
zqY8f~U47*WogGWR`DQg;Lmv|oMd?dH)=zt<IJ&VB>@FHHGyTagL0uJ&OiTpA`ln<r
zInwk3=t!rYrhVswA+Xm7W0<CA3WR4yJbmR&y+g*LKo9z13XTKK9q<HDeZ@IySzNFJ
zHBE$wNGoJ$6jc)!P#KD{r4)I7lo2#vNPMst!9()jFOdJpzJR@r8I59K{3Zmw53m6s
z>x2(1N^AtlqY*ihpfBK=f&i}q<<SJk%Yza2k1+`lNfd8Q(fXdTP~;LUlxg5JR74HL
z!htO?ExZ;an4oZ*3b2<kZU{XDc6J&(UJc`dT!60UvM(@+_CFxUJU<l;f;^L*0D)$}
zVHUUx<jR3DK{kR{lFk^!?G*$bN&(Cm`(Lo!-zVjshb;;t=))M&VlRfyp?3rmsBq75
z9FjyhD;ZAUHZ0l8pQm56LC!;2+znWbAT`w*liISlwrt_hindB3o8L9hs#Xn_t9$46
zUfnmhZ_P@_YW6OVEceE$4koOJV#Y%c1+FBit%_@_lG?hsw(gd4IU2*zp>?@Jmyfiv
z|Dy{ZUPx}+AK$kBw*6k&ow8)NJKpV%jbC_R3_Vs;7W+>RC+)Ql?6pgQTZeA#Ud~@S
zDkeM~?>-&3yA$R!v&waOt<Fjc{CM!@U~)%qd`EB0dEx<ZDP;{y?pSHZ?BJ@gC~2&S
z!@r8xZ`a;yxYLk4a2B?9qT=-x<Lf}nFVud}aHAnv+8!@$Png?REoDhdb=*=NtLa>^
zbp58NdS0=*g}yN`uUoa0TsL1cFDY+D=go1;-ZhJ3$?*&KpShFmN8{~BV{Xri<p<wr
zsN$M+BbC2B);M_o(EZ)9<4mk!WL+Vz&zn6AovZKqW!v)9-*n!N-n(+=O0v%r@AD+;
zevqsii`R{PQFlIWshL+?dwqWFOH18aQQ5l}=asA5o9C6lv;1R8)%&IM>J;m;aAL($
z`_NVh-AvdzR_&$Nk6b$vtGcpc|50kjepb5>eSiDn*ovibmEQJ|`9pJpZkgA<Yx<^u
zst?N63#lr{M|mISeL?TMW`u6qi?0nNZQJ6uZAn{W+}4=1H79J%5Pf~{+Tfz{L;X_U
z7xrD>sHmzIV2=t)7P{j0ZL>YAM$6T~xxochtZL7)eOVpbcQRHvx?()FX0*?{9vHVH
zH`M=j|Ga<2SiNd1o;~t^ANR{BOVJ}rrpxDzmURU@zkNIaaV3u^InJr|>d@Om3$;uB
z2gbHlWB$4dVg=^tPD9(EjrydZciUhs_1XSz8$5n((+^fDeof2JudO<wQf!b-<B<bs
zBzuG`4=_jaTuN+_oIu7$A}LTlg*ZlBrab_V3OSggH2cKJk)&W0#8(pXLIDyqJa@8O
zE-5w0167Qg5EW30;Bx1NcHq&O<($BjWjiQQLl_(&(*-B>SP86*G9*dMQBw-F6^QB5
zPcer$K3;&L3Y4@1X_D=bJwfRxNHx{K79h-KIhR@_Ewgo@L|1D7xu_vcGPxzj!liQ4
zVo~CEu|-6JE=jk6=+Bm*tDH4r-t-g9L{pTDOHSmHaLkWxWz0y%Zqhr;hTd&WmnDWq
zPl#<pRw}D6(yRj8_mcCMF6{*}$@fH=q`OpXi$FXA+mjv{BaRGXa%q5FmvrVXO+d~V
z!kTW)m`o%dH`h}R`%_ZQ{FwnJ5T&E%1N2D{5=Jg@5+Q=<3zX($DCi4DL(}vnASMEI
zN?-`&4jqA9tUx2tNJ2KvY|B{&QEr0GE-E-d5*VH4^=T@J*IW|neX13yq!IRQ=so*K
z;PEmxtvDTiY7vcih?X=Mrk~0?>8A~1t)x`aluZ??yiugHuzPF->TuXtBFsF9l^#Qn
zkPA03L}(jaN`$~6v<J)KE1`!@W5|u(pQ4AmFhgegI=&(`;?QPFDY0H8JknB1fmA>O
zfmZ}B`#3FxM5;g_35r3i>`9FiSi=${R)IRI&n68vOZh$&%1y#nd5d~zE4#k$+P;LX
zW>))Ka}hBm>Pc98W5(WxV1y_cm>A>cUALy==GSg_#?3>L+%l;xiEB$1Yj4?O7}`y&
zYd&iDuwg0s@s*oblFj|`=Kh%L)C2A5uTlcflo)f>oKFOnSG(rAuD&|=>bhKMa>`Z<
zO0J)}b_zv(^QYnkDC{e%{Gj7T$Kr`Z*^Xpc>n-^_>TU~nKh{$AiUt4A4<&7mxXpob
zJjV#s6dO4mt8*s`&%`We9vaM7_ss2?A5Iu*7B43Z&8syH^FTz<tN8`jORkkHv@I3Q
zm&Eg1Zk>>bBfw`U-`e^W5;$pkWW@*qLlpUyK;54gw14}RZ42NYG?~=gv0S@cxXj+J
zxm^&e>q`_KzVC}!j(-b?2q~UE$%6tv&u@9k9e|PlTZg4*7xlLtWj!^DPwZL<|6RSc
zw^;FMjlQQv^J$|3Vm@sl{w{rQf#TDB)?SO^u0;jmyT$t6ZJOL7!`}+1NaaGs3`8Tw
zN}0I!(l$S^K>%}+mCACtbh)5;0X!nuCm~Yq+<<*KL~OavQz%i5*atZzA!52IV7{i=
zq^um`H#jx5nSuah<<nL%B0`42PRXSRN$mral;=cAz(~eGP!cVga-pPjI_E@5BLjbF
zY)GRdSTxaMAI0yRprkq5q6xIzxlqy~qGVX((wy54v{4$9HSXHYYV!i0{d^&i)Gj!`
zUVbJ(&}AVAoqJ^SH;k-9Y+d>}IwFn>AawRPN^5VFe%V!)E=>^cY-ZmxoY)kh)fotF
z!dU?dM!f-{)qv2(u)16Qoe<hO^Pfb7MoS&P7sLP}-~p5%qf8U1z67?Z8^Jrs(J6&s
z^SO{We4$CNC--0wyu*=jBLU--K`beQn6A^HrxRg5;BV5i{}aZY{a@()Id~c9Jd>A+
zMPRM;9wzz=^!m^{4BjyNml*s7ddukj6?z1B3k0+!P`WAP0y#&qAE1W>xB$K{fxBp@
zA;5Yz0%zbZLaqS5e}kbPgO>w*%fRFpgisRxrUqTW--c}beNJNRKKEY<1h4CXQ+^K8
z3U>jB5w*afC5`2AWBH>0)<_IPof0p8Yu7Kj{;Vt6HWY6gik&+902t#GPp4eW6A`&D
z-rN^!I(%Oqs~B7{9s%2^*}*Jq1}xSM%W{BZQQ7tBYtxH`iK6;sQPa|ac_qP0z+y{j
zrX>~V8;`|~yJE*q#A;3^tfMjG=tFDa_4;e|3;Pn*?X#LygLQ8I&t{hD{=7|4G2YhP
zGu<)WGv6_<*3^B}^<h`CrYm04HGAm$;&qt-z2AOiE=E3eShi+`*0taA-#W3}y6jta
z#cELKala;J974Q?6i=U6HsE!OrMHv%L{`@8P<*mQ3*k?jtbG-VyAFNtE1J7)3W&M;
z3h_JjePxP!N^4)C;$EQ&!xj3z9U5OIX5!KXq?SGU@pJHc)GD4rVP%?gl~73q3OZFt
z4kZysY?PF_P*}{7OW`7(*4`6vS}Su|;iA$G)M?23X#h)1VtwhSOR_e~fof{P|Ek2E
zfY4h)ZLpq_Fj@RAwukV3Hn9${o>FG1A{C5=C`N!=1Eo`em@@qYo;9P^P15Kx(;S@#
zfxDiR3Rno(RhTYK4CPWEy3~wtlg<Dk9irIL3s91glmtgpns;;NP}hO-5fxhUT*@|a
z=GtMEpmSCU&rF}mlaO5dJG9yC(l$bIj0JtE{f0CZ#N><R2V|S95bK5&l7re99T(>p
z&>7_+88hRS`0dfxa*p`6%-#y&bZIW-^K5#+`gV_q&zmB6cZ&11&Fnjg7ZV8Y3wO>y
zT>?fnBC>)E7A<Ci-VhzR2#jLTAE1M94V0D?CQT#RNH<e`7$mzd;6K&EMM(mKyhX%M
zQ5C=&x$^+Oeh;}BG_xJ_0vGXerUX7DUSa{oY@jRP^`vD&KE3<()OFJaUgnu8m5Rx(
z&oiTdyfd^bd?6gU6wcLsxU32CZ35VK-jaehX%y0^4A#zY1C!T)K8Xv?1lTl4r_G2C
z!hG_I$;hOjML<~R<t$j@a8u_%O%u5UBkh4mL5NS7??HHV=rR~+<=7AXVO}LPs~Hn}
z(et5)fX*u}1g1Hp0Yx4<Wrtjq$r_Umq$e4#qy|EKOE#LnFiR5Z;Vubmwb_=sqcfT?
z@0wML);`(HZ^vB6J6%ab1^jz?xc$loHpywm7o_(+xBa(I#Hx-Y3Ws8rA&~9QA5Ivy
zAow4iJ3RmT;>e0|d+IG#P`70N+}N~gvd)JSrrMlvTgS{EisjclFxFzSP{LHbX0>16
z_LFT3<x7gCk&jQ`JpDh;B&?lD>uYiAYqxC)YtQV#+$9~n?Tgp--|van9T&^|3hyiJ
zPgq}z8DC48YR_|vC(&5D@m3+Wvwx0AnQPEWyXmWqH+ELE2L(>N4nX<~V5*<ckmz$$
z<5R8}Cg6^}td~}Ny4Bj-s<=z*dz&?PTlIa^Mk{9tgIi&?UU<JuE}nuCLV?^beOn|;
zo~(gJWVsCPo5+)0#D}{vIc=NaL?x&Tc=<cX7a^~T@W={AP2|;RjV;NF(+v~xMd}k!
z$$%je?xs_^l<AuiG*Aj~ol`qJQ!9$!aQBe=b3_v=9R@VsW@6`|m<%R?Fb(7igG0}D
z!#DN-dUzBF^nWfv8{r9%^oJ{q*jl2YWd9yRMAL@*o<k`<+2ce=#@>V1XH{j{2i7CZ
z`JchdajA|h(v&(3RVSd7Su9T2w=cQl_C3qH;`aTsx>apH-Yr{HE=BQf*)EiRIX-sZ
zbSE48;*EVV=HvtI=&HGR0c2)dLE7~UCBL9tI0vR>WIYRaw-nGC(P5w9UG``l0-G6w
zWl)N^o-*^N%E_K-FAX!T$ffrXQ|8idFtW~{f-wrvoG7;jnnmKQQ`Nu&=|vHr85uS|
z3{oJZ-%v9FzPe2XIteNltvT8*=7co{H8?b08*I*lMEy^DX&=#SBP=sSl}?ZLF*KkI
z++SsBRK()%E087VrNe<s%>qB0UXEz#2|Vuz2)Cuwz!L+GBeX||Ev;BdV<a4!ZlaIE
z?>TtEZi1tI-Z1jSbP(j$(=^!N`giCB5qNk1P#q^WNw~K@1(~2g8r9LXpwI?Ex-S~M
z7!YpsoCAa1OHfu*E)G21;ti}f4TQ%zD0c#QaHRW*HSyOlK-7$-CQXQt0hnpi*Sw6=
z3mK8o@1(tVpje0zf7~H*?hT-VxK4<oLGtf~0S>eXZ#3ENV5!g}MAI$RG*~ALcaQX+
z=%G&>=^iGTAerz(5s-3c6Zu0UhT)!(lSiF{boZe{&K`zIB?Zt={fY#nZf$RG694b4
z*4JdVp>>lsw30R)9XZ_N{10jZ{M<!K&5`OCof;z=R38Co<I9XW^aWC01PKiMgaItw
zF|c6XILMoKFf~-cN%5CAHV$n6@JNrdxBFlZ-G7W8K05Ndj5Ikyh1P*7O3TicRGl-C
zuy9W~W7b<?W=MMS5w5ktDyoLb-w^E&2*0lZ8zM6+eHsd+>mjv6nBVl^V(nyG3S;x#
z1{ZFn;n6RsWbR|=Gw|T*8fdPf#Oh<iy)^<Nh#$Nb_Z?Bi9D&zo?yVK2phGa@@kpEW
z*~|Q!B&1-gazBEi-=fy@K;E-~It06IQ4O*%^1-Par`~rb%Xh}hciw7Al<y)Enul<O
zt@B#vf^V?}Zo4gd<F<M*2`}8XczN-SbxPi1dT1(`9ayKzie&4ma+`8iv%Z(onb5X;
z9*jS#H-Q+03j#5yW!ns5GRPOAJjftlUIuPJsqB^nAi1Cgt=&Wt3vQ3g#}y9cus}NW
zI+OxounXG9euUl<co3U|5+GJyxFQJ+z+2eB1n_Gall6@4Om>P!oTV<P0BmPA!+e81
zX()>u%94iixS?D$ad4~vt!yh=HQS%PgDp{;e+nhPc#u&aBU~vDXWXt!50RV#%J4-4
zD$%UKb!Xj{9;Y_f1&@n2T;#*-bzz{7!GlFY^x5HW!dS9>bkfhCWK9BGAAw&~2t0dH
zUx?p@1C9h940uZ2cqn160$RylESRO})=Z@f9iN-FiX&aSVyr~IU|Z6(^$XM1ryREJ
zPl~$biaT<Bw`HSp42OxV?=S>jZs=czgd!p;q;H7JVJ#2JB>Xi1>33d0#2y7~h98mW
zq~Yfc2&+n#v=&MbfA2sV&JDkHK-NEBl+BH%ep{du2e1_i5e5*ih1lQuy$!S`5qJ^>
zWvu44gta?n>`tEsEQ(l$VLy?|QBsb^aA0T|CYN)-T=Of4o6+G9eYn90^K52P@{Lyx
z!&wf;D(Mss3NdXX=6fUo`!5g&+0d{sBNkIW8*9c`bw=9X$6OdIltpr7e*bIygze7w
zuFc5*_tN)&kV4ocp?jGnrBlAlcV2le5(zm9S=9BhrRbHRhhjd~fgTwTG$s~ICy|2@
zu3`Bx^oQtujNUKN`xSa|^ay_aBZk({dx##{gB2J;7MGkb0-sZjujrvg2zM5|A5;G(
zm#NAht7WR4kJU=mxa_e}t_sN>Yvrm#;LB8PkJV<C{&6*}vOhi~+o`fX9+Q<pxN{45
z`%1yvqX)0F0ld>Pm8#%zo>E0WF)CHU*+%MfY{4Jz8k<6sT=;P<!~tST$^IHc<e<I?
zA>JVUA{$&NQ(_F*C`ZqSg6GHt@CJ4Y$j?v{-W@0MBR&s*Km$x41UpQQ)nI|RO@xbQ
zMfh1dZJJU)q5{9Lf;w9GK{)sda<2=Z)*^=%Z^oF6A7&$F9PmqJ5G(Ql9I-dWUmBU1
z1TH~fOv#cX!@F_FdF@`|C(HJ+-$0G9{V2{09;gmvvM;IXf2MT5!GEUTQ06bGsxPVH
zf1$SgZ)zw`4Sh-N_>$WCCDr~V)%Y;aa`lb3--wm$N#u3BWq2slKas0s^g0FJBLyWl
UtmEqwi&rVL{~K79%Y?E2e_kCqQ2+n{

diff --git a/scripts/src/aim/customers/manager.py b/scripts/src/aim/customers/manager.py
index 82b683a..c65e519 100644
--- a/scripts/src/aim/customers/manager.py
+++ b/scripts/src/aim/customers/manager.py
@@ -1,5 +1,9 @@
 from __future__ import annotations
 
+from aim.locking import customer_locked
+
+from aim.permissions import preserve_replacement_metadata
+
 import os
 import re
 import shutil
@@ -31,6 +35,7 @@ class CustomerManager:
         self.config = config
 
     def path(self, name: str) -> Path:
+        self._validate_name(name)
         return self.config.inventory_dir / name
 
     def list(self) -> list[str]:
@@ -67,6 +72,7 @@ class CustomerManager:
             ad_netbios_domain=str(data.get("ad_netbios_domain", "") or "").strip(),
         )
 
+    @customer_locked
     def save_defaults(self, customer: str, defaults: CustomerDefaults) -> Path:
         path = self.defaults_path(customer)
         yaml = YAML()
@@ -95,7 +101,10 @@ class CustomerManager:
             current = path.read_bytes() if path.exists() else None
             if current != original:
                 raise ValidationFailed("Customer defaults changed externally; reload before saving")
-            apply_managed_permissions(tmp, self.config.required_group)
+            if path.exists():
+                preserve_replacement_metadata(tmp, path)
+            else:
+                apply_managed_permissions(tmp, self.config.required_group)
             os.replace(tmp, path)
         finally:
             tmp.unlink(missing_ok=True)
@@ -119,10 +128,15 @@ class CustomerManager:
             directories.extend(f"group_vars/{group}" for group in self.config.platform_groups)
             if "linux" in self.config.platform_groups:
                 directories.append("group_vars/linux/.ssh")
+            from aim.permissions import configured_key_identity
+            key_identity = configured_key_identity(self.config) if self.config.private_key_owner else None
             for rel in directories:
                 directory = temp / rel
                 directory.mkdir(parents=True, exist_ok=True)
                 apply_managed_permissions(directory, self.config.required_group, directory=True)
+                if rel == "group_vars/linux/.ssh" and key_identity is not None:
+                    os.chown(directory, *key_identity)
+                    directory.chmod(0o700)
 
             defaults: dict[str, str] = {
                 "group_vars/all/main.yml": f"# group_vars/all/main.yml for {name}\n",
@@ -212,31 +226,108 @@ class CustomerManager:
         return path
 
 
+    def windows_host_credential_state(self, customer: str, fqdn: str) -> dict[str, object]:
+        """Inspect host-specific Windows credential overrides without modifying them.
+
+        A credential override is considered complete only when both ansible_user and
+        ansible_password are present and non-empty. Older inventories often contain an
+        already-created but empty host_vars file; those must not be mistaken for a
+        deliberate credential model.
+        """
+        if not CUSTOMER_RE.fullmatch(fqdn):
+            raise ValueError("Invalid host name for host_vars path")
+        path = self.require(customer) / "host_vars" / fqdn / "main.yml"
+        if not path.exists() or path.stat().st_size == 0:
+            return {
+                "path": path, "has_user": False, "has_password": False,
+                "complete": False, "model": "missing",
+            }
+
+        yaml = YAML(typ="safe")
+        try:
+            data = yaml.load(path.read_text(encoding="utf-8")) or {}
+        except Exception as exc:
+            raise ValidationFailed(f"Invalid YAML in {path}: {exc}") from exc
+        if not isinstance(data, dict):
+            raise ValidationFailed(f"Host vars must be a YAML mapping: {path}")
+
+        user = data.get("ansible_user")
+        password = data.get("ansible_password")
+        has_user = bool(str(user).strip()) if user is not None else False
+        has_password = bool(str(password).strip()) if password is not None else False
+        complete = has_user and has_password
+        model = "custom" if complete else "partial"
+        if password == "{{ vault_windows_local_ansible_password }}" and complete:
+            model = "shared_local"
+        elif (
+            isinstance(password, str)
+            and password.startswith("{{ vault_ansible_password_")
+            and password.endswith(" }}")
+            and complete
+        ):
+            model = "host_local"
+        elif not has_user and not has_password:
+            model = "missing"
+
+        return {
+            "path": path, "has_user": has_user, "has_password": has_password,
+            "complete": complete, "model": model,
+        }
+
     def set_windows_host_credential_model(self, customer: str, fqdn: str, model: str) -> Path:
-        """Write the selected Windows credential override into host_vars."""
+        """Write the selected Windows credential override into host_vars.
+
+        Local-account models always carry an AIM header as the first line so an
+        operator can immediately see why host-specific credentials exist. Existing
+        YAML values/comments and custom keys are otherwise retained.
+        """
         path = self.ensure_host_vars(customer, fqdn)
         yaml = YAML()
         yaml.preserve_quotes = True
+        original = path.read_text(encoding="utf-8") if path.stat().st_size else ""
+        headers = {
+            "# AIM-managed shared Windows local service account override for this host.",
+            "# AIM-managed host-specific Windows local service account credentials.",
+        }
+        # Strip only AIM's own credential-model marker before round-trip parsing.
+        # ruamel then retains every unrelated operator comment/custom key itself.
+        source = "\n".join(
+            line for line in original.splitlines() if line.strip() not in headers
+        )
+        if original.endswith("\n") and source:
+            source += "\n"
         data = {}
-        if path.stat().st_size:
-            with path.open("r", encoding="utf-8") as stream:
-                data = yaml.load(stream) or {}
+        if source.strip():
+            try:
+                data = yaml.load(source) or {}
+            except Exception as exc:
+                raise ValidationFailed(f"Invalid YAML in {path}: {exc}") from exc
             if not isinstance(data, dict):
-                raise ValueError(f"Host vars must be a YAML mapping: {path}")
+                raise ValidationFailed(f"Host vars must be a YAML mapping: {path}")
+
         if model == "domain":
             data.pop("ansible_user", None)
             data.pop("ansible_password", None)
+            header = None
         elif model == "shared_local":
             data["ansible_user"] = self.config.service_user
             data["ansible_password"] = "{{ vault_windows_local_ansible_password }}"
+            header = "# AIM-managed shared Windows local service account override for this host."
         elif model == "host_local":
             key = re.sub(r"[^a-z0-9]+", "_", fqdn.lower()).strip("_")
             data["ansible_user"] = self.config.service_user
             data["ansible_password"] = "{{ vault_ansible_password_" + key + " }}"
+            header = "# AIM-managed host-specific Windows local service account credentials."
         else:
             raise ValueError("Unknown Windows credential model")
-        with path.open("w", encoding="utf-8") as stream:
-            yaml.dump(data, stream)
+
+        from io import StringIO
+        out = StringIO()
+        yaml.dump(data, out)
+        content = out.getvalue()
+        if header:
+            content = header + "\n" + content.lstrip("\n")
+        path.write_text(content, encoding="utf-8")
         apply_managed_permissions(path, self.config.required_group)
         return path
 
@@ -298,6 +389,7 @@ class CustomerManager:
         self._write(path, content)
         return path
 
+    @customer_locked
     def remove_host_vars(self, customer: str, fqdn: str) -> bool:
         directory = self.require(customer) / "host_vars" / fqdn
         if directory.is_dir():
diff --git a/scripts/src/aim/exceptions.py b/scripts/src/aim/exceptions.py
index 058e9bf..7b110a8 100644
--- a/scripts/src/aim/exceptions.py
+++ b/scripts/src/aim/exceptions.py
@@ -30,6 +30,10 @@ class ExternalCommandFailed(AIMError):
     pass
 
 
+class WinRMConnectionFailed(ExternalCommandFailed):
+    """A WinRM connectivity/authentication probe reached Ansible but did not succeed."""
+
+
 class ValidationFailed(AIMError):
     pass
 
@@ -38,6 +42,14 @@ class ValidationIncomplete(AIMError):
     pass
 
 
+class InvalidTarget(ValueError):
+    """Explicit target validation failure; remains compatible with ValueError callers."""
+
+
+class InvalidRunOptions(ValueError):
+    """Catalog-declared run options are invalid, not the inventory source."""
+
+
 class ConfigurationError(AIMError):
     pass
 
diff --git a/scripts/src/aim/integrations/__init__.py b/scripts/src/aim/integrations/__init__.py
new file mode 100644
index 0000000..a74b48b
--- /dev/null
+++ b/scripts/src/aim/integrations/__init__.py
@@ -0,0 +1 @@
+"""Private, core-owned adapters. Add-ons use aim.services.v1 instead."""
diff --git a/scripts/src/aim/integrations/ansible.cfg b/scripts/src/aim/integrations/ansible.cfg
new file mode 100644
index 0000000..d0cf0bf
--- /dev/null
+++ b/scripts/src/aim/integrations/ansible.cfg
@@ -0,0 +1,3 @@
+# AIM fallback for the local service profile when root_dir/ansible.cfg is absent.
+# A real .cfg is required; /dev/null is not a valid Ansible config filename.
+[defaults]
diff --git a/scripts/src/aim/integrations/callbacks/__init__.py b/scripts/src/aim/integrations/callbacks/__init__.py
new file mode 100644
index 0000000..73fc519
--- /dev/null
+++ b/scripts/src/aim/integrations/callbacks/__init__.py
@@ -0,0 +1 @@
+"""Native Ansible callbacks loaded by the canonical runtime, not by AIM startup."""
diff --git a/scripts/src/aim/integrations/callbacks/aim_safe_events.py b/scripts/src/aim/integrations/callbacks/aim_safe_events.py
new file mode 100644
index 0000000..e01c53c
--- /dev/null
+++ b/scripts/src/aim/integrations/callbacks/aim_safe_events.py
@@ -0,0 +1,359 @@
+"""Count-only by default; opt-in sanitized play/task/host events for AIM.
+
+No dependency on the AIM installation in the native Ansible Python. Raw names,
+module results, loop labels, arguments and exception text are never serialized.
+"""
+from __future__ import annotations
+
+from collections.abc import Mapping
+import importlib.util
+import base64
+import json
+import os
+from pathlib import Path
+
+from ansible.plugins.callback import CallbackBase
+
+_policy_spec = importlib.util.spec_from_file_location(
+    '_aim_progress_policy', Path(__file__).resolve().parents[1] / 'event_policy.py')
+_policy = importlib.util.module_from_spec(_policy_spec)
+_policy_spec.loader.exec_module(_policy)
+_output_spec = importlib.util.spec_from_file_location(
+    '_aim_output_policy', Path(__file__).resolve().parents[1] / 'output_policy.py')
+_output = importlib.util.module_from_spec(_output_spec)
+_output_spec.loader.exec_module(_output)
+
+DOCUMENTATION = '''
+name: aim_safe_events
+type: stdout
+short_description: AIM bounded, sanitized execution progress
+version_added: "2.19"
+description:
+  - Emits anonymous counters, or explicitly requested play/task/host progress.
+  - Never forwards raw module output or rendered task names.
+'''
+
+
+class CallbackModule(CallbackBase):
+    CALLBACK_VERSION = 2.0
+    CALLBACK_TYPE = 'stdout'
+    CALLBACK_NAME = 'aim_safe_events'
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self._detail = os.environ.get('AIM_PROGRESS_MODE', 'summary') == 'detail'
+        self._detail_failed = False
+        self._allowed_hosts = set()
+        self._target_indexes = {}
+        self._context_failed = False
+        self._output_contract = None
+        self._publishers = {}
+        self._output_errors = {}
+        self._play_counter = self._task_counter = self._sequence = 0
+        self._play = None
+        self._tasks = {}
+        try:
+            # Core writes only the reviewed target scope to this private file.
+            # It is required in summary and detail modes so final target outcomes
+            # never depend on a client reconstructing task events.
+            with open(os.environ['AIM_EVENT_CONTEXT'], encoding='utf-8') as stream:
+                context = json.loads(stream.read(524289))
+            if (set(context) != {'schema', 'hosts', 'result'} or context['schema'] != _policy.EXECUTION_CONTEXT_SCHEMA
+                    or not isinstance(context['hosts'], list) or not 0 <= len(context['hosts']) <= 1000
+                    or any(not isinstance(h, str) for h in context['hosts'])
+                    or len(set(context['hosts'])) != len(context['hosts'])):
+                raise ValueError()
+            self._output_contract = _output.validate_contract(context['result'])
+            self._allowed_hosts = set(context['hosts'])
+            self._target_indexes = {host: index for index, host in enumerate(context['hosts'])}
+        except Exception:
+            self._context_failed = True
+            self._detail_failed = True
+
+    def _send(self, value):
+        self._sequence += 1
+        value = {**value, 'bridge_sequence': self._sequence}
+        frame = json.dumps(value, ensure_ascii=False, separators=(',', ':'), allow_nan=False).encode('utf-8') + b'\n'
+        if len(frame) > 4096:
+            raise ValueError('AIM event frame is too large')
+        fd = int(os.environ['AIM_EVENT_FD'])
+        # Callback dispatch is in the Ansible controller process. Handle short
+        # writes/interrupts without forwarding partial JSON or dropping frames.
+        remaining = memoryview(frame)
+        while remaining:
+            try:
+                written = os.write(fd, remaining)
+            except InterruptedError:
+                continue
+            if written <= 0:
+                raise OSError('AIM event channel closed')
+            remaining = remaining[written:]
+
+    def _emit_detail(self, event, **payload):
+        self._send({'kind': 'detail', 'event': event, **payload})
+
+    def _guard_detail(self, action, *args, **kwargs):
+        if not self._detail or self._detail_failed:
+            return
+        try:
+            action(*args, **kwargs)
+        except Exception:
+            # Ansible swallows callback exceptions. Make loss explicit at the
+            # final handshake; do not report success with an incomplete timeline.
+            self._detail_failed = True
+
+    @staticmethod
+    def _source(obj):
+        # Base.get_ds() is the original parsed source mapping, not the templated
+        # name/task_fields. Never call get_name(), which can contain expansions.
+        ds = obj.get_ds()
+        return ds if isinstance(ds, Mapping) else {}
+
+    @classmethod
+    def _sensitive(cls, obj):
+        """Conservatively hide true/unknown no_log, including inherited blocks."""
+        seen = set()
+        pending = [obj]
+        while pending:
+            current = pending.pop()
+            if current is None or id(current) in seen:
+                continue
+            seen.add(id(current))
+            if len(seen) > 64:
+                return True
+            source = cls._source(current)
+            for value in (source.get('no_log'), getattr(current, 'no_log', None)):
+                if value is not None and value is not False:
+                    return True
+            for attr in ('_parent', '_play', '_role', '_task_include'):
+                pending.append(getattr(current, attr, None))
+        return False
+
+    def _start_play(self, play):
+        self._play_counter += 1
+        label, redacted = _policy.safe_label(
+            None if self._sensitive(play) else self._source(play).get('name'), fallback='Play (label withheld)')
+        self._play = {'play_id': f'p{self._play_counter}', 'label': label, 'label_redacted': redacted}
+        # Task UUIDs are internal only; serial batches re-enter plays and get
+        # distinct public IDs. No ordering assumptions about free-strategy tasks.
+        self._tasks = {}
+        self._emit_detail('play_started', **self._play)
+
+    def _task_context(self, task, *, handler=False):
+        if self._play is None:
+            raise ValueError('Task without play context')
+        key = str(task._uuid)
+        if key not in self._tasks:
+            if len(self._tasks) >= 50_000:
+                raise ValueError('Too many tasks')
+            self._task_counter += 1
+            sensitive = self._sensitive(task)
+            label, redacted = _policy.safe_label(
+                None if sensitive else self._source(task).get('name'), fallback='Task (label withheld)')
+            self._tasks[key] = {
+                'play_id': self._play['play_id'], 'task_id': f't{self._task_counter}',
+                'label': label, 'label_redacted': redacted, 'handler': bool(handler),
+                'sensitive': sensitive,
+            }
+            self._emit_detail('task_started', **{k: v for k, v in self._tasks[key].items() if k != 'sensitive'})
+        return self._tasks[key]
+
+    @staticmethod
+    def _hidden_result(result, context):
+        if context['sensitive'] or result.task_fields.get('no_log') not in (None, False):
+            return True
+        data = result.result
+        if data.get('_ansible_no_log') or 'censored' in data:
+            return True
+        # A loop can contain hidden items even when the aggregate is not marked.
+        # No item labels, nested results or values are ever forwarded.
+        items = data.get('results')
+        if isinstance(items, list):
+            if len(items) > 10_000:
+                return True
+            if any(not isinstance(item, Mapping) or item.get('_ansible_no_log') or 'censored' in item for item in items):
+                return True
+        return False
+
+    def _host(self, result):
+        host, redacted = _policy.safe_host(result.host.name, self._allowed_hosts)
+        return {'host': host, 'host_redacted': redacted}
+
+    def _result(self, result, status, *, ignore_errors=False):
+        context = self._task_context(result.task)
+        hidden = self._hidden_result(result, context)
+        if status == 'unreachable':
+            ignore_errors = result.task_fields.get('ignore_unreachable') is True
+        changed = bool(result.is_changed())
+        if status == 'ok' and changed:
+            status = 'changed'
+        payload = {
+            'play_id': context['play_id'], 'task_id': context['task_id'], **self._host(result),
+            'status': status, 'changed': changed, 'details_redacted': hidden,
+            'ignored': bool(ignore_errors),
+            'error_code': None,
+        }
+        if status in ('failed', 'unreachable'):
+            # Bounded fixed-code classifier only. Do not read stdout/stderr,
+            # invocation, exception, module arguments or any registered vars.
+            payload['error_code'] = _policy.diagnostic_code(
+                None if hidden else result.result.get('msg'), status=status, hidden=hidden)
+        self._emit_detail('host_result', **payload)
+
+    def v2_playbook_on_start(self, playbook):
+        self._send({'kind': 'started'})
+        if self._detail:
+            self._send({'kind': 'detail_begin', 'schema': _policy.DETAIL_SCHEMA})
+
+    def v2_playbook_on_play_start(self, play):
+        self._guard_detail(self._start_play, play)
+
+    def v2_playbook_on_no_hosts_matched(self):
+        self._guard_detail(lambda: self._emit_detail('play_skipped', play_id=self._play['play_id'], reason='no_hosts_matched'))
+
+    def v2_playbook_on_no_hosts_remaining(self):
+        self._guard_detail(lambda: self._emit_detail('play_stopped', play_id=self._play['play_id'], reason='no_hosts_remaining'))
+
+    def v2_playbook_on_task_start(self, task, is_conditional):
+        self._send({'kind': 'task'})
+        self._guard_detail(self._task_context, task)
+
+    def v2_playbook_on_handler_task_start(self, task):
+        if self._detail:
+            self._send({'kind': 'task'})
+        self._guard_detail(self._task_context, task, handler=True)
+
+    def v2_playbook_on_cleanup_task_start(self, task):
+        if self._detail:
+            self._send({'kind': 'task'})
+        self._guard_detail(self._task_context, task)
+
+    def v2_runner_on_ok(self, result):
+        self._capture_publisher(result)
+        self._send({'kind': 'ok'})
+        self._guard_detail(self._result, result, 'ok')
+
+    def v2_runner_on_failed(self, result, ignore_errors=False):
+        self._send({'kind': 'failed'})
+        self._guard_detail(self._result, result, 'failed', ignore_errors=ignore_errors)
+
+    def v2_runner_on_unreachable(self, result):
+        self._send({'kind': 'unreachable'})
+        self._guard_detail(self._result, result, 'unreachable')
+
+    def v2_runner_on_skipped(self, result):
+        self._send({'kind': 'skipped'})
+        self._guard_detail(self._result, result, 'skipped')
+
+    def _attempt(self, result, event):
+        context = self._task_context(result.task)
+        hidden = self._hidden_result(result, context)
+        attempt = result.result.get('attempts') if not hidden else None
+        if type(attempt) is not int or not 0 <= attempt <= 1_000_000:
+            attempt = None
+        self._emit_detail(event, play_id=context['play_id'], task_id=context['task_id'],
+                          **self._host(result), attempt=attempt, details_redacted=hidden)
+
+    def v2_runner_retry(self, result):
+        self._guard_detail(self._attempt, result, 'task_retry')
+
+    def v2_runner_on_async_poll(self, result):
+        self._guard_detail(self._attempt, result, 'task_async_poll')
+
+    def _target_recaps(self, stats):
+        if self._context_failed:
+            raise ValueError('AIM execution context unavailable')
+        for name in stats.processed:
+            index = self._target_indexes.get(name)
+            if index is None:
+                continue
+            values = stats.summarize(name)
+            counts = {key: int(values.get(key, 0)) for key in _policy.COUNT_KEYS}
+            self._send({'kind': 'target_recap', 'target_index': index, 'counts': counts})
+
+    def _recap(self, stats):
+        for name in stats.processed:
+            host, redacted = _policy.safe_host(name, self._allowed_hosts)
+            values = stats.summarize(name)
+            counts = {key: int(values.get(key, 0)) for key in _policy.COUNT_KEYS}
+            self._emit_detail('host_recap', host=host, host_redacted=redacted, counts=counts)
+
+    def _capture_publisher(self, result):
+        if self._output_contract is None:
+            return
+        index = self._target_indexes.get(result.host.name)
+        if index is None:
+            return
+        if self._output_contract['scope'] == 'global':
+            index = 0
+        try:
+            # Final stats lose no_log provenance. Track only explicit set_stats
+            # publications here and match the accepted value at final stats.
+            data = result.result.get('ansible_stats')
+            if not isinstance(data, Mapping) or not isinstance(data.get('data'), Mapping) or 'aim_output' not in data['data']:
+                return
+            if index in self._publishers or index in self._output_errors:
+                raise _output.OutputError()
+            context = {'sensitive': self._sensitive(result.task)}
+            if self._hidden_result(result, context):
+                raise _output.OutputError('operation_result_withheld')
+            if (result.task.action not in ('set_stats', 'ansible.builtin.set_stats')
+                    or data.get('aggregate') is not False
+                    or data.get('per_host') is not (self._output_contract['scope'] == 'per_host')):
+                raise _output.OutputError()
+            clean = _output.validate_envelope(data['data']['aim_output'], self._output_contract)
+            self._publishers[index] = clean
+        except Exception as exc:
+            self._publishers.pop(index, None)
+            self._output_errors[index] = exc.code if isinstance(exc, _output.OutputError) else 'operation_result_invalid'
+
+    def _final_outputs(self, stats):
+        if self._output_contract is None:
+            return
+        used = 0
+        selected = list(self._target_indexes) if self._output_contract['scope'] == 'per_host' else ['_run']
+        for index, host in enumerate(selected):
+            error = self._output_errors.get(index)
+            try:
+                candidate = stats.custom.get(host, {}).get('aim_output')
+                saved = self._publishers.get(index)
+                if candidate is None and saved is None and error is None:
+                    continue
+                if error:
+                    raise _output.OutputError(error)
+                value = _output.validate_envelope(candidate, self._output_contract)
+                if saved is None or value != saved:
+                    raise _output.OutputError()
+                raw = _output.encoded(value)
+                used += len(raw)
+                if used > _output.MAX_RUN_BYTES:
+                    raise _output.OutputError('operation_result_limit')
+            except Exception as exc:
+                code = exc.code if isinstance(exc, _output.OutputError) else 'operation_result_invalid'
+                self._send({'kind': 'output_rejected', 'target_index': index, 'code': code})
+                continue
+            for part, offset in enumerate(range(0, len(raw), _output.CHUNK_BYTES)):
+                self._send({'kind': 'output_chunk', 'target_index': index, 'part': part,
+                            'content': base64.b64encode(raw[offset:offset+_output.CHUNK_BYTES]).decode('ascii')})
+            self._send({'kind': 'output_end', 'target_index': index})
+        self._send({'kind': 'outputs_end'})
+
+    def v2_playbook_on_stats(self, stats):
+        counts = {key: 0 for key in _policy.COUNT_KEYS}
+        for host in stats.processed:
+            summary = stats.summarize(host)
+            for key in counts:
+                counts[key] += int(summary.get(key, 0))
+        try:
+            self._target_recaps(stats)
+        except Exception:
+            self._context_failed = True
+            self._detail_failed = True
+        self._final_outputs(stats)
+        self._guard_detail(self._recap, stats)
+        if self._detail:
+            self._send({'kind': 'detail_end', 'complete': not self._detail_failed})
+        # A missing/invalid target context makes the final accounting unsafe in
+        # either mode, so deliberately omit stats and force Core to fail closed.
+        if not self._context_failed:
+            self._send({'kind': 'stats', 'counts': counts})
diff --git a/scripts/src/aim/integrations/event_policy.py b/scripts/src/aim/integrations/event_policy.py
new file mode 100644
index 0000000..a841721
--- /dev/null
+++ b/scripts/src/aim/integrations/event_policy.py
@@ -0,0 +1,90 @@
+"""Private, standard-library-only progress policy shared across Python runtimes.
+
+The Ansible callback loads this file by its adjacent path: the native Ansible
+interpreter need not have the AIM package or its UI dependencies installed.
+Never add rendering, templating, variable resolution or raw-result serialization.
+"""
+from __future__ import annotations
+
+import re
+import unicodedata
+
+DETAIL_SCHEMA = 'play_task_host_v1'
+EXECUTION_CONTEXT_SCHEMA = 'aim_execution_context_v1'
+TARGET_OUTCOME_SCHEMA = 'target_outcome_summary_v1'
+MAX_LABEL_CHARS = 200
+MAX_HOST_CHARS = 255
+MAX_EVENTS = 200_000
+COUNT_KEYS = ('ok', 'changed', 'failures', 'unreachable', 'skipped', 'rescued', 'ignored')
+SUMMARY_KINDS = ('started', 'task', 'ok', 'failed', 'unreachable', 'skipped')
+DETAIL_KINDS = ('play_started', 'play_skipped', 'play_stopped', 'task_started',
+                'host_result', 'task_retry', 'task_async_poll', 'host_recap')
+HOST_PATTERN = re.compile(r'[A-Za-z0-9_][A-Za-z0-9_.-]*\Z')
+_ID = re.compile(r'[pt][1-9][0-9]{0,8}\Z')
+_SECRET_ASSIGNMENT = re.compile(
+    r'\b(?:password|passphrase|secret|token|authorization|api[_ -]?key|private[_ -]?key)\s*[:=]\s*\S', re.I)
+
+# Codes, not snippets of result.msg. A diagnostic hint never proves that a
+# particular supplied password was used, or authorizes replay of an operation.
+ERROR_MESSAGES = {
+    'details_withheld': 'Failure details are withheld because this task may contain sensitive data.',
+    'connection_refused': 'The connection was refused. Check the target listener, port and firewall.',
+    'connection_timeout': 'The connection timed out. Check network reachability and the target service.',
+    'name_resolution_failed': 'The target name could not be resolved. Check DNS and the configured address.',
+    'tls_verification_failed': 'TLS certificate verification failed. Check certificate trust and the target name.',
+    'authentication_failed': 'Connection authentication failed. Check the configured identity and authentication method.',
+    'permission_denied': 'The task reported an access or permission denial. Check the effective account permissions.',
+    'host_unreachable': 'Ansible could not reach or authenticate to this host. Further details are withheld.',
+    'task_failed': 'The task failed. Arbitrary module messages and output are withheld; use trusted local diagnostics.',
+}
+
+
+def safe_label(value, *, fallback: str) -> tuple[str, bool]:
+    """Accept only bounded, unexpanded source labels, never rendered task names."""
+    if not isinstance(value, str) or not value or len(value) > MAX_LABEL_CHARS:
+        return fallback, True
+    if (any(unicodedata.category(c).startswith('C') for c in value)
+            or '{' in value or '}' in value or '$ANSIBLE_VAULT;' in value
+            or _SECRET_ASSIGNMENT.search(value)
+            or '://' in value or len(value.encode('utf-8')) > 800):
+        return fallback, True
+    return str(value), False
+
+
+def safe_host(value, allowed) -> tuple[str | None, bool]:
+    if (isinstance(value, str) and len(value) <= MAX_HOST_CHARS
+            and HOST_PATTERN.fullmatch(value) and value in allowed):
+        return str(value), False
+    return None, True
+
+
+def valid_id(value, prefix: str) -> bool:
+    return isinstance(value, str) and bool(_ID.fullmatch(value)) and value.startswith(prefix)
+
+
+def diagnostic_code(message, *, status: str, hidden: bool) -> str:
+    """Classify only a bounded native msg; never emit it or inspect stdout/exception."""
+    if hidden:
+        return 'details_withheld'
+    if not isinstance(message, str) or len(message) > 16_384:
+        return 'host_unreachable' if status == 'unreachable' else 'task_failed'
+    text = message.casefold()
+    if status == 'unreachable':
+        if any(x in text for x in ('connection refused', 'actively refused', 'errno 111', 'winerror 10061')):
+            return 'connection_refused'
+        if any(x in text for x in ('certificate verify failed', 'certificate_verify_failed',
+                                    'certificate validation failed', 'certificate chain was issued by an authority that is not trusted')):
+            return 'tls_verification_failed'
+        if any(x in text for x in ('name or service not known', 'temporary failure in name resolution',
+                                    'nodename nor servname provided', 'could not resolve hostname', 'getaddrinfo failed')):
+            return 'name_resolution_failed'
+        if any(x in text for x in ('connection timed out', 'connecttimeout', 'connect timeout', 'operation timed out')):
+            return 'connection_timeout'
+        if any(x in text for x in ('provided credentials were rejected', 'authentication failed',
+                                    'permission denied (publickey', 'permission denied, please try again',
+                                    'logon failure', 'the user name or password is incorrect')):
+            return 'authentication_failed'
+        return 'host_unreachable'
+    if any(x in text for x in ('permission denied', 'access is denied', 'access denied', 'operation not permitted')):
+        return 'permission_denied'
+    return 'task_failed'
diff --git a/scripts/src/aim/integrations/output_policy.py b/scripts/src/aim/integrations/output_policy.py
new file mode 100644
index 0000000..ac24fba
--- /dev/null
+++ b/scripts/src/aim/integrations/output_policy.py
@@ -0,0 +1,136 @@
+"""Standalone, bounded structured-output policy; no UI or Ansible dependencies.
+
+The catalog supplies a closed JSON Schema subset. This is a type/allowlist
+boundary for trusted reporting code, not automatic discovery of arbitrary secrets.
+"""
+from __future__ import annotations
+from collections.abc import Mapping
+import json
+import math
+import re
+
+PROTOCOL = 'aim_output_v1'
+RESULT_PROTOCOL = 'aim_operation_result_v1'
+MAX_HOST_BYTES = 1024 * 1024
+MAX_RUN_BYTES = 16 * 1024 * 1024
+MAX_ITEMS = 20000
+MAX_DEPTH = 20
+MAX_NODES = 200000
+CHUNK_BYTES = 2048
+SCHEMA_ID = re.compile(r'[a-z][a-z0-9_]{0,79}_v[1-9][0-9]*\Z')
+# Defense in depth; operational publisher schemas must not declare these fields.
+SECRET_KEY = re.compile(r'(^|_)(password|passwd|passphrase|secret|token|credential|private_key|vault)(_|$)', re.I)
+
+class OutputError(ValueError):
+    def __init__(self, code='operation_result_invalid'):
+        self.code = code
+        super().__init__(code)  # never interpolate input values
+
+def encoded(value):
+    return json.dumps(value, ensure_ascii=False, separators=(',', ':'), allow_nan=False).encode('utf-8')
+
+def validate_schema(shape, depth=0):
+    if not isinstance(shape, dict) or depth > MAX_DEPTH:
+        raise OutputError()
+    allowed = {'type','properties','required','additionalProperties','items','enum',
+               'maxItems','maxLength','minimum','maximum','description'}
+    if set(shape) - allowed:
+        raise OutputError()
+    kinds = shape.get('type')
+    kinds = kinds if isinstance(kinds, list) else [kinds]
+    if not kinds or set(kinds) - {'object','array','string','integer','number','boolean','null'}:
+        raise OutputError()
+    if 'object' in kinds:
+        if type(shape.get('additionalProperties')) is not bool or not isinstance(shape.get('properties'), dict):
+            raise OutputError()
+        for key, child in shape['properties'].items():
+            if not isinstance(key, str) or SECRET_KEY.search(key):
+                raise OutputError()
+            validate_schema(child, depth + 1)
+        if not isinstance(shape.get('required', []), list) or set(shape.get('required', [])) - set(shape['properties']):
+            raise OutputError()
+    if 'array' in kinds:
+        validate_schema(shape.get('items'), depth + 1)
+        if type(shape.get('maxItems')) is not int or not 0 <= shape['maxItems'] <= MAX_ITEMS:
+            raise OutputError()
+    if 'string' in kinds and (type(shape.get('maxLength')) is not int or not 0 <= shape['maxLength'] <= 8192):
+        raise OutputError()
+    if 'enum' in shape and (not isinstance(shape['enum'], list) or len(shape['enum']) > 100):
+        raise OutputError()
+    return shape
+
+def validate_contract(contract):
+    if contract is None:
+        return None
+    required = {'protocol','schema','scope','required','sensitivity','max_bytes_per_host','data_schema'}
+    if not isinstance(contract, dict) or set(contract) != required:
+        raise OutputError()
+    if (contract['protocol'] != PROTOCOL or not isinstance(contract['schema'], str)
+        or not SCHEMA_ID.fullmatch(contract['schema']) or contract['scope'] not in ('per_host','global')
+        or type(contract['required']) is not bool or contract['sensitivity'] != 'safe'
+        or type(contract['max_bytes_per_host']) is not int
+        or not 1 <= contract['max_bytes_per_host'] <= MAX_HOST_BYTES):
+        raise OutputError()
+    validate_schema(contract['data_schema'])
+    return contract
+
+def validate_data(value, shape, secret_values=()):
+    budget = [0]
+    def walk(item, node, depth=0):
+        budget[0] += 1
+        if depth > MAX_DEPTH or budget[0] > MAX_NODES:
+            raise OutputError('operation_result_limit')
+        kinds = node['type'] if isinstance(node['type'], list) else [node['type']]
+        kind = ('null' if item is None else 'boolean' if type(item) is bool
+                else 'integer' if isinstance(item, int) else 'number' if isinstance(item, float)
+                else 'string' if isinstance(item, str) else 'object' if isinstance(item, Mapping)
+                else 'array' if isinstance(item, (list, tuple)) else 'invalid')
+        if kind not in kinds and not (kind == 'integer' and 'number' in kinds):
+            raise OutputError()
+        if 'enum' in node and item not in node['enum']:
+            raise OutputError()
+        if kind == 'object':
+            props = node['properties']
+            if (not node.get('additionalProperties') and set(item) - set(props)) or set(node.get('required', [])) - set(item):
+                raise OutputError()
+            result = {}
+            for key, val in item.items():
+                if not isinstance(key, str) or len(key) > 256 or any(ord(c) < 32 for c in key):
+                    raise OutputError()
+                if any(isinstance(s, str) and s and s in key for s in secret_values):
+                    raise OutputError('operation_result_withheld')
+                if SECRET_KEY.search(key) and val != '[REDACTED]':
+                    raise OutputError('operation_result_withheld')
+                result[key] = walk(val, props.get(key, dynamic), depth+1)
+            return result
+        if kind == 'array':
+            if len(item) > node['maxItems']:
+                raise OutputError('operation_result_limit')
+            return [walk(val, node['items'], depth+1) for val in item]
+        if kind == 'string':
+            if len(item) > node['maxLength'] or any(ord(c) < 32 or ord(c) == 127 for c in item):
+                raise OutputError()
+            if any(isinstance(s, str) and s and s in item for s in secret_values):
+                raise OutputError('operation_result_withheld')
+        if kind in ('integer','number'):
+            if item < node.get('minimum', -1e100) or item > node.get('maximum', 1e100) or not math.isfinite(item):
+                raise OutputError()
+        if kind == 'integer': return int(item)
+        if kind == 'number': return float(item)
+        if kind == 'string': return str(item)
+        return item
+    dynamic = {'type':['object','array','string','number','integer','boolean','null'],
+               'properties':{},'additionalProperties':True,'maxItems':MAX_ITEMS,'maxLength':8192}
+    dynamic['items'] = dynamic
+    return walk(value, shape)
+
+def validate_envelope(value, contract, secret_values=()):
+    validate_contract(contract)
+    if (not isinstance(value, Mapping) or set(value) != {'protocol','schema','data'}
+            or value.get('protocol') != PROTOCOL or value.get('schema') != contract['schema']):
+        raise OutputError()
+    data = validate_data(value['data'], contract['data_schema'], secret_values)
+    clean = {'protocol': PROTOCOL, 'schema': contract['schema'], 'data': data}
+    if len(encoded(clean)) > contract['max_bytes_per_host']:
+        raise OutputError('operation_result_limit')
+    return clean
diff --git a/scripts/src/aim/inventory/__pycache__/__init__.cpython-313.pyc b/scripts/src/aim/inventory/__pycache__/__init__.cpython-313.pyc
deleted file mode 100644
index 169de4416df2b4d3fabf2613820a44fb9015b2e3..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 147
zcmey&%ge<81kYx!%mUGmK?DpiLK&Y~fQ+dO=?t2Tek&P@n1H;`AgNnM`l%(!`iXhP
znMpaR`o+mbnFS@q`o%>+vCLfk%)GMHypsH)O8xlw%)HE!_;|g7%3B;Zx%nxjIjMF<
VtUx0`RuqF6ADI~$8H<>KEC7&UBXR%$

diff --git a/scripts/src/aim/inventory/__pycache__/hosts.cpython-313.pyc b/scripts/src/aim/inventory/__pycache__/hosts.cpython-313.pyc
deleted file mode 100644
index 531b28e428df28478df76eea21b918d151a9b82e..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 14499
zcmcgTX>1!;dNaH)iIhm)hesB5(3V8&@FmM$+mb9<mgHCz9c5*krp2+ugc`~-ln>R(
z23ep`Hd~lNlA10Sh=K%-j2MlA7>yUZK%Hc}aIq*l6M8kwRNcCJw8%d@Hg-4dpMLKR
zhomS<&K~WH^Ymus9pC%jcYlwM^YTmtl>fYO^Z6e(5X7(0gHkkdgM54n8gCLF!b2V-
z21u5qP+N6OHK1nIxUD{>8PKv?+}0e^4d_|@fPppOXYDcLfQdB?m{~JLloDGBkFK2X
z=y$5**;&h^!DajsJ-A58>}Qy8#2*QU84f)L==1*BP$UqXh`^(zJ3Kv2GZ8v4<ezb=
zBujsoiwuV&N5ZpAKq@%OT!fEd_DXk{IUhnpRFbiK%Fj&F9y%gvQ11zORk>Enf5^vg
zK;uo~6v2`nf>n7)R_(EQROQ6;8dl>`mlLekqk&rIDL}wKPqKQC9-a-JLXQFWGJ5PD
zBW{^anLQ4V3AJ}7*J3U3uE=9v^DfU*?6Kex`JNI_9&TAZrJj7;vU#j*!KBtzCRtOv
z>J0>8b6=Wa)`=wKcmae+cqSiLLgP(h%of70Q8h+|NabOYxJeEJM%01ugk+eQ<s#u}
znsuoq4M&I0O9ps7i;&COU<8L2peRamyXnY;+s|;pb0ONzO|Ze42<PTlco&>@2NjIF
zrvSHH%ghzY;PVBUV8rK>O0ytuQNCEv0;qbKNZ2dBZ%C9<f0g$bo{5PRwD6#X|M9+t
zVTW%LUSb4w$tojBGRk~Cf<|T)4>_(^UMc6IkRU^j8<lTfavU=RdRD$SCO-xM_2YR;
zPmgM65?Y${k~!B@Z?dK;V@=gJUQ?5?rYhH(fTer|!t~!w;8174q22_J@-=(c=3b{u
zl@ILQuFil`oeN6OW|+}rK&1J`5a~C8$gl<?jgxR0hb6T?6q>7SfVzR225z9v(UhNh
z?$FR6HSM372{MzwB~!srfTfwaTIklIJZ;c@F26g;R1^~q(9~SXMjef*j&l_Clv!N{
z)(QtHX#)O;UovrYBq<YFMCFnx$ORcL;%6pk=mIj2MP!b7*rjC)P!|Kh?n4l<Wy&W>
zH_3))XE+Yc0c=iDtQ~c=`4qX}lRHS%IwsEQfu+T-U@&6llIwdG_FUh;uwS%q7wp@Y
zdT)1qbRcd&Ja1UFmc<(1?Gddm!RlHqtmU1D<AvS4r5hxGXs;LS^^0?xbUqp{9N;Yj
z>CTb&UVQt-+o6w`xV?A%?2F9u=*Oo&JS}we^1Y{c=jnLi8QyXxQBWopIE4b|;<s;C
zepDSVI5@9EfYrb26s-+{wE+NI3@&Rv&igP=a3ACkp5>kXc;PwTaxP&ln$Kg4VV`Sc
z6jG5`Mzw$}_|s*S!Z#q1Qql?}k^xr1Wt~KVRVRrJq)$pdF{+H&R8O64Be{~2iwZO#
zA(Il2$>3+NdgB%RAg#S>CzubwgX&?n6sE#d>C#~;XF<vkl6sPkut=G)Rj5J~=F(tV
zW~<Q)M8=W^Q8b6}pC;e@H2I>hQuW5fi@tAx!Q2I?vPjn{*qw{sxP5yTVF7&u0bcJ~
z=vp-8{%S3`cJ<Y(v7WbvZVbh(+vYW^B{hrATN<&XStx0qkMM@w%N<Z*LK<G9#nBnp
zA}vk;j%o=CQ4=`<1ozGL-f_@FKshPx2b80OS#jBra#EU4=}CZ@mvOG?+0+})=5GV-
zfD98{yy}sZmQ>yWtt6Yu+;*bBh#+QRw==!tNW|gdO=-BX5wE&KbCGycOA$jQ1Yri8
z0Hx=GH%;lfjNR)tf%oVdcy-?p-t9?vFT<H2(VA7pUdh;pUfE{{*$n*@{1*Z3Pl3d^
zNWQ5W)>>dsL+}~xZ4&-75W}Y3>hmP<hNQ(NmCPN+G<Re$29OKzK`6*YByBK4Pjix*
zi?C9$?~*_Cf)5S%g(oIvSx{gTH0LtPEab$aX8e&U78y2@=KO^KBWW-CS<a`hmVcU-
zv{*552;YdqaKT!FZ9>E9*YQ^FRiQ8Uk5GMyxQueXZJCc;yZq|qYcGE9#bqZj2#8<j
zyBg72Cs^wemcoS1aow<Bh?T@`HS^k4b5WH3!Ki57DwwyfZmC`Deec-Y$KDxQ+0wRP
zj%rqmVesq0#iAveFK)kYYk#CBsP+f48j20X?G3=eFvS!sV6GF)b!dwI_lDmdjypS6
zw(LZ6Br3Lu6}yCrUCXmSnYictEO_^naNtC|Vnno!d~O^03TE8(P)%6s|HC%&HCG5b
zd8OOkeSrL|mF(`)eb#1%_Bxe-85x=3Nk%3{NO;I93PUi!w&yA^qXS`N7cU9ym^5<N
z6Hk(8bckqfs)lb8E)`n`Q{XeYsY;(Xho(@}e7Q^^DNUY1CDOLs=bEeUE|`+r4HZ6H
zt6j8i6|7t1Ryfv#*(#VT5+xO4Nt;m8w%l>2FkaFnTDk;F7s6)c7nZKCu@CTytAl)>
zY}4G*caRgweZrI(=Knc(z^Zi<9NLMKDo*7lI2DK$5GLWR9ui3|FWEUp5CNEX2t<-s
z^^9r=7#Fb{r(#r2sO8pqK-@5kmUodX+LB8x<E{nTk_K}ZIvn5v*-|PzA7lb)b%U5q
z+M12J^?mli92}Yxn4zXltT`yu9K2t1IBq@pdClRN<6i40ll%$qC*kWFq2{n)J;@tR
ze*L-iB!{%a>y{?XJGv&#8frsI82}?6{}h0KlNe9oXdG<@7ex>Ooe{Z=afJ>6bD&un
z)mWj7JA}WHlo^to4E}gi;ueG#&@IBIn*b9aC7Qh{1!5=q$bNA37|oai&BtiHS~x4+
zNj;}-l}~FBgsKLVz$8U5x(p?vABS;rQRpAZD^&1#f+^tDkE9fb`~}r%#|+Wa5K>Jk
zVg0lb3a)~xp<#JvjDgWH`f+3)<Ki_aeLQMJTYd-34~k4K<DjVIlJ2MUKW_3GlpP>L
z$fG$<dbEsj9N9Ctj2-pp_No{Y!cqUYj2DWSd4bV+&B{o;cQA>(X8DvDO9pIaWi5}s
z^Tz;NJ@hk;z!_y1uf<~+LDp4PfmziaLX$G=6wJd(58%0w&6HKV7G+iFby~(6m;kvb
z$CU2bM-IW+VWkcRA?8Chqi1x$iAI?dB}+2wfK}O-h_WR^_wnH)gGakZB_!z(Be4gd
z`VtYlM7muz7D$O;U8q8AEa||Nqaiq?<H9V&jk2^S3mP5l%@ECiJxO1N7!hzf%OXOC
z)dK+^H+v2{LXzhBaFCIV=pBCH%ER(O(&HyOAequaRMN3D2T>~wpJYyd;3U$=y77|1
z8BS6KXCw`h94xXBBrTqb1387nOuEPd$At7e#snvoXA7G2H-rstAK>a`VzsvARwQ2A
zF|SXQSBvF)h4Q^C<@@Fb5*B;x!orYX*(zFGg2lD8ZN;(^G-pNELmg2~flK5lkL|vG
ze7+}9UUQ>){@5cO(a`optFh<*vc7d;IC?1NUo2R)SH<XeM@9R#$6BJm{lMMv!Ihg=
z?o`L!{rJTj>S*uvqYFo4Ox)4DVr%)LzV)G&$g@2nV4f!?qONgC{Z9Wf`OeTAjyD3a
z_Sb`NZ29TL4^8*j`NOOBlGvzVZ=dh^*P5n<yeJuMjUD<$NyQhA%0y{p?8FUyRJ&>~
zjz(VJyGXu%AmJz#9d&}EZjoN{d@y!%Y&meJ^-kOJRJ{3HD~^K?9HrNX7ls#it~gwe
zti;ylhc+V5er@R0p_o&&Y<W~m6geL{30v`e-q(+706MJYKPjo|tulPF#|HJMmTIWi
z$Xz7Nu-yG`Xq-`JN?t{tVtJdA!q6>Qo+5)!$VTS0no)UGBPj!38BGw1B=9!?N9Ht$
z!Egqv0RoAJ+%wqM8RNjYKshj5%7{;|HwqG=BU9#kl6*^o6Q>$pgBGMC+mSkIg2n+-
zF@Hdu0Z%dHsLD%rsFF54EG65$$arD%VE~Iz2N6kC%MQt)upT=KFO%`emt|fsc1_a2
zt~2ZbsV$ooeBc!ZSvueg`OncIuB9s!p74jb11+gBAfgBkd7i&Vb_-wS{ruqQa(`@g
zaq8#QZfJjvy~^(vI7pWcENX}xo2TjNb2Q6M0oStIV5DSJpyMRn><olvXox2T0xpfD
zPp&WNWB?>nda%3|B%y%256XM7W&td1dCHDJ=MdaksDA%4@#~h>_vv|EqNY)-=@4o<
z#F|c_rgNnR%&e;U-e_mSS|(a+;a|d5d_8X=?|zl{u1P#N3cHL~c~@-S2k_psV2brF
zcEt9t*j$f{#Mb=}O_&+hM>|qPKL`S5Ba<w{dnCsZJ>UYqDB3qJic(1tG8i#lQh5r%
z7%%vsM&$V-p`TUK>K)=5>G@Tg%nzzOGXkP0A)rd2RYpBli%k<v#%!96XH$%ibd)0(
z)1>`aU@ahPtmss!JpwLZk18WEsYd^~G;>Er=;`o9nhG<aD-=CF6S+cxVwjzX%(DIv
z^#Xl`+egiSUZGj&gq$_EY?9+o?g=?D!nI(Z4!d!~5L2lI+-0adtQHZ6OJ%+pc9x-i
zcp=}kpYcxu%b=hLL=By26arOt2i34R+X|0a(L#0#&E#4~t{csK4o&ers9q*O(G(PI
z<mdg}PH+OF&qni-@x+{tTuDW&|F2()sv&o9BM)f<MH|KK+g2U5qGP|{*nfv!ar8XW
z6Q%XPH4vaX9Hp^x!Qli4#8LUs3_jf^B>uMm=td--mhc%Qvl)SdGz4PKWf7$;WoiRi
z4vCADOjg!a7)TBpAkPJvkZ|60@F(NE(E+i@`opne7W->RAt_FbHAw}EbC*N*$cL$P
zxB!E>gHVC{vc}&-UUuLIJ)*frFxMn3Hqo+8uxwlExNq6<z+$_0{MF;Jfm@dM^M7vH
z{ZLO>w#talRE}tqz|G|2ufXg_v9Da&9)*AW1%Oa8SMEpYfpay8t#L`qB%G_+M5$(t
zOQ}6NBS)kh11M-BC-3KkU6DGB+N%Z^NOMxV&IRfP7f6%NFnP7(NGsx^9C>PgfV&~&
z0%=D87um(5R#r>7Kxqf&DI=7T87`2H(J<PyljGGXeLR{@NS*q3fP76mJ~?*}c_EZD
zLTWdwpp4OY%0)@folmrDm383Mbjr^CLmQpFSBDH=|9<$c8bR^ntTK|rdGYASYm{!|
zNL=EQhC+b=pfu#BIDj)1v!oE4BPPr$X@{86qtgec_@kuT+dK1W+AR!BW7xrM%PzTK
z&&?wMsj)ppw^T;Pax;4JgD>?oTFSlu&P#xEaOHA;^=dt8uv3YlzsPix)6TKSgemCd
zKg+(&9?J;Qaakq38sH``^R&Jhul--+23%oe0U12`NML2~Svu5U!l4HE481g{7laPL
zC}&J#?_ruh2)X`+ToMzkDAfouS+hzmddiJGkF^|v2<u%2g)=Ci=Aq{SZsfS)vKgHr
z>kj(A0y}w%9Lh~kh}x2KybE*W)By_3!8(7Rw7iIsW(B(R-;^9T!#p{3!U%HJvx+hX
zcv#&Jr#1_6c;=tI=8@K{j_~NUjDvkC7iF9x$C>;LeC2N<=ONUSmaQI}*Mf8G1#2?e
zc_SUlI_bZPyzC?W9|J7;xghiuZUUh-148Q`452*}!VLMI6IO+muw)zuo80EHcy0S&
zGk&lO(m5TEL+J?`!J2DFUfU)+D#+MT!6rL`D1Qddi@X+)8vqZ~#cOm@K`sb9C7VEC
z%z(i7M?p}!1_EO)?GMzPCWBN<!5mZQEu1(6J514LZZ7ha?Im-|6eQ0<svvVRtK^a@
zY3!vb0(_$10t9J^QMd^%Kx=25MtSbt!P!)#SMpT0r}A$=DTTSPl(vy_?>|G*3~nfC
z3T5pElIDyoY5G({V6$z&ZGR5R$Sn^_)3}BG{;^a6mec<qRVefb`a?Ce^o^+j?7BaI
z8Y<Ut%b!LEs-gdRDjld%nhE>*#K_((=72{<3sAs6si3!((Lm6<YIv@yA7a7OkrO?`
zl%EMuN1vhmEKRZWg;^BPnsXhBP$Ak6UBV1a;b1Y9jxA9^F4Yys#My7bf^)6Zl%Jy}
zk{2T3QWH##@ABbLG6WJrvouEq8A@^Ss5w<9HJ6{+3!XJp^8spZkb+2Bn4&L3D4L@J
z0M$eUq7@Kl3tyrlQ*?R~6iL`e9XdLcidh7pgC9UoC8XKI2)^1iQ>Ngc7@C7{J%!TL
z6x)q@Zpk@c8UZ+aw<Z_~s#y+3B1x4IiUeadT%f2&9L@nH<0X?}NpPofh9y<(b1)6t
z2~}n?l?8Q0NG;h>5V%}LvvRyXM+ovAGzlb*aORYEAOE!Ij^k&}k2N1^J}vqhC;MJ8
zm61_n89ArxLpQakxps8Ga5t7(dq)jZ$^^bOi!QJwBRLf3KTn6Q;IP144JH9U3}%{>
zH`~&e&M*PYb$F6_4vK-)KS!ZEwm@=-F3=e&*W(b~h3JcPhzij3%$zYbYOXjpbU2DM
zSDga@l=k3c@`H>k%3926G5G_j!K!oR=?O3T*`Ob8pDNe#Tvh4Bk7PQDD7cqp!z>FT
z81Cev3Rw;ragbW{xE)nTP=(?!_*N0y3oS`Mfv*S$*dFx04^{oBqR~ggB|pmm+i>gv
zdepNxN*7=$)C1Yo8Sxb#>Y;@&Fyxs+(018zj)*;n-X~Y#*yCu>GpIu5C3^yW%wHR{
z#`z$OJ4uV9$Sm?)arBrCp#CPz{WxAHnejah+~(MCqpx{Na9Zx5m#=_CI6HiVz;kwy
z<Iv^|ij^uhA?M353&(&Df?`0$*REc>y0}}cMgLX{EBUIfc;SBDvL8OdbpZH>U-rif
zkMfqIzb>qJeLJM1ip#~~W}&!wY4U^6%}~5}-@F-eOtmeLW3rllxwUyAKT5`GVkgk$
zkh*srqO~4UN_pEKY~S(0-kW=u&&0R);1}QTj%u$P7mTr%xXra<+4cqGcC>`i0y!qD
z335yp>pb_`o~Zw|F1Xm2u$QB&ThSJtI>C>e6i0l*h>t&UmOp#${zQ;}emXwE@aMw3
zZRW9BWzT;|sPgiEtAjbByG470U~gFB;`TO3o}p-#XxR$+v&A#Fdw%S=Gx4LckB;;0
zJ$HNVm54`A3rA1${b%@E-+jy32W3@aS+h_ETaB0Pn$Le?AnIEMOU?YDXy6xcoy=Au
z+9<(BiM9s8){rQvzJ7J#YLwxfGrZ%%6Sb<K@QIFaR3|fSf_>Z4Y%0xmuTLC2D-52E
zyU!+?+Qp`WLes%$Z>&XdxW2HJu38JD9j{%9wZ8V^#;f$*Q~!(MpA2y2;Ai=K-?RL)
z7kS5}KYm%sR{Ef*ELOAd>@EA!==){M{`ae6fyLIpnY=T~I}XqHCaey)7MF08z14K1
ziFY&rWY?_=R?${3*y<O#_b$JES#Tf!q$ut_9&b1<+MZc0sEGBx+aVS--Y;le@_z8#
z&F7Y1iZ>s**B}m@5eCkzG@nT{y2ZvWp|LBfjWYLbb&s|KiXXNRg~eh)y--jeFKAqs
zArX@ql0?}Sv22@Awry$W?WT`f;$?^C2T&;a`CCrW?iTFs)#8Sw`sJbzjr`sa-#8sF
zW_TO(K*_4`kXWg16sy~X>h|S<pIAQ2k5?a$n$e}d?YAOgNrzC<v0A=;>HM<y!=wEE
zGklXTUVfH$oL!~hx~tf*PiWXDQeDyhL`ivU>h<reRyXo4U%dJ(UwSs-bc@bT!P$9d
z&reQ$b|&r|jSj6=)Gbcm9u+G(g^JGAYWK41PVb%FcWdtU-|ggwCioqJcs0$J(uqo!
zSlJ;|b}T>p<Is<oc;!&E7mcNF!PqvTqHW#S7x*2ac=a@2I-RJleJgk)xTOEUa?=v8
z-Wlx!s$BTaYD?!mz1V+BfPXEgW7@YuH$p<`_C)EHxAJb}iKR_KY16WH>C&?Qj$wI@
zZ$7+I+PzxUu%y535UX|xRlCrVb$9gtVELhC`K7y~_v-GI@Xr7vew#lr&X3RXJ1)kn
zFY%?95@pm|6*npt&&10*?&!rmgTkJ{m9oJ^+g`Elh|qQ<reDmzU+R8RL)7ettZiAX
zSlTR<0)O4U`q4}A(j$-y0QA@0a)>1@LP<*o`p5aEQ}OcCyyJADe9K#|8?ME^_Xgh{
zjF-1Y^&lJ;zO}k-*WEs`XH0;9+n$T|A|e%lNF5c|hZcrJN2B0qTq+VB?$xr|#Xi7g
zS({MShE|}L`#v80aB%s+UB_Me?z8;hdA?~fUOvS;rV>S!*T)ye7pvn%JC^&zj((w|
zf2F8D(Xvx)IV`jsj`qcd?>n|XI!2<*+b~HO^F%|XV5q!rs0JZApa1n^zY4^eoRsdU
zdahmfX^{=pu4<^)T$w^K3^j_OYakA~QSu@q76}RFlo^ElY#1w-bRUR&qi_>0iuDQ+
zY;?`4D|JDom(h*+A=0GI8AU<2DYA+uXQJ7giudkMX9K~AgP##)#4}N%I%#32{Kxe4
z3XEW3!?hB0$G96l&gCiQt(y&pBQCvcAs~Fo215k3u>MDCUe?}vS$jiZl#rG7MbyHY
z8wHcFe&&!ZkyNNjJt|uW*t}k^M>9Tt4kNiRRG>#w3Na8bZl5>*!dkvsSRISR3!S{h
zxhiW-xC()?x`*a3#Iy-pQPjLv6}7*&=j}a9J?|V4YkQV`E0*3zT6EPxw~n50>IE*(
zfFnuZYo$sX8%QXSq};4QFW?75aGM2^kjxyufijMaw9{}M8yPkDq73^AwB{-xPd*-*
zoe9z7khW|>xl8IQH4GNxY1G?^dRL(e^_Dc~11y6c*zZEMZbE!4@D^hqLx%ez>&{h(
zeq@9URrryS$>*C62WCU4ZSnao%=$ygFIJ!Le30cLp&&yuVV{ph_O@)d)u9&T<m5X-
zGA(%FQL?}<DI&p%X*x0$hTnal9#g17)*SmHs$PalD)RZ{jy``R!UoUHMraNeK(vRk
ziz$Hxjv{b{8r)f^{*rj2QfX_xGURECzp6H9_dIc!wI1@Ta<z8<6BDU@mVBZs)fPYO
zAasR~ReEjlV>PrMqSnJg{LZ4SOTL5FlS(a2kv~RiOMVwo8MP(y;%K>HR~|ym`B^wQ
zKn;sH8!W|eC<HDW`f(k;CnY)9SwLf`<%)kAe%_MIA<I83$%o%}wa}L*=oz^`<`qQk
zk{x{sD!=?{0rb-$nTrso%iCUy3dztVAJPH#8gv2SL~s;T57i_|{u{CNH$?4ki01zy
VI{%$;|4#Renk@N>KsDaa{{qPJ>&O5A

diff --git a/scripts/src/aim/inventory/__pycache__/loader.cpython-313.pyc b/scripts/src/aim/inventory/__pycache__/loader.cpython-313.pyc
deleted file mode 100644
index 85865b4f96f09c05dcac9529eaed460a189695c0..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 4773
zcmbUlTWlN0agTQ-j}M7@MwBH-Ct0#}wnZkE?N*MX)RkP<)T6d(=21BzPUKO#^mxbY
z9UY6!N52XM2w)qDYa1<U1q~884N$u+P=E9zZUQvzPmiD)vIoUT(FTS8+^B$&=BKlF
zJc@B7CFl~`o!y<CnVp@Po6%ZBgC9Zr*VXIK|0aOYKgh&sj15q0rvbQx;wVl{pcsWI
zj=-)7SB%EA1=ABu%#Ga^%uIM<UhK7C_XHdBVIPOWs1L<G+fdwlz-3d#{yCQS-6a#A
zG6RC5sJfs_s-nS^IU(rtWPIkx)Fh0-F*TbN6<thE2|1WI9aqi@vXq7aR#m)^vWeP#
zl>@al2=hzm48l|#VON~ObleknZ9~s9n2CGiv<1224ED^qdDd*MksDW2dBX25s05{|
z^ep0D=xKzgwJ@w+LQglz)-vg4VBKy9s$&AlwX<<5flgI5>fn)4uASO=|CFyD+lJ$=
zI1PWy2+g5~QGz-}#C)LD$>4Fe05jyk>toy<_l!_3q_{Sbpm`nFffB9*lnuijYZ8K0
zz|VPM4gtLu=fwJ$0vTpHoq3&{H99k0&hEw(X1bkyhZlKi($b)bnGPF9DDHEl6sbAX
zi}s=#9!Q^Yai|Az@S9FNPWPY;)r)4@oU>je03C&{qvlOejVR70=teZmIFu8#=!yg0
z5jsO<kWGj8PoKU^Uj8n5aGo~3Ss|B`lsS{t#250Sk`hgin#pLQUU292%+NQ%rde24
z(|}ZH7_+>A%L!N$xq|BuR~V?7CWlp3=dyWC=VnDt;E0ECRq}kuWOCp+*bQt=W<kix
zW+;b6O~hx#<O_LK7d6u(DQPfm(~m_Vot#}DYmF+F<|IXst8+%piHga{s*pCBw4e*7
z@94Rdm?Qp)i3?z2Q>I_iBt_E&avvrwrF5P#8BLTkm^{1b(RAREHEHo&N+X)!pqY<E
zMLiW26iu3y#i*9TQcl;R8iq9~8<iZ7juPe~j^q|hHkp(ZNlzxtZ8bGG9vX4>f<Rxp
z1Kp2Mr7ir5Z?!G_>US2ISA3QJ!A0i0?`7W#+go9S1S+%PA{$<6UOsu_1%tpN_grq@
z1XbzV`BwDxXsK^_aeO7%Q)zC$+<CEc>DYzNV)Nb`o=P`&?fBK>*QT#dFCQ#*@4LXf
z=DSa$mZ5tr3O1b|d3mH5=w1!?|Fm&&{FURYq0TG)*Z8aa8>h>m-Nn%E)s{YEN37H`
zVFV}c(Wq(9{RTMu*XF&S|1%U`Llg)AC`-@Y*neZ^E!VB#TLZ?9Z<Sh(ysH_(*ys0X
zg79DMAYAb_-9I*nZtv<H>!AO@vH-u=;U63DzSm0=c);oh{o_9Ry?rg?4E;Xi2KWnc
zjQAQv9%}6@*vcgowY?t}A8f7YNm_G7k>+Ye-)%=o9gb6nUIb4A`<{Yt$9mLD(2h@>
za7}^l1i-TtMxhgo<8{Iggc7b(#5x~nB%+-nhV?*8)ckA+b{zUvWO)FSOgD^`lygdP
z&(z{%!aYL_#%f=RA+4KAS(64NaP^~vdqa-y8b?nZN6-Jo(c{pna`bG(F|mF}ZyiVP
z797Ky-VvhQVHb&W!?pLU^7d|E3%<u7l73BFV8IsHuVD-RO>BX6bn$>KcsJ5XJm6s0
zIKp>q6YC2)xNy^rsWmtlUxQksgS#oUbqn#;y_awE_Yzh?cHc%{Z|D07-uVGSdGN~I
zFY9OqHm8~1+y+7kzhwhW^)@iI4`c{zsO$Cn1nYPQx8O~p$M=C=@GI^FIM$u+)X{DH
z3c8RT)MIZg@mJ9LHpsYf#A;6X!An{a4bZm^*EGPPsWW!$oBFdol1QOJuA#XUI#UPn
zZPO+#$a3M)Bk8n6KCObx>1u9B7SD<@SNjrjKM)r*PQW5(eaaOb@&VUgu5jS=yvXeW
z0=w#P6*Vn#lE!5v4Zh8DoQgR}tRYXRrU(&}P0dSk8jDJShqDo9w&kHh;}|3yYE~rF
zfI(sVmguAKWr6(TEaWeydtTLa4ex}N0$-!Dez}yY=mKOBT*~5LUG@-%iJKM1w!*jQ
za%l;RDP3NGWJp$D<aAJpO{gkr1n(l09@&bLbD*ktB6g(UIfm7Ijw|dVH~oSNIYCKt
zFG{j(EkhEPg|sariD^y~GNQZ?DGb=$I7QT;WZ@tU%BS=^JfL_^0%cTXHK}N!<1y~Y
z@hO{{lc;f$9^qNMjp&euv!(}<M^S-H?0HpEOnOe#F-d^&c7oxSbTO;(A^b3zvCdsg
zH^>Z`9Sz0<sUGBvN%5SH1(StGPm)J8g9LJ(-)wMB+M8|mG+A3EMreBGh*IEDt<m&b
zgLS}qU`TKCv-Vbl16jKoDLY8^SJ!Ya5%{4hpPG&UpU6G<<xFp5Ori<xFoYAx`?|I-
zx+}XQzvAEKOYP%t^Gn0G#G5a@I{#Yg%8sARU*{M7M*H}kKzk+Fe17ufNuzV}1N|=x
ze_Ak}NtM2rE_S9@g5t-m9hXNgj$D5H;^Ry0rPf`GEJ@@B-xx24_+p5!9X+uUJXvWC
zFHTlEdM>|o@uj6$sUx}=B*=T;ValPQVrZy_4B6yS8#&xx4i6T?gUjJkc;8|JK_7aj
ztsIIJLy;=_mC@zF>)pnIQ$}ZeC3xC8_xJrrN<GT2r<UW!iEQy`_806M^wQXy?9C~I
z?KXOpJAs~cX7B2MT)4epoD@sPGR4l!N^q_c2$uuhkeyz6svH<71_o-#&#eTL>$^{u
z1O3H7e{FYSB{=zU^TXxlzG8FV(xFmwWYM!4Xupv8S-Kq9Q4H*;4D5O9%<E^~e6HBk
zd%?Zh(Yv(!opiZlxY#jVY3sZ^d2w>-;PSxrPGeu%=oMGmGJk99u5=At8@)QZyt~wO
z-~zkay8X&LD6Dm;)H+lde(ZOnH%C7l9xH~USJ>6Afu-zkPnWw6mAVf7zVN|NIW|*_
z%@}7grP$nxlr2A@l%7y3-M!Z)uTC0!P8cVjG)_EaJoU8kj9@%HYs@YfeBs0HAFjF4
z{&DKx4QS{7do8G`eKGjir^hMu&{68MPx}z3QrbgcMHhXsN1308pnJc=7dyzj-yedW
zXDm;|q^PvY8Vu<nn&w^h#47L@93{KEp));L1XouIJ{eqn2F&_d-b*SNMaYU!!T6I&
z2p4&oz`-QcWP)7X2_=&m32VA6DWak#lemx2JWOb|CzDWR=~5~w=sK2W^WY)L<aM+L
zo5=DbO!9fFBPp)d0Nsz#e_W03N$Nhg)7_4bI{VXnfC!PvlYj(VtWfPGRiiA;Vsafb
zfb$@%93l0iT}rmqtwd7x|6(+|25f|?Edm9eT^wq5b!bU5PFPxeEl+0;+ZP|j6R-hU
lBhpC7g1UyHK0<w;pztTC`y({;3EFet^9`!~Qv{uL{(rzs8~6YK

diff --git a/scripts/src/aim/inventory/__pycache__/model.cpython-313.pyc b/scripts/src/aim/inventory/__pycache__/model.cpython-313.pyc
deleted file mode 100644
index d3cbbb97c90f8aa92dac7b9f7774cfc02e47a703..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 3205
zcmaJ@&2JmW6`$EJF2ChaAC4;7ilwGuLX(9>A#tHdPGVP<g6QCt3bY}*SdlA=2DPMT
zm#%#iV4#stRSrVbOTnBf139>-20;$_6HF+!>_w5dNP$8(rVNnw*7s(2DOzGXz`mJ%
zzqdQ@d!`eQM+l66{_(-h?<7LL!<S&l{-R^SVwY${qwkX?%IK27gb7lhXUPSk38O?4
zX9Q1n#{YzgJ}Ln!pF$-cRR9g0LgliW4j<v4(t;Z<8IDn`8n*4q>lL$FD*9XS2~_5z
zGYiu$DG)|A!UT;n@u#F96=Y5L86XAa0x5(v@iJv<AykmiGQcFnG?|6VN;>2w7g()P
z|G?Z_Gnu_nsUP9bUAc_h2h>fL%ypwtb@X+k=+xL<H*7c7IA}j0%jt-#>bhlYn!4^r
zbbYf{YE*F@)Ad^oqv|6`U0<&-+o@J8)2ab1+75GpYgkszF`P=xvUQ#DokiPpSQK>_
z(sdibqHZ`2tE@E~6QyE+b>JaxE@wK$oMG9OwW^u3i>y+2?3~SjSJ})}tlOrAD(65e
zvzo2nWeR-73GQT%0{MtMk0$OdJsUm$P;8Cnw-&eUo$32`o=AB%6bQfIdi({B&hLTz
zAJ=0L#GW8XK@bYzyx<2y=7CTOk`~g`yrhLk$xVqxG~`5luA)UbH>!mSF)xI9L5p!-
zT#K^=WKF`AuGehm2y@z%)^C+8H|Bdq-vEGx5r}SfV{9`OISMnK2D6rnei{Rh5HwJP
zr?U)Xm#mT-FrOSZP~yZ`r5^^RLssbw_23}QCrFt*pv!5IjRD|BAj*Db@qj?eOSV~E
z=Ze{=&%^{9M#->ID(O7o+yq*g?Y<8HY>xxkB2U%Wp?bEZo;_42Tk2%<+Gq2h&m6q*
z&SUjm9!FOVvbNZ(Ij*^_w_(9;^|glA?l`t(0=?1eD_>@nqTx3%sZNX=p%V;vT@?b~
zpikI&V5KE?0VeJmFZV^T5`6UvaxqqH3W$xmP6UpLp(6sb+%sL@1gsQ(aS;f2&mR)^
z6FZHs)$y*Y_J&&O`9n3`Qqza(#g=+;f8(+GCU;k{*9~X_chbLL@mq11<cLK->`L@^
zNnm1%T>lLrn__>d74d&L&JtFI*I+*!#;f2o+Siq0o@x|oLG96}>)sRz`f{Mn1o>c*
z{|gJ^#8?q~qzZ&Y351(YK{H-{!5tXoX?Qx9fXvZJ5W~y?L!mKQbVW$Ok+Dh>WLmsU
zc4gQy;r*;k-xSv=Bs$G4^Cp%ST_O8(=!K0nFYUeXZuxmXTQ)88PMyuUX&&3-^3|)x
znpw58v(;MBsM>Sct|-=)jpW})5cWso3twa&PB({|q2{gq)V}=qT=t91e{3}2-rxvL
z%dTSAm}8cDGEXt@IHpx{6{B8<8B+5V5O)=CPpHzyn%6$~Zy+15c>10>rJp<8U+)oA
zQb#2rGsn(tD}NjM$==n&u}o_$^JM7a_O+*}k;BwvD+P7jO1*xV%C}Pa?W^A;Q%?tm
zKZ$=F|9X7k%U8b|{4#SezVKvV;kn1%GoK7heIF&m*>;Q!3~$H14vxn~I?3WNF^B|V
zNhH`i*cl`*AwiG0QmImOJWpT~^hy$2v@2CB&_ywu*dP-8r}uYkQS59$umRiaK;T%3
z#P2OWeQD@G8hVzU{_1KgySVlK&frdQZ~oEn>#Z|y97v08iOTQMJ-bbCZaP2kxvdED
zTg}Nff$3q2PoEF|fNyP8m4}=8eeu)FKN47aD&X!#c)A0P!O{5>kkdyL+zH@*0LPJ1
zkP9Jx6si7EC3UfI5615cg<~wzgYhG*2aEP#3i_@PgM%v$N0y35R#1>Ep@mtp97#vr
z@OvAERW>!#IpRH#pH(vSHnZf0iX4LlGdF9ufusJ;U{=K{+YB53slw!a>JB%%rz7-j
z+HcdKzm%W_L#_91;5||hbS{Otabg6WV=8FpuC!LGRoN`avA2=T0ZCI{N;ZYHf4B|!
z2Es+?uCoDlxuacoWKUvg_|BdLvPJ%pOzm9#Wa;Cj!@;@c)Sok-W?=Df>aUr<WDb(^
zkJS0&++R))^i6)u6807nuH|tpboFKPfVyg()#@g5?y`4K_+2FZir^OrAi*fwH-UUa
z{ys9cztS4Hv~_Jeza!qid>~zV_VT%Xr}c7vYhin3XY&5952SoQ7Tm|A*67UE_3aYe
z$0`TX%yT*37N~rMHm5pJCs$}kBub*gS)R4H`Epuuqusl+X*0|SUf$m2kC!S}^~D-?
z)miWEI>&wqUtoyrUjb>0l+tg>Yi)%H(H{kY&OkxZ8Q5Ehw)ty>1A}z9O@R0SzGgX~
R(krx0kaFmI0he6g{{kGfgU<i}

diff --git a/scripts/src/aim/inventory/__pycache__/validator.cpython-313.pyc b/scripts/src/aim/inventory/__pycache__/validator.cpython-313.pyc
deleted file mode 100644
index ef705a6b841aba660a8736c4298d272dd1cd6ad2..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 3607
zcmZu!Uu+Y}8K3=Qd+oL3m;@3?LIwzGe8CO~P)PzUxsqI)Kq%gr9+#BuX1z`p>|NjN
znh>k1qP~=S0$QO1snVtDNezACp{ni?`qW2Txi-<3yCM}-@s?ANka{ouX4ZDn&~bM5
zo0)HRzWM(AzAsy`SOh`)_oK%*{wyK%FFI(nfKPB+zXjp}Qjo$;q6v<0n9}?tKOqo-
z(ZZxS5g-9Zi<7~L5D76lFey!hNtn^W$;gCE<cTPWVl*opMoLJLhPX}yRQLc=BBy!(
zywm;*k(kn|$Oq63k+diYCCaF{5>r~zoU%uW)A0?Sw9dzpZLjH`B<IPRW!bLgnzrS@
zFr3p|O)qE;9f&{H+y(l+HhSqIyj!no1rr#6cU&_IMlQ*F3EeIhH7loTw_r+}D;Qps
zlr7b`?Ha_=3e&JJm?w6{u=Ki^>?QaEZtFY{56~<koPr3ia6~u?sv@Ey%mx(kJFuz*
zNRW+!^-+k8LTn@vX+E5c?368IIOT%-Itp8-J#o&q3tnhRD;8Ay=C~KpEXM>XVc<n>
zX~3wK9V7P`O(nygq^g!yG*s1#sA|#9m4Q$7qN@6FSu506;;NcAiQ^Vb%dl)!C2=^%
zgV`O5gxOY@B?-E;S5+OVU|rQ*mzZ;9*KmMg53Fs$gS?Z2hN}<O<r;K!VwPNI&>=8q
z76(o1mSMRzSsJ|MYu_g6(h{M!V;v<N4BfBLi}udt5AIB_iJcoA-OCgA#5J+IPW@f%
zCi@#(bPlLSqdo-2;I@td@c?B}rm?c)t#BzB48gNrpnV@oic?->p4jD*dP^gYCuoI2
zCCpTsUMd!--Aft)*{KJWz>^$$EG7q__x8gcs(U)G=53-juSqbhx549dLAQ)H<oMl@
zPevYg*W{zCfts9pBG=@RsyM>#^FLP!!UlGgJ~-(CI!G_G^Qy2+o5Csl5XU2no2h#t
z%n6D(#AWIM?DP43mOEYlhQ%uZ`fG$8MnB=_FhVn-27i{H0Z8y$gR8$j&VkZq;PIOh
zY<$(=W~iI6rbtQ{evu)e4;@0sP;)OxkmoV#MHqflXU_?}D9;^2Gt~I3g^<>ckR{Ae
zZ)8mgWrY@Wl5d=o6%3Hy5=MnQmq-2=l5*vIJ*EvzgB%xZ9n83d7fpA;F1r}aV&62a
zc|7We4YmosN-c*=#4duLrYnK6n@^nqBTEqCb`F?5(b4h-%n0sMX{vIxX<JNe+r`DQ
z<Kj63YyOc%tyF?dl};u=-N^xBaGqhzFrFTNEU+ls4l0OM(JmPlp(gjlg01Dei0POX
zM4F`=o|rRr*Ned2%ElNWHu1t^w{@dLp^H#+vCv71q?hgwIxaD^BJ2Y2^919z?uamt
zq50k#t4n356i3J)EOx--{2IDtv?&Gy6Wm5DarfFM*H%JzuGM1wtK-kxIv$SK+K#NZ
z_1D_^SNE;89lvwot$<pRFXVVl?)rRU)&0}-df#xZZ}|D1?rP74wLN3i=-8VeigvGD
zc#?fuuF03G;-$AS*z>no|F>@>6y3XpI5_Ni%fafQp)ZbnvA5d${k4|!PxY$wqi;6_
zy7nI@1!Da&K6(P(-#?0lKMnx(3`a)Op=a-fD19RGeq4Aq5`RA;{3Q|qdWu?42ea5k
zgET{mx;@nu1PQm52Ap_+X6PJiS=4YWjCO=kGgz9gOWnR1R!Y+y4KB-_<C<LiK;1N4
zsXceKjI?V4h871wENq9<wls=3C|dkXtg&Z%#S*eYrWqcMb%Yw((-N~{Lmmy}$?}<I
zU~Y3Ofh^a8l;BBzuz45I00k`8KE(g;4v@KN?iQ^;Hjsfp-QAk!UIQos0GO1mAaHi>
z=0j+Q&cGrVDY6yH1~U{ZcQqxN4K+Z>lCo0s3^-qjWu;8dt_?6$S{hcR&~cfAuZMS7
zFP;rk-%?s>-{1rQqfx{fy=PWb5){Cadn%KeGK6utQ1Byt0N0aTY8w%@<NX+bjb12I
z0I5UF;(}oT&KM3Pk#r^T&gM!gV|-jTiIKzgDg;9<gY$OT$_>AJR)tTQm0&7WFderN
zNu^i@N}0Jz=)4bR(@DV-^u?SPcgiJtt^=7n2QcWh=vv7w6N8QoLI_QoQy!|cUnb_f
zX${Xh@Ac1IpCz-_PY03}8D9h#rC2kJU(<-G^t~fH-oAJp=+c#6;2$g)`b}S1&XVP7
zw~qlIF=<(aiIF!To$7`ISIgB^r0Fnr(m10n;+(0?Tebt0hJzP@l_?`<I;DcP1S*;{
zbPY-!>@FBfSl2Aj8Ju8R*fDfs0FslVAZoIe!5g7L=Og7opgfUQKb`<U$?~%oG94&`
zpx6u2LeI*PFy)HCcgloj0mI`7Ec)t#x1kYz!3(f*!N=YR!(MWneO)8-ju&7C@r$M)
zXdki+IZKy=IRgYOcoNM{RIQ%4U|Oz23vmk4e)FMPYCts^ht(tSI6RnO8NCz}_xipR
zJ6_6wwa3@x6E*n+h0)%rwU*0O>GF$s$9jC=;i=C?9*wMb4b-{@mVdYr?OkdA+*v*K
z`=uxSRe5Cj!t?0SmE2l%V0mmKvG3EK`#rzuU7q+ll-Q7>cjZsyd$TJGD<7>cR*!tQ
z+J5FsY3OBa|HHmNO#W{2X?ykRN440@^7uw5wjSz)zkf)HjYJ3i$a<o0<?x;0M%&&`
zhwcwmdrm#cueF`KBYl19?7gmsAAWZI(e>5QwVrgfd$1Ni{`Bx2kx4%GSFzT6ag#^*
zXZ$w;2R&qmxW;cHF0An{<t|7g(@$^I<SSM23M-fD8IMpv_CUwfT5Pa$fqVd~zLA2y
zktjQ}R3!o)fPapsY|GfemZ0@=zRV&-C6F(WCpZ6*FdRa&sTZQPUcsF650^<9JgSgp
z36*8>7N~a9kbC_s?J(!_qW+}+zl86U)YF)B%oBZYrM6}jwO{125>q<sSMc8>Q?N?I
z(76H~BuS3@3LSoh4t<3>U!m?-XyBjd%r`;A%lG<fT*q5p;CeO@bXx-AJ2&a@O_bx#
ZzLCP*6t~%lPMvv+_Hh|*llAP#{{m)tUZem3

diff --git a/scripts/src/aim/inventory/__pycache__/writer.cpython-313.pyc b/scripts/src/aim/inventory/__pycache__/writer.cpython-313.pyc
deleted file mode 100644
index 0dd8e944b9257bc8318e34d29a975f635628b806..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 3506
zcmcInU2Gf25#IYDdHj<oi~6x7n<v$>MTa7j#!@S}iW9|2EGm+1(u8d&!1Z)IN@tOG
z?B3D(u?_U8u!|O!QUsEV0+yd_p%3w69vdWR5kHBMS`rr-D3BCI-h`-tfD|Y?d*q3#
zY8&oDSHkY>?A+`(v$HeH9lzg$p#A;c+O_L0guW&dyRj95+Q|a(5lW&YHHzXCrg%cr
zqco<ik->~LvY3UD8Fj>+*lEeIqpmoIIg56Ty5k<~v1sS0H}1ne9<`z_lytSBB-ck*
zcEkQDI_&<IOv04u6;)L;L_^V3eH`ZO1<{y>v0+5LE~|!y=ik=UOjeN$VEV6%StTtR
zvM?{^vV^fG^}Z&}NR<sLJyRK|od^&gp$`zIk_hafz!tg<fhA0mjZ#Th($R*lvDawq
zNP<;UOqet4_taj-iXr1~{h&jt;<xk?8g`&|0+#kG0ph_*n*y`O*C^99DM~YiydI`a
zR+qCGOqA&4L!LKZjmd@-6IETA%*ruc!b;xIV>$+&l8Y&}?Xg*F|7d>R<OD%c6+;lr
z)&uCG_DUVu0L~cw9F<#+{@S+#BqC1bq=If}IT`QSK*0);v~2jPgLo)KC5ZfirZOoe
zvETCQdIG*V*pd|d(E~J(QuGkjQ(aCsgT?4MTAT-UAf(b0ZkwB8`Up~JbVY}^GTYzx
zRVVg-Vm~6g5pN%8wj@|eTy>xg&LSkXA~expFMyV3;H!fh@H%bdlBtP9wtOOJQ?(JI
zpG`WRZGF-?z!bo@`FAG3N0pWU1P5CeO0o8SJep{?*HaFgt2&ROlrwR}Ua5@`-(1o?
zK+{Ndf!#-ID>jwrw5i$%l3lf#O{HA+9k%W`<cQiFEPR=>8G^HMCc15nwQ=IOO(*Pw
zv>7mh2bjc(eT*t;pJ?LbGuEn+WBUj^*K13qoHZ`sc|okG+)G*px<T><no`{06^O9I
z2w7(pv$51hxILZ$>c4$E<$XyE|NqGM?T`EvO1xS_Z&QiaZK^ib?lGJ~E!I!fBy6e+
zU6KAHs$S$#Dob*h)&6InQk^J*>`+TXtYjc>g&@oD=sjwDdWZ?349Gxqyx^oV$d-Ga
zuBoa-*gt*=DuF96Vkm36$;oqyZV1}U!ew5X7S$;^&5IeRHT+v6V|-Q<)4))SD4&qY
zgcsE`kLA298oV(r^IBfUR?$4oL;0Lm)G2;e)Oqc?j7iBbWHq|rh(aytU0|d0P%9bJ
zna6TQnKPYwAwxzctzeUyU2qhPOz)3Lm5^0QOM@z)Jvl|!fdqi>E{yCUoSjy(vW1ZB
zR;|WlbAm|%j8=7y^5f6J6mB=!JQR2UWBI{!<YovARu!Q-k;62dmSc3&gJm%-OwJp!
zZq{j7nNn0STbW~0drZ!dbNLM5F<rSColHzx(@lqz)pQw?r;W*in^cn}j|G!W7eIoA
z*MkT$(>W~-Wf>kGrYk9ojGaIGj_HE)0Je-t(l?z2HLIvIR@FAWm0B)nss!7?Ib=mi
z4!bcaBPN&Dq(Tl(6*s~ZlO$}?nY8I9m;_>($y)H7x&cPzO!uCrbW-VfyWx8BsZ-K&
zImIxW50?1~pHwIPUl6ZQ<m+4R-nw(^He2R=cfEJKCGK#MJG^@Aad4eb{pH5?Qe$kz
zxPRl`jZ!F948?A9-}u{BPW{=>m+Kqv-nesve7_oe7<v%e==|a1=~Dk#v43o%b8M^m
zM7gDXd46erab~@9Zap}^!_X~<wh`TM=pP(9(p~C^eAy9s{N5klUB7UtbYY?h{~aIP
z8M{5a<*U1U?w98l6Tf<YtFdLp{hKql&u-Jr{@!xa;pMAKS6B2$mlv-VoBBR!E(bf7
z$Ck!Q!Q;i?@zuG9w;tSjoY@Qx?J}sjf7^+It;?sEPA?BF4V8h6FU5an+`swTn~%<Z
zJhC?O`_WS5Ofhn1BlPBG@U3qGM^@6CfghAR`1|MYo!{u_U38ZlTkP*wFFh0<2piq~
zpM*EM-!8ZF+pVafY1zBvT{RZH#Xw~D465r~_w(B)_w8Eys;4w~u{d~fqx<4k+biYv
z(EWjX11qnrcdP5I8hEC?89dX}yv-4%z9nBN&{GWbJPK|GqFaGO%bpKCE2lOC$IB<9
zAIH{W8z)aMa+?9-;lBog&j7I-1pEKe)b~$7Q$zV>Ao9Hh6OQkDeH7y0(}v;tc!>F|
zGZ6REpS^ZsWWe!x>+n&S{P9O*;ZOC$4KVqllT5xC@WeUy6NUrM6K_Mj!||kp0sfPa
zC*JGAKF}9ttq@-DK%nwB;TEg1>BO>8z;KHuH7y%<k#{HwX?TZv1ae&pSwi~+;b#Rg
zTV1Iagp7i911^xPYJz~tD;W<!XEq4}xpj&ph=zfc$pYMOL0ChWyrQfNfXSV(I+FTz
zQZ0UgzN0Be2qI$eja_ui(fb|gDxVPPa2)}YDF9FagW*w&FnLd4D9Q*QgN`I#V>+u$
zRuV%UWX7mGC&_v1hesu$v=HXr(>q$tZW^xS120+4!mkWScUGpV;2b79>|r;#pHy7(
y20jN1a7&R+o-Nx9MNv;t*VoAX74m+C>Yt+4zoE!e^x9L@z3c3uz#`}@MgIl^I@?D8

diff --git a/scripts/src/aim/inventory/hierarchy.py b/scripts/src/aim/inventory/hierarchy.py
new file mode 100644
index 0000000..6cac53d
--- /dev/null
+++ b/scripts/src/aim/inventory/hierarchy.py
@@ -0,0 +1,69 @@
+"""Read-only inventory hierarchy projection for public discovery."""
+from __future__ import annotations
+
+from aim.exceptions import InventoryConflict
+
+SCHEMA = 'inventory_hierarchy_v1'
+MAX_GROUP_NODES = 10_000
+MAX_DEPTH = 64
+
+
+def _hosts(node) -> list[str]:
+    value = node.get('hosts')
+    if value is None:
+        return []
+    if not isinstance(value, dict):
+        raise InventoryConflict("Inventory hosts entry must be a mapping")
+    return sorted((str(name) for name in value), key=str.casefold)
+
+
+def build_inventory_hierarchy(document, customer: str) -> dict:
+    """Return group/subgroup relationships without exposing inventory variables."""
+    all_node = document.data.get('all')
+    if not isinstance(all_node, dict):
+        raise InventoryConflict("Inventory 'all' node must be a mapping")
+    root_children = all_node.get('children')
+    if not isinstance(root_children, dict):
+        raise InventoryConflict("Inventory all.children must be a mapping")
+    customer_node = root_children.get(customer)
+    if not isinstance(customer_node, dict):
+        raise InventoryConflict(f"Customer node {customer!r} must be a mapping")
+
+    seen: set[int] = set()
+    count = 0
+
+    def walk(children, path: tuple[str, ...], depth: int) -> list[dict]:
+        nonlocal count
+        if children is None:
+            return []
+        if not isinstance(children, dict):
+            raise InventoryConflict("Inventory group children must be a mapping")
+        if depth > MAX_DEPTH:
+            raise InventoryConflict("Inventory group nesting exceeds the supported discovery depth")
+        result = []
+        for raw_name, node in children.items():
+            if not isinstance(node, dict):
+                raise InventoryConflict(f"Inventory group {raw_name!r} must be a mapping")
+            identity = id(node)
+            if identity in seen:
+                raise InventoryConflict("Inventory group aliases/cycles are not supported by hierarchy discovery")
+            seen.add(identity)
+            count += 1
+            if count > MAX_GROUP_NODES:
+                raise InventoryConflict("Inventory contains too many groups for bounded hierarchy discovery")
+            name = str(raw_name)
+            node_path = path + (name,)
+            result.append({
+                'name': name,
+                'path': list(node_path),
+                'hosts': _hosts(node),
+                'children': walk(node.get('children'), node_path, depth + 1),
+            })
+        return result
+
+    return {
+        'schema': SCHEMA,
+        'customer': customer,
+        'hosts': _hosts(customer_node),
+        'groups': walk(customer_node.get('children'), (), 1),
+    }
diff --git a/scripts/src/aim/inventory/writer.py b/scripts/src/aim/inventory/writer.py
index f9f0b06..ac63f02 100644
--- a/scripts/src/aim/inventory/writer.py
+++ b/scripts/src/aim/inventory/writer.py
@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+from aim.permissions import preserve_replacement_metadata
+
 import os
 import stat
 import tempfile
@@ -33,7 +35,7 @@ class InventoryWriter:
                     document.yaml.dump(document.data, stream)
 
                 if path.exists():
-                    temp.chmod(stat.S_IMODE(path.stat().st_mode))
+                    preserve_replacement_metadata(temp, path)
 
                 validate_yaml(temp)
                 candidate = temp.read_bytes()
diff --git a/scripts/src/aim/locking.py b/scripts/src/aim/locking.py
index 33b4e16..2be1ba6 100644
--- a/scripts/src/aim/locking.py
+++ b/scripts/src/aim/locking.py
@@ -3,64 +3,81 @@ from __future__ import annotations
 import fcntl
 import os
 from pathlib import Path
-
+import stat
+import threading
+from functools import wraps
 from aim.exceptions import InventoryLocked
 
+_local = threading.local()
+
 
 class InventoryLock:
-    """Non-blocking advisory lock for one customer inventory.
+    """Stable-inode, nonblocking advisory lock shared by CLI and local services.
 
-    The lock file is removed after the protected operation when no other AIM
-    process has acquired it. A process that acquires the lock in the meantime
-    owns cleanup of the file when its operation completes.
+    The lock file deliberately remains on disk. Unlinking an idle lock lets old
+    waiters and new callers lock different inodes. Reentrant within one thread;
+    separate threads/processes still contend normally. Not a shell-edit sandbox.
     """
-
     def __init__(self, inventory: Path):
-        self.path = inventory.parent / ".aim.lock"
-        self._stream = None
+        self.path = inventory.parent / '.aim.lock'
+        self._key = os.path.abspath(self.path)
+        self._entered = 0
 
     def __enter__(self):
+        if getattr(_local, 'pid', os.getpid()) != os.getpid():
+            for fd, _ in getattr(_local, 'locks', {}).values():
+                os.close(fd)  # close inherited references; never unlock the parent
+            _local.locks = {}
+        _local.pid = os.getpid()
+        held = getattr(_local, 'locks', None)
+        if held is None:
+            held = _local.locks = {}
+        if self._key in held:
+            held[self._key][1] += 1
+            self._entered += 1
+            return self
         self.path.parent.mkdir(parents=True, exist_ok=True)
-        self._stream = self.path.open("a+", encoding="utf-8")
+        flags = os.O_RDWR | os.O_NONBLOCK | os.O_CLOEXEC | getattr(os, 'O_NOFOLLOW', 0)
         try:
-            fcntl.flock(self._stream.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
-        except BlockingIOError as exc:
-            self._stream.close()
-            self._stream = None
-            raise InventoryLocked(
-                f"Inventory is currently being modified by another AIM process: {self.path.parent.name}"
-            ) from exc
+            fd = os.open(self.path, flags | os.O_CREAT | os.O_EXCL, 0o660)
+            try:
+                os.fchown(fd, -1, self.path.parent.stat().st_gid)
+                os.fchmod(fd, 0o660)
+            except BaseException:
+                os.close(fd)
+                raise
+        except FileExistsError:
+            fd = os.open(self.path, flags)
+        try:
+            if not stat.S_ISREG(os.fstat(fd).st_mode):
+                raise InventoryLocked('Customer lock is not a regular file.')
+            fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except BaseException as exc:
+            os.close(fd)
+            if isinstance(exc, BlockingIOError):
+                raise InventoryLocked('Another AIM operation holds this customer lock.') from exc
+            raise
+        held[self._key] = [fd, 1]
+        self._entered += 1
         return self
 
     def __exit__(self, exc_type, exc, tb):
-        if self._stream is not None:
-            fcntl.flock(self._stream.fileno(), fcntl.LOCK_UN)
-            self._stream.close()
-            self._stream = None
-        self._cleanup_unused_lock_file()
-
-    def _cleanup_unused_lock_file(self) -> None:
-        """Remove an idle lock file without interfering with another AIM process."""
-        try:
-            stream = self.path.open("a+", encoding="utf-8")
-        except FileNotFoundError:
+        if not self._entered:
             return
-        try:
-            try:
-                fcntl.flock(stream.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
-            except BlockingIOError:
-                return
+        held = _local.locks
+        held[self._key][1] -= 1
+        if not held[self._key][1]:
+            fd, _ = held.pop(self._key)
+            fcntl.flock(fd, fcntl.LOCK_UN)
+            os.close(fd)
+        self._entered -= 1
 
-            try:
-                fd_stat = os.fstat(stream.fileno())
-                path_stat = self.path.stat()
-            except FileNotFoundError:
-                return
-            if (fd_stat.st_dev, fd_stat.st_ino) == (path_stat.st_dev, path_stat.st_ino):
-                self.path.unlink(missing_ok=True)
-        finally:
-            try:
-                fcntl.flock(stream.fileno(), fcntl.LOCK_UN)
-            except OSError:
-                pass
-            stream.close()
+
+def customer_locked(method):
+    """Lock customer-scoped domain mutations; nested manager calls are supported."""
+    @wraps(method)
+    def locked(self, customer, *args, **kwargs):
+        manager = getattr(self, 'customers', self)
+        with InventoryLock(manager.require(customer) / 'hosts.yml'):
+            return method(self, customer, *args, **kwargs)
+    return locked
diff --git a/scripts/src/aim/maintenance/__pycache__/__init__.cpython-313.pyc b/scripts/src/aim/maintenance/__pycache__/__init__.cpython-313.pyc
deleted file mode 100644
index 40b3121de28292d2f17f8d10277cc2552e59a112..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 201
zcmey&%ge<81kY!#%+dkUk3k$5V1zP0a{w7r8G;##7}6OvnW|Ks^YcoI@^f-hi*$4H
zlM{0kauYN2N>cL@^O92)GE#F2Qj3c9{4^PFvB$@!<R{0+uVnZPGV7L!eridweqvs6
zW>QY7esOY9W<g1@esK{{EHhUh$rSzg_{_Y_lK6PNg34PQHo5sJr8%i~MQlJrK&~nV
Sx#$BkBO~K22JIpiAO`>w-8eD;

diff --git a/scripts/src/aim/maintenance/__pycache__/checkmk.cpython-313.pyc b/scripts/src/aim/maintenance/__pycache__/checkmk.cpython-313.pyc
deleted file mode 100644
index 8e4eeb6dd119fa422d6c00ef3ec2187a23ea69cd..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 8108
zcmbt3ZEPDycC-Bc6e*GtsqYmn*`^awwk5^iie*dw(x*wSEk|+~id;&J$R#tojAhn`
z1W0l96?ceyfnhl)Y8@Kj6re?Qe|joVpeinRRnj_MTB@b4b$0=pLy>>VDS!+6Pv0!L
zlx@kr05=kM-@KXk=FOWoZ{ED!uv$$B%KzT}^zFZOA@o0_q7-c&pf>&qfSV|Yf>bv;
zM`4O4u&P^iPL0(vtnSue4dB$>TCA1dI;?}Yrdxl`fDMH{Mr@SZOxOf(ZMXTH1zXNp
zu~lx@b(fs8VcR)7w##*Wcj-9?cF<@<?L|RD(0GXQAb?DjC}?g|<z;KjzYuoHZ5C*=
zDs9*`ruLP5Lwfiq$sFdmln@r;DUOG#F&Y-akwlp1`=F*72n*vrm1I0KI5^OSaSBTY
zCeR~8fYt}tcQPz5Ncs#;q|z)0B!-T&y>j~?RCF<%%CcOfAdUP|=PT4k0Dzll1Ys(O
zuqsGlbt7nRL=#l+f)*Ll6d|n)>7Z3FLk571#a5FHnXz`v;<HNDfpBCZJjMoCK9dl>
zu>&_r%?nu4Cc>j^LNdhS36={dS;@qwGC0D9KzvCZ=LAW^$FpqK1fA(?bYF^tE~!K`
z#E*yfx4kBrIQB{b{uK53bdn(yB78z2$rK7DQ_)O<z?M+xolH1UXt9Mtu{h?1M4V%}
z6f^_kDV+nNEEM9&3PeI-LBR3RjKK1t5O#yy8}LI?OEW7(n!_9)A5E~$d<4hS0^iJI
zz{Qiz$uLL`^Wh?Fb7Y*2Oe81#>8scZl=6ejpRb3<U!kweB_EtyEh+t=ch&Cvpnuh5
z{ow4Xy>dxY3H2ZL<64Dg`xP66=4V$dr~>;o2Gy15Z4K6r=z^x8hQLMp(*w>N)INhV
z1T8_GOkoV_v1!ZzYvw$em%L+)<pd@TR><OSDq+0r>CV&@E|CgH=`aUBA(f0r!imIH
z8gw?s(giviU{0XZ`IYDC6h{l=EFDR40!}3oEcQnVTLX9^L|`yPYJ(`}CK|FQ2v#m*
zuq*mLr6iLO#$&7yipDXRx`t;HG293}ctT6lxDH;#0ODL+fJLm{W&(btwT95?;qg9N
zt!(&-O;&V-0)$d@0LTJ40Q;u;CK^^+P~d673s^5wG|W*93KTq2kpzGs)mGrILP_;7
z8C))mx|Is5K>LQETJZ=@bOwAJr(&ppQR%n&W>g9%8ugYVWJa<d0$-=l(+DWdn-mJ9
z$k>4D(W_{80UZUoVk#Qd0iQojc}!i0Vw6wQC#mr07PEAcHQWh|+o_vq5Cwqs^JP;J
z4aleJiz8$weouqhaFn<x*z0UK$rH-=3yXR*5l)Uq!|hVjwu_qg2L7Xo6c{4k4nV$p
z1F+yr;PHR&qnX&xCw?|D_sa6l_WZ6QTMImfemu;NC*q?pZr-P8h~Jbnaj<tumyr!$
zGLEy8(fAm6R-Z=Fq`?PEx_n*IM#eMT1a2ZjY2ZQA^zppZdc{jsy+ml5(7g>05b^6$
z&#l^@)-ILSU)QZ#OFz8yqf1l5k3%!MwThbM+V%zYgNn{6?W(=}mi2~pntfnz_*RW7
zyQoKMR8q69L-z6&TV2jpw`8jq4fT)ofc<f33;r=r3}e>U;Zy&c&vZhke`X&Nvy{#L
zO#p5pFy)u7Ag2nd7*z=zs4c3Xrd1u($~7HB0Z!kd2^s)rlyN2*X9k?5Ro$$HwYT<3
zRCCsRG0sI(S9rQNcs5(rd?jDYJI+vYA|(3}e-h3CM})YfXK~I>b~GO5=w_N3&2U17
z?(8~|wdbjuk`qlbbtr2Hfrs)(+0g=%Vv~$>2hMc$0E>=9G7PUkDl&1E4h-~eVbqj0
z`?*vYN5=g)o!r6;aKwP&Y=Hy8r<M$(VLpGB>EC5B4=1{$At)X+ObjJ&C%O=yW+S{*
zxxJZ?HnLOs5Io*TU)kIrzW1Z|ruik?j_aDQtd-NkbWCh`U93JXp12@dF0NX=Gr~+v
zeD&!3#rd-fLt;apI1m*r?5cI=Z0qb!aqsa3_kwY;O5Dwe7biqZVqLGXo7R!WXv(`m
zBArq!0Lb>>0Y?P(Ky7CaidzXhO<CZux!b`ps$ND-++EQnfsGCqooKM=@L1sSf<9`+
zDYDcsao%zX7!+vp4WXF^Txh|Gzkr)|liT*LG^kU0ynusVX$P6906F}hD?x+O;{_ay
zN;_~s0o!xrP#tn8v*6Uth|>&{!&5E+hXQTBNk|$rAEH!<(+-y@c&0d0PRFR>;Q0rH
zGO&*6NzOPFZ-RB;Otom3#6EIiNU&htO9e{~sW|g+MG<cf+Jg2&Diun75vWqIo9|$$
zG8-7*I$W)^1c)Dgu6WVVU1erlk2VO&pFQeK0pD{Bpjx!aJzLv28)FNW9X^auxbzu2
zD`)iJx7>`O1hr@sc|rS{0P*k7m7&R@kB8O+&Cj8s%9s?|)}ocbQT>nkqq>%O)xBG(
z0xer{K@a>@98%E;*4GY{8YenUovDX40vji5#FcV3&apj5#wf3!lW_(Vbv!kMf>NxH
z=mPj`Hy@`mpMJO+aIUB9?6s#D7C^AGD#i$UtZq?nFITYUkSYWFk1ONKpR&YqWfaa0
z7I#qL9DsFtzIYK+1{PJ=!^EPP(rvA-R^bVKJb%jS7!OmtltCb54IF!Z+)cZppO&zF
zYd?_C8tB-HSG2Ck^*!v{9XPp_Pq1#217qLbJ{cq9W}J+TaWJmdqPL;Jf_fn|B4Hy~
zRRv>*UH>{*l%ZfzZq7+;3f6gZ4bE(p0A>i>l{El;Rct54aJND^bam)M#>F_=3f_5B
z{$9`%k%r030^Wnj!c}rrTs7zBYPedij-wfO;IzVP^9}ohK19Lpf{>o@;8oB2hnEGr
zr&WEs^8xLP17hg2U+FVUD<cnkix3Gj<uXhHU%9ku^e7CsC9dSDQ_LZI7bo#9K^Id3
zKBnj$m=YG`=1MwBVpI$jM=SCJZuQS`tK5EX6?qr^*Y><$6#k#4`Z|>HU(%;r=`-A^
z%o$_^4+5+B(sg3d_ncq-pEp0*s{brY+LZG}dKfFLl+W9TkAfPqI|?CO;qpsjJsQ$8
zbeyL#WM<-+jrz0RXFC-l!)N=HjYMA=@hgus08Q}APHs<{%<ux8fw9O9yKv*CV=0^r
z3-r-s`0W&iJ5e&u$#1y5M8@0GN9A{deV0wNHyy?7yKxeqw$r=W$#62AU=P##{jL7J
z>HYhf_WAriRn{;r2x<Osb8}WtAOakDR-EE=WqBYQfCc(WTo|VnN;-vQ7-;=UYz^Uj
zvmB)J+1Fmij)h!<%&d4bD3JNH4oJE*Me^y2e8AsC!tgX^WAVwXiQ!q?)IqWl+4|AA
zK=eWoXM39q<H>D>6bBIM$KfIh;rcgZNl9IZC)rd+kW^Pjv(A&LOd?7{hK`0yOFj*f
z)zOevOVU}@VH%SoDQi|zBy5z<n#t0#$+U3wFg-|;bm=e#VR*^FPR4m5l$yx;H@QaO
z@+)j+Q6N{s(j+~`(~$RIBSH#ar6tOr)%wY-eJV`$pQMIHOd_55CzLF-DH-SaI5$SP
z@7d)3(iBacqkTIit$cgI<mkgB<qFq)Rx-vi3Ah}A<v@y#EG$pf0%pKPWe9hWo(2J?
zNraUgg8-#)7+>vFq{bwi$KclyCOHkfpHRT1J0rvsk~xw}UnP{O(YG-<A27LyN|wRA
z>hqaSeSa_yXg~zWaf0qhc2LrV({N>v;zNXvWP~Jbasm`0>0|}-l0G@X6VW79iiZ?v
zRKDSBV~GquE@@-@RW1Tpl7dW;>pY|lC1clQgiVtiEaU(<$P`XUdd#L1;Rq|I@O<@{
z_-0HFehg<P44J>gnG~yFqo9stT24nwYJe~a&LuTuHZizKB$=a-PKa}IqL(nwCvFXx
z<<pS)g;{~grNQdd>|_K(Hi#&TB-o<xmXoBCfn+~P`a;s>Q)7~W<VIzTDi)PjYK+ZG
z0ILeLk|oXoPsnbP6bl)ZBxFG+p?o4%BPU*skRL7NWA&i|XKh~9#!zugV@Mf{hogyH
zXJ20A%Pwvu6WR8rn@_dugLa<L$cZ^;)vfj$?Mu!bE6zPR=bqV?C1>+>!>Xg=R@059
zkD9ORe`j;AIV#1f<4cYX(bDldTe)0)eaUfLv>acvm40~budj*Kt#e~5w)UK@9a`5_
zRH<)6t#+2IBek_;-GJ<#6`MC_^NKqTuh@>{Y)51sLracJqUF-6&Anoyb2eJ6Z&|Um
z=4`EUYjDXiC|U-;vb%1XZ<wdgEZP0nwW}Q`ubbAaWh>U*_pQ6dy`A^1U5lPINBPv`
zNB-+4AMS3-*&C*`(`Qy|>u+;Y=5>{}^fI+p+c*=M>k&_|VoNMnJ2rKCt%9C$&w1}x
zw9R`~P6l%)gW}-O^2tl$<;a?+cEz*jzGu(u!DY`;$oq6sZ%`{0Z7>bbjurQ=oO{=j
z+qdH0mvir%(yTh&)B8R;v{vbz8J;Vf)6f0ILd!y<xZ})H<yp~1^2{st`kcLfrfqg|
zA$qUp^B(b1bg73Gy|D-Ov2WeT=U=Z>TX|{~=4rcOTd_Ch?2WV0`9YCDCt%b;>H>BB
z)Viw5y8r9WzMSj$RM(7QcIRBfykWJb{!Zw2Xm&DJb71P!>Vadw{J}4N@XPmp@!qs>
z=i2RSv!|BpS{6H}&a5>ytu(gXZ)}@?XTh^zT5J@L4Tu-sSh>LF;J-0;qi^cOv}vuH
zo~c}_es!vAU1cb%U8||PbLrztGkCUjxn}R&srgg?+WpVni<;%5z2f=HYt`PBYXALe
z|LnE-3(M7=tJU5+J-2)Qrf;pf_Rg7)&&*u-`Q@Ko{=3j}bsJ>Kj`dM1HG5$)6}5NF
zx6LzM%bq<@E33NId!v`=X1;7ex2Rbh7l+;wz2Ozt=(jbfi|VJ=X|#9$l>Q+zoO7L*
zC*C+$KJS{JgjIKy-#YixbJLlb*s`l>)m3$???&Gz$L7iwb}SBw7eh-s-g@8)f2&0o
zs1XWMbe_5m1G-E_sGMtP>eO`SjBl2iJ3Y@VoL#)S>Z-WabE9XrbE;>_wGUE$q~D_u
zg-T9QIcwJ=i);lCPF{KpmhhmW?a9}k`cDr2{m8!@5Zxy?5Jilv(knI|oG+W#&%e76
zSzs2ui^0V%aYtaOGALde5nUrs*43orlkXhJRRu(_>TBh-Vtv0jFt{=h$_<3X{<p-p
zM#V@>932zu#+S<DVhW3POemrE<3}E%$p=S!AA>d@)a-rooe5PpZXi`z?W(8dj^(yx
zPBU%EdD@`1t_AFq?_7nkQu(pE7d!9uf8H;4kBB30ilI^Q&4^eRT`FhA2~M<g@<1u-
z$%gLxY3h%8O+7BC>c6aAk9iB6j=yT~oIj%e)v@wEr1{KQ+UwVU*5K}~Hhy-*0PwHX
z2EhN?+(A11rlGR$fa*8xDuDl;>S!I<rCNN=Jz&&)Zgun@(0^XnVd-x)e({O{Dqplz
zK*N7nIvSzZf9|UXlDpNW-dC)5cM`sL{ifby=DP>g!2RwK!tm}f0)L4r`&#v1R+jZO
z>%VN)61Y_jtzRB6^?SAVsOtV2?Y$Z;fxQHOuhG=sYQ5J?hP-#cG@vt!lmP}7ja35;
zda*$bql>#t=N(#cU-fybHfPlWoO7tpm#K1PJI)`}<_;1*xg(~4QIE;pr4OPAa%{>c
zv`>S{onD3^mB|Vj%wdvy^6B!Y9f9Q|PsZZEgle`j0fEf0kb$^y7|xbg;ZsolaryGg
z$ec3SGam;p`^?xwMj(kL3^yo*Nis>&heFX*1U|y;A~g#M0OFA(D~zWK=ROHQ<kJO{
zZ#(k0x_q9$j#SABB|iv9o?L5xi2hr1{yPn&ZG`Qob8M)zTJMG$AaKiC?|O-h(`iiw
z96*okCn@dzJX6BYS4KWE#xkHG_{fM!?h_7m<!dd=V>rbSCW#&#B9DI30fIk)d~V1`
zLkz(O3El#60igXX`KJ3+1XNPM7vh7>_(>{(_|FfqK|W03<ybBMjZvN~N!V>FKr$T7
ze+_NNKY<1ce*6GDVDD1YZ;|&8sQw`;d5Dbg|6AmFh^!Bh?f2-_-=kOlfOdSVLn`xB
hLymGkQt2qyI)Vr2Mdev1)klsuC~E&75qZiZ{y+TiRonmo

diff --git a/scripts/src/aim/maintenance/__pycache__/repository.cpython-313.pyc b/scripts/src/aim/maintenance/__pycache__/repository.cpython-313.pyc
deleted file mode 100644
index 4737c7e103399a26212bb56664709f4cdef39868..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 5183
zcmbtYU2Gf25#Hnd@K@rGO#N7mb+Q#lltZdbOe0e2w2ma#l42#{iH;IExSq(Pcn)>P
z?j3E5Y0#nuQu(2XRltyf2B^|LM1GT>;zt(_Q0FP9FsRt8Qxs@}!f#3yz^(hz**lVw
zW!Y%a6*QdPncbb)-T8L*wwjuJ2+H5zzjkiUkI-L9rCwNvp|(B%<|-19K#ij@3R67c
zUE{7X8q+pUk27N|W^JAs=P(CycHBMY!5$u+r4J&36Wjw-I|9zL9|_*1%NaZA{2=Vz
zrR4)H|3g|ndxQYUn(8v_pJigrcgZ+0%JNI9su_}@XsQlXZ&os-OhM8~g?U9X@)N*#
zPK=%&!C1qSP~mb|E6Zx8W{CYmI~8gx1<X}+7GX+2*d<Vyei9r%%Lw#SAQ2eg*apWn
zIJeDtK<c$QA8>w~3t)D(Db{QSQ*u$$6+^@G0+=h`CA)yhf?G@x%(Q6Tz!o=yB{h?`
zJf$L3Wogc0^0Jh*m>EqgSWO0&GH=OQF{@x>-l7%Nu!1GE-kQ;XzlJ8Rah69ERcTHZ
zMaw6Ob6U1kAbda+e^inRHAzqua|+gtf}+Z*24ZN~v6#>h6-AvaZAO#~11mEnL)JwR
z?*pT^;2&AX`eh^2FR8jRQ;_@h3|5MU-mhb5Q|9{TBrs4`!6CUHH@r_2=dl+$+k`BF
zeh|pd(O-Pcm&U4r;HB|ubNJHfs;}wNXtkxS!n9SR?SEj}@we)o_TITuAb!lwkv(MW
z9U+{vha7Ou&XG2cE%m~F`C@*{C(Nsvl&qHu#$Dnt4gi7uk#icBEmq1IGRDnB5F!G1
zCNHV8GVBytF?)$7aFmGc&bIAOkZM<*kaoQj2)J&0?I-@*t~WXUzdP#qOuGEHJ_{}k
zCr_aFqjL;q1@JUM2?2p4^>Z!=(<Z@f%iKaU2~5!P2wv<3pMzFN$V*x6!uCnMOH3}0
zoR(B+R^}x>lb17ZX(fX<@{+;ZyGsI3Dir4VIfVq6&MSt_XEZgZ%$Bg6<?9DIk*NUy
zjEE57A?BzpvUpd~RH#5&?J^5dJ#me~fK4dog7uUOIlH2hPCSo^P2_+ps$#$)?bvN}
zqAub=QFjCRDXQ*k|Ap6H&B<$&#oB&kC=iiCeu*0VQ(J$7+EsJ_O%sV-QacT=wE?P8
zf@`{lmk6a%imQos{3L5L^wVkAtCT>)A8g0~qta<QMb6W%a-8a|wPayVz*cuExJw19
zbp%ye7=^6guJS*Q!lfItO0R+^bSkoIK&T3y!3zjUCqT~a7{8rZnPzvifW2V1ckfY}
z(X%eqJxzAjE`m?+r$~_ODrr}J<(iQYNV}mQQ*V)}G~0u^(X^-D$&Dn4C6(DRE|+G=
zT=hO_Ms^9Hae~QFIdq)vLOCkdG-1)RicxmOhbB+PXp1rAi-y&lk%|T!ToF!rv1H%`
z%u;R}(n^Ia5BCf&Uz9TdgFN&c<Sn=&h}<V%R17%uS(z_0AmJ^FFMIi%q!i@rAWzUl
zFU=IOmXUScqH#&J(ZoL0miuMFzM3#OKo+MPS(w^l0sfVuT?L%6d{_pnR5FFdoYNFF
z=D~fSZ`)@v5}wuJ8i5HcTE3XEILCU6g}xfxDp}b8TXeEye62WP#E4+76@55_p!pDJ
z>vw?s6m7aV?+A6L<%y*ie)&Q*+`7zskXh;ZDE49OSE?C0x@rKaMmtt}*5t2QdSCOx
z@MZwDv@IQ3JhBlvv=Z3}_pOKfD&eOWxN11M)VbKX5k9!$+6cwgL$ONe$O8Lkf9T5O
zlDH_YQk7_|8r{DUJ-M6%vf8&c`LTFiG>?v$y(bq=-ihpAo?JQfQSXPnt4DvEFuT9A
z)^X$5jb5{Js1g}A1H;u|bfM{=-vm*pZ3|Jv?8tueiKA=6+KAaXScyD;vjw#Ny-5?<
zeZ37F{8|4{7~Kl{hWhDSox!0#`c@wcd;=gr1reyX5$iXw<yT3-lh$1&1sc0cJzN{1
z4MDRF90IlXNIQ=&9C?%?0JW<KE`hEmMFL|7=!0Xk|Hs&nzSYOx5#A0gc~mM*0VGTT
zBtS6l@WxvYxyRTHK`#W7jN^>zdZcfSgb(0yZ~vQxpb$#d)?8&Cp%oS)LQ6x7ohHeL
zUG`p`sYsgMhLSXsYO3pR|JL`k?(K8~rqgUHyscN~>iR9{45z#Lk?v|ir{M0_a*rFm
zabjTAPj?XLeZ_SeZa+UjtnN~|`s~Tt)zbs5jwFX-`zFfq(;8fn8dlU<zLuNukU7d3
zl7#YEP1b9Wrsx1>_q|v?A1_K+m&?(3T+!nS<aJp&enG=;#UU95<S}qbF1Jqr4odtF
z0OyE^j83G3JSHnuZjQ(Gymld;DPb(DMmg9^&<AeZEPra`#Bi)UG?|zAxra^D?c{^s
z&J=kCvI&)cpgT{}D>-pL5RXeUGsI#n=kD)=Ip^nQw1Sd}=Sqb_oTRw-neV?{ddFhO
ztOQ6UqokMp@pw_g8My$tX&JgTvgddXz*;}9YGqGBcPeF1Jgyme8SCXpJPx>8D8X{T
zKx$UP*_hYCZ%)xkK5oM|9)cBcvRiU7;{hNRU656{0Ez|0PPO%z+ktMfT22N@PLJiT
zrSX=xVUxv>+}uuK9zbn3>`W21(Q1DPxNDMUU__m#?9?aN^4|RA`Hf)Lda!FF*u5U?
zwh?jc_R-G<J{`Dy#Oyp%iM(b8UaR_p?+siYxH4@X9H{sQZ{#ZeVOur1mi<_{uB=U)
zohK@h7tO$n1jRcRJC>g_pG;Q5$2P*_=HNJhyFYA34_Ew$Nw>})Rw9xakRXX)8dw}y
zo?cCugRhvWsY=W13!bWD)^g`ct`dwdFx5!wQfx7{d}?LROpaF~FD<wsX<Hgy99=%Q
z+GidctLz(J@ZJd?ST=q=|Ni{y;TyxB^xVAg`*(i#&aIzRUVQCN*TJ>dH<F|4$<Z&M
z|Dm&=C&yPOKP!J){_Mve4X-E1*AJbobiKJnQz4Psgo{C>{$(9HtCKYBldkrWK<g*Z
zb3h*eeF7B#FVt2MmeK}&_}yJdCRm3`07jJBTgT4*9)P{Q^mf25WLA$Fi*3wDPqo-E
z3=koBUT%Fv53k@$Q;<vf(==QxG&~5JAPXgcxt9$DR@pjWKE{e|uh}WVzJ4H=n}+pr
ziV#Y>V9qd^Q;4Klpe@h3>!2l5+t<cabgDbe4$cC^G09p^-9sP@pM;_CI3cG986{*4
zh{fjM<(V(LA)FzdlJT>ok;y8#T$uwffM74X5{Z*IZYyJ1mklDwL*SNsw;wowHXs31
zbh0~macA<4CktQpC-{+zB+>x9%G}fZEFhmnC1SJ_=mdA|2VIPFLb{tYkW9hyV|h+9
zWRbkyaSv%e2t+46oKUXiUpl-p_sG9U^9j=7b0F}1sfF9~t6U}A4{^44NO=P9c`tjf
zJheRVh3Cm?>;5HWQCab?o~g7RUGP_<ot0?cWxU3G?7i;2arkEM?en+u=9ww;^{hE1
zn=j=|RbTU(-!>o^8zVipa^?%q)78+vCGVnl`N+!oN+_|wR{f!hzstskk(>FOZ`^*{
zoX(kV%$l=vFo-#4m`2I$JYR`iFasCv1Ur@wueRSvU;p0C;Yx7S^wi$9G4O37=CWbb
z{t^PqcpTcC<d|gM&fA)El3%+S)ZZim5}9?LypLl(+)CO>I)@<(LKrSg098@UY8m)u
zafCG4=qwP9yzVf0eD8jqA0};tkXNS819=zyk$L$WhGIK5Ih1(j9%^D+zd6vviqyRW
zJ{CTX*>8K&B^DrGTXH4){UBlz2$sL`JxbOw$$2a{`Px%ZW^9i!$qcM!_*#;H`$aC=
zpRt^)gm~zDEwF8R@H2wt`L6R-=LMVrJrc$GSs;+rQq-5|;8&>oOVs`+6#fbw`kF&7
x|COF~s_mYOqdGPbkS!Xy+99i_I=+r<OIfOU69K77fx8z<P-E0T5TUlC{{chFc>DkW

diff --git a/scripts/src/aim/permissions.py b/scripts/src/aim/permissions.py
index a661f80..778c18d 100644
--- a/scripts/src/aim/permissions.py
+++ b/scripts/src/aim/permissions.py
@@ -1,7 +1,9 @@
 from __future__ import annotations
 
+import errno
 import grp
 import os
+import stat
 from pathlib import Path
 
 from aim.exceptions import ConfigurationError
@@ -14,22 +16,95 @@ def configured_gid(group_name: str) -> int:
         raise ConfigurationError(f"Configured group cannot be resolved: {group_name}") from exc
 
 
-def apply_managed_permissions(path: Path, group_name: str, *, directory: bool = False, secret: bool = False) -> None:
-    """Apply AIM's group ownership when permitted by the OS.
+def apply_managed_permissions(
+    path: Path,
+    group_name: str,
+    *,
+    directory: bool = False,
+    secret: bool = False,
+    best_effort: bool = False,
+) -> list[str]:
+    """Apply AIM's managed group/mode policy.
 
-    Files are group-readable/writable unless secret=True. Directories are setgid
-    so newly created content keeps the configured admin group.
+    Normal callers remain strict for chmod failures. ``best_effort`` is intended
+    for non-destructive maintenance of existing shared files: content may be
+    writable through the owning group even when the operator is not the file
+    owner and therefore cannot chmod/chown it. In that mode, EPERM/EACCES are
+    returned as warnings instead of turning an otherwise successful content
+    update into an operation failure.
     """
     gid = configured_gid(group_name)
+    desired_mode = 0o2770 if directory else 0o660
+    warnings: list[str] = []
+
+    current = path.stat()
+    if current.st_gid != gid:
+        try:
+            os.chown(path, -1, gid)
+        except PermissionError as exc:
+            if best_effort:
+                warnings.append(
+                    f"{path}: content updated; group ownership normalization skipped "
+                    f"({exc.strerror or 'operation not permitted'})."
+                )
+            # Preserve the historic behavior for chown: being unable to change
+            # the group does not by itself make a writable managed file invalid.
+
+    current_mode = stat.S_IMODE(path.stat().st_mode)
+    if current_mode == desired_mode:
+        return warnings
+
     try:
-        os.chown(path, -1, gid)
+        path.chmod(desired_mode)
+    except OSError as exc:
+        if best_effort and exc.errno in {errno.EPERM, errno.EACCES}:
+            warnings.append(
+                f"{path}: content updated; permission normalization skipped "
+                f"(current mode {current_mode:04o}, wanted {desired_mode:04o}; "
+                f"{exc.strerror or 'operation not permitted'})."
+            )
+        else:
+            raise
+    return warnings
+
+
+def preserve_replacement_metadata(staged: Path, destination: Path) -> None:
+    """Preserve metadata before rename, rather than silently re-owning as root.
+
+    Existing legacy shared-group writers cannot chown to another UID. For that
+    established profile only, keep group/mode and explicitly warn of the owner
+    transfer. This is NOT a managed single-writer/ownership-migration feature.
+    Never use the exception for private keys (no group-write bit).
+    """
+    import shutil
+    import warnings
+    old = destination.lstat()
+    if not stat.S_ISREG(old.st_mode):
+        raise ConfigurationError('Refusing to replace a symlink or non-regular managed file.')
+    active_gids = {os.getgid(), os.getegid(), *os.getgroups()}
+    try:
+        os.chown(staged, old.st_uid, old.st_gid)
     except PermissionError:
-        # A member of the group may be able to create content but not chown on
-        # every filesystem/NSS setup. The caller's inherited group remains valid.
-        pass
-    if directory:
-        path.chmod(0o2770)
-    elif secret:
-        path.chmod(0o660)
-    else:
-        path.chmod(0o660)
+        if os.geteuid() == 0 or not old.st_mode & stat.S_IWGRP or old.st_gid not in active_gids:
+            raise ConfigurationError('Cannot preserve owner/group for this file; no replacement was published.') from None
+        os.chown(staged, -1, old.st_gid)
+        warnings.warn('Legacy shared-group replacement transfers file ownership to the current writer; group and mode are preserved.', RuntimeWarning)
+    # Preserve supported extended attributes/ACLs, but not the old mtime: it
+    # must change when content changes (catalog/config cache invalidation).
+    for attribute in os.listxattr(destination, follow_symlinks=False):
+        os.setxattr(staged, attribute, os.getxattr(destination, attribute, follow_symlinks=False))
+    os.chmod(staged, stat.S_IMODE(old.st_mode))
+
+
+def configured_key_identity(config):
+    """Resolve an explicit local key owner on demand; never change process UID."""
+    import pwd
+    if not config.private_key_owner:
+        return os.geteuid(), os.getegid()
+    try:
+        account = pwd.getpwnam(config.private_key_owner)
+    except KeyError:
+        raise ConfigurationError('Configured private-key owner is not resolvable through local/NSS accounts.') from None
+    if os.geteuid() not in (0, account.pw_uid):
+        raise ConfigurationError('Key creation must run as the configured key owner or an authorized root operator.')
+    return account.pw_uid, account.pw_gid
diff --git a/scripts/src/aim/playbooks/__pycache__/__init__.cpython-313.pyc b/scripts/src/aim/playbooks/__pycache__/__init__.cpython-313.pyc
deleted file mode 100644
index 20c2c17ffce23845f4cf6812d89c112ae22803a0..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 147
zcmey&%ge<81kYx!%mUGmK?DpiLK&Y~fQ+dO=?t2Tek&P@n1H;`AgNnM`l%(!`iXhP
znMpaR`o+mbnFS@q`o%>+vCLfkf}F(4r2PEsV*U8|%)HE!_;|g7%3B;Zx%nxjIjMF<
VtUx0`RuqF6ADI~$8H<>KEC7pTBUk_c

diff --git a/scripts/src/aim/playbooks/__pycache__/manager.cpython-313.pyc b/scripts/src/aim/playbooks/__pycache__/manager.cpython-313.pyc
deleted file mode 100644
index 438f0e72b1a116b1013025f7624bf3eaa1b34f89..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 6262
zcmbUlOKcm*b$7WWmmhH{Qj#TEvR0yOi;5-rBh_(YH6L4!KC$d@Ovi!bY}VvT+L*u0
zE^UkHK|qkyF521wV#Gy?#_1(CS|B;PXp5$&=17J?L@b;%K#@akaug(JPkl4Xr6@{H
zgAT~IZ{BZyZ{EC_^`<5-1I7K$-IxE`!Z80L6}vQB2)q6U%P=>Y-3($7JHt$~n3V|5
z&2ZBW?4Y<~hM#s~C&l?0*R&hEDejyRrajm*?ZsY+nRoOt$c5ZT*medmp_4(LG0tjb
ztlBE}&HI4oMLy(5O(=lGF_*=n^dM?RAwnN>)=|T#1+@aTZ4-3|YDXPgWINGL)P=em
zEbKx(NZLZ}MSUo;h1!pHqdjPEgM|SUMT1+YkDz^MXbW{1jiCMY)KMSyqXY9z=-^%$
z7CM9jbcRM@hQ{m}!s6mjqKCgG!;Z41PswDmhGJ;hj1E;#QZbZ7O3_J$Kdl%`@NJ#A
zVyHNyq>g3NX(f|9p=c>J8Rg98ghh~*OF&XCq*T+7^BGyK%AWyc*8<KK)J(#fW(zv3
z54*ks$W3OR!7O4hhgj?Y@8ITn<e>d07+=GjHOxgZH*f`td9V|anwQpm*oFL1YpT}V
zv=*q=1X>fTdY;8#wAu8ZPASV5ve}C$rzXB8o@_dF1DlSE>axjal(cFJ3ovF2ODKlA
zn8nKl(a7gg>KsV!lZJ<f&zqiHN--9)IIZ7hOfSp=R^&?x)=!u`SWm%x<#i*QR<W!@
zL)wCtFa<@wDCc0l%_gkAlGm^b8u^ql8}*ukERz;x+4RbCI-AU=2=15VSMo}#$`NIG
zLBqO{(lTl$3v3|NEvYPH*p3WtBVY#s?PPSVvaFLuPsoa4VC_QQP<0Ru18*JvjCo*0
zH4-CAM%Q3bNAv{Na)v&lW1wm25f~<&E`0>tL0MGsaBdm<K#u}4fBFP~pEF;2{I5+`
zyiKo7RRYbgowR_stIY4J^!2Yy-w?}ue`Qys$hY1w%6z2K+PN}$HCg66E1f+nCvS{?
z#`oYJ+pZ}lmej<>^hG(5Qk6_TR}ha`h;)oFPR<m<4HCo4>6GcNa=~GpFirU@ru(v%
zNoFsDj~BWcG-Oz07;<vlz<JdS*xaO=OJ$b}f#dXBYcI5!Pn&DCY55#%CRI*kGYi^c
zp*2pcwyJc@B6n;nO$<d@+z&%H+ZrUQi&1E6Fo>*0Ds*lyPy6Ogsu%K$a!$)E!tMrG
z2y9TOg!4F&Fn3yHUB#EcTX7aVPghfFg2ahJE23m624o4<$UQ%xLv05wfusg5pVz@}
z3f|*@OL2;~G;*m<OIpz~1}sV@p~5~f5=(McF9;Bs5=+u4RA}FhPc?lfH#E&qy%<(u
zHyVYe82w6USvS;lp>3-OwbNBkzn~;8=5w-oNzE8?D!W(+JxwW9Bhs_kMZF;XkOsBc
zS1$oO5gV`{v$>p_glWc?w1lb`+7O{j$fCnMSLu8Hw=QX;&~8Pi`p{;FsngFs^}^Gq
zPR*dG1NV{bHAuiPfbGL{4mg{`G~zlL%+EXFaCLMtFY~oy*98Y9Pbk<8hpv-i0uoUW
zxe5L<i#<?lCWkhydEp@U46|?;dntv(J_Lu@qAMCUMZ51Ottj*L>!gR(!vj!;A%{NH
z+4U|!ZZhYBDMF>?oRore!zzo+U3M0>zsHWhy6LjEWz=Ev;MfcJQINz(0O-WNBuQ9;
zFA2d~Ml&F;wl{QU*yg-Jl>7izm`X?AF9Vgfu3!0R)JoJk0Nh$vN1<|)i8C?yHkMd5
zi>aq0b_haiKNIC<=>cO!-Y7?VYYG@#Sx##BE{h)nHJ!9s?L1F-W=mto3H295l$-}E
z%$H*L`m5JoT@@oGF>?E2Njy*#4s7i|nHD<L5+FC3x!Ty~YJDE7()t;E7=&QL`IM#`
zX5iRUXC|IG6?;KG6+1o=!%qUUzMtOeiK?l(+1c3J4c@PbS`&a3=DrwyYql&#ibBNd
zX{`^yCK(;=={z9NQ-D?pGiN!S8)0-V%uK?GnC;tczT@m;=NKjl7Ei*_8Rt%OC*jQW
zF%sxyxPE{ZwqTDE9|ZH5WVx`N$Qn=_{0h$a&E6EEBpEUU*-j$NzQzG>m3b3v>Jb1d
z%;&v>WpVQN9k*IONZ(E0yHXl{=57AHj*>W86ej=ui8!eXAa^Ys<!`&9{OqR9!UKoS
z%O`+<2eR9F-~jMQQGQCsZr74919PBj6~uxrvDQ!m%puP90hI+0uV&o!Vu&N&9Je4F
zBfV`XmbY)O4edTuBkGtf^c|}vSdyko)qE-`!F)@(YRV$fogQ`4jL7t!RZ@9%0^=;k
zBJ=}4ML-b1-Re?K0d5MlxIyNi794mukCwLXFG76_<n%ZI2ns%N)z=HZFTy+Tw@Jmw
z#7D`0Xn)r}nk)7`S8j_HgRx3@$J<BVJaX&RQh4yrxl(xS9{;zdKQ)!Y6Gi_-1@`Ci
zwdGr*?~eawyd(}3g#pXwYwH2c)YkS%sL<$A+n+$FmUAKd4iKx?t#a)UUfaF+G;mC}
zrbC9AQt>R*HoLQDBkk{K^x_)p9ir9=0A`{(l9sYKuqy5^iTlgq!J=@G4hOCZke#J9
zBVl_M83FMi=qtN^9N<I8b-*51#u<11(AaAJ3_dtlz4?JRI_tca`#<#SynfCNJ*EY*
zw$)9odTRVSEyN<n97&*QiPt!Fv|1lW_>3#g#mI@%P!Lb{4sufHA~55QJ7R$bF{s)-
zQX(*V_m3JeSlO5{<c_-=cKeUAqCnJ*yJFQBf%<+SA<hQi9)E}%sf}J@p!cDADGRUl
z9_)a%)~yoAYtKE{;A`@5zj;XOzBu2|F1ax^6zkN;2oJI0j|=rS>{DZ|!!~p7r5M==
z4JAf$mxh9xj&K=I+!Nc?z<_FPG$bZ(cvE0|>CLOO$VA22La=(T8?u99VPDL;dnTpo
zjb4IB0f?LVO!6^li!?W+nchX5g+!R#ZcT@hN)<ep$hDPbo{<e}b~vWYdZPvJ&=4gK
zX~}~7$sEq6a|R*8eRzo6hYRkZAsP<~+>i>v!I8L}EcDo6Mp~e65YlDMSd!E$ngJb8
zs!}vagBC_GPiFH82wSsR;{+Lo730a~#3ZI*l1G@XoPr^dx9-F)@@kPu(p$3WQXm<J
z3cWlFM1kan_z9xr#j26V8PZ_XYaRHf2;HM)$h81o1~54_@L56>>^U}h1uyERlMdSS
z)E);+7glwcIh|aa;b^HAEB$o9Yl<1R2VG5rhk^Jz5Y}IS2nkWOdU%{Ehxc6-D&me+
zv8N>VtctxQvG;x`a(l8I8Y=pSDq{PpD3wHMRqQK?eS|Yr4h<Lm!}mq0*n4PI94(2X
z_d|P&182*j=ZpU5zYO->KK{qZ9qkXpe~H{%`twjxoV?0cf*q?tsT7oMA1wt(KHOaj
z9=`WTDL8S}Nl&`&RbTgQ_5JjF>G!kmWucYgo~e&_f4rmE|6Dl~EBa#<U-0_)wejmu
zTzjJ84_=?SHgl`%&cL0{4-XgjK3;4;`l){$3|$|;K5n!9pZa%y;S1W;j@uK(_Q6m6
zk5oFk-|hKr&($fL({gLM*dG1NKls4GbVk2*F`-?zk{|f)`c?;ymf+Vse$`d+HLv=*
z;73L}IQ8+K)#<s?^jvXjzBq8c9D1?ne{s#h_`9t`$;z^=oPi@tMOGe@lLHd)CHNFP
zB*i6fK<A@8P5h{9S-cSC*~^C@A3Sem#xBc4NW{m)cmCrA1Jci=*=$Cos#X(?Vpt;z
zq*+XY9(W&7wi<kiV5DPprilk`=$Je)A8o=UAYl@T@J<3q{K1a{0B6P7oQjQQD-SwB
z7}ErhOaPxDV1WP<mFQy;oh0h2c$Clxcpd)wF#vBc-*B9>dre?mfpv~`9$a?-wnngT
zU97X8fGPGnm(v;jF2Fhut+|*N*$eFVOuJKNzoF2wPpr;HgX9%#ArA`xuV5I`0mk&z
zUMp1{leEEfljJL<U7#~z2H>%3SiO=^bM$?a?tIg45v><ZOd|r_;B+x)D&Gy3@B{&L
zP;hE68v`|kqt;X0Pw^|jAW4dz0l4O1S@sL2?<=PFbEf?(X8%8#M<2Kt&Ud4~#P0Z>
z^RUty0{|w0YhNSP2VIP_xgvDXUw1_SysIKa*PGl<*MlJCwO0iA0hRF9eJ)@GD5Iw$
zz%N1>E%gkkBEYY|UL!;`S}H<-S`!;g?WU%p6`_&QSrI^KS3Scr1*A|#=&J~=4W^)@
zJ81ijj6HM^gIhKBQStqCjI}vVWA}0^o}w?Z&S)&lt(|i)p|O>~_xu5tI0k`qJ^l+X
C%g4F^

diff --git a/scripts/src/aim/playbooks/catalog.py b/scripts/src/aim/playbooks/catalog.py
new file mode 100644
index 0000000..523f1cd
--- /dev/null
+++ b/scripts/src/aim/playbooks/catalog.py
@@ -0,0 +1,224 @@
+"""Declarative playbook metadata and typed, opt-in execution parameters.
+
+The catalog never contains passwords. Defaults are documentation hints only:
+not editing an input must not turn a role default into a high-precedence -e value.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path
+import re
+from typing import Any
+from urllib.parse import urlsplit
+
+from ruamel.yaml import YAML
+from ruamel.yaml.error import YAMLError
+
+from aim.exceptions import ConfigurationError
+from aim.integrations.output_policy import validate_contract, OutputError
+
+_IDENTIFIER = re.compile(r'^[A-Za-z_][A-Za-z0-9_]*$')
+_KINDS = {'text', 'int', 'bool', 'choice', 'list', 'sequence', 'secret_ref', 'url', 'serial'}
+_PLATFORMS = {'linux', 'windows', 'sophosxgs', 'pfsense'}
+
+
+@dataclass(frozen=True)
+class InputSpec:
+    name: str
+    label: str
+    type: str = 'text'
+    default_hint: str = ''
+    help: str = ''
+    platforms: tuple[str, ...] = ()
+    choices: tuple[str, ...] = ()
+    minimum: int | None = None
+    maximum: int | None = None
+
+    def parse(self, value: str) -> Any:
+        """Parse operator text. Never accept a literal password in a secret field."""
+        if self.type == 'secret_ref':
+            value = value.strip()
+            if not _IDENTIFIER.fullmatch(value):
+                raise ValueError('Enter only a variable name, such as vault_checkmk_unifi_password, not its value.')
+            return '{{ ' + value + ' }}'
+        if self.type == 'text':
+            if not value or any(ord(c) < 32 or ord(c) == 127 for c in value):
+                raise ValueError('Enter non-empty single-line text. Use - to inherit instead.')
+            return value
+        if self.type == 'url':
+            value = value.strip()
+            p = urlsplit(value)
+            if p.scheme not in {'http', 'https'} or not p.hostname or p.username or p.password or p.fragment:
+                raise ValueError('Enter an HTTP(S) URL without embedded credentials or a fragment.')
+            if any(c.isspace() for c in value):
+                raise ValueError('The URL cannot contain whitespace.')
+            try:
+                _ = p.port
+            except ValueError:
+                raise ValueError('Invalid URL port.') from None
+            return value
+        if self.type == 'int':
+            if not re.fullmatch(r'[0-9]+', value.strip()):
+                raise ValueError('Enter a non-negative integer.')
+            number = int(value)
+            if self.minimum is not None and number < self.minimum:
+                raise ValueError(f'The minimum is {self.minimum}.')
+            if self.maximum is not None and number > self.maximum:
+                raise ValueError(f'The maximum is {self.maximum}.')
+            return number
+        if self.type == 'serial':
+            value = value.strip()
+            if value.endswith('%') and value[:-1].isdigit() and 1 <= int(value[:-1]) <= 100:
+                return f'{int(value[:-1])}%'
+            if value.isdigit() and int(value) > 0:
+                return int(value)
+            raise ValueError('Enter a positive batch size, or a percentage from 1% to 100%.')
+        if self.type == 'bool':
+            if value.strip().lower() not in {'true', 'false'}:
+                raise ValueError('Choose true or false.')
+            return value.strip().lower() == 'true'
+        if self.type == 'choice':
+            if value not in self.choices:
+                raise ValueError('Choose one of: ' + ', '.join(self.choices))
+            return value
+        if self.type in {'list', 'sequence'}:
+            try:
+                result = (YAML(typ='safe').load(value) if value.strip().startswith('[')
+                          else [x.strip() for x in value.split(',')])
+            except YAMLError:
+                raise ValueError('Invalid YAML/JSON list; input contents are not displayed.') from None
+            if not isinstance(result, list):
+                raise ValueError('Enter a YAML/JSON list.')
+            if self.type == 'list':
+                if any(not isinstance(x, str) or not x for x in result):
+                    raise ValueError('List items must be non-empty strings.')
+                if self.choices and any(x not in self.choices for x in result):
+                    raise ValueError('Allowed values: ' + ', '.join(self.choices))
+                return list(dict.fromkeys(result))
+            for rule in result:
+                if not isinstance(rule, dict) or not isinstance(rule.get('pattern'), str) or not rule['pattern']:
+                    raise ValueError('Each rule needs a non-empty pattern string.')
+                if set(rule) - {'pattern', 'run', 'async', 'timeout', 'cache_age', 'retry_count'}:
+                    raise ValueError('Unsupported execution rule field.')
+                for k in ('run', 'async'):
+                    if k in rule and not isinstance(rule[k], bool):
+                        raise ValueError(f'{k} must be true or false.')
+                for k in ('timeout', 'cache_age', 'retry_count'):
+                    if k in rule and (type(rule[k]) is not int or rule[k] < 0):
+                        raise ValueError(f'{k} must be a non-negative integer.')
+            return result
+        raise ValueError('Unsupported input type.')
+
+    def validate(self, value: Any) -> None:
+        """Validate a value received by the backend, not just UI prompt text."""
+        import json
+        if self.type == 'secret_ref':
+            if not isinstance(value, str) or not re.fullmatch(r'\{\{ [A-Za-z_][A-Za-z0-9_]* \}\}', value):
+                raise ValueError('Secret options must contain only a Vault variable reference.')
+        elif self.type == 'bool':
+            if type(value) is not bool:
+                raise ValueError('Boolean option must be true or false.')
+        elif self.type == 'int':
+            if type(value) is not int:
+                raise ValueError('Numeric option must be an integer.')
+            self.parse(str(value))
+        elif self.type in {'list', 'sequence'}:
+            if not isinstance(value, list):
+                raise ValueError('List option must be a typed list, not a string.')
+            self.parse(json.dumps(value))
+        else:
+            if self.type != 'serial' and not isinstance(value, str):
+                raise ValueError('Text option must be a string.')
+            self.parse(str(value))
+
+
+@dataclass(frozen=True)
+class PlaybookSpec:
+    key: str
+    name: str
+    filename: str
+    category: str
+    platforms: tuple[str, ...]
+    description: str
+    inputs: tuple[InputSpec, ...] = ()
+    requirements: tuple[str, ...] = ()
+    become_platforms: tuple[str, ...] = ()
+    warning: str = ''
+    customer_specific: bool = False
+    ask_pass: bool = False
+    require_vault: bool = False
+    result: dict | None = None
+
+
+@dataclass(frozen=True)
+class Catalog:
+    categories: tuple[str, ...]
+    playbooks: tuple[PlaybookSpec, ...]
+    sophos_profiles: dict[str, dict]
+
+
+def load_catalog(path: Path) -> Catalog:
+    try:
+        data = YAML(typ='safe').load(path.read_text(encoding='utf-8'))
+        if not isinstance(data, dict) or data.get('schema_version') != 1:
+            raise ValueError('Unsupported catalog schema; expected schema_version: 1')
+        categories = data['categories']
+        if not isinstance(categories, list) or not all(isinstance(c, str) and c for c in categories):
+            raise ValueError('categories must be a list of names')
+        if len(categories) != len(set(categories)):
+            raise ValueError('duplicate categories')
+        if not isinstance(data.get('playbooks'), list):
+            raise ValueError('playbooks must be a list')
+        specs = []
+        seen = set()
+        for entry in data['playbooks']:
+            e = dict(entry)
+            key = e['key']
+            if not _IDENTIFIER.fullmatch(key) or key in seen:
+                raise ValueError('invalid or duplicated playbook key')
+            seen.add(key)
+            if Path(e['filename']).name != e['filename'] or not e['filename'].endswith('.yml'):
+                raise ValueError('filename must be a local .yml basename')
+            if e['category'] not in categories:
+                raise ValueError('unknown category')
+            if not e['platforms'] or set(e['platforms']) - _PLATFORMS:
+                raise ValueError('unknown platform')
+            names, fields = set(), []
+            for raw in e.pop('inputs', []):
+                f = InputSpec(**{**raw, 'platforms': tuple(raw.get('platforms', ())),
+                                 'choices': tuple(raw.get('choices', ()))})
+                if not _IDENTIFIER.fullmatch(f.name) or f.name in names or f.type not in _KINDS:
+                    raise ValueError('invalid or duplicated input')
+                names.add(f.name)
+                fields.append(f)
+            for flag in ('customer_specific', 'ask_pass', 'require_vault'):
+                if flag in e and type(e[flag]) is not bool:
+                    raise ValueError('catalog flags must be booleans')
+            for name in ('platforms', 'requirements', 'become_platforms'):
+                e[name] = tuple(e.get(name, ()))
+            if e.get('result') is not None:
+                result = dict(e['result'])
+                schema_file = result.pop('schema_file', '')
+                if (not isinstance(schema_file, str) or Path(schema_file).name != schema_file
+                        or not schema_file.endswith('.yml')):
+                    raise ValueError('Invalid result schema file')
+                schema_path = path.parent / 'schemas' / schema_file
+                if schema_path.is_symlink() or schema_path.stat().st_size > 65536:
+                    raise ValueError('Invalid result schema path')
+                result['data_schema'] = YAML(typ='safe').load(schema_path.read_text(encoding='utf-8'))
+                e['result'] = validate_contract(result)
+            specs.append(PlaybookSpec(**e, inputs=tuple(fields)))
+        profiles = data.get('sophos_profiles', {})
+        if not isinstance(profiles, dict):
+            raise ValueError('sophos_profiles must be a mapping')
+        for name, profile in profiles.items():
+            if not isinstance(name, str) or not isinstance(profile, dict):
+                raise ValueError('invalid customer profile')
+            keys = profile.get('required_network_keys', [])
+            if not isinstance(keys, list) or not all(isinstance(k, str) and _IDENTIFIER.fullmatch(k) for k in keys):
+                raise ValueError('invalid required network key')
+        return Catalog(tuple(categories), tuple(specs), profiles)
+    except FileNotFoundError:
+        raise ConfigurationError(f'Playbook catalog missing: {path}. Install the matching AIM + playbooks bundle.') from None
+    except (YAMLError, ValueError, KeyError, TypeError) as exc:
+        raise ConfigurationError(f'Invalid playbook catalog: {path}. Check schema/field types; contents were not printed.') from exc
diff --git a/scripts/src/aim/playbooks/manager.py b/scripts/src/aim/playbooks/manager.py
index 03e4788..65d160c 100644
--- a/scripts/src/aim/playbooks/manager.py
+++ b/scripts/src/aim/playbooks/manager.py
@@ -1,182 +1,168 @@
 from __future__ import annotations
 
-from dataclasses import dataclass
 from pathlib import Path
+from contextlib import nullcontext
+from aim.vault.session import unlocked_vault, VaultAccess
+import json
+import os
+import re
+import tempfile
+from typing import Any
 
-from aim.exceptions import ExternalCommandFailed
+from aim.exceptions import ConfigurationError, ExternalCommandFailed, InvalidRunOptions
 from aim.external import command_available, run_external
+from aim.playbooks.catalog import PlaybookSpec, load_catalog
+from aim.playbooks.planning import validate_targets, command_arguments
+from aim.locking import InventoryLock
+
+_COLLECTION_MINIMUMS = {'ansible.windows': (3, 8, 0)}
+
+def _version_tuple(value: str) -> tuple[int, int, int] | None:
+    match = re.fullmatch(r'(\d+)\.(\d+)\.(\d+)(?:[.+-].*)?', value.strip())
+    return tuple(map(int, match.groups())) if match else None
 
 
-@dataclass(frozen=True)
-class PlaybookSpec:
-    key: str
-    name: str
-    filename: str
-    category: str
-    platforms: tuple[str, ...]
-    extra_vars: tuple[str, ...] = ()
-    customer_specific: bool = False
-    ask_pass: bool = False
-    require_vault: bool = False
-
-
-PLAYBOOKS: tuple[PlaybookSpec, ...] = (
-    # CheckMK
-    PlaybookSpec(
-        "checkmk_cleanup",
-        "Cleanup CheckMK",
-        "checkmk_cleanup.yml",
-        "CheckMK",
-        ("linux", "windows"),
-        ("checkmk_cleanup_enabled=true",),
-    ),
-    PlaybookSpec(
-        "checkmk_deploy",
-        "Deploy CheckMK",
-        "checkmk_deploy.yml",
-        "CheckMK",
-        ("linux", "windows"),
-    ),
-    PlaybookSpec(
-        "checkmk_update_config",
-        "Update CheckMK Config",
-        "checkmk_update_config.yml",
-        "CheckMK",
-        ("windows",),
-    ),
-    PlaybookSpec(
-        "checkmk_update_scripts",
-        "Update CheckMK Scripts",
-        "checkmk_update_scripts.yml",
-        "CheckMK",
-        ("linux", "windows"),
-    ),
-
-    # Debug
-    PlaybookSpec(
-        "debug_ping",
-        "Ping",
-        "debug_ping.yml",
-        "Debug",
-        ("linux", "windows"),
-    ),
-    PlaybookSpec(
-        "debug_server_role_selection",
-        "Server Role Selection",
-        "debug_server_role_selection.yml",
-        "Debug",
-        ("linux", "windows"),
-    ),
-    PlaybookSpec(
-        "debug_disk_usage",
-        "Disk Usage",
-        "debug_disk_usage.yml",
-        "Debug",
-        ("linux", "windows"),
-    ),
-
-    # Maintenance
-    PlaybookSpec(
-        "maintenance_patch_os",
-        "Patch OS",
-        "maintenance_patch_os.yml",
-        "Maintenance",
-        ("linux", "windows"),
-    ),
-    PlaybookSpec(
-        "maintenance_reboot",
-        "Reboot System",
-        "maintenance_reboot.yml",
-        "Maintenance",
-        ("linux", "windows"),
-    ),
-    PlaybookSpec(
-        "maintenance_backup_event_log",
-        "Backup System Logs",
-        "maintenance_backup_event_log.yml",
-        "Maintenance",
-        ("linux", "windows"),
-    ),
-    PlaybookSpec(
-        "maintenance_start_stopped_services",
-        "Start Stopped Services",
-        "maintenance_start_stopped_services.yml",
-        "Maintenance",
-        ("linux", "windows"),
-    ),
-
-    # Sophos XGS
-    # PlaybookSpec(
-    #     "configure_sophos_initial",
-    #     "Initial Bitformer Config",
-    #     "configure_sophos_initial_bitformer_config.yml",
-    #     "Sophos XGS",
-    #     ("sophosxgs",),
-    #     ask_pass=True,
-    #     require_vault=True,
-    # ),
-    # PlaybookSpec(
-    #     "configure_sophosxgs",
-    #     "Configure Sophos XGS",
-    #     "configure_sophosxgs.yml",
-    #     "Sophos XGS",
-    #     ("sophosxgs",),
-    #     customer_specific=True,
-    #     ask_pass=True,
-    #     require_vault=True,
-    # ),
-)
-
-# CATEGORY_ORDER = ("CheckMK", "Debug", "Maintenance", "Sophos XGS")
-CATEGORY_ORDER = ("CheckMK", "Debug", "Maintenance")
 
 class PlaybookManager:
-    def __init__(self, customers, config):
+    def __init__(self, customers, config, *, vault_interaction=None):
+        self.vault_interaction = vault_interaction
         self.customers = customers
         self.config = config
+        self._key = None
+        self._catalog = None
 
     @property
     def root(self) -> Path:
-        return self.config.root_dir / "playbooks"
+        return self.config.root_dir / 'playbooks'
+
+    def catalog(self):
+        path = self.root / 'aim_catalog.yml'
+        key = (str(path), path.stat().st_mtime_ns, path.stat().st_size) if path.exists() else None
+        if key is None or self._catalog is None or key != self._key:
+            self._catalog = load_catalog(path)
+            self._key = key
+        return self._catalog
 
     def categories(self) -> list[str]:
-        return list(CATEGORY_ORDER)
+        return list(self.catalog().categories)
 
     def specs_for_category(self, category: str) -> list[PlaybookSpec]:
-        return [spec for spec in PLAYBOOKS if spec.category == category]
+        return [spec for spec in self.catalog().playbooks if spec.category == category]
+
+    def profile(self, customer: str) -> dict:
+        return dict(self.catalog().sophos_profiles.get(customer, {}))
 
     def path(self, spec: PlaybookSpec, customer: str | None = None) -> Path:
+        base = self.root.resolve()
         if spec.customer_specific:
-            if not customer:
-                raise ValueError(f"Customer is required for playbook {spec.name}")
-            return self.root / "customers" / customer / spec.filename
-        return self.root / spec.filename
+            if not customer or Path(customer).name != customer or customer in {'.', '..'}:
+                raise ValueError('A valid customer is required for this playbook.')
+            path = base / 'customers' / customer / spec.filename
+        else:
+            path = base / spec.filename
+        if not path.resolve().is_relative_to(base):
+            raise ValueError('Playbook path escapes the configured playbooks directory.')
+        return path
 
     def available(self, spec: PlaybookSpec, customer: str | None = None) -> bool:
         return self.path(spec, customer).is_file()
 
-    def run(self, customer: str, inventory: Path, spec: PlaybookSpec, *, limit: str | None = None) -> None:
+    def dependency_check(self, spec: PlaybookSpec) -> dict[str, str]:
+        """Explicit run preflight only; never invoked just by drawing menus."""
+        if not command_available('ansible-playbook'):
+            raise ExternalCommandFailed('Required command not found: ansible-playbook')
+        if not spec.requirements:
+            return {}
+        result = run_external(['ansible-galaxy', 'collection', 'list', '--format', 'json'],
+                              cwd=self.config.root_dir, capture_output=True)
+        if result.returncode:
+            raise ExternalCommandFailed('Cannot inspect installed Ansible collections. Run ansible-galaxy collection list as this operator.')
+        try:
+            inventory = json.loads(result.stdout)
+            installed = {}
+            for _, collections in inventory.items():
+                for name, metadata in collections.items():
+                    installed.setdefault(name, str(metadata.get('version', 'unknown')))
+        except (ValueError, AttributeError, TypeError):
+            raise ExternalCommandFailed('Collection listing was not valid JSON. Check the active Ansible installation.') from None
+        missing = sorted(set(spec.requirements) - installed.keys())
+        if missing:
+            raise ExternalCommandFailed('Missing Ansible collection(s): ' + ', '.join(missing) +
+                                        '. Install an explicitly approved version in this operator\'s collection search path. AIM does not install dependencies automatically.')
+        too_old = [name for name, minimum in _COLLECTION_MINIMUMS.items()
+                   if name in spec.requirements and
+                   (_version_tuple(installed[name]) is None or _version_tuple(installed[name]) < minimum)]
+        if too_old:
+            raise ExternalCommandFailed('Unsupported Ansible collection version for: ' + ', '.join(too_old) +
+                                        '. Install the release requirements.yml before running this playbook.')
+        return {name: installed[name] for name in spec.requirements}
+
+    @staticmethod
+    def validate_overrides(spec: PlaybookSpec, overrides: dict[str, Any]) -> None:
+        fields = {f.name: f for f in spec.inputs}
+        unknown = set(overrides) - fields.keys()
+        if unknown:
+            raise InvalidRunOptions('Undeclared run options are not accepted by this playbook catalog.')
+        for name, value in overrides.items():
+            try:
+                fields[name].validate(value)
+            except (ValueError, TypeError):
+                raise InvalidRunOptions('A run option does not match its catalog-declared type or allowed values.') from None
+        if overrides.get('event_log_channels') == [] or overrides.get('os_patching_windows_categories') == []:
+            raise InvalidRunOptions('At least one event channel/update category must be selected.')
+
+    def run(self, customer: str, inventory: Path, spec: PlaybookSpec, *, limit: str | None = None,
+            overrides: dict[str, Any] | None = None, ask_become_pass: bool = False) -> None:
+        overrides = dict(overrides or {})
+        if any(f.name == 'checkmk_cleanup_enabled' for f in spec.inputs):
+            overrides.setdefault('checkmk_cleanup_enabled', False)
+        self.validate_overrides(spec, overrides)
         playbook = self.path(spec, customer)
         if not playbook.is_file():
             raise FileNotFoundError(playbook)
         if not inventory.is_file():
             raise FileNotFoundError(inventory)
-        if not command_available("ansible-playbook"):
-            raise ExternalCommandFailed("Required command not found: ansible-playbook")
-
-        args = ["ansible-playbook", "-i", str(inventory), str(playbook)]
-        vault = inventory.parent / "group_vars" / "all" / "vault.yml"
+        if not limit:
+            raise ValueError('AIM requires an explicit reviewed target limit.')
+        # The domain boundary validates inventory membership, not only UI selection.
+        if not all(re.fullmatch(r'[A-Za-z0-9_][A-Za-z0-9_.-]*', part) for part in limit.split(':')):
+            raise ValueError('The target limit must contain explicit inventory host names only.')
+        validate_targets(customer, inventory, spec, limit.split(':'))
+        if ask_become_pass and not spec.become_platforms:
+            raise ValueError('This operation does not use privilege escalation.')
+        if not command_available('ansible-playbook'):
+            raise ExternalCommandFailed('Required command not found: ansible-playbook')
+        args = command_arguments('ansible-playbook', inventory, playbook, limit.split(':'))
+        vault = inventory.parent / 'group_vars/all/vault.yml'
         if spec.require_vault and not vault.is_file():
-            raise FileNotFoundError(f"Required customer vault not found: {vault}")
-        if vault.is_file():
-            args.extend(["--vault-id", f"{customer}@prompt"])
+            raise FileNotFoundError(f'Required customer vault not found: {vault}')
         if spec.ask_pass:
-            args.append("--ask-pass")
-        if limit:
-            args.extend(["--limit", limit])
-        for extra_var in spec.extra_vars:
-            args.extend(["-e", extra_var])
-
-        result = run_external(args, cwd=self.config.root_dir)
-        if result.returncode:
-            raise ExternalCommandFailed(f"Playbook failed with exit code {result.returncode}")
+            args.append('--ask-pass')
+        if ask_become_pass:
+            args.append('--ask-become-pass')
+        env = os.environ.copy()
+        # Bridge controller defaults at ROLE DEFAULT precedence through env lookup.
+        # Inventory overrides still win; no customer secrets are placed here.
+        env['AIM_CHECKMK_AGENT_FILES_DIR'] = str(self.config.checkmk_agent_role_files_dir)
+        env['AIM_CHECKMK_MONITORING_SCRIPTS_DIR'] = str(self.config.checkmk_monitoring_scripts_dir)
+        env['ANSIBLE_DEBUG'] = 'False'
+        env['ANSIBLE_DIFF_ALWAYS'] = 'False'
+        # Unspecified options are omitted. Secret options contain variable references,
+        # never actual passwords. Files are private and removed on all normal exits.
+        with tempfile.TemporaryDirectory(prefix='aim-playbook-options-') as directory:
+            if overrides:
+                path = Path(directory) / 'overrides.json'
+                fd = os.open(path, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o600)
+                with os.fdopen(fd, 'w', encoding='utf-8') as stream:
+                    json.dump(overrides, stream, ensure_ascii=False)
+                args.extend(['--extra-vars', '@' + str(path)])
+            with InventoryLock(inventory):
+                validate_targets(customer, inventory, spec, limit.split(':'))
+                context = (unlocked_vault(vault, customer, cwd=inventory.parent, env=env,
+                                          interaction=self.vault_interaction)
+                           if vault.is_file() else nullcontext(VaultAccess(())))
+                with context as access:
+                    access.ensure_current()
+                    result = run_external([*args, *access.arguments], cwd=self.config.root_dir, env=env, ui_mode='live')
+            if result.returncode:
+                raise ExternalCommandFailed(f'Playbook failed with exit code {result.returncode}. Completed remote changes were not rolled back.')
diff --git a/scripts/src/aim/playbooks/planning.py b/scripts/src/aim/playbooks/planning.py
new file mode 100644
index 0000000..0980b4b
--- /dev/null
+++ b/scripts/src/aim/playbooks/planning.py
@@ -0,0 +1,33 @@
+"""Shared target validation and native command construction (terminal and API)."""
+from __future__ import annotations
+import re
+from aim.exceptions import InvalidTarget
+from aim.inventory.hosts import InventoryEditor
+from aim.inventory.loader import InventoryDocument
+
+
+def validate_targets(customer, inventory, spec, hosts):
+    if not hosts or len(set(hosts)) != len(hosts) or any(
+        not isinstance(h, str) or not re.fullmatch(r'[A-Za-z0-9_][A-Za-z0-9_.-]*', h) for h in hosts
+    ):
+        raise InvalidTarget('Select unique, explicit inventory host names.')
+    available = {h.fqdn: h for h in InventoryEditor(InventoryDocument(inventory), customer).list_hosts()}
+    if any(h not in available for h in hosts):
+        raise InvalidTarget('A selected host is no longer in this customer inventory.')
+    if any(not set(available[h].memberships).intersection(spec.platforms) for h in hosts):
+        raise InvalidTarget('A selected host is incompatible with this catalog operation.')
+    if any(available[h].ansible_host == 'CONFLICT' for h in hosts):
+        raise InvalidTarget('A selected host has conflicting inventory addresses.')
+    return [available[h] for h in hosts]
+
+
+def command_arguments(executable, inventory, playbook, hosts, *, vault_args=(),
+                      credential_args=(), options_file=None, check=False):
+    args = [str(executable), '-i', str(inventory), str(playbook), '--limit', ':'.join(hosts)]
+    args.extend(vault_args)
+    args.extend(credential_args)
+    if check:
+        args.append('--check')
+    if options_file is not None:
+        args.extend(['--extra-vars', '@' + str(options_file)])
+    return args
diff --git a/scripts/src/aim/runtime/__init__.py b/scripts/src/aim/runtime/__init__.py
new file mode 100644
index 0000000..7c90586
--- /dev/null
+++ b/scripts/src/aim/runtime/__init__.py
@@ -0,0 +1 @@
+"""Core-owned local runtime implementation; not a public add-on API."""
diff --git a/scripts/src/aim/runtime/agent.py b/scripts/src/aim/runtime/agent.py
new file mode 100644
index 0000000..7eb7952
--- /dev/null
+++ b/scripts/src/aim/runtime/agent.py
@@ -0,0 +1,81 @@
+"""One run, one owned agent. Private keys are never exported to an add-on."""
+from __future__ import annotations
+import base64
+import os
+from pathlib import Path
+import shutil
+import struct
+import subprocess
+import time
+from aim.runtime.process import run_process, stop_group
+from aim.services.v1.models import ServiceError
+
+
+def key_is_encrypted(path: Path) -> bool:
+    try:
+        if path.stat().st_size > 65536:
+            raise ValueError()
+        data = path.read_bytes()
+        if b'-----BEGIN OPENSSH PRIVATE KEY-----' in data:
+            payload = base64.b64decode(b''.join(data.strip().splitlines()[1:-1]), validate=True)
+            magic = b'openssh-key-v1\0'
+            if not payload.startswith(magic):
+                raise ValueError()
+            length = struct.unpack('!I', payload[len(magic):len(magic) + 4])[0]
+            start = len(magic) + 4
+            if not 0 < length < 256 or len(payload) < start + length:
+                raise ValueError()
+            return payload[start:start + length] != b'none'
+        if b'-----BEGIN ENCRYPTED PRIVATE KEY-----' in data or b'Proc-Type: 4,ENCRYPTED' in data:
+            return True
+        if any(header in data for header in (b'-----BEGIN PRIVATE KEY-----', b'-----BEGIN RSA PRIVATE KEY-----', b'-----BEGIN EC PRIVATE KEY-----')):
+            return False
+        raise ValueError()
+    except (ValueError, OSError, struct.error):
+        raise ServiceError('key_unreadable', 'Customer key is unreadable or its format is unsupported.', stage='readiness') from None
+
+
+class RunAgent:
+    def __init__(self, directory, key, broker, env, *, cancel=None):
+        self.directory, self.key, self.broker = directory, key, broker
+        self.env = dict(env)
+        self.cancel = cancel
+        self.process = None
+
+    def __enter__(self):
+        agent = shutil.which('ssh-agent', path=self.env.get('PATH'))
+        add = shutil.which('ssh-add', path=self.env.get('PATH'))
+        if not agent or not add:
+            raise ServiceError('ssh_tools_missing', 'ssh-agent and ssh-add must be executable by this identity.', stage='readiness')
+        socket_path = self.directory / 'agent.sock'
+        self.env['SSH_AUTH_SOCK'] = str(socket_path)
+        self.env['SSH_ASKPASS_REQUIRE'] = 'force'
+        self.env['DISPLAY'] = self.env.get('DISPLAY') or ':0'
+        encrypted = key_is_encrypted(self.key)
+        self.env['SSH_ASKPASS'] = str(self.broker.helper('ssh_key_passphrase')) if encrypted else '/bin/false'
+        try:
+            self.process = subprocess.Popen([agent, '-D', '-a', str(socket_path)], env=self.env,
+                                            stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL,
+                                            stderr=subprocess.DEVNULL, start_new_session=True)
+            deadline = time.monotonic() + 5
+            while not socket_path.exists():
+                if self.cancel is not None and self.cancel.is_set():
+                    raise ServiceError('cancelled', 'Operation cancelled.', stage='key_loading')
+                if time.monotonic() > deadline or self.process.poll() is not None:
+                    raise ServiceError('agent_start_failed', 'Owned SSH agent did not become ready.', stage='key_loading')
+                time.sleep(0.05)
+            rc, _ = run_process([add, str(self.key)], cwd=self.directory, env=self.env, timeout=15,
+                                cancel=self.cancel, stage='key_loading')
+            if rc:
+                raise ServiceError('key_load_failed', 'Key could not be loaded; verify access, format and passphrase.',
+                                   stage='key_loading', retryable=True,
+                                   required_credentials=('ssh_key_passphrase',) if encrypted else ())
+            return self.env
+        except BaseException:
+            self.__exit__(None, None, None)
+            raise
+
+    def __exit__(self, *args):
+        if self.process:
+            stop_group(self.process)
+            self.process = None
diff --git a/scripts/src/aim/runtime/ansible.py b/scripts/src/aim/runtime/ansible.py
new file mode 100644
index 0000000..e91c284
--- /dev/null
+++ b/scripts/src/aim/runtime/ansible.py
@@ -0,0 +1,129 @@
+"""Native Ansible CLI adapter; exact canonical runtime, no Ansible imports in AIM."""
+from __future__ import annotations
+import json
+import configparser
+import os
+from pathlib import Path
+import re
+import shutil
+from aim.runtime.process import run_process
+from aim.runtime.staging import check_controller_staging
+from aim.services.v1.models import CANONICAL_ANSIBLE, ServiceError
+
+_COLLECTION_MINIMUMS = {'ansible.windows': (3, 8, 0)}
+
+def _version_tuple(value: str) -> tuple[int, int, int] | None:
+    match = re.fullmatch(r'(\d+)\.(\d+)\.(\d+)(?:[.+-].*)?', value.strip())
+    return tuple(map(int, match.groups())) if match else None
+
+
+
+def base_environment(config) -> dict[str, str]:
+    # A trusted local client is not a sandboxed tenant. Still do not inherit
+    # password sources, prompt/debug settings or callback choices by accident.
+    safe = {'PATH', 'HOME', 'USER', 'LOGNAME', 'LANG', 'LC_ALL', 'LC_CTYPE', 'TMPDIR',
+            'SSL_CERT_FILE', 'SSL_CERT_DIR', 'REQUESTS_CA_BUNDLE', 'KRB5CCNAME'}
+    env = {k: v for k, v in os.environ.items() if k in safe}
+    env.setdefault('PATH', os.defpath)
+    env.setdefault('LANG', 'C.UTF-8')
+    cfg = config.root_dir / 'ansible.cfg'
+    if cfg.exists():
+        try:
+            parser = configparser.ConfigParser(interpolation=None, inline_comment_prefixes=(';',))
+            with cfg.open(encoding='utf-8') as stream:
+                parser.read_file(stream)
+            # Such defaults can auto-prompt or silently select another password
+            # source. Do not copy/rewrite an operator config or use empty path
+            # environment values (Ansible resolves an empty path to CWD).
+            if any(parser.has_option('defaults', key) for key in ('vault_password_file', 'vault_identity_list')):
+                raise ServiceError('runtime_credential_defaults_unsupported',
+                                   'This service profile requires Vault sources to come only from its credential provider; controller Vault defaults are not supported.', stage='readiness')
+        except (OSError, configparser.Error, UnicodeError):
+            raise ServiceError('runtime_config_invalid', 'Controller Ansible configuration is invalid or inaccessible.', stage='readiness') from None
+    else:
+        cfg = Path(__file__).resolve().parents[1] / 'integrations/ansible.cfg'
+    env.update(ANSIBLE_CONFIG=str(cfg),
+               ANSIBLE_DEBUG='False', ANSIBLE_DIFF_ALWAYS='False', ANSIBLE_LOG_PATH='/dev/null',
+               ANSIBLE_NOCOLOR='1', ANSIBLE_STDOUT_CALLBACK='default',
+               ANSIBLE_CALLBACKS_ENABLED='aim_safe_events',
+               ANSIBLE_CALLBACK_PLUGINS=str(Path(__file__).resolve().parents[1] / 'integrations/callbacks'),
+               ANSIBLE_ENABLE_TASK_DEBUGGER='False', ANSIBLE_ASK_PASS='False',
+               ANSIBLE_ASK_VAULT_PASS='False', ANSIBLE_BECOME_ASK_PASS='False',
+               ANSIBLE_RETRY_FILES_ENABLED='False',
+               AIM_CHECKMK_AGENT_FILES_DIR=str(config.checkmk_agent_role_files_dir),
+               AIM_CHECKMK_MONITORING_SCRIPTS_DIR=str(config.checkmk_monitoring_scripts_dir))
+    if config.ansible_collections_path:
+        env['ANSIBLE_COLLECTIONS_PATH'] = config.ansible_collections_path
+    return env
+
+
+class AnsibleRuntime:
+    def __init__(self, config):
+        self.config = config
+        self.env = base_environment(config)
+        self.tools: dict[str, str] = {}
+        self.staging: dict = {}
+
+    def check_staging(self, *, cancel=None) -> dict:
+        self.staging = check_controller_staging(self.config, self.env, cancel=cancel)
+        return self.staging
+
+    def discover(self, requirements=(), *, cancel=None) -> dict:
+        configured = self.config.ansible_playbook
+        executable = shutil.which(configured, path=self.env['PATH'])
+        if not executable:
+            raise ServiceError('runtime_missing', 'ansible-playbook is not executable under this identity.', stage='readiness')
+        executable = str(Path(executable).absolute())
+        # Resolve sibling entry points before following symlinks (venv bin/ matters).
+        bindir = Path(executable).parent
+        for name in ('ansible-playbook', 'ansible-vault', 'ansible-galaxy'):
+            path = Path(executable) if name == 'ansible-playbook' else bindir / name
+            if not path.is_file() or not os.access(path, os.X_OK):
+                raise ServiceError('runtime_incomplete', 'The canonical Ansible CLI tools must share one bin directory.', stage='readiness')
+            self.tools[name] = str(path)
+        # Probe in the actual process sandbox before native tools or credentials.
+        self.check_staging(cancel=cancel)
+        reports = {}
+        for name in self.tools:
+            rc, raw = run_process([self.tools[name], '--version'], cwd=self.config.root_dir,
+                                  env=self.env, capture=True, cancel=cancel, stage='readiness', timeout=10)
+            text = raw.decode('utf-8', errors='replace')
+            match = re.search(r'\[core ([^\]\s]+)\]', text)
+            if rc or not match or match.group(1) != CANONICAL_ANSIBLE:
+                raise ServiceError('runtime_version_unsupported', 'This API requires ansible-core 2.19.11 for every native CLI tool.', stage='readiness')
+            # Report fixed parsed fields only, never arbitrary tool output.
+            reports[name] = {'executable': self.tools[name], 'version': CANONICAL_ANSIBLE}
+            for label in ('python version', 'ansible python module location', 'ansible collection location'):
+                found = re.search(r'^\s*' + re.escape(label) + r'\s*=\s*(.*)$', text, re.M)
+                if found:
+                    reports[name][label.replace(' ', '_')] = found.group(1)[:1000]
+        identities = {(r.get('python_version'), r.get('ansible_python_module_location')) for r in reports.values()}
+        if len(identities) != 1 or any(not all(identity) for identity in identities):
+            raise ServiceError('runtime_identity_ambiguous', 'Sibling Ansible tools do not report one identifiable Python/module runtime.', stage='readiness')
+        rc, raw = run_process([self.tools['ansible-galaxy'], 'collection', 'list', '--format', 'json'],
+                              cwd=self.config.root_dir, env=self.env, capture=True, cancel=cancel, stage='readiness', timeout=20)
+        try:
+            if rc:
+                raise ValueError()
+            listing = json.loads(raw)
+            installed = {}
+            for collections in listing.values():
+                for name, details in collections.items():
+                    installed.setdefault(name, str(details['version']))
+        except (ValueError, AttributeError, TypeError, KeyError):
+            raise ServiceError('collection_discovery_failed', 'Cannot inspect collections in the canonical runtime.', stage='readiness') from None
+        missing = set(requirements) - installed.keys()
+        if missing:
+            raise ServiceError('collections_missing', 'Required catalog collections are missing from the execution identity.', stage='readiness')
+        too_old = [name for name, minimum in _COLLECTION_MINIMUMS.items()
+                   if name in requirements and name in installed and
+                   (_version_tuple(installed[name]) is None or _version_tuple(installed[name]) < minimum)]
+        if too_old:
+            raise ServiceError('collection_version_unsupported',
+                               'A required Ansible collection is older than the AIM-supported baseline. Update from the release requirements.yml and re-run readiness.',
+                               stage='readiness')
+        return {'canonical_version': CANONICAL_ANSIBLE, 'tools': reports,
+                'controller_staging': self.staging,
+                'collections': {n: installed[n] for n in requirements},
+                'uid': os.geteuid(), 'gids': sorted({os.getegid(), *os.getgroups()}),
+                'qualification': 'controller_acceptance_required'}
diff --git a/scripts/src/aim/runtime/events.py b/scripts/src/aim/runtime/events.py
new file mode 100644
index 0000000..c09f011
--- /dev/null
+++ b/scripts/src/aim/runtime/events.py
@@ -0,0 +1,235 @@
+"""Validate the private native event channel before exposing public v1 events."""
+from __future__ import annotations
+
+import json
+
+from aim.integrations.event_policy import (
+    COUNT_KEYS, DETAIL_KINDS, DETAIL_SCHEMA, ERROR_MESSAGES, MAX_EVENTS,
+    SUMMARY_KINDS, TARGET_OUTCOME_SCHEMA, safe_host, safe_label, valid_id,
+)
+from aim.services.v1.models import ServiceError
+
+
+def _fail():
+    raise ServiceError('invalid_event_stream', 'Native runtime did not emit the supported event schema.', stage='execution')
+
+
+def _counts(value):
+    if (not isinstance(value, dict) or set(value) != set(COUNT_KEYS)
+            or any(type(v) is not int or not 0 <= v <= 1_000_000_000 for v in value.values())):
+        _fail()
+    return {k: value[k] for k in COUNT_KEYS}
+
+
+class EventBridge:
+    """Fail closed on unknown/malformed payloads; never pass dictionaries through.
+
+    Summary mode preserves the 3.1.0 public stream. Detail mode adds negotiated
+    event kinds and validates IDs, ordering, source-label policy, host scope and
+    fixed error codes. It is not a sandbox against malicious controller code.
+    """
+    def __init__(self, mode, hosts, emit, secret_values=(), output_collector=None):
+        self.output_collector = output_collector
+        self.mode = mode
+        self.hosts = tuple(hosts)
+        self.host_set = frozenset(hosts)
+        self.emit = emit
+        self.secret_values = secret_values
+        self.counts = {}
+        self.got_stats = False
+        self.begun = False
+        self.ended = False
+        self.complete = False
+        self.sequence = self.frames = 0
+        self.plays = set()
+        self.tasks = {}
+        self.recap_counts = {key: 0 for key in COUNT_KEYS}
+        self.recapped_hosts = set()
+        self.target_recaps = {}
+
+    def _secret_in(self, text):
+        return isinstance(text, str) and any(isinstance(s, str) and s and s in text for s in self.secret_values)
+
+    def _label(self, value, redacted, fallback):
+        if type(redacted) is not bool:
+            _fail()
+        label, rejected = safe_label(value, fallback=fallback)
+        if redacted or rejected or self._secret_in(label):
+            return fallback, True
+        return label, False
+
+    def _host(self, value, redacted):
+        if type(redacted) is not bool:
+            _fail()
+        host, rejected = safe_host(value, self.host_set)
+        if redacted or rejected or self._secret_in(host):
+            return {'host': None, 'host_redacted': True}
+        return {'host': host, 'host_redacted': False}
+
+    def _context(self, data):
+        if data['play_id'] not in self.plays or self.tasks.get(data['task_id']) != data['play_id']:
+            _fail()
+        return {'play_id': data['play_id'], 'task_id': data['task_id']}
+
+    def __call__(self, raw):
+        self.frames += 1
+        if self.mode == 'detail' and self.frames > MAX_EVENTS:
+            raise ServiceError('event_limit', 'Execution exceeded the bounded progress-event limit.', stage='execution')
+        try:
+            value = json.loads(raw)
+            if not isinstance(value, dict) or self.got_stats:
+                _fail()
+            seq = value.pop('bridge_sequence', None)
+            if type(seq) is not int or seq != self.sequence + 1:
+                _fail()
+            self.sequence = seq
+            kind = value.get('kind')
+            if kind in ('output_chunk', 'output_end', 'output_rejected', 'outputs_end'):
+                if self.output_collector is None:
+                    _fail()
+                self.output_collector.secret_values = self.secret_values
+                self.output_collector.receive(value)
+            elif kind in SUMMARY_KINDS and set(value) == {'kind'}:
+                self.emit('progress', status=kind)
+            elif kind == 'target_recap' and set(value) == {'kind', 'target_index', 'counts'}:
+                index = value['target_index']
+                if type(index) is not int or not 0 <= index < len(self.hosts):
+                    _fail()
+                host = self.hosts[index]
+                if host in self.target_recaps:
+                    _fail()
+                self.target_recaps[host] = _counts(value['counts'])
+            elif kind == 'stats' and set(value) == {'kind', 'counts'}:
+                counts = _counts(value['counts'])
+                if self.mode == 'detail':
+                    if not self.begun or not self.ended:
+                        _fail()
+                    if self.complete and counts != self.recap_counts:
+                        _fail()
+                self.counts, self.got_stats = counts, True
+                self.emit('stats', counts=counts.copy())
+            elif self.mode == 'detail' and kind == 'detail_begin':
+                if set(value) != {'kind', 'schema'} or value['schema'] != DETAIL_SCHEMA or self.begun:
+                    _fail()
+                self.begun = True
+            elif self.mode == 'detail' and kind == 'detail_end':
+                if (set(value) != {'kind', 'complete'} or type(value['complete']) is not bool
+                        or not self.begun or self.ended):
+                    _fail()
+                self.ended, self.complete = True, value['complete']
+            elif self.mode == 'detail' and kind == 'detail' and self.begun and not self.ended:
+                self._detail(value)
+            else:
+                _fail()
+        except ServiceError:
+            raise
+        except (ValueError, KeyError, TypeError, RecursionError, UnicodeError):
+            _fail()
+
+    def _detail(self, value):
+        name = value.get('event')
+        fields = {
+            'play_started': {'play_id', 'label', 'label_redacted'},
+            'play_skipped': {'play_id', 'reason'},
+            'play_stopped': {'play_id', 'reason'},
+            'task_started': {'play_id', 'task_id', 'label', 'label_redacted', 'handler'},
+            'host_result': {'play_id', 'task_id', 'host', 'host_redacted', 'status', 'changed', 'ignored', 'details_redacted', 'error_code'},
+            'task_retry': {'play_id', 'task_id', 'host', 'host_redacted', 'attempt', 'details_redacted'},
+            'task_async_poll': {'play_id', 'task_id', 'host', 'host_redacted', 'attempt', 'details_redacted'},
+            'host_recap': {'host', 'host_redacted', 'counts'},
+        }
+        if name not in DETAIL_KINDS or set(value) != {'kind', 'event'} | fields[name]:
+            _fail()
+        if name == 'play_started':
+            identifier = value['play_id']
+            if not valid_id(identifier, 'p') or identifier in self.plays or len(self.plays) >= 50_000:
+                _fail()
+            label, redacted = self._label(value['label'], value['label_redacted'], 'Play (label withheld)')
+            self.plays.add(identifier)
+            self.emit(name, play_id=identifier, label=label, label_redacted=redacted)
+        elif name in ('play_skipped', 'play_stopped'):
+            reason = 'no_hosts_matched' if name == 'play_skipped' else 'no_hosts_remaining'
+            if value['play_id'] not in self.plays or value['reason'] != reason:
+                _fail()
+            self.emit(name, play_id=value['play_id'], reason=reason)
+        elif name == 'task_started':
+            if (not valid_id(value['task_id'], 't') or value['task_id'] in self.tasks
+                    or value['play_id'] not in self.plays or type(value['handler']) is not bool
+                    or len(self.tasks) >= 50_000):
+                _fail()
+            label, redacted = self._label(value['label'], value['label_redacted'], 'Task (label withheld)')
+            self.tasks[value['task_id']] = value['play_id']
+            self.emit(name, play_id=value['play_id'], task_id=value['task_id'], label=label,
+                      label_redacted=redacted, handler=value['handler'])
+        elif name == 'host_result':
+            context = self._context(value)
+            status = value['status']
+            if status not in ('ok', 'changed', 'skipped', 'failed', 'unreachable'):
+                _fail()
+            if any(type(value[k]) is not bool for k in ('changed', 'ignored', 'details_redacted')):
+                _fail()
+            if status in ('ok', 'changed') and (value['changed'] != (status == 'changed')):
+                _fail()
+            error = None
+            code = value['error_code']
+            if status in ('failed', 'unreachable'):
+                if code not in ERROR_MESSAGES:
+                    _fail()
+                if value['details_redacted']:
+                    code = 'details_withheld'
+                error = {'code': code, 'message': ERROR_MESSAGES[code],
+                         'classification': 'withheld' if code == 'details_withheld' else 'diagnostic_hint'}
+            elif code is not None:
+                _fail()
+            self.emit(name, **context, **self._host(value['host'], value['host_redacted']), status=status,
+                      changed=value['changed'], ignored=value['ignored'], details_redacted=value['details_redacted'], error=error)
+        elif name in ('task_retry', 'task_async_poll'):
+            context = self._context(value)
+            attempt = value['attempt']
+            if ((attempt is not None and (type(attempt) is not int or not 0 <= attempt <= 1_000_000))
+                    or type(value['details_redacted']) is not bool):
+                _fail()
+            self.emit(name, **context, **self._host(value['host'], value['host_redacted']),
+                      attempt=None if value['details_redacted'] else attempt, details_redacted=value['details_redacted'])
+        else:
+            counts = _counts(value['counts'])
+            host = self._host(value['host'], value['host_redacted'])
+            if host['host'] is not None:
+                if host['host'] in self.recapped_hosts:
+                    _fail()
+                self.recapped_hosts.add(host['host'])
+            for key in COUNT_KEYS:
+                self.recap_counts[key] += counts[key]
+            self.emit('host_recap', **host, counts=counts)
+
+    def target_outcomes(self, *, remote_started: bool) -> tuple[dict, list[dict]]:
+        complete = bool(self.got_stats)
+        targets = []
+        totals = {'successful': 0, 'failed': 0, 'unreachable': 0, 'not_started': 0, 'indeterminate': 0}
+        for host in self.hosts:
+            counts = self.target_recaps.get(host)
+            if complete and counts is not None:
+                if counts['unreachable']:
+                    outcome = 'unreachable'
+                elif counts['failures']:
+                    outcome = 'failed'
+                else:
+                    outcome = 'successful'
+            elif complete:
+                outcome = 'not_started'
+                counts = {key: 0 for key in COUNT_KEYS}
+            else:
+                outcome = 'indeterminate' if remote_started else 'not_started'
+                counts = {key: 0 for key in COUNT_KEYS}
+            totals[outcome] += 1
+            targets.append({'host': host, 'outcome': outcome, 'counts': counts.copy()})
+        summary = {'schema': TARGET_OUTCOME_SCHEMA, 'requested': len(self.hosts), **totals,
+                   'complete': complete,
+                   'accounted': sum(totals.values())}
+        return summary, targets
+
+    def require_complete(self):
+        if not self.got_stats:
+            raise ServiceError('event_bridge_unavailable', 'Ansible exited without a final safe result; success is not assumed.', stage='execution')
+        if self.mode == 'detail' and not (self.begun and self.ended and self.complete):
+            raise ServiceError('event_bridge_incomplete', 'Detailed progress could not be collected completely; success is not assumed.', stage='execution')
diff --git a/scripts/src/aim/runtime/outputs.py b/scripts/src/aim/runtime/outputs.py
new file mode 100644
index 0000000..031c718
--- /dev/null
+++ b/scripts/src/aim/runtime/outputs.py
@@ -0,0 +1,97 @@
+"""Reassemble and validate final purposeful output, separately from task events."""
+from __future__ import annotations
+import base64
+import json
+from aim.integrations.output_policy import (validate_contract, validate_envelope, OutputError,
+    MAX_HOST_BYTES, MAX_RUN_BYTES, CHUNK_BYTES, RESULT_PROTOCOL)
+from aim.services.v1.models import ServiceError
+
+class OutputCollector:
+    def __init__(self, contract, hosts):
+        self.contract = validate_contract(contract)
+        self.hosts = tuple(hosts)
+        self.values, self.errors, self.parts = {}, {}, {}
+        self.bytes = 0
+        self.ended = False
+        self.secret_values = ()
+
+    def receive(self, frame):
+        def bad():
+            raise ServiceError('invalid_event_stream', 'Invalid operation-output framing.', stage='execution')
+        if self.contract is None or self.ended:
+            bad()
+        kind = frame.get('kind')
+        if kind == 'outputs_end':
+            if set(frame) != {'kind'} or self.parts:
+                bad()
+            self.ended = True
+            return
+        index = frame.get('target_index')
+        maximum = len(self.hosts) if self.contract['scope'] == 'per_host' else 1
+        if type(index) is not int or not 0 <= index < maximum or index in self.values or index in self.errors:
+            bad()
+        if kind == 'output_rejected':
+            if set(frame) != {'kind','target_index','code'} or frame['code'] not in (
+                    'operation_result_invalid','operation_result_limit','operation_result_withheld') or index in self.parts:
+                bad()
+            self.errors[index] = frame['code']
+        elif kind == 'output_chunk':
+            if set(frame) != {'kind','target_index','part','content'}:
+                bad()
+            part, data = self.parts.setdefault(index, (0, bytearray()))
+            if type(frame['part']) is not int or frame['part'] != part or not isinstance(frame['content'], str):
+                bad()
+            try:
+                chunk = base64.b64decode(frame['content'], validate=True)
+            except (ValueError, TypeError):
+                bad()
+            if not 1 <= len(chunk) <= CHUNK_BYTES:
+                bad()
+            self.bytes += len(chunk)
+            data.extend(chunk)
+            if len(data) > self.contract['max_bytes_per_host'] or self.bytes > MAX_RUN_BYTES:
+                bad()
+            self.parts[index] = (part+1, data)
+        elif kind == 'output_end':
+            if set(frame) != {'kind','target_index'} or index not in self.parts:
+                bad()
+            _, raw = self.parts.pop(index)
+            try:
+                self.values[index] = validate_envelope(json.loads(raw), self.contract, self.secret_values)
+            except (OutputError, ValueError, TypeError, RecursionError, UnicodeError) as exc:
+                self.errors[index] = exc.code if isinstance(exc, OutputError) else 'operation_result_invalid'
+        else:
+            bad()
+
+    def report(self, *, final_stats, targets, check=False, remote_started=False):
+        if self.contract is None:
+            return None
+        # Interrupted streams never publish an earlier payload as a completed report.
+        complete_stream = bool(self.ended and final_stats)
+        items = {}
+        selected = self.hosts if self.contract['scope'] == 'per_host' else ('_run',)
+        for index, host in enumerate(selected):
+            error = self.errors.get(index)
+            value = self.values.get(index) if complete_stream else None
+            status = ('available' if value is not None else 'withheld' if error == 'operation_result_withheld'
+                      else 'invalid' if error else 'missing' if complete_stream
+                      else 'indeterminate' if remote_started else 'not_started')
+            items[host] = {'schema': self.contract['schema'], 'status': status,
+                           'data': value['data'] if value else None, 'error': error}
+        return {'protocol': RESULT_PROTOCOL, 'schema': self.contract['schema'],
+                'scope': self.contract['scope'], 'required': self.contract['required'],
+                'complete': complete_stream and all(v['status'] == 'available' for v in items.values()),
+                'check_mode': check, 'hosts': items if self.contract['scope'] == 'per_host' else {},
+                'global': items.get('_run') if self.contract['scope'] == 'global' else None}
+
+    def validation_error(self):
+        if self.contract is None:
+            return None
+        if not self.ended:
+            return 'operation_result_incomplete'
+        if self.errors:
+            return next(iter(self.errors.values()))
+        count = len(self.hosts) if self.contract['scope'] == 'per_host' else 1
+        if self.contract['required'] and len(self.values) != count:
+            return 'operation_result_missing'
+        return None
diff --git a/scripts/src/aim/runtime/process.py b/scripts/src/aim/runtime/process.py
new file mode 100644
index 0000000..6e9a102
--- /dev/null
+++ b/scripts/src/aim/runtime/process.py
@@ -0,0 +1,96 @@
+"""Bounded process-group execution with no raw child output on the service channel."""
+from __future__ import annotations
+import os
+import selectors
+import signal
+import subprocess
+import time
+from pathlib import Path
+from threading import Event
+from aim.services.v1.models import ServiceError
+
+
+def stop_group(process):
+    try:
+        os.killpg(process.pid, signal.SIGTERM)
+    except ProcessLookupError:
+        pass
+    try:
+        process.wait(timeout=2)
+    except subprocess.TimeoutExpired:
+        pass
+    # The parent may have exited while descendants are still running.
+    try:
+        os.killpg(process.pid, signal.SIGKILL)
+    except ProcessLookupError:
+        pass
+    process.wait()
+
+
+def run_process(args: list[str], *, cwd: Path, env: dict[str, str], timeout: float = 30,
+                cancel: Event | None = None, capture: bool = False,
+                event_fd: int | None = None, pass_fds: tuple[int, ...] = (),
+                on_event=None, stage='runtime', output_limit: int = 1048576,
+                stderr_output: bytearray | None = None):
+    if cancel is not None and cancel.is_set():
+        raise ServiceError('cancelled', 'Operation cancelled.', stage=stage)
+    output = bytearray()
+    event_buffer = bytearray()
+    start = time.monotonic()
+    try:
+        process = subprocess.Popen(args, cwd=cwd, env=env, stdin=subprocess.DEVNULL,
+                                   stdout=subprocess.PIPE if capture else subprocess.DEVNULL,
+                                   stderr=subprocess.PIPE if stderr_output is not None else subprocess.DEVNULL, start_new_session=True,
+                                   pass_fds=pass_fds)
+    except OSError:
+        raise ServiceError('runtime_unavailable', 'Could not start the required local command.', stage=stage) from None
+    try:
+        with selectors.DefaultSelector() as selector:
+            if capture:
+                selector.register(process.stdout, selectors.EVENT_READ, 'stdout')
+            if stderr_output is not None:
+                selector.register(process.stderr, selectors.EVENT_READ, 'stderr')
+            if event_fd is not None:
+                os.set_blocking(event_fd, False)
+                selector.register(event_fd, selectors.EVENT_READ, 'events')
+            while True:
+                if cancel is not None and cancel.is_set():
+                    raise ServiceError('cancelled', 'Operation cancelled; completed remote changes are not rolled back.', stage=stage)
+                if time.monotonic() - start >= timeout:
+                    raise ServiceError('timeout', 'Operation deadline exceeded; completed remote changes are not rolled back.', stage=stage)
+                for key, _ in selector.select(0.05):
+                    fd = key.fd
+                    data = os.read(fd, 8192)
+                    if not data:
+                        selector.unregister(key.fileobj)
+                        continue
+                    if key.data == 'stderr':
+                        stderr_output.extend(data)
+                        if len(stderr_output) > output_limit:
+                            raise ServiceError('output_limit', 'Local command diagnostics exceeded the safe limit.', stage=stage)
+                    elif key.data == 'stdout':
+                        output.extend(data)
+                        if len(output) > output_limit:
+                            raise ServiceError('output_limit', 'Local command output exceeded the safe limit.', stage=stage)
+                    else:
+                        event_buffer.extend(data)
+                        if len(event_buffer) > 65536:
+                            raise ServiceError('invalid_event_stream', 'Runtime event frame exceeded the safe limit.', stage=stage)
+                        while b'\n' in event_buffer:
+                            frame, _, remaining = event_buffer.partition(b'\n')
+                            event_buffer[:] = remaining
+                            if on_event:
+                                on_event(bytes(frame))
+                if process.poll() is not None:
+                    # Drain already-written frames/stdout; descendants cannot hold us forever.
+                    if not selector.select(0):
+                        break
+            if event_buffer:
+                raise ServiceError('invalid_event_stream', 'Native runtime ended with an incomplete event frame.', stage=stage)
+            return process.returncode, bytes(output)
+    finally:
+        stop_group(process)
+        if process.stdout:
+            process.stdout.close()
+        if process.stderr:
+            process.stderr.close()
diff --git a/scripts/src/aim/runtime/secrets.py b/scripts/src/aim/runtime/secrets.py
new file mode 100644
index 0000000..40fb5f5
--- /dev/null
+++ b/scripts/src/aim/runtime/secrets.py
@@ -0,0 +1,120 @@
+"""Same-UID, run-scoped secret broker for native password-client executables.
+
+The socket directory is private; SO_PEERCRED enforces the execution UID. This is
+not a cross-user privilege service. Helper files contain no secret material.
+"""
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+import socket
+import struct
+import sys
+import threading
+import time
+
+from aim.services.v1.models import ServiceError
+
+_CLIENT = '''#!{python}
+import json, socket, sys
+try:
+    with socket.socket(socket.AF_UNIX) as s:
+        s.settimeout(5)
+        s.connect({endpoint!r})
+        s.sendall({key!r}.encode('ascii') + b'\\n')
+        data = bytearray()
+        while len(data) <= 65536:
+            block = s.recv(4096)
+            if not block: break
+            data.extend(block)
+        value = json.loads(data.decode('utf-8'))
+        if not isinstance(value, str): raise ValueError()
+        sys.stdout.buffer.write(value.encode('utf-8') + b'\\n')
+except Exception:
+    sys.stderr.write('AIM credential channel unavailable.\\n')
+    sys.exit(1)
+'''
+
+
+class SecretBroker:
+    def __init__(self, directory: Path, values: dict[str, str], *, lifetime: int):
+        self.directory, self.values = directory, dict(values)
+        self.endpoint = directory / 'credentials.sock'
+        self.deadline = time.monotonic() + lifetime
+        self.stop = threading.Event()
+        self.socket = None
+        self.bound = False
+        self.thread = None
+
+    def __repr__(self):
+        return '<SecretBroker redacted>'
+
+    def __enter__(self):
+        if not hasattr(socket, 'SO_PEERCRED') or len(str(self.endpoint).encode()) >= 104:
+            raise ServiceError('unsupported_runtime', 'A short Linux Unix-socket path with peer credentials is required.', stage='credentials')
+        try:
+            self.socket = socket.socket(socket.AF_UNIX)
+            self.socket.bind(str(self.endpoint))
+            self.bound = True
+            os.chmod(self.endpoint, 0o600)
+            self.socket.listen(16)
+            self.socket.settimeout(0.1)
+            self.thread = threading.Thread(target=self._serve, name='aim-one-run-secrets', daemon=True)
+            self.thread.start()
+            return self
+        except BaseException:
+            self.__exit__(None, None, None)
+            raise
+
+    def _serve(self):
+        while not self.stop.is_set() and time.monotonic() < self.deadline:
+            try:
+                connection, _ = self.socket.accept()
+            except socket.timeout:
+                continue
+            except OSError:
+                break
+            with connection:
+                try:
+                    connection.settimeout(1)
+                    _, uid, _ = struct.unpack('3i', connection.getsockopt(socket.SOL_SOCKET, socket.SO_PEERCRED, 12))
+                    if uid != os.geteuid():
+                        continue
+                    request = bytearray()
+                    while len(request) < 80 and not request.endswith(b'\n'):
+                        data = connection.recv(80 - len(request))
+                        if not data:
+                            break
+                        request.extend(data)
+                    key = bytes(request).decode('ascii').rstrip('\n')
+                    value = self.values.get(key) if request.endswith(b'\n') else None
+                    connection.sendall(json.dumps(value, ensure_ascii=False).encode('utf-8'))
+                except (OSError, ValueError, UnicodeError):
+                    pass
+
+    def helper(self, key: str) -> Path:
+        if key not in self.values:
+            raise ServiceError('credential_required', 'Supply the required one-run credential.', stage='credentials',
+                               retryable=True, required_credentials=(key,))
+        python = sys.executable
+        if any(c.isspace() for c in python) or len(python) > 120:
+            raise ServiceError('unsupported_runtime', 'AIM Python executable needs a short, space-free absolute path.', stage='credentials')
+        path = self.directory / (key + '-client')
+        if not path.exists():
+            fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o700)
+            with os.fdopen(fd, 'w', encoding='utf-8') as stream:
+                stream.write(_CLIENT.format(python=python, endpoint=str(self.endpoint), key=key))
+            path.chmod(0o700)
+        return path
+
+    def __exit__(self, *args):
+        self.stop.set()
+        if self.thread:
+            self.thread.join(timeout=2)
+        if self.socket:
+            self.socket.close()
+        if self.bound:
+            self.endpoint.unlink(missing_ok=True)
+            self.bound = False
+        self.values.clear()
diff --git a/scripts/src/aim/runtime/staging.py b/scripts/src/aim/runtime/staging.py
new file mode 100644
index 0000000..a66d044
--- /dev/null
+++ b/scripts/src/aim/runtime/staging.py
@@ -0,0 +1,270 @@
+"""Bounded, credential-free controller staging probe for the local service profile.
+
+The child entry point is standard-library-only. It runs under the caller's UID,
+mount namespace and sandbox; it never invokes Ansible or inspects inventory/Vaults.
+Do not import this internal module from add-ons; use AimService.staging_check().
+"""
+from __future__ import annotations
+
+import configparser
+import errno
+import json
+import os
+from pathlib import Path
+import pwd
+import re
+import stat
+import sys
+import uuid
+
+PROFILE = 'native_defaults_preflight_v2'
+CAPABILITY = {
+    'profile': PROFILE,
+    'operation': 'staging_check',
+    'default_directory': '~/.ansible/tmp',
+    'passwd_home_local_connection_directory': '~account/.ansible/tmp',
+    'required_before_credentials': True,
+    'rechecked_before_launch': True,
+    'probe': 'create_write_read_remove',
+    'service_units_modified': False,
+    'remote_paths_overridden': False,
+    'coverage': 'native_local_tmp_and_passwd_home_posix_local_default',
+}
+ERRORS = {
+    'controller_staging_unavailable': 'Controller staging is not writable in this execution context. Provision a private staging directory and permit that exact path in the executor sandbox; no remote work was launched.',
+    'controller_staging_unsafe': 'Controller staging must be a regular directory owned by the execution UID with owner-only 0700 access (inherited setgid is allowed) and no symlink components. Review its ownership and permissions; AIM does not repair existing paths.',
+    'controller_staging_config_unsupported': 'The staging preflight cannot safely resolve a controller temporary path. Use a literal absolute path, a home-relative path, or a supported literal Ansible configuration path; no configuration was rewritten.',
+    'controller_staging_probe_failed': 'The controller staging probe could not complete. Check the execution interpreter and sandbox; no raw subprocess output was forwarded.',
+    'controller_staging_timeout': 'The controller staging probe exceeded its deadline. Check local storage and the executor sandbox before retrying.',
+}
+
+
+class StagingIssue(Exception):
+    def __init__(self, code):
+        self.code = code
+        super().__init__(code)
+
+
+def _unsupported():
+    raise StagingIssue('controller_staging_config_unsupported')
+
+
+def _literal_path(raw: str, home: str, basedir: Path) -> Path:
+    # Match the ordinary native INI path conventions without evaluating Jinja,
+    # lookups, shell syntax, or arbitrary process variables. Fail rather than guess.
+    if not isinstance(raw, str):
+        _unsupported()
+    value = raw.strip()
+    if len(value) >= 2 and value[0] in ('"', "'") and value[-1] == value[0]:
+        value = value[1:-1]
+    if (not value or len(value) > 4096 or any(ord(c) < 32 or ord(c) == 127 for c in value)
+            or any(c in value for c in ('{', '}', '`', '*', '?', '\\'))):
+        # $HOME is supported below; brace-form is handled separately by callers.
+        _unsupported()
+    value = re.sub(r'\$HOME(?=/|$)', lambda _: home, value)
+    if '$' in value or value.startswith('~') and value != '~' and not value.startswith('~/'):
+        _unsupported()
+    if value == '~' or value.startswith('~/'):
+        value = home + value[1:]
+    path = Path(value)
+    if not path.is_absolute():
+        path = basedir / path
+    if '..' in path.parts or len(path.parts) < 3:
+        _unsupported()
+    return path
+
+
+def _path(raw: str, home: str, basedir: Path) -> Path:
+    # Only this exact variable substitution is allowed; the child environment is
+    # the filtered native runtime environment, not the terminal environment.
+    if not isinstance(raw, str):
+        _unsupported()
+    return _literal_path(raw.replace('${HOME}', '$HOME'), home, basedir)
+
+
+def _homes(env: dict[str, str]) -> tuple[str, str]:
+    try:
+        account_home = pwd.getpwuid(os.geteuid()).pw_dir
+    except KeyError:
+        _unsupported()
+    home = env.get('HOME') or account_home
+    for candidate in (home, account_home):
+        if (not candidate or not Path(candidate).is_absolute() or '..' in Path(candidate).parts
+                or any(ord(c) < 32 or ord(c) == 127 for c in candidate)):
+            _unsupported()
+    return home, account_home
+
+
+def staging_plan(env: dict[str, str]) -> tuple[list[dict], list[str]]:
+    home, account_home = _homes(env)
+    cfg = Path(env.get('ANSIBLE_CONFIG', ''))
+    if not cfg.is_absolute():
+        _unsupported()
+    parser = configparser.ConfigParser(interpolation=None, inline_comment_prefixes=(';',))
+    try:
+        # This is the selected native config, including the packaged fallback.
+        if cfg.stat().st_size > 1024 * 1024:
+            _unsupported()
+        with cfg.open(encoding='utf-8') as stream:
+            parser.read_file(stream)
+    except (OSError, configparser.Error, UnicodeError):
+        _unsupported()
+    def option(name):
+        return parser.get('defaults', name, fallback=None)
+    ansible_home = _path(option('home') if option('home') is not None else '~/.ansible', home, cfg.parent)
+    configured = option('local_tmp')
+    local = _path(configured, home, cfg.parent) if configured is not None else ansible_home / 'tmp'
+    paths = [dict(path=str(local), purpose='controller_local_tmp',
+                  source='ansible_config' if configured is not None else 'native_default')]
+    warnings = [
+        'Local staging probes do not validate inventory-specific ansible_remote_tmp, delegated connection/interpreter/become overrides, async/cache paths or remote hosts.',
+        'A successful check applies only to this process UID, groups, environment and sandbox at this instant; run startup checks inside the actual executor unit.',
+    ]
+    remote = option('remote_tmp')
+    if remote is None or remote.strip().strip('"\'') == '~/.ansible/tmp':
+        # ansible.builtin.local expands ~user through the account database on the
+        # controller. This can differ from process $HOME in hardened services.
+        paths.append(dict(path=str(_path('~/.ansible/tmp', account_home, cfg.parent)),
+                          purpose='default_posix_local_connection_tmp', source='passwd_home_native_default'))
+    else:
+        # A global remote_tmp can refer to a different machine/OS. Never create
+        # that path on this controller or pretend we resolved host variables.
+        warnings.append('A global remote_tmp override is present. Its controller-delegation use is not probed; validate that override under the actual local connection separately.')
+    return paths, warnings
+
+
+def _open_private_directory(path: Path) -> tuple[int, bool]:
+    """Traverse with dirfds; create missing components privately, never repair."""
+    fd = os.open('/', os.O_RDONLY | os.O_DIRECTORY | os.O_CLOEXEC)
+    created = False
+    try:
+        for component in path.parts[1:]:
+            try:
+                nxt = os.open(component, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW | os.O_CLOEXEC, dir_fd=fd)
+            except FileNotFoundError:
+                try:
+                    os.mkdir(component, mode=0o700, dir_fd=fd)
+                    created = True
+                except FileExistsError:
+                    pass  # A concurrent same-UID check may have created it.
+                nxt = os.open(component, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW | os.O_CLOEXEC, dir_fd=fd)
+            os.close(fd)
+            fd = nxt
+        meta = os.fstat(fd)
+        if meta.st_uid != os.geteuid() or stat.S_IMODE(meta.st_mode) not in (0o700, 0o2700):
+            raise StagingIssue('controller_staging_unsafe')
+        return fd, created
+    except BaseException:
+        os.close(fd)
+        raise
+
+
+def probe_directory(path: Path) -> dict:
+    directory_fd = None
+    scratch_fd = None
+    name = '.aim-staging-check-' + uuid.uuid4().hex
+    made = False
+    file_made = False
+    try:
+        directory_fd, created = _open_private_directory(path)
+        os.mkdir(name, mode=0o700, dir_fd=directory_fd)
+        made = True
+        scratch_fd = os.open(name, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW | os.O_CLOEXEC, dir_fd=directory_fd)
+        fd = os.open('probe', os.O_CREAT | os.O_EXCL | os.O_RDWR | os.O_NOFOLLOW | os.O_CLOEXEC, 0o600, dir_fd=scratch_fd)
+        file_made = True
+        try:
+            data = b'AIM staging probe: no credentials or module data.\n'
+            if os.write(fd, data) != len(data):
+                raise OSError(errno.EIO, 'write incomplete')
+            os.fsync(fd)
+            os.lseek(fd, 0, os.SEEK_SET)
+            if os.read(fd, len(data) + 1) != data:
+                raise OSError(errno.EIO, 'read incomplete')
+        finally:
+            os.close(fd)
+        os.unlink('probe', dir_fd=scratch_fd)
+        file_made = False
+        os.close(scratch_fd)
+        scratch_fd = None
+        os.rmdir(name, dir_fd=directory_fd)
+        made = False
+        return {'path': str(path), 'writable': True, 'private': True, 'created_directories': created}
+    except OSError as exc:
+        code = 'controller_staging_unsafe' if exc.errno in (errno.ELOOP, errno.ENOTDIR) else 'controller_staging_unavailable'
+        raise StagingIssue(code) from None
+    finally:
+        # Remove only this probe's random child and fixed non-secret file. No
+        # recursive deletion, chmod/chown, existing module cleanup or rollback.
+        if scratch_fd is not None:
+            if file_made:
+                try:
+                    os.unlink('probe', dir_fd=scratch_fd)
+                except OSError:
+                    pass
+            os.close(scratch_fd)
+        if directory_fd is not None:
+            if made:
+                try:
+                    os.rmdir(name, dir_fd=directory_fd)
+                except OSError:
+                    pass
+            os.close(directory_fd)
+
+
+def probe(env: dict[str, str]) -> dict:
+    home, account_home = _homes(env)
+    plan, warnings = staging_plan(env)
+    checked = {}
+    results = []
+    for entry in plan:
+        path = entry['path']
+        if path not in checked:
+            checked[path] = probe_directory(Path(path))
+        results.append({**checked[path], 'purpose': entry['purpose'], 'source': entry['source']})
+    return {'profile': PROFILE, 'ready': True, 'uid': os.geteuid(),
+            'gids': sorted({os.getegid(), *os.getgroups()}), 'directories': results,
+            'remote_connected': False, 'credentials_read': False,
+            'remote_paths_overridden': False, 'process_home': home, 'account_home': account_home,
+            'home_paths_differ': home != account_home, 'warnings': warnings}
+
+
+def check_controller_staging(config, env: dict[str, str], *, cancel=None) -> dict:
+    # Import only in the parent; `python -I staging.py --probe` must not need AIM,
+    # ruamel, Rich or the Ansible environment in the isolated child process.
+    from aim.runtime.process import run_process
+    from aim.services.v1.models import ServiceError
+    try:
+        rc, raw = run_process([sys.executable, '-I', str(Path(__file__).absolute()), '--probe'],
+                              cwd=config.root_dir, env=env, capture=True, cancel=cancel,
+                              timeout=10, output_limit=32768, stage='readiness')
+    except ServiceError as exc:
+        if exc.code == 'cancelled':
+            raise
+        code = 'controller_staging_timeout' if exc.code == 'timeout' else 'controller_staging_probe_failed'
+        raise ServiceError(code, ERRORS[code], stage='readiness') from None
+    try:
+        payload = json.loads(raw)
+        if rc == 0 and payload['ok'] is True and payload['result']['profile'] == PROFILE and payload['result']['ready'] is True:
+            return payload['result']
+        code = payload.get('code')
+        if code not in ERRORS:
+            code = 'controller_staging_probe_failed'
+    except (ValueError, KeyError, TypeError, AttributeError):
+        code = 'controller_staging_probe_failed'
+    raise ServiceError(code, ERRORS[code], stage='readiness')
+
+
+def main() -> int:
+    try:
+        if sys.argv[1:] != ['--probe']:
+            raise StagingIssue('controller_staging_probe_failed')
+        print(json.dumps({'ok': True, 'result': probe(dict(os.environ))}), flush=True)
+        return 0
+    except BaseException as exc:
+        code = exc.code if isinstance(exc, StagingIssue) else 'controller_staging_probe_failed'
+        print(json.dumps({'ok': False, 'code': code}), flush=True)
+        return 1
+
+
+if __name__ == '__main__':
+    raise SystemExit(main())
diff --git a/scripts/src/aim/services/__init__.py b/scripts/src/aim/services/__init__.py
new file mode 100644
index 0000000..1929b6c
--- /dev/null
+++ b/scripts/src/aim/services/__init__.py
@@ -0,0 +1 @@
+"""Public integration contracts live in explicit versioned subpackages."""
diff --git a/scripts/src/aim/services/v1/__init__.py b/scripts/src/aim/services/v1/__init__.py
new file mode 100644
index 0000000..ed59488
--- /dev/null
+++ b/scripts/src/aim/services/v1/__init__.py
@@ -0,0 +1,16 @@
+"""Supported add-on API 1.0. Everything outside this namespace is private."""
+from aim.services.v1.models import (
+    API_VERSION, EVENT_VERSION, CANONICAL_ANSIBLE, RunRequest, PreparedRun,
+    RunResult, ServiceError, CredentialProvider, EventSink,
+)
+from aim.services.v1.credentials import OneRunCredentials, FDCredentials
+__all__ = ['API_VERSION', 'EVENT_VERSION', 'CANONICAL_ANSIBLE', 'RunRequest', 'PreparedRun',
+           'RunResult', 'ServiceError', 'CredentialProvider', 'EventSink',
+           'OneRunCredentials', 'FDCredentials', 'AimService']
+
+
+def __getattr__(name):
+    if name == 'AimService':
+        from aim.services.v1.service import AimService
+        return AimService
+    raise AttributeError(name)
diff --git a/scripts/src/aim/services/v1/credentials.py b/scripts/src/aim/services/v1/credentials.py
new file mode 100644
index 0000000..83a4687
--- /dev/null
+++ b/scripts/src/aim/services/v1/credentials.py
@@ -0,0 +1,95 @@
+"""One-run secret input. No secret in repr(), request JSON, environment or argv."""
+from __future__ import annotations
+
+import json
+import os
+import selectors
+import stat
+import time
+from aim.services.v1.models import ServiceError
+
+SECRET_KEYS = frozenset({'vault_password', 'connection_password', 'become_password', 'ssh_key_passphrase'})
+MAX_SECRET_BYTES = 65536
+
+
+def validate_secrets(values: dict) -> dict[str, str]:
+    if not isinstance(values, dict) or set(values) - SECRET_KEYS:
+        raise ServiceError('invalid_credentials', 'Unknown credential fields.', stage='credentials')
+    for key, value in values.items():
+        if not isinstance(value, str) or len(value.encode('utf-8')) > 8192 or any(c in value for c in ('\0', '\r', '\n')):
+            raise ServiceError('invalid_credentials', 'Credentials must be UTF-8 single-line strings, at most 8192 bytes.', stage='credentials')
+        if not value and key != 'ssh_key_passphrase':
+            raise ServiceError('credential_required', 'An empty password is not accepted. Supply fresh credentials.',
+                               stage='credentials', retryable=True, required_credentials=(key,))
+    return dict(values)
+
+
+class OneRunCredentials:
+    def __init__(self, values: dict[str, str], *, ttl_seconds: int = 300):
+        if type(ttl_seconds) is not int or not 1 <= ttl_seconds <= 300:
+            raise ValueError('Credential TTL must be 1..300 seconds.')
+        self._values = validate_secrets(values)
+        self._expires = time.monotonic() + ttl_seconds
+        self._consumed = False
+
+    def __repr__(self):
+        return '<OneRunCredentials redacted>'
+
+    def consume(self, run_id: str) -> dict[str, str]:
+        if self._consumed or time.monotonic() >= self._expires:
+            self.close()
+            raise ServiceError('credentials_expired', 'Supply fresh one-run credentials.', stage='credentials', retryable=True)
+        self._consumed = True
+        values, self._values = self._values, {}
+        return values
+
+    def close(self):
+        self._values.clear()
+        self._consumed = True
+
+
+class FDCredentials:
+    """Read one EOF-terminated JSON object from a PRIVATE inherited pipe/socket.
+
+    This is the dedicated secret channel, never the machine request/stdout stream.
+    Callers close their write end; regular files, terminals and fd 0/1/2 are rejected.
+    """
+    def __init__(self, fd: int):
+        if type(fd) is not int or fd < 3:
+            raise ServiceError('invalid_credential_channel', 'Use a dedicated pipe or socket descriptor >= 3.', stage='credentials')
+        self.fd = fd
+        self.used = False
+
+    def consume(self, run_id: str) -> dict[str, str]:
+        if self.used:
+            raise ServiceError('credentials_expired', 'Credential descriptor was already consumed.', stage='credentials', retryable=True)
+        self.used = True
+        deadline = time.monotonic() + 5
+        buffer = bytearray()
+        try:
+            mode = os.fstat(self.fd).st_mode
+            if not (stat.S_ISFIFO(mode) or stat.S_ISSOCK(mode)):
+                raise ValueError()
+            with selectors.DefaultSelector() as selector:
+                selector.register(self.fd, selectors.EVENT_READ)
+                while True:
+                    remaining = deadline - time.monotonic()
+                    if remaining <= 0 or not selector.select(remaining):
+                        raise TimeoutError()
+                    chunk = os.read(self.fd, min(4096, MAX_SECRET_BYTES + 1 - len(buffer)))
+                    if not chunk:
+                        break
+                    buffer.extend(chunk)
+                    if len(buffer) > MAX_SECRET_BYTES:
+                        raise ValueError()
+            values = json.loads(buffer.decode('utf-8'))
+            return validate_secrets(values)
+        except (OSError, ValueError, TimeoutError, RecursionError):
+            raise ServiceError('invalid_credential_channel', 'Credential channel is invalid, too large, or timed out.',
+                               stage='credentials', retryable=True) from None
+        finally:
+            buffer[:] = b'\0' * len(buffer)
+            try:
+                os.close(self.fd)
+            except OSError:
+                pass
diff --git a/scripts/src/aim/services/v1/models.py b/scripts/src/aim/services/v1/models.py
new file mode 100644
index 0000000..fd6fd51
--- /dev/null
+++ b/scripts/src/aim/services/v1/models.py
@@ -0,0 +1,129 @@
+"""AIM service contract 1.0. Public values are JSON-compatible, not UI objects."""
+from __future__ import annotations
+
+from dataclasses import dataclass, field, asdict
+import json
+import re
+from typing import Any, Protocol
+
+API_VERSION = '1.0'
+EVENT_VERSION = '1.0'
+CANONICAL_ANSIBLE = '2.19.11'
+_HOST = re.compile(r'[A-Za-z0-9_][A-Za-z0-9_.-]*\Z')
+_CUSTOMER = re.compile(r'[A-Za-z0-9][A-Za-z0-9_.-]*\Z')
+
+
+class ServiceError(Exception):
+    """Only fixed, non-secret messages/context may cross the service boundary."""
+    def __init__(self, code: str, message: str, *, stage: str = 'validation',
+                 retryable: bool = False, required_credentials: tuple[str, ...] = ()):
+        super().__init__(message)
+        self.code, self.message, self.stage = code, message, stage
+        self.retryable, self.required_credentials = retryable, required_credentials
+
+    def to_dict(self) -> dict:
+        return dict(code=self.code, message=self.message, stage=self.stage,
+                    retryable=self.retryable, required_credentials=list(self.required_credentials))
+
+
+def invalid(message='Invalid request. Unknown fields and implicit target patterns are not accepted.'):
+    return ServiceError('invalid_request', message)
+
+
+@dataclass(frozen=True)
+class RunRequest:
+    customer: str
+    playbook: str
+    hosts: tuple[str, ...]
+    overrides: dict[str, Any] = field(default_factory=dict)
+    check: bool = False
+    key_mode: str = 'none'  # none or customer; never an arbitrary private-key path
+    become_password: bool = False
+    timeout_seconds: int = 3600
+    progress_mode: str = 'summary'  # opt in to play_task_host_v1 detail events
+
+    @classmethod
+    def from_dict(cls, value: dict) -> 'RunRequest':
+        if not isinstance(value, dict) or set(value) - set(cls.__dataclass_fields__):
+            raise invalid()
+        for key in ('customer', 'playbook'):
+            if not isinstance(value.get(key), str) or not _CUSTOMER.fullmatch(value[key]):
+                raise invalid('Customer and playbook identifiers must be explicit safe names.')
+        hosts = value.get('hosts')
+        if not isinstance(hosts, (list, tuple)) or not 1 <= len(hosts) <= 1000:
+            raise invalid('Select between 1 and 1000 explicit inventory hosts.')
+        if any(not isinstance(h, str) or not _HOST.fullmatch(h) for h in hosts) or len(set(hosts)) != len(hosts):
+            raise invalid('Host names must be unique explicit inventory names, not Ansible patterns.')
+        for flag in ('check', 'become_password'):
+            if flag in value and type(value[flag]) is not bool:
+                raise invalid('check and become_password must be booleans.')
+        timeout = value.get('timeout_seconds', 3600)
+        if type(timeout) is not int or not 10 <= timeout <= 86400:
+            raise invalid('timeout_seconds must be an integer between 10 and 86400.')
+        if value.get('key_mode', 'none') not in ('none', 'customer'):
+            raise invalid('key_mode must be none or customer.')
+        if value.get('progress_mode', 'summary') not in ('summary', 'detail'):
+            raise invalid('progress_mode must be summary or detail.')
+        options = value.get('overrides', {})
+        if not isinstance(options, dict) or any(not isinstance(k, str) for k in options):
+            raise invalid('overrides must be a mapping of declared non-secret catalog options.')
+        try:
+            encoded = json.dumps(options, ensure_ascii=False, allow_nan=False)
+            if len(encoded.encode('utf-8')) > 65536:
+                raise ValueError()
+            # Copy mutable caller data. Request instances are revalidated on every public call.
+            options = json.loads(encoded)
+        except (TypeError, ValueError, RecursionError):
+            raise invalid('Options must be bounded JSON values, without NaN or Infinity.') from None
+        return cls(**{**value, 'hosts': tuple(hosts), 'overrides': options})
+
+    def to_dict(self) -> dict:
+        value = asdict(self)
+        value['hosts'] = list(self.hosts)
+        return value
+
+
+@dataclass(frozen=True)
+class PreparedRun:
+    request: RunRequest
+    revision: str
+    credential_requirements: tuple[str, ...]
+    warnings: tuple[str, ...]
+    credential_requirement_reasons: dict[str, tuple[str, ...]] = field(default_factory=dict)
+    result_contract: dict | None = None
+
+    def to_dict(self) -> dict:
+        return dict(api_version=API_VERSION, request=self.request.to_dict(), revision=self.revision,
+                    credential_requirements=list(self.credential_requirements), warnings=list(self.warnings),
+                    result_contract=self.result_contract,
+                    credential_requirement_reasons={k: list(v) for k, v in self.credential_requirement_reasons.items()},
+                    revision_coverage='core source, catalog/playbooks/role text, customer files and selected customer-key bytes, AIM/Ansible config; not a snapshot')
+
+
+@dataclass(frozen=True)
+class RunResult:
+    run_id: str
+    status: str
+    stage: str
+    exit_code: int | None = None
+    remote_work_may_have_started: bool = False
+    error: dict | None = None
+    counts: dict[str, int] = field(default_factory=dict)
+    target_summary: dict = field(default_factory=dict)
+    targets: tuple[dict, ...] = ()
+    operation_result: dict | None = None
+
+    def to_dict(self) -> dict:
+        value = {'api_version': API_VERSION, **asdict(self)}
+        value['targets'] = list(self.targets)
+        return value
+
+
+class CredentialProvider(Protocol):
+    def consume(self, run_id: str) -> dict[str, str]:
+        """Return secrets for exactly one run. Must not prompt or persist them."""
+        ...
+
+
+class EventSink(Protocol):
+    def __call__(self, event: dict) -> None: ...
diff --git a/scripts/src/aim/services/v1/service.py b/scripts/src/aim/services/v1/service.py
new file mode 100644
index 0000000..e52ce51
--- /dev/null
+++ b/scripts/src/aim/services/v1/service.py
@@ -0,0 +1,447 @@
+"""Authoritative local application facade. It never imports aim.ui or add-ons."""
+from __future__ import annotations
+from contextlib import ExitStack
+from copy import deepcopy
+from dataclasses import asdict
+from datetime import datetime, timezone
+from functools import wraps
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import stat
+import tempfile
+import uuid
+
+from ruamel.yaml import YAML
+from aim import __version__
+from aim.auth import require_group_membership, AuthorizationError
+from aim.config import Config
+from aim.customers.manager import CustomerManager, CUSTOMER_RE
+from aim.exceptions import AIMError, InventoryLocked, InvalidTarget, InvalidRunOptions
+from aim.inventory.hosts import InventoryEditor
+from aim.inventory.hierarchy import SCHEMA as INVENTORY_HIERARCHY_SCHEMA, build_inventory_hierarchy
+from aim.inventory.loader import InventoryDocument
+from aim.locking import InventoryLock
+from aim.playbooks.manager import PlaybookManager
+from aim.playbooks.planning import validate_targets, command_arguments
+from aim.runtime.agent import RunAgent, key_is_encrypted
+from aim.runtime.ansible import AnsibleRuntime, base_environment
+from aim.runtime.staging import CAPABILITY as STAGING_CAPABILITY, check_controller_staging
+from aim.runtime.process import run_process
+from aim.runtime.events import EventBridge
+from aim.runtime.outputs import OutputCollector
+from aim.integrations.output_policy import PROTOCOL as OUTPUT_PROTOCOL, RESULT_PROTOCOL, MAX_HOST_BYTES, MAX_RUN_BYTES
+from aim.integrations.event_policy import (DETAIL_SCHEMA, DETAIL_KINDS, EXECUTION_CONTEXT_SCHEMA,
+                                           TARGET_OUTCOME_SCHEMA, MAX_EVENTS, MAX_LABEL_CHARS, MAX_HOST_CHARS)
+from aim.runtime.secrets import SecretBroker
+from aim.services.v1.credentials import validate_secrets
+from aim.services.v1.models import (API_VERSION, EVENT_VERSION, CANONICAL_ANSIBLE,
+                                    RunRequest, PreparedRun, RunResult, ServiceError, invalid)
+
+
+def guarded(method):
+    @wraps(method)
+    def wrapped(self, *args, **kwargs):
+        try:
+            require_group_membership(self.config.required_group)
+            return method(self, *args, **kwargs)
+        except ServiceError:
+            raise
+        except InvalidTarget as exc:
+            raise ServiceError('invalid_target', str(exc), stage='validation') from None
+        except InvalidRunOptions as exc:
+            raise ServiceError('invalid_options', str(exc), stage='validation') from None
+        except AuthorizationError:
+            raise ServiceError('access_denied', 'The active OS identity is not authorized by AIM.', stage='authorization') from None
+        except InventoryLocked:
+            raise ServiceError('resource_busy', 'Another AIM operation holds this customer lock.', retryable=True) from None
+        except PermissionError:
+            raise ServiceError('access_denied', 'The execution identity cannot access a required local resource.', stage='readiness') from None
+        except (AIMError, OSError, ValueError, TypeError, RecursionError):
+            raise ServiceError('source_invalid', 'Required core configuration, inventory or catalog is invalid or inaccessible.') from None
+    return wrapped
+
+
+class AimService:
+    """In-process callers are trusted, already-authorized local OS processes.
+
+    Construction has no side effects. It is not a tenant authorization boundary.
+    Browser approvals/queues are the responsibility of the independent client.
+    """
+    def __init__(self, config: Config | None = None):
+        self.config = config if config is not None else Config.load()
+        self.customers = CustomerManager(self.config)
+        self.playbooks = PlaybookManager(self.customers, self.config)
+
+    def capabilities(self) -> dict:
+        return {
+            'api_version': API_VERSION, 'event_version': EVENT_VERSION, 'core_version': __version__,
+            'canonical_ansible_core': CANONICAL_ANSIBLE,
+            'collection_baselines': {'ansible.windows': '>=3.8.0,<4.0.0'},
+            'contract_stability': 'stable_1.x',
+            'credential_requirements_policy': 'conservative_customer_vault',
+            'operations': ['capabilities', 'list_customers', 'list_hosts', 'inventory_hierarchy', 'list_playbooks', 'prepare', 'readiness', 'execute', 'staging_check'],
+            'execution': {'implemented': True, 'enabled': self.config.addon_execution_enabled,
+                          'profile': 'same_uid_native_inventory', 'qualification': 'controller_acceptance_required'},
+            'execution_progress': {
+                'modes': ['summary', 'detail'], 'default': 'summary', 'request_field': 'progress_mode',
+                'detail_schema': DETAIL_SCHEMA, 'detail_event_kinds': list(DETAIL_KINDS),
+                'static_source_labels_only': True, 'raw_output': False,
+                'error_policy': 'fixed_diagnostic_hints', 'qualification': 'controller_acceptance_required',
+            },
+            'inventory_hierarchy': {
+                'schema': INVENTORY_HIERARCHY_SCHEMA, 'read_only': True,
+                'nested_groups': True, 'direct_hosts_only_per_node': True,
+                'execution_targets_remain_explicit_hosts': True,
+            },
+            'target_outcomes': {
+                'schema': TARGET_OUTCOME_SCHEMA,
+                'states': ['successful', 'failed', 'unreachable', 'not_started', 'indeterminate'],
+                'source': 'native_final_host_stats', 'available_in_progress_modes': ['summary', 'detail'],
+                'overall_status_unchanged': True,
+            },
+            'operation_results': {'protocol': OUTPUT_PROTOCOL, 'result_protocol': RESULT_PROTOCOL,
+                                  'catalog_field': 'result', 'scopes': ['per_host', 'global'],
+                                  'available_in_progress_modes': ['summary', 'detail'],
+                                  'raw_output': False, 'max_bytes_per_host': MAX_HOST_BYTES,
+                                  'max_bytes_per_run': MAX_RUN_BYTES, 'qualification': 'controller_acceptance_required'},
+            'controller_staging': deepcopy(STAGING_CAPABILITY),
+            'credential_fields': ['vault_password', 'connection_password', 'become_password', 'ssh_key_passphrase'],
+            'credential_semantics': 'native_defaults_not_inventory_overrides',
+            'unsupported': ['cross_uid_execution', 'custom_password_override', 'private_key_export',
+                            'inventory_mutation', 'vault_mutation', 'bootstrap', 'raw_task_output',
+                            'automatic_permission_migration', 'automatic_retry_after_launch', 'untrusted_tenant_sandbox'],
+            'limits': {'request_bytes': 131072, 'credential_bytes': 65536, 'hosts': 1000,
+                       'timeout_seconds': 86400, 'credential_ttl_seconds': 300,
+                       'detail_events': MAX_EVENTS, 'progress_label_characters': MAX_LABEL_CHARS,
+                       'progress_host_characters': MAX_HOST_CHARS},
+        }
+
+    def _customer(self, name):
+        if not isinstance(name, str) or not CUSTOMER_RE.fullmatch(name):
+            raise invalid('Invalid customer identifier.')
+        base = self.config.inventory_dir.absolute()
+        path = base / name
+        if path.is_symlink() or not path.resolve().is_relative_to(base.resolve()) or not path.is_dir():
+            raise ServiceError('customer_unavailable', 'Customer is unavailable or outside the configured inventory root.')
+        return path
+
+    @guarded
+    def list_customers(self) -> list[str]:
+        return [name for name in self.customers.list() if CUSTOMER_RE.fullmatch(name) and not self.customers.path(name).is_symlink()]
+
+    @guarded
+    def list_hosts(self, customer: str) -> list[dict]:
+        path = self._customer(customer) / 'hosts.yml'
+        return [dict(name=h.fqdn, address=h.ansible_host, platforms=sorted(h.memberships))
+                for h in InventoryEditor(InventoryDocument(path), customer).list_hosts()]
+
+    @guarded
+    def inventory_hierarchy(self, customer: str) -> dict:
+        path = self._customer(customer) / 'hosts.yml'
+        return {'api_version': API_VERSION, **build_inventory_hierarchy(InventoryDocument(path), customer)}
+
+    @guarded
+    def list_playbooks(self, customer: str) -> list[dict]:
+        self._customer(customer)
+        return [asdict(spec) for spec in self.playbooks.catalog().playbooks if self.playbooks.available(spec, customer)]
+
+    @staticmethod
+    def _request(request):
+        if isinstance(request, RunRequest):
+            request = request.to_dict()
+        return RunRequest.from_dict(request)
+
+    def _resolve(self, request):
+        root = self._customer(request.customer)
+        matches = [s for s in self.playbooks.catalog().playbooks if s.key == request.playbook]
+        if len(matches) != 1:
+            raise ServiceError('unknown_playbook', 'Playbook is not in the active AIM catalog.')
+        spec = matches[0]
+        path = self.playbooks.path(spec, request.customer)
+        if not path.is_file():
+            raise ServiceError('playbook_unavailable', 'The selected catalog playbook is not installed.')
+        self.playbooks.validate_overrides(spec, request.overrides)
+        targets = validate_targets(request.customer, root / 'hosts.yml', spec, request.hosts)
+        platforms = {p for h in targets for p in h.memberships}
+        if request.key_mode == 'customer' and 'linux' not in platforms:
+            raise invalid('Customer SSH key mode requires at least one Linux target.')
+        if request.become_password and not set(spec.become_platforms).intersection(platforms):
+            raise invalid('Selected targets do not use catalog-declared privilege escalation.')
+        return root, spec, path
+
+    def _revision(self, request):
+        """Bounded content digest; detects changes, not arbitrary shell-edit isolation."""
+        h = hashlib.sha256(json.dumps({'request': request.to_dict(), 'config': asdict(self.config),
+                                      'core': __version__, 'api': API_VERSION}, sort_keys=True, default=str).encode())
+        root = self.config.root_dir.absolute()
+        customer = self._customer(request.customer)
+        candidates = set()
+        for directory in (customer, root / 'playbooks', root / 'roles', root / 'scripts/src/aim'):
+            for parent, dirs, files in os.walk(directory, followlinks=False):
+                dirs[:] = sorted(d for d in dirs if d not in ('__pycache__', '.git', '.venv') and not d.startswith('.aim-') and d != '.ssh')
+                for d in dirs:
+                    if (Path(parent) / d).is_symlink():
+                        raise ServiceError('source_symlink_unsupported', 'Source revision traversal does not follow directory symlinks.')
+                for name in sorted(files):
+                    path = Path(parent) / name
+                    if name.startswith('.aim') or '.bak' in name or path.suffix in ('.pyc', '.msi', '.deb', '.rpm'):
+                        continue
+                    if directory == customer or path.suffix in ('.py', '.yml', '.yaml', '.j2', '.ps1', '.sh', '.cfg', '.ini'):
+                        candidates.add(path)
+        if request.key_mode == 'customer':
+            candidates.add(self._key(customer))
+        candidates.update(p for p in (root / 'ansible.cfg', self.config.config_path, root / 'requirements.yml') if p.exists())
+        if len(candidates) > 10000:
+            raise ServiceError('revision_limit', 'Too many source files for a bounded review.')
+        size = 0
+        for path in sorted(candidates):
+            if path.is_symlink() or not path.is_file():
+                raise ServiceError('source_symlink_unsupported', 'Revision inputs must be regular files, not symlinks.')
+            st = path.stat()
+            size += st.st_size
+            if size > 100 * 1024 * 1024:
+                raise ServiceError('revision_limit', 'Review source size exceeds 100 MiB.')
+            h.update(str(path.absolute()).encode())
+            h.update(b'\0')
+            h.update(str((st.st_uid, st.st_gid, stat.S_IMODE(st.st_mode))).encode())
+            with path.open('rb') as stream:
+                for block in iter(lambda: stream.read(65536), b''):
+                    h.update(block)
+            h.update(b'\0')
+        return h.hexdigest()
+
+    def _key(self, customer_root):
+        key = customer_root / 'group_vars/linux/.ssh' / self.config.service_user
+        if key.is_symlink() or not key.is_file():
+            raise ServiceError('key_unavailable', 'The canonical customer SSH key is unavailable.', stage='readiness')
+        st = key.stat()
+        if stat.S_IMODE(st.st_mode) != 0o600 or st.st_uid != os.geteuid():
+            raise ServiceError('key_access_policy', 'Customer keys must be owner-only (0600) and owned by the execution UID. AIM does not repair this automatically.', stage='readiness')
+        return key
+
+    @guarded
+    def prepare(self, request: RunRequest | dict) -> PreparedRun:
+        request = self._request(request)
+        customer, spec, _ = self._resolve(request)
+        vault = customer / 'group_vars/all/vault.yml'
+        needed = []
+        reasons = {}
+        if vault.exists():
+            needed.append('vault_password')
+            reasons['vault_password'] = ['customer_vault_present']
+            if spec.require_vault:
+                reasons['vault_password'].append('catalog_requires_vault')
+        elif spec.require_vault:
+            raise ServiceError('vault_missing', 'The catalog operation requires the customer Vault.')
+        if spec.ask_pass:
+            needed.append('connection_password')
+            reasons['connection_password'] = ['catalog_requests_connection_password']
+        if request.become_password:
+            needed.append('become_password')
+            reasons['become_password'] = ['request_requires_become_password']
+        warnings = ['Known-source digest is not an atomic snapshot; external assets, collections and dynamic includes need operator review.',
+                    'Catalog playbooks, inventory and plugins are trusted controller code; --limit is not a security sandbox.',
+                    'Native inventory variables retain precedence over supplied default connection/become passwords.']
+        if request.key_mode == 'customer':
+            if key_is_encrypted(self._key(customer)):
+                needed.append('ssh_key_passphrase_or_customer_vault_value')
+                reasons['ssh_key_passphrase_or_customer_vault_value'] = ['encrypted_customer_key_selected']
+        if request.progress_mode == 'detail':
+            warnings.append('Detailed events expose approved host names and static source labels; keep source labels non-secret. Dynamic/no_log labels and arbitrary result messages are withheld.')
+        if request.check:
+            warnings.append('Check mode is not a guarantee of zero side effects for every playbook/plugin.')
+        return PreparedRun(request, self._revision(request), tuple(needed), tuple(warnings),
+                           {key: tuple(value) for key, value in reasons.items()}, deepcopy(spec.result))
+
+    @guarded
+    def staging_check(self, *, cancel=None) -> dict:
+        """Probe native default staging under this UID/sandbox, without credentials."""
+        report = check_controller_staging(self.config, base_environment(self.config), cancel=cancel)
+        return {'api_version': API_VERSION, **report}
+
+    @guarded
+    def readiness(self, request: RunRequest | dict) -> dict:
+        request = self._request(request)
+        customer, spec, _ = self._resolve(request)
+        prepared = self.prepare(request)
+        runtime = AnsibleRuntime(self.config).discover(spec.requirements)
+        if request.key_mode == 'customer':
+            import shutil
+            for tool in ('ssh-add', 'ssh-agent'):
+                if not shutil.which(tool):
+                    raise ServiceError('ssh_tools_missing', 'Customer key mode requires ssh-add and ssh-agent.', stage='readiness')
+        return {'api_version': API_VERSION, 'ready': True, 'execution_enabled': self.config.addon_execution_enabled,
+                'runtime': runtime, 'prepared': prepared.to_dict(),
+                'note': 'Readiness is local only; no remote connectivity or credential validation has occurred.'}
+
+    @guarded
+    def execute(self, request: RunRequest | dict, *, expected_revision: str, credentials=None,
+                event_sink=None, cancel=None) -> RunResult:
+        request = self._request(request)
+        if not isinstance(expected_revision, str) or not re.fullmatch('[a-f0-9]{64}', expected_revision):
+            raise invalid('A SHA-256 revision returned by prepare is required.')
+        if not self.config.addon_execution_enabled:
+            raise ServiceError('execution_disabled', 'An administrator must explicitly enable addons.execution_enabled after controller qualification.', stage='readiness')
+        customer, spec, playbook = self._resolve(request)
+        run_id = str(uuid.uuid4())
+        sequence = 0
+        counts = {}
+        remote_started = False
+        secrets = {}
+        def emit(kind, **payload):
+            nonlocal sequence
+            sequence += 1
+            event = dict(event_version=EVENT_VERSION, run_id=run_id, sequence=sequence,
+                         timestamp=datetime.now(timezone.utc).isoformat(), kind=kind, **payload)
+            if event_sink:
+                try:
+                    event_sink(deepcopy(event))
+                except Exception:
+                    raise ServiceError('event_sink_failed', 'Event consumer failed; the owned execution is being cancelled.', stage='execution') from None
+        outputs = OutputCollector(spec.result, request.hosts)
+        bridge = EventBridge(request.progress_mode, request.hosts, emit, output_collector=outputs)
+        try:
+            with InventoryLock(customer / 'hosts.yml'):
+                prepared = self.prepare(request)
+                if prepared.revision != expected_revision:
+                    raise ServiceError('review_stale', 'Sources or options changed; prepare and review again.', retryable=True)
+                runtime = AnsibleRuntime(self.config)
+                runtime.discover(spec.requirements, cancel=cancel)
+                emit('stage', stage='credentials')
+                secrets = validate_secrets(credentials.consume(run_id) if credentials else {})
+                needed = set(prepared.credential_requirements) - {'ssh_key_passphrase_or_customer_vault_value'}
+                missing = tuple(sorted(needed - secrets.keys()))
+                if missing:
+                    raise ServiceError('credential_required', 'Supply fresh credentials for the reviewed operation.',
+                                       stage='credentials', retryable=True, required_credentials=missing)
+                if 'become_password' in secrets and not request.become_password:
+                    raise invalid('Review become_password=true before supplying an escalation password.')
+                with tempfile.TemporaryDirectory(prefix='aim-run-') as temp, ExitStack() as stack:
+                    directory = Path(temp)
+                    directory.chmod(0o700)
+                    broker = stack.enter_context(SecretBroker(directory, secrets, lifetime=request.timeout_seconds + 120))
+                    env = runtime.env.copy()
+                    bridge.secret_values = broker.values.values()
+                    vault_args = []
+                    vault = customer / 'group_vars/all/vault.yml'
+                    if vault.exists():
+                        if not vault.read_bytes().startswith(b'$ANSIBLE_VAULT;'):
+                            raise ServiceError('unencrypted_vault', 'The customer Vault must be encrypted.', stage='credentials')
+                        vault_args = ['--vault-id', f'{request.customer}@{broker.helper("vault_password")}']
+                        needs_key_secret = request.key_mode == 'customer' and key_is_encrypted(self._key(customer)) and not secrets.get('ssh_key_passphrase')
+                        rc, text = run_process([runtime.tools['ansible-vault'], 'view', *vault_args, str(vault)],
+                                               cwd=self.config.root_dir, env=env, timeout=20, capture=needs_key_secret,
+                                               cancel=cancel, stage='vault_unlock')
+                        if rc:
+                            raise ServiceError('vault_unlock_failed', 'Vault password was rejected or ciphertext is invalid.',
+                                               stage='vault_unlock', retryable=True, required_credentials=('vault_password',))
+                        if needs_key_secret:
+                            try:
+                                values = YAML(typ='safe').load(text.decode('utf-8'))
+                                phrase = values.get('vault_linux_ssh_key_passphrase')
+                                if not isinstance(phrase, str) or not phrase:
+                                    raise ValueError()
+                                validate_secrets({'ssh_key_passphrase': phrase})
+                                broker.values['ssh_key_passphrase'] = phrase
+                            except (ValueError, TypeError, AttributeError):
+                                raise ServiceError('credential_required', 'Supply the SSH key passphrase; the literal customer Vault key value is missing.',
+                                                   stage='key_loading', retryable=True, required_credentials=('ssh_key_passphrase',)) from None
+                            finally:
+                                text = b''
+                    if request.key_mode == 'customer':
+                        env = stack.enter_context(RunAgent(directory, self._key(customer), broker, env, cancel=cancel))
+                    options = dict(request.overrides)
+                    if any(f.name == 'checkmk_cleanup_enabled' for f in spec.inputs):
+                        options.setdefault('checkmk_cleanup_enabled', False)
+                    options_file = None
+                    if options:
+                        options_file = directory / 'options.json'
+                        fd = os.open(options_file, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+                        with os.fdopen(fd, 'w', encoding='utf-8') as stream:
+                            json.dump(options, stream, ensure_ascii=False)
+                    credential_args = []
+                    if 'connection_password' in secrets:
+                        credential_args += ['--connection-password-file', str(broker.helper('connection_password'))]
+                    if request.become_password:
+                        credential_args += ['--become-password-file', str(broker.helper('become_password'))]
+                    args = command_arguments(runtime.tools['ansible-playbook'], customer / 'hosts.yml', playbook,
+                                             request.hosts, vault_args=vault_args, credential_args=credential_args,
+                                             options_file=options_file, check=request.check)
+                    emit('stage', stage='syntax_check')
+                    rc, _ = run_process([*args, '--syntax-check'], cwd=self.config.root_dir, env=env,
+                                        timeout=60, cancel=cancel, stage='syntax_check')
+                    if rc:
+                        raise ServiceError('syntax_check_failed', 'Native Ansible preflight failed; no playbook execution was launched.', stage='syntax_check')
+                    if self._revision(request) != expected_revision:
+                        raise ServiceError('review_stale', 'Sources changed during preflight; prepare and review again.', retryable=True)
+                    # Sandbox/storage can change after readiness. Never turn a
+                    # local staging problem into a late remote unreachable result.
+                    runtime.check_staging(cancel=cancel)
+                    read_fd, write_fd = os.pipe()
+                    try:
+                        env['AIM_EVENT_FD'] = str(write_fd)
+                        env['AIM_PROGRESS_MODE'] = request.progress_mode
+                        context_path = directory / 'event-context.json'
+                        fd = os.open(context_path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+                        with os.fdopen(fd, 'w', encoding='utf-8') as context_stream:
+                            json.dump({'schema': EXECUTION_CONTEXT_SCHEMA, 'hosts': list(request.hosts), 'result': spec.result}, context_stream)
+                        env['AIM_EVENT_CONTEXT'] = str(context_path)
+                        env['ANSIBLE_STDOUT_CALLBACK'] = 'aim_safe_events'
+                        env['ANSIBLE_CALLBACK_PLUGINS'] = str(Path(__file__).resolve().parents[2] / 'integrations/callbacks')
+                        emit('stage', stage='execution')
+                        remote_started = True  # conservative from the instant execution may launch
+                        rc, _ = run_process(args, cwd=self.config.root_dir, env=env,
+                                            timeout=request.timeout_seconds, cancel=cancel, event_fd=read_fd,
+                                            pass_fds=(write_fd,), on_event=bridge, stage='execution')
+                    finally:
+                        os.close(read_fd)
+                        os.close(write_fd)
+                    counts = bridge.counts.copy()
+                    if rc == 0:
+                        bridge.require_complete()
+                    target_summary, targets = bridge.target_outcomes(remote_started=True)
+                    if rc:
+                        code = 'host_unreachable' if counts.get('unreachable', 0) else 'playbook_failed'
+                        result = RunResult(run_id, 'failed', 'execution', rc, True,
+                                           ServiceError(code, 'Native playbook execution failed. No automatic replay or rollback was attempted.', stage='execution').to_dict(), counts,
+                                           target_summary, tuple(targets),
+                                           outputs.report(final_stats=bridge.got_stats, targets=targets, check=request.check, remote_started=True))
+                    else:
+                        output_error = outputs.validation_error()
+                        if output_error:
+                            result = RunResult(run_id, 'failed', 'result_validation', rc, True,
+                                ServiceError(output_error, 'Declared operation output is missing, invalid, withheld or incomplete.', stage='result_validation').to_dict(), counts,
+                                target_summary, tuple(targets), outputs.report(final_stats=bridge.got_stats, targets=targets, check=request.check, remote_started=True))
+                        else:
+                            result = RunResult(run_id, 'succeeded', 'completed', rc, True, counts=counts,
+                                           target_summary=target_summary, targets=tuple(targets),
+                                           operation_result=outputs.report(final_stats=bridge.got_stats, targets=targets, check=request.check, remote_started=remote_started))
+            emit('result', result=result.to_dict())
+            return result
+        except Exception as caught:
+            counts = bridge.counts.copy()
+            if isinstance(caught, ServiceError):
+                exc = caught
+            elif isinstance(caught, InventoryLocked):
+                exc = ServiceError('resource_busy', 'Another AIM operation holds this customer lock.', retryable=True)
+            elif isinstance(caught, PermissionError):
+                exc = ServiceError('access_denied', 'A required local resource is not accessible.', stage='execution' if remote_started else 'readiness')
+            else:
+                exc = ServiceError('internal_error', 'Core execution failed; private diagnostics were not forwarded.', stage='execution' if remote_started else 'preparation')
+            target_summary, targets = bridge.target_outcomes(remote_started=remote_started)
+            result = RunResult(run_id, 'cancelled' if exc.code == 'cancelled' else 'failed', exc.stage,
+                               remote_work_may_have_started=remote_started, error=exc.to_dict(), counts=counts,
+                               target_summary=target_summary, targets=tuple(targets),
+                                           operation_result=outputs.report(final_stats=bridge.got_stats, targets=targets, check=request.check, remote_started=remote_started))
+            # Do not call a failing event sink repeatedly.
+            if exc.code != 'event_sink_failed':
+                try:
+                    emit('result', result=result.to_dict())
+                except ServiceError:
+                    pass  # return the authoritative result even if the sink disconnected
+            return result
+        finally:
+            secrets.clear()
diff --git a/scripts/src/aim/sophos/__pycache__/__init__.cpython-313.pyc b/scripts/src/aim/sophos/__pycache__/__init__.cpython-313.pyc
deleted file mode 100644
index bbc9bcd405fe29bf12e609be1521153282ec7a42..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 197
zcmey&%ge<81kY!#%+dwYk3k$5V1zP0a{w7r8G;##7}6OvnX1%+^9wTaixnc=gB5^u
zi9&LIURq{)X;ETHW`3SRMruw$YEiMCpC;oi_W1ae{N(ufl?<OjhTYQFPc2E-Ps}UM
zOv*{sFHSDXEGQ|~FD?R#W#;M^gU!{CkI&4@EQycTE2zB1VUwGmQks)$SHuR?4{}j4
S$Tc6B85tRGG3XSr0675Wj5baH

diff --git a/scripts/src/aim/sophos/__pycache__/config.cpython-313.pyc b/scripts/src/aim/sophos/__pycache__/config.cpython-313.pyc
deleted file mode 100644
index c7e72a6ff3490e9290caef0f719c1f9fdf870e34..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 8218
zcmcIJZEPD?a&O7yHz`u2Z0p0ZR<>N3wkX+=t;ioyBHL+fDN+)y>2s_&Jepj}YmrO(
z?NYXs%LlH&LAvB%34vj`Eno##;AG%{^N;@MwFg{34!9IW4rHhv)jb6;aCdDD6sU3z
zYSjJHnMW=q(TdM)(<l4wysvq0=FQBT89wlMoCM0h+`4mlK0wH?v0)Ux3~&#w0dRwe
zMC69ZAV)a?VbhR_n%LJ&&Fsrl9=_%w%b=B7*&KezHfX1I23v+4gHGyXuyx2a=%#K4
z+lD-Yb+k?(jbtYg?af4V95R)6rrt4A(0LylK~8tY6eXj@G&!TFBhcnwi)okOYaUQ0
zvH8Zp@GJ0jpU9-slA=k8;aC>hO|fh?H5pCEl-QV*h-M|4mQ@vz#LK&sYjgR-J@^g)
zH^`fWav}i&IUvpigqfQOwTNz!Zzh*{YJJltdPEDthbma89s24->xMpu=oM{jg;Vq)
zaj@34gKYjM){71{!!0_gXUrA!>j5#7y_8W;WR#>lHq1z%_r0*=)V~f(bW9QkP7jAF
zqzUD@!bFV9v5P556=X%r2r&T=Xi?}@1!R$slv7fd(-~35mCRM88&>CHsq#=vNeJ;W
z`&1!DB_T^CRiYD8q6>EtGD>Pvh*K%1Nosd4o4~K2U6P!*g%V3koq{51S2J`xnz?vc
zife!cP)?*`N)!$w(PS(RE8uphjNfb7lpL2eK&s~8mSia*T%2?QLLme96w@-a%Nef-
z17kD7a8uj^9{@MVIbVu(V>L$Za3gm(-4V~JS|%+~HE7a#RZ1l(GEBv#f}n@GB`w|^
zQ&bsP)UC#;oYmBBl|rAK?p7JQyW@=CUD-+99)*L;S~RL}-{dN~jL~hlgAJ<p$#T=q
z@6|m3ki;u8g)l*7Vkhqd;0B41F!t7z@cI>%v2%Vy9oh-?Kxfdz2-1C$qUNX+tzK`?
zOpz_R-Qa-EC$A(F6_E;pK<jak&w|$IjhhjJBh4^JMQVT$Z{Yg7Gw+tXT?KE~;<ci;
zKX31+4KTLhN~(k%gAuS2yvU&tE2fBPCy;rFgKj8_nYFoUn-@(Ha~;@=2wz8f_;wPs
zOucYCC#Mo9Q6PrO1jq^KDF|mpvdc0hpr9Q=L5q&(l!R0fwQ*^(D_+@*?TFU_CXIXW
zJ^*kqF1&t}O(9^$n#pLD>!R5>Uf5EZu<j%BKu$#(1H{n#>I&SirWkXOxDlO;Za5!e
z>cR8%0<en+OezB86i92PeoqBc0%i@n2#IhL<c38c!*Gc%m^((EGbcGF4|hN!bW_)U
zyjrSN<h*>@j$>nz0$N7<^~h#7o{*BUTuO^>RN5#qxa(Ld6OX0T{w^g$)3KC1wXUm*
zwhfNS#N|E+Ouj|>EcE8Wnc_DSw@=<W3Gjcac9`&OXA?K;XySAem8LwSZw-Xb$3j#4
zLx(Ty3-UUDIU_5&6ErEE%}~@diwdSd(=DmYRf&QHw@k!RIZ4Ias|c~9dM5q&|D7%Y
zi8u%q$b4Yy&Az$5LW}gn^MAn?L(i8&Ckmkx`IBezXGfPpZx&mmVn8Yd#tVV*Vj!J&
zr<p?NJW3;d25<y<8ibE-RyC?ysiftoLPO9)TXEDvQMq(8NGsiokjGHgDBhlKhXDqu
zD1e}~hTgV3;jZ-V{~;6bpz408-X~vLIfuf1VI@sF7xokz_f32LDX@KB{HTB0zFfa$
zHa#0%7+AQpa6a$dpSSNXt3NEP7Aru^t_=ckgN))Wv0})+0-6^gscJu1zRh&YB*Hr@
z@`ud=7!9T`XYQkh+~=VRnsr+m-f>wO)9tEsB_}CyNw;Q_NmbIo?BOAFuklz#ujDfD
zFzHqqtb?L~1o4xxbZWf-S)$mZH*Ll@Hq-$aRaC<F$#1-Y4<@Gh<<?!({E~h9vfX{%
zHRGBeSmf@uO}h&AgJ3A9U1iQxEeWiwa%LWAXBNN80~oE8HR}!rl5A%Gt9;}m=FK=~
zj2jjswgaq%Is61`6h@`2DI#~|93e4q21mi#l#7A69r5AIQ&Zr+%y45S6HzP?K8&wy
zO^H|x>!?`4HH1IIehTCp*7#TKHi{1wD-r9c-++yk2AzpIIO`T;lszSu9+R=3#6_&_
zq>Xfv>U`jS(j<^pBEa9si_e=|Ns<d%M<|M!&e2DfoR$prfeT>=@yaAX*rv7%Y49fS
zG16kPBE-sWQbiPlF4_c3>GQbWDqWLRO$CnwTvXi#9+wIxlj1e#Ja{vT&Zjc5gzl78
zS%Enyz<ffEYr69+nzxrI&CsBYz2MA7&_=|~Ho%uvw}L^DVrf_u(_+lmVAi2xALuEZ
zv+1*r+jhaI`Y}}HXMJ*Ja=x+X-2+k$kNnik)Cb=xgKy8gef^!8cNX{`I6iiK-&GQN
z3PR7_D@CDiCD8g&f8O1;?5V&0#>^YD>cTgs-za!OcegGFw%t5DcX<A6G0;AJ@}Zg3
zb=`A$XO0;wR=iE~?SICXyt@nD-7Eg>3;g^<e)mBBnd3$OiM;y+Q=f+(SoV*e&?D6i
zr~I34|M8>dzdh<a;jnG+qR?_MYtsw2`BXY(-b|;&svGh=SCtPC1A*)(3hLQ<J%%l@
zh*jCzWQ}FCYSSY8C~7_{wK5w6-5PZmqY>Va)>j>Cy@uAU!)SQ|Mqt<4+BJPUXlh^A
zZ{Wn<pm{|1ZhY`n-CN_L!#l+U$~-1%^fVlpqIri$4a}{zRz`<$$W}oKuQho4s){@)
z3uxID@i6@Wor=N>r|NB+S>6p(jsgO80;<PE*1z@Up1D2wmd>I-RPy)S^-tTDeGND5
zbM}1G-lA_`$#-CpPFq%5gNq%1ez4TqS7`0~P@R45!*Bg0{#VkHcp?8*d`Xf^;^l&P
z`DfxMTmBASw_M(yTgs}%Y_1G%wC5-fReOF8l=>-T&-#1pxh-OSDtiug6=rT?&qYo&
z9p+x;M6+U#*uz!1g0ohNaqotV$H1~iY~iYfH|9aFy()_k_bLuJ`zEv2y;jb1M?}5@
z5JdPY_Dj%mZu(NJy#ua@D~^`C`dS!gR9xr&QnVn(b@t!&1pAM=w8fx6v>N9J%g=|=
z$*L*FKHy=)o00=<&wjdgiipQpf9@xEhGB?v(9e!oo`O1?u~vC9b+-RCb=BJe>MUO)
zb=EMxGBqXKQquuV(E)$X!zO`@ZZ}55;AzwrNa46dH^}QIcty`)GvoWej|#@R@J<6-
z`$E`QXK)nu+ii?Qyhg9$+d(3}FtW3zKn4c20)3MDh$H?SO7>G}2Am^OA4b=`roj4r
zHC@m&q)GImZ*QCn<i!@oj+zp2M(T~XfF->)ctT%6iEkYxo9k@7v9IEP%)9bm6gFs*
z|EV>piWPmRr?OC2fOo!dcMZ|d9K{%emGH9$wDyI2wuTR^wGGJNZ5U&+nqp9Fe1YS>
zFx+x&F>t^RPZ(uBFWN*aU^!figGs&rFegAf^6K7Ee2`d)_`o`%PgYaH{WTrX48Qnz
z-<l+>(}UxW&jbGWBGz@Yt0y@3&97(w-%s~fd(ba)BNxg(^b_a2WXyRohm)k@j|WER
z0I-50KXk}t8JR`;8gxvFHI56U5Yg)vF6J~rRt3lp3mbj(qk@!>VN4Usc}_?*UX+p<
zNNwi84<Ey<CVib@uJM4r4$NmDF=K<U9)eI6f(krpG&4Ts?t)ZfNM)(U&=lV_nNC4~
zYlZMNDPIFWKbOR>IU!S>yE?Vc>D<NAyqL;?oG9c-%f6Fv?qv}p6UYqbpdT`2PWmE}
za^U6Knbi~_OX@z(B?yt7EGrJ~S!O)Ab1kl+Cjq1GfXE{e)ud~Xm4Prs&NA<iVhWQ*
zIBPB<9m4q*S(DNbfR}04E$MM2#txlX%sxXfKdxd!H)T}a5>I6y$;>0Nm)Yv86xKuX
zglz=@PYz~U;+N8y1bqo7*u?1R;a5+-#KJ7-m2@XN;KfN6_UDw8tc+7TB1AVsx0bo2
z*HK6v$P|7B7^9h7R<}_pn}UpVFi`8#p2xK)aZEVYMPZ%{mB(brNtU_c1qxNbXY^9$
z3zx4N#EYU$Ea!tv$pkPUon^^2-3$<Y1<&S)Lxx;tnRG~2R$S&vWVhabwy>WuHqThF
zA=Dc6-%RK)ulk9v;rix5-mw>dI`reApAP?cc%HvqcdPEMZN9G1*!KyY_AK|FDD|E$
z^qwyD4i$Qb=G$)vZv_{Imztl=zaE+PVyL)=^IprY>GK79<3GEam$$Xtyf$|&FB~Xt
zdv^NNvUgj-+q%-y@hAPW_T|0L=C}Mo!Pl`8cxL|65BX9cR0xDtwhH;SiQ?9)dEeFL
z9ih^Wp2CivU+y?G=bSaK2%U?OqR=yI|H$)&nY8x)hn2Wn{-5_)wGxL1(>f)4Q^DS}
z(0;cek5KQ*w${?Nj?cDrEWZ2K$$a>1DSV*-|F*p~<DNFH*qzty-?h*BKXk9u`Dgn+
zP^QhRrmc=W%k>R68|ND5cP-jx8w>UO@BZO(U}qt)ck!K4_whpa@lyB6Lifq#hUS~E
z%)PSkOsVZqq3uwy?YaDs%Z0YfOAX@~&p75B^X&`PC11xw8}T1lbrS!UTCCfJ+ox}x
zUPu<Vhh`lRdixLD^EMW|?U226{On*UbgB?K#h87jxHXdZMee~JR$}~RUjVoG)Ark)
zf84pC{b2Ir$?v~i>Nry9I8tmry5u{CxzPT({$gMkjK25rd&Q2vVxVuirFGRuJihCL
zGlL85(}SP6J5~dv;qaGMQona`*P`~LckjGgrmxg37P`eH-<jXI>#h%ecW_pnKe^;?
zTXFARNc?Ez&Pb_qpwKx`>U^!x`P!2Eb;u*!b9>j}eYg+k`DOk7M-PE?1paGP*tqi}
z745;#Ip0Vl`FZ_-XZWD`lO2uF_@viAVm1H0{kQ;)f9M<NgwLl3og-%3r~P(-e_?fw
zY_a{q$Kb~L5y&AzP(nr^xW&++oUmmH81&{SrcaoG+Az+Pdu<#c_-%&G#aMB}+!|cA
zCy!4xX}N4l8ijCs6pY}7PQidK1l^mSkQpp?7PMNAnlQ73OFM-%2!1EMaG`9_-h)Z&
zsH(%?xiISw*>}jqgGtS$5Ozl)ml{h|M!eBzQU;?8)>Tq6Fl>uP6Pb84N-;^tjHK?y
z^p_k@OWGx{*68%H^jP`5IE&49pwhQQqveUwm<I0&Jl~QEcrZoI0&kWxppYLVtU@cU
z{t;B)Azzp*7W?n&ILj``Tw7iM#kKk$m~55<56l3qA_V3S`*=%3r4OJl-7ct_dCLU1
z>VCnp=bnGdss+BV-s@krA><^1t*b7C+@!f@)q_wSLSBS?#98;S9-#91@Mu9FGAo&b
z6hAPFn(?$URw$Ho3@Uv6wM!}aA`>3ns!d`Fn_6(lMRUOLR2L?q%L(j;bv<3i&#>hT
zq8B`du5~|MmmfFApN%}z?Z?Wu*H6C(yKwMd?SyL8%yHc3WaqDm<5$G>E8_i}G=5ID
Z{+4Y2oP>T$4n4G9;kZ4&BUm#E{~HlJ-v<By

diff --git a/scripts/src/aim/sophos/config.py b/scripts/src/aim/sophos/config.py
index f459526..0e316f4 100644
--- a/scripts/src/aim/sophos/config.py
+++ b/scripts/src/aim/sophos/config.py
@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+from aim.permissions import preserve_replacement_metadata
+
 import os
 import stat
 import tempfile
@@ -121,8 +123,9 @@ class SophosConfigManager:
             else:
                 apply_managed_permissions(tmp, self.customers.config.required_group)
 
+            if path.exists():
+                preserve_replacement_metadata(tmp, path)
             os.replace(tmp, path)
-            apply_managed_permissions(path, self.customers.config.required_group)
             return path
         finally:
             tmp.unlink(missing_ok=True)
diff --git a/scripts/src/aim/ssh/__pycache__/__init__.cpython-313.pyc b/scripts/src/aim/ssh/__pycache__/__init__.cpython-313.pyc
deleted file mode 100644
index 7028d0be7005e29f573d89c0d9bbae095f7f5800..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 141
zcmey&%ge<81kYx!%mUGmK?DpiLK&Y~fQ+dO=?t2Tek&P@n1H;`AgNnA`l%(!`iXhP
znMpaR`o+mbnFS@q`o%>+vCLfk;^GYb`1s7c%#!$cy@JYH95%W6DWy57c15f}%^<^z
PL5z>gjEsy$%s>_Zh$bM+

diff --git a/scripts/src/aim/ssh/__pycache__/keys.cpython-313.pyc b/scripts/src/aim/ssh/__pycache__/keys.cpython-313.pyc
deleted file mode 100644
index 1680320cffefda4c75646bbdd3966b16eaf73b18..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 14117
zcmb_DZEPFKb<0mt6h9<Nlx^9TR+MCkK2h}d*|KGy&X&Jq%QjcM^F_89np{b|qe$ND
zQnq=%;Lrl8R2-^vF9$0~&?sn;$Vk!LkNj|c<qj>-6e!T$&?(uCk_HHh_S!$XTEG?l
z)%Rw(%N51*IcZ1I?Ci|!o0&In-q$=mb-SGmq<{bRqc`1s4D&mD(UMIqn4bOs3Lh~X
z!<ojJizZ@Xv1}eU6El5Uh=o3_#7dtwVxvzxvBT3c-f+=D9P}IOc;iJUaniDFyy>Eg
zxM<lv?!M?Do{L`MWtkg}0K+wKj$@|n43ru>7|wavtj^`I`d~;iZEJ!ym)1sFX3RnN
zXV@cXQkvqKOjeAGscc4=fcM5^T#P5uaY29=>(#h83s3*pU6Ci5c=~j9ZZ4ilo{gu{
zd@^WOS`unSEItoa@!M%$aglr`##j1J!pHV$k}dF=L}g0!VNqX9PftSOBjyG}OdJDf
zG7(E3pzMZ~v-Cp?Em>*F26cA5)IduPVw-6UIu#ekoge4#aj=ZM@R=7rB)BI^Q;wwO
z<02n>i@&EhbNSopRDzbRx3k%_;(*EL(!9tk4Y@cGQ}Og8W+G@;9I;p?KF7ymiZd3Q
z%O>+_EW2W{xAXCIrNtYIO{a(;rc)U{lZ9reFkliY{IQsTcumCOqDWG=^CB<AV#Eg%
zdkTMyG7#p)L^z%iQh>IwkRYj?D1-$9b*Z_qAk2ng+QLxo9%+K^G{dC{+adcC=C>{W
zqSaq+ZYx^b${ybzPn6v)-@HtAXk9m<yFwMFr+);^o6*gAIZFrgrU_`WnX^L43RKy`
z*=Whm`8Yc*HE^w511&kYHqJpyjhr8;4!&@5?VOXAnxF*K26Zm@)<sKhZX4&OB@gEz
zUZB41iW9c%ay%2C;mK#)U{VtaE96?j`2vZUo*se1N6hu+wAR90XVWI_<@&yKWo1Ar
zrYMuHkQKwsFhTRg*`QTvOymVIJI512u_v;b>C}v3n~&$yqT-3c;29A&iHJbVR>dmt
z>1omh&<TrKH)H}%i-klwpn#;2%A`ct-qz{@hO|oD83A|TJ*K=P@V=+qzU%#_vcKbf
zXSuUy!TL+bPP#t{ebUesr%acMOZ<q5G7)&zrii|<YD?5~xPk~=dc=snN~egu+FL7m
zn1kjJ&{HoWsL(z`viV$WK2C%%P;&lmcnIk(Xr)+C8VLV(K1Fzn4#g$#WImPPV|ge9
z&7=ol!Wq)=i;L3H1e6=g0q@v^Catm)dJ19408QT3rEe^LqvY+Ay?raQMQ>O-bn)kh
z{^|HX950P0<ne@bF)1D3WiKx|_^rru01%424Jc6L>9heAl~hGk#yq7Xa;n0$876A3
zA~FQuXm1(IRD%ZNdQa3GY1H1TPmRxxm<B49@n%2+6SX|A_w!*r|J&gim|<nJ=_Wq2
z4gqHi+Q?p*fy(zRf=DR8Q0)BOlpqSQp}1Ql2pKRtl`ATCl_S=WxE;AxUQk*L1g=)m
z^KcVDz`ps~ABG-;RvblNaG_zX#s96ua{q_vmDl9<mx?We3-&ed&gFBfumAYgqg%z$
zNGWvflRbYQ`ZV;nVTt=%iHplzyvQY_nYq%8D9?z+nR%I;FM97tjyqd-8QCA*WjyUK
zvde&9;}L_;G3h%5G%{m?K6Q?a-Um)`b@w?l^hR2%Ngj~e2Q3=C@TMu8DNUSJtJNST
zq0Io%rnU1plRB^?E)7=o8A1MElQ=v4G#oRt%v6ik#9289*T^}iTD6+`V`y{Wnt*|{
zX??5DNPD%cm0-=Ts0rAJCENgCA<L^tk)1Ua@LD~CocowLV*wi9wY8UqtN3PId9-<c
zDXx%b*CfuXeFdk{9ARsk;Wbk4tLExgGxlK1#Mwf}g^Z>ruy7<;;9|LWim-8!EesxK
z2`^;R^E{gp+1vbdmhkN8h082R7M_6SA+T{a!{5P=hMqZrw}zkujfFiCm9-|>iU!4k
z7RF9z^O@u@TkSUqIu<G?AgBbzK@W2*`_?maNK_j5<blJ7_a7^mL(}kgS~0!y$fQ^j
zcanvcDgbtxs%okCfap_y1zE6#9Dv0WU{ef1iXkW^h#NCxcfb|saEfj2tz?Q2Buz4e
z8H*Wikt!ll15=!Y7xM%Vl;jm#ViuGo;(_`{27W__Q|y2zkh(Rz#>r=dJW=&Czk%OW
ztM>pjp#|m*Jg3F~aOZ=a%h!u7dlu~Frk15sOQ*`M+p%<V>ExQPzw8@aeXSHaC5KK)
zgRe-hq^0J$rxtUoXPq&-JsWnWxqD?-$vY%_hoHAKaJA^WCb_Pa9iEb-Lw0nO9Nn^`
zyX5GX9sM6$ABz%}&aAcUF1vRuA6nV5dgdoRA5WK#oR^QBFCMt?^Fz|)_0nWao{W_y
z)AD3m;^w5ejFi12W$sGX?n$l!=w}Z-4?LyjJ#zD&mAl2}eV^MbKIejc-NCqgrKVl*
zOQ&+Y=sO{~P8g=b$_{qL|HRQx>vqVF9VJJX?C4stJ#p*-xw(~3;`UKK`8R;CKb%iS
zbjb+tDoK-b+6hhijob{*R~>$<oh0Cky5!_coVm&+pZ{Ih0{rC#xuAi+SUBr33*|6K
z;x$Q|e|!+;U*(RLy4(--(wd~<p(^i_uyU}?jQreEmn%L88pv_`1VPvZODH`(`N&L8
zz>DHZ#B*@G_*gbC=JH}8a5|e$Cn={Od_1YKBX&BK0X-VTdPWSo)#Ht)kf4sGw44Q7
zZ6Yh4Mcy(-NY;3!sj`bFnViB5S%CryK$0g!v4Iwm%F$OCpNv9V&GBtA46L*p&aa{V
zIDYmc$hI6{ufODFWiMOu_RHS>k~b)OgKNH?m9wSZ!*cK8qVI_0Is%7p`TlD3C#N6V
zOGhurM=ul)U6eY<rEAgBwU~S@R=PGLUz?F;bH!_KuQSYP^Evb94C6a*rW`^)V5{~Y
zyC1nr1IOio<HdoI(f}`w@<rdY<eDyf{Y&pIzFYDJWN)D8?Ufw8>d}Iuq$mAo{RdRR
z(K2g<M8!HBH#Kp(P7b1qsdp&qDIFOLC>WL#W>uZYSPg1|m9s^$-mZ$=s5NZ;61Wa+
z4%H{B1sPk^7NM?-YCV>;`BPDg%%3LCQ9ZO^LN!i2>v%Pr6@d`qITqD^HYI?>qeemU
zS*yT{Y>0PGjz-RnO~#_!SY#yL3+KU^nr6G%RFVz!8rlNv$#9aN4`=e}G<)FWp8dyJ
zahA_GSysp=vlM(hnPfwAY)D|kw^Nz$?YJ;o1H(C;a?<WpI<cV~8wk&WeHS*4M6H;B
z+AlGiy_4AtWZ2j@@YMi7s<AKc+xMJ~uwG4!hvw-@@SCq(E_MpV&#CLL!PNo7*Z1$U
zBFXbcOlhCqndSNP=H&$dxm84K-vZuvz{TdS?C7OSBLk2H*@-JxM>+2GGsEx}VDGDQ
z5_uk0jcy9WIT+DH$xVnhZmEWDoY}rZhY(%Q`Ov9YKuIA-f$YdIX2>TBJrRB`EAni`
z(hO0OO8~D!_f$od2{tIs*W&3suktb$KSpY%nu_8eK(8@WTy%yOw5z778JL*|96u^K
zQ!7@ngYiGZi>RL9z~of`Bp??=lV7uDTj>n=n9=@KIt}cuPWu@I^d4mIF~9NdUi0me
zb{{MHh9%c<MU5%71m%_>C<10vySwaeUA(x?xVM?sEgqkB!M@SS_&S&KE6LSwNJA$d
z$3HQHHZpkTlWD2*vc$b!;%>>@tr9mQ!*9#%W?m-^TrT=1B-g~cg>mgxd6^Yvq9vV|
z{U`7(;AIw#7d)4j8M$EvQdQ`Jip|th8>&4r)~L0fKcb$Q%$YgMF;hf0rnHHJ;ae$Y
zY*V^o5J6E_lL8EIJ>49tHgdYDukpEvt^^o*>Bd{e4(obB!zj}Lyt;vMaeLHGpA83X
z8OIblglIyeENTI6?nIt`&=Pe}Ze9;QI-6<|*96?WG1~Z*hLdjAfXlZcnRpX$bN2+f
z0x+N1^5S&pDA)=PaLQ(rpgSnGxR6Mt$W>@Av^lRvUmYKNW2AS0Y82CKA6PMe2}&Vw
z1>ng1kwa`K8T@^Dyvlqg>2Xs<iIEGlz+D8Y*iaj12pG$r1HkX#O=S1~-b`Q2<`W<}
zzC<#F<9Ts5OHu_siQZr#pst0Al^Me4*wEW|&jO=V@$lsWVhbEypj8mp-zVJ2^cx@<
z*lH;L;`1{|5*-z)Tnj}uGxYy|(MGXCEj#web7bHaTsWOQ>=?D~Sk=vhmM@E#2U|9k
zP&qni6a4fvpAb{?eEJ^CXYd9g$=*r9{^UhAF&od!0DZFg4B^vYPOB;}s2w8I3Pb2b
zJ_B@Wki8&Ol59ohQ5v0MLn!{SXMnw_?-12c=-RZl(Bx*h$yP`q#rEHV6~OFkCV!6?
zdi!;NEDIoEuq3OBJ#eGqTw<!zc_?WZ8zswT3hBQ}2N>Oq9T=eBD2eL>4j<bWf(wHo
z9LPv0I0~N@P;0;hvojKSY7CZjL)cqy;2XkA{dHGiSS*61@C4YDP>Kx!JRyt_dro~h
z*rC1QdIPes((r})V^*ebSjiuTJUDOl@K=j57K|x6WaY7$L`2%8uKS)K@^c9>4f=38
z3&t3wyc*5xOM7l6wF+CP=oc!a3e>s)RX;rTs|*g)g89NPxdtq}R;xM*#E%{*HkAQK
zZW;~}YExmh?pEZ00mi{~Wl*@93EoMN)0k1;5lUR85lzsT2seG?BEH*I*`PGuK5~c(
z79PCMs%OZa<k3T9@F1bJLO9H-YMQg^qb8Hs6vYe&R4lptZE$!|Xi4%K*1wJ!RoBqE
zL2^`+dQa0-St`BlGg_vG`YHHM_%Fz|s%Q?^l6TR&?0DknuJJl~+De`-+0#|>1Z7X~
z<Ci5*Q1Tovc}8W=Xwh?e!LsJtUh)Ng;R~!B{NeEThgWBcJx7YZmrK5rvhU>MJ4N5Q
zg@)&-fTnG2<+hy<j;}LaU8Z$gH&q7DnEo%?;B3*Cl3Xc+HmKXHuy}O#P^XauhTBIB
zB1KJgt=BrPp{mWR>5*}OKVx)u>spuAgKC;pr%-(tx|y?v&76(1gWh9`n(DcNG<ejV
zqr-!~b#%gd`k<yyZgJ-{R5d4n=F@OeeMbD%vR0~E&#lb)S%%5rwLu*%R2!AH*KrGR
zjoRqi`jX&g2Uzv`I=A$NeY`wM``4ReQ#BAE4?S~-qSoi{d6eG7Uw)Heni#lb&=y<Y
zyYWKwQM3DQZ3VmuG-xKRYxYyR7F<u~1s$J>;8kKx(x9<;3GA6r+`#=}qtVIpG49Ig
z@j@eT%@Do$E%ber4_@tN4hfTwOynGlQ`k}Uz|nhS<iRR5#dN&j*)-Hh<^9~)#ANL1
zg)<|HY2-6JdWC-dD>eyU67>A%NOnGz<k6*9ooujKF=qv2eDf)i%_tTyRjHF+_1QZB
zmdZabU<tV}8HWr!ce!**RGf5*0%}tvfc17zp+KPqBblFpYeAks)PgXZ7n9&3QE$WH
z8nFk#yh_0&X7ic16bpzByfg=sTfqILd{$+%?pVcBPcfxzhuK#y^@ldKEW&4k1J?c?
zv)1HZ8eSY;I=OgqIb3SmD>v;eyL@Y2c4cSD8<M>t>JGnB^j(!)SJC_T&gvPdbN?s3
za?82RcJ3CR-VJH=M$vaua@{QZcRsxN;AY7`Ao~YaTmRV~S{N(0?RYr;VEn_&Q1rHy
zyj`-lOJetxy!&PE{*R-j!(;N{G3o4UrNgfm55HdC9r)hVx2INHSL4Oq`yMzyu#^M+
z-!eaRK5#A{{LuS(Bhx;#;bfY9ONGS(USTh14Hpa7ioS^Cij+G83)Ux&oof!ylJ`%&
z%huBNL3#V&FC8J(Do0|_lFo<CP)nWnT8rVS^8@Gu92U;6n(BEKBWUN>By_)PVL+6p
z>O8aBQR7b9Sn+O#=`@ao^0p=gm?_<dShe{%i#8TG$iZ)!*1wuzx|u1RM>jBWkU%Wc
z#Z0tKGb5HRX4(|AX(v}ZJ_<vSGn@@NC^3@^ypSwrImncTl#oo#0C8L2N~P0^1$^O3
z!xfG?iL_t^OD>fZ5NQ?94$0$}9Y(6%d>p<D?ZR!yXruzTh~XEh)ziH6=Hi=6nZ?X<
zZ1r~0vwy)-Zt^T0Up&4vvN*DCwz&Ok&Ax{Xf8Ow2%kt^(I938rn)}x6Ojj?B0{Nc}
z8`HM)DPwZ`|E0NY-2%^N0t%T=8`;tQ%%}UEqbDt&j+h|d6f1(eMP+pw{5dap!2|tk
zQ|%5@eynruYB&U3+~_p4Rm#_Jab3n!&-ZhDHy}fFTA9)>w5y|XmJm!><Kpxp=LOaf
zp8$!+)RVSVdaUQ`(Qv_85dq+P_iNaKvtk4NgI=yvFM6HJaLzG&onbKK<N8>=OP}Ka
zERJWj5$2{#Gi?NhNdTS<mt#%ZswocZ^pEVWeyf$Drm92-f0bQ3w>A4?kg`*{)Qqqi
zl<E^g2|b+mn90m!8mc=L)ioln8RLgCj;JHjQ~gRSLFkx|YsGK`Xz$Z%t52>?TO-f`
zUhdKq(I%}`z%%la;iXd4c8mJKkW6Zlfu8i649*WeGrS3_Nf4;EP2*2dJGXsE_xi!i
z3{+r%sndAa4EwpS1|Ymf4sNZh(jVO7G;%wRSu@V4vtDS0hJ+ez))_gp6>8+=t#ul9
zwrH~*8qRrBCwL$6M_V~)N%n4LP`?jK0<})V?sWk_#<mJK-dVVG35{Iv-mqH4S3fv!
zG6`}ohkhB=ycDxlg$SH{=(<UX0{a>U+_5=`Db39i@E{Hq8mI=8OrpnMy-m_DP-@~J
z;7W+#PLnyvAkHB@NkA2aSW(E%P85!)uz}n2GZm{9oJt5Iu0^CmR0YwmO3_qDk7wsR
z&M8KN-eNErG!!9XO`Boi&8upVl>Q;Qs<hP(vJlP5J|6<!l<{*p@g57K&!q$v8JSHO
zR1s5ff%_&D7v93*Ll`g%Hu!YvZoyfp8xm#<2YR~cm6$N=thkN>=v)NnWG}><#87Pn
zpKT29aIT(@jB;ZECqZ4E+<+|g3GAw313V-k*7eK<?&_t{HwxzAeGv56L^V!s9KWQ|
zda+UUB^DXG7QGM|BMSgQX|F#@&_ZvjsdB7XKu<07RW)Sl76I^eh$Fa54Ohc+NzP-2
zl15c)?_mkKu^M)A2}^Hd=D>{l3&ye34VlsiDlx<_f^Mofz#o&FhRbfnHwmRIiIaP0
zAbK$&W(kD<-XST71g8FqSMYOPe^9K6Z0??7&*vcY8LrW>5q;>SA2VIG4mKJ56L+vF
zi5X5$v8Pd;PC|^aPC+o8xg3onR_wEUItMrE?_>X0ArpXsf)1i5Rhe$7M!m!kbpUUd
zK{eUZ`a^{DTiDt6nBRJQOLL2J%jb)pK2Sxxs#bb`@jl+CpDy|aB-a3{*gHzzmt^lt
zRK>1b5|te;HTdO;W7nF;_pO5;2p=9@o|apCRal_bpt^oy@kF_!v(&Ly?%2C}wAgW|
z)G;h~3>Q02JiaD(oLU%P^LMWtTTM!VgP)v{{TCL_!o9kBzrQkC^!Ba3^t0VR-Cf*!
zw!Cduxyg$#<tDfngD9M@7kzQb6)*dDJp9^&ua*2k*&kdTkPb~2{m}*IZ@fF8SGoEA
zra&G~d&xcU3-`dso?p06eR6cozhime!&@t9*?#~=hR7P%ZrQb4>WoTXpOLUU3zbWk
z7B4OPpSZf#d~FZ+KG^#({2*NP^(>q&ySz&m7cZ`L1y+uH=bdu@P<dzP_g?<?%ebK8
z&V%K>hdyt#ZTD<2Hn(@f#k2=jj{SAw<DMVQN`aRjPyX!IPj8h*IC+GVCT|o+Zb}&<
z-F-*)-`8*eXjp51Y4z-nFF(3m8ayQro+=KGmIl+(Si0Cg2Qf<EnrZI-Vh7`S#k9VQ
zX>R*sHx{3`Ptmt$f*W@F@AjYGd%n-|^FHVKgAECzMub{1yqlh`0WExlS`a*IQ&kGR
zs76(z6&idrFoLcZR>!H10P<6}D{2CMbSNBz>A)Y@`}O=f_53$93WDC7aSdVAr$Fnf
zP4zUq>b&s&4MKzPCbG_*n=XC9j)op}v^|4d1^oat9BVzD&(I5G6j(madI6D|tcIIR
zU8jrMwtQ>Q2*I1-nxOt&kb)`r%NE?P#>K?!WpJ&IfCs(MaypyI0K1z^&GB%3GO~Xk
zy;@hS7(6gZ&H}c`yO0&o;sJR}JENZ$;uInFQ2n0{Z!Kefh@Vl`JA@?`GsKmFM^c_l
z86{=R)DeM~=#`sy8g{I@bSd9N7N~$vScDO`T(*00GI(o(D}l*vGS6z-{t*BPMaaNB
zdjSqeSzV{>=v==0#4$j_`g|Xp`EJj0;yVK?XI8_H4@skw(i=BRZzSb6lBGA^mfv_=
zx=th_NaDOC+>u_pyUsB0m`2U;aKCEa8r)aj+4XsYmB#lu_4q#cFMx-059Uhk!z=SY
zeE0kBLgBHw<R6v&qecJeg|ookR_&#M3F*K@(RW31U0Jtj_x2FC9f0MjNT)KX8(xE^
z31|pn18xZhFJKTRm6^r{@)y_zWzE)FG`zOfA~@JI>V2oX9YqMVgs>FrL^i{N0j`hz
zrCrJQ5R_S+0xjF?enqE9+nY%%4u&U_!0}=To<P!z*<Q@(&BJLdp~xj*cQIrdGpaA-
zu|!D~ZFU0wQilGk4Ry3o`AT+S9cJ6$Pk05gZ!#NZtF3p#WwK41HtZJLUDJlM)z-GL
zx53u8;q%+Bm^Ow6ZEu=3ZkU>FLmPV<p>unWt?i48CYSB1Nd=A|gFgIUq3Jx0){7Bj
z&qToN>zHLA18-dZHhB3GydaQ2!-^*TKdpFySg{5oeZ|>y>Ned;#e=tc{M`hf!*d`|
z<w!wY5h~UH#!{6gdNy&F)fJ*2p}K0taRLHz;6Ip7k{>_=N(SKyWZ-l#nSRX#e#f|f
zg};rzVp@L1cz?}w|C-tUZ_K`bWsZJsXUt6>^vb4fUzn{X-#P=?Qww9>zK*Y7ct$Oz
MtET^E=z|XUzqGR6-v9sr

diff --git a/scripts/src/aim/ssh/keys.py b/scripts/src/aim/ssh/keys.py
index b2ee521..51b3030 100644
--- a/scripts/src/aim/ssh/keys.py
+++ b/scripts/src/aim/ssh/keys.py
@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+from aim.locking import customer_locked
+
 import atexit
 import base64
 import os
@@ -26,6 +28,7 @@ class SSHManager:
         self.config = config
         self.vault = vault
         self._agent_started = False
+        self._owned_agent_pid = None
 
     def key_path(self, customer: str) -> Path:
         return self.customers.require(customer) / f"group_vars/linux/.ssh/{self.config.service_user}"
@@ -35,25 +38,50 @@ class SSHManager:
         public = Path(str(private) + ".pub")
         return SSHKeyStatus(private, public, private.exists() and public.exists(), private.exists() != public.exists())
 
+    @customer_locked
     def ensure_key(self, customer: str) -> bool:
+        from aim.permissions import configured_key_identity
+        owner_uid, owner_gid = configured_key_identity(self.config)
         status = self.status(customer)
+        if status.private_key.is_symlink() or status.public_key.is_symlink():
+            raise ExternalCommandFailed("Refusing a symlink in the canonical keypair")
         if status.complete:
+            if self.config.private_key_owner and status.private_key.stat().st_uid != owner_uid:
+                raise ExternalCommandFailed("Existing private key has another owner; review migration explicitly. AIM will not re-own it automatically.")
             return False
         if status.partial:
-            raise ExternalCommandFailed(
-                f"Incomplete SSH keypair at {status.private_key}; resolve it before AIM generates a new key."
-            )
+            raise ExternalCommandFailed("Incomplete SSH keypair; resolve it before generating a replacement.")
         if not command_available("ssh-keygen"):
             raise ExternalCommandFailed("Required command not found: ssh-keygen")
-        status.private_key.parent.mkdir(parents=True, exist_ok=True)
-        result = run_external(
-            ["ssh-keygen", "-t", "ed25519", "-f", str(status.private_key), "-C", f"{self.config.service_user}@{customer}"],
-            cwd=self.customers.require(customer),
-        )
-        if result.returncode:
-            raise ExternalCommandFailed("ssh-keygen failed")
-        status.private_key.chmod(0o600)
-        status.public_key.chmod(0o644)
+        parent = status.private_key.parent
+        if not parent.exists():
+            parent.mkdir(parents=True)
+            if self.config.private_key_owner:
+                os.chown(parent, owner_uid, owner_gid)
+                parent.chmod(0o700)
+        created = []
+        with tempfile.TemporaryDirectory(prefix=".aim-key-", dir=parent) as staging:
+            private = Path(staging) / status.private_key.name
+            public = Path(str(private) + '.pub')
+            result = run_external(
+                ["ssh-keygen", "-t", "ed25519", "-f", str(private), "-C", f"{self.config.service_user}@{customer}"],
+                cwd=self.customers.require(customer),
+            )
+            if result.returncode or not private.is_file() or not public.is_file():
+                raise ExternalCommandFailed("ssh-keygen failed; no canonical key was published")
+            for key, mode in ((private, 0o600), (public, 0o644)):
+                if self.config.private_key_owner:
+                    os.chown(key, owner_uid, owner_gid)
+                key.chmod(mode)
+            try:
+                # Exclusive publication: never replace an independently created key.
+                for source, destination in ((private, status.private_key), (public, status.public_key)):
+                    os.link(source, destination)
+                    created.append(destination)
+            except BaseException:
+                for destination in created:
+                    destination.unlink(missing_ok=True)
+                raise
         return True
 
     def fingerprint(self, customer: str) -> str:
@@ -136,7 +164,13 @@ fi
 
     def _ensure_agent(self) -> None:
         if os.environ.get("SSH_AUTH_SOCK"):
-            return
+            try:
+                probe = subprocess.run(["ssh-add", "-l"], stdin=subprocess.DEVNULL,
+                                       stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=5)
+                if probe.returncode in (0, 1):
+                    return
+            except (OSError, subprocess.TimeoutExpired):
+                pass
         if not command_available("ssh-agent"):
             raise ExternalCommandFailed("Required command not found: ssh-agent")
         result = run_external(["ssh-agent", "-s"], capture_output=True)
@@ -150,13 +184,14 @@ fi
         if not os.environ.get("SSH_AUTH_SOCK"):
             raise ExternalCommandFailed("ssh-agent did not provide SSH_AUTH_SOCK")
         self._agent_started = True
+        self._owned_agent_pid = os.environ.get("SSH_AGENT_PID", "")
         atexit.register(self._shutdown_agent)
 
 
     def _shutdown_agent(self) -> None:
         if not self._agent_started:
             return
-        pid = os.environ.get("SSH_AGENT_PID", "")
+        pid = self._owned_agent_pid or ""
         if pid.isdigit():
             try:
                 os.kill(int(pid), 15)
@@ -178,28 +213,32 @@ fi
             listed = run_external(["ssh-add", "-l"], capture_output=True)
             if listed.returncode == 0 and fingerprint in listed.stdout:
                 return False
-        if self.vault is None:
-            raise ExternalCommandFailed("Vault integration is not available for SSH key loading")
-        passphrase = self.vault.get_value(customer, "vault_linux_ssh_key_passphrase")
-        if not passphrase:
-            raise ExternalCommandFailed(
-                "Private SSH key is encrypted, but vault_linux_ssh_key_passphrase is empty or missing in the customer Vault"
-            )
-        with tempfile.TemporaryDirectory(prefix="aim-askpass-") as tmp_name:
-            helper = Path(tmp_name) / "askpass.sh"
-            helper.write_text('#!/bin/sh\nprintf "%s\\n" "$AIM_SSH_KEY_PASSPHRASE"\n', encoding="utf-8")
-            helper.chmod(0o700)
-            env = os.environ.copy()
-            env.update({
-                "SSH_ASKPASS": str(helper),
-                "SSH_ASKPASS_REQUIRE": "force",
-                "DISPLAY": env.get("DISPLAY", ":0"),
-                "AIM_SSH_KEY_PASSPHRASE": passphrase,
-            })
-            result = run_external(["ssh-add", str(key)], cwd=self.customers.require(customer), capture_output=True, env=env)
-            if result.returncode:
-                raise ExternalCommandFailed(result.stderr.strip() or "Could not load SSH key into ssh-agent")
-        return True
+        from aim.runtime.agent import key_is_encrypted
+        from aim.runtime.secrets import SecretBroker
+        from aim.runtime.process import run_process
+        from aim.services.v1.models import ServiceError
+        try:
+            encrypted = key_is_encrypted(key)
+            passphrase = None
+            if encrypted:
+                if self.vault is None:
+                    raise ExternalCommandFailed("Vault integration is not available for SSH key loading")
+                passphrase = self.vault.get_value(customer, "vault_linux_ssh_key_passphrase")
+                if not passphrase:
+                    raise ExternalCommandFailed("Encrypted key requires vault_linux_ssh_key_passphrase in the customer Vault")
+            with tempfile.TemporaryDirectory(prefix="aim-askpass-") as directory:
+                values = {'ssh_key_passphrase': passphrase} if encrypted else {}
+                with SecretBroker(Path(directory), values, lifetime=30) as broker:
+                    env = os.environ.copy()
+                    env.update(SSH_ASKPASS=str(broker.helper('ssh_key_passphrase')) if encrypted else '/bin/false',
+                               SSH_ASKPASS_REQUIRE='force', DISPLAY=env.get('DISPLAY') or ':0')
+                    rc, _ = run_process(["ssh-add", str(key)], cwd=self.customers.require(customer),
+                                        env=env, timeout=15, stage='key_loading')
+                    if rc:
+                        raise ExternalCommandFailed("Could not load SSH key; verify format, access and passphrase")
+            return True
+        except ServiceError as exc:
+            raise ExternalCommandFailed(exc.message) from None
 
     def test_connection(self, customer: str, ip: str) -> None:
         key = self.key_path(customer)
diff --git a/scripts/src/aim/structure.py b/scripts/src/aim/structure.py
index caeb068..de04cfc 100644
--- a/scripts/src/aim/structure.py
+++ b/scripts/src/aim/structure.py
@@ -74,7 +74,13 @@ def compare_plain_yaml(path: Path, expected_header: str, expected: dict[str, obj
     return diff
 
 
-def consolidate_plain_yaml(path: Path, expected_header: str, expected: dict[str, object], group: str) -> bool:
+def consolidate_plain_yaml(
+    path: Path,
+    expected_header: str,
+    expected: dict[str, object],
+    group: str,
+    permission_warnings: list[str] | None = None,
+) -> bool:
     yaml = YAML()
     yaml.preserve_quotes = True
     data = {}
@@ -102,28 +108,108 @@ def consolidate_plain_yaml(path: Path, expected_header: str, expected: dict[str,
     yaml.dump(data, out)
     path.parent.mkdir(parents=True, exist_ok=True)
     path.write_text(out.getvalue(), encoding="utf-8")
-    apply_managed_permissions(path, group)
+    warnings = apply_managed_permissions(path, group, best_effort=True)
+    if permission_warnings is not None:
+        permission_warnings.extend(warnings)
     return True
 
 
+
+_WINDOWS_SHARED_LOCAL_HEADER = "# AIM-managed shared Windows local service account override for this host."
+_WINDOWS_HOST_LOCAL_HEADER = "# AIM-managed host-specific Windows local service account credentials."
+
+
+def _windows_host_vars_expected_header(data: dict[str, object]) -> str | None:
+    password = data.get("ansible_password")
+    if password == "{{ vault_windows_local_ansible_password }}":
+        return _WINDOWS_SHARED_LOCAL_HEADER
+    if isinstance(password, str) and password.startswith("{{ vault_ansible_password_") and password.endswith(" }}"):
+        return _WINDOWS_HOST_LOCAL_HEADER
+    return None
+
+
+def _windows_host_vars_header_diff(path: Path) -> FileDiff | None:
+    if not path.exists():
+        return None
+    diff = FileDiff(path)
+    text = path.read_text(encoding="utf-8")
+    try:
+        data = YAML(typ="safe").load(text) or {}
+        if not isinstance(data, dict):
+            raise ValueError("YAML root is not a mapping")
+    except Exception as exc:
+        diff.syntax_error = str(exc)
+        return diff
+    header = _windows_host_vars_expected_header(data)
+    if header and (not text.splitlines() or text.splitlines()[0].strip() != header):
+        diff.lines.append(DiffLine("+", header, 1, "comment"))
+        return diff
+    return None
+
+
+def _consolidate_windows_host_vars_header(
+    path: Path, group: str, permission_warnings: list[str]
+) -> bool:
+    text = path.read_text(encoding="utf-8")
+    yaml = YAML(typ="safe")
+    try:
+        data = yaml.load(text) or {}
+    except Exception as exc:
+        raise ValidationFailed(f"Invalid YAML in {path}: {exc}") from exc
+    if not isinstance(data, dict):
+        raise ValidationFailed(f"YAML root must be a mapping: {path}")
+    header = _windows_host_vars_expected_header(data)
+    if not header:
+        return False
+    lines = text.splitlines()
+    known = {_WINDOWS_SHARED_LOCAL_HEADER, _WINDOWS_HOST_LOCAL_HEADER}
+    lines = [line for line in lines if line.strip() not in known]
+    body = "\n".join(lines)
+    if text.endswith("\n") and body:
+        body += "\n"
+    content = header + "\n" + body.lstrip("\n")
+    if content == text:
+        return False
+    path.write_text(content, encoding="utf-8")
+    warnings = apply_managed_permissions(path, group, best_effort=True)
+    permission_warnings.extend(warnings)
+    return True
+
 def customer_template_diffs(customer_root: Path, service_user: str) -> list[FileDiff]:
     templates = group_var_templates(str(customer_root), service_user)
-    return [compare_plain_yaml(customer_root / rel, header, dict(data)) for rel, (header, data) in templates.items()]
+    diffs = [compare_plain_yaml(customer_root / rel, header, dict(data)) for rel, (header, data) in templates.items()]
+    host_vars_root = customer_root / "host_vars"
+    if host_vars_root.exists():
+        for path in sorted(host_vars_root.glob("*/main.yml")):
+            diff = _windows_host_vars_header_diff(path)
+            if diff and diff.has_deviations:
+                diffs.append(diff)
+    return diffs
 
 
-def consolidate_customer_templates(customer_root: Path, service_user: str, group: str) -> tuple[list[Path], list[str]]:
+def consolidate_customer_templates(
+    customer_root: Path, service_user: str, group: str
+) -> tuple[list[Path], list[str], list[str]]:
     changed: list[Path] = []
     skipped: list[str] = []
+    permission_warnings: list[str] = []
     for rel, (header, data) in group_var_templates(str(customer_root), service_user).items():
         path = customer_root / rel
-        if not path.parent.exists():
-            continue
         try:
-            if consolidate_plain_yaml(path, header, dict(data), group):
+            if consolidate_plain_yaml(path, header, dict(data), group, permission_warnings):
                 changed.append(path)
         except ValidationFailed as exc:
             skipped.append(str(exc))
-    return changed, skipped
+
+    host_vars_root = customer_root / "host_vars"
+    if host_vars_root.exists():
+        for path in sorted(host_vars_root.glob("*/main.yml")):
+            try:
+                if _consolidate_windows_host_vars_header(path, group, permission_warnings):
+                    changed.append(path)
+            except ValidationFailed as exc:
+                skipped.append(str(exc))
+    return changed, skipped, permission_warnings
 
 
 def vault_structure_from_text(text: str) -> tuple[dict[str, bool], list[str], set[str]]:
diff --git a/scripts/src/aim/templates.py b/scripts/src/aim/templates.py
index 2b8a070..cefb1d2 100644
--- a/scripts/src/aim/templates.py
+++ b/scripts/src/aim/templates.py
@@ -47,6 +47,7 @@ VAULT_TEMPLATE_SECTIONS = (
     ('# Example: vault_ansible_password_server01_example_lan: ""', None),
     ("# Linux - legacy SSH password", "ansible_vault_linux_ssh_pass"),
     ("# Linux - private-key passphrase", "vault_linux_ssh_key_passphrase"),
+    ("# Checkmk - UniFi monitoring account password (optional)", "vault_checkmk_unifi_password"),
 )
 
 VAULT_TEMPLATE_KEYS = tuple(key for _, key in VAULT_TEMPLATE_SECTIONS if key)
diff --git a/scripts/src/aim/ui/__pycache__/__init__.cpython-313.pyc b/scripts/src/aim/ui/__pycache__/__init__.cpython-313.pyc
deleted file mode 100644
index 96d41a032495269e08f2653b633b539fd1fec89b..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 140
zcmey&%ge<81kYx!%mUGmK?DpiLK&Y~fQ+dO=?t2Tek&P@n1H;`AgNp0`l%(!`iXhP
znMpaR`o+mbnFS@q`o%>+vCLfk(oFsM_{_Y_lK6PNg34PQHo5sJr8%i~MXW%*AhU}>
OjE~HWjEqIhKo$U9njl*M

diff --git a/scripts/src/aim/ui/__pycache__/access.cpython-313.pyc b/scripts/src/aim/ui/__pycache__/access.cpython-313.pyc
deleted file mode 100644
index c4a99e4a945427a71f08cba45b6897a2ca2d0a29..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 26873
zcmd6Qd2kz7dS~M#K!5~zUpiVhA(NmiQ3rKUw?tABC9w&KG9|$v0FsbEfbIq)5te6W
zCr42`lUS;WBe`a>qioIY$d%b0Wh%R?somPh$tKpMwlWPvHke+IGqqcrt*Ol)vgO1X
zr?zT;-|KFm2{!GSWUDqka`T~&*YEtk-}n2z_vU#`O*Mz(f4%wEmCyjk{SW$~A9gii
zd43a#H#mV4Il&@WPgsVmqLrt#?SyT}F4|eze!?L-aLsYTIaDQ9v1`r~t|7PRX6dRE
z)k7Z9GvpP$?6>Pg%}}ja%hK)>z9GNp=ebsHEhkjBbAo5PRsFhHH)RiabMKv=jf;^?
zTI8>%#jBIa^mU1!#4kY@=;F^OQX{AMNGit1(le1nil0p<6VW+dOed4+Y$jM;eOQdg
z;;Bp`l9YHc&Yr<zndvwmzmbqKiPRK76G=s;;-VDfLxXtcS|W~5NYm--e1g52NyMct
zJ{7+f7prF@l7w=^aDl#>N{cg*Bp*$uQt@aekw(sODI@V&Db5e3uHnOJajxfFB%93e
z(Q-+G)jy*;1}usvl1imB5qed^Py3ljW_p+s7Y?2}iN9|8dsGzDV!*1n4i27TX{BCm
z6ufmfl8VNY$#@J8yH3SZ*}+VF25INv>2x9*kE(5{p0$RxJpY&Y{RVfD6D{akt6&jr
zLW5v!=dPejk+QLrLueH2EaeoM1P4o13C)6&rCdT)J14pY7tYmq$IY&KkU}RSA1_iK
zma0L@%Tl#S)v%NgsalruBjsbMI-y1IvsArMCpJvg2U?YygVAVQk_5C}JSF|C4&{#8
z3{`R=jo+5%8!c3$Ra}T0L8|iDu3g~izVUtSI<7h@-{H8BMX>0Dal4i)%b{xNv*T|4
znqU=df_=O86~lFh;1sI#>pfOI$CNE(6I{E;I4**3Oi>9vdS2zfc*e?}@uFPZ2+ozq
zX%DW~R$k?}v3mWRJa_622Az9YajMO#SYFI|P9{>>8+;GVr`(Gt;&a+`n8DcXqH!$p
zvtoQUf+<MDn+AP^^@%#t70cF~53?{v)3QgMkGa(+)6qz>OP`bU&hay+%kx*UYzep&
zM>H9ah>CMM9*M<8rFud{A}VHQCKNlqo)xJ{6+3cDDz!-}WmuA?!*oljzMe>lGb|mj
zD|RWKoK#%VtdvR5AgkJhKJ~)0m`{o`%I1PZVvWb41bX6`Xip?1B_@*b9w{m&W;0Tc
zB;s0PrYD=|QL7l7ox=oWwN*dcrnZ|l9D{~i^~hTKHJrY}E!5U8c>S*r-5UD(NlKi!
zb>g1=+rBq_4_psB3$1&ediO3gwcWjN=fVg6)_V>2X5{Xd3;qcEA+PF@UmPj;g=Y>M
zU;CW1HT&j|J#%sX=6eladu_qrOc@T|8hmi>q4ax~ZpVtvfp?n&kL~aH-uB67FFf^L
z`KW>OH9SW_7Ecr!Fl?fH$R-Mg3O!PB;HoAfj5lyq(+3q-oyOm48qd;{tT=F$>6*ot
z1xwJGvau;!v-l4ES~O*SOYb93k_HtArmR(;vVu)du}Rxd@hE<dH|f^|yMXDbPZY!T
zD#0bVO|Dl99>HsJy+)`Nd?wfZLY+{Wh=%+dAY_~L=X;zbp<oZ$h2}*<p+zri`R`aS
zNv%Z_`~fC-%W%Lc`f*337E&zR6icsS*{)c2<XY7M%=gnwT{LG0hDT4H!VDf59X%uP
zySMl4+7Z;$>kQ@<A4$^moZ~0rnmmZdc*ui^bUGtt#K<h4iHKA2j1**F{;X*fdJrOF
zW;QKG#5ql7<klY5m2M<9lSn}UtE%0g8(E=0TX}{Foj9K)QNlwEU4u5GY|`0OCijAn
zfmDek)2TQ=orcEU!~S$jv+-zRG7&W@TX7v);j>kGh8j?)%yH9cWOd{)53r%htv#q{
z;#wjZpF&j+9^s?YkrZIUdgPW{eKZw;=+H$W8e%3sGl5qrTR@3i;8Y})MZqT_y(S{j
zt9#0DLo0xWE#|}xlwsSE_-ryghYp~6Cq%93AvSYeTFGN5-X4<365)->#8ei5qOxVg
zja1n-*7^rk`KD#13ai|<!{v8NVv>J>XBcG<01eN22JJpYa7s+i%w|NAZUL`S2dPVg
zCS2-QrAEKR`bnwPf2x%%-<}d9sf^;&Z)^BW@#+@{Hi<Mv#YQ^O#1xz9L`p!Uu^(`V
z?Ue4I(+ZrFstAKzlDHDTB$^5&+<9>oJ<&!_Xv1BX*Z7#GH0TkDq~uq)pVl=M>o(=<
zHa&<Hg9q}#1CKMs<1gipzqCL%*5&KgJy>7d+@Igv|9G@`^j!YvxsM#ShU)n$h-F{H
za*|%&da}@Z>KVtKvAkscgyU+)twy0Qui7r}9547UYEplnygym+&uG8;<pYU=|BCi&
zzkJYeuTS1%xQAb}1^+A0YN|+ER55MgU!pB;Pu)r1zwy+2;G+%{SzLp9M~x!AjG}Po
zjb$*@SiN8&6e8IA9P7D&efTYlQl)j@=v!9Bkx68dam6RbU&$uKcsLS^iGXf^qP0-Z
zK*wQCLIms;9Vzal-k<`Nx=-<kOCv*-E6OTWbm@Ird4DVALEQ=k>}x3c*5-X{@9%na
zQ9gT4o=(cXwX$zUcFm}jH)=T=H%v25e~xA}1&x-Hw6;PUQ9cz18q7Lkq9ylPI<+Tb
z80gSWRx_<>cnal(wZ!TA%nTsv`f|iXmqI6^Zgiw<<0XhVLMo!-fDHyXs(+_cN&wRF
zlKup^)pCnl#<q;me62V}Xy#TNwVdDx*=o6Mwq7fSk8}958pzZm!-6Jl6-zM3k4L(5
zTe|x$b?)D-C4=3UHtSad`*V91y~8uj1dSA78KojKaoA~TC@Vg6W|)VOc;xh{gM-5t
z3C0E$%K^wRw~i7er6!q<#KN)oB$;QDQmc*JSom5bnT;zobTcJ|by24N4NKX{$;1uC
z0Yel}(<wr3C1w??7+2hr*<^Ail8H_$)#oS+)mC$=(pvFqDkn^(F-`)-RVss1{m7EZ
zpnY4{8A~QZ#eEtK(wjJ8GBmW@?Z4AsZ0N~1^gMJG8v5p4OtP)d*R8)FemGs+aWcQ-
zWN}AIJ~LK4Gnqd#N$D%8LS4F8m(AB@3w76vbzjQYeF@U+fc3ByVzd5;b>8`bukQ7m
z|NN%BV*lgjqHiGY8~C7pg}idSP=8VOUR>}sefxzsUnsV3&9`rr+qOM?@!`3L19Hng
z*|$%2?NjF==3VJ1%|j8RiwU99t#aZE<{`$e8CKQDaRfNh{0WRs%Qow2yI>7jF-EN^
zJ7%<rnTOe7*Jnq{A=pEXJt%FYhojN0rUT1;qf`o@vSmwwTxgD*cG6$uPo=S?94L*e
z+zNWiOb!Tmv)9^Fl1)5`b2FL1kZqqe<s3W5W@PnnuJ+<VBPz?)F8X;Ow{5h9=hOkG
zVuccl>s&hP0^)v@R<T_Cto~35D(b`dGrpYRVmzqRETd2|F8xQKN<4tf#DkP$9cE`L
zo|#Cb^%*K2qU+XdLaB<yGm%76Qfv|FD&8vNhEw$ZNqWw!%{ew36&KA(k{@CSHzn$M
z(nUBJnow4TOF&nX2VnzbRbHsjO`rGhUi!fMIGNAQXHIU&GGZwXM)B`nXR*CE-`*>?
zZGRZfw;YwP&S4V1YB^}dpPc0o{kdW}Y@PRFnim^3<{LK3n=Z-WtA&Onrn#r~_H@Cs
z>VEHo8-;Z{7mf`VkG+h4##~1pxgO^7Er;a9EAq4`i;|ql$<nLx<jwhk1()~rs#{gB
z`)>K<_TWR8+}0<z?tbdpLo#L8on7*Z{wIyMcgYRI_?E9l_N|d!Yt)IYDG1b(<46HA
z1^Wj`EQc<jDou?~v*}C|l;IF-$`UH8Qc_Z-DZ5BX`OP>X7<`0fth=vc0xy2IWQN6&
zKa^F~aIWTzM*K1Eaa0^dU2@%{pb<5x-mRG?ygpj_D5LhsV8X1)%t5^|=q=7H`$}$;
zpxQZ0GLxVsnPy|^B?#?t0R<3;=yZZkgE$4O>PTlpm>`ZmdYdp)u7|aPf)Y_FOl4ig
zs5N_N0NF_6IH{u*y?$@z!IAHuc<V&5>qx%qi2TA)dBrjLY>39exp~)zz80nhP8RA<
z$=*{7o`$<O?%a_1Lr+F;-;i5I3Z4;m|5%~^xa>WSVKeVr3P_19U_<6xsKy&y50|o!
zmxfdbgrzQn8@Pce$7S)<?73wIkO?jeSs+`jOv2jALnc&0NlfxO%_J^{UKKF~eO8{x
zM%!90R2nRhw01Lz95T&GsOl|!55!!Y<2)Rb)zonn#|RlS6^Gy!s(Y+uZNziqWEru8
zh}V$4p~Ru+crE4n#oNfxE+xDda&@C;&^q3b3+I|`_K>Tj)lhDs_OwOtfrIh)*;rl3
zFsnFpoXUghT*Hl*h|DT3f*g1*&Xp1BxL<#HoGegwjF<3cuO08~2Bxk0rP|$PY<IMW
z39k~W(p!w@Rs(mZst#5ix155RqNXP;liWVrYHrdJs2lzn4a}UCA6G0rIol<$i}pln
zG7ZJ$NWx{1RNO)q6e7G3F~xZdY6*Ys1K=za=SW-v@{E>7HZsDf=e7}{y#<MNXb%#Y
z80BauHp=TU`nlbhmDjj892hr1^E7UzEIVx|ja8h+Yr}7G0h?kCZc!{@#Ua7F5SJ+5
zk~VYior<U8H)h3tC0HQ?AjM#`g(nEb2KO?fUg{5)p1+K2Bx<prK_JMD`+so#tz8dZ
zydAnX{eIKNA6)-A1Fm0fY_{aQyrfrq51(^^2%(w>VKPR<6ud4<6}t}u(JD?NLuLd9
ze2N?NF4Qo}ES|?@0BqJsiY*yWDfY=%VkyNLnVpTNVxo&)BZ;q6ofa6@W@1nzg`-rH
z11B6O&k0OZB5M?zl$}u=vk~a}fLj%n=u*6`8K#Om&0J03xs@vQvy$Qf<q^N3*okFQ
zZ1EdW#i>?BB4z?jsvas#s0ka}PwDua#yx|#r48tM2-f<>`Kk{(*55z>Ao704mRl$0
zj}onL{MPZ;hi?tvi{Cqc|Iq#H{iz3Mzb8H1`Fl4Xq#hjx<?DXi{peM><Af|+m><r2
zUwUSB)%5*^zwO@o-|{`H<?34R*50YTZ~w0Qcij*6$g6k0@89)N6Sv~UXU&|uhAH-%
zTQ#?@-Mb+-cRtwk)V1}4y2gCt{@=e|Xxv|@+duEr^?&WH+HbA9H}%b~``7aA-Ev#-
zLGsa#N1cy5<(3m4Zr<|dg@=j9*=IJ+-SQD<aSvO53fxeAtNJ&*fA>iX*SPUHXQ^pk
z@Hc(XxZ+z=-^u+!pWLwTIcKfeu;6bo6mgfly7#Gn`+~pmuJ4ZTzOCqAU+}O0`)3Y3
z`I*#;=6buvb-3I5$KC6XdK~|yE_l@G_!FlCX>*UzDBAWiciC~-`35&?>J=hJL#JNZ
z<mwICba58L+f(!&O`M9OY);QO@q~$jArFw?=(El^aNmRg7@@IKagcXNaG5C(@~wqz
zOT~GwRj3|y;_T@une053*$nP`1yIv{R=s`^U}8LJLaal8+d?onLe5?r^T)aLHX@Nd
z#X;odI@N(~ppp9l<;@7+UCSYSvK6|F_BomBD%s2IV^Ki+s5nd9grrh6su4k!>O~Th
z^d*y+yO1zQOz4huotc+Ilbp~fOmcE0Ip4B?&JwR9hqtWa41LZrEm6)ooj6O^wl1E}
zC5B43icAD%0`EypI5B~FEd1{I%kqfu&b2?ihSblW+i~Zst?e*!231${9NfI_QIMq)
zi1SRYekm)Tt5aKgIu0K*<G%MFBPvd_XL8Nu7C*0g$C*f9)Mhj!8%WELy6CrIf>_O3
z%53mMV^X0j4qP=E=A*Vz%XaPQ^_=)MyaaEZ1MMcxC_bWm!{A0V&pB&-#j82x!c;TB
z+~34I%qCOiH6c-z9Qn#uzM{%p*WP4gW+E2pS6=+ZyGMKFDrL6=r@#9O_vFZrhki6v
zJUN*^IVn#~7pG?OQ!{dUwwQh`pMLEbaUTO@Zw*;Th|oO+PZI;K0hb66!ZGVpMdiBQ
zqCf)0ekGlNI$<1;I3xZV9$jRS5|b@{2`9jX$V5D;R+iP1RNKp>UJe{kIqetdvDIHt
z%P1a_$kh4_nx$=Ju`QT~#J(X9N`<z}t=jpj4}I_=)*B4Qi9$mZ7MzJurx}1y0CG$4
zVc^l|A71$3h5WH_{`}>_v2bBuSbp(kIf_=gE>GM*+q`PIOilD+m|DpFvUS1ZdwuV%
zy>jad4@2{N-}mf+UMqT6<-Mz*j~=!BEyo>3GyV<e@lh)jh<EQ&T8JbiWU%EqkLd_`
zZn^BdTy@!X*}a@p9|h_950&d>m*KLKojD32*{dKuOV%dJs2w`IopIql0hEfvRK9Ce
z%(AkZIUDg!_cD2!Npa?gG;@)XOkYNu)G=*RkFS*AcDeXwL@#s?9GIi-l2$<<2~98p
znsKM4$0@W5ZDa}{M>Cz&PEORaPEvJl$Qh~%fei?`LhfFt(1C~$SBms#OSvq1N?0+r
z-Kd=cE6sJ2?)y{qOGI-bwv;91BK8SUCq^2~powxXmHd|^pA23`J`J~@2x3d(BO-H=
zlDQ54TsD;ipyub&S$F_v5u5}s3F4FB?TbX?6o)heh5%f0P>i8gBJ4me*Du5~APLB6
zf*hEP=QC**v?NU<`&hSHk#iMsMf^-U7EkU!CVqpmqD~R#>2wRHMe?6C+do=oGI=h3
zoj&jzI4xC|6}E-0E?L=4R3&NO=QQw`s$8@C2b&(8{qDwpz3~T|elFgouaJt$)tqDw
zVXY6LEgi?jbapn^s9s;xb5gE$fV$~gL`;wcAmui)mNm9vnZ`q>Ovc4H!l|TO`v@_J
zsj}0yd@o?l)v67zXREBgMjcV|NU;irbw#GrExBJQjh*EvBMGrL%)<`jBc2KJM_5c-
z_jL>_eu`>Yt_d4u<mynp(y<^fAk>TvC}aZTjRM>BPxGh=D{>GZN2FFPxz{lO0V7z6
zb?3UYf6-VWA;+-7pCQptVA@U{QF;8Mv4UmPI_lW2foX^gXGy3afp5AhzsQ*eN{!mg
z5lUGlXfW0~437*O31L=!#7z7)KA|+1$y=Q<BS6aFiFglBhzIDgHRz#IkJA)25W-<L
z525D2N>92=87lRqWQm1S{n^A&D}McZdcP^2>}(8{FdR~%q>|ErJtgE*HLJ!*C|%}|
zfK{tJ(X^)tYe+<a1M_I!>!P<i@9lmN`+nlB#G}Sy-%!49=*ggbJ|SOy^{MyfhrV{Q
z%3w_v{Ri^?1CLvu^!~W-M}6|S*n9ps^tQi)>Fr$GN#oo!#*GEMl^`jM5-<y2%u?!i
z==4oGeTz<IVv_-;Y6FE|0!-q+peG;F>3ekgH+1^9boxF{5^;zxYw$@2P+hoIX_YS$
zO9cI;O|bp`&m!>jXw?$<)Yw{V+>~$JBzGQsyuZ*W%)1v>uKD)Zn`83E0a-YIZ%ke}
zCcD}fI#w4uw&y#x7dm#zu2zFdEw@O3N;g5`&)0qgv~<|I(A<7Ec_%5ai^?<N?WEi+
z&3hKTuw$X78KGqEH{JO)yMKREVa@JB>u%Y*NA4eyM=#0yE-%!qxEK5O)i<veSMA8J
z+97*)%6%^_)U5pTJ^9tg<%>6D@7#j-*fY1IuliXv*LcDD%)_j9hx;Y#GcV_FeEsGv
zIP~^B4$a?u-**Bq@l&hKJ!$!vqcZ{?+%-j4d*0P9ckFmn^`2{RDPE&yXL#+;0Q}z|
z=M!49^3YKdBMD6`Y`moj0^^$?7E8o$nV`e7CO8aNO>Asf{46@N4=7HjkSYFB7d09J
zF%>MKl1q(o1xN7(6HGJKsOQU`n!-~i=uEFaBV_%?I;!ar2;9n}{C&aM?E&rS4!K8~
zDxWF`&gpfEz#PGoX6OmHv(IAXQq|)nf>|%wNQq1?e<4(@w|dGWfC?2#0SP>J-ZQZd
z{+ANr8}f{=(%;luL@!Ycq~-V;{jPv|kVi+)8$K6qWUYR;{C8wSIjyGzAY-^vH|oF3
ze}O-}Av?}B;4!R1EjdL6pWp|kv;vnR7*C_91Lb%06k%GSX$danMmFnDl>d%&m(zO6
zyhOMf)SoE-9h({(*sht*%*|_7^B2p{>nX%xw+OA88-g<n<ro3Lt31Y<^uAy-?-%`6
z2XjhWg%!d|`r<PEV^+#ldMWYFp32gc$117hHCz{08X=GwllanVj>rFwTZXr&bUPdd
zy?QR=WVf?poYxZEIB`JiV9o&^v&8#Ll(tQ1SKBmBM8Ef-*Ff~I9?k_+HM@xQ(k%<!
zAFi4fB9#)pYmv&6TPH9mZ*-PZC^do&JN5X*K(2!UJf`V;G?mmts}+KCGs&DIo0;t1
zg-|LN;AuJrY?s?|UJKx?1cv397+N|2FgQDl=XdiWjr7mz3;<azgt!maRc!4Sv@lEE
zK@Y4;Q95dDqcokE%{3ni4W1lDNR1(%G~ylorPU6+idk}B8l6r^fUSu8lZ=s+K<;D^
z!Jg6D4Ae-5;sMzTjDrTut;3)SR6LmBkuhOk_zB`Lrqtqf6M8}frka0H{4O>9`ooA?
z&BV)Ll^H73;?C0SrQ85&ikB(A)CgS=Y&kQVjKdPc`VfL+gsf@(NI814WE^0T$c>EA
zlA9wBG4d@r7Rp|cE`B152-#&ax*k!hC`DjIk|n?@47`Wxu$M}W!)yiq3dQK6O%a;J
zQ@;mQoWDjjA#{&(Mg8Kj-F&W5dql4~3-iU$-AV2Dt6yMMEH->9O&&BDj0+0=*Wx{i
z<E0v7#SI0=R(2d)VL)qpv|w7TD+8-4B14s$*+lee7?X$5go>}!73{Yp4%3jnNGAp}
z4<JPz9Tu3VIO7z9EGc$$N=hW0q1Y)BOsP&ti4@#rumBZ%ED_D9?j-0>4Vqr36ho@a
zQdn6=^XiByx!9S(z-)yqW#4MF74$}8&k%AE=jcQ_Kzt3SKusmsB`ZQag_GjZErjfB
zssi*X?rXZ0t2hyp7LUxJ5)rtzeg$tz1XaK!mJgLtB<-cFILM}?9$BdaVzo}cN^c8R
z=BHBqI$!q^DD~X(+&*&m^qtf92jt*|LgPzMUE?h9a!ua1=KlKP+8z0|J09MU&t8(#
zlDu|@yfy>4d);!8;>Y}#tn>B{DSEbkVb$8=s%`mI+a3-SR_)8XI^cKe>?(E+<vWL-
z>?(9#%)2%KTQ7#uKW%KiJA7xj*tj|0xcR}ZLSwJIb2Q&LiU&Q7MNdcG(^2%S%zIWY
z)V1GTb!XLsmfNfHb%;Rwprzv**Y3W0=hgc=3N4#&+ds8&^;>`HYsmXnf3Nys?|*76
zcJ}8x`#)&r<#hsKYT>fHCR}KKS@yrY2#W7qsNwIg|8C%S1G2a4!IvL9<=}C7=(7BB
zLLR)bP_z1ehwSZ^d&cF<v$FWAeCZ|@bnLE1a8Dzc&MF4FZSIhjmUd{M`_Pl41iDA4
zO<)LIxpSr1+@Ejmf0X&dxgX9wSzjC)&kv2umnPASuOa3K&De6zT45nX<V1SDHt(8!
zX0^N7G8A|ai{5Q{FWUF1cZflF=KCW~w{7>MJ&(HOmI3+9B)v6ds3N}7%E;VFYf`gN
zW~_9ddG<ctgm!zs?!~|VWCd5(_N`6d+5Npa+1CfRp88eIcZp0^oF_&&Y@N2w55vr<
zNmv)Wb>!7^*MBCh$Kd+ohW3GG+n;Xh80h4lG*=I7sCv@bKDgHQBWuUtO52ZCI*>N^
z@Od#Rm$NXiC<1rsU^sk<XAh{rrrtN6%NU!zMIj|7c1RgTv8Qg}DHG?1nf*bFC<U7-
z2aJ_=%doNzhG4;p0>M`G*l9tEhFxh=R~&?hO*mE4m0@P=FqPq)Te9|m&qLS&c!~6z
zW^6DlipGjh<7cn+jP(=@baJdo)|7kfM#!N%fEaExYbP_ygt6Be)-2g3<?rcM3gJcx
zIFY_J$p!qwxeje%Mx|;Y%<)f=3}yJJ%+ZtrEf}Nm9n_dnpSjw_N}9nnaGzM@No!Ja
zTMouzOtCW6MgT?E=70n$xmSVLzNTep0AGw!MC7E(I@6*(>1qOz7BPNej%CiuT81)2
zIWAs=!+@F?zk(cej8&#rr9FHax*q^Q_2bea7GSAtT!U&GjuTYW;2SM1!oxrh8Wd2$
zoup&66Q|g68y)kpa1|p^J3JkaUS)+os4apK<54V9B5<MCN-IaOv?xjkDOmJE!zCUQ
z{{uQ8P@{A(xS{JswM6=A1_Rb80|mxmm4U)W)^d8_Xi0}7u_#`|Krs?*P|?8WP+tTI
z#6O}_ng9At{AAQurKTs_b2;jZ74Kiso3${!H0G->-`4l2v(P3Oe1^Z6t~PoNdzYoG
zhUGKk^1h1;HEZtoF<m(W6}gkC$Vgd5P8e0>;U|oj5=cd=nyBdN%j4grSYdbk-Agff
z?7|-&`{A+22j3Zfd$_Piz>WOwxI8rr6?EKsig_i6nHHnCR_4}>;ns}hxTfL;$|~;X
zA3L}`lNO0Y)*p4PIbv}w(n2JAp+PLq|H{6+7AniBW%P}yelhY~h&9pl7?YpB4AZ5?
zpxCjjQOm)U=_0<a;xOa2C^iLp2eKA5sjYYcKh1Q>SUoroa_CeXWse>5`bEEA{RQ7|
zs`v<ge$n??kbm>i_e{erp;d(%3b=%RbewZaHcdm~yDC;FhhI`aJ^cs0U5YP)UWA@w
zdeN40rW|@3Ab7FL$a-M?cNNR;7TRXz(z4O=QUQxe`)sM|Q1!@alPBtRCJiO^lr%Z4
z|MY(xS+n$ceT<e$fzfgbIydC`yr)qgL?cjrQr;A;JU8pdbxXfS+?x5Q0J>=snu(ty
z&PX6Gro)W$3wibWEm<J70`IQuaS5x0)fz%FE7c~GQt^78Y<!z>f@{#~YfU&ov$;TV
z8WqQKV{z<TWtZ17t!Rew)(Pu{4ccrptE1UF8--1!8Qfh_Jp9zhK?zf_aXP8vD-ZBh
z=WuSlYAY_{z`#Ud6Apu!pSuXV9~2KP{SqK4ndsnR&N08WrU!MX66A;B;?_f{jAR*f
zwgE;2RdP-I1C%+}rBQ2|Zwq@9ls)%LIks*F3kV*ua2$03ty+5EC5@G$QXe@S3>s-1
z{%kfb&e4l$aVnBZ<k)5iU@)?&1eQDpgSlp{Ak+%js{q)8p&Z3}I+UwFqHZ*jO-R!~
zQ?$$^*AK*&Aie{cMB`$H7A+G|g#~dvgJ*c*;IPDZf_a*W0OPRT7veDhs9E)ufWjR^
z-0W|m3CM|wKvymLOR;q2_{ycksv%!qQ7ry@ya)8?0Xe4cjgnh&_;c0;=iH;LI{fJn
zxxa;YG%F@DbE;EX={SBoJdwx%TY-=ZYk(`v04Jh*6&o#LZYw>&ck?<XV@=NrQf`5q
z2Q4|-EhVN>@mS7hXeMftoV5$_)x%(ZP!7*1miO?P1QwD{<pu_4X5z5~wV@cFQkNv5
zdH3*JyKz5@%f#03h>wWO?culU7sWW1?_sPGFnkfA7FjX(>x{UhPDCsR1C@9iyI`n0
z%K%W*2$A&YjMJeY4@QzfD0Rr|wNr^%6@43r<u&87aj>(931Mr=7b9I26*HG;ZbfB}
zG8R)U(0&%|k=u1fEgmKcnjlspJdq?MPqjhPr0}^`8nQ9A`keOsD5GeGesh1VWeiX}
z8<|o!0nzB!gx=yoek7aXr)E{=m+wJiBDMt(KBB{Se3)h!I9}=?4Pc|&g8V2NGei9d
z;!OlojJJ&a*M(nd4<#nSu2K}ey7NvfA+eASJ~BzY1LjwqLg@1#k9~6ZX^lZu@1XM0
zWP<9awK(G%NwR1Gh}STlRnj!jQb9M0k1$`vAJU0I{4Avy1K7c07)zpUG5>cRk14(+
zhN6!A(^*MzsUrtb=}t8zlKf_YgNW6~V8~F&K9-c0z2S&B$IwLx0$CJFi`rLup0G-=
zrhN+0qNe1bVvR)=8-3VLatA+CdJ$mXq$op2I*WC#iUZWO7{THN$Y7<K{Rm5ul(Zam
z*hBBGRMkNxb*NcV{|=8xdx0llQmA;{ggYE9G=_k|$1K+vJil&TsHrQ~tj>c&vlsc^
zJm33p?8!}e<`tRmm3a}5W-U=-ziMOFdFzM1I?Wm=A^Kxa7?~9+nFztW3jvT%>VMqw
zqn4+xvvj@maNpx*V!j5jY0K+ZZe1zXcIIn4AGAK+`p(X`cNS_-%-bj~a^IbO#fDA!
z26+1qJnoeTFUf~4|3!G>X=n7^@I+o1hr|DS%?}$NRzDhjH1wqYiR1mia6UZoZfEql
z&C(dR%)9=|*FxoN=(y#Yw@@^N>kih_U67-3IWu?LCHr&pj)k7y@4x!itB<xl?b%;w
zI`eMN{`;ACcE7#*oxR^k-i{F?_}j^R&;I#px#`T}N)Q>j_Pd*Yca!YhEO(7B)U@8)
zAbWXvEli~?^42p8HLJ9R0GkW^_9DOkQM2qlu;86~=5g+=hUdTWqV-t~V<nyLOIEBN
z&{hb*M7n+Bsf!1*tA+;be#}_PA)^VlIqw1q`*`G?^KYMj5`XGi%#@y$FG$qH8AFlL
ziLJ-%I1k&;+tu)gF}v1Zzv2D)^G#eJX8HNY)m-ygi$oU0AMai<*jf80wXK6e`=4xX
z#Cef1=E5U3GRD3R`*nFrup9%#AhsDPsF_O0uXLDEfNB_lS>OR}l(h_z=ftK@TK)`X
zx=WuZC3G{Z1jbPxwk6ar2=Wl%P;FW&S`lWlgg`e#Sb5CqZW6peh7c_!VDHqGie5?>
zfn>lpoZDyu8CeLst|(RPC2mFz|6eJ(ZgXKqGTwxt`wJAe9N9k<eRq69K6n1dJN|qJ
zQfkB^AX))W<&Kvk|H@8YXlNESb`7CjIwWS>uT(%_BlOL!BRxy-!+>9P1xAb+N~$qr
zie>krC_d`jZ8Ss3BfSo08_g0By#8NimBbfCe2RaK%s<3`<t1Wgue>{vkS|>>j*PuO
zGKRF;GP#`wxTzv=Dty^H$^h9SpvA&qgSj@mXxwYB0<U0U7mLPUj*Al)P&_r{jOokD
zO=VapK8q}?+)!o<UR2tbA0qEjy&vGTC~{05e5KGP8YncQ^4W@oQ;qMmz1@}{isr{B
z3PaJt!Kl1Fw$Sp*Gn-|*Wch@%xHA^`r&Qs4@X2;^5uJtb)z(-QU7B)h_;KrxTJvYG
z<R=n^vsVg(SDw1A8U(J~az-92i(%%&SsJ^As3KL2Dol*Bt+|k@JjxRs7OR=iF!7m`
zJuAdQnfXg}kw?ow1<Pq-2}rD09E+Z^BGTN(SR5*O#euS!Si#`dN*g#}%LY4(JksjG
z1e%G!8!rhtb&ZxTG!56W7#AB?LIu%bxXwhS$#urzm|U+Xenh|C<Iq_NL<Tv8rbXL<
zHK^Y*o>5~HpA47>gAeA^|Ay(;Je>1kr$4sO6f9>6usBygh{zH((1E|I-phH0DZp5@
zC~}P@F@DmpV_^MZZPPv4KagHTpb2COm-7u`2@^R2^vrnL+7cEOtdZI51dN_;+(Eno
z?Wu*0wh#kC&77-+QA##~{#r94Y#8}prV?;VVw-y9R_Nh3I+s9Bb@mB7lk3s4qKjRs
zg$4l=OLrl31J*_|$w#u8>9m;0!8*VT;(8R|GeokeH*p2lNOCT>rX;@g&p>0bFcE#n
z7;ys?9qS1o!gQ@h?SbdOD&#s1!cO0QhCawjs^`h#0SM~^Jk0*Ua#aai7osc~G8^>H
zQL4ZO&~~OG^|jeXS&A3d9yUu<cgI3lGX)oyx6Kj(ojEa0C*l_wzpXk8)R2HyT&xTU
zP&3qbU;OX%+F#-XNoU;a5Sto~-5I+Zz7xJbR%i;&A6p3Ye1G-#SLYiy$mcE=&&BXB
zk5JVs*VP5ChK&*BtpkPDLHSfzemO3OC*>1UPrcKNH_XDuh(f_Xs%?rDl(!5N{Da!B
zy>frL;Gflg0r7?k{&U(dguq4%{uq!hZIR_<TV&NP-69KHDQ?O)Zvyn+0YCXiD@`}b
zBE-gU<`sxIwiwB#EkweN%EQdTjP-DuKuy_4ZGweO>HmsYF;hoCS<vFX3H6VwCKz(m
zQg#~XU*l<CC%YL*3(6FG4VrBziaQXHW@P^&A?$<@hHJWqcB%RNr@J^V<S=s-2((zL
zvib1aEDW~Xg2r|Hc;7_ynFYN<7-~JhQ>%Z0a~XZ)W_|RZQTETT9Rg;TDTPTWt?s7h
zxzqn_nYU<iRvf_H|A1aJS{?Y7nahAV6)MSXJX`U7`f27ADEA3#Q?s5hYXbz~3JqjO
z;7ecB58TMQrG;Tj{Sc~4!LWS}X46fDO6x|nCEPZlmGvOO3huNY-y&gMaR_bts9=li
z%xYlPA8=7nP%Jqdg0@i`;U3HyURX0?=44n48_a3CjC&nQrB5nD$;<+dk^lNp_Y&8~
z23%iuZ1gxVjyINCVH0L-rx4H<=9!I$&E#ZSG9GNg3wuzyh&s{@<<yg3G&VwREG<WP
zcduROV$1qy-kZ20gzm9v9R!g(A`l!_L4~#lAiNI-41!-Lbii^3J9cX5Ay<8d!3<Kg
zic?V4Xca>ffIAHaxYNT&CI|y5o@140<OMC~()Op!pMjmiLHX(-n)(VX!vel~4S8so
zh=5kEQM<;tTa<||>fsEHh6i=P70lJ>9|t0e&8fi%w5ted_uK|EIEJPGdrqiJ3vL({
zcc61rc(M^YoOXjPk29#I?(fO)QYV3;ZiGh=p&H0Fj<7Az*;A#sRmFW;-y0*>sG}|;
z+7c1mr9&XpjzKH5DS0(O$p&l;urY+iO7l<2&^N**6GPtzeIb5_n(;PO(I;p@(i#X<
z94Be3)Ld%`2~+iZc%Y?jY%333OOh*hE(D;rD6Uv@8R&t$Y?&za1RP;#Gk6IwD0=7u
z@#WY-%CLVu$Y4Tu*AP1+Q^CGVU*OMB+zO!V^+aYGECE=08djw)+}}@jPPrcz@dG5f
zU{Y9~pF?f??X)9+hE9f|*Zz?!{-7U9Ce|`}nW39yR`MY?U@$sJHlUp9#^{ir|IhO_
zueTZITBfY!dP9oYhRcnQ-E2Qb4U~o`Gj|qy4(`z%k7lHVF`UG^xPn){ia%<w4{4+F
z(m{#3k1wqZ6u*q0N(G%|KFUj@qZ$1!y@vPx4yfMOq;5CPXzHTBEAQ`mFk0;H&v*Af
zc0ctGX#_U5XvzE6-yeIBDfS%5_Z)Z}c+Y=wp|0iLwr{Nbyhnbj^4~>&XWkF8{b6r$
z+mZaXBk%c-GEO2_vuNDHA45&0+AU=EmMtH}Lt8XM;8P<h)v8^|8tfB#?gmbZ$7o_Q
zT4;>!QB_qQ=$n-K9eT7H{~rU`RGDSaM^_Kgi3M{FQR)PpehsI<lBg`!A7oi6b`d)y
zmuV!{7p%`%SQb_!zRavGZA*v0rB^CgC1X!fmeT8(J%5jGscX91dZ+d7>N~6Nw-)L)
zBU0K^cU$<{zU4O|9x1d6PraiHO>6HTE3V&>U%x|c-1(^MiL*FxAwO^ds{`dr@Id4~
zC9ld6tM(_)0;YznVG7;7WO<qXG)AoRM=&s6|MKf!roQ#u@!Y$Fo!|!E8Yp%h$ai5?
zXrXIJUUA|nhJdzv(dk>K?;UySU1KO;y<X&UPE~iRXl<#y`lLMi((T%J{o^z~N>{f%
zeC_dM@z_}Y*qFTIf_!mWzA{_9@@oFdtMd3wdHZWm{a;#W>9~9I&P{neyc4%?zTYym
z(8yM-!pBndugm+_-5+@B@1|0ha^3zYe7iR9Keec6v|C13zOC!Q*uyV9&Y{vTsXHwS
z*7H`mtqT|0$E*e}Z^hdC(Qlr*bA-nKp?uFF`S8_3PZB}sMv|`^-WZwRA@4gapG)W4
zXXRI}=iAvz%;gqyp2l{1#j_XlXD=4dCh}(!@;*eAH{MPZoA=4<_Q~G<$1CMC=Za@0
z@@FRG1JP$y_AS*2?4Gq;v&eHd3+bErhN~#+Ve3)rGdFYU*xkphSn#Qbn)g3(5RW)a
zP8^J&mkOTM)D8o;28!O*dGG4`uBYC>r`9U>G0QWKo&BYipZE4ZIR2h%Kbxpx5~Gtg
zn<sP+z9J*Cjk!fT{lvyynXH%+i};~EB6>)bB0iX7kFX^s>>7x2%0f-s%W1aiLA~lS
zTrKCorX9=GOIfpTH7c%fn4F#Auu>hSwb<DtrM=<sD_C`+-SLIPlL>6zi^&#GrNd#7
zaIi>bh)N(s?HQMl(5x3<pcAZEP9)GO2I)j@P;m>Lh&U11d~OPdiMB~Z!;uVJxmf2D
zm+%E@Ew$ZfX{6}YPsDpk=WzOU?h|XZ<ErJ8)_TW5%O{-{N6PYv)8Xj<q_*0z_TyHk
zqxEBdoulcKjV{Ni^^?XX$B^Zd;A&hrWU0lOUxm{FiwEa+pW}q()3q-+4p`Jr($@m@
zN>vz+<EYv)lUZ~ST1F&wO1x5LI+>VIyXH7u@`zb9V=_1wnMtY(W$Fx9f^2g&ws1wM
z#s6<c5SydLS%8Wpk~(MmvtgfB+{q?_#9tw71B<~#(w~Z7yRJIH0TER{IBS%}4W+pD
zs(simwxg5rkCV3I1d7~Z`N(Rw*#D-Qv#k4{T<d@1+&|$~{Dj-|m)y>ua2tQZt^3q@
P%5FJe`IuvWSWEn0bp;*k

diff --git a/scripts/src/aim/ui/__pycache__/administration.cpython-313.pyc b/scripts/src/aim/ui/__pycache__/administration.cpython-313.pyc
deleted file mode 100644
index 576e8f01bb5c8e76bf0f95f50ba0fcdf6bde178e..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 27362
zcmc(IdvsHGe&>}eS&}W=GM3-3Yo0b38?Z4C1HoWp`~-9@Fc=WBBpVI3<hfUNf|5*n
z=8rCH+YL06#cZ<;*`3pYHoGCGdp69R*$$be4bx^PS0fj>cgW0~-FCL~&mJ=5Y&x0K
zJ^T6o?!A&ME=-a=J^h9J^t-?J^ZWk&{HUm?fP?#A*Kd90r-wQ2f6|BUENZ~?=q>`U
zasnrEf=MtBnFh_GnWu2xP~M<Lw6L&c$U2xW=CiPM$Tnyf?JS%><PaUmYa1#UEEEe_
zoPEeSSR@v)uw$rrutY3j;esL8V5wNj!i7Vt2Ft`U7IqG~2g}9s!3wcruu`mKaYaK_
zgVkd7V2xPAzKe%y2kXQ-o~z<kb3#cCC%Cqo)e(sG)A=o>@k5@FKe#y>nYqY^Bhp+b
z5DP~mt$gUYxtVYv9ODDgh!mX(2mKV!`y)Z#KSxRGw-k!S!jWmI?H5#Oi%BW;M<US}
zOO)_w4~9Z>f#}>tg!8Aup_w4XT8{c-=SL}UvS(x%zYhBC6UC^Ak18?r)%ma(@=c4;
z`8nTgXm&CrO6S9KNVE40jOh973x3wGP)nXt8JL%1(b<sbi-l(AX8f^`FBqPhl9Yx_
z|3kjVGD#>Hot^Weu?7G9Ow1?6#Q8vMUJSLE75hjiGCzR&6iY1hTnw$}A3Pro2SNdL
z0##p|P1B>V<NH<aG$)#{C(MFL%o9oka}D<u>;=Ik<gt(yAqxxT3#EdUg>1qqA)kfp
z2-#T3A(RPr7AioTgM|taDqtZeLWL|;B)A193l$4RV##!IOSw|s6Pyi4!War$1|cAZ
zLJ{c~W$0f(+r6yoPWX8oXL|H+FosvT2F}ZQSi(xrgFLxze3ib7A{MWuj5}_X%<Y_H
zF5?bw<G6@*!m5|>S|@DjuyOqkJw5X~Uar@_-K55Ln)H~X=8;a0E97`Ck{_|6&+M#b
z%2LQvwDOz2ym`eqogHSu+-~ybZ`Vc@v3YF)v@y+jZJv_HO9^>;56oP|?zMYL4f0s@
zJRX|l94A=y)QCd>ybw5jBs_P*(X8e6Z$b|_k2|L@K0TF>#|im@O|b7W^Hiq#@$~Il
z6we*$L5|wTb9|{)snmO}j|g*C|9IVkLnzplUN4^OH;uG&*d09nk65R;Ca#s!#~sAn
zPa&ld>&bJYm-ps1a#N<3!qIp!zmFF}GXO~ZRCp#7FDDqmf_$^6!>ks?EKdHS7=3s|
z-rAl~Vc@`UpYM2&cX%uw>Wc)#i*vD1kUvhxo0V?k4@M)gP$VYtIQKlD6(0=g*}@S%
zc0R-}_{Fe)at48L=-H6i#(SlZR>eNPF9@(0i}E4*4aeFPOE@wWy=79YGogjh%xBj5
z*wp5o__l{4foKrmv86<D=~YTTwNAxKqmo40Pf8vRt6~>J09@gPkYbnExTB(yuZ9#$
zbS@N8EHrMVK#KXrnDlHoc3v^hhn0LWBw=uhb<RI8g%k(X4>0&#OmR?t7Hla{EU0Qq
zvFk8Uv0Mm8f{Ha3j?IKbo_b-LQ)~eS;UvW}2M~?sW2j<QabP6sL`rnp__R~DwufSY
zc7H?)W4hX<fEb>ON$rw|xbSTIe7N1e0vNT;T~vxQQ!xt&tE@GIS8XeE(ZP_au~~kL
zTP|L;?5;|=TN3V;l)F9QZoh3$x}Uk!_qV=avLf^&Ur;_Z@r{K=|2Nm%2&UF|C)RhT
z*7qjX_ud^(u0NJs?U9?t?pJyfzTl;PxgxY&R(Wmj)xD{*4T-W1H@Dy1aJxZn-Y*|K
zB_EiO&jgcYp-a8XC1saiSaww`mzH0vzFNK5`HjXKhnDMBzdm$*=%)D(j-=|k5_Mhj
zj>E~ifh&$r^SD(_KQF0TcDb+FuG+2@UoC!!N$WSmKVtTpuM~gGaiz!2lwNSP;8o|(
z5J0Baq#K>7H9He)cBa<!B-ZrYZBDK^mTdIMW8<l@$;8;CJR`~Q$6`ya`CnFZC1t<*
z9~Gfb?P%@Q#?K_$NpI}x-D>&%s;1tqy!W~a`Yg79hM$l|KvRSGU6@D>;v<ynGSI`z
z89{%<rr~?0tQS;}4j%wDwRRbVN@IXb?uj(i7c7ERNW<f-ctAM8p~LB{_yVC&a2muH
z3B|y;rtKPzYfnSv2<BXH?H=biKSm2k&v|GjavWj_Bjz|@It^3s+{ks1IHjXwij_f=
z_%j0FMhGw<GB*!j;?IYJ!BC`|fsmkIIzJipi$OjDs37VvMnWQT(%ElQOk3mb0hQ>|
zpbL(6Y+i~t5`omJ#f4EPPU%HPd=bzATrh2mI}hS$#x$@LUpuDJJ^Y*qiY6v?^V*r^
zCqq+F06KyVrjB?417GR@YK{P^u-<}7nhH;Y?g=umMlE!H=IjL+O1Dt$3C%_qLM(e4
z9I$~XrY$Wt#Tu9i`2n%c1LlN8rC^ePPe7cXom4Dz&PBqmiY4HmnNgf7wdH5TW=o#9
z8A)OrrRQq^h$bCSM(m=<0yR5>7W|W-1(9!*V+~43*Wjs;!s&W>@bcjA4lg4xba`me
z@_NbjlAHG18<JJK<vlMhIls1CUVZK4)sqigRf}bEL#NzzBIz1uUyBjBZ7k{Xsvk3Q
z>*1tpAe}OBuQTa7`p{wJiyv{;ijqr*9y&Q!#bVj-yhxw|?G0QWxDrfNY)DjWxLLL2
z-2HJS&g>&}jazXn(}dU!Mu=e}QkEQNco0oGBKBkxc3Mdt#rlE%QD=Tmh4}QO4`C*a
zm>D6DNQ);O6dgQ7%#36-s@H)0qGSGqkr|L(-t@>i%|gD{1k%mcVMf?KktV>1EcTj>
zNG`pHWt<+;=Lt0wWYqv7`is{9z>*Ez$}@APhXkhpV6@AeUV(jV1@z>sUnAl!i@47F
z{Ojh;OSgvJ2_;8NU^PmGRg6e9Kb=UN=9*|8o=QkgaT;k>HX1+7zz6T2p(B0~ydszl
zsf{0v@)CoH5)Yy&#1kJEl8E{uwlNY_iMMC{5+6A4k4%SxZ6Y-(*1(HbXy7aZT392B
z<q$ySXT@rZIw<_iwqFHv@si{I88pI6^Td^gf<()w9UY1e;&65%u!iG-^Sm5*6c>0D
z(?mLFX0t7DuUY};SE>BPG`Ayf%5=*#3R=!G8I8`|GArh`EsAMDq79%!C&!-YPz3z4
zxKG(`44i-^h$CGf8nkWCOcXFs+SisYwhNU>74Uumm?du*_)g>Po;NKwkG*BPY5Pv&
zuOu4A*Q;tw@ltKDGoh&%4|pHDXgu5lD3CQ=>`>$3>N{o=rwtse1~FFZz{R7eMm$EI
z055yY;&F;S0dF^@RKa6?Z#nXvm+myZ8N9vqPp046bZgUhUebDB-)M^0Yb#8fLB~x*
zY_p|(<`5>?77R_%9L4L@<yPlS-9G7k(H7V6;>zvUO&d(zS8Z{pT3#iLZ<)j`=wM5c
zVr45pR4rjyC12gRB29zX0#B(^ca<g#NQ)96XuuvLLYru75nGB#_W4;QUrVtu{3#+r
z?XuWI4O%jIO`N1MHf=y`MS<Nk^yXBf)mD|&zj+UBMP*Vc_AgLeVadz8FYitj)+Gw-
z7RQr?>r;iB@sH3?|K<LdM=y`cwIO*{x-^<_#+IF{K*FX<w<SuqB}+Rm<v%nRIBHkq
z?N~0YTy(!)bG_#E#_NqYtCH2*WLJmWb?DyCdmH7k3Hk78dHb2=($(KQnAk9Ir{a6{
z->&~|V{*ela_xZZ8eA@2`^`Y2<;b0d@4fi#7r*;bvgJr}{Sg^>(q`!@{)Dp>l{_rq
zT<(`&xcq`#*L~M}>4p0xL(4S{uW!7*F;%lEQM2jh;bhI;E4D1^`7bLIjeF(MInd7+
zP5m1EeAxUm=c<>7FAx9T=s#XMqy|2d2=lyKd9bXvn|rT&RbNqFKqKD}&vAtB@NIf@
z9R90>6<PF3@9CH}k_Tea#E8k?XHcC^XO8n25WIrfo9D6TWW*;h5<z(*f;5c-1q;#J
z$Z2JmFrQ&U+eDgN^$_oy;|v8Ab{!AyHR)$Rhyc%hiMkvHbpb3w>{!rgZnqGTPPpgD
z&oN&`Y`y?iG19V}j^Z-|fRX=)$Y0Fz1O6bt(fk_W+!Dffnn>jFCJe<W+3kLTmR3PH
zr;hD8^wrJ!Dn7BV23S=n7b>2#8`@1mrBJmikEgL42yTRGp+>09qAft;Ag9rY4Ma0v
za>R8)y*gsF)cAN)=mK+uIa(S<#cq6wL>DUg0t2<;X^I&kZ<Iw76GGyR;{$@XXIRPa
z>m3+7;!!LSe<Vt14oCoO75J7}Cc_jbsOTQ@_QH#wCB_AU6~>IHxmCufjUNL>QNw&N
zEI|}}QPO!Y5F&unB>Le|v&x92<=j+;R~eFQvZN`yc0Mo@l~9W`9|(jbX=;9E=3*Mz
zsEvvs^*Hev@`kCWC&!506B+9Sfz!-PnnYrvCZw?j)PA3j5*>AMmNH2a$=fIWfeZ6<
zd@u?Uha^?NXqdMUiJb^vKI<208sc>tr^a~8G^W%st9X)nqLENR#?uAc;zjDn)UE|v
zT<RK~p`H_LAY>f#hi4=e-Pxsxe@;3djVb1+q}W1{g|HZnD0$PNm^ejc82+@-B#7te
zJ3w{htF4I}@v#CO_EQ#WYb7ca4^gQnV88|16+U%|h{BQPR1652OwHArRO#wO>FOIh
zlclYf@|O!suL!@hS4V6|E+1K(x-s>w3vXPI>$lw=zY`<mbZ<QQ%yId|*~BwGx%1p|
zL)-10w>RGDm$&rF^?l0?>)$lLRdB1|t>Rn7x1UQk?@u*Py?5aK!FLDWAANUJ7ABIt
zrx7Keo099NA6m`zVbenk_f=D``Jt67s{18pF6uKs%;$>TSES!LgPx?E^$BPF;`zUE
zZdfiV(;_oC`gtI?Uh|;&(&)z=S2Sd%zJqannfiWs$+=D+3q$Dp?nW++{>bTlyrRW@
zH;>;w{?5eP6LM>hyy*aH9WkBPY7Ltq$Wk%y?z?@2c?UHaRLa$qa5dd%UUF^9!n<-~
z`|X#m6enE$%Xa6>1(yqc&nXUK=2zfU5(qM!x`gHUoI)kwiCkwWQZnl}M#oluloZV1
zZSsJJIU_uaSOcyW!l^XZ1}q9yKu20w#UQN#{+&p3v8uRT7X)R+L(nZ08pJdHFC&V|
zD#5UnULs3G1vQGWieVDWBICRba5~23%AGd`{ef9?9r79|6NIuhv_#YdQ=J&77RHZx
z&3ga93jG5Pu6uMWUemJxV8CSJY1pX&sd()uAd^n3>tIbwREk%UvvGF@$cdo<1WMw?
z-8{n>MAxedJ%IiNK<TKc%Di+sT#9e?fZ=4y%5KQ$8RLicR6rIC`==uSpy7Zj*q`-F
z7eYaXG~x|C!5}{y223TKp-alr%D#B(QI)h;MQobt6B<#CtY4`FRZ$S{(Lix#JS%~A
zyulL!`U!;iz`Q6D(#ed9)U6Ct#7hrqic26V#`{R|ro$LT#6KHqh3GK$Y*f6!y4BO0
z&LZx|0s@{gJe$Uftil#2<2@9cia8`@)p@_<(|YDpBSnIq;z9Cy$zy`KRhUoG@`ilr
zZYt#%zoz^Rr4_4y{u&lis&r+7Pw%`B8USb;#Xjm_eir}3cqS_`ULlcyzhar1j|3zl
z5{MDfS)nrj3UvV!=qW8Lw~(gLY%|E}MRn3Y!OM~Tb?$s;`0e3Tr;z9rNSfYxGJ${Y
zEwb;0OML`cvm}G^wgbtkgL40beA+KhOv-(MC1-G@jBvkvU_R+u&?JWY<o%JPE2@1V
zZBh=NPrAZd#8$cEc+z#^iE_f~`c(CnMD>>2vDA)Zi5<t}@zbgCU}8KdUx<FnaWkd?
zGcbbo;~pd>!jSnG#koCZs3vqd<Bi~wbJNGQkT5<DqiLEMjJ|}xt3)pX%H+BX6^C@>
z&UJ`27W=1FeLA#e5Y>PO%BDU+DVj&)Ij9~gzsJr4_IVGwlG(IMEjyMZt<Grl^$mC{
zOPI_k7l}rq?=SHsd?;<k`{_xWIfOFOR(RM{DjNJ<Cj|;G7hdVTcI4`j8;9jKPtq+c
z*~bu{vNtE}%{Qz5#=h<Gg-9dIpEG3XO^XPFAgeLKXeHMfE(Hlhq07!pI71mmtdhYp
zWOOOnI-5*g=*JhXNyy6}*sPk!BH(!-n>?^PH1-^qM(Y4UgqDr+5UK{k&xfT!o{@$|
zun`z!gn=FT91O92;r^p;1B8oNE&yUKEa3zva@cdak5BZ@>b2?u;mpWKUerZtEk)So
zyGc5gMm#~tkr-b?tVs+SZiqrj!Z;I*kBn$o3J60CgX$+8HKbB=jPdXXL0^L}fOdz>
zTS6l6S-ZM#b$m$qp_KB6Bd9d)fEKoGb{-8Vrs24G^X7eY92Dz(1eQCBO+$%_Bi*BT
zA(hbi3iiQxCTNpQeB8Wmd)&<PE%q##8OgqYBtp<XqdPH?C=|sqgZ9OC3g*xH#S0-(
z#|B$i`;-hNa~M;i*hwHtqf&q$E<z`sixkRzK%dYlrBM*G?NK%vA7jJJUqP$VpTYYr
z?k6SgELwUow0J^Zdq}SBUveHM@fZ%a^D+)`O~PLDTIUVxjfG@w+mgLKCqd?;@>gF-
z*1ou8|Jsk;)qukr+umw<t7WltvGes^*LN*$y86-`_oc(j>sr2b@{N=7HX*rAxH=-A
zoKg`E<W?zXL&DkcTI@#bThG7o{EgY$Tfv!3-X6KT>Td7*1Md#p?UvUbk&hiuHlDce
z9RH<_E3bJRprj>Q{{frxpAWKURJ(xfW+Pn^qsI*n$kQcT5eq1JEB?>N|F#UBJdxH3
z;n<a8-Etg&jfTPW-``jwZHA+l*bLC9hXJPkHNcb|8ZEn#gi6TQbHWVB;dOY*b2@}i
z!KUXi(&`9l*;^Xu;iPzNf@3rIjEJp)nFeJW2aODIFv`j`8G1thz=!NIQQs!g@+KXh
z8%dG8Y3Uv0b?iSKgkgR2wLayK{H_YbfDqO`K3>m;$KwRIHy=Q=+-rqj;kCi9?67&Q
z=`j=kRs}F!EtF}py3boPq+V*725y1?3v=U5Lfsdvr(RzrNImr_;>NdlNYk9-Jft_u
zar!)IJEq86<RKkMj!TahHGKZrLtO?)(nF$^9Ouo`M}Zk`fKgkOIyWN_I-$M2Ioa_!
zK{6@kzDz56Ybd*4t0wD5pA+zl`i`-94rXQ0g8Fo)XD9GQW=Ck$cYwe}ika@&{&*W6
zVm)$PhVG0MPxR}F<D+`NBSloB@w^HAZyK{!_H*vzoU_n`v#>fRPCXxMgteL!ctG!Q
z=2xFdlDIzEoUY$ITBT}jpOVKk`YS!pM4jG(jq^VTs8ry!YOugM0RmNZ-U8^iIbB8&
zDfAYm*K;*acagWy!|Qo7zo-Wv*saA#N4{LAr*~K|BP9{%7dSQc-*`e?UME^E?SPC$
zJtvKTd69yif`0SJ|3#l!c*-=fQSTMTk3MFPAN`>L<T!7Eelo~}QL8g=1QVjysq4*~
zxCtVCn9H;?u`L~!p8HM<T5tN&t(!+@{>9ohjsC00+eS>WJ_{}DM&s2h={E3uy4)u|
zmX`1A=B0~~nE$y}zDKn!<YA@F#5bfqPE*pV^>$c_Mws~l$zn)Y6H(3Bkxz=XiNHBr
z+`5qj>+yX2_-AKCQn!mF{t}t;nurOJRzR$Wr#L}z!=7>0N3?6)O4KSJceJAFnfciW
zA9u}1E<~cwMtGfcjaTmGnSH9-Yd%D_?7Tn5$N4s1h|Y@;18D*)-RP82%S8BFS!UG=
zqIj5$1GKU4=HvCC<^4e>c1xSTN|*`>YKU%hiJyX0js@50I(6tLm}MzRi%>H@VXLZ5
zVw)JH;n_3=M*M_lKEm`Uq{`4UWyz^DnGk66HciS#O+zFVl=xZyMVOYMf4Y&!<VC#(
zRe=J%dmCDdH|Z;w7A&RLQXNQJylc17lJe4p@Z1~*Fc}JvX{$QJP??}25>~avCuqNr
zOivX7rUiOTzvD+2Nd$;hBNKmhlQ4A*bzSRsmIg^58t<P5_tf@TvwHtv0sF2UiktQY
zX1+n%nPzP%)%siF=hNF376_rh1+wph0seWcE<dJA8&!r4${CHR%TjOoXS%f|Z`bFF
z?Fs07Lg>FgMmj56ge(E*<1NAbMqPMje50G##LJGWf<2T^ck7l}tfkFP5UFKdu6!k*
zE<}KnJ55=b;4WW^io`?a5!YxHr)Q#*;yOxQPae^MB8X{X`=b7!NLX31K{JGoi{e%K
z%2!WL7TZ{;TRZz=QN?yd=%W(@+vfApXMO5{Ad$RC^pH}3A<TzZ4$-MqNA`+}QwoU-
zxRK$*?hx_CK!#TQ8Wjf^<-}LWJ4@as@`%q@HBu$H0!oV*jjH2T>~yjqVuHAnttmvw
zgme{0004*yN<~~lfE`Haxd03t0Vfpev*%&<q*!RB$<~DA)5OO>`jqXMO{4e%6>eS$
z3U$dQisp!7=aF0bJMivLlR*t6-GdKF-xDx@0$Yb5)Al@n`T0v0P0Mqw<Z8(cd(zc%
z$+}$TzGPosRd&g?>@L6Lcu?K=&Ac1E-x_>l@aD70wL6mh&hK_WO&0%l{9beN86nv{
zmf*+kS9>oFJT#XSty?Z{xOVpH*&Dq}<t;alFIU!Id;aS4H@3a<QmS%mqH?Re?O>|1
zH&NNUT-9{r*!AK?$8r__sg0}Hm?&>quIz<{bj8MpcCMn4YPosh%GpHu_B$01+*Pj}
zx;Aum=tlmMdjn<a`kAY8aqCs*@7q2u<!X+b9<JsbMK9Yf+g>idT)fzD({|&cyk+Fx
z`Fp426X#_ASLAaSFatBDV<aZ6@|gb*lqu#Y2}@6z0~9xJ{+js`*<U+eG80R$RV7!>
z$<KZ5QgOom(nE8;W54Nv(|u*^N6yU;3%H`vjFxWSlJl7d?oBs)-`Vu`rqs5<#J0iv
z?jdF%o+{z-FH3uNW9_$E-e^g!-jP_n<Blb{davBHPu>@k8|TrFuQ5B8N3a8j9gEAI
za&1hwHon<$GxpZSTNhL9y@~eTyJN}r!Q`f)dt)D-`oXFDuJMl@T=}pGJ#v=5yyx<s
zm-k)XmnF%NYo9~CJ?4H**>~6sEBQ-(u<$9WU#_Zqz2JI5s;V_n)p~P0S=DvL`k=Dy
z=6tep&lL-5tggReMc37C$eX<KiHXz+f8vCH$u;@2syZZQ<_dFq$UI7OT6KV?bj;kJ
z_mhp=uAjW)kO$5_%;OxDA9E(hIn&QjhA9m{g{@u1#{1<hpTStYqU(P7_FsRJ&$;U#
z!5nB5X7E*uJy(ma*dJ6jEJ`;<Z}%oEcU`gkWME`*-3`mP9B(*oHoZ}}_~Olh+rf7(
zynW$r)7!JReTk|*SqQOS>qhoB9-C~he0)Ooo|aF)AUD2<t{yUvz<LN$_0m!5Is9Kg
zD64tInX#kwUeF5CImt`8)+SwRe+}Jk(YjxMQp}ZBzqa9<yWhMhm+V3bN7J&?y=b~T
z0vQiP@T8_am~!$za`IHd(e&$2c&@zuwdrrh|I049Z10oX_))rzhs9WjtJcq?|A^E6
z{ne$zjppxnv<`J!|Gd$T@Skt2g#VtYX1K`uUTqP=f6?hUQq28e$NHmA?yu?_jumi!
z-CZzT;P}8w`9CNs7_M`CP|3oL1xE_4AGGwej@DU!SXYFPAGTB+$+v!(Z$<dS;+mt5
zybqfzj#~0$ixpwnS#!*mC$FzKX3mrM<fH0@*@~EiEsw$lmSe>$O{)m#13sA^?SuI4
zUse#6k#B>oH)5y>hvYb&71Y>zC`pav!D&WEW$RrzmEhAzc!atPRIx@vq7`g?9@u&q
zO_O*-W9!qRolLtEgvXitGOg&$3(BV154}DJ$B1x-%VO&}PlFnl?HdWhGAy@;aBz;(
z+1HF2njdq?ljveiPF8&Cx7{Gw&j^xyOmtw>8zM|{T&6dXe29<If-AIVR6}`AaeQWK
zz}-P@ULd^09YoY&ur7k*H_a)^8SNhfVGkJ@cug?>gIPh=44@Z6F)_<9x65P3Z+TCg
zLEI~)`-1xZrCWE?+ys$B%zgfIf?gY)s8+qE%&#sWm`6Y7p7YvpvbKV$bv$9*WtozC
zNGOA#m3Xuqx8jtzJM#2hjC~4fl?<4@cC?1@7ikS`rNxSw2FX-UUvHt(iUgsG<N)cD
ziLK09%<N2@NQ}{FUt#>YF0-$&k~Rn&3iLJ7u5B3Y5u>@P&dkE+pWzA2k?Oo@;dMqR
znh|bjqMMqm{AqDE1S_>27Oy?sZ`zk6#37@>22F&uLvJVZtHS_QgheMQEhK0hjn}QD
zj7c$^u|<dvWZQFG2wjxg!Q<ib4_$kj1I-Su09Jr>ErFOrl@e!06lq<VdcRX@i|^j8
zvy+Uyq{~~{{Ve|3FqmSnxH=n3H!h>N>7}w(lFCf0eEZgH1CnqgFf$*_y(x8^88zyX
zi)Riot32^_Oh~+}2bUL^wMpixy<*oj;VtHP+0hxWq;#h<%_mDMjapVr0?+JANGu(%
z9nd=CpMvEDxZcg0c_7%qc*$_ckBNdIhI$_({%l|FoI#sNc83wN#GDDoiK89y&yZmz
z7*m+HXuVPyPZDitlSKxN#Hp)hi+(gb=MRf~bZW(HYg})e7@@wdRi_~mjcg7=a6>oo
zaT|7}@y#>wqO6S&<P{UH(d`!h9m=b6o;FC1RIx$#%BGsBk373NF%R3Kd2n^XmbUng
z71fb&DKkeH;*(?mZE=^zZEJJKq%r#7#eYxZsmN5F&3ubDkl0d}!*z>q&=80+5#J>5
zKauyJ$)khC%qtl$F5aZiYveVN_X>H8Q$I_g0C^cU_Z)o|!BdL0R~3TlvkK6);=W8w
zaR)NTDy?5t@@8<`IFGcsBoS>X%;A&8x2W3xO4Sx=n_a!UAihI!V3^tU9>|&0l@Pzd
zvMw+KPAyR)_CAX(R=Hwm&ABHjc8z)}(F{p{43P6Q#&|gC9(l-dM@<uqF+QDPjQ{_5
zx##4@i>UX2c?ev^Bk&W$U!0e#t|!h+y_A@&+M24`nW)-{yNRE2T=h{iSnwCV{enFF
z5}Fw_A2Hu~0fGIdqvlIRKPjvNgLiH4>R`&<oN&Y9B<bEp{9ayBJ@Iz2x8k?rZ@qNu
zr900h+YjGcm#jQ`#iH_ZWQ@8#;ao3oI3^1xQo@;paAwJQHjBrTD_d_D+&L___o2PR
zrXKThRpVc7PJn^+PRW(i5A#gz%-)qhN#?G^@R=Q_$lO)G*>T_=voG~PrT(CH*PXTR
z7rtAV+CQGyKQ5m-n>rOroC>8*#S*7t$=dmZz3P(f$L?Cym`S^}vUuiZXKGV-VpI2>
z-sGkpdE<e*O>%ATeP`dtd0ctjqkMQP3v|A|`}*!1fty>CwVQAH6SZ69jzFR|AYX`G
z8cjOqS+Sq@d2j=ivBEnNRXgt3m#TW?@iXddf{jaGnHgJxb!~>{eQnL+^dGdoS$6YG
zvZXsw(=Au;k@pOLAjrqY|N8X3QTbFrt_=QU<JRjZZ(o!TpGz~rlNl!XA0MvM*gHDp
ze^Ih-xQhFr$}(KHl8+)e8snpQZ0c8uk^rri>oT|#>Byby5KE*=j)S$2v8fgrT;w=I
zBigjRk&f$wfHY{!h$1AQljG=OsbJC6wImqJahXvuYbK*wOLL0glWvcr4@P4!pp#(S
zs?8_pX`2^UO51U%RB&i?O1VM(?7n%1cJ_m2dO~}ZkC%pmx=0(b(RhqziEgpGKHn_i
zHoAccokz8+<<pj_@x71@r@w&URJ&XKb^*JQ2|WYd)YQ#)@y?EZ2_gGBM1^kky3*EF
z$v?m@Dkz1$K-}R7Gv|q4WF!DEKUu-zc6|DF0})cV!T?1EaIK0D^u~bg=PtJK19+4p
z_s#>A2bvKj?P9#dL&ZYZ7jQ*gx`=zGvl+^a(GxJhRc}i$k}jitP_1Bf3hWQDXz|0D
z&VhWSD;DalLv~jaq!}q+HtS+p&_K|e@Jwf-#SwnT9ne@?e3dr)M9$$QBA9mt+3gk0
zFgIhyD8|vS_&j+T3{U7*JO@uHRD0>8cQ{n6{xwSbZFnn98Yx<-Ur8?Of@Ezh2`cmt
z@ScVwbqhxIhCr&MEl~m_k}By;lyt5TGoF$s&(m$fFvV(j>zUnDT9(>=d*_|8@16ek
z>C|3tVlRYnr;>Xo<ZY*A-;5j)<+GB!HTKZV@e}4Wpge8<Sz!rDHRY<Ech_CobH9*@
z)tH$SpK$Uw+_DqDyH@lh1mqMk9nb`x2bn-O>y|<`;3NSI1FL_BBljwob@`X`0MO<-
z9Y{n>%+A07m}Y?0xXY-9-P7os8GwQSdX5uJ8N*NQMngkJXoWHcJu(8adM|Yb6^yUp
z(?=QGC<4G)Et!l&5b0Vq#FAB-K&{DRaN9s<_OtRr;DEdaf-i%->>h<7t8em<em2KF
zrHAb1g+U7dspw5jPDS|CQ5jo@Qn0P*2S2jLQU<#wlaYvQMd@;st}tjD_xVt|;qkT&
z^5S+M^74=8&4|i^*d08WZiCWbxlwxcmn_{NG_Kei1{N((nR#AlT2Xra<Gsi&-R{(5
z$Us<F&F;To>{+J+2pN0YNGJyT7-3x&TE=Ogrl+P9vYJC}d91b|ET7V1F4VO7@m_s_
z6QP|;z1KzpBONZ#!)P7@fsdZ9@0=j`po~~WSg+R|GL84l*!AA_TaFB4Ojb6gHEd3d
zM)IW7srB1ynsH>+xCS-aSd9>TJz;L1bcVGWBbF?2QQ9Vx=g{{wxznF_<bR_j2W#o#
z6I<FK6n+T^p!dT%u|pr(1cdXd^K|Q>%&*XlH$SXK7IH$1KKGBm8=|K`+?)S|mD{N2
z!OHn(h{k6QqmN?rC2aJ7WjLQtfkK;*K9eR2QT7<hmSvSS5Yy}ZVP%W6+U-EuN>-Lc
zl7<jS*u>H?i$W`)*Cw={Cd|?LD%4QTa==arJ0xvGsJDW0Pk>iCPV)3*^6DXBvp!d7
z&!xxqn~x}Hua32+?s22`o&e$W_E2M*NkENnqs9hS<L7|{Z7U$y)8L=B@APr}GeClN
zy>12x(l{4m>c^P)&poCsE5`IRsQk}ArmZW+lxENRO-DY$n4C1Gev|(`+iM5(eUbS!
zvh5VM2_4wmX=szl4F<0hDe3*SB4s;L(sQ~Zr3)zrR10d`ffPQIR}VdonUVJiyVNl6
zPSk6#*HFtYq!_Fim{z;6Tj<u9RwL}VXC-#TtP-nk^7QMy&iv{a3HHzfdTd550Y%Dw
zP_nj(p>&!deTt_bhxHtp-wd5SaYT<DuQbZ3pI?24=+q6AI@k$J#bVg55i|v)GT1#c
zI-n#-rtNjTPxNa<-({`WYNEO(JbDSwm>$afdQN1*dPvx-k4V_J`|y)?_Drju{|S9F
zpdN)*t-e!w+05@un;sT0+8N+?)fvx>$FHYneuZa*{X&l>h6rTh^-yNl^yiPf!f~)~
z1%y@I#8f&2yrIRN*F(&{6}u77sdAnRdTi#`n^rCHv{FxPo7vpjd+ehJp+Lg#lqs!5
zI)EocNs2+Qh^mhi$4k5s2?`Hb1Tq1&q+UC&&~5I>_zU-{AReKs$Lh^tx1d^>;c19K
z6nX=mF6OE?fZaXw&<Ba66yd2MrYcZx^_D<i6C)*w8Y#uit<Y3#j~5A~Z_yu3j#sG)
z4|)U%?^!TI#s&4MAyZepL}lXf<^-PAgBnY*^+m`KG^p5n!;%^@?TD8gJnt9rC<2r_
z?Dmvm?GX+R48-fakuY8#4e`xL!h68}87Nh#6==y?6w}Ul@j<A}NZ$dK7TzyZOuL}4
zAnV0h+&9LHRxyZ&U~}p9496YKqys{?@!aaxE%EY|*%t6RGvpsg+8VD~nIz&~n5rg0
z>b7`|o;n+i(EA^xoRiciL&g2r0P%GgS%BV5#Qik3Q2JCc<=u3YNvt%%O?<T%-Sgv3
z>PcwLaK%lxKIPdulH8;%-juTtd^0Hu{hKAIqwqX3G(am}(8@z6I>?BH<VRUAXkoWT
zOP?l))j<pKW+N~M0Hg&!lI!#{qrJ8T3O?txtrk2Y3&j_nx;BdhUlddLv1hlGPGeaQ
z)FUv7WH+V_-Wao@I}(U0^_{ME-}m?3@u$3}6W-G)@7X_f+%~;qd)xMo<F@1b`+g<a
zk?-qO+f9F1x!t6gTI0<<F(}Ubu&s{55E|mVti4StK3%oc2GtMQ+6H2D0T2(_n%d*5
z^)*-bRAxtHPFlPzcO{=#MqSmldivx0D67`y+*%ECtMyg0W9c_|*Ia$XrP#9qGT>;g
z1PXCi7ARm~Anw+?s193VCgAZ^dTeGI;;Tj;I}C9FhdMG%$3wr@oDql4hNo%gX4Kmm
z!RCVYY%wIH^U#4a0jVGy=1DoM=~&%tsDL;)JNn^zMzM_bc}8HkipM%>a4NXu*%5?&
zIu+4`m|da;dqdSw_E3oMEK@`(h1v#W0?S^CCQbsc8e{HoVN+B!n*WXBEMJL+BT9+B
zkyMSOq?F8ueGJ-ZuLvl1MEIpZIIK7j(%@7@Km}4hHnVurK!W+NID^LuR>bR2scvO7
zO}vk3tEo?T9$qVy*&Eb2Jz~uIOvp!l$ta^gWguE9z{^2^o;1%&VOa9%P)Pg}Dne{F
zodF3aAsEJauutJxR$2$~&nT%lI!6ZG{uv0gVJ3{H<=C-TCBf%dVVZrB1dmXos;1QR
zJQ9%4A5ok$d!j@UQKCd%j1sNtq!ln&7YX|CNOU2cM|}#5eEMrXK6FXdEi=h8QPJWp
z@(2Woe+;k1!IZy>H7LS_06$?dc9A{dpelRwME|o&KHKyXy=jdn{>48<If<qqt>0zZ
z-Sie=54kq|MlkkMsz$*S{1!)VDY##+y<VGit%LD0UVu)^p54{2Ph6jX0yO=SgIv}8
zXY+}T-5;#E7yR(T4=$ueLy6H)a&T(NIlb~BhpzAD-Rb+@=(k6cJBO04VeQ3+&fB3>
z*WpB0`n6ZQ3QJLgiLSw<Ye>u0e%t*{_1o2Vwx_y}Cc2L%w;oHnJS=T7Dz^_LU4weY
zJE7D*0sr2vmQMzfu3$PIO@D9n?MnG**834{x2^A#yj_xX?bot(-La;2jwN=ErFI77
zalO1-Ze$5UVyBSWIVqo*Ou7P80tvfdx;>wI#-Dh`pX|<x@BXfEw>;GoO7w)1d#94F
z>4()t^mc6#d%Lzyd%N~0m36SXb-v-0H;>6@12>%a`QWm<MsZa=H1CEfaar}E@XFo?
zbr8v?nmQ9ro$~gP4<uO_PYM2n;7=ZzOg06Qb-`3!G*K5#)_wI#-*PRVs%=fwwx(*^
z618m)8k*&nkz~WDTs6A9ZsWflT`sR(lwLWr+_E{<vM159N8T&Q-cu>>bizBGY&n0W
z@4kDzo~Mpa)wL(;+T|^W?pafZPbUtaPS%~d()YmKdegh)?pWTm<-WUF&t21ys@a^V
z*(|rIn(osH;k0~aGId5woDq|Pl&pzeIryNy>6>f6wfT+BiFV)Jj`w%HyX&6t-o9kJ
zFS**6tUq_<&`)ZcSf7Pt!<bw(w%oeyzPm+lV$1f_mcGQ6zNOYa>S#K?rR}YTTMbL=
zc3kPpjBv|#THL$4l3Rw~n36pcNIRle)UhMgaVXJoNbdK^{;8Dz#f1OGWXIQF2+(<m
ztgYcg-_egZq8{M`CI@J33l)yNa&~!JS87{dVq2el=#1<OrhM^)FP_}?JmqQE@~l|0
zlS>n4kr9=jg8~J$(+}!BZ8}Ilt9!|>?=vGq{ZUGXPca@eYqXpvlMScjs#D9m_T6`P
z88tYubOr|cQ>bs!#D+sZsPQZe;i<vHtoi}g;23LgjKv&(LWBBRbnn0K-pQu$8)wKK
zqW^0Dwb84i@|t~j*WX*08k|TBPRKn_J>kCoLh7q8CB90w6h1O(SiAl9d}_x)V#k2I
zW>6kcXMH~5pO=Rhme=mS)0f&ap4c;<+A}Smo|e~~UtZgN$D7(ap4dB{+MABsd1qZ}
z_vys$)AE`#%WK)!*~IR%@*3a6LTiu7Z+htDT6@e7i@5SNA9MNTu$eFBs_L%2aP<Xw
zEuP`J@<OU|aJh<^fxPB?ux``MzCSv%*!Q4r4enzMy)ksV{GFP&YrZ@F-t@gt%Iiyb
zeaS=Tl6(F4>n35+u)gDG?HzADf9v^F`(UDd5XKF*>$at;*5&5bw+e3+rkeL8n)jrd
z&%I}Uzu?`1_lw^xzPFIve_TFwF0ucdn)|h)<*waiSfA<|N^}j~TS#<y)n~Gosydc8
zZ(X!3Rc)jj1gQD-;_JoohMjk9i^Ykm!`iii*POqcFyq~sfBfXMIoIaBK5b6F<XTH%
zJa~W2dDY3x>gzv~e1P%qZ|!M5wUPTl?FRUNW$7S)SI=Jje6X_){(rAverF@XKP>Np
z|6vhj{jiIbOYrO`S<qjPNM&QqM0?(kElm>}^M1V1ig1fb{3o<BidQR$D^|^>h$B`*
zTl5gU?}|VDf<Ln`3NjbZ&SY{E^(^MY!z&h<Sdyivbr`32P<lRjnRE-gbCp}loR!0+
z*nK`i^gf?b;PcH!gYzI+e2UZO`|7-ZMoTI2fr<gqKvxqZQJ+uTLG2tSkC<=vke>K;
z3cW<$HS*}nkw_L+BI%69Jd8&v_u+5eKwTg3(PgdhB={)F=exzRmnKx3tTM_>9{n%v
zgZJCqC*~sSg6We6r?vZ&x)N*cC#y@X<)5rCwzhu4=UF>GDR5X%nm(!6fk@HR1pko9
zX)XV>&SSFHt5s8FEe(pz=L<#y>QJZV=`ZhKEX0Q4rFd8ZFmh8V#Jg1fzzp4blr)lv
zsLYx0q&mGs{wRgwJSJ^Mz1~SmSEV#7rcJ$5Mr4g*rzcMQVBS?St(ZP>iz~!PGD##N
zNU5aAG-ZuHM!{}mMMbfYQi~`xecMpA+9RnwyIZD|QtEuTjd&sKBv_>~Qdo3RQJ0pe
z{$Y=BG{XJ@2%BHgN!x6Y>gl4a_C4z2?-Of~fPd=j!}!W%`de=JBX0HIbJZVl4Ign;
uKjs`CadjVY8~&c#{1Lb2Bd+zQ+*cCZSANR1;`7t|vldhRFFEpA{r?Z>;6DKX

diff --git a/scripts/src/aim/ui/__pycache__/app.cpython-313.pyc b/scripts/src/aim/ui/__pycache__/app.cpython-313.pyc
deleted file mode 100644
index e0f6543bcd5fd23d62bb4c7914119d7763ad2bc1..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 22523
zcmcJ1dt6&re&@Y<3j`8KyfFwHY-1bn1HWH`0YAXT4%f0tu%i`7fMOvr=L$Pk(#drC
z`E>D2+u+H}8aMegq?<OllWv^dcE@RF8>g9vXS>}>k+U#&@k~D5w)@FnOU7<8<N2fe
z{hh0OC9s@K|LDa&I?vxZ_dI^@bMF@w6$p6#@AVtcys}#m{tqRzr%;WE_y0*0gl`Ly
zzywK@483BHff>9MH})EPOw7dNrd~5MBhTDx>9H~^&$IN}dhE>JQ@{#%+S*&#<6sUR
zxAhkF6tiL;xA!`GT+GGe1-&IbrL2_43wzx?9_Hb3M{ikAIV<P!qTY(0N><6^#l2NM
z)vUUwhSl)2v$wWq6<fvQuHL$ydREWlCB5FB2G+pirM;_r*041^?(S{uX<|)0?&)3I
zvyQFf@v`3aJ<Y6{$IE*+^lW4sdAy=`Q%?(P;ql7e)}A)j#^Y7Jn|rpfEj?S=)}C!_
z8_%omZSUF6w)1#R?~b0GY$uP`_U`K0&35zns@^?4d)Zzduj}2{v!Ctf@%r8aJqOuA
z9{2Wssi%W=@OVS-p`K3G$>XbgyL!4=w^ul4?*AQa*|NW@1!>K8tQ|e<NTq;uW3?bP
zo!fnG@45Zw4xZ~c*LkjcyFF9m=%}fAZDN1N#6%=K9EgWwQSWeUd?F@?c{~seQhFTO
zv5621#AB>wI2M&-k&t&NG#0oRj<ME{30AYH6b7QvSeyfqk+gQkCZq8X>r>;rQL}-v
zqa$H9u2@bn^b|*_MY<e~2cAXD{$$6A<K2wK7!rkk|HTlKF($ts$x0Ub@?@BW{G%*3
zIpH4<jSr!8EIffSj}(%r;-SFsg~^E%foNbfL?A4@vr)vHos)7rHXdSHp+T{A96Q1L
zQc6$qmji&#Ky)}1iG+e^QWkm^!;c0c{s|V6Ll`2>3BfuRy@+ItUG5Hs@q?@qJ*z7=
zJUNciW%bUoFhEh(sYu}RP%L&q8-}P9NYc@4$}Pnv#$vKM?re7PnE(q1h9aRe;m{=x
z$#Ety8Hs0WIL?Nn{U@}vQ7KU0DaL%q6x)eVbn;j{G_IK9cqxp-CWRuQVRh{GPOLCi
z+INfwsLhi!%tE0kEo9-*m>kb0i#mpfG27V;{hhK|WgWrsa5OB(v1Kr4*@B|e0X7=S
zfmV7V5XLTv(!6J?CH9>gY&*FA;GUsaB=~$VJpMcj1)m?K;XHpCixa!_{P5*K^!aft
zG8Uy7HNAsRpF4kkWAnjt=ZDput%er$N4&p*qqB1Y6M@nUlE{owy=0J#{Lj>CsuQ$7
z$t#(wg=b997@iTCNotTRlw#&{7HPG#MzZoUaeJm0W|bNx8?RxLnj|}q*#Ud4RG`*m
z1yZ5pXceV(QW4KFutI6QRLpBSq-M#<V?`K=3$->#C7D{q(ne{MRLWB#a{^|I<j$mA
z7?+2)E0J2IHmNL=Un-SL6@ao?s^mEa=9acdRlKH0s;(ATnY2}^;puW|n^enV6@a#i
z$10^dRyAs9ZdZ&z2_J93TlO7pHYwK3p;v6tn147D3NXby5y8qSg^}>ZkUusVpO}mf
z8#1$E!Y@s|Q4qxYE~LIK_{9C<`b=@KOc1=nU?wF9{aQOcM*!Z^rr0M$^zuQgR%M_u
z2VObB^9lXb?~142wju*bpHUmhMj;C&@Oe-;#as?a5_cOhw#*g-RH5IoyauKEiyzHH
zEB!qNOSJO*<JWLG+GKFHAPi#u)F)?-GL##oRaz+^;+<ALIS`AqvcXka3~frac=k7^
zjZ@1VY|vs~*hYWH!KTk|lYb77Tc@?l{%*(aq6ahMR%3YgW-a!GW76kvuqCHWo*k6)
z?iE_i!7W-We?R%(V|!*FW5oIzNi_ay4Vq*?szy&yS?#ivzD|StwS4rIXW#kE*_|Ck
zZ;w462Q)a@U&*-Vs31tD-834nmOt33#U9h6(BGxi$o}TM^BOI8RA@H$ffXnS$iv~V
zKNgK#Rva9w_+?IY6w^_VYQ;pjrCDUOK+TPeb}RB?fuLdmJ{k#+GMXyIHW~JFNQx7&
zWpE5&7zl|mI)#dTIKu<TjAl%+4smutW*$meE^#8wXlWGlMWU{(lH#t58QLrRFLLV3
z=u|02Ssr7wBNU6wX*Q!}RLqycQ8vzKdntC{NKWl##Wg(17|4}h8-wE1a%2!<5J{!T
zFGm9t@>neHzYw~t*!3i<=fLoCDxOseh$jQZ_T%;FWGE$mnbUKC@sEW9!4OkyY7V#)
zi(*22gteolIvX1)wuu6oTA5Iomp{tdworVyEfAH%;5FK?8sUk!+$J;Rg~!__!)<|y
ziPnkBip}o_eUJP7iUWkARZ9^}`IIOKUll$oubnS%dEN3x;U5<M$D%3I?-VYU*3O)r
z-_m!h@!gH@Y@FZIm)g^}(7NNzP4gSh+-iS!?>l?v_nt}ZJ@biCbPtGVVg0D0=GvvJ
zm#)2V^#vpyi&g9AJa5(9s7Y6CN4j{iVq?0Zg_o2!%?96yycS89Z$r9pv8-XX@r~Bk
zTGM4)kS<vCw$8=h`pS*3q`e2GOm}Uo7Tv36g0DueN9TfXUAS=p-S2s4PuhJLm2HdV
z&2x=!wccn=m+#I3+xXhXbXhA0#)naNqwbdH-I{kWm~P}2FKpV(AurT7(Qoa-ss{S4
zUZ`3{#f#NzX1m@v^4gJGHS@bi@0k9s@W+MoN6)8@o=*lwQ%6Tr)nlmUT&(oYdfupb
ztzxcme#4hi8@`mT?3gnBZqa>AtT2p;)gQtooWAZt1oTzt*Nd`|{tS-H<_J1n^$MfH
z4H4&%?L@I+<_8C-?HE!r_2gwe2-ztrwbLr|8i%Nuh`?8c1)JkV>lN#ZMOTV`*U3&G
zPv-y-&vF1ekbo>H_UDeDYT%I!kWP#PV!P3;k4(e3jY6}j@1fCq!28IXZzIlv;I0w8
z{O#SsQ4A_pqEYrB=H~=xqEEaieB105PJjj#qVA}$(>NlslW2NF01h&=ZdOba0T!2O
zLcQucEB1Y0Ekn;vumeg1z4;Ksp&DkB<3p|cBC+8>L_W}}S2==)GNFWzF(=8Yz7IBb
z&$j=K=hepRjfnnICJy9l1y$m-y-EaMb?gLqYSS~Za1`C!baY_Npn+xMD9CoK6fYl0
zH}y)y0Y}a0c`<P%k*eyO>%O@wwXr*0)t7emC2f75vnWrYDc?4E76qFr&&ENn35`}f
zK2byQ+Op9k^9gP?Di#$Rv8U0Bbs)fYqYb8*<KcKDl>4%b=20o*=wu}}<9m{@pt|V_
zuM|#qT|0U8<ZRb`<L*@B?pxc_o{kS~haP=jntXmt&LRBQ922}(W@e%WA0&nrY^JDD
zGDIOO_>BE#z+LfZ%vjW%WmA1d4T{g4mlZYl=V2||jZu@&Gz4a8;7j=!$UOssK<w%=
z=J9jbwy5P~9P))>Gl+VtF=_$q^8zHEEF+m6XVf~VvpEA_*4DOPXIQc?t-r5LG7suZ
zi_fOLadvcB_L8J2pY743uC?)5`)Qe1JlVC7tgWV~W#F((tclJ<BW~B4V66)HTG_Eq
z_WouqKl>{cYP}hRXo0VwpUB~gM{;O&`iVrYc%&k&R6{obU=OMIq$oLk7Rj{^^&ws2
zPn$omUzSFpK^P>)gFjXwfF0=->V>{fM}+;xdSOIFxi?cR46fE=je2aY7Hc=5J@&R&
zkZkDDPCWwB?`9!w611@ev5!X#)RPx~G!DJDRt+AYVFm%ML>qrSueofzYK_w6HMAa^
z-HGnwgc`l$p?Dw|hzGpH*tL2|rQ<!>>kY<2vKI;>ln0{Tjtq;zpd$*8hrAa9kuVyC
zf~^TV^dE7#_40V6PqCf|L$MPb1uC(JHLZ(c<~4{5L~A)=&2+JhN?>vYP9=zl<xmN1
z<XA~QTIm)*L%<5fR%a*%rk5zj32f~Zl!KHaS^bmTY-DH9i6V|E;;2j=gPBr^Cl0Eh
z)DuqAc)L6V#E(icF^`;pY#scI(5;fcJO8)m?}&f4<;UmW-trfrU&@4ezt*ruY&NkG
zMA;|>V+a&8<}@THDxra*IaKGn%?sVj<ZyhFg?Rl$rK&XpD=W7JB9XR>#NW~!D+V_7
zF|o%o1&tkj(y>FwyZvW6e8*2G%Dbb(?D7Pb#XAy)&M%_~OH}%zp}Zw*FMuQp`>@R5
z<Y_$<4oVRHB=uEuB_n=?NN#)#d?|ElV5H+rDU{>>aoP#~sH|9#ki&_PVm&Ew4IS&`
zje_CfIO{@`k;KOc<0%CZsG0oghA>7#QARVRl&f^rug`*?&k`fXMJYHFh)jl5)t~+J
z<q0*)2!$vn=sBZ`iN>oGV0d5*E`>4FlEZj^yvbo~xuB|{Eaa4oo#V||EEeZ8tr)?)
zGsZLN6ez}EY*<|`ni~iUaR48eK~89!Xb;~mVA?YhfXY^DspF_Ce@|3tz5B(lT=~kp
zb9KtOdUjXZxoOI@;HjM1oARukvM&^uP8pXBCVR<(yY||Fs|V8VHB()S?(*r&FCCa|
zpI@^rwPxGR)89S!_PJ!~p{dR#i{NlxIXENFuiceeyDMG4YtdaXV|umtdU4vl?n>83
z4I6HrzTKa4AD!x2aF$+qVaZ@E=@b{MH_jbPSMQkaT&&$V*O{)}Ghf@Cs_jnK9+~c5
zXx{og>2}#)KDD@Z!<#!(TL<3>rMC{IHx8!Po?B>IKi_mP)pYQ-E!}kN6SJYVSDfxz
zDiF4APdZwsy6!saW=*dbFStC(iY+PEmMQa+!D8RIP*Q%a`fBw|*WHqa*)t3K4!zs^
zPVXJVU!I)bcP6#(O!Dm5{JwAs|Gc}F1YrWkifPmI*{emL8HLi-OAf*1nJWCngDrxq
z;=Ul-OMc>TEgA9qs|VFWRm1BW-VA@QDp}EqGQ8Wu`a{!QGc{>X6Y3!S@UsE{LB|<5
zzj|O7Tnz+g!$NKIRM&LH*H2&?sf!2ZOb;6uYB#7Q3r_b`;gVUjZ+s{d$MyPF@NIu>
z>!|H^3GeSJIcycaZ*S?|Zv6fZ8{$6@3c8DoKX8Z?y6U^P8h@}wq;Pw|VUzU-2aTxn
zLlY0J&chpxKddUIaD#|&nDCDFkVJ>Hc>fgW61blHthdhLxP>!D+0Z7)2B1Jt%-FVk
z{GUeeb-DuBCxA}D4dwQo8G}~)l;H&ED<RORDQfhYwAMs#d?v|2j1&|Om%!2BJo`-f
zI4jcB=1@|hpWbi9qr-&^3Qjdo4WDT*j!*zR^J983<!_hMvq>`3c)@QFmf=sE5H;s-
zr;iA73Tn`SU-9H`r|}k1i)6`Pqun4`L4|EJ7R2p{7pU<zBOi^<Wn??-C)Bs%8FXnG
z1BY_dMOasG0);;F_RL!nM=u+^_#ZWn2+fW@CZQoiJ%Q1#{uuKreEctX6kBIT$D-JE
zlZc8J&1bkug(E?s*{+yn*qq|{i9^YtSi(^`#Nu2=V223sZ&N^`DGN|QY;v<zMY%(W
z16NKCaUntx(VPospd3&Pk%@!-7OKd^AZ8G(N{$JVQb6Qbl}n;j>;EBuT+y`QjltIj
zZ<gI{+L<ot{-9~+toZKEcXqzJ`=#dThHLAtuKN$osivJ%mSjoyPn~5m<+I}Ts@YJw
zYU6^V^u-fbPRumS`0hH^d{pS1FZANy?CJTYJ*lQWx7Vhdj%Mqeo?o>!wQB2K$2MpR
zW{0jPRBb`2XUe*uHC=F5T-$$j|Ey=eVMnTAN7}s;=(lpUCha6E_S_o0(|G5(RL@{?
z-?^lJBsmsIj>l7DlgXzqCd)5P9nnPd;w#19dT#dcTYa|-w~l;h>-y!-D}>U+qD-^-
zt;()7rkfrFiir$oHz1ahMobstX;o<oIVM>^1eoO4Rx=EgLP3r_^OzR2T~|C%e&U>y
z>Jh)D-A3M)`d{%#<~GqMF2h-1U4XM}D=H!h?1Mc{*oXEmvGUsKYRuiymOeIvGQ|YT
z-K1jbel{G3aBdIb7ly{@B)d+f;^t<vx+7nvq-6v&ADT9>g3(F;@K`K79AaNX33#+)
zRKX0R-?*%{HSsu|C)$weZsbsGv>OS+^C;sqBCA+&TyaeMrW`5T+MM;AzBuQ(Sq|+}
zaH=?E>jZ_Fch;wz^|S6-Gf3_FuD=M~48B$QX5~Af)cUTJw=3=JPTIPE`N8@wuIYQv
zUe>X$Kwo6^nqA~YB)-i}VS|*<pZwMtNyNhHNKmT_R8B@U({59Lo`us$!Xv205H$=m
z5Mm%P%4cY#O_N6~?k~#rqs1h%WRa}2(N2I7g8-#(f~<fwYS4ugTOVw~W3d=;%^v{7
zVX*ES@T*vZp%Fq)iUa!BOa4qMu|uuv4S0#m1Q#5I3Mj-jd1H+8!m_uUOx)f!?`Cg2
z<{gcB=>WAV)=L2vh1h~4WsZa{h9baRG$D#HAYV{*u+x+*=?y_Y9ALp?1cpsc#8qXS
z1qNq~2BYH}$*OKH8EB60vgI<yEJ1Q=+bFXUe-oK9p*QTN;?gC9v8ZOTs{YmL->;rM
zdNcUl$lH-Soyn(%Q&qwFs%KJF&!np&^Hp+kLY}q|H&dQ=dKW5IO&2XVTrVEEa^%In
zD}BitDLELN>PtC7pEw1l`xg%^f~N_bP*KfKDyqRP71cbH$<*^(yE^KG_v#8dHX7gC
zAR=70+34hh7K-<OhzM;qpCPYeQ0Go`I*OJmj#!75gV-wSlW!ZY7IJhjI;3_{A{wu6
z5e<SMY!-cnE^&v*WpsV(VGCi)d4)lJ<4I->e@H?oyR9sJiftkw%a>v-c$mEbxO|Zx
zdUVGE@37`s(AsQOjIe?84Z*%cb;+uu?us`lMpRi_ddmd&l29xcu%$-j<ttB(6)UYg
zw$(R~kOK(5DiG6rMEuBEMry&C4fD>Xl(T7}xpmqy{gsq!?V`Kt+MaLjc_lcz<K;-o
z-Fvg^yT{)?o^<!#K8#e-(ff-<r<XX~BjRFdW3p*)x^&;|#-!sgam`1>hcdAjU+b`R
z*oF7(6&+q9w8npoEPa_pB!~gy%lu75XqmqVqYUaKA*=3bCoDsdRy?GTYc=?c`jY8O
zsxKM(Rv#!~Xgqk9Et!!t-*oo*(Aj@Mtl7e-ug9;6ir3kn>#hDPVq7%Wkviu<xPMC_
ztqa%@N_>mz^&+6PG19!ctFP_-=H6H0vxi@PKIuNM%4BzTrrhU~XU<XRIR8bf00vt4
z+NL()t%?rIa`vB44JX<WL^#pT%m9-5;}fCOM9OCvL|ygqW#`JU`}38YMjxCfxFQk<
zQ8EE%8=<c^_a%zF>stsJs`i8%26cYvOekUt`#t<(Z-0l9COE=G7$L$8#pE-K8B|SW
zWQ2p9zG8lhV-sX8gI5kORZ3}^m*@RHAj<m?0Qb2(*KAj9;MUqwRa<WDy!(VNdFFij
ziKnM+Ntb`#6-v26Y1inKd7-R&X85IZQ!HuQG&_kvRVC{)18DlJzJdftTtYs?HBg#&
zKH)8pPqfi!B19wID}hr%%x3<*-%snl;>l251E}C}%%-`IeGfGf+d4?EHW~7UWoTfy
z_f)Xe+Zkt(jhz{UBzxmyD23KTb=7HQb7;wKAON#N%f$YQ0$L@N_xV#QdgLVBM()a$
z(z?uDspWY@gXJR#IF*7P<J!@yM`zA_zx|H&{r%HNlb$E$J!ey%vuV$hQ{cKi3l+7~
zj%6h2RB|9dBx&dqJ4lkcXt|r6kP0Lp@qQz=>9>VJy)27lB$1@gU?pgZzT7w*TrwRr
zp*?>zDNv(EK_KnNERc?jw6^5V;uAOHs1d?~G-cG_M~#CzwaLrgn0!X9XV?Uc`J^~~
z3z=bKAo{!F$<i!s>|9%IIl1LA^{pDhTvp$9vg$GQ?Ro1LKpRfB28#{_*cLNJTDuib
zf7yx*Bq5{ckyx|3d&s;FV*4<cc}YY*Di5xpLhH$A(nj6BY-O5@5?yeJgMKnR6o!C$
z87C(SgF3jp5paE=@E1nlg61VD(|c)*w4xV6p$Ra1Uas^;6C9;TE4zZ8xQN`xkzT?&
z$X(dZL%TW2J?Ij)LDik@JU?>@^C0}(&MRgxf-$Cu1?nMmu*(3X6ojD$hdvT+a!e-3
zM7rRF#o#@sSp3rICy#eSlR7!1SR!1aW-m}JE<e+W<vd14epalpp=aQ9ATy$0ijf5_
zspj7(gldw;CqhB?Cn$PEfL5&IaQ%bdox-VGCh<p9bsoW2g?}h4p1SmneKT9qg|)Bu
z%w4+q<r|6bZJTdAm})#o=l1xO<MWQX51{6=CLLSnc6{L23ek9>xNJIb<(VntqO1H`
z!PSD9tuu1kwFX$(U4CuP)jcomo3bs`t(~vilB(Nsvw6O5U#f23)v7zs&Yv7gog7LI
zkI$csrcOrRYhGw*o^NPRHMHM6JKwNB)v*8S=<W6;qhK%or$Sc_;+Wa~>b~py=1l3D
zmYcq*z7HIGKgt~)=yLbV&!rsO=SI?w?T=a&iA?~m5bxgsK3RrU@;bBS<50ET2kT<~
z{hJTXgG<#<6Omm5oiTFM@p7RJkaV^OBg{O&HAWJXK!9{URx8W81LQkxI%XkaZ{-3S
z-ggwFUb1o05B?!%L~Hr^Ce{3k2O6qhdtM~?OOot=a_wX0B@eEU966()c`3rY6k~9L
z<dj@oI0XHIa7dgre{zIFK^G27`WPLRM9oF7m;7wKk$?<4hU#nMRef(%1_ojsDVYL?
zIi3A0bSdxxE>tSw#f1BKo~Fd+Ln5?A0@2Y)9HK<UDad&l8M2K_kSqj~O*BzP0_H{H
zqR8VY({-yNwkoD@6ljQ(=R%b-9|lyoVWPi`dysnQU!^f|`c0%8VrUG0!(6mb>;%-$
z)nxR(8Zl2(J$v9{ARHl6jbect5ZbJu>gI{Sq#RNmLU{Dg&`kbY1YZ>vVTka&T7SKM
zzN$S{)t>fjhe;yiBmzy;^t1odo?6$HJo_YRE}qKBr4{gydA0I-<?OnfTW@#IR3@u>
z=BrMns!pY=`sb?#QdI-#s;4qi=}cAHxq87>z5oTB`y0RU$5q7N6<;k**0)2bjlCV4
z-|<9h#}mnOL(|0{xQ0JMsr9N=t+DHWo&9&IeNu8HoT`5&$)24qPPs0BQl<&AYe|r;
z_=&5W1lfv*GLfnG%q^WB;eAg*XM^#5uZU1FT@H*#*iTTXE8K~tfC5TI2!8;y0FFDa
zNUI&E9Q_Asd*K<=CPtwOkD4JRAxC|<sH(FcS}r_F3HhveBy$Vc2%S-|<Up|u>WCyu
z@_ZJ4I4sl(aqM5ct#wdGAp>V6UPCW451eTMLlw2*Xcny)0+QPMd5O&DA>PQ%!=4~F
z4@&^{j7}9E$*RRT+<Y^V2PI?)y=2ShyfAQd;J0ZGOu9l4NX;%8eKx!^^=jmZNN0uq
zRejgcxak36%D^iIQp%ZG-gmy0(cTsHi}RHu-{}J~r!gY#@>z?8Z3R+^)=ncUe7v=M
z5X*vm?iEsLwiVPdLVv@uCOjdzanHvim4S$?d9+kp`TnNImqqP9yHuV-MC?)pPXS)e
zel=ug$!Asf-@ubnr7me&fZD6*?e#a#?31YZh<M^Pj^;s#)F&^RuT~i{&YPY7nD*1h
zMF=><mazB3^4mh53+%_p1U`hLf<G8w7q}eTY=-C3SP0Ikjz~BPV>Q<Y${AC!pYjwt
zX@UHgSYSeNkvfnp@9@<ejzwZDVL6T}kjDNSfG14e*oZe_^FHrA1#;k3#I}STewMA{
zlh8FP7S-ESF;SsPX&7-?2k3<rG0I-TFZ+aouOn#oU=(Chp+U%saXj#>$|S-ED?B<D
zSNTXI?qzV7KGmx7G_~%a;BP3fQ7}jWS4na1aXBGjKc!Nlqs;|5#u(M^5``fjB_K9@
z2r%-4Q#5f)KFG!>Mg?mROzJF&S~75tKzbAPQB~qUqvk~<((5$peX9F+B9{?e74xpu
zDc9<>t8w17X|8n61Rl}pf(g91l&sueo@sn_)AddB)h(&&mYarD_13g|8w}u{iW%{h
z&RO%zJ#(H^ZOctDRlDV8FjccB?b$okO)cZIPh5WzHg6bOJe5~_r@Dz*?77nOJI5)~
zd!-jvap!gCoN0dj{?z*Yw<gn--M62+>yWa1W6DwY%0;-LhF=TcG~eoerzg4jNP6wj
zJL?xV?YtdKo;{a5|8(l?(+iv1Z(oM#+uJWb5DZ0<2z_f&Nrp2f81dPWIp57KH_px-
zyZOYQ$+xz@v*-Kro$c=@(mVT;JEWv^_U^!7@?0Q2FqAwyoE*N8j7%iI%u*4SydWp#
zcycn4j6aube11s~UVtt9KBl?X@IVlXjvI1W;9YkejieZ^SSYW)Hg<Jv=HeW?ZJr)W
zmLHxkKb|T-o-Xg3FF&0sKb<Z=Gi@ZbuzNb3cGhzOTsr*>bi|7l)iYaO8J=yL6JJ|5
z*M3X>%YwJJ+%cp!_NMEOrz=iOn||KRDQunK$wy&-P~UR+pzy<k1xFml9~FuSbtNK}
zJ?la`fjz&B&la=#UkwrHoH5WZkXSxKK`NXT56~J+7F?2qj2<;)k*<c+pqeq{Ge-<b
zKwN}5_>)zg`HbAo+=Wr(mDlsN$s*wVeUT4h-Z6ln=7X0R17__6#*w4-Fl2e)N9N6s
zn(plTNG3_pE?JO2qCUT?LD<ZY&ple*?5|FktSB$f=4&yne47bq+y+m{Y=0(@-vYhA
zT)hFX5~Te?KC5^mACUk@)JmjJD)O0$RBkgxZ6^zJuD<9xf6lD@ntK7n8uEfvLh=VL
zDU|jlcIQ*zdr3bK36VVrMxhDW8(<;s*~VgYbx^edW%X!^13G*#)Z_kfkdcI$D1bLZ
zZ8kx?h)j-0y$KIF&yi-+I~mRL;HGE*cNR%$%CY`K%RchMI`Gi7Z!#Jljs-*H=LOxv
zfkY8^f`hLSzkSGwSK_HXsy7(?<RY+L!4GQ)K3s4CgPUCeIW(bnx_lSUzCthz8WOmS
z3V2K0SQw5&L5N=X4NWiI2Ze~jF1NBf7*oQVGd;O|KxR@W2s-vZK}9x%pt*?scZw77
z$SNkFv<Ss<*}*?das@6F7{WoA$$~-EAIl0$Ngxiog3BPFt#J9H>EbGoX1i(~GlrfW
zhW>(!CAjH8?prj`kh3x~%KimCDt0+A0)mbCR4hRN4M$|+j5Yd`@%%2}_CHkx!#%FE
z=|$9*D>)%rEG(NIzFX5WU)Y)|Y|TNc$(l3Cr$<R4IYxR7mwU>*=q&xlBvB~$i?J)Q
zRB`j0LpRI56TTHsw{}v?qgRf8tAED)(vx=`^$VUVa%-OIUNQ@C>Rw*|!`4n%+#Kc8
zp;w-qFI<-@Tn8({%=X#Vn~mH<;HSq=&6Lf=U%h<&^4yl|zcCY=d-7)dyU)G--0dgc
zej&NzNUGv!@=RpvD79*zEuSk*yEjdB{nXny=Sgmt(#_I!Q}W5Nsbe2iHcUS^yLxtD
zwg(iXt;c|{yw`B$@IRDQ&bVJ1m^z#*(_NfBn`}QbRs4bNY<@in*S@x5+UN=Z@G@p`
z<r6`v`hfiup(}-_a*lCFKfQyx=#w?`X7#7sCw3#m6SDE?cv*uCyrFCSypIu3G>lKa
zvJ&8Qm_{?dBVrbBf~nj@Vq5-RvKUQ+mV?{#ibYyI>UA`$jWDQeD%dQN@Yy{INT^~L
zDR_<o+P}<&$zy*{u{U`V0W|l=@S~VUCZofOi42Ea)yM3pE0ao`?|RO1DJJ;rMsOLL
ztW}6%u?0Df04n*l>!(aFI<GkI+Sb7F&tCNtI0t%??)9_fDfjxMWBo4{U6rq_dwtKF
zmy^!j_XUH!iZ=AgD<@|<?>f8`2M0x*&9AsYF<XAOwl!V5`L1J2rq1sjUoxZgA@_oP
z$yy`4Tz$x6{PTv68smF4I}rVAw}^0=gRcW)gs?2$C(n(4jb}=h;<v$Y^@JEzy-5u4
zfirG~R|tIIDg<E?lxAYhfH$Af2BIQ&JCJO<O@0IUz;O=~W7HUh^8)vj;&J#&+4~av
zr4W2!<KA!-cVx*FGZqd8L($fZ?*MMoUW7ydpJ>gBl`-0ca62A|me7u>@G-$BrS2lR
zDfn^8EEu~a`!hGS{F?DOQIBijR04PFaoo@K28OwlG_byEod$@;<skTdmPY|KX@KN0
zkhh?hSIY;kRvUu~7HE3%SwHT^@i8S<f!a+z>y3m)1H+f|HP5_Iwi(=KdDDq87LY@U
zS``2k-523b+=5d6E^6s%P8!LJ<3H0Z{V@e(X+#E>UH+6ZNC~F7<XA?+p-52XZaNTC
z0z;w53jJ2CYH)|misl&(JRpbhkZQt`6)zo=&#Un(bSC={;P_-UU&#uP1@5mC`nkbe
zS}<k##377|<KkWC_y;4A6gc^T!D-{QfvW>Ep}F9#Lw9`B1IaS!1DBK<iG1K3Puj+R
znRbrzv-^5ohsCn&C=jyaN8udKHn+9w2o*>Q8+qlEk2%)RR8)i(O4k9QJsq?ak5<<J
zG*|}|x%@IlJ}plc$pNCy^ku=48XIn^d00xYcV?92VJ4yZFlkIIN5?pbE1&Ge6!H_2
zY#M`^lMl8NW+luYJvsRfsYoi$lh0X1cok&GQcjCfXh}SIT9nbXd@aAtB2`LNyWx%o
zG*Zp=8kiiKMfzLzKEI~^COfxMP5$+Y5YNS*(OUFs;k^PnYOm2svcJe}%%-%Mw&qaH
z-vA8z7sAlBFd78tY%=>2F#bJYIKB{uCUay#<iZF6hVu(yY{+SxiRO%>6EI4@5C#bT
z$|na#17MVK7^>)*e@<IhLdcyD=&t^V>#lSb2W$qQaq|$-`4vxA+{`d5h7Q9hK5h}k
z?}(_GG#Z4*T?0CKK)(dESp$t8F-C%i9q@0m_q1{S8^ISE{*6Yijk|eO9~azCCkk+n
z6BkqIo_eCRV=_J#W4N#q^zv&qd%OuNlzK;wbwQ`MCE@JEjgL5lt&D4QVoe{6I{I}c
zE>-EYKjV5RE8^Bf5yUHekVk8_nm)uLZz3uRv(YB+86r`<b@raQxGmv2#J~V#yTjce
zk}V@SJ;pAE7%A8ku|47J!qxHI(XH(djiUmW`!qpLA4C?2B5qd-bH3h^*xw0Zl8eBs
zMdcPc$3nvw#xFoVj)zAAFgWwUs<+BXq#Pb&v1mBK#a>0+L0_eb$05zii8Y|J`WJ~v
z>deTc<aId$V?4~@GJ6FZm;3E<vzuywBVyNF#fX0K3-3y??s3AGMrENn&rG%mmACGo
z*eMDE2$TX|Qxz4Bqv0TXnTqH@u>Dl-^vh$Dad25tKa`qyXU?0K0k`2&KVRzXE&n2T
z)<m<(GJac0TTxm2-hng7*C1QZMa)~~vpC!XSt;bMWTR@r)_wADH~&mh#?{yqz!v1}
zJ$nm7T*1>Aam!Bi6GX&}amu7kAYU|-y=>9FajxsF-W$F1n+~To9ZtKCOm!{Uy!MvG
zlC`t(H(q${g%3-1LPdxR?$cd&J<a5$({r`wTgNHVd$o7gk=%UfcKeSGzIQNr2-?Y~
zl7s&F!Qs^4aPp~OvNd$qGlIMDuReMGNxIzbPOjaV-2HUA($7<~vE<Idbmh5B(XQm4
z)9FfIwqhVTJesZ?Q|pc=x5v|!lWO9b<kqw4%7LXK>-zGgVqw*qC8togZb`7#HBKL1
zatW1nv+kFEW1-&r*(#xQ*U~=Hu|m|IcQmFPjdvYu7dAlnC0XS|$GW8kt$JnctM=>m
z*~a<RJ5sB6d|0`2p{jm%+smsKvIXs_)$JcvZhy33UuyNf4=eXSTJTs<J5#H7eptEd
z(H2`%tGC{*-1hTrLPgCl9ux|$N|LV1a;2+9x93+RG?hL4%!U`l8vW|Q4qj12MYo6a
z(vN*#JL)`C_0Es0^9y)Qe9n|Tltb8OU#mY-C;VX<<fZQ(YC38$zF%uY{QIuXVkCZ4
zS8&v5{L%W7BL|E>I$%cpj-}wJ$9l(QM5Q}!@z??3j)%u93XVCAcN!??$HgMzKXw`^
zexRiX-ox0i`a?_?XLY}h$hQgI=ay!wX$%obb{Yo}@ZvVLYni4&$Sd3FnnSP3*y`{{
zA)Pm@$kPaecHg~dB0PLSKgQg$q7-SzouA#z1$cgKaM|^DQjsVnBws8;87;_`yYXTW
zDBKnE?xvKxiR=`%pBB0o8aLf_G>{Iz1%`0dG%~yEu4~gr>o-lCK6EuL6$%c|FO~{~
z<`$lQ$W>mimh2YZv3D4Z&86yX%1(f1yD8wRhIWb(*Q8p84pD3u1z)1zC<O;7AY`b@
zS^Frqmx6;7?4jT!0w^yCSfU7|0pDu@P3((BLmYOZ7<v3da+yqMZZf`x#B8a)4J}#>
zVk>;&$u~kV5r}3(Umx6c&!PMwu4yt2@_A~oA5+FiTdb-HO<en^dQI`%eJFxJNR4xH
zFCht#LwfEvm&4+%EbKMpCW;A-51zoS4f?9ud49zs2b4^pOzb~VRXeYWA)a40q(3L%
zR4*sjqIwqdTrSG~m0nIUcv+Jo7-P&fewS)|5ttS8Ats9Z`BajB3Ee!wP}9rd@OQQ4
z%*CgAIT`qJdd$ovDV7v__p`$x?wzZ?6fZOIc%qo@?haxaHj&2qJWc^Eg<=GiYp$lx
z$&g|e+TQ}de>@hPj8NR+_kVdZ5XqD{{eHMo%iO$)uaNm!FO7t#HZE<@xA}%~@q8>6
zRKGPrPNnJ<vH-<61)rtZcPMy=g7+x+J_Y>k|DIw$qkwY<M9x_q1;pqxemcwixKK<z
z`AH=m9)g)x#z1`3=mZ5l6cEPY0UaUveFVQPESWs!Lt?W3%);t*Hz$+*XFoAg#zIZ~
zk{a0zFEyUid-78rd9X<|R{}*_O8?m)noo-NjfgJs=mU#r?i3$byk^g*U82L>EiTmx
zd%h%oCK%0!#Rmm8^N9GsV}(6@sZ`jx?=!)K=%)^Yx#d%v**q*hC@wPZ__VIboDi4l
zgu~)-w5%}qi4V4xng_(6ueY149+cb6Q2<$MZu#t#Xf?N}??<oJd`z+W{V+7Bt2Hu7
zm&`E>z{>DLf_|PpEC@S>%m`QGdO2+6EId3$zVLM38FUn=$g@;Uit2Swwz*8UYHi@w
zXr+WrVrN8J$?v9>>*ZC$fDwjreko9~k;$C%Kg9JZrIaMQ`y?*igHOg#)XzN?Pyq%(
zAC4l8iBiThv~NPS;)_aP=a~AfsA4LEVL{!`a)xcBRt~iUUY>A5XT(G*Zpza6`Br`z
zUA>*|SzbaPuR;%QYP6y#^YtlGfT#o0d3t?dWqS8eueCxGCaYhfDxpr)Z%}FP2L)!P
zhl|?BtGGoSox{%=bcUL66_*a3lqYIF|ALjCU#;g)h5;TQ2gTig_>Mw2%`nBQsD_Im
zqK5wI7WK<iT6XB!(C{Q}3-x1GTDC?SW#%Oyd~N|moxujmD$2lBg&wv#w=aE)*c!^_
z>xtHZWgnkpja0_h6J>BefJI4WO_a&E3Nmw;ZAMxPy2LR)0s9#HA4sVOdifz&Z2MF+
zb%2F|9`H|)uOoo-m?-{4=)5Pa{zswye+%}16udtZ*4-28?g{JuQK-2mwA>T6-4j;b
z6Sn+J*m+NAy(hHY6Sm$HHY4Yru!e`o*?@mP6LzJ9UH62hd&1g#!lrvdBY^M-8m>pp
zkL-mnR)4)Z>5<a*(_ghbu=JS3mZ`Rxy>mr3Usx!ppIrsk{Gai?UR=B&{Ph0;F;?|0

diff --git a/scripts/src/aim/ui/__pycache__/components.cpython-313.pyc b/scripts/src/aim/ui/__pycache__/components.cpython-313.pyc
deleted file mode 100644
index b3018bcb43399fe0356413b99711e37b8b193193..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 11765
zcmb7KdvH_NnZH-MlCB<pU>ooYxW*<%1dJ01#!f<bnSu=lbP*72;>y;wEs!PWTnVs~
zY1!>eYuauhO*3(J*^M)$#msg$?j$o|JG(PZx3i_4&a6~BL3^8~*|xho{0B>$?DE(C
zzH@aY*%6!cfIpq{o%cE4`=0wHB_09kzh1j>rn+7ben$l>dCiP?zg854R|HjHf-0)E
zZn4Y8YzpP=-F9Z@zY>%1D|I`%oXpAV9Nn%inaN#l=H_K*x2Ma?ygcvf_H~u8lCDx#
z%FA+hSywqL=XrPcvaSkN!SkN(%C0I_#q-|o<y|Y-3PtE!u~txhYKdB^mZ|0HGM=w!
zk)OaSDY2D(QlQn$7ee%^%(bae>(qL+s#Z87oe^1WpA)sq)fMexwSe5pT0yOT!e;h<
zB0C7H<8?KttF`J_{jlA?YT}AI5@K3-qoPN`+9qviNE=LS8e*EJj4@5uVu?^95|1fE
zai;7#aHv^V;$s>MB~ToU$MkqqYw>sjS}d%wNNiXMDf%G##*~<LPGd?Wb}oKa)0JH@
zJu(p0HY#Clkd2QebTm93N=6e3#u;Pr0kjDzBXK>^;<-a>_KSu$6pO{p+4UZj-QiFo
zG#Cx(y5DBV2NGBXhBRbVdp@bf1~oLX55zB^(zVB2nc?^XizmlW;W!eCX;I1?qfW?3
z$FvIxju_EKwF%!qJQ`LShlbiht*sNTY{qa5(`F3kxE77Z&ris_6;8{rha;nY`GGqW
z8Er{K5>f4em$EpL1jaQBdU9}3({;0OKEz@;AhU<YSe%*J(PTmko7r=8AP+n=&On^u
zKqq?oE<84{{+W)x-rm+t&z#=St8Cf~xO3B&PQTc9y7#%h3$1OZH&6p)UZlo-eSZIo
zy(qSB0@#kf0c0K<>buZ3bb2sL6`Uw!K)WD__XEhhBJ^e{P!M`^tpX0-auHC)UYCUk
z3KmUTG!+DosrGhzli-&o_V#3H09OTCN+_|=sHSgJ#zKh^kP%aGQW}eeq6$9`P=Kxk
zB7-B!Xo#Inj&0u6qaJ861Vb9a-QZdsdSaX|JPyhl!gcs1=EG79xqr{$o@0T-2MxQP
z8~{i#YJDygO==8+LC|SOiehZqtR)6FhfG@B3_^{75;yA%xX9?{WMuPTd~_@x1I_C#
zW8;QISIHXDw~hu;04@r@_m+J}e%1GqZz^!Dayt0k+WGR0vz>GM(%$Zr)O{aqgkvBp
z=MalefGVkMC7d=T@%}!*SA;%+iI7V+Rb=*cf@<rNRC_aOcuwLu2XpX}lb2k~smf^O
z<|Pkv4SW4QLq4R%lHi8XI|@280*3vpHf}hgp#d$*Y6;;CYl%=Ky3ddX;_)boq1dp-
zZU{Yo8OPU87t`Nwc>4QC<KbkK^1lB5=aZpmwx+DVe<;HAL^OiaiK7~b0`~0hXOGh4
zn`o}({rx(z?O=Z>kzkPl5V(#8E!3ciz*+*d2M!cu_}P9<_{i=1%KnVE^ebJNimHqI
zCil!sRhi0a<o3QVRhylu-=b5^(x`a<ebg*IRkcR7tCH$yv8{&OQ=MF5+8{HfK8Nb6
z6>`$i35hCGEpx3F(6*i+epjiUtdx~iuj*?N)zxZ=ISO-w(o2C^qn2eco-9UD%d;3S
zB)m<nXtAjcYGoGZQ{8G6`mI%$XE7yeBXD-iu%gATHjxB}WT$nOs@1G)*ydkncn)W!
zZt%dJ_1I|7zGI+qPe>n(MEc{g=(yn<jA|j)Z;Ia>rxWGV34!*+`%$h7gW}U74M8bf
z3dShP`=l+~Z9yTLlLkQ{Aep@iVZc>bGV^%}V#x<Z2-*r}1qEPMl0ZBKxE{AkSzO8D
zGL=-jHJ&PU>=y*AE;l=F%Mn=i={^rxb;YM!T4O81$<`<d7M_NM2BEjgD)p|ga$9XK
zA%t~9zdH-pu}0`ohJ>f>YlI=u@9Nn{k|;qc#&C~BhDW0KOF;Q_1`ZigI5|3ybYsNd
zUVZtuS6}_@#UCB>moPdO=&AjkhdK>cR>vBiv7|oIZw_RO>xN5<or|z|%&-q@3B$qZ
zz;Hs~#KVw~{1@8Bs0hX)gzDrKouqaQ@4<K+;*}RzJ0|l>hNNrJA+{3*ww(Z>b-HZ@
zi8CyTiAXGx0Pk1kX|csZ`l-X$04@q2tz3P3<rl6szwMY?o?iQfN$H!uk7VCv-zDE|
zc}-egbIq|JKayF#=JxVE*B-y#@kYn>9dGQIePq6|{pRs>;~up4+_l-=t1~|3wy!zu
zYo3wb^xg2?UjKA@{nHD+9e16=D*t<O&HwztAuMaW)}1PAy)TGpU$bg*@3*?{+L3>t
z(*?h~Y2EG`;m0*AcW<%(_;C?%5FC(8l;?aAM&=bzQy^EB&sdxiDqo}-i*Q0yq2_ev
zN3e2D!VR$pI;#^1Ms#a9cBy*~957sg!@-`toqKPHtP5zJ)|EYUr)dZn%L<O%M3L;$
zNiX5R>y_8LUhn#*etG=TcuH>j!Jap}Z*(KWCFY_n6EpKI{{orM+_Fk67RU(zbjhY-
zf*^NLZ4d2L<WQ_$VQl3ga}k3qNtWPNgyHNz)`KQ~2Pa%k$A&ke_rtsxjljS#%26P0
z%VQi|T(YC+R&e0#1j<Hv!D;hmoE>(e>Y|YGmfiN&<NtKk_4+sJZ#T5#|6J2gH@>^^
z_U?ZC&-ltOAG~z%wr_RXxB5Mwa@Q{G5x*#=8roCddQ*pyN**k<t!Rt<S~7sJ#ZWX;
zvBQUrPqJBzIf9O&78=)i?KVYtNWBv}(M9!nOU^pbm^0`M6ghBJhKBO+F^ktjJO01*
zC7;p1G%tOz>a6!>odW#^oxM4Ypq2&2Qelft^;veO^-Fu+EXG_x$s(-Km%z6<Es@)&
z+*@Xi9+a%PD~0{X1R)86kGTns{cX^l8wdO!l#8BCd2a7T>w}(BL0v|x&7M%vR{7nX
z{E=GGaZ(UMSb<u3SX8U5-C65YghR&#!3*6JbQN1sFy~LAg%H5Xm!?4FQVdRMxrOUp
zY2|{hZ8So)RnGsC$EmJt&z&8gi3od1%AFtWrW(7ciTVD7HRbL+=nJe`GBk=on{_66
zzt+NFMfTk6>(KV|pG1CEdjXAQbqC++=R8x3-bhgS>w36npj{XX#lm-JG{ZR>35Vg2
z!bpHm9f=z<d>fd~5LpgJrUGhQXOem%GBnPfqaN;oNCLk2C|oA8cAzuJ!%31pQhxl7
z!pJ}|?C{i+bX<hW`rgWc*g1GMaW<|T3dKS&{|)in0~hrBi};(cbtr~|yX1^+pOOA#
zbniD1FrhpNCBNNNT=163KZTu74w-8#6b{4Mn6N85lqAVD1*VKbz6SiZGDh5NNW&}=
zhQS&R_YcOS$<dhUyE#K+V+bA?E~;Sh^W5Ds+;C~I!w}^6PU`F!LvSI%$V_A;ofv6q
zu1F2(Ogs{U)kK=paN+cHL@NyEAcM5m4H*t0ch9*cMgE-O7+^SlLq@bChN|&wO)O#9
zF~8x6Ae3=|`Dua%8q=+7V<8^!(1|Q?R{3OFM$Qo}gwt50q)pV*=%9ZKHx0kBeEF-M
zZ+oVj(&f#Qj*MJ#Tdq#a)l<*UY)?^cYYsKNa@IsW^+Dyzm$yyI8M*v&*`=~6@63~v
zWofz1Dm$moQu%SK?3nJQ@?+U@s=94K-i~1}ms~2jGIC9tetu@<jC=a@Z1=pfb3xvf
zsaZYcnsj~Wt@xl~#mkRO?)jj(b#~?Z&F$&(#w(7OUYxRjSXrH^TKQ_%OI=grv)(IR
z>8htP<(02`Uh+&0P6emePIb)mUh$;M+q2lKTc;g2PrMa-<AqzB=Ic(rU;gYpx3IqB
zu16@Ty4-WAXKKrWZ%xKB25ZxD?bRo)EuV2subB<MbM}X4Q%CwzL(z2I=z<)}tZI1u
z)a$2S>YO<>>0aDt>$LlN=^Ldp=jN4dH=Xl!&n(D0KlD~E(!5s_)B9)6&adfM@IASx
z_j|Ibg$-$UXz(mWf(G!LbC`%NbL!Xw%KzNz*dDZhhB_`<pBE7i>F<QH79n&*s3#4o
zNkY4vLc?masW+##gHkbvN|h}&vZ!Uw(XqyXpp*h|3zw#xC?!Geh9LJ89j}OBRGn7K
zCt%)Cf&v@PDzKt^Q9bl8-}<w54A(g~N5SrFdF-OmgaApmB`J_ofBA}F&f(+&+}D#8
zhIdFJ`b8GO59<fGLmTtk*cb6*IL=4Hi4iV|*#Hn+mO{E{VKW#bw)zoFri!x!q6A_D
z8VPX8vw?D(2s}z)CxI~lSh!r!IU)%7=<Lft!M)^hP>G|s^d$jhiY93klGG?GuxAMY
z<3iAX4scQUAS;%(rOP)Ih$YA%k&7h=m#m~(kZW`KsTX+Vqra-EncSQ4ExUZ^(xIzO
zQ;F9vymnz`)qHK+2eqqFns{wucJDjg?{wdIVlFUWyZ;wWw-W#Q!p~kv^$pK=jeKku
zOU{V*?85R|xODDPE~W;i)=mv9$PHPs^_}q4mTB+&ij6-A&u+b0H{a4Z#}?$SMGQUl
z#CviBH>__UzRRWkV3y7V;${#2P!{i>L#Z&(34?&{aY@S2IVic8)GAMbBEHMvvVwZq
zYMK8fGo1oZ1!f3ty_asDr#y9mn-IQecgCc=85k5TLk4``V49_4$HAL9!_^u`5Ka!M
z&L>e+T|tBhbH*d*Qq|iof!{z|++eg}v>Heen8?KpLpT?{T9}oUx!~9~;#PQPy!Yql
zoC3oTrcX)Fv3(3IFR(KJekV60*eT?pUq|BS`?W9(5@ILAXR1!qwqSn&)DF5OLu{l_
ze-vLQz(-h*z+NIi+-FEpZ7AWl8!p5q&$G}NBin~F<09{um}3i3!Vofz*cW-gIFDwW
zhnNq52gQN_R+d6?RDp6(JnZSEv3Sbg(>dW42hIu%OlLJLwAqJ5(=W9fo`@caAuNjT
z6x{IPybj~e*3xQ7gZR3j(?k~Ax}O@>Vz3k04x_PvcR8cCJQa<@KGb)#<QkC}(Xk2P
z4mdhh*Za#8r*0*#b<HH+K6bmQBi+>T+TNc?bI1PKvrylKy8q>ooj>3Fm}tqNPV_ae
z<S=rES3Pj($idG3{hhn^nnEc~4f29&Cl$FolCy@FY18S31RF}{x5g%EC@}(C%(VB$
zQPzn~NIX&EBFb!5=yCI1hN<y)0l0{oPF$b3K5@12b^l-b-`3yx@(;g!E0Iyw&77Ot
z_kL(-A#gl(qHiH^Iu#weXBU?-ankYonzhqy@7Fwf>A>VJ2&mh>`n0cp>UgSce|ppY
zl=^I@b=%Fxw@ThPF}Dp4ddVt8kV?8q7}ajP?-Z)4C--o%_Vq*Qy597OQ}cDb^S(Y*
zS5@a?S!BNCWzQl5A}4Yt#m{R%;H!x(_AnCyF>IC006WZpqDDl4e@<q?hOD^g{4B*8
zlvK%5&IO9oVTm5A4rIO25+FHN=m0AS#Y~Mr&VRxMW>bN`Z7-N9@4tDA`)Blpv^}>T
zVyn+TXI{W^^<CP-{tT-@;M`Q)Bz{aSO}@<?a(3Y0kUPar0~qen(1m_emw$zjBy`Z1
z>P!LiGUa$TiIcqH<=Uq|geY&!<fjqp<9@id-$_FdCz;L-`8AM^U4-~+0wn)9i{w2L
zom3HLpsbR2nICs_qoP1oWN~Cy=+^)WRQ)V`khTJ4KlQ?F!%fCD`tH1ne|~10X#xDI
zcJ-yMEI)8HuTOW+*S5ahG@E?u(f55jz!i0C{?l8&*!)gT2hA3@wq^XA-mJS(H}@2n
zQ#mUB5v&#vq4G<X<pX6?$@hHgxDq#9+3%+06i4v|G0G1i$6q8TbNn^U`3n>Q<kFO*
zQ}j?ps91c>_{?^8w99f^ixiVgzT)40q@aytKB8{<r~>W@W73M2q+*UhJ_=Pp|2ZX}
z$DQ0w^B`ta60{@AWe++mE>ufT9x29eYT05ADK^#?TYelK<txUcZfhHPrDjP2NS@EV
z)1Wio3(CK|$FLplPTDazK6Du3$!zvjLu_Dw11y5#*YRUG_;+B#mHk$3NRb#q9Tci!
z^aX~Ih0cxXYzOxDg!nrGZvq&i!iXhN%h`s=o)H6bR`k2f$oo!0<T<X9ibNJ{6abBg
z_Y4<4RO=KYnV}jQ4P-e!ihzdB1q3V(d<oTEs4zJ(%Zg4snZQT<MWFx_HG!u38~{Sd
zk8HSp=K7h}!m}f(BgbwZIfef}t4w`yB(u6<W(%04vUSq+QN4e5^w!zb;8?o+`4l^!
zF26A8`0!I)cJ0_q^LJ1GW7AyoyDh0*M^i@wDfMJ3@NDXtQ>nhte8)iMv9>ww_R+rd
zQK&Cbd5*JRzxW4Ia#L-u?MT&bm}y8=Z=BKQE4Pv{Uw*m!QukG9>cn4_EchN-#MD!X
z_k2y9N#Xm@*)OuQiE44jV)j7+$OX)~G@WcvMIJ`ZGZDgAXiL<wBn9ncKT~Up^82M8
z_D!_l6Jvh58A#*r5$bKqOQzW5SI=c9t&p2KbVb=v4b#p=wDU{uhfrUo#_IuaKW2d9
z%CSjbT5d*oBzq`RuIcf~?qB*IgT>&hG|#~fqQxVD5JFZL@Nta1EAEx$#1-vJ#vebK
zRxYkAzra-Ls@&pQBveRTxewb<9_8Z3i6<2vZqb7e@}ei~LrGG-9p@1!hC)z%L5W1h
z7CV@`sF*8u!UeI1;(cfdOA<X@;_-;$J&N38Uhth9pcAGP!pLfQ&_-c=h}>nHfKy8?
zLAOYJRP;=&?ZmShrfgPP6@{WUxK9dN?n$udqkBx$#KD3#d&tg?W?OBhu%Dvri$rM*
zv*#GbiYdwwu=tX(%&rpyJ%}Gt^JDSh;i%QfoI(k3B2w_p6y6BJjoBfvxIbm$iH_`W
zyYNhCETNDe6vG3lA^t9E@eZ@&#`z-v%sA0Dj>+ONJjxi&&TefVt68)P>yWY=TV}Px
zY6Ds#$zl^*3sAfBr~B|TqDGLEU&oypPV*ED$0+1pgx>0~QT7gMI8z!<;w`*nD!jo?
zaLSTXClnu#;d6~J;VoFvMCFpUG<!jCMWeZD0U!W&Ql4Zx{17~2F`cZeNSE-mMPvU!
zEq+A6jGc@it_-h*|9o1S55?o4nMKmVM12Dz=&u3b>uc5a%!+Vk`FN)4NM^<1%nE;I
z#ld@J@-ok)<Kqfp`z|qEwq;Ix_w1yEZ--a5ePhS>{j<_d=Ub(j<;rx`v@`Wcd#bVn
zqPH+Ex**r*$~9@ZX4;#Q@w+jH<iXRe)6zc$XPRf%&8|$ZZ@*<rE8Vwx=j)z*Pd=3u
zPo~amrw#8U&;tMilkyX#*=KU#r5?O`GQa%8%r`&(Gs?jRgGwVRF(hgOflEitAM^M<
zj8R@8paVQ8v7X}f;tAGimdMp6k(;Q=)h3c-QH|Q*(IFb1X8%Ghe+q!5eT~{ySkL=<
z4?&{R>!#EE!pzC?&1H6#y51r{GJm2r*D*I+eBcb&6tj?Kc;LZ|)`s)rIC<{}^|{^!
zOI*~S{fwr{ca+%=384^}$>q2X`czAf<t@2-`Z+b{77WMb#}qjy;CSE74amusH{-O+
zFNp|v>3Nj1&4g_w@EC!|33LM(GM-sNd?dzAYv%-2yhwo9*mN<zM>*1^CIkP3a$5<s
z5NIN>mcTX(kTlo75AaptuFd1{-wMLExo1Z%v!?N5`n_8%I7{!@M922~cI56-?hj6z
zqv5VBbc=_?%vSi{HI7x8YG_sZee#(<((m1E!j8S-CxXYZ7DEh)XONeXuYy%^oZ}w>
ze(Tezz;SA{4uzBADOA`UkKgr_IeNvL6}OV9fss!HD%|JL+ybp0_5&9gPV*a&)4XHT
z_ft@B-Y|5m;9q69`uoH2LGyjwP!i05_i>E$9NP_G*qCN`b8k~Mok@gsCdS9`O^lHS
zWlq9K3~w8`DQfsAOOHkA{Vad*!#`^o9*)Q7K{!1g>SH2!M8y1z=H@N<!$ex0)qoxt
zu@ai<8N%Y((CAnML$4-OBY|cD{Nfg0rXfFNzWLk1{tZpYWYfP5fM+zKc+X}Rr9aAo
z*!Vla{VT!!YoXyc!n*$us(vFh|5~W$|7!vNT`tKiTQlp<RMyUHpWBdGwqp9Zx%PW5
zsmyj?klgl*j=LVgS9-bQ>m8{T!}H#ei}J@#n|M&X=Mik)D@|!}<tH{tthp-yfKY7J
Vcd7VEDH9Qw`)@py#1Fr{{{u-@a$*1g

diff --git a/scripts/src/aim/ui/__pycache__/customers.cpython-313.pyc b/scripts/src/aim/ui/__pycache__/customers.cpython-313.pyc
deleted file mode 100644
index a7ac06fd0d129d09df7be0fc47007f1d006fee22..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 16650
zcmbt*dr(`+n%_BkAPEUcAYSHqco}4D;W79D25f9>z}R4Okd2MU8d*AkjF6af1Q=b<
z?5)~V0-3!TsAS5_?ret5y_GOksam!wf3Q`Xjc4{|<4Nrw=Zt)>*c0E$RBdfi^B;5V
z?46zaPrk3uLm<mDH=8bK_37u=-CuYAzOTQ2QBaUif&1Sde)6E(M^S%=ADS~M0s2J(
z0v}K;#nQvn6`H3R3>$_Gya9fV!^SHn-bCU|!{#e_d>#p#hb>pEyp@FWhHY2!`Fs+#
z4BM|bcn1kvAx{Bcz)<B>J;mB8C^rA3L1~qDP8+=Tukpi6%l2R_7Ec5dk$6lPfp6RG
zzH3)6@qC<z5BJ3dArYVB_<n9GxDZVU5NGWhx~8RDuW_-3p#(Pv@p%_#;*k&sp`y`w
zjwdx<48}rSG|GiTO4EvORDS3e??T`M>Mq68ECoHLc_Zs)4HeV_=rvo&8cE0uArlGZ
zv1T^UN3%t&1-~B{cnj-ctt8FL7Gp1=q>asI?U1X4b*Q=Wp@ssIW@k%TCkZ)N7hf=)
z?=6#ES|8aE&v7x~YZp)zq7@p6?*JcYre7E!_5;dKjqOX+f@5m0v~T=9seX8<o3vnP
zqXdJ88az!=F?!Oh<(nv+v}obi)NIqzGrxZNq)H)6AG1SC>Q{%sPj}EKRa&kau60tB
zonok%Ax1;(gd;PxU}&u1;5UA;2G+=$+6;b!R#PL;&cJ_+o}#?wk?(9XaUmi2mgk~L
z7t2MtP=X1mtRh>r0hMh-u|+PHi1W){i)_;}2(l>}5fZ!=T9S<rkWKT!#EfheNJVj8
z&Qn5OqillElx&Ix=Q!CCA`B)7*gJ+{<fCm|BGeX)36c9zu1yH>k@<wsCh!m!nQL2!
zwCOGS=9lGy`ABFsphd~m8kOp_`wk?#p$Xv~@P15vRon3KyC1%ru00{uo_JQ<@xn-Z
zPRX?$Yl)Xes<>jK@n^zT$Dj6o(wlDWm0Eju5~<eyCqI%}$5PF#$c&4(CdHd?{?c>r
zZ)-dDjFip2M?v|oT%PyeS$!w%YLHwFV&lo3{3pZW>FeUy?Ud_|Xub1~zcxcI0lDOl
zd;7Xgx%qK}@M9bB(`z{AdwFtj1US(EC3Rke)>H>GuX0q(=%>eY4%N~rYEtLQiF&`0
zrLmGp;6%kii~(crgQtZ@Y1XLK3UMY(?=bld8GhAL8S2_~g>Qj6Tzy$?43}t@W6f<8
zn|FhTm7(@JX7Za_)Lg+<po1F2Y0Yvm^ThcmvLbOcn9HMmWq$pp3~dwFGx?{fX{wIe
zA2UVu7;C91+G`n+Z4r(CWiweYGJQ-oFXB#`bYI}(O9H1a8^LShv0FUSD4PdyeaYsV
znAe-n7h*~grdWkoa9)^+C*-`~{5%&6lXb)+&3p-ZrI^bdTHtwDdKrE%&^SLZ2Ya?R
zk1xZ_htMm>5~gr45!BWo7nY6jXjsUD6j*8C_zKKaf(uu#QwYGCgDq2T%3e!3vms%^
z{{rvF)NWDnie<OB{PD>8NV>RLDsKK|v3I3^*HiYmXT4{$IORDEUk=avBda4Ho!V^N
zN^B2HZRda9fUD_lNV*l4Zp}XlKRx}~oVd80x{%zXsCVc-1N>Yt3>m(`uPgZF9Y%k|
zFor+Z4C96u6jkLn`~yW5+%$Y+rb>?N<xxNfw3_xbOP*%2rR$6CX)!XN^1Qub{nGB)
zEh<eHHA_X!D;IYgk3MtM?HP;(M|a)DX?MNkuHQWK%zgB$meyamoAwGQNAb6N4$6BJ
zzP=NXaX)J*yhu}jMO!c0j0e^*avbm}{o)Z|0dl6O>kZ;{r=1@Ra%GOS%+jnuJJm@Z
zTvAyMcXB*8JB_(kvDO0YAT(<^3uS{q$27L5uZc{BWBU5e#AQw*LP4%lIZl{Nsa$JW
zqpC%1=Jl&L*IH$*EMS061EB|(M3&QPXOw=rvy$O+4A(}MW9_U1&Q=3k@S3st-d=VX
z+78YXF1#$qI$@q%od&Jf;qRM?%B;fhnHkfVVZt4CYB|WBmaCUJ_Bqz=H#n(w10bd%
zbp&g*dNRMjD`wWCrstaRx=dazw2wNY-#AvU#b<uCeg|ivFVt9LCPfR49o9mbUnj*D
z=dN$eo5`hxw7G{q8sU7%&E;@bWV?yt1MBQ}9nBKIiHv5c&X2j~z3kw;2Vt`Z%8q5z
zuz!Xb%<;Xv%|eb058x?vFh)P8%14qV0O^@t<|5Ap6PXh!c}0m3m>?75mKgmo^D&nm
z!Z{F$P3xx@6OQlz0^@vygX}y91r|A;;ko%}FvNv@$p-C+U=YhOEtg^mNN;0~Gl@78
zB4UD9rY?VCkS$?F){q@=$}I)dufIg$g$Fr`lIi2gk@1;`kZC*^1<J$A42NV1J_h8E
z7!yfg)pNmF=+R6tHq8lVF>Wa+Fd*<SaiDLBk0cUY%qLrxf_x16^9e1Rqd+;J+N{Bl
zO(Q^e(xW3<y~oSR5;bpPKT+pCq50!LZn8-4d5DZ}xQj_T^*BN}Hk*hfq8tY1g9`#D
z)8~^lBQWS86;(60BC#+421Xr^E=D#*VpH*CjoNrH#&EF^zdWDd!VG~8(9NZDAmEro
zQ7#CedIrXb<7Hz|n3c@{yCd@iR>;o4VlWzk<DU!Q-0;OX$a%_G%7%rAoX2wlz!1Kh
zB=Fo~gj)hM9*<2$_&I<Yq+0=~aUqmg;5i;wsa#3Yr{P=23))-?azQj64Db8IkC+e$
z$LE5Pn4G5+1qR^wMGz?iFd#fkOneD`$^|YFSW*TfpkjX|gF_{R;480L0XT?llpa~t
zkrQOQUhjO2Kx_m!D#CH8m1yHG*J@Lx$q88*nxFyUf5KJ`sK)AeKYum<4;&b<uiC}p
zR`J;KGi!1e(Eh{Khhllp6JDHnbLFAvx|eo^C097*np!dK+Ffg%DSOqfqX<hnSDk5V
zlVok$3_r8BLgM?qtG#J^jbyLcNTlqIX?v?=Z%x~eN%mvA4)^;5s{@FW#L8Jwc(gJi
zIo`q8E2~%j;Hp}qWz~YUie)WZm$&=3dd2P=B6};%1|>F_W~U@}N}Qfeu~G5toOmSm
z%o<06AFVzTtJ-(`E02EZx`-7)+`Fsqrd>YC<=aZ6Tpd6;)A-C<y=QRPy!$DsZre6(
zEsB+=#NH7kXcQ9Dj-!&}=+^j7iHM<dyJeM+-(7z<UDhs@wQu*Q$~spDcU@&^R}=j0
z);0Zy%0H=0*L6yDog&k<Q@1mi?jDo6$I{&sQujov`;K^aQmnbVW(Oqp*tzaZyH88*
z(>tbT?kgB$S+`)USa<G;edisq_L}IQTysk9yL!*MpK#c-s|3l_N$$GM#%JzkedNAs
zY+335g`@7<&3^Lxoq*^2&yQd18azQgJz*O>YaHhhFNIXC3I!}cp-e<j-Ct{{4kEH$
zE+lv0bfm_hbhgWd-Vpz>M)e%l<*`gj)&wVG4w+v&%W}&8W=+x|=VPu~^PpB8U1VC*
zYK@s$ODxZC*3a{4iXs>Ug_tbITA?nKYqDGqt(6YL_<}~urq`ZVLrvlqMcfz)6<MyH
znz#u#4YWX=hL~kiKXLt*oK)kyfjf{d2SwVb%yXnKxyHo_eW_Av+wW_X|G;Ql;Y80>
zs|#wa*<YU$)@qH}ChN4+iAxhRe%nb^3W()T{IqKV5ItZ;sQY*2DbT<vJT>~quPN1_
zwU_xtyy!Q*GHV`~hvI#l0D1(!84z2EKMxTYXaq2a({IgL(&e}1if=Q47O$++NH7p?
zzgdnghq*tL!O_7pr2kpD@N=yB)yRnoePr#g>3<Gw2wUN|6QozkR+06nqj(j~d0%Zw
z!=fmMAU>N!5t}#*6@;^v^zV0_H3wVpy*mM{N4;O>%#4IV!pGHGOAXN1<|wL`8Z~Li
z5MrK#1YJFnyrH1AS&o}WFc^*q0PB_kX8>?m;Czf9^ccqokVB*aC~F@=Bzg}85(4T{
zkXYEq_d-W`9D!s_zk>G|%t^qZ0s|OfVQMP!P^NvEEO>AOY>aV<r8qy!1jAu~CIW$l
zN!N%P3#oH}agqfmPM-8>|Hm%_w#q})6G|j60E$D%!wg+t?9gg!Q_K07G42?sPN1E{
z3<6ow)>-Hv^g9TeMgcp>cOdNref>=T2+JrGCkx>dsJJjRsz;Tny;D%}LQETgWGNe5
z%wTN|)(PLaQ1e5ELFs?e)`D;qP>(n1WDoTJJ0k$-<el*u4#porx3Dk`Fqf$EnW;FA
z(-ITcbn$?Tb=a;>N-WF(nh8T^Bf+SO+o7$w$TX<$0kwN+rJKcsRu~OvM?+EPcvx0c
z(yjMTfc^lsmCcwr%y&Ynw?t7~4MUi}gx+QFWM_OHX$(dYcrI{qfiipnb;9$a1f0q)
zb?5`?G|Nt&dwT)ojIdhHqRtrT+2*x8cAQd}1LO~)6qECBVk6|ng1?H*7XsRZlJ_HV
z4RP|gWAX#&4PuT0?28Uh3GVee2%eO!8ZcDQutn9g$$3g2__wf<`&bE5N2tI?`6&_=
z<^-f4;5UvD(GU^rsd_}o#$Um#t*^jNgxk5{bUzdjSU4w9u~z!nx9&?9`J^J>*27fM
z8PKx<rqmJO1Cf8Y;*_k*yM-m`!bYjEQEa;OWGOvxR~opRDtt3t7?ujdA~%yNjI8AC
zR@9^`j!6~AMBj*b{Z{(=v~+zsRWY;TA{x9e?G@1AzD(zyl>N8bPixbCA#psEstB)H
z_6)Ydn&&mm>6-R0YTCC0V#kPh>#kJu=GwsXwiDZ@)9qKJ_A9Bj;lE+U8x!dpZ%H@a
zN?i+X-r6lbwCAJ_Rj12arSjIT(VbiAo-wIsELF~?%kN0#cf`qisq(-|!EP0ku4<F2
z+Qj1*pWI4cx+h(_m#PYg)<e&W>NijA42a`gs%Q$v!CsWISMSHEl^r{mS4O^YT>NT3
zjBej8tlzwxZtUEe72RE8&o$5%Cg_U>aV#j_xG&!4#Hl%vi%FyLJ&GCvog)17_zk;-
z%;vFleed>J(S1(5;1_Srq;D;W(Iv6(;hx!e$_bjr@&vtSp$aO$p^OC!^q!S+7b`gX
z#Lgu|qZf9|t3Gyq=uDS)NaY>d6RGlnHS+;H`^I+Dc9~e)`J@ct?9i8Xw+dN*auseD
z9EIP$Y^KWVUr^@48q}{2tPh}$Rcx3R;}6$Hq~hh>!$;DGJEg;&V%Ht<?riFCbZzv@
z$|Jk=jT@H#QC<x?(W=%x3l#tE*9DZPOh72~*|BqjWz^HMb3@g}&#P$gb<_)~6s{hE
zddmSz5nU$6X1O0gy>Qo*3!!Kzkes51F*vQVot8t<mH{@jYB_Qt-+C%{I}n?rZonph
zusaQncslF%5O6vJ{)`zXb&Vej8ZA8iHH_#ta&UheGxiy$;J!?~4={~f<^hdS$$IVd
z(Y6w8Pu0$vF2-xww{gA&g~*n|hcFaIj{^@b42TYY1|!D6la1WNkbsB*_Y*~9Uzm};
z)%{4W%idaE$$~WskHCWs1yu6A>%D1Do8)QRwx&FtD^?<=HK$$8TMyH1=im=AfmYl$
zMnCsdr9CZQcv`kv(nl^xM=m@WO!tpV{o|t7FWw7Dp0MZ$fBW2Z=mkY%_M$4Ww(m*9
zlM=CdAXPN@G$cB1{C3ZXY2OLuK)|Qek-k>y)7Jb8Hshx!T^CHo&rD_rAK*WnIl_P4
z|3Cbf^Bzo*uvpU%XwPB(Su@d|gN8hFGsfm=9KnHh-ESm0P`hW$rAcQkTJA=~>pFKq
z?^FlUk|C!I1A9NZv0M_CUh9GTFht_Ovp^MUD2>n}{CjO9$-_GS0043MM*m1|T^+$(
zm-#kml|KPqvINV43M#=btNJ{+_V@9(Fs-1UD0Wmt=e6x)?mn#G0(vO>fT~GROudOQ
z_s|P~rzvwXoNh$~L$p;7AU#`&<DTc^bMuJ+W(rKb9gfLNHqU40;IW!N0`D~}56j@p
z`WdmR|LJ`(5MDbYdbqS_R`SfIJae!j?4Gsdl%08A1jlK2s;EbF^z7Q5Yc21=+NgYd
zZvEV5dkQX>9L@T%yBXM?NuRnZow}MTyp}E;mkP&4|3s?r_DbHD-nO-twTg{5Hg0YV
zimoQn+Os_Y9^75QU6vPYHi&W#^p%0gyuK2E_cQtj+>>8-t8_ruU<~yGCuF1*kTik!
zU^Qhsmi8NPFU)mYtVuG2Z*!K_IQ#oc!=4HE!7XajK>$LqpX>W_t{W-b&$YVYCYL2E
z4D|Pzo9N6g4H6KJ5x9MExiuMTzGI*}(aOY3qej0WW_sNXF`far)+Vem)WYZ*3xxvo
zA;k<SIW!oMlGm=UTjq5$0&CZAVyUY%YlZy@PvI=5%?oH_^0ZM6;|`_o6QEa7`wBZ$
zzCVwQA4A3+@+s~IXF%WOw7ME`-t_&;pT|0M+0*K`vd%656~TjaxU{kyy{}}>5!G_~
zt;c}Cn9XlHPy&yQET@&|`ZtO;WMBW?ek+W2;p^t1UBCASx_*cg^|3_F%UKv#)V%C#
ztH_`KyS4@N=-PlxXIM{H7t{*VI`Pw7yauIm^uEJDW)<qo&_XD|d$XL}*RI=XK(BQ^
z@aJpeNbrz;2L^ZuMh3VPRtM@4M%FdV1E^_#E<{b13=OQEXo2+g>$ecpWa+bHP*YY7
zz_$l#D9|X%Rn}WFlC+RhY3RBltd>rOBXe(R`UVvbbus)T3~|!Hv?MLw$u`WAEG6Y)
z3v>5D4FCt>)Iu~0+5&RkCCf>oDseJ!5v9qc%4t`q;X6Ejpimd{HS8l)@`R#A2{KSE
z2YLvi@W2nXjiA;F=p;1F1|ICmn*GGUT^Z^F?xSX68jS1~xuj!%deVUu#TODnB+M~M
z&&6Ogv=BvcUaOS(8r6x(I?RVv1(^k+*HGxuyA@-+PX2Ak$@ig0&gc+?WFlhssj3&e
zLzayZIQHMdT!>3$%N!_Wg43KL2RoM{iJ8DW&w(;03dSOZ_j$Pd2?gP3R@;(odaBpH
z57RDVjk8!|fvR=T6bAbFhc(DXKDflsV?H|$c|aLbuxwOl3;=bqMg0(voe>_ZPC?1e
z{cs>MFV}n@T!_r0VVLmGU~Y)Ooi1vTidweHQ$;6;khyy9OIHP6Z#-OoxM|xyyY^5l
zJC`oIB$ZuCl?{mQ0mRe*CN_q^%q8tPDtV5kJU-Fk`>MQZrQl0@>7Kz-aP&FjO*1FI
zU`}q&rkD$B1-l+5<!OE1*!&-jTh~%8U4OwoDNFZFNPQEjp4(E(?NsBP^=n@>wyj?S
zvC>xXzGKy~>ulV-m2T>mn!3fto*gKF!nt_<hIoS&$0yU{52W!2B0DS2@}fg{X*AgK
zK}LmZo|)B|T}R_?aoz5r!&_nT&<PM)U1fWe$(8>bD`j`DHoe!pXQOP6f5@lY9z^lg
zr$N;qI?j9rpr_%zF0_%kL_aU9_^2~odHjpY<J+E8<;hgpDbamu&uX;YrJq++Z-h2a
z{L#^sVQAA)wo&-rIZ{zis;F0V^gb^=w9%ZdctfgqBUO50dr~Srzhd9Dmwx2gxRtIx
zB~_nF9Xg$|pN29UkG6)ldUhNr{7*`kCdK}{V)dJ;qI;s_-t(eLu-^HisCmntD(X;m
z0Chy}0OiBBcc=TQB|Ugg8oVbC1jOpMQbj@05d=*^+Fm8ut2PZOd;R8;qNI2_kiN=E
zS2^*-RH}Ij>e#ewEQ>8ePn*+M-jc4oB@P9}>iel85Mn~lT}5lB-+LrlE5ChtiKdEc
zK;QwZA*S_T7l3$EaP+q?>(xjYrcy?1=-6hrFNt+ssnWAgJfgcFr63r>-@b$qu0UxC
zh78B~MyhB`oR}0HlSEFs3v$vBaO0;9eda+Q^_kZI{?BV`hG^>N=Nv=z)Ki~hu-Evs
zhX((1I)A9v__^IRRAKzQ!i?ei{GlG>=SLkwXN;epF+=!(k&-T0{WTnBuY;2s$ao!0
z0XUfhnh?QSH)17abEws|y3ssI2QWa(Kg~di7(42)1V&AD0Nseui*}e0YI2zvn*20^
zwss?%$663{#f%egbS=S=41ne}BAX5h7;5x5<gse4W`1*tZ5fbGsL4fjKB2~*Ijl*}
z97a9bDB?wf*D;cG^@E`;7<y=%97q%v0jxJbC!6e^1pVZj#JmC&$8*6LNOaL<&`@9r
zfoQ}-nn{9Y^Re7D*@mU^lX>II^BmKhbTpIO0L4OJpQxCuy{K7)`<Rh97)*c-30h?6
zYVq>PX*4N>LmC?d{j}Ct(&n3NQ_{d5@*IpFe;zzJ|2~>fgm^ecd4O9Kku7D5dL;9|
zhf#Qdfrge;sc3Wet4<J_gE3`H0P}(@?TJe%qbo>WwFbz_@Mln$@K@l$$&h6Yu-5;0
zbbVAj+Osw)7WY20qShqsX_7omAQ^(Gp{s2FC3}<PYTBGhx!T~89V&v|Tr2|t@wPaA
zM=Y6qX1xo7<m2-7@{P-zXEu*)T@@=jpPUfKZ?Bb$g?B)4YcEuFomW?{iif&>;W&#r
zPB0TlJL)7y-Db-(M=NR$F}bpRdvLpJ=eBrg;F)7krTZri{vq^37cU`9As2#pN562u
zioR$6r>XiBgY}q!2vRwAh77mDYRR!DKx~d{QZPx=4eSoAV;#O?2NaiCTQMV{LQB~9
zn@jz&uN(+oxd8Yp*OkVY8FK0%IMYCmoN%qqnsGqp>;TM>m$O_(ouuuBK>+nI9yu<Z
z$8wnM;hx3XRC9q`W$LmTgijC(jjSE1f}PLNZUB{N0mL{l<~|q!Og3m`v{-HQ;d0jn
zx!r8xSd*3~^Xs>Fz(Wprih<YOhcoe7XiV#(76HE={XvD+2GsBIo53&k=Yff(86JI<
zlK!bQvt?v={(l>#a`uouO0D~vSA&x%brQ!`z@=-YW^TSOzKX48YjVWbvJ6|7Bfg$(
zU>kG9H?fCv#y7JqtT#vgBWx>sREuxZ6$mkl-@+avrU2U6iH3ApZlb6IW*27Tcvb>@
z>S?Iz%X0YOgp}*ZN`OyTl|Hti!}vYvZR}w+{nV@F^>)v^E{#3zv&5_u{{s1O0TB88
zA3_g6NX~YkD6+ND{`?#C>AX`ELk$?N!Knb^C7j%f%NUhR>O%3PE>3rtK+J{R2uxAH
z%whf}5p@4n6Lh_AjPPg?BU?w|ej4rLl1@0@7~KXgoIIjQh5Cu6-K3rc`4NjSK6ti*
zPioKrZXt%|{~(@mLNcHn)ENUzMz^(tgE;{wH)vWJwBcNefS3xx6uBpdYihk}Fnqkv
z!Id!F5vyi;!Kh{yx$iQbJU-xwc<5nTqVW*P#f4^>cr3c?<?Er3Jnk&A-5(1s1|w0t
z5Kk6g2LTgmpJV1YlxBsQ$h?p=Gt47~IRGeeJ8#DW<T?a;=>`~1JVfAC6l{0#LfB%c
zal;r5iCGR9iPm&TsIOk6J}|>8k!t0Y$h6@!+_ZR&NdpM;zyw4|YMh2EbE9nV9hd28
z{sV|r9}fLkk@;-h(_D;uIM4UW$CUx*c-_WNMIGd=gs+<ngwX5LOFYBc(4^zrui>N@
zPcD9OXF>Ge+%fK)*qQn-5B~hY)552HsooK>XY?1Ru0!HK5@7NB4TtHZ4U7cT%i=pw
zL$Xk7oS38{BaplEqy-=1F{8uDYrr{x!r&DZD%MeA2jPD{$O~lF!*h`szNRAY?U*23
z=}$$X9E0^BxZ*i9sbuuIQVbVl`i<n_zHs;`@RTqQ41_uk$O=ZW`?w5+X+fq>$a#IC
z5Qy~2!z?>UngC<ev1@3PurLoM2*Bkr1wJysu2`g<$73Pcc#)Wf9%Z;NFd#IcwRRJq
zwE!yy6AO^LBk3C8<51ONkdF`xi)6_dfVyMIbPO2=><$=z(kGKnqU_Lf%JeDO2JE+d
zKOUbIl3w*OS|Z59^n*zQj0e8}{htR3AFkXPG+ZHBW%{)2>^m@e$u=+*Acn9<u}?x=
z`vB8sG#4hdL8rC*I)MjX1_U~d#Di*r7i97-js)Qf@83cy|1o-hg5JMF@2BYf484C3
zp0`H13i($UaSpxn==}t}M)Zc!BL)QbFoXh`Y#C)0YX%OZOz3@x-X-)dgNG*630Rwg
zVgO-!5Rb(8Ynb4I?vsTYAT+~EJbVnq<Fb_V$#fHr2h|CgaOER^5ob#YJN1EAzxDA{
zzCFPMBdSE2U>k|51{C}ZQi+h8#}l61Tk?2^1I9Uuy-%L<%nvj+L?Qtir@(ARHo=Sv
z$}+~ASWSNezvsz%=9{sSS6=mLyDg#QGsq(RIcyN$0zB8uS#_kn-72|y0B$>rbSqE{
z46hDvm_BxW=-RSwA4!$>JahD-0teqIm8U#MR{Hl0=7Ldrx3c!*-Vb}zm8Yf3(>vBw
zW#5{0_fTE>P@8n9Eq&;s*nV*>@0AG9eUw&gw5;D-xr_vXk?@8k?P4Ssv+ve_54ua<
zHVqj@4QtMCD5~(f0ZBv4-_h04-NLHP;>}s9?u5v+i|v=i8qhKg?iQABo3?NLS%GwX
z=%a>>@aE|c=blv@efo~*esj05d8_PCt3IiEc5+d?b1!{|lkRZoI}5N=rA{uUyo;iH
z32NP#65UN=OXtohvH8ND&0Ou=%cn}cdv>az>Kn>ja0DJZxr^6^f!xiZl<U|&n#J0f
zxcGYtv3-W!l0%Pguit*|F5mEMOpDE<Dfe~dV@7Pbo^s#NQ?8}lBjiJ@X%pWVOu2{D
zFQ0gPAmtuZGR}&vH&gCgnWSLKeSgnoWt=Z4YpHAH@?H_;F5U3F_s*`n^sCZ}$MN;}
zmQ`#%EtZ^lVoIOCE}g$FvXkQ2eeqmqS4-dgkyz5c(~&+qBAp!(Z`>9q;UQR3y#6Dx
z>k(v1mwKgA@7Cb<tay<XTgSx`|GrqU^{iOZ{iHwLe^&wpRA5@X7ZWeWzp<IioGSw`
zP!)9_)~;T`XKn8HhyLZz8eE0fZ;YoL^}imaLFxAGOE*<g{n7N#lK-hw^uS#ojZ9TP
zBDzP`^8T<C)j^}6>_PGV)5bnCsCGWDufAe5{&xcnK3HlYi1r%LSRah=W8dY&nE>bS
zNIb@Q4g6o=;xLhqJY@-DMT!lR3HHM%$-)06)?wP00m~(;bn`0TKI<y2^6czn(}DMe
zWTBH*h#vPpV|!SglKx65(zH{y2FN3XKtRq91m@!5g(wGMM<DR_LNJOKzVPJ=1mNX?
zkcdV=I}r~A6uBRvIzNsc+#6Dg=6VrBtLUwxN4AKP06bNI(=rqYCcqr<{sNp?fxsse
z5qFiX1Z74ZJyZe-ec=6b>ZQSGo}^zo9Ok1hYpTrNy<TdV9;JUn)tL{y9HcGgG5Te(
z)!e&R3J>{5ApQ+=)yo;$X)gIqz1Q5J)Q)v}UD&m$1$-(2w1YfN5yK9-kY9lQMSaV`
zxu}oB7x-jzmrD>9YWtYr1Dy=&)_Fv{vJ=z5>VqQ|b%Jt06k_B;#211~aF~8TlFAP6
zR^ye|)sc8ic{+;HH0dq>UonJIzk-mg-O2>?@_z$yh{^;UWMD;_{uNdKca;0@sph|@
fPW*~$_&<3R-3-6KqK^H>bk|5X{F*|aRQ7)X`^Q_M

diff --git a/scripts/src/aim/ui/__pycache__/execution.cpython-313.pyc b/scripts/src/aim/ui/__pycache__/execution.cpython-313.pyc
deleted file mode 100644
index 94a4e0b6687eaa05abe614da0f105fd8fcb7b8e5..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 8081
zcmcIpeQX;?cAw?<Hz`sUX?<8LS++#kr2HAdpR!`fvZY9JxT2Dnc9<2plGdh{%<R&(
zRKqd)M<E{yNNV6pLVJ)84O#^aa6X`aC~bkHXwY+m9zce=6SL<_uh;7x@<#zD&cUtF
zKl)~uODc*|+yU1CIWs%+=FP{xdGGh$K65&42-2^Y-@T4@A@uL$K}!a;LOuH!Di08Y
zFk&c1H$e64u#P5m{eZsTfDKCBFktLAVUtof4w$hS`i%n?Y=P1=VC}bIo6=_<u=hK#
zqu+_0%Clv_)$hh`8eKI<Xl?3B*^C(LaY}v0Ro_ZuE7N!x7h|tQ*A3VgKrq@-ix}r|
zU5P{WgfZxz`Oov|sSKNt=yX=fWF>k$jp-Xg`j$WoX@M6c4nrq@lcTSv$HY^#z$y>W
zJjDxaN+IWNa(G&r<b?^EONm_AW*Z_+bcV$uM<>`+YK%?X&?b=5bdpoYLuYzwiWQQy
zm`x-&QKVsVHj_#53794=&`DNe!?xbryabd<PNWH~G|AC0h@IfD*h-5M&L*TR=8`n#
z#B2(7z^8x`b5krY&}>$kOk-YBmL0ZzPWB$8WIHPeY0{V$M0hkNxi_;MX&17oR3Z)A
zzAX*Gv*9u;O$K$cnY+y;vJxjdL@Aw#XK<P<mk<!j8UNMWhsUnQVuwOq*V<!rr~~qI
zp}W^+F12;>!M3iG8CDc;rE&5OsbnTGD{^;4E`d4ej+DN^33oD>zsX8mEKY~6b=}~m
zgIC4&So77^Yh9#r^31hF>BTEA&jh(1A?n#n(E0$yltz+8pmlp<s3_82x<GXxLC5F>
zeUyqAw^Jf?ywv1F7snA242(W%I0bF&ZiE;^sqTZi5jf}~=5KOfOq%%7D5`HO5wIQ@
zV=j%iY~cmMNLDj=0->Gx#eiB(5xZ8alu?5=TX`nJ(K1X`dT2B_iI5%9aD5`q%2=%y
z)oDChP|!B>X%9Ef2_g~sBrj%C>@<-m5ZHq>k*8#mS40!UxErX(Qe3MDS0$cGPtcPf
zo+-Ena05nJB8o7YT%p?%%>$8gDMU_?K!kBRJ243*w8I_9qy^H<!Y`Ey)0b5GG(6fc
z2TT&&6zL~-vosZ44zjedboz!!-<sqTldw7oh(Mx&$21KB1tUPhlBAJMiD8?JE^OLE
zB)!<%cWH>;^jwZy8toqGr3ZRnQ`$#1cg0GQNP`g4=_y{4xa74>tJ2*&)I-m-#9)gY
zeT$bSx3GsZ;!?@-0GYA{&9X7xJ;Yp+^<s8Rw!u;I5*aGWCb;9Akd)1FruTfLcSJUc
z9E%f^vf+A~7lKCFq$(rXoJeu3z$ImqdbeeBX?3ze;Y1{uCP_Zn!AXe@R(&HKVgmCS
zN$e0YwDD6NS-wNPz;HU@%(QG5*>NtePJ;IU6VUfa{4Qko&{q!RuAbxX^Gmv=3kBES
zdwoTx``(43%Lg@&f5X$9_cZ^+(=ux)+5<~H1v{PF*SU7Au&=9FQ#;#Nba>|m?+@l`
z53f6pd}j9+-L*@}g1b4_dSY#)(Ar(BZJalM>ZmSSTyxI*&X3GLbp3<tv9xh+BoDuu
z)440J|HKmiq6$^*d+J3F&)kXoC+0^B_WGQm{uwL~B}k^F(siev9f6hy=qkb#*d`rA
zVLhW`^kIszG6rG+uIsRYG1ek%WK58o7_dqcmY_|xg8nBeIC|;xcHnV=D8Up6f9Z4*
zC2N6*`XO~i?GVZb=v7Y&N;SPor^*V7D4diw4o#q-ZU~dR8`R6XERXj>73N??sWb<)
z8$>QOj`u;2(k+sG!E410gw_&|^8zo$<FdEB*s#`i04PNA`tG5kxB8FG#k&3LmO!zt
zVb<_tO8_@QPoi{6WbKHkEGVgGe+xON&ho0G6hjet(v(4@yaQ+~CBYOmF*>3U&rq7e
zNqS+aC{|XcjJ_5{DPLKYYWxIq)W{f4UfepCWysj5S>ttJ3tzTZ=_{+yul02*eTE&!
z1(m*?m9tS>O=bOTl|qjq7HyZ6vcg}mL@nAA84*Q0spD6@nxSdgqWqIQ(3jVm98*R+
zDzj*{h)b(g$_UK0J;lHPsfmI2;R3^QRL@wnnYA6lxuVGLXBO*@-1S?|Fsz*6&hL>f
zo$qhEmTGNxl~S-qt>x1n{+-UxU*V$FzHxpwI6u2~e&2Fx0c~`pEUyS|3gZ~27$@U8
zp&Pcw>NFY+P6)QBO-F7Cxz9?fNQ$Uq08cYzh(e<l)PxQqje8Pq=(vtXjWC`DZE{B6
zh{ma)dkB*YdX^w_urT7}rVX+XSgi?8*tC;+BAuBI@yShR$t;9!5~KVzAVoC7QKAic
zpt2YEKLDu#@KXcehXRd&w%v8O<p3j~hqT{B4~zgV;A9B6n9z0VVO{#OL=$Z4LId!>
zv1tp1Sn)=Pz`jk7T31$~wp6JtV;o=rPHCDkp963?m63+t1-&Wj!iQu7FL6^M*{r4z
zt*2p+-0ciLEAQK?5ed|e$HS*nX{d>3!(}pJ9mEi1pM#owiuA8jwqFG5=M7Kw$XS)E
zekJdCWy6um#ge(nR6dqkcckP%{eO$(Z2xc%O@SR&odj%!mQ70}D}ZY-LC^T<J2WvC
zblD$JZR(5_tZsM;0CRF?_`HNu2hJ<-1mi52Wd*?lM`CuubcCBqOW+9rc$y#xKZQ9q
zISmLu$<Zw40PsjOPNz};@QE7{p3#TH;Y~Z4paj%$J*-MLB-4`kF056|@PfeMpc@mI
zEE@!Nij(!MFfHpRI7u}>mbkW~eS`+~Cy413CmR*mq-;~R^I}}v7a$by7P6vjWW@x}
zWActMF(pAeZdGPs@dN;y8@H6wm0&Z(Cn*^?*)3)>8GtZiT$GY<M6x-{$EU!fQBIbe
z1I$+OweU&8(!vV-6!-*5+y{>$v7lfQwNy5Z>P!E+X;j+|kzq3wF^x~WHS^L^_rk5W
zLmS?fytif6T&!uxHI3$LMxP_S-?o0`+82sk{9B;@nUM&{Go+7EwpsgA2db`H;`6@N
z=ZLC~QIG8J4Xd>eht|(U)M~M=ecj*wTu%s!9ml^v^X|;r{z6B0sil8tqyI|2|H}G>
zD<E=K&#wR%`TUD#7S24ZF8IPZNBA>$!(XP00C)QC_stF8AKq{@<sD7$w5$dmwLaRN
zJNa_1HIf^N7n<K#cd$Fq<yvn)Md%Nx3pxNvd;4@>A>_QMD^@peRFAHndgm=D){cG9
z`F`gIUGH~ooEpua8lAQL>eV-3Io_H@|AK$9aiMXesx@EL`krC+_L}+8^oROfsOQ6}
zLfc63<k=5e-*5dO^g-wcrpKdXOxqWT@<ypA<8KzmMY1RNFPy$7zS^Z@1z+29J#tmg
zjn0j3ibU!EQ>VSpq5q-7)>msTV-aXaB;KH4ky;R?uVIn0O9F0|ekZ3cM((DPB1Fo!
zr7gXdZC&t4A{Qt0ppDB86=*s=5oyhK?qoLwL(Hx5VgO5?paj5@QG*K|)d?nWE6t2q
zurL<De&sp0tOHQe_S6hG=@@kgkU|gj0tGe>MRu@#5zxikQv}@6?WtmQ0HayAShJmY
z5{<DfY4(OC*31Uh%+5GY=)iLQ_NyYE#J04RYt#m|u}LE++eZ5y6txrU7_~;4wcbie
z5V#+4)Xu#=)JI)}9SV+Ei#8@gG}5*N@5K=TWVk(PtI*C%a5B!QlUO&!<#(0pfVdb6
zFrYC)@b<RExHY+fJycL4arr%^@gNb5#*3UUNXp>r2*rp^Qc~2Z@c=APWk7;!=eeRT
zjSl8=MLM+cm6Gvl6y>vj84#0er`<C?jTVso@8>-O_KDhdys^-urmga+%@4PcsB0xf
zh`HXDAbM8~dxx_lN!wWxv_~H`2zk`J)0^3PT0jR_kRTP1B<;1U?37$<65QMI7_%z^
z{>JtcE&CE%Z+yj<VZmyB%b7y3XM2hfkyBFCteuGuje15MqP_!(Iu(;;VgG^$Wc^H;
z+QZZkA=1V~9mjN+bs8oU^@2n2Fn%U*LPw)l+}gRZa0|a>ZCx7YN=bAavpedBy!NPp
zsblI1x8a80kwe2#9kWLryG1XatIVU-n$fF`+MAA@*IJ`i(A$k<=AAXc7?HdkHAtja
z<54NKw@uLY|An{vsG$<#7GY-fJjYQJ`u|_oI2zZmK0P!7F#>>K3U(qThp}7*kPJ(4
zfx8tK0a`(5NAU>wuP7zNYnozjr#Jx<!MdQtAMk0YDqs;4`N3yNMhrA2Q9(?+PfSc4
zp96Co)XkVix|snwHe<T{Quk|6>ge{FnyX{!8)vR24}{yVj*YVrYEF_T49X6D4ilpp
zXDKWQ5okbx5Kb{l5clF{yfg=KY(TMU<P5+cJ##2bM<GOhlZJ2}32T=k*bu(rI6(>b
zm0)rycpjFGu=6w~TvHHEOaTHPhuDZX34BX2^l^w_Plo{pt08qlIswtfOmHtiWIiFu
zrfde{>KsJmvSXz{HpICvUG9}l%t+60bVR|;_#A8o6O@7XLna$9ry*vihG=?7D_n1+
z0A+lU)Gm-rfyE=FM%;ExY(9kUAVkk+FfqeQtPLh6FHR)qAnP!PiGi05w^&}n#9Nik
z@O=PIR+O!rkez}L5U^N1Fu}E?*K;0xkraGENM2T>@Yq6{jfqrR<bqWS9LJZS3HK|^
z(itVnkB7*UfiRY>O7KYn$4oXVZ%M8y#TDb=KgP$vf4V_JjY^PT*{I?nkU*~LYv?h1
z3u0CfM3fEW!-P!nBH6J9&da5O(lNQiUjyhR=Y!l!@n1owsQ~@v+Xn%bTikQ5`>sE~
zzLH)}|IPJ{7y9xq^yOmlSy$fj#ttz4Ngcha&(|G<aAeJ%rCUpUuDWg3TJ(5ljm7$=
zoMpEX3WJc?6L0;7xA_xq^TT6#@6pvx$Y8drUEct|udO)?Z5JR8xp9TfUtu?{Ou#RH
zc{DdA=BiqARnn}fSWmC?E%&VqFAs0jcfxOB|KG>{?%J&RsjkV|Dpv)H{ymF#7w+c$
zhjX68Isf5e{oa+K?+(rP{Ia%jCAb`X_~NSJ`}TM3f9)*PzA%5j=x<ro7yJiuhhF?J
zQ8;v|c<@jz5G)4jSM1C7T+6BT!0FHYZ4la9-CL*&<&N|`))$Tp6b~KG)rUR}&`;|2
zKNJgf2UdGmM{;#X=6j0OfyIG^frp0m>U~9j-QrsdZ{=D~ZTL^;{ilm9ZGScJy@5xD
zLd)?bYq73zrE|G+rE9rsqwWRx73-T<2A2olYgwIM3l-WguGe3B;@`bE{U_78rju(u
z8~*Nfe|Is^u;N&DJRI2ww12S|H5_=_f&z_;cNXrveRtmQJczuzpSB~qWo3GKdbRq`
z-kR-MchrC8t}c427tIUiMfZaHquq~>uXn$^PDeiJe)$IzkJz>9clJJHSE=tM{-SNQ
zr_gjb-~I9@bR>6$pLgdy*FSUnw9&2w*TdF_yL0WQ*GASZ<X*(NM)4^^cc}BadDoW+
zRrTn8UYe*(+MR2B@o{k8mG_K1@ilDt!k_rUt5U&t@|TXll7H3ki6c~W*Ua6$e>d+A
zLYR9IMs9do@}8C-d-j8W<7t211-trF|NlG-qb7#>udiIlx%;;pxhWEZ|Bq*NgEi<Q
z)KmM?S^eY2{gD5&vD*S|A3GZcJ+_bAyPM$QU(VVFo#r1|Tu}c}&9NbyKB!kTkm9&2
z`e!JpQ@wZteEvuUEhIopoO}on+v3En&ZbD+5s$x_WmBadcRW7MgDN854d5F}91|>n
z0U09odhUvYZw?;>6LD4oeKiKL3lXS@om7Iz>P-gRfH28O1Y9I4?T=9LNGG_^#ywx!
ze8%8!+C#=xbpRm?8ZZf*;p>o*j~EaX5R`}DF8KNpPo@*<qQ|pJxFC-8gwUQK@ecUx
z3Q-9~1<STls3XOXsY-U7aD9Uin=|l<lC%>)P<D{G2<Rye!)G8RLZPb1D$<_iA!Jhe
z*d(e!4kfY!R!mjcy9ig}#VC8+wt3ldT0Psdcos;Au@f1{p6V%z`a)-*48O4<YVUub
zhM%G4pCao|QPs~-;MXV&k3YBA=4{`w<$R%nC4A3Vv^nP5ztf)E#TIO1_sn0Jyi~*U
P_KOtN`XwT{a)AE}xlp_t

diff --git a/scripts/src/aim/ui/__pycache__/hosts.cpython-313.pyc b/scripts/src/aim/ui/__pycache__/hosts.cpython-313.pyc
deleted file mode 100644
index 59d3deb817b981a8744459f209c644112ff6f75f..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 19679
zcmcJ1dvF^^n&03>f+R?Q0Qi1rNKqmoiKHk|4@$DQ6!oS^N*qC=L`yJ8fFx`Zpl3kI
zguPzhC3QvC?q#W5e4=xyGxu`2rG1xJu2jXkx+E)SlUr@2>UMD88rV6l*HyXHX8%YP
zy>j;TM=HOsX9fU4Q1V_~+H!NIrypN;fBp5>zwc{2EiEnP5Ptg3doO>`!*TzEUi4sA
z9}G_eczBx=IKeQ$T{MUWo}P^Z#)~G=#GXw9=8G25!k*0o1s4m&LiTJKuwE<@i!K(6
z#q7OcpyZ-WwDDXu*USlpwVYr*WK>%bOQ(uF#XqALk3lK%hr^MmKN^aJCA^w1`=itN
zYrhb_6AVWq;=-9g2!D`No=!R)nV6r&SC3IC>Yw(9r-DK-s+iA5q$u)P2ZQ1H3(?^0
zgxa1Or@Qzkcz>IFkrNF9CmIEVXcC-)v6g$;ESd$EU}8^}7YhWpV5a9oS}kIsP$5{@
zSF2Dd6tJfvp^7?(vc;&y%AQK_RK%WaLNWWVq{Ads3pPr7*(jFcdnx-~hNm+2WXF@8
zJvju2SUy$msZmO(Kf;6<42Gqjm4b>1lST^tDZ&4EH$45P2I@~E=jBH5lpA#FdHSAR
zUdxD7OKusC^BM%BK3#{jT3HQ+Tl0<;>1l#VFbkGLS}R%U1wtXFe`|UXMyDiCx=kn*
z$^^q9ZO%H)It^iy*Cg1FjdGkHR83Kz7*p#MsDF`a+nhpgNG;2o>e!kpI6BN;6Aet*
zjB>86IY#@uMxAn=8+-&_E+4w8SZK~9#n2Ti?+XO@PJVta;Ex9RX(Y!QE{nlCq2OJ9
zg7K`xj|V3sVvv{ocS7MQ#c&{IJ0(W$N@{i~wgXj&K}iZqygwY^r^Lwo96uYJ9S@4q
zbZ8FE9E_D+qY9~dsbgVwCRRTZ^at7_;hBYf{M}G=nx6@UgM4_N6;ce{zbP3B&PMKN
z6t(otND*FSDH0!wN~|W|9lt2?fsh!SparNH_Iu2t9b+KUP>JOfIT3k^70bj-&@U<l
z(`Yp)D#ha>9wtOIr<k!q=S5-;rDT3i3W`x5k*O5Vge3J*Qp#vJd?9_QD<vu^YDV*f
ze`dyGQOr_sW>T?E%uCV8EE+M-K}0A86Vs8<L{KU4PcYd*lf_d|+B$>LiB5l53XRVM
zJEaLRG#8aRB@t<%+0OY;r#f153raD2@)4m*<#`aNt+tL#I<buOSBT!?Qf1DR&GF5P
zOBcU!i5>=)23E}P+TXFSSs%0}s*kPPj;AVW?%%j~<B6ks#U(d($p=Rg4uQR`gyoLm
zgyXXIsYBjBlyD5IpJwHDLH6EAIBsqfS@^Q2oTbvfcy`0aIVx9NU;k>#QJJdSk*wPr
zuiN{e<)h9IJ0F{q=f~pb$K>(J<hU5ezY0l?#^M#PFP<gJE-YPGo?J7p+uA>`;q0!b
zAfKDa77hhSV8Y`YkjZavBRa4EvzLB$d8!ZrLgINjAQH9_JKEw_Yf|G8qAMrpEtGMB
z<)BG_<GKA@*uaEdTKr@R3QXV#MLnhw5|cSW7l~n`*Vv|g3)GX))8G6U6|bRXyKyPb
zP%+q#Q7G{mkE0$x!~}#zzHzc;m3Wck#z>m8kfz17ZC^^gM)bYxpoxU&bNgiWn)O};
zK*{hvP-lJ)b@nXk&Y%yb5nAjy!J8Js5O>#Ud`3tR<OHvAYv1&ZB%c`dX3gl}|AI(y
z48?X7kBvuW0=LfP%Db^nmL9uyCL9fld<23`m5Kf+@8_eT+2C<LI6D_z(2_&px%ntR
z848D_>7dlX_eFU~D=C^)G9*Fzy*dw37wCx9js-%qw@wEq{qr+Xe%2ofs})Jd_}>`!
z@v(xjPRbCgQYmXw+lofCCOisv_C2Fg7*H!vY|?b(u1|Z5?H^kR&dfya-g*udW1U()
z#n2h+(F>_Pj!vh0jQv2GA6L6C1?T)CcA1%lj&$jmUC=+zhasBzSOcF+Fdv;p|5+WL
z*fG7Sz6*oxP&!awrU`67*r#Z~XM%TvGkhQzoXfO@eV}j_`;>nwsF+`lgu)Qck?>?_
zO0mz)_@mh4W__#`Niq4QR}_mBg-ljV5|lQRKM+ug@uZJhfx2UQEMg;gODVtxh}lpq
ztOD!>^W&0Y)w?dGrM|e6ay#e52p9koJ+nzRW()SM->DU;14{)0-fH`%ZOJBA99g#>
zO~1^pTf_QGRTl)X=R?oK)885R%Yo#H>+uuU69-1+t{d_VpIq_My49cB-L_ajTZOy&
z{`q_7<%YwLjPjLh%jaeH^`!e&+<hzI_AQ?I)K&edt0q;~v^<z{xbNHU+2n@db;so&
zIjU23=W_7tZ={n)*Bv*I{G@^ZBk$trl#_OYcaOevbT#rI_~5#H;)dLEQw~hZ^Rbnq
za^35{<hc4%#?M&{$zOlkxNQBjYDdallX6wAwEaOZQFiIxCAsO=y8HHz-1XFu^`3R5
zdfn0dxt()WZ8*46SJKuHw>7K;|5W(b-h^#$(sm$jJMf@;-FEczR_rO_Zj9R|g*3gV
z{8xN=n;T2Z!BK-?=rKZdGv?a~bP4F<&Y$AAc}U*5GhT}>!~DA-EoqWj@LF_9h1_l^
zX9bW|c~sKTv%1WItg0kk8GpN&WXrQ#Y?5rJ)!bfF3+FKo;ecVDd^HeOY??a3G!yWq
z74#^U5DpoVQXoY{EEePm1bjMYDn<0BuB}3`m$Dnd^Cj7wX(ly8#953}iu7`lNWxm8
zPBCqU=T*+GpuE0Gu=ghBZpvovyjiGv3Gy2J{r7g)iaT!aTr{Wny-B_+&UbynAB@}T
z!H)LoC;aZ!g-`gd<?~>Wq<dG~y=yi2iTm(V6W4TLqkt=~xL<a!Y-Rov$F9#yxTbE>
zPuz<oDkGTDfF5YNm~wFk54TO(tT2XjH9&jT7{qJPCo62unrc%w*ajyetJj=wiZg7Z
zKM9;(51YD8`VKXFkPb^1@o>_x6Z}A054fnB<09oF8d2GQt{Ul>5dc39g44W)JKWnA
za8a$wA5+{B)1<*;81fj{<a$hsv17k@4mGfMiCX0Ox75iiIx!Ut2Va{LPbzKM6NarR
zz&NVo#7qR*u5_{^os+7PNI3oKXP7$KJ^Z)3dsYJ9x$&1b9=F6_7`lJ;-c_XhS|U#T
zC$61_e_6EC05zQkU!<j|n9*WX1ihRlOT``Zji-q5V?mIetaTaslE!I8X{wZpyu_YC
z4blNbzj}*%QqHe8K`bPijy`Nll=m+dJh8jh-NUPs$=yfdyN|5z?n$_Z<tyHV{hDmO
zrZNl0G#zL?GG>wSz%<eHr_4h>xgi*!fn>9tmc83381W^KCiy~IzoS_NN?}4?99T#4
z$ppi*G)J9vx71kBZR})vT91*(@zhf^q)LiH?Iaf~Y6IB8W4rSxC4*U;l%Y6QfKTC|
zCuXBT#||6yhi0Vr42mThip~T*1&VP#M9KwAXEP{%1$`Df5h>*vx#FAgj|XQYkCAPl
zj3p%+ab1!)=EP7~J%ITn053tMK6{#TztW14ZX;6n$HJw;Z`zmaE4x=)zU}#zN3Pko
zw(zhed2AqlY#@2;=Hu7pj<Hm2>zez6n)hlRbSDp9h#$O=I5?2-TuORI<;$aT&5aF{
zp=QjG8lT%RaYfZX=L|)nVJl~(_mkHkDBk8eInvkjYS$1GnDK0`0=X1ioGu*n8RNNa
z>Hq+gpPzn<IshHz=e+!Nr1v<ia-17zA?JjAJV+ediILES9eQNQ2X{cWHDHG{ZBuhT
z4c|oPCgR*dNDA6B!NJy{{DO23NX-(XSVCdoX<kFOQ4^Fnc(E!BOi&t?0xv^ChTh}e
zGm3*Ktr+fP^QAaMY5TUaq6U`a5s_C=;wgkP$0Vfd`1`%9{^ik?SKl6dzxUTqNjCg$
zxy$g6M8643ct{*arQ!slEu@P<q|!zrWhgrQe(7r0vUjEL?Thc1{#u;E*MB5x3RD#5
zxdaJlQk<lS8jqD-o&nqn#a<m$rSP;WPL#sCelZLXisTJb@jX_h0Q*NU98e0?%mKv$
zl?HlFp$gIj#G9xR;>iz~MX_oXNa9hXVk4rhOD`%ZX2P`;GgFvoVo0}9_r_9H;Apd~
z)NIQD!zd;#B7z{YmqUkvwqCMS5_cV6JMuyA`@IR*@pbF*bn4-?!VgN{FHN`(uUikN
zQ#a-Pw8Tzm$+@L--yB>Tl<W4c-H>aKJan(yPNv*-Nq5V-y9EljmSt#ZXr+5~VR0y7
z>-xEgtJt+w1tu(#ZDzNz9=3y3bdiLG``aP1X+0@Rm~r`ZBWP3*nH1Ra&$GRaI&ts@
zr7RC11A)85g)JHA;GDsaQlKvne3Gp$LpRHVv<ggh@}ulnTFeM0ou;4x_2z*NM%{Vq
zGUMn_fD$g1+U!`cr~)f3NdK54Sf~(G(HhJNBUL#Gc-7|u!qTf9K9;;iBTx!+gNwUX
zEE&77?vWSpO}JRFdW(-^oSBM<zIuy8#zFL#q+YlrT<k4L(}k^U^dqme6_pMiM$Wt~
zq;q2<8@zzAtJ7)FsT_Tc)c|Fl+VB?YB?3)st|0DngHWW8I`VTPqyXjwz3y<~@PX&%
zXv#lxS^P#b^~_erK&u)uCxEbRY^R<&`mw&Tg-cP_E<HW-cl5BgFwMJV-qH~ol$_u#
z)B7E^d+j6oKxO69lL9e}oqdG1vz(C55dy?l>@Ca3Qw&%m=#U%Pms1?CBb{5*MqPUU
zcy73En{qg+=7#KYD3x!nOY}aoxyErPH|TRs8$0Ug&ixLGk8Dj7V2$yTs$AxUdMnrk
z#|WJ%a{|VP1|uivE$Wn!dYtJ$Xm}x~0A9UWa3pf%TleL#mO)WT&rma)fqY})(p&zL
zV{&pUJtKWv(?&lQ+>lF-{~vr2F8_z|MYudaUw9q*I1#KZR16!0%B)dILoJZ`=zab=
zgeq@&8Fw&!X2;>_St|m@p>67^&a^zd4ZT85CXZ12jCJ?ZZCk0!)BrmAx6a=foncuJ
z>V*cOQI{uK={p2oXv&k`EbJ6o^mH8db_u(|2~Mw5Xk~Uu>}+WBIjc`-6FkBmVQ+`Y
z>$HH5unT4KNsx0InOT2EU0#>oKIYsd>|yO<#}M`j+(1j%?RAd~WEIdJg?6C>a2cuI
zIU&7DHH~0|RIQvKbm(ImuGnU7JG~W~d1SZ>)OoT-CEp6&uh+|eiE)#RJa*u4@g(Qz
z8j3lglJgOfS5Fo^X^x7ue|YHZr3?L6W25xWPx~dF!04F}%!J`77*d&8kfAR89skUH
zP&y71fE1a5O%(Y0EO7tuJPeNux^)(KI6vVJ>z3RQxfqlLUxN`7_4z_`v9<xA;rztB
zD8eOyC-@vy01GF*INMy?d-XkoxEJFpwj+xDu@1OjB@}*|h}G&q+eCIaLWq02inwoE
zZ3lk=W?R)bn%x?#zcVxF13!n}1;snTz;S5(kqE5I{%ku4buR-RWI%mDl94%3_1csa
z8!aB2A~%FvY)JhxWaM4IKt(5DSD{g3MwFn$Oa=rgbnrtFK5f=b+q=`Ima$H?zF3jq
z*KE-YC=tChJl7~9p%ruY&COvn&;rQTjtISHf3u_CAD)0U1x6b*1S<w6_AX5{v#SR>
zFwUfe#JV-I(~cwBBnFs0{YKy5rFO7Dh%EF0^jxE<@!7P;nv3<BW5aRBFNSEUrDJL1
z3m-e(#|v!u_|bC$9}Y(EM#NXzBjYc_q~3Y$Qr{2{=$MQnL6vaL-U3qzI;*imN9^~!
z=r((w41t&EEAdIYG#8u*O@=1Gz*^fd22D)!7y>`fkVO7EphX<H()>Q>mn6`D^>QaD
zilG47oeqZC+yx@c)CHSQ01O=R!@Lv0v=UI|r{V9w=}@gLwp%mJ>9uE-nT-U3Gn$2t
zISa%pPpcIZ_rX%n`zIzM^WkW$mU^Yvzz}kvUCibtF$aTKy)X@PQ$XuUZt)#dTw*!e
z)xKV1_By?X%s(MkM{|=IC^e%_K`R_FU@`+qIpe9;BnBsgSj!W^SRGs1`eJ8-Bs4V-
zTN}KUAO_6i{)tyaI%_Be>L`-Yk7)O?22}?G_1R;}b)mp+%*BewZu{F~``deN?NtoE
zScgi1KCe8Ci#T*2!$iXf=F^3j-c?_$2ZJH;n+xf=wMkQ(-%{4oCRTs|5#|w2q@$4n
zV2~Nlh{b$l^$-cp5N}cR70OV2jpXGSQH+R6S$1X^HVT==Pn;FcQg%|A#Pbx9k|}mj
zbb=zBgg6zW#(u?#HHZ|4wroM-0$a=CtCU=%JA6n=6+EEk#h_1>NKAG!9~H%+ePASG
z&?Ln&=bs11FlYj{L-H?S2&o9OJ0~ts#RYdo;1F<HnTX8JhN2>!_EbNWCIGWOeb`u?
z83y+;23L$?5QfY7alj;zyI4uI(R(UYsFh@n$WzpdNU`dCL+Fa+3xg6;JJb;(6<R6I
z2ww3IDZwFyAQjM2&2|e@XF&6H6R%JP;J*?XtHnE16C0<pbmx7{F~-IS^=a-g7L{z1
zkLZ3SxFFGd6Z*0>Fg!+`lB)CI0o@rU%Xx=}RdNBqQNiHirQ&bcG;C%0^!?#`!>i}z
zj#CMD|GM>b%I-?qTjKVX)zO5#19*+A>i)@lCs*4Zv?N?d7Og2~?Mgs)HZK<bq{Ib~
zC24Dl+nQF})@^%J_A0gLT5-aD;7KJfH@%*yd_#7;kt(l9mbb*qQEBq{<@oW-a(Rnf
zer53#TKnc3OK-^aXXVRR7vK2A?oBoF%OxpKSJLxB-19=x(;xTrf8sd<v)1yN)RDgA
zk%7NGGLUG!jrf7-u_WKT_5C+LFvX7y$nF-o_4cP#t*Q1GR?j4=_oNzHlMP+?7jNi#
z(!T%Cy(=Y1g%NDeS;H@ET=h=PqPk%;)Vyl=!epwb+^}*xTa(Q_@#daH^YP_@Uwzit
zoNPQ4Z#<M}JaVt(vrIP<<sG2DwlP`T6|e0|)E-<M_<L8&>eYm6&!QFPmDTD*c{eP|
z&dQ{7U);HG?dpTq6VCp{!j!W*>1>HRTUM_pob7nGS0?SP`1hdjBl}18&+N4;Q_04z
zcw<+>-bFTESnraK!*R#q2e19marQGkr8Dm6d|+L7^b*i@Y3Y(&6J58>(~IWm<opas
z8{z(COJ&QiuTHK7R&PHDJ#s$qJ^HGA?Pl_tFMiD@zciJ6X(9g7LgJ;@6W895&wf>I
zd2`+RHE>7LS{t|4uE40iGd)WO9-g5|I+bpdc~51viT>W-dvCAS!%^AUB0Kxg$&$*I
z)?{saytX}2(w=H)diVA_x04P1@rM3K=MxRW($Hsm+KG6>iHD<!hD(b>#G)|l|IOWa
z#en?c8|&7u{-lKYa#45dPCk57J~<@U46oZRr?!k5v&>KY&=H^k!wV+4VvHua+=)qc
z)U2FK)_2D1I}`TKw8j4Hy5n4G$If>b-dT9!u3r)4=40}S(S-Yk_VyL|)I`D^(B69G
zzLyj3S2haGd#K8q!y82$@7dtY{E=nbMlt8+R}Us!yNSsz-n;lOE~VVHsm9%Fw;%0`
zR}agVUyN7ZTDGK`c740?TaC%4EAgf)^2kkjd@9j2y<C=ZRj*u1xZ3{C-IA(pc(?VP
z*46e0t_OjSUjFdqe?OC`?N8QTh}T|tyfaZdwA`<|2JA!?UU)6YP1k?u9!*u$u7nd6
z`}D6(FRr_9(U@ZW|Gw?lKOZ!5Z9aoUNZ@z(6p!pF`0mjH#QD7g{+WTG(e2z-N1Zx6
zz@SU*K!S?X0S=&PAQaA-W&+e1oI&TPoS+|U*wLae=ObRdTz=c%HqNgA`EtW1Ff^~*
zX+B>nfvhs*OPLe$fgKreO)$3;%$OJ4q%VSnVn8fu_?Pwj8L%fTJ^u~cSHV!Mj0C>K
zpX5~s)R<j=*9-(|hK#<c6s32an3dE=az6Fg6nk3fXS=kdl+J}FUh&}^!`^dL4pq0H
zO+_4|==Uk&DWVNjTt>9TcCA>bWl6Pb(wwu6Ox?R`@w(ZOGvjOeA-+lf77?~C=ADyt
zx5eFUYt;$&(Zw^^oRY3xaTi=3<n|X5u9Lw1?XD#_;Z$Zx!c9J(@`3(D_33rn8D!A*
zu9kIMD`h8(!tm0t+}QEJ{88D5Wy$^h@%<#A_7BRJ$Kw0P<lE!P+f#A;+dn109F6af
z$_?{!{hf8&-E?!GyL303v+yo}*KBzHH4Nm;f@0HE6!uo4X+`vsUUIZ>h~e?q@bpbQ
zybZU$O*oKY*p<Qi88T!XF3xhiA*{#*tjNsJcPz5p02a=(JYiWV(9sF~WDkD~3mhe&
zGEpDkG4Z>o3xB?bKg^;ATlKf;`Ohf5Fjtv+pFaILMSp=vDbjt)q^({uMU2~sK{op?
zq?7+MYLG}LeT)0FdEdQ@f4%R+eV<Ie8oxR&-(6TNVmeDx+}^a>l59R4Z^l;nXd%&j
zC1D?tts`3vK33GkhWOv%2}7LM`*V{N$}?mrl}C2L1wSq4^nu(?j*a31gJ9}0L1v~W
znY=$C7frv7U0IjCLIDxPT;EBk=Y)I`ZPb;o9lgGJFw@*MGR@$BEBafWQzc%7!cD!*
zm&2OL!S)YVo?6(I0>K8)Upn371brsLMcyKPF)%OLKOKFW(CYxYJ$j#k`Vb|cGmq@_
z7Qq|0^q^5F5z4Y4X!LOK5-XE$#OR!p6Gm(F(SfNbKg@0S7E>F~>`BQsWgYrhJ+riJ
zo6-cZKd<FdZ;99DEfriHrqP8~^ltFKv;OCsIk!#?<KTQbDl$2?o!d&fF7jK=EoSAM
zVff_eAEsw_<sUq|08Y0VExWhqxudn+JXPuae&#%tZPW6Xnx}2YGY!T+vu%50mMJo0
zoPqJf;&n*I7mUY_!S@{pd!d#+;dD4`gmH^DnEWd}3*a9F)VxjK>bz`)J(D&vA>@++
z1nNJJf1TTuZ6s5Nu*2&_%pWvAw;mVP0nCtIhqv781mNA&Q8>Cp>*1VXa1y=Cm}xzD
zv!>-vGwXT2wa~2d1W#i_s6tNA<(Ov3%U8$F{E~k&K#$t<m2Jt;?8kRu*GN+i0eFQG
zR#OU~B<%iD^|oeu|BQOmQa*3Jc_cE7DVt^S_9N@jY5tNUn@^VS%rh2-{G;tPdkei*
zVNZ_*Mw$F$z1QpBGIr0I@g{BzCTBGia()0htT*{)GHa#n;LaHbp%PAVFPL_4@Lk<E
z6m$18H+?{BS!nfDXl8$b+7&~`&uE542vIK9pdr6QDwNHuP`0FB$vDNXPN=sOU@K9-
z^1z$)8yTDLVyK|D1TY*xDv)<}t)hOI!Q)hF%T)!Bh{eO570FH?tLJqS1Vh-Q4t^vE
zr4SHvDB3HMwyT(j{IkKBU8fcpDqW<Dl?e0W0OMi0kY0(E9yoNUL;rt2bZm1Ng_J@K
zt;ekdmYL<%yU(C|xK9SfNwk;les6a7d6wz7>wB$UW^2!5whMZD{DsT0LYDKw>CD{_
zErFlK1vxVK__gbPJb8=rU4$Wb@9*i(n07+{7j7!CqMLM|gSxCeMi=IQ5yCbRbFfc<
z8rj`BOi`?mXGv{}!2<>TKhO{thvt0RxQY)cq3{lz%Y31LQWT@}9ve*ck=5*Aso9kt
zgP}#UlBoAZG-REJ8A1#J*OumCe+Xq;d2|a;%&qYwol{|WVHbn=Sh+so8hak&nH@<n
zw8zTXFlDCh7$0l8PCzi(KwweO+r((4kG8$yTj&@#!%9i4Lw1cjd|C^NUG23#MN;gr
zW^~H3|4`}8#sl3Dm9{z+dz>O^tQkCBd_b>s5XOZW3`3MI8jwX!Db;~x9|5{5x_*E%
zAEfB(RH9C^r~q|lrYDVDby7?i1#yY;(g|C2Ahs}5kEbH{@O6%Id`wk3(yi(Xq%566
zV<3tDh4OxvqCcSmwlodkF~&3ENA!`HMf@wuVHN#%eN<NbkCgVGD54XZ_#KM=4I+ug
zWGhsS6n5f=?Le1cnsH#WGjr}&B2KD=hVm@@`gFp5X5D(0u*x@=-dve}*s}PhZ0}t(
ze`*I#?feWlcF(<@`@Q#iR}ZckfYYvZ#a-<HwD)#?aQwaF$-SrJdrv<a{lUWb7ZQ7K
z#I0?zwK{e5*rJ_91g5e}Mu#-NMD}uH-FlN?380>B_uAyTo<|4dt2dV0WarJK^QE}+
zrG#^QvHw$7Wy(>Ja<~$X*0qC)y?u|ne{kaaC*-l)@=c%YdtDxVV*`4J@sjcJiC=Ks
zCBvYR?i1m<(D8SUC+kkd>rOp7ny9<7c!|LHqxX)koL#%Ld{lPzBwf967hEX&fO}Nd
z-k-iVE$`T$sO(Bs9*I{TNmTYMo=ep<yj%TF^=kXW9V^vx&4pymaJ*(XQFCSS;%C+M
zsk-J=W83G2=9aR>;kb?eyaMRO2G13h=IQOVb?f!)-X3}6lt->pZ%32P+i~aZg!3iV
z+aGDY-L>XQczPeZe^CGZdilnS^5`x3)`EO3hTfhrUNk<gM{h4023T*?J?p2Q?N7Q6
z$6bdLuA}Ig)`N~jO;@t!NWA7qqNZo@qMn?mV_BE2E+pzYl6Bqjy6!~X;brTF(Oll}
zq!IRtKbl=W2iVqKu~PU$SL<r`C$3hyYo(&aas%Do0+fSWRc;RLTi>y+);$QUSmo;D
z$?Cp%bzh>ofAK=9x?cMfq)#W3)u-asr+_cv6M*E`-gzzMXkJ@bd*xx(qnbx0kGtf3
zgYcf`+cr2OU-r{7*HZB7QyUhpw1E)h222J0!<;nirhhHnpWCh4%>29yGxLkn2F|hL
z&%Q=z6T|$y>$YoY=!v*oW78@a96q@5-i@^Zx#H-$wMT=}<*K&7{+j0G-@ESVmtXYB
zZ7<0c{&nm4m&u}AYkD77kR4z+O-HUB;4`4!1NR2h`$#F9n=;~hbE={tRlgViHcGgP
z-5Xp%Me$<MMw!lTRYQ*#9={@2++4SgrGe^Sec?55)y+>iV|l|SDEsf+^&1u>{zii1
z68HV~lFQwk++BCYZHl`Lh|{PVzGhIhQ+U}9^1<blyqDb=Op}InNPYL1hhpXDu|E*_
zO8bO*jo&gKooqh}%*+ZqbR+-=2l}lGc3VCQw``?|Trhm}2)lA4C}9o{3_F!fc+~}@
zScey-mKxB_d7H1?H$cUcNS#zAB1}AT)t<G}9}K-W^yu8$ki75G53PgG0KUed9d0)Y
zo51{BV2aCkVIv<9Cg8Uypk9;ZI48gx5tj<-5)Ve3ptzi%0^<40YEZd)<-x=hXn^Or
zfi7GN#aS>9Mr$hT`gWENt2yKAJldy2JNb@R`RUOQCh)@MMu-h_LcU}0XrE9**ELY0
zGABD;NAiJAu6*ODQ_GNE%x7*GAtuTR<P}OsW3*nNA8Gw6X!d1mfG4R?uF;>zGc5a%
z>v0Z=bk1i^LP}BEpC?wre!v2rCqby>q%g!@y$W}v^g@DT(gb<Dz?%!M8u<B)v}+5_
z1Nd=^AY4zVY#^ibb@0q53C;-c+ks1r`YGc|LasPaO*40{abB9GmfO@j8S2@FC}3Vj
z`j2X4Y$v^E*%?Lr9V*mGOA}PmZ*ssxD{VgE$vX*Un0FF1aGrcV=#sj6JxsrXF-moG
zQJ2Lac@t&zBl80u%*6<|3-w?62z1~kMi|~iVU+gRRYmhAp2d3<F_p7`{9~Xdk~W#;
zwLy|X{O1(?0Yzl6Q5-5U8Mh2}1w^&pYytC`KKZYx>>Vm=(>lW3Ikw>WA~mOMaz@B%
ztBFLH1rbD-uB#>N?Yf>ua$mPve|4<@mYAXsi{#d0562$2$R~zV)w@=s-+ujDuRj=z
zw|?bO_xE}}?uoZvlB=+<8d`@98)l9djM!3(sy^q8MOTfu0_$+6eGI&`ZDGfBKFJvC
zozMmn&O=FOU)<UEsO5W}k39+JB^a$i32v%rcJQMz*~5>ds_O2)dGF0+)!}#*%naYF
z`M4%gHL%FsDKxU>s`K*Y+lys!tMAj2D%$zTu!MUka@~-8?Zw5RxGiIbWipysQ-(YR
zY&U?PN>pT9f(VV5U8RrCi(#CNaXf>`<;O_;jVl1h$T4KxN4FB`;nppWRkgo8K?d;*
zMeOM;J^h3tD#?~2a_&ff=jn-B$|}v;U_WHUzX4Z0v};x`$&$EM>-iK<NF{a<flp+o
zs{K$~=jjuxowfcMUOi65>SIS5pHC_Fk%!JaoM(KB&F6a+KAd!5!<*gbn+%Cklzs^(
z9P#<Y7OLt5B6w@jFHcR(2BXuFfXG~uM(E=$iWVp$A<8b%s;lI0=#|8w%9<5Ec7-xD
z;qymvWF4Q61|>8wP8oJnw38y*SXfkw2Z=uZ9`}W@)Y9<<Uv25xILs9|pBk+e_fr#|
zHt6Y#N~7hv;frFUMMP}19QdO0s=-q6Mc7zusoALIP8rS_WbaLRdiIx`(IOzvb^07N
z8Z1MGUs@fO3blD^dB{^ngEKjg$;WVrq#h`R<SH~18do{Pg&)T0NQ)lz*Ke4Ymg3(0
zWhO#D^TXtUl2eHJ8L1OUbE}k7$@x$RoUG<B?_rp1i;%7k#^wQ1tS8i|J1PEeWWkE&
sq*g>&hz7%tx#s`LRsWv?&anT-+<~8Po%GoHOLM?%sQ5WYG3)C81AXPa{{R30

diff --git a/scripts/src/aim/ui/__pycache__/maintenance.cpython-313.pyc b/scripts/src/aim/ui/__pycache__/maintenance.cpython-313.pyc
deleted file mode 100644
index 26c4c1b438bb97d953a715cc1229b8fa5f84ea7f..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 7471
zcmb_hU2GfImA=FOe^QjFf6Eigl0`Qn6WfYy#g-x~R%|(v9gZ10by|8vj>L(`8TQUl
zvc?XwPYY?cg(C!k<R_~@fh6d|?xXrt@6+x+?GWmg#B2*Juq_sOlj{Hl^3-$Zhm<I)
zedz@;bLZT9&pr3tbMF1l;j3WKhoJobvu{2rbRhJ9<ijcsqe8uU2$e4pgBa=-nx!yB
zle+DeZPt$Mdfk4@G3&%mz3#Z>nssBhUU%N|%zCj`ue)yfX8qVtqi%ExG45W(c*bnT
z3^=gljr+bOA8|_avw|SXtjvpo1fPyOtel6pXX@tMb&N#}_4esJmt8I{Pc3nRoG#^9
znIq%~lV@|{YKkj~5-*E*jSQRPgz`<9D`t(kjHfv<_39jae~CUum|_sNF%-5lZpPM&
zK5<|N)a-iA2{ngab1_crUUJ1fT6B)(1(_3AA<HpY%yEMBtsj_WsRQ$Ppl(M9rUB}g
zXaJ>A>R`Lsb<BLzq#gP<7lvYNmag<Z&gLEnJ#bqz#?Ckx=a|Xo0Nn-4@L2SuZOoKJ
zpwblM9lwtd3zQ`UUv~Yg9}#)H7T?AjsJhiOD5PfbqtWfxfQL)x(f3z)1P+fs%wui~
zjKMdrw86I16Z8RXEALE;f{evNfy1K(G0PU{Vq-57^t?!C%aSY>IZX4y3RnnO0?kWw
zQOxm+JeNyo)SKU*FwBNFEs17{DbXc1y9_l+x$v&IDilOEN6#@g=_LK`^=t4<-I)WH
zvPjE$j?Nl3m@!6zJe)?I`~D=eCS>bei=sdbkr$R|DU11%EGbt~oW#jGhaxM$;2bUK
zW@|7M%g`p$ye!dKQCQ@c${2c-OOlK^wy05W#NC=RTi{r%x$+#F<FMu^f{9~dYnlVJ
zQP5&#-6b-IB$Tuc2}G+CO?l!r%^`7xMa`AXi+q-oh-=WamPm4PHpvPSzfj<kX6K}Y
zfyNh;Wj=XO=cP3*a^O2d1kwf%?3w8yiRMnk1f(zE@eimLiq-;=r?VTgKYgE6Zf)FB
zyMLgLioXezYO$WJk2XL0U8H-vT^+cpPL}r~E9TdvI`!ErgxaQT`%XI@dWGzr;q{q)
z4~ledxBv5}wMb_z95ZSiTi#9Y_UUTxg-Y**|Bj5++Pb#Se{rG~sW+Uj^q&7s<ig7y
z6mAEmP3{~7g6__{a5R4T_i|?Qm?g7WB~^E3i-J%RG4>BA;@X#O`XSK5F&S5D*G#o=
zwX4*K$vg*JPL62nh)IPTvsyLAZMiob7cCD3#&gWv5sOFTef->l?LoWM?-+h?O*NOg
zY<3vaN}pZLBM@S|j4w@HurdC$4W5Ct9iG876+%qtJfVd3dL(TFO51q{P@+1eU8i&q
zO47x|n9j>~eLs3y%+bYkGd-7WbxrFB>;pIyjgq$4C3hSn`3b9U<IVIkeN4Y@1&-9o
z2HmRNk6Jq^IFm?lrJe2QMhPLoopz^at5@S~Nyoyzx9$Pg{Rs!UO)&$42YQ@pjJ0Y;
z55b#urG_k8;|*hm8(&rpsMgdL3ErUXlhAVZ0LiRE3!V1B^R=`$gwDG!)UPla&0&Q6
zV8zF1v4uaSUCgPvFSW9nR+=AVP8(zHM_OHht^90!6`>s1#(lcwh!);KMzFoG7p-l%
zm0Ux0i$JN-qnc{~j3pEwo>$Huxm4kbwQj;G{U*F)-GmRVn^2<RZn17idQrqh7A~np
z9!v7uG`aquUf`e?=4i~73TzfGE>S3~(d;7NGn!lB;2s8iX56b%Ih*CUoRo+=<2I%3
z`lAw;m0`pJD{*u>^}cc@FUuuqJej;AaTvx<K!umNiKKq5Ws1v5{pOWmv>*D@oREXb
zWhHX7gXX^eh%J^1oN~!x+PIk$oY9uZamfbtC=(_0A%`VErRLg|<dq`(iHIi>SBku#
zze}u~%}<oB=<fn7xG*t#1#>Gr88!iehAkH6oQm&U;zHt$(z!QB-&8uR9WW4uB$jcO
z`-ak-GB1PZorjw(J!w=@i5+eNWswPS2rNPITr(A_xy{Kn*IgDbak3J+#|y9@5^YSS
z^d(mfLVfWDxJeWxUJ1U-E%2;h^)<CTT3jC0#my+54A=)KaY6ABoMiHB?l-FV6N1R%
zY(9ZYMJ03n5iiLEAL$lk;jd$jh?t<92e@4~B#F+mD}csCvcJTDbi<OQ#d4vrmH_p+
zS6M8;49Zy(@&R}Q6El$GVZ~X~PtK5WIc||H7i49~@&F=c>j8;GLUZuKqDZz&-}rCI
zm8<wh1a4LLi@0K^pU{ezURaaCNucVWM<-|{VhEM997|HhreKY&r=eFla4rMgH7)e}
z*a5iJ(1tR5moJUe5>XKWt(Mg!O&b9?OEa8Ic0eMyvkaPnenpxE*DlKdK50`8;HX_V
z3X8(zg4S$ho@hvB`GTZ{F!z%(4?s1u!WPOLU`ZXiYMt4G7&${G&y;aNbHSMbXjqFK
zZnx}~oW@%J;WlC(8U29C<aofo#H+Yf&8^Rbi`YfR09Aq=(_Ds%G@n?=WdL2D8+%Lh
z!A@9p7h5X9aRFP!E^r0SL--18kpn2qE1c#mv7m>z4|fx$p1Rm>Q$Won>kg#3jd`%<
zHYS!d2L^w_m&iCfOs?5sR*3{lbiH6W+7a#~T}BS<nFWyzmUWnJoN)v(NYjAR04I9_
zPkkG{p9V<9zu{Lq-l=u0d}pV;kEs6zl6%AbG`tc16LR(V_5&z7vL8g=?w82rjqit0
zM|ZV-xY9nXo|$~n@$Y^A)>oa%R;IGmsbzI(d9S@tZI>$Tk}9w6wLe<-)S{i$=ujm(
zqz+%*m4E&CSC6Zc4=a-otCM*(m*0!>>+avR#Xiq%EpIMYJ0~ig6MJow>n<W05hJt_
zQoG)&1-rJp)xfD*uyfn32IyKa_W6n$7^nqL?2PR6sy~=fPrj!HZq$PPJKZ}z_3ZfW
z#ohReOX|S;YGAGw?Agw5|4==1ao7E?YcKq2AEE9C-Isl2Ib~`;jJ#bhk=wgM?MG0g
z<LQ%)Cu;u<HFa<O$#28=Yk}w=qC-22d(qK#_aVV1UM#MMDxSGov}Y@^nb_&xi=Kxr
z;kI?h|8$;MpQ*imuKM~__<cTHjSg0#gFDkZsY-O@#g+BxTC}@CQ==n5F+!H@&gcEl
z`oA9jm*h7|H9o#OxV!l4<zFrD{^&pA>fL)Pb6>sxvHGKj>c^~lW<l-F{x*<%=|)`x
z5U+TH*4}M9)YEURhbx|ohXkHiKP(c7g_^&8>+$B}YS-mT*X2F`<=uP#<^NBA^#)(L
z!S7w=i74-Fy!Ui|V_xlBQpNK6d?m0#Sb^RAEPx4sIFzO!c?&(R`6qb(ed3x2^%O-T
z0Rec%12Z+1R;b8A#nzjoC{iT)YAP145p2Ml+;&YR)z(CSPm&%<+fw8tYbt>7ozT)E
zzJL}Nv=E<dD$wGF7IIKD6+pxu2ZDAlv=f(aDi-u*!K)b`U~5104M1N=yEGTTyg@xC
z2_?yFe~VifxJ8&YGcIWnAuv&<o#|+fOODauYt7Ptyb$#;U3vsUr3R0-*Y}0QW3Be3
zMT`I%wjZP6ZfI!{Kh!nc1MQYN4+v9l?}hdj@q{%*-+?~RSwHN+3F!O!0VZbkNW?k-
z(Vvq!$<Ssr-fEStH1`@r9oCrS(RnP*(U6FX56&xzzlPN38rdbdJ@o7nKi4{^G)~JH
z5Iw*n1NUU}tN?i~9cSrzOp<N|a0LLJm$EF*ak;nYGNjpzK?jjNT=@bd(J+ZzG+!gx
zs=2OV$cE-MPuk2@DWT~y#w4!>=&Z=gm?&0>-EAd_()H1Gh90F?c|bo4fI2KOG~2wW
zgwuybQT+4>Cg1}ki9-s@d%MJ8J!PznEb%hE2+6BFJvv&#Wr2H}CM39_A?-Fgnuo>F
z?>sJls{Ht{AVzvHYb2hJ$^k-U2`m731i3`OAP}yYiA5F?kcTsQVrea*Ox(4yge0kF
zEzFPu@PAeYZ6BZNOJL$8%7~s%B+#u9n^?KTdg2hKo1DRCNdGrx$kGW?Wd(qUknzi7
zFcXDPj&cCpisLX06Ze1(<RGjA{4+%YHqDhX(3Cr^rxSBZc&Y$N$lMy_SM_aGg44Pg
z<&4Nr>4wy+m8sN8kkZu6ObIv4M3)KEMAn-Y$~`KWZkP?}!ERT1Ij=+57HQE0CP8n!
zyMa$JiTE)AlK4${Xag3SY)q9glbSl7bn}8l0#KYFL*61o91z9jHP?b^)Yif@2T8kX
zLDMzJXn9Qw*L@|E6-oUf;iKa~2U!Ltz7EVx1?v$pfLB9(06XFT4*U*ui8~C?>3|4Y
z)SQIQ>1-sj7J?xS_(&33+L;#ckxW(xkLC)mL1*cgkb7!{9^b8Xd`8gYl<g1UlfQ86
z-2Ljo&mUBWZdZnG@6mVm!XK<VNP;x58TcZ!?mPrYE)j4x_I&)=xEdHHu&%uIWb=s{
zI87j5?D@d60W~lJFmJp3TzRH^J^1yx?a$OevKBo3Vyrs-A^a-Clj_G0)c{)y4(yCo
z2QO6yFR7<4@Aj$mbu}<k3tZn1d*1f#M^X2QYS&r#y|klPnX0`}+Hco!pVuo<`yF-M
zH>2K36WsS9;J!n$-c&!hN5IqlT3c+ZXS3&vz6MSOxJ)GOe17uTNi`7H0qWMLo1gA5
zI}2)8Tn(J91v@@p+$wAqcFylyQ#;S->x%8nd^P{o{N|c^>82W(1^l|b_<Z@<a&_Q6
zb(A35eZPsp2kRL8G=NqU=;`QqVIQGo>Y8mm^b#TOwCylT`v%R!;RaC+1Y&~bm=^^O
z{(ACcG9*~ZWHetU1E*FQBBP8J$Yg#}W(#IZI0L~FL|FwmAq6p$!6bsvgAS~lPArol
zw#8>NtPG*pLK%Wm=#?YA2tG8dj07&2JP1OR2xR(4^qno}9Q$ry$Qk?dJk{@v8Qn>z
z`FM~>WQ2{t48SDP+{B9t{DSU_S_u9;fP71qE9rmlVS*C1E<!x;&p^WTRU@YBZEhu=
zVf?+PJGs_II+XbY$pC<Y1X<Gm3(@6nT9D?sV(4oEL%tA!M<9v7mwh`$QNKs0{)oE&
Zhz5U;F6zJGKf4%;iv0=x_oR$v{so2cJ4pZl

diff --git a/scripts/src/aim/ui/__pycache__/playbooks.cpython-313.pyc b/scripts/src/aim/ui/__pycache__/playbooks.cpython-313.pyc
deleted file mode 100644
index 998648b9049c6fb05e276b4f08d9ab1ddb35c1fe..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 10993
zcmcIKYiwKBdH3>7iV~@pO+DgVy=>EwC_9#8%XVcue#n+A+Ts;0Icm&YkyjFJ@=`vR
zv@Fg}-4-h(q?@f3fn~Iq)vajd{;6CPi-J9(V#VeL7<zB0n(AFr3|NODKL#XmhRnr&
z?ECKJC1sjU-5)!U&ONX1Jihn&4j+}5J19v1dFS56fALV%zhgyDCapj}x(0=}DVAdC
zeyWcqG=pVBzoE}ajB44~Z|XA>vsyOwTl%cTs+P_Dwmv(tt7S{SqpysVsby=wv#*?#
z_f?PzwQlQo^|^_gp*&PG#oFsB*0IN+txhT@%Dm2xvErqbGENW@NiG>p2qIKXXSw7g
zd|ju6E4+|QkeTC=D14x)GT(G85l+RS7ssDWi1>A$jd3$$iNqy#iVu4Yifw=wQm2x9
zTrnm2t2n}PbTSbQ^I>fhTAtex{pdBQzfFCWA~Z`814|PlTgDpdsf#9JVx6o}Et%PJ
z)})p!Yz1ppOIFs!TGWz_b+cBrWM?Z`n_6<Pc2YLs@K!0V{Qkm(=LPX&7pxdIZrF?y
z%21~t1z=Yfs0;Ml)DRWeFhDN`HbUhZ_vF5UaSKA3^|6JoK7zr1YoT2)L91Oa7rsL@
zOY3xF4bRw*%5Mc2ELBju4LTe{by9+9v|Jw%G_pp$ubMg;rKl8~c<S6UW=BL7rJ!XG
ztu+bO(Mr8DNC&AdgGwP=&{|FDC(e(x1x<l!eRSbFTC0~wH|wRKS%(^#te{x)XkEU?
zs`o&<Ww&Whjv9I^Lk(P_s4_~$bAt|5_y$e-NWmVov)2716ve@5CXg;K6vpW#Xx*Zh
z3*RAnq-C^8uLte=oUE|}sDb3)laqCZ>ZJ$DK-6r0#jZ1<n6A-_Oe9M9Fbdj!=3~Ta
z7&ATLOuLaOzY2vOLkq=#m;@;x8!Rr+L&oQ2&>%gOXNW7*+n`tmS~N6GP<xHz^gY@S
zQfr^eNwKKdxhq^W#*M{zuSqfZb}F=}*up6>nTYd5F^PO^T*M<X%#9mLdnca^cXEOl
zh4GzYm_(<NVy8%;EgJ7kMLYBJ`le<S`@sob;IB@R9%Yw~238YGUw&W+6imu@FqQ~&
zF|o&&2LY8ziEWVm&&SjaN@^H<f6pqnaO|%Cjz8PjB{z0053bm<jYp)$Bk%8dtZwm}
z-ga7{JJU5xes(5*I)&cptt2%tq2dU0Nq!<hqP(b>!!e#Cie-}LB5+>E7=c2Vq~c?W
zi6jz9#SYs8OaO#ZC4$ZqL*oe&%FQsN7{ydvv2asUybvKM*wB(BiZR9uiV2UVnBZVB
zWs|<8Jg9nb#TW(k>LAGW1dps#M0JH6ngSI~Uc^Ro6f~@;&`}_bw)YvutnLO5kVpwh
z#S&Jvu82C~jW?KFBK7K&`r4wl=9aU%4lhXzH^7Mh3)$lv)Ou~*?F;i4vb8?B)|aW>
zIqO)js9JZrZ}!dgefu;P`sex=Om|&(TuZj)molCn>D6=6@Mw0JmxuZ6@I`s}qIB+(
zbU3!=jIY;hnmzvEi`$p#mj@rdxOcwn7QOCiyjyXnBJ1gvJ>4tYGoGWj%pZChe%&zm
z%RQNf!Hj3{mU-P>d)qnh{NBh9!b?qmJ-#%#vTe2U7rR$e|G0m(UGk4f`@)$QA`jjC
zr&fyD_lb?#RDb*Y{P~4crnYVN#Ja0?q57@s>+Vgs+f#F=Zbh=2cFCJ|E$>^our@L(
zeRV7|5|$#oJi^NZ<7>`|&o)!8>PK*XDx8yTEK^8a)oyHoRus<X7D=P7H3ZWZg!@vf
z0sSSc2DFy28bPocLE}anps&PGp#2T1&I6s#8qd(INic(bumsJlQEdl(9<&5NV-+Vh
zuag<7U`<AjZ?GkA=4{E;XJDa(EgAW`4!=FOAP1JXU{zQPYt=`bDcjI)W9@o7X!4Rf
z9?e^uVBTs3Z2=VaqQp7^dD~Oyg0U!jMM=kH(B74|C7@1kXzCPBj>1)xN?DdpiY*(Y
z!ItK{pbfNv8J;l@ihWT6|EQd;=r#a66#%nPoLHB>V|7HS-GM16POSS0DAc$`X>^<3
zFzVGy1?w6#cR-^)M>TcMDjGT|(Ez5a0!){+6m8BL20+Q6?G_C}o??O{=wK@gb~?|g
zuxse4QhUI1!|7kr_fhylYkQ%lmqw~|zk#97v_BKlr;jguN2-FR(Or5y=+I9H=PhOV
z{|j^`PzKL4PI;^Szt20$BGbd99c*H1G9fY}z3j)x1_Zq+Fu3%tbp2VvPjQ52pg+lk
z6T*0OA_eva9QAYsdfm(wjzrNwgRwrM8*6e9CP<fo+4YI3aF`dxwDUwX#xwD#C`N?|
zt!tVi0#tr)XlHP-7R7QTtWNA?!-*-L>12{KQ@mnf;bM>y)6@D^@+-D8BqcD(NuG%c
z(PWg1F=HIK1W|!+$5w#>%NLtb2k1TnleoeY5{>XaMz=E}gXe?m2NRy;05-yKDey1g
zjA$EYe2OV5j3@5ViaEw#;bUp*PKJ4v3tu8T5LM`wkpqaYI@Nv?<Wa(4hEhP9F+(0D
zt(c*gNze=uR5Xf7;NrYux|oOxs@szU^9`odkcukiBw|&u5ME5hl8QABSmY+4VH^xU
zI0I#9zeAc~Rm_AFCU}ApK#=_uw@xZPB&x(!Dgjp^-PVT2V~J^kvf(W&n0JDlMv$$@
z%Q%T8F+MKxN%S?QMY0o{Ola4^x&ujg#Ynhm5p}d~(c!Bab%M;UY}GMb>{dPLWiT*S
z{5eg5Bem|Xxm__|k#+Bq-Mf~zXWR#7&0l8HPp^7b9n#DF8PDl8=fHY>^I|Mh|ML9c
z3Js>Ux_0&$+Skgr{siYOn=g|ZFRZykA2zfu1|K%;p0|R9KX~{(|GWO|!6EtJkQ6+h
zJs6P>M!siS7+vaE^Xyx@C`gIxpHS3c!+-&d?j_o9K$EY|_C0p7^1J62hkkVa`{$QU
z@7V9#S6bimz3a>DJoR9Y)HwLi9r)BtHFkYsp~@?7_RjU*9GDyUp#JFU(3-Pv-L-k)
zV8*o#=d#XQ@zk&kbKU?sXP7YDs`!+mDklx-7Mz|ty->I2Y{4>4<Dc^{yt3wOUa#7e
zt!kF5ntyiu?^;&)zumEVMczNK*5%K%ocW;3zjXNrN0;ayo{+oza?6=a)!Esj>#nL>
z;kVN0ZfJ;E5EsMWg?i0x`@DUjHCx{)*LN;^e(mo2w?f-axqj#J_6Nt;0zv8A`Apz7
zX_S)#oP2t0%^m*iCGbZcf3}5cJxhxgAmu-~YEL?BPdF#oY{dJ+@1XEDH43!W(kQfQ
zDQL*6u>4i?%Ult-O6DDrpfO<6=P7*k`2=&&1d891SNvNkD#4d>Ex>%^^}8tP^XQI2
z1T^FT$a2sEh5{OMhQiXSt60l8MbPAXtpt53f~Qv;v8b2~p%N9r2j`RI1hzWCzvhVu
zH!skqDADmTs7^+wL;%iv-I`dUL#LRv8LXg~64QJ{F{yRLL{0=XpBkh;4*ogbgK}%;
zwVf`D#Uu8^9O4jUH>eNYFRn4WmVFuK$m+g~`*hYlEW3v@?(?(e536c#MQ#i8LZ+&1
z*7}>Ktr^$gU)3(uWOww)J9<`<*+XaKLuax(&fYeCzgBh)O18nrAGiipCGqzyM><SD
zZ?!=F1a~0qRPHzke4)CodH#T&Tmpk<)Qu(3zQ8xefJq-y`06wh%sbJk1p1#0qPY)R
z14xacRLXhP!v+A^m2)TOM*j2w?2JSD1D}k1D`-Q#9<&EgpBE*70|!rVfD7zE>!3n`
zsvP-Y&;}s`L(l<^u@T`1HfcOG@JjAGtbGg4E%0Rt_gdc}hNW0jx1p8tn*9W02Wcai
z&L=MLXw-ov=|{-Kh+>vT)(n(Dv_36NXYdmQgs7PrxecRlCiSX^V49*=YzJdpd@REC
zDBZ={eglV1kVI-K6pO~ANpZt%ItMxc(~01Y0qZR%SB~7De&_oA>p%M%*{dyXyu{Cd
zI9z}lfiMZBiVk@VOP!D@b}==kE+8rvF+q}i<Y}9R!b3(e!w`mIfsg_p6UpmXF{{9e
zqab~XEk9)`>!xge#?h2*&xwP>u&%fWnQHQ~?l#%owm7+J%D9gg%h-BT%dF*JYwEz3
zwRy8`d*rq~*|r06+kuB|Uy<ESV2!Fhnd)u7scBqi+HR%h%h#D5S*B}^>AH1teRKW7
z<afUI8xOPoO3wnnFuZtl$+no58eY!S?0#gWn)W=hQ(JpJHBz<ppI1@tO}EBx$L3?-
z5#${wWLK|b>s4v+gtVfrQKj`56rLrm;L7GD6o%!}Mj6&6v^A$I4NCb`G<+$P5HyXY
zlG|%4r37;UpPZ|qREJc+yk~<NQE4eAM2SIXVOwGoWIzO0b=K7+yP6hTv(0<u=DjO6
zDR3^+Je+ZjNVbuuu}}_RDi(eUg=b-5<9P)W-~^?qD3!8tEX^7^Y1L|(^HvKkhJv|Z
z^G1TK5k<I*#*2tn()A<QC9oYiyJXf|^Y+OMR{)bg?PU2F7#>FBeseF1s3z|w5{H>V
z2-E=yh(Bp1g2Ldnl%k1Z$w?qRp*jJYHPVbxO%d+31zZ0Bh15}Kk3^JMAW>y)wz5O6
z>{yz7V9Hbu%vykGH?PlK&$?P<SIeS*d3gDh%wNhJihaOelHTBcVOhQWVDOh+54K4|
z;I|CRLn9LV+QY-6Fi1WW%edl_E&lj}LopGt_meG0YMf6nI;vci#J`1pmBi3coJz9!
zF8wYIL^qWpu&!hCE(Pc@V2|fCO<+<?7*$~ntPvEykwI7_O;OTUVIZmuBamf_5;AB2
z6>m{u&Cu>HYJ@7rx}m44RL^b`Ywb3rfW@cI1<m=BfvK3FSX-d>X&8JD3Ytqq=&i8Z
z5^<2id7wWZi7(6xt)(LE^p~8*u{-|;p(`Z7rXkQ+m{l*aWgUQH!NxjEV*uV9%7Z4z
zD}n~dT|o=vZnm=I$*W4A93ZM8+JpR9l=QRfc;#SBkOq3x>^4C3tQH_Q!M;ko5#%9&
zGVEp;>*+FdS|L_t3@}BDKs7%aE^y%3v^+h6tz+v;ovHMEI##>#?!C&br8vE<#99sT
zHqywxkmK=EQ0PGwC3cIxs=8J_DpVN8zQ{6cQ@24sZA9hL(U<fQY;$S)=;OIGV5ek6
zCx9MFQ3}%fegZp-x}ch$6U@<b(jNTDXRN;a>G=z*=T`zL0r*nbEa7IdE&A@6KL)Cm
zZDY6QqJd9uiVElqy`gWUYGg0Ft=sg+tW#PRK`yp~e)NJyGN`lt0qyAB;ZHL|lTk7M
zG{Zm{BSKLDA|0_9AKA|+)?B=5!>d_J;PjA}*FcWKVIXW1O~!cA4Q24ddl)ZGu46mB
z|0$0gs6{{82b~)p)IjSdD$!dlPPykY(7kBbwdXSRnhAj^)A;3x02_dt1f}}4B6=En
zEC!XL(p7A3pNa-;@XPgwu`z%YQQNDJT%Nr@o?cAet^3QmA5TAiWP;{zc<Sl29S#}b
zuSEIjv`01Cp(`8_I{|B*S2&1V`DWrV#ilQ>m@p2g*z>RWie2+V@B(Zd;>ZLKH)PuJ
z|AZ`Z1Garn!<0f#K7}Xp4d|bM|H82k487mGdilK*|8U~{-pAyd(5INs;la|@!&3zA
z*~xU7A6R7y0(J0fgmm@Mgdk`)dS;3f#pwizq?xnoNQf<t%`iu_7fNP(M+YZf>cBzX
zbm4amaCy__cOAc)BwQiDO1=V%r=0<ac~0ft$kOZ(L_hT!6X#|yhzX%UHR!3iZLp{s
zCGau+1e1WcDADR_*fT1GW2p!Xi3&_dhk8Tv0n1*)V?yXrC2JL~nA|8Hhfcs<&>G>#
z5f4w0$_RieUmu3T2ENA2F#M__NSESmP-s++zk!8S{-*Ic7~X=-5Y0_p^~09b3*TEX
zvNX{yV-I=-Dz8>_|8(=xk=f~mrn?<?Iv%>V{dBYT3j2-5Ep&R@(cB9%!?GtCxLz``
z1U#@J5|Rl<6el|%&?+Q-=?gmBGKo}jDwSjiABPaJ$i$*oct%Vx0t8v0q|+Ig02xAT
zhnAGcLu6Tqz|%T6A;6_18WwZ#OiIMqu8$mn{gPK9Q}5V#Jx(`6kUc&X<KY_1Krr}8
zI*J$<_oXZI+Zu<!w>Swm-UjXQ*o3dLiZu%Fz#wL%7w10(nPOHqq*Q1u5lU);rd_3X
z;izMn9mkBptO>Jb$P^2P|KSbS2D}Q7zM`l&;HNZ%Q^j11Z2vh9?#IDaHSA2{ijfoW
z`B|KV%Yz!ehqvL}xs*!y<x7h2AwYacLp(&1Q^LlF<_#gQa-F-?7iYzq+d6Ot-r>n#
z;Id{_(~v<Zt8dJ?U>JO~aP%1*)TCog4}m?U0?#A-w+-rbLx1{xN%p+7bS&dJFk8Ov
zYRtM?Wmjv~wN-X)-4KqIUiivNd?h3`3`oHX()hJmzwEq@{kezes`a`TvUTlpUHj6=
zYVx1o{P~+w=#mth%Eo5o*o<^3Eu}Ha{5ATh;S2nnG<>Rkpz%%m6b6Ma(0vA}t{qDC
z{f4=US?h0I@Mc`K?ykOVo43iHz4xXwp1m3OUWl06oHreFj&D1$P&QX~>)7ox^Jf-M
zE<0C--h2Js*H_Lw=$3rJOwGA9+wi)3ixz*7w!bR7Uj^vOhJ~TK=kJ`C+}oD6E_X=Y
z!>b3RvlpaSL+h1|3%ulRU7T5NeaCy>D<2s8WpC!dQ0C<!X=`x3(zD$5PRIR@cRKHP
zE{rVnEl$YwzSZlJ8@jeWi2N%4tGK+qPvVl2JN1dx=$@u$P4FNNXgYNB5Mm2n>!rFK
zOUHh4>fWj4$UBMqiA?(m$<w>$Jc&oK&RK6(%vIcab1?~Mc%|Pki$QYxX~V|Ot7|p}
zZ-&?Au1SqMSK4N;J#-xgME$O;Layk(zd2LUoh|E@%eq%0?@hit`Cj7P#DmF9&v3Tq
z4fvDzi&>t?JjwD&nNQ+GSLd!~U0&JcUD}>??Ur4;H-zk^7f-IaPi<IU+B^+gJ8U?S
z+gq=?H`sL6RxjJ?7xpa=Nm%OL0JG3~*L%mi&>*#*kT&;9XU1kLWLp>q01^MpsRkeJ
zQGU31<1?`OZls9^nqXAY$rOQ~bNC^2;<c3;qrK>$`$v9+*%D;W7>U}M*z}QUHEKP2
z5|r2L&j(P8VeZjn3KZBV{L-YIf$a6?ge}8$m}_9A;2<RrOY+-$uH9${bt<+{2%p(P
zA;l32#S@VfM8!jjGZea<;$pcTR|qsF5tI0MC?rB5f)1+sjHLx0F(N`PV>W}Cs!(b}
zA=GWraEMDLNpvig<VAq|Ar8RUrKWrE-c2xb!M})ijBin&8_La-^ykcGbA<l9%V-YJ
zpF7LVC!vKlpQk^!8O#Fxg=34kR+|T*{qXZa*#3A5s14gEXlNBHs{2@UjHs+ojqk1b
zAL#g0qpv<eC^b*^s7jY;4--W|fF4k)R-C*Rfpq07`r@1bR*|UOp;TgDD(XX>4&)M&
zqWbe9^<`6W=Q=f81CE^<I8t#?gd7MTYxL+Le*;UxHH;EFAp68f)AUDF^M6pD|F%%{
h&X1^<KcZScqI_RKt>YuA<qOj!P1k-#VXorn{{T2=J@)_r

diff --git a/scripts/src/aim/ui/__pycache__/selection.cpython-313.pyc b/scripts/src/aim/ui/__pycache__/selection.cpython-313.pyc
deleted file mode 100644
index d2b3a287fe293d2ff1ea5dd222fc268d0ef124a7..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 5967
zcma(#ZA=?klCS-3Y_P##7$Bq}WP%egn@nai3Hf#s5(qGHyMe@Et;TMkiQRTyw;}P(
zjYe8&k7!pKXJ$tsH<8wnP8XtG-7>n>EUWu**}Ic2r&;OTV|MWMX0v-Ad#C)%3?uEW
zbkbeDwi_HoviHE%^}gy=)vH&p>aAB-S0O0>b@$=yr!@%uJE`c!T0*GxzXIeV#2}0q
ziZKjQ0|soM32q!T4w$e>!%c(c0SmSaSh01$hHYA#dC)#kg{w5&GUym^VyA{%2df8a
zaLs@VyJ&RP)`1w?n^b8v?7nJ(x}B*yOf@0E9L<PvUbS3xn_<A4#?q)aOCN-5wK3H&
zrshpUnL^#P%jeDnMns;L_&6Vxg``L)k}*C`PbD!OO-phz!DFeLo=HkFe5P?Sor3R_
z5a%VD6JzwLGxP{6`JWMrK1y|PqL`F9LP&zDJ;upgG|owq&!}4ad6CCLRJAeu^)xR=
zdDR-anc_z|3_~q%<76Tw16DVZ;;}{|z`>w+oR9eoYE`K<iP;OPN#<|JDisQmc~dx<
z0b*r2wNF`gYW*#!euS<fOu?QQ7z!JABgSym#2EKL4`Tw%tYH>x)@s&r%`$EC*;Pwm
zCMiVuXRzN0I{~QXIWC^&GcGxuit}Mf#@)2v@1Ic3giq-qQmtHE;3Qre_E}Y1BqDMN
zJ`z!@A`wt)I!<tBByv5?#mhaeNMuUDk{lOAUQ9waG*sv?62bLk-G)d+B5I9BI9bNR
zWLoAW=<`6|I{c8@-OJ0-UQU#R$vEFDMX`{QrCtd`n~>;D3%wf~>`&dqE|{VLBAL_(
z;Lp%+9nNo`FFKkFrsm?#_V@Z1B43!=af?23dj)?Jx?fZ<V`B`>Xcml}F)}7U)rQC)
zn5mhx&Kf|`VEofoUlp+fVsuITtO3YG%ew|BLc~I$POY~B@(~($$4RSJ#_4$Z1RyjG
zHa85$VMq(ABZj&8$PCZLcnsEN0)eM+J50eH03<@4rfEzFlARGmK?Zf#>OA=MCNCLX
z4d6XgtgHW?wb=6dFKtblBF=%m*%IlvEWqwZO)!QO!VU2a8ow9qgkRR!MS7sbb|b{1
zV5#x~3|7ip?jc@-F&;M1h&AaHIM78e>IARSiNfS)YehfTBG|2HVa%cxezrCgF8d-_
z)u?+44;r<PR!PQQBpE#D{27GOKr{8{tThPSZY?@x#u9XF?E|V+L2?kb6n&*v(d&ab
zF<5u#G*Gd>Z5TR-kOR?3bclAbDojjLD~vT<yMfzYqPseM#O60h4$79o*n41Sn5rIF
zSND4QS9Dga=?IfUpcU4kOT#*QpoMV|8h}^O5UV$N98Z)+Y|yoge+r{vr&tU00EJS`
zgv6ScNb_20<w~gU0!^%k9KtPyrF1T7uny71*1*nY5fbg=9}!J+K7_(M^hqySw@vTg
z{8m~W;~b%w>dpIN#IZ?{aWU=<iQN^}3N%@Fn4CMUu=bJ;bZ&bM<A;e6Z)Zi9sFBuJ
z%%om5Q><lO!CmD=D?V(kzA}x5J}6n-OSAzeb!(}R3r;&z%hdH6MhpO{Fu5qS!W#4y
zw7queTA>l+(Ji0`G4*UUz=rMY4BEXF?HlJ7+8f`ni**%Tz{z0in5K%+W_|S<^oF4a
z{1%M2ZtS8>8~++>t?1p}8*O)@z=pP#O$z`%HY`Br0j$-wv34`8z5QC-cs|y~G?zW!
z_H*`a<pij|;3Jt9u-4WJ+2Oo0JD|<Xv=NUAzOh@U5%lZW<`*KUoiE{c8{Gg^nrT05
z3hv*epkw;k6+Of!vmR#Gk#RVY;7woTSoi9zN7q^G8<k^XaI;LK@FATpyRp~Aqf3Ue
zKL?vge#qLjQ$+%vEd@L+gbBpcN(Ry1iC9mNIEXEUsn_>V=Y<202)sKOWJ0f!k};*G
z`;9{<$mm!3f2LFOOQ4(zziZm`qil8A(^~!ro!y!?$?iH}cV8!`PCs+{SF`{}3mQkq
zwg^f_mzy>ug(xTt{Fe&r(KS)xhpZvi15f`CO0ly*>5t#Q;P2DGKit3`xKB^&D{p>@
zrnI|~>;bteTgrE3gLYSL-c=2oylPqjBVZdC6R`#0xt?|Ofemp`W%h`+e$x<Ga)k|o
zU9je0U~^p^W9#=<+%F?8*2vZqn!#=Cs}liT(2WFVOfrg9qJ0XrqwoQpmKAZ}m1q>!
z)sC2s4XzPym_o;lJJA%S%?AsedV!L!YdF(2oTL++9GwxwX<Cr^gyg4(ld@Kw=cID(
z!pHooNf4)!5Tu#o{2U+0pkt&Wm7<>!kMoQKF4#>l((w#5gEGeOjfpf7E&OlyKAgxn
zAX@fI>1dRfB<Q0jGIr9EfOtEm$E$!*yE5jtxoMtOsosp4rr)9IjB}I6UOHo;Wypi#
z8JE^s3NrcF5js<?HJlUTGLMhYs&$^jBFLqhwYXBXK-dZ~amLk4(}6h8VUlaXP$Cp0
zJ(yE1C1U4DMiqrLD;bA8D#lN75SOY>X(l-zDc3UfrJ*FNi|VPAU!}frTvH4ss#FRe
zC93#eD49d7#M2xd7bFmt7SoAI9?~05r1=|MRHjM7(oI8J*h{i65U<Rc-`Amq*{TKe
z65+up@v>^?fdEP4c-0n#glH-mkEy2Fq#$DAO;uxpy8!^I#H3Wq3@=R2z}z@5LNY}J
z*TQy8LQvJrNl`%n!ZKDZTq?zjG1V+{km;x<!mesgVL_B37fdEWSJ<Ylz)9CsGfWXu
zYV9C@b27={*aeaFr&BT}kuPXFi9uLQ0#3CGGAt}h^MX91S_LU4Obfse&@H84Ez-?I
zf(LTZNKBZT;xWl!Bk2^RxV+DccWI2uf=sp}nvACtq6CPRKuY*^(rYX2E!dAK1;(SA
zAq&PgRofKL$0oVxHI))nOKAo$AjTl|lvFzz8j*wyj3+1%ofEVyPc`A>yrh~E9KNO+
z0S9p)M@&ml;pSB{P~dN<R_)|~Ig`8w5}<90mJ?xeJXKf8Vv^Wj;uY?2BzYkAc@O=k
z%Ug81-|xTG|Nii;;e5;4$D<3wiZk@|wf5|RymMbp2JmDD{V}^>E4thZrlPxU!Cdq-
zK((gs$=)}X`&aiKUG>g=zW3<e%ZryDng6lo=QV|sZ|6f}YoV)3=xTl<x;7yw6G9<0
zyB3m^kW>hzm6Pc^*Ok3T7y1?N+<!E+ES|b2<qj;Fer$bc{juwzYpv_J(sle%ozfL}
zOeuRV6m||2ng$mxJgIM7r0xZB){ieP9adToE?-w#-&(n>w45u{_b;4%;_+tX+@-sh
z3!Xg-XNuk(xywqMf7!Hr{S({D1*P|F-g|DLUl(}j*3kDxpt9y{Rh+Gh?5cAY5$w#b
z8d|edadfOO8vVYU3q2USKlWha!NlFOD^-t%RvUw>LLx6p&k>rVP8lFkpQTP4vZkje
z`m^#qCRdxgbid)_D|v6<(w>KV*Y+M!;NRQ#i)cQ`<VVMp;Mixg`Js3|JgJ2FweU41
zd=08uW6@oI$8p=S82G|Xe`!VD9nWp3x>nm6VDwYl;=qzoY3W{(R``FAANT+LpDN9v
z{OFZcXSmqdx){oxx;wr&kmHujx%nmjCxI2~Ute54{-~9#d-=2Y<8S4|T)ts);oMVK
zW6|wh9QjdT+4jSsr4#w)KE>UawLEpzllGyd-Aj%6=KYF$f7YUFYUI|)nzLPTw*N(E
zZf@yM3LSl`&Z8Qk`a9O!);l$~YZh-T-OSb~?!)>VFsHwqxqE2&{1@MfDrc_bg=@sH
z;?E7n>Oty>xAo5K2eY}R<%2&x^vR*0p7`X%<J0+xNyQso^9qVrD0r`Bjn6Hpsd?di
z(N&j?emC=U$L=i7yL*=o0(k22K5g7tY}xtbz*{R#s|QXO8UvpnIK6Z!N8PPjYwB8U
z>QWAzRvH6&cL3(U|L(1K7o%&g4#m|`Y-`W8=Q<Xre~`GF_&B+AJu9p3CNk)qTkm}L
z-CT3QweLw|^Wy${(cJE(_WQo2(8{jA?fzN!-}oN~3P(mhxs+$el%DZI+vP&zm8^+O
z?%eZW@c!U~q5DJM4=fr#JimDTgNw^};cU_4z0-HQ@6NH?$Da5Ptyow6Cs&)VeC|Ja
z|FvB0qrl^D{`2vFI<B0#{Db|9|76yxG+!YmJpbX*-2Q^6v)H-|wsjzTw&<!~>@T=>
z6<b1C8?2|PzG=;UP;nnz=9kBQ=|1+`#<s=u?RVE2_bHA0^6q_K2^4a9{_rdB+<$+4
z0M+kaN0g@buDtI=!F%#iEbkt8ZX|90^OYMlouU4)UWZ!3lte=EpF2-cm-;M!S8D<I
zne%XvLcciJ6l^i&tGz+mlHX$i_&L=WY%=-`C70d~)8Nsj^fp5tPJC4u;$wsd2)GO&
zQ?0)ck|(wae1)`mHrh(Ba^cX#M9Ht3CX>lHxqjp{7Bh9^Mu1MZltb_vPKvzGiW>-R
z;sP-Vo^TTZodgiKhl!ih9@9$iUF3}jljK+fWU53Q_;=9P27`Ie^D5No`_g#K++A#?
zpKITq6Tc_l=LkTF1erbT^QhKHB$kYpo&cxPz#u#UViJwOdzJn+%1anLEZj!&%@l+J
zn1mzPLI4RRRR>%-GyatJJX*TiYDi4N--z-l?V+`Fm(`NSwBV1zGb+d|$`U5Z)oxJj
z@v`*lr-=oDAKDaEwH+<JP9Dc|&_UuNX%ql#Iz{~py6|h%@jKN18`Ptqp5LLiU!$Ji
zApgIb91DSOUwn`H(t-?*Y^Opser+&P9SdXGOSi79BS6=U$j}6*nCkew^E5?ue}xFt
G*8M;55gh*j

diff --git a/scripts/src/aim/ui/__pycache__/targets.cpython-313.pyc b/scripts/src/aim/ui/__pycache__/targets.cpython-313.pyc
deleted file mode 100644
index 69cb6ea4033b55463770225f82533ad206da8687..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 7294
zcmcIJTTmNWcDMCtgb<Pd$p~zqZD8yk9x^t5+juaTv0(tCMg|+(nwHc+W2uF2OSVU`
zovEaf!j-L<sbp%HpA61!)k0;rhOPY=W_PyMn~#k1m6k<WOz+s0N2QYaN!az&PI<p_
zZns)I%uH%im0NK8KF>Y(-1F9p(o#Eu@*f{APO)VO{Tt~R#iBQ;7t_#qA8`mHj^a#x
zRIdq}7}7TPnR_kRqO~o3)?OOZTHD%J)N8{wtxfk8_u8>tYZvvE^g6IZYuoxtd!5+H
zARpR;xZ-NW*$<iY6R~Tegmt9*0zyjW!!e<m5pGY%#E6(=l02Rel8h|Ggh*0MNGF&H
zoJdVG(|mGLW)f2D9VVO-V^Jo;OHnb(Ck0rWlv}?dkXcGC;Uy`N<jGbUx|R#D55BJR
z(oI21Ch$9Fqau7@sH`y5ort93FiX~-OUUGF>ldWd`J@nsHr+Lu5F<iF$6c=rq`L$C
z_t6!EDIlMTqp+ECa%RrbN^vgET8*YGQ>G~jTdr6+H%F8Hp*$Q+b7fpPSEQ|>a1mF*
zc{p3XX9Fn30LR{H;=Ei*0ZuWugL9A`wsR(2GEvG_s-?pk&A12_1WEqN0q_@5&mvqJ
z3pY|C7D9Y9iUnDY<grE+ETQ4wj1cwWHuT;{V`NM#V=$_hpy^P4G)Ngw7qA+$>tEwW
zl69=e7!6uE3ZC3_%p_TZ=6(5L{uDw%YX!PU%O*dPO%>?eeuN}?thlhxY@8V=F~-)v
zK{`OLx1|_6j8me(X8o;j5`Dqce*mEp#30Ek(Lsx`f<OEU9xOtM@qlv+Xy_VyG^kzz
zb-PuZ`S>k_v^9J4CpT?4+1dcNW#C_;$2YWC%Rr<+csPs5M+JElzz-fJhyw84S^|X!
zTAwkVpaCsX1FT84jNgb#sx89H!gwMU1umv0WpWauzU~*25kD`<B1oQJj$m;*Df?v%
zV`AK&68*Xe%B|DysJ4?aJ|2$p9jbp5leLP5IE5xbVC2@5u|$NA$sN$pH@M&|nN;th
zh0c$A7JEJ(TpV0!KJ|j&4Ct7z3jn@raG>X{^IgNN4HLe?geg^fOq7#4T$Pp+I4ML`
zGYGlr5T&GmWnD3-C2=7hhVG;|Evt_FeY9<Ck!k@2G7k4o$;m`qz^aAl54CtY#wW)U
zI4)y?nrhXM$MC2~CY;OY1@9n}t}S;|Yrc~Nr3A?Lpn4a5>8@L0+Lju!%#meZ)_o@D
z?$5aUv+lte>zD2wv#HFUQyF*1jP-em=L@DW>lyxA>s;H9Di$vNU2Tr-&amB&hCaXg
ztE)Md`(Wsyb>^(%8Gc?;tu4JomVR9O<J!L(TJHSiz^4O`r!pr;jb)csU7i`o%ik6u
zZ;*QVubxYC4IuQhmNN$|ziOgM-QhWN#Pat$oTT1IL%oUph-_&(;Xk24*bgL?DoE<v
zAgR>4o)|3)<kdMWE|ee@Ftkiz453rhMk&(FgDFtZ73&LOcR>@Zj~dKv$oZ?#+Rd<Y
z8*JLCLwR8VO%T@Q5oC}mNFz0lSo45Nwfx@H%&=BWPRAgD2=9hUwM->MNiAFFv`~x>
z3o)5B;n&C_jdRGk45KrRgK$(Rq8SWXt=`Nr8|Mg%$(Nye7yZlayII%0C%5k^a`La~
z*&81n{_ya8+YdV)cI4`hE^*5ZzhpmUA9d!sM>5?b+3ri(<Ck;CdF2|fREHH|JSSYw
z2-lTp{Ha^Y+`gM}-BWD$UOsW%lZiC_S?AtPza_F!W!PX?d*wZ#5dIJ)69k>jQ9~4{
zrERPL*oeF;<4m0Sm_;(L>wTgZ{iuN`G=kKYvfZ0=7S77i+t~nOF@xp`w3RE`O`L6v
zNTF7O1v}Di@|z6n#SjdL=x-@tYwcXgF_XciJm4ENH)uGsj)6rpCd{f9b?SyxE$Ls^
zJ;R{QZ1GeqDNe_Pv^yZ&6op&s4vcC&M>M2L**A$AVVZ+P(;tOKJ!10WcFqlEsBAl}
ze-piLWl(>)&cqYwh<TjC&;w<vF)S#3Q|ta$IkNcVgdl-?g*(*t&FnZWMy`hp#9z_l
z#;#g8LiRxQ6|kyudgRH4i;vqrr~iS5#!H#V`k(l!Db?DQNJ+_bMNk%)<fJIC6X0|Y
z5U40BjPpPv)~4EY-!6ecxoch?22+hxQ%Y26tPu}4lL2!~kkq0`LK+uwoVDORFsMnL
zYE6pCn4r=iW-@p@1P7wHbqTE4=346R|Mlk803@%zSIfK~)Vx=dD{IV@HO>o9S_YM&
zU~VX!844?r$?TA*ByTHajY`=&GxT$pceTPhbAHw4cu;h|=z;UTQ>kPZMwX(Vh(8fC
zr$;guE@n@UWDk!h&7;a#cqKZaOiI~kLb*JxG~HOS;nk{|k9K{yOL^_Yqu|`Gr&WD3
zHx(PF3~^B7D!^)!>=HKAWcM00{y${b(3cH}H4Wf4IE6K1@Y)dWAQgEk7%032?t%fC
zXqUnRlxh!<kOYmT)ScUq-k2mhRwgp{E?RX}Jh*%RZq8Moan;YCebUtbIGG!KJ2UvU
z!jESMC$g?d#WtxCB<<uhzRAZ5@}fz@LNn<F7njHvQ3e{Z!l14+V&xSSj2Fsi`RE~z
z0(C_PX+!*@!1SOf2#hUdJH<!T9cMXaVnAJR)^<|^swKO(F>i*-($vs4h7NXZ<MfVt
z4E4p)Tv4E);?_}HS9Y(MMq3LkGxmR*`Wu7DP%lIgjuHE(l^|`XbSL6U4w?++*s$Kg
zm2%E)#$6EZlx;I!PQn~x+;4&4W(R}_MZqGj^7tr1JP5NvMHnmA#sIq@&H26sud0J)
zLUUN{(pCdg0Ue2D-cm-R1|1|@(6#}ZZNn|A51R7O$~9=<!~?X-Euf&g8JfX4JQ$at
z%})hw0pF{82xQ}S`;k-}q#*zTpHZ?0?E#{Jwv+&I-?kKkhhXP*gi^qx)1R#yS{}G=
z^rt6)&xr}^hnEZ%2kN$ffNrpaaH_w+837`STT0Mw(1k%kM_|vEY3KqDjevdW_GgU#
z;tx5Yf3I%Y`s4ZUU+Uj6I6*IP%6HJiz!h9p=S7!n&WD$vwKN+2_ZYy}%jkb`JBj~N
zcr%cwpp)B0#(>Xjpsme2(LwW|#h4j`08uX+ILBq2YJA%Zt_C=qZ|FCW+>%pr0T;b)
zKv@3<h<I)(TrF3}F@96fZODn_3_6J!c+=GH*Kqwm;4hVZi&Xp#xi_~vSO)hkU{553
zjBtB4+;*d!)E~4EZq|ZYv*ePT;7B(NU=ly4{R0Uml88gdMM6x5xV<uSOH58Odb)=x
zL{<zWaQIfW=oXJ9QJMfp!5R~83NaO>OD-6(+HnSh6oNy*$6_kgmiBbUVz0nY@7B*b
z!RS7O5M{y;`eFf6OF|??@<A$fAnohHi8#aOlS&E9$f>ZFU`p5Zh%tyR8SpmbWHb0M
zf|U1RbigWgFzwA79>ZzUXVN=|6B83~Q7~(alp;YX!zba8q!<@esy*$>ZzJ=B80k_D
zE(;ryTH*#0OuQ5kVsLv)n2%gnsr~64+uf1br&4U%l}8J1s8RMSV$?9PRcSNhXVSj>
zX?osl;}z|17E)=LsF8GeeyRRK<AgM66SFUEFC4+Lm6!+)J`EM|&t!1oRBI$A@Zi5q
z3ValTYkL?&BZA@Ty6a|vY+4H2$i7Zeoh8*dQfZ+T11;4mLUv77?GV`KeM6Pzr>6xe
zsumlMB4Z-(T2KZVfFxdbMA&lO2dO9X4Ww!$RTrs<f3MmL`9WE=%8|shfV;^!t&v66
z{AAT;<O5XudWZ)nrNSg(AY$F!EY-FYf;y`n0ut97e4Z^u_d%Vq=AeZ1_m$OMn|+|o
zvjltj*YJMe1bM4+UN+-p7xpc)iWmNb8T)fr)vCk&;LZDQJ{Y(^pzM508NNC*ka1iC
z$8#3X9-ir6b(WJAz4v>+_ZDgN-S3;TeB}DjwP4HojxM)6ZvUra|9DIZUd#4{a($EF
z#Ac3*D~_pEkMD!?@16hB?VGDmYTG}nSib!8I_2nj<@}U#_<GhI%g-EDj*n&CSMt3>
z%8}u$JDBhJm+G?a&b4A|opa5Oyftej$XmOHtlrw0vuh6I_Rg9A;?8Pi)!c#Eo3o{m
zpV0femBtgFbv?5Gd{8;@*5gj4en6=lP}~E?f~uNaRa>U2ZRz!FRrf5tT3Pdh`uXwi
zH_g{9B$T=irLseDcWhkTl&NZ3=*?Dj%+k*f9G%-SXPbZRhfNQgl*(4c-Ls4z9ax@(
z#;Uh+rsvn*x>;(qx#i>j#r|CL=}hzKr_G%i&%W7n&nubv(QISK7d~dyQ=RiPW;~7a
zx0lN2rKNDzb1dh1Bjb7FQQ3;8YqgHe)g4@^J2+=v_0{HlY{thf99{4)AISPTa=x<}
z-`Pj}Q{TB4X2i6=C`K)3sNa~;4(4k&YCE!Y^OHM2x%1O|EBkxCHd8g{D0P3&!=3Y<
zug$2oVZQru=jXQ;qDyUy6APD?BFhcSH$L6FT$O3+QieyBOP4dlV=GtRUg4vPFqP%6
zXRpST*W*uXq%ZdOteH`1^=}XX`Og)VADnvcRIXxgred$M@64ks3U^uQ9#gJPWh<`F
zbc4fv|BmYRt?qAM8v3MYHaXY%-mO`2PM&XHpdKEXXEUDW<>5!WKOLDltMO$^#@n(m
zz8F(FE+|76l?x-v$<eI$(oD~4Mb(@zH!^?b2lB$<@Bh(!eCfEdvqP!qP#hgEU$_V|
zT6XR8qn*~?CVEpmLv)0hgux`8^6f4<`B_49vLTPkS_eo#c}tX{iCc1d=UIvTguv(m
z+#(D3Cego<2qe6RaW8;{069iJ`LKnk4AogMK_QYE+#JE|)FPPt0U;f5L6+Igviu!O
z`{5v&+)ImYa;`lY*Pi*K%U4#}9%b|jJe9kC4N>lE6x7AnC@r>ut6^|Q5KCiCwS}Rr
z>o*IuhyqTgu=IN^MLKp4Y{^w46_q5rsI+6FN(U(9d`#wa-KfEnjWJkXvSIyqEKiq^
z!<akF02na{#<xLk(<u2x2@{lAhiVIjBt9;LLaIF!iYKC}7->5~p&KbamY;EjLYm=?
ziIN~CLLtrQs1BL@k`svw$;m`ii#<1(67r__22`py6w()l_+%1`;Z#zP0R*9=MpR8H
zV-i_ul>-_wNwNGnS~C?{y~^d#HweCKT2+qd@)st``o|QAE?vH+HGfB2t;5vsoRn3h
z*66*~)5>5-xpDIw1kE*4eG{Ne*8Cf4hYYZ8wI~#dCL;R1$5ZfdaBmFU4v8efbTKik
zkw~q8#QS<iy;ZZuT0UI$Y@UfFh`rUb<XbiYU4@vQr79zvQerD{!Qi!|q^y}@)tw*L
z%?~(4dbU%e%Vt_Z-d}&G4*aKpE^#nq;)1Q2DT?|64Lw79{vG+AA^$UU;2COohF*Jy
S>c648DC!#ZTcmw7!v7C)8;b7$

diff --git a/scripts/src/aim/ui/access.py b/scripts/src/aim/ui/access.py
index 94fe0d7..9e910a7 100644
--- a/scripts/src/aim/ui/access.py
+++ b/scripts/src/aim/ui/access.py
@@ -9,7 +9,7 @@ from pathlib import Path
 import re
 from ruamel.yaml import YAML
 from ruamel.yaml.error import YAMLError
-from aim.exceptions import AIMError, OperationCancelled
+from aim.exceptions import AIMError, OperationCancelled, WinRMConnectionFailed
 from aim.ui.components import MenuItem
 from aim.ui.selection import Choice
 
@@ -57,7 +57,7 @@ class AccessScreens:
             raise ValueError('AD DNS domain must be a DNS name, not a UPN or DOMAIN\\user.')
         return domain, f'{self.config.service_user}@{domain}'
 
-    def _bootstrap_domain_credentials(self, customer: str, domain: str):
+    def _bootstrap_domain_credentials(self, customer: str, domain: str, validation_host):
         defaults = self.customers.load_defaults(customer)
         # Respect the operator's configured down-level domain, rather than guessing
         # its NetBIOS name from the first DNS label.
@@ -66,16 +66,40 @@ class AccessScreens:
         if '@' not in username and '\\' not in username:
             username = f'{defaults.ad_netbios_domain}\\{username}' if defaults.ad_netbios_domain else f'{username}@{domain}'
         self.ui.details([('Bootstrap identity', username)])
-        password = self.ask('Temporary administrator password', password=True)
+        password = self._verified_winrm_password(
+            'Temporary administrator password', username, validation_host
+        )
         return username, password
 
+    def _verified_winrm_password(self, prompt: str, username: str, host):
+        while True:
+            password = self.ask(prompt, password=True)
+            if not password:
+                self.ui.result('A password is required. Re-enter it, or press Ctrl+C to cancel.', level='warning')
+                continue
+            self.ui.result(f'Checking credentials against {host.fqdn}...', level='info')
+            try:
+                self.winrm.test_connection(host.fqdn, host.ansible_host, username, password)
+            except WinRMConnectionFailed as exc:
+                self.show_error(exc)
+                self.ui.result(
+                    'The WinRM credential check did not succeed. Re-enter the password, or press Ctrl+C to cancel.',
+                    level='warning', title='Password not accepted',
+                )
+                continue
+            return password
+
     def _new_service_password(self):
-        password = self.ask(f'Password for {self.config.service_user}', password=True)
-        if not password:
-            raise ValueError('The service-account password cannot be empty.')
-        if password != self.ask('Confirm service-account password', password=True):
-            raise ValueError('Service-account passwords do not match.')
-        return password
+        while True:
+            password = self.ask(f'Password for {self.config.service_user}', password=True)
+            if not password:
+                self.ui.result('The service-account password cannot be empty. Re-enter it, or press Ctrl+C to cancel.', level='warning')
+                continue
+            confirmation = self.ask('Confirm service-account password', password=True)
+            if password != confirmation:
+                self.ui.result('Service-account passwords do not match. Please enter both values again.', level='warning')
+                continue
+            return password
 
     def _access_batch(self, title, targets, operation):
         results = []
@@ -101,7 +125,7 @@ class AccessScreens:
         if not targets:
             return
         username = self.required_value('Temporary administrator (UPN, DOMAIN\\user or local user)')
-        password = self.ask('Temporary administrator password', password=True)
+        password = self._verified_winrm_password('Temporary administrator password', username, targets[0])
         self.ui.review('Test temporary access', [('Targets', '\n'.join(h.fqdn for h in targets)), ('Identity', username), ('Transport', 'NTLM / HTTPS :5986')])
         if self.confirm('Test these hosts?', default=False):
             self._access_batch('Temporary WinRM access', targets, lambda h: self.winrm.test_connection(h.fqdn, h.ansible_host, username, password))
@@ -110,23 +134,88 @@ class AccessScreens:
         targets, label = self._windows_targets(customer, inventory_path, 'Access > Windows > Prepare local account')
         if not targets:
             return
+
+        credential_states = {
+            host.fqdn: self.customers.windows_host_credential_state(customer, host.fqdn)
+            for host in targets
+        }
+        state_rows = []
+        state_labels = {
+            'shared_local': 'Shared local', 'host_local': 'Host-specific local',
+            'custom': 'Existing/custom', 'partial': 'Incomplete', 'missing': 'Missing',
+        }
+        for host in targets:
+            state = credential_states[host.fqdn]
+            missing = []
+            if not state['has_user']:
+                missing.append('ansible_user')
+            if not state['has_password']:
+                missing.append('ansible_password')
+            label_text = state_labels.get(str(state['model']), str(state['model']))
+            if missing:
+                label_text += ' (missing ' + ', '.join(missing) + ')'
+            state_rows.append((host.fqdn, label_text))
+
+        self.ui.table(['Host', 'Current host_vars credential state'], state_rows)
+        incomplete = [name for name, state in credential_states.items() if not state['complete']]
+        if incomplete:
+            self.ui.result(
+                'Some selected hosts do not have a complete ansible_user/ansible_password override. '
+                'Choose a local credential model so AIM can repair those host_vars after bootstrap.',
+                level='warning', title='Credential model required',
+            )
+        else:
+            self.ui.result(
+                'All selected hosts already have complete credential overrides. You may retain them or '
+                'reapply a standardized local credential model.',
+                level='info',
+            )
+
+        while True:
+            model_choice = self.menu([
+                MenuItem('1', 'Shared local service account', 'Use vault_windows_local_ansible_password'),
+                MenuItem('2', 'Host-specific local account', 'Use one host-specific Vault variable per host'),
+                MenuItem('3', 'Retain existing credential overrides', 'Keep current ansible_user / ansible_password values'),
+            ], back='Cancel')
+            if model_choice == '0':
+                return
+            if model_choice == '3' and incomplete:
+                self.ui.result(
+                    'Retain is unavailable because at least one selected host is missing ansible_user or ansible_password.',
+                    level='warning', title='Incomplete host variables',
+                )
+                continue
+            credential_model = {'1': 'shared_local', '2': 'host_local', '3': 'retain'}[model_choice]
+            break
+
         bootstrap = self.required_value('Temporary administrator', 'Administrator')
-        bootstrap_password = self.ask('Temporary administrator password', password=True)
+        bootstrap_password = self._verified_winrm_password('Temporary administrator password', bootstrap, targets[0])
         service_password = self._new_service_password()
-        self.ui.result('Existing host credential overrides are preserved unless you explicitly replace them below.', level='info')
-        update_vars = self.confirm('Set selected hosts to the shared-local Vault credential model?', default=False)
+
+        if credential_model == 'shared_local':
+            host_var_action = 'Apply shared-local credential references'
+            vault_detail = 'vault_windows_local_ansible_password'
+        elif credential_model == 'host_local':
+            host_var_action = 'Apply host-specific local credential references'
+            keys = [re.sub(r'[^a-z0-9]+', '_', h.fqdn.lower()).strip('_') for h in targets]
+            vault_detail = '\n'.join('vault_ansible_password_' + key for key in keys)
+        else:
+            host_var_action = 'Retain complete existing references'
+            vault_detail = 'Existing host_vars references'
+
         self.ui.review('Prepare local service account', [
             ('Targets', '\n'.join(h.fqdn for h in targets)), ('Bootstrap identity', bootstrap),
             ('Local account', self.config.service_user), ('Group', 'Local Administrators'),
-            ('Host variables', 'Set shared-local credential references' if update_vars else 'Retain existing references'),
-            ('Vault variable', 'vault_windows_local_ansible_password'),
-        ], warning='Existing service-account passwords may be reset. Domain-wide group variables are not changed. Store the matching password in Vault.')
+            ('Host variables', host_var_action), ('Vault variable(s)', vault_detail),
+        ], warning='Existing service-account passwords may be reset. Domain-wide group variables are not changed. Store the matching password in the selected Vault variable(s).')
         if not self.confirm('Prepare these local accounts?', default=False):
             return
+
         def prepare(host):
             self.winrm.bootstrap_service_user(host.fqdn, host.ansible_host, bootstrap, bootstrap_password, service_password)
-            if update_vars:
-                self.customers.set_windows_host_credential_model(customer, host.fqdn, 'shared_local')
+            if credential_model != 'retain':
+                self.customers.set_windows_host_credential_model(customer, host.fqdn, credential_model)
+
         self._access_batch('Local account preparation', targets, prepare)
 
     def windows_domain(self, customer: str, inventory_path: Path) -> None:
@@ -136,7 +225,7 @@ class AccessScreens:
         if not host:
             return
         domain, service_upn = self._domain_identity(customer)
-        bootstrap, bootstrap_password = self._bootstrap_domain_credentials(customer, domain)
+        bootstrap, bootstrap_password = self._bootstrap_domain_credentials(customer, domain, host)
         service_password = self._new_service_password()
         # Validate the local destination before making the remote AD change.
         variables = self.customers.require(customer) / 'group_vars/windows/main.yml'
@@ -167,7 +256,7 @@ class AccessScreens:
         if not targets:
             return
         domain, service_upn = self._domain_identity(customer)
-        bootstrap, bootstrap_password = self._bootstrap_domain_credentials(customer, domain)
+        bootstrap, bootstrap_password = self._bootstrap_domain_credentials(customer, domain, targets[0])
         self.ui.review('Enable member-server access', [
             ('Targets', '\n'.join(h.fqdn for h in targets)), ('Domain account', service_upn),
             ('Bootstrap identity', bootstrap), ('Change', 'Add the existing account to local Administrators'),
diff --git a/scripts/src/aim/ui/administration.py b/scripts/src/aim/ui/administration.py
index dfdbbe3..f792139 100644
--- a/scripts/src/aim/ui/administration.py
+++ b/scripts/src/aim/ui/administration.py
@@ -5,6 +5,7 @@ from copy import deepcopy
 from dataclasses import fields
 from pathlib import Path
 import os
+import re
 from ruamel.yaml import YAML
 from ruamel.yaml.error import YAMLError
 
@@ -193,17 +194,28 @@ class AdministrationScreens:
                        warning='Existing values are not normalized. Malformed plaintext files are skipped. This is not a repair of invalid YAML syntax.')
         if not self.confirm('Apply non-destructive consolidation?', default=False):
             return
-        changed, skipped = consolidate_customer_templates(root, self.config.service_user, self.config.required_group)
+        changed, skipped, permission_warnings = consolidate_customer_templates(root, self.config.service_user, self.config.required_group)
         for item in changed:
             self.ui.result(f'Consolidated {item.relative_to(root)}.')
         # Avoid printing stored parser snippets which may contain secret values.
         for item in skipped:
             self.ui.result(item.split(':', 1)[0] + ': skipped; invalid YAML (file left untouched).', level='warning')
+        for item in permission_warnings:
+            try:
+                display = str(Path(item.split(':', 1)[0]).relative_to(root)) + item[item.find(':'):]
+            except (ValueError, OSError):
+                display = item
+            self.ui.result(display, level='warning', title='Permission normalization skipped')
         vault_changed = self.vault.consolidate_template(customer) if include_vault else False
         if vault_changed:
             self.ui.result('Consolidated and re-encrypted group_vars/all/vault.yml.')
-        self.ui.result(f'{len(changed) + int(vault_changed)} files changed; {len(skipped)} skipped.',
-                       level='warning' if skipped else 'success', title='Consolidation finished')
+        summary = f'{len(changed) + int(vault_changed)} files changed; {len(skipped)} skipped'
+        if permission_warnings:
+            summary += f'; {len(permission_warnings)} permission warning(s)'
+        summary += '.'
+        self.ui.result(summary,
+                       level='warning' if (skipped or permission_warnings) else 'success',
+                       title='Consolidation finished')
         self.pause()
 
     def restore(self, customer: str, path: Path) -> None:
@@ -231,14 +243,18 @@ class AdministrationScreens:
                 MenuItem('2', 'Service account name', draft.service_user),
                 MenuItem('3', 'Authorized AIM group', draft.required_group),
                 MenuItem('4', 'Platform groups', ', '.join(draft.platform_groups)),
-                MenuItem('5', 'Save settings', 'Apply the pending values'),
-                MenuItem('6', 'Screen clearing', 'Enabled' if draft.ui_clear_screen else 'Disabled'),
-                MenuItem('7', 'Character style', 'ASCII' if draft.ui_ascii else 'Unicode (terminal-dependent)'),
-                MenuItem('8', 'Command output', draft.ui_output),
-                MenuItem('9', 'Checkmk agent base URL', draft.checkmk_agent_base_url or '(not set)'),
-                MenuItem('10', 'Checkmk agent version', draft.checkmk_agent_version or '(not set)'),
-                MenuItem('11', 'Checkmk agent role files', str(draft.checkmk_agent_role_files_dir)),
-                MenuItem('12', 'Checkmk monitoring scripts', str(draft.checkmk_monitoring_scripts_dir)),
+                MenuItem('5', 'Screen clearing', 'Enabled' if draft.ui_clear_screen else 'Disabled'),
+                MenuItem('6', 'Character style', 'ASCII' if draft.ui_ascii else 'Unicode (terminal-dependent)'),
+                MenuItem('7', 'Command output', draft.ui_output),
+                MenuItem('8', 'Checkmk protocol', draft.checkmk_agent_protocol),
+                MenuItem('9', 'Checkmk base URL / host', draft.checkmk_agent_base_url or '(not set)'),
+                MenuItem('10', 'Checkmk site name', draft.checkmk_agent_site_name or '(not set)'),
+                MenuItem('11', 'Checkmk version', draft.checkmk_agent_version or '(not set)'),
+                MenuItem('12', 'Checkmk patchlevel', draft.checkmk_agent_patchlevel or '(not set)'),
+                MenuItem('13', 'Checkmk revision', draft.checkmk_agent_revision),
+                MenuItem('14', 'Checkmk agent role files', str(draft.checkmk_agent_role_files_dir)),
+                MenuItem('15', 'Checkmk monitoring scripts', str(draft.checkmk_monitoring_scripts_dir)),
+                MenuItem('16', 'Save settings', 'Apply all pending values'),
             ])
             if choice == '0':
                 if not dirty or self.confirm('Discard unsaved settings and go back?', default=False):
@@ -262,34 +278,63 @@ class AdministrationScreens:
                     if not groups:
                         raise ValueError('At least one platform group is required.')
                     draft.platform_groups = groups
-                elif choice == '6':
+                elif choice == '5':
                     draft.ui_clear_screen = not draft.ui_clear_screen
-                elif choice == '7':
+                elif choice == '6':
                     draft.ui_ascii = not draft.ui_ascii
-                elif choice == '8':
+                elif choice == '7':
                     draft.ui_output = 'live' if draft.ui_output == 'compact' else 'compact'
+                elif choice == '8':
+                    protocol = self.required_value('Checkmk protocol [http/https]', draft.checkmk_agent_protocol or 'https').lower()
+                    if protocol not in {'http', 'https'}:
+                        raise ValueError('Checkmk protocol must be http or https.')
+                    draft.checkmk_agent_protocol = protocol
                 elif choice == '9':
-                    draft.checkmk_agent_base_url = self.optional_value('Checkmk agent base URL', draft.checkmk_agent_base_url).rstrip('/')
+                    value = self.optional_value('Checkmk base URL / host (example: monitoring.domain.de)', draft.checkmk_agent_base_url).strip().strip('/')
+                    if value.startswith(('http://', 'https://')) or '/' in value:
+                        raise ValueError('Enter only the host name, without protocol, site path or /check_mk/agents.')
+                    draft.checkmk_agent_base_url = value
                 elif choice == '10':
-                    draft.checkmk_agent_version = self.optional_value('Checkmk agent version', draft.checkmk_agent_version)
+                    value = self.optional_value('Checkmk site name (example: monitoring)', draft.checkmk_agent_site_name).strip().strip('/')
+                    if '/' in value:
+                        raise ValueError('Checkmk site name must be a single URL path segment.')
+                    draft.checkmk_agent_site_name = value
                 elif choice == '11':
+                    value = self.optional_value('Checkmk version (example: 2.4.0)', draft.checkmk_agent_version).strip()
+                    if value and not re.fullmatch(r'\d+\.\d+\.\d+', value):
+                        raise ValueError('Checkmk version must look like 2.4.0.')
+                    draft.checkmk_agent_version = value
+                elif choice == '12':
+                    value = self.optional_value('Checkmk patchlevel (example: 46)', draft.checkmk_agent_patchlevel).strip()
+                    if value and not value.isdigit():
+                        raise ValueError('Checkmk patchlevel must be a non-negative integer.')
+                    draft.checkmk_agent_patchlevel = value
+                elif choice == '13':
+                    value = self.required_value('Checkmk revision', draft.checkmk_agent_revision or '1').strip()
+                    if not value.isdigit():
+                        raise ValueError('Checkmk revision must be a non-negative integer.')
+                    draft.checkmk_agent_revision = value
+                elif choice == '14':
                     value = Path(self.required_value('Checkmk agent role files directory', str(draft.checkmk_agent_role_files_dir))).expanduser()
                     if not value.is_absolute():
                         raise ValueError('Use an absolute Checkmk agent role files path.')
                     draft.checkmk_agent_role_files_dir = value
-                elif choice == '12':
+                elif choice == '15':
                     value = Path(self.required_value('Checkmk monitoring scripts directory', str(draft.checkmk_monitoring_scripts_dir))).expanduser()
                     if not value.is_absolute():
                         raise ValueError('Use an absolute monitoring scripts path.')
                     draft.checkmk_monitoring_scripts_dir = value
-                elif choice == '5':
-                    self.ui.review('Save application settings', [('File', draft.config_path), ('Root directory', draft.root_dir),
-                                   ('Service account', draft.service_user), ('Authorized group', draft.required_group),
-                                   ('Checkmk agent source', draft.checkmk_agent_base_url or '(not set)'),
-                                   ('Checkmk agent version', draft.checkmk_agent_version or '(not set)'),
-                                   ('Checkmk role files', draft.checkmk_agent_role_files_dir),
-                                   ('Monitoring scripts', draft.checkmk_monitoring_scripts_dir)],
-                                   warning='Changing defaults does not migrate existing inventory variables, users or SSH keys.')
+                elif choice == '16':
+                    self.ui.review('Save application settings', [
+                        ('File', draft.config_path),
+                        ('Root directory', draft.root_dir),
+                        ('Service account', draft.service_user),
+                        ('Authorized group', draft.required_group),
+                        ('Checkmk download root', draft.checkmk_agent_download_base_url or '(incomplete)'),
+                        ('Checkmk package version', draft.checkmk_agent_package_version or '(incomplete)'),
+                        ('Checkmk role files', draft.checkmk_agent_role_files_dir),
+                        ('Monitoring scripts', draft.checkmk_monitoring_scripts_dir),
+                    ], warning='Changing defaults does not migrate existing inventory variables, users or SSH keys.')
                     if self.confirm('Save these settings?', default=False):
                         draft.save()
                         for field in fields(draft):
diff --git a/scripts/src/aim/ui/app.py b/scripts/src/aim/ui/app.py
index 202d368..955d2dc 100644
--- a/scripts/src/aim/ui/app.py
+++ b/scripts/src/aim/ui/app.py
@@ -35,6 +35,7 @@ from aim.ui.playbooks import PlaybookScreens
 from aim.ui.administration import AdministrationScreens
 from aim.ui.targets import TargetScreens
 from aim.ui.maintenance import MaintenanceScreens
+from aim.ui.vault_credentials import TerminalVaultInteraction
 
 _STYLE = re.compile(r'\[/?(?:bold|dim|red|green|yellow|cyan|magenta)(?: [^\]]+)?\]')
 
@@ -50,12 +51,13 @@ class App(CustomerScreens, HostScreens, AccessScreens, PlaybookScreens,
         self.customers = CustomerManager(self.config)
         self.backups = SessionBackupManager()
         self.writer = InventoryWriter(self.backups)
-        self.vault = VaultManager(self.customers)
+        self.vault_interaction = TerminalVaultInteraction(self.ui)
+        self.vault = VaultManager(self.customers, vault_interaction=self.vault_interaction)
         self.variables_viewer = VariableViewer(self.customers)
         self.ssh = SSHManager(self.customers, self.config, self.vault)
         self.sophos = SophosConfigManager(self.customers)
         self.winrm = WinRMManager(self.config)
-        self.playbooks = PlaybookManager(self.customers, self.config)
+        self.playbooks = PlaybookManager(self.customers, self.config, vault_interaction=self.vault_interaction)
         self.current_customer: str | None = None
         self.current_section = 'Home'
         self._snapshot_key = None
@@ -255,6 +257,7 @@ class App(CustomerScreens, HostScreens, AccessScreens, PlaybookScreens,
             ('vault_windows_local_ansible_password', 'Windows shared local account password'),
             ('ansible_vault_linux_ssh_pass', 'Linux legacy account password'),
             ('vault_linux_ssh_key_passphrase', 'Linux private-key passphrase'),
+            ('vault_checkmk_unifi_password', 'UniFi monitoring account password (optional)'),
         ]
         return {key: self.ask(label, password=True, default='', show_default=False) for key, label in fields}
 
@@ -271,26 +274,29 @@ class App(CustomerScreens, HostScreens, AccessScreens, PlaybookScreens,
                     self.clear()
                     self.header('AIM > Home', f'Authorized group: {auth.group_name} | GID {auth.gid}')
                     choice = self.menu([
-                        MenuItem('1', 'Create customer', 'New inventory and optional defaults'),
-                        MenuItem('2', 'Open customer', 'Hosts, access, Vault and playbooks'),
-                        MenuItem('3', 'Browse customers', 'Local inventory overview'),
-                        MenuItem('4', 'Delete customer', 'Remove the complete customer inventory', True),
-                        MenuItem('5', 'Maintenance', 'Controller-local Checkmk artifacts and script synchronization'),
-                        MenuItem('6', 'Settings', 'Application and display preferences'),
+                        MenuItem('1', 'Open customer', 'Hosts, access, Vault and playbooks'),
+                        MenuItem('2', 'Multi-customer operations', 'Run one catalog operation sequentially across isolated customers'),
+                        MenuItem('3', 'Create customer', 'New inventory and optional defaults'),
+                        MenuItem('4', 'Browse customers', 'Local inventory overview'),
+                        MenuItem('5', 'Delete customer', 'Remove the complete customer inventory', True),
+                        MenuItem('6', 'Maintenance', 'Controller-local Checkmk artifacts and script synchronization'),
+                        MenuItem('7', 'Settings', 'Application and display preferences'),
                     ], back='Exit')
                     if choice == '0':
                         return 0
                     if choice == '1':
-                        self.call(self.create_customer)
-                    elif choice == '2':
                         self.call(self.open_customer)
+                    elif choice == '2':
+                        self.call(self.multi_customer_operations_menu)
                     elif choice == '3':
-                        self.call(self.list_customers_screen)
+                        self.call(self.create_customer)
                     elif choice == '4':
-                        self.call(self.delete_customer)
+                        self.call(self.list_customers_screen)
                     elif choice == '5':
-                        self.call(self.maintenance_menu)
+                        self.call(self.delete_customer)
                     elif choice == '6':
+                        self.call(self.maintenance_menu)
+                    elif choice == '7':
                         self.call(self.config_menu)
         except EOFError:
             return 0
diff --git a/scripts/src/aim/ui/components.py b/scripts/src/aim/ui/components.py
index c98492b..4bb7617 100644
--- a/scripts/src/aim/ui/components.py
+++ b/scripts/src/aim/ui/components.py
@@ -140,7 +140,7 @@ class OperatorUI:
         hints = {
             'menu': 'Enter / 0  Back   |   Ctrl+C  Back',
             'select': 'Enter / 0  Cancel   |   /text  Filter   |   p / n  Page   |   Ctrl+C  Cancel',
-            'multi': 'Number  Toggle   |   Enter  Review selection   |   0  Cancel   |   /text  Filter   |   p / n  Page',
+            'multi': 'Number  Toggle   |   a  Toggle all matching   |   Enter  Review selection   |   0  Cancel   |   /text  Filter   |   p / n  Page',
             'form': 'Enter  Accept shown default   |   Ctrl+C  Cancel operation',
             'review': 'y  Confirm   |   Enter / n  Cancel   |   Ctrl+C  Cancel',
             'result': 'Enter / 0  Return',
diff --git a/scripts/src/aim/ui/hosts.py b/scripts/src/aim/ui/hosts.py
index 72351d6..6c64d54 100644
--- a/scripts/src/aim/ui/hosts.py
+++ b/scripts/src/aim/ui/hosts.py
@@ -192,18 +192,35 @@ class HostScreens:
         return self.pick_one_host(self.inventory_hosts(customer, path, platforms))
 
 
-    def configure_sophos(self, customer: str, path: Path) -> None:
+    def configure_sophos(self, customer: str, path: Path, *, host: Host | None = None, required_keys: tuple[str, ...] = ()) -> None:
         self.clear()
         self.header(self.breadcrumb(customer, "Configure Sophos XGS"))
-        host = self.pick_host(customer, path, sophos_only=True)
+        host = host or self.pick_host(customer, path, sophos_only=True)
         if not host:
             return
 
-        hostname = host.fqdn.split(".", 1)[0]
+        existing_data = self.sophos.load(customer, host.fqdn)
+        hostname = self.ask("Firewall hostname", default=str(existing_data.get("hostname") or host.fqdn.split(".", 1)[0])).strip()
+        if required_keys:
+            self.ui.details([('Profile-required network keys', ', '.join(required_keys)),
+                             ('VLAN parent', 'Port1 (unchanged from the customer policy)')])
+            self.ui.result('Keys listed below are checked by the playbook using resolved inventory, including inherited variables. This editor changes host_vars only.', level='info')
         existing_network, existing_vlans = self.sophos.existing_keys(customer, host.fqdn)
         network_objects: dict[str, dict[str, object]] = {}
         vlan_interfaces: dict[str, dict[str, object]] = {}
 
+        missing_keys = [key for key in required_keys if key not in existing_network]
+        if missing_keys:
+            self.ui.result('Not defined in this host_vars file: ' + ', '.join(missing_keys), level='info')
+            if self.confirm('Prepare these keys in host_vars now (they may already be inherited)?', default=False):
+                for key in missing_keys:
+                    self.ui.result('Network object: ' + key, level='info')
+                    network_objects[key] = {
+                        'name': self.ask('Name', default=self.sophos.default_network_object_name(customer, key)).strip(),
+                        'network': self.required_value('Network address'),
+                        'subnetmask': self.ask('Subnet mask', default='255.255.255.0').strip(),
+                    }
+
         self.message("\n[bold]Network objects[/bold]")
         self.message("[dim]Enter an object key; empty input finishes this section.[/dim]")
         while True:
@@ -258,7 +275,7 @@ class HostScreens:
                 "zone_description": zone_description,
             }
 
-        if not network_objects and not vlan_interfaces:
+        if not network_objects and not vlan_interfaces and hostname == existing_data.get("hostname"):
             self.message("No Sophos configuration entries supplied. Nothing changed.")
             self.pause()
             return
diff --git a/scripts/src/aim/ui/maintenance.py b/scripts/src/aim/ui/maintenance.py
index 01ab53f..caa01ec 100644
--- a/scripts/src/aim/ui/maintenance.py
+++ b/scripts/src/aim/ui/maintenance.py
@@ -15,7 +15,7 @@ class MaintenanceScreens:
             self.header('AIM > Maintenance', 'Controller-local maintenance. No customer inventory is modified.')
             choice = self.menu([
                 MenuItem('1', 'Update Checkmk agent packages', 'Download MSI / DEB / RPM into the checkmk_agent role'),
-                MenuItem('2', 'Sync Checkmk monitoring scripts', 'Reset the managed shadow checkout to its configured upstream'),
+                MenuItem('2', 'Update Checkmk monitoring scripts', 'Update the managed shadow checkout from its configured upstream'),
             ])
             if choice == '0':
                 return
@@ -27,20 +27,33 @@ class MaintenanceScreens:
     def update_checkmk_agents(self) -> None:
         self.clear()
         self.header('AIM > Maintenance > Checkmk Agent Packages',
-                    'Downloads all package formats first; role files are replaced only after every download succeeds.')
-        self.ui.details([
-            ('Expected base URL', 'https://<server>/<site>/check_mk/agents'),
-            ('URL ends at', '/check_mk/agents'),
-            ('Example', 'https://monitoring.example.de/monitoring/check_mk/agents'),
-            ('Version format', '<major>.<minor>.<patch>p<patchlevel>-<revision>'),
-            ('Version example', '2.4.0p21-1'),
-        ], title='Checkmk agent source')
-        base_url = self.required_value('Checkmk agent base URL', self.config.checkmk_agent_base_url or None).rstrip('/')
-        version = self.required_value('Checkmk agent version', self.config.checkmk_agent_version or None)
+                    'Uses the AIM-wide Checkmk source configured in Settings.')
+        base_url = self.config.checkmk_agent_download_base_url
+        version = self.config.checkmk_agent_package_version
+        missing = []
+        if not self.config.checkmk_agent_base_url:
+            missing.append('base URL / host')
+        if not self.config.checkmk_agent_site_name:
+            missing.append('site name')
+        if not self.config.checkmk_agent_version:
+            missing.append('version')
+        if not self.config.checkmk_agent_patchlevel:
+            missing.append('patchlevel')
+        if not self.config.checkmk_agent_revision:
+            missing.append('revision')
+        if missing:
+            raise AIMError('Checkmk agent source is incomplete in Settings: ' + ', '.join(missing) + '.')
+
         target = Path(self.config.checkmk_agent_role_files_dir)
         self.ui.review('Update Checkmk agent packages', [
-            ('Base URL', base_url),
-            ('Version', version),
+            ('Protocol', self.config.checkmk_agent_protocol),
+            ('Base URL / host', self.config.checkmk_agent_base_url),
+            ('Site name', self.config.checkmk_agent_site_name),
+            ('Download root', base_url + '/'),
+            ('Version', self.config.checkmk_agent_version),
+            ('Patchlevel', self.config.checkmk_agent_patchlevel),
+            ('Revision', self.config.checkmk_agent_revision),
+            ('Package version', version),
             ('Target', target),
             ('Windows source', f'{base_url}/windows/check_mk_agent.msi'),
             ('Debian source', f'{base_url}/check-mk-agent_{version}_all.deb'),
@@ -59,8 +72,6 @@ class MaintenanceScreens:
             rows.append((result.label, f'{result.filename} | {result.size} bytes | {old} -> {new}'))
         self.ui.details(rows, title='Updated packages')
         self.ui.result('All Checkmk agent packages were updated successfully.', title='Maintenance completed')
-        if base_url != self.config.checkmk_agent_base_url or version != self.config.checkmk_agent_version:
-            self.ui.result('Tip: save the base URL/version in Settings to use them as future defaults.', level='info')
         self.pause()
 
     def sync_checkmk_scripts(self) -> None:
@@ -69,7 +80,7 @@ class MaintenanceScreens:
                     'Managed shadow checkout: tracked local changes are intentionally discarded; untracked files are retained.')
         repo = ShadowRepository(Path(self.config.checkmk_monitoring_scripts_dir))
         state = repo.inspect()
-        self.ui.review('Sync Checkmk monitoring scripts', [
+        self.ui.review('Update Checkmk monitoring scripts', [
             ('Repository', state.path),
             ('Branch', state.branch),
             ('Upstream', state.upstream),
@@ -79,9 +90,9 @@ class MaintenanceScreens:
             ('Operation', 'git fetch --prune; git reset --hard @{u}'),
         ], warning=('Tracked local modifications will be discarded because this directory is a managed shadow copy.'
                     if state.tracked_dirty else 'The checkout will be reset exactly to its configured upstream.'))
-        if not self.confirm('Sync the monitoring scripts shadow copy?', default=False):
+        if not self.confirm('Update the monitoring scripts shadow copy?', default=False):
             return
-        self.ui.result('Fetching and synchronizing monitoring scripts...', level='info')
+        self.ui.result('Updating Checkmk monitoring scripts from Git...', level='info')
         result = repo.sync()
         self.ui.details([
             ('Upstream', result.upstream),
@@ -90,5 +101,5 @@ class MaintenanceScreens:
             ('Result', 'Updated' if result.changed else 'Already current'),
             ('Changed files', result.stat or 'No upstream file changes'),
         ], title='Repository sync')
-        self.ui.result('Checkmk monitoring scripts are synchronized with the configured upstream.', title='Maintenance completed')
+        self.ui.result('Checkmk monitoring scripts were updated from the configured upstream.', title='Maintenance completed')
         self.pause()
diff --git a/scripts/src/aim/ui/playbooks.py b/scripts/src/aim/ui/playbooks.py
index 7516f6c..7c6b9bf 100644
--- a/scripts/src/aim/ui/playbooks.py
+++ b/scripts/src/aim/ui/playbooks.py
@@ -1,120 +1,532 @@
+"""Catalog-driven customer playbook screens; no implicit credential changes."""
 from __future__ import annotations
 
+from dataclasses import dataclass
+import json
 from pathlib import Path
+import time
 
+from ruamel.yaml.error import YAMLError
 
-from aim.inventory.hosts import InventoryEditor
-from aim.inventory.loader import InventoryDocument
-from aim.inventory.model import Host
-from aim.playbooks.manager import PlaybookSpec
-
-
+from aim.exceptions import AIMError, OperationCancelled
+from aim.playbooks.catalog import InputSpec, PlaybookSpec
 from aim.ui.components import MenuItem, text
 from aim.ui.selection import Choice
 
+
+@dataclass
+class MultiCustomerPlan:
+    customer: str
+    inventory: Path
+    targets: list
+    label: str
+    platforms: frozenset[str]
+
+    @property
+    def limit(self) -> str:
+        return ':'.join(host.fqdn for host in self.targets)
+
+
 class PlaybookScreens:
-    def playbooks_menu(self, customer: str, inventory_path: Path) -> None:
-        categories = self.playbooks.categories()
+    def multi_customer_operations_menu(self) -> None:
         while True:
             self.clear()
-            self.header(self.breadcrumb(customer, 'Playbooks'), f'Playbook directory: {self.playbooks.root}')
+            self.header('AIM > Multi-customer operations',
+                        'Customers remain isolated; each customer is executed as a separate Ansible command.')
+            choice = self.menu([
+                MenuItem('1', 'Playbooks', 'Select one catalog operation, then choose customers and per-customer targets'),
+            ])
+            if choice == '0':
+                return
+            if choice == '1':
+                self.call(self.multi_customer_playbooks_menu)
+
+    def multi_customer_playbooks_menu(self) -> None:
+        while True:
+            categories = self.playbooks.categories()
+            self.clear()
+            self.header('AIM > Multi-customer operations > Playbooks',
+                        f'Catalog: {self.playbooks.root / "aim_catalog.yml"}')
+            items = []
+            for i, category in enumerate(categories, 1):
+                specs = self.playbooks.specs_for_category(category)
+                items.append(MenuItem(str(i), category, f'{len(specs)} catalog operation(s)'))
+            choice = self.menu(items)
+            if choice == '0':
+                return
+            self.call(self.multi_customer_category_menu, categories[int(choice) - 1])
+
+    def multi_customer_category_menu(self, category: str) -> None:
+        while True:
+            specs = self.playbooks.specs_for_category(category)
+            self.clear()
+            self.header(f'AIM > Multi-customer operations > Playbooks > {category}',
+                        'Dependencies are checked only after an operation is selected.')
+            rows = []
+            for i, spec in enumerate(specs, 1):
+                if spec.customer_specific:
+                    state = 'Per-customer playbook'
+                else:
+                    state = text('File present', 'aim.success') if self.playbooks.available(spec) else text('File missing', 'aim.warning')
+                rows.append((str(i), spec.name, ', '.join(spec.platforms), state))
+            self.ui.table(['#', 'Action', 'Platforms', 'Source'], rows)
+            self.message('0  Back')
+            self.ui.footer('menu')
+            choice = self.menu_choice(['0'] + [str(i) for i in range(1, len(specs) + 1)])
+            if choice == '0':
+                return
+            self.call(self.run_multi_customer_playbook_flow, specs[int(choice) - 1])
+
+    def select_multi_customers(self, spec: PlaybookSpec) -> list[str]:
+        choices = []
+        for customer in self.customers.list():
+            inventory_state = self.snapshot(customer)['inventory']
+            if spec.customer_specific:
+                playbook_state = 'Present' if self.playbooks.available(spec, customer) else 'Missing'
+            else:
+                playbook_state = 'Shared' if self.playbooks.available(spec) else 'Missing'
+            choices.append(Choice(customer, (customer, inventory_state, playbook_state), (customer,)))
+        selected = self.selector.select(
+            'Multi-customer operations > Select customers',
+            ['Customer', 'Inventory', 'Playbook'], choices, multiple=True,
+        )
+        return list(selected or [])
+
+    @staticmethod
+    def _multi_error(exc: Exception) -> str:
+        if isinstance(exc, YAMLError):
+            return 'Inventory YAML could not be parsed.'
+        return str(exc)
+
+    def _select_multi_customer_target(self, customer: str, spec: PlaybookSpec) -> tuple[MultiCustomerPlan | None, str | None]:
+        inventory = self.customers.path(customer) / 'hosts.yml'
+        if not inventory.is_file():
+            return None, 'Inventory file is missing.'
+        if not self.playbooks.available(spec, customer):
+            return None, 'Playbook is not installed for this customer.'
+        vault = inventory.parent / 'group_vars/all/vault.yml'
+        if spec.require_vault and not vault.is_file():
+            return None, 'Required customer Vault is missing.'
+        previous = self.current_customer
+        self.current_customer = customer
+        try:
+            targets, label = self.select_targets(customer, inventory, spec.platforms,
+                                                 title=f'{spec.name} > Targets')
+        except (AIMError, OSError, ValueError, YAMLError) as exc:
+            return None, self._multi_error(exc)
+        finally:
+            self.current_customer = previous
+        if not targets:
+            return None, 'No targets selected, or no compatible hosts are available.'
+        platforms = frozenset(p for host in targets for p in host.memberships if p in spec.platforms)
+        return MultiCustomerPlan(customer, inventory, targets, label, platforms), None
+
+    def _collect_multi_customer_targets(self, customers: list[str], spec: PlaybookSpec):
+        plans: list[MultiCustomerPlan] = []
+        skipped: dict[str, str] = {}
+        for customer in customers:
+            plan, reason = self._select_multi_customer_target(customer, spec)
+            if plan is None:
+                skipped[customer] = reason or 'Not selected.'
+            else:
+                plans.append(plan)
+        return plans, skipped
+
+    @staticmethod
+    def _multi_fields(spec: PlaybookSpec, plans: list[MultiCustomerPlan]) -> list[InputSpec]:
+        platforms = set().union(*(plan.platforms for plan in plans)) if plans else set()
+        return [field for field in spec.inputs if not field.platforms or platforms.intersection(field.platforms)]
+
+    @staticmethod
+    def _prune_multi_overrides(fields: list[InputSpec], overrides: dict) -> None:
+        allowed = {field.name for field in fields}
+        for name in list(overrides):
+            if name not in allowed:
+                overrides.pop(name, None)
+        if 'checkmk_cleanup_enabled' in allowed:
+            overrides.setdefault('checkmk_cleanup_enabled', False)
+
+    def _change_multi_customer_target(self, customers: list[str], plans: list[MultiCustomerPlan],
+                                      skipped: dict[str, str], spec: PlaybookSpec) -> None:
+        plan_map = {plan.customer: plan for plan in plans}
+        choices = []
+        for customer in customers:
+            current = plan_map.get(customer)
+            status = f'{len(current.targets)} target(s)' if current else 'Skipped: ' + skipped.get(customer, 'No targets')
+            choices.append(Choice(customer, (customer, status), (customer,)))
+        customer = self.selector.select('Multi-customer operations > Change targets',
+                                        ['Customer', 'Current selection'], choices)
+        if customer is None:
+            return
+        plan, reason = self._select_multi_customer_target(customer, spec)
+        if plan is None:
+            plan_map.pop(customer, None)
+            skipped[customer] = reason or 'No targets selected.'
+        else:
+            plan_map[customer] = plan
+            skipped.pop(customer, None)
+        plans[:] = [plan_map[name] for name in customers if name in plan_map]
+
+    @staticmethod
+    def _duration(seconds: float | None) -> str:
+        if seconds is None:
+            return '-'
+        total = max(0, int(round(seconds)))
+        minutes, seconds = divmod(total, 60)
+        return f'{minutes:02d}:{seconds:02d}'
+
+    def _show_multi_customer_summary(self, customers: list[str], plans: list[MultiCustomerPlan],
+                                     skipped: dict[str, str], results: dict[str, tuple[str, float | None, str]]) -> None:
+        plan_map = {plan.customer: plan for plan in plans}
+        rows = []
+        details = []
+        for customer in customers:
+            if customer in results:
+                state, elapsed, detail = results[customer]
+                count = len(plan_map[customer].targets) if customer in plan_map else '-'
+                rows.append((customer, count, state, self._duration(elapsed)))
+                if detail:
+                    details.append((customer, detail))
+            elif customer in skipped:
+                rows.append((customer, '-', 'Skipped', '-'))
+                details.append((customer, skipped[customer]))
+            else:
+                rows.append((customer, '-', 'Not run', '-'))
+        self.console.print()
+        self.console.rule(text('Multi-customer execution summary', 'aim.context'))
+        self.ui.table(['Customer', 'Targets', 'Result', 'Duration'], rows)
+        if details:
+            self.ui.details(details, title='Skipped / failed details')
+        success = sum(1 for state, _, _ in results.values() if state == 'Success')
+        failed = sum(1 for state, _, _ in results.values() if state == 'Failed')
+        interrupted = sum(1 for state, _, _ in results.values() if state == 'Interrupted')
+        self.ui.details([
+            ('Successful customers', success),
+            ('Failed customers', failed),
+            ('Interrupted customers', interrupted),
+            ('Skipped customers', len(skipped)),
+        ])
+
+    def _execute_multi_customer_playbook(self, customers: list[str], plans: list[MultiCustomerPlan],
+                                         skipped: dict[str, str], spec: PlaybookSpec, overrides: dict,
+                                         ask_become_pass: bool) -> None:
+        results: dict[str, tuple[str, float | None, str]] = {}
+        self.clear()
+        self.header('AIM > Multi-customer operations > Running', spec.description)
+        self.ui.details([
+            ('Operation', spec.name),
+            ('Execution', 'Sequential; one isolated Ansible command per customer'),
+            ('Failure behavior', 'Continue with the next customer'),
+            ('Password prompts', 'Native Ansible prompts for each customer command'),
+        ])
+        interrupted = False
+        for index, plan in enumerate(plans, 1):
+            self.console.print()
+            self.console.rule(text(f'[{index}/{len(plans)}] {plan.customer} - {spec.name}', 'aim.context'))
+            vault = plan.inventory.parent / 'group_vars/all/vault.yml'
+            self.ui.details([
+                ('Customer', plan.customer),
+                ('Targets', len(plan.targets)),
+                ('Scope', plan.label),
+                ('Vault', f'{plan.customer}@prompt' if vault.is_file() else 'Not present'),
+            ])
+            started = time.monotonic()
+            try:
+                if 'linux' in plan.platforms and self.ssh.status(plan.customer).complete and vault.is_file():
+                    if self.ssh.ensure_key_loaded(plan.customer):
+                        self.ui.result(f'{plan.customer}: SSH key loaded into ssh-agent.', level='info')
+                self.playbooks.run(
+                    plan.customer, plan.inventory, spec, limit=plan.limit, overrides=overrides,
+                    ask_become_pass=ask_become_pass and bool(plan.platforms.intersection(spec.become_platforms)),
+                )
+            except OperationCancelled as exc:
+                elapsed = time.monotonic() - started
+                results[plan.customer] = ('Interrupted', elapsed, str(exc))
+                self.ui.result(f'{plan.customer}: execution interrupted. Remaining customers were not started.', level='warning')
+                interrupted = True
+                break
+            except (AIMError, OSError, ValueError, YAMLError) as exc:
+                elapsed = time.monotonic() - started
+                detail = self._multi_error(exc)
+                results[plan.customer] = ('Failed', elapsed, detail)
+                self.ui.result(f'{plan.customer}: {detail}', level='error')
+                continue
+            elapsed = time.monotonic() - started
+            results[plan.customer] = ('Success', elapsed, '')
+            self.ui.result(f'{plan.customer}: completed successfully.', level='success')
+        if interrupted:
+            started_customers = set(results) | set(skipped)
+            for customer in customers:
+                if customer not in started_customers:
+                    results.setdefault(customer, ('Not run', None, 'Batch was interrupted before this customer started.'))
+        self._show_multi_customer_summary(customers, plans, skipped, results)
+        self.pause()
+
+    def run_multi_customer_playbook_flow(self, spec: PlaybookSpec) -> None:
+        if not spec.customer_specific and not self.playbooks.available(spec):
+            self.ui.result(f'Playbook not installed: {self.playbooks.path(spec)}', level='warning')
+            self.pause()
+            return
+        versions = self.playbooks.dependency_check(spec)
+        customers = self.select_multi_customers(spec)
+        if not customers:
+            return
+        plans, skipped = self._collect_multi_customer_targets(customers, spec)
+        overrides: dict = {}
+        ask_become_pass = False
+        while True:
+            fields = self._multi_fields(spec, plans)
+            self._prune_multi_overrides(fields, overrides)
+            can_become = any(plan.platforms.intersection(spec.become_platforms) for plan in plans)
+            if not can_become:
+                ask_become_pass = False
+            is_cleanup = 'checkmk_cleanup_enabled' in {field.name for field in fields}
+
+            self.clear()
+            self.header('AIM > Multi-customer operations > Review', spec.description)
+            self.ui.details([
+                ('Operation', spec.name),
+                ('Customers selected', len(customers)),
+                ('Customers ready', len(plans)),
+                ('Execution', 'Sequential; isolated inventory and Vault context per customer'),
+                ('Failure behavior', 'Continue with next customer on failure'),
+                ('Dependencies', ', '.join(f'{key} {value}' for key, value in versions.items()) or 'ansible-core'),
+            ])
+            if plans:
+                self.ui.table(
+                    ['Customer', 'Targets', 'Scope', 'Platforms', 'Vault'],
+                    [(plan.customer, len(plan.targets), plan.label, ', '.join(sorted(plan.platforms)),
+                      f'{plan.customer}@prompt' if (plan.inventory.parent / 'group_vars/all/vault.yml').is_file() else 'Not present')
+                     for plan in plans],
+                    title='Execution plan',
+                )
+            if skipped:
+                self.ui.table(['Customer', 'Reason'], [(customer, skipped[customer]) for customer in customers if customer in skipped],
+                              title='Skipped customers')
+            if overrides:
+                self.ui.table(['Explicit override', 'Value'],
+                              [(field.label, self.option_display(field, overrides)) for field in fields if field.name in overrides],
+                              title='Shared run options')
+            if is_cleanup:
+                self.ui.result('Cleanup remains preview-only unless explicitly enabled here. Enabling deletion requires a second confirmation.', level='warning')
+            if spec.warning:
+                self.ui.result(spec.warning, level='warning')
+            if spec.customer_specific:
+                self.ui.result('Customer-specific host-variable preparation remains inside each individual customer menu; this mode only executes the catalog playbook.', level='info')
+
+            items = [
+                MenuItem('1', 'Run sequentially', f'{len(plans)} ready customer(s); native Ansible output remains live'),
+                MenuItem('2', 'Change customers', 'Re-select customers, then select targets for each customer again'),
+                MenuItem('3', 'Change targets', 'Re-run target selection for one selected customer'),
+                MenuItem('4', 'Change shared run options', 'Explicit overrides are reused for every customer command'),
+            ]
+            if can_become:
+                items.append(MenuItem('5', 'Prompt for privilege-escalation password',
+                                      'Enabled on applicable customer runs' if ask_become_pass else 'Disabled; use configured escalation'))
+            choice = self.menu(items, back='Cancel')
+            if choice == '0':
+                return
+            if choice == '2':
+                selected = self.select_multi_customers(spec)
+                if not selected:
+                    continue
+                customers = selected
+                plans, skipped = self._collect_multi_customer_targets(customers, spec)
+                continue
+            if choice == '3':
+                self._change_multi_customer_target(customers, plans, skipped, spec)
+                continue
+            if choice == '4':
+                self.edit_playbook_options(fields, overrides, context='Multi-customer operations > Run options')
+                continue
+            if choice == '5' and can_become:
+                ask_become_pass = not ask_become_pass
+                continue
+            if not plans:
+                self.ui.result('No customers have reviewed targets. Change customers or targets before running.', level='warning')
+                self.pause()
+                continue
+            self.playbooks.validate_overrides(spec, overrides)
+            if not self.confirm(f'Run {spec.name} sequentially for {len(plans)} customer(s)?', default=False):
+                continue
+            if is_cleanup and overrides.get('checkmk_cleanup_enabled'):
+                if not self.confirm('Delete obsolete managed files on the selected hosts across these customers?', default=False):
+                    continue
+            self._execute_multi_customer_playbook(customers, plans, skipped, spec, overrides, ask_become_pass)
+            return
+    def playbooks_menu(self, customer: str, inventory_path: Path) -> None:
+        while True:
+            categories = self.playbooks.categories()
+            self.clear()
+            self.header(self.breadcrumb(customer, 'Playbooks'), f'Catalog: {self.playbooks.root / "aim_catalog.yml"}')
             items = []
             for i, category in enumerate(categories, 1):
                 specs = self.playbooks.specs_for_category(category)
                 count = sum(self.playbooks.available(s, customer) for s in specs)
-                items.append(MenuItem(str(i), category, f'{count}/{len(specs)} playbooks available'))
+                items.append(MenuItem(str(i), category, f'{count}/{len(specs)} files present'))
             choice = self.menu(items)
             if choice == '0':
                 return
             self.call(self.playbook_category_menu, customer, inventory_path, categories[int(choice)-1])
 
-
     def playbook_category_menu(self, customer: str, inventory_path: Path, category: str) -> None:
-        specs = self.playbooks.specs_for_category(category)
         while True:
+            specs = self.playbooks.specs_for_category(category)
             self.clear()
-            self.header(self.breadcrumb(customer, f'Playbooks > {category}'))
+            self.header(self.breadcrumb(customer, f'Playbooks > {category}'), 'Dependencies are checked when an action is selected, not while opening menus.')
             offset = 2 if category == 'Sophos XGS' else 1
             rows = []
             if offset == 2:
                 rows.append(('1', 'Prepare host configuration', 'Host variables', 'Available'))
             for i, spec in enumerate(specs, offset):
-                state = text('Available', 'aim.success') if self.playbooks.available(spec, customer) else text('File missing', 'aim.warning')
+                state = text('File present', 'aim.success') if self.playbooks.available(spec, customer) else text('File missing', 'aim.warning')
                 rows.append((str(i), spec.name, ', '.join(spec.platforms), state))
             self.ui.table(['#', 'Action', 'Scope / type', 'Status'], rows)
             if category == 'Sophos XGS':
-                self.ui.result('Prepare variables, run the initial baseline, then apply the customer override. Playbooks are not chained automatically.', level='info')
+                self.ui.result('Prepare variables, run the baseline, then apply the customer profile. These are separate operations.', level='info')
+            if category == 'pfSense':
+                self.ui.result('pfsensible.core was not present in the supplied controller collection list. This action will refuse execution if that dependency is still missing.', level='warning')
             self.message('0  Back')
             self.ui.footer('menu')
-            raw = self.menu_choice([str(i) for i in range(len(specs) + offset)])
-            if raw == '0':
+            choice = self.menu_choice([str(i) for i in range(len(specs) + offset)])
+            if choice == '0':
                 return
-            if offset == 2 and raw == '1':
-                self.call(self.configure_sophos, customer, inventory_path)
+            if offset == 2 and choice == '1':
+                self.call(self.configure_sophos, customer, inventory_path,
+                          required_keys=tuple(self.playbooks.profile(customer).get('required_network_keys', ())))
             else:
-                self.call(self.run_playbook_flow, customer, inventory_path, specs[int(raw)-offset])
+                self.call(self.run_playbook_flow, customer, inventory_path, specs[int(choice)-offset])
 
+    @staticmethod
+    def option_display(field: InputSpec, overrides: dict) -> str:
+        if field.name not in overrides:
+            return 'Inherit inventory / role'
+        value = overrides[field.name]
+        if field.type == 'secret_ref':
+            return 'Variable reference: ' + str(value).strip('{} ').strip()
+        return json.dumps(value, ensure_ascii=False) if not isinstance(value, str) else value
 
-    def compatible_hosts(self, customer: str, inventory_path: Path, spec: PlaybookSpec) -> list[Host]:
-        hosts = InventoryEditor(InventoryDocument(inventory_path), customer).list_hosts()
-        allowed = set(spec.platforms)
-        return [host for host in hosts if allowed.intersection(host.memberships)]
-
-
-    def compatible_group_limits(self, customer: str, inventory_path: Path, spec: PlaybookSpec) -> list[tuple[str, str]]:
-        hosts = self.compatible_hosts(customer, inventory_path, spec)
-        allowed = set(spec.platforms)
-        labels: dict[str, str] = {}
-        for host in hosts:
-            for group, membership in host.memberships.items():
-                if group not in allowed:
+    def edit_playbook_options(self, fields: list[InputSpec], overrides: dict, *, context: str = 'Playbooks > Run options') -> None:
+        while True:
+            choices = [Choice(f, (f.label, self.option_display(f, overrides), f.default_hint)) for f in fields]
+            field = self.selector.select(context, ['Option', 'This run', 'Default hint'], choices)
+            if field is None:
+                return
+            self.clear()
+            self.header(self.breadcrumb(self.current_customer, context + ' > ' + field.label))
+            self.ui.details([('Variable', field.name), ('This run', self.option_display(field, overrides)),
+                             ('Role default hint', field.default_hint), ('Help', field.help)])
+            if field.type in {'bool', 'choice'}:
+                choices = ['true', 'false'] if field.type == 'bool' else list(field.choices)
+                items = [MenuItem(str(i), value) for i, value in enumerate(choices, 1)]
+                items.append(MenuItem(str(len(choices)+1), 'Inherit inventory / role', 'Do not send an override'))
+                selected = self.menu(items)
+                if selected == '0':
                     continue
-                labels[group] = group
-                for subgroup in membership.subgroups:
-                    if "/" in subgroup:
-                        continue
-                    labels[f"{group} / {subgroup}"] = subgroup
-        return sorted(labels.items(), key=lambda item: item[0].lower())
-
-
-    def _pick_playbook_host(self, customer: str, inventory_path: Path, spec: PlaybookSpec) -> Host | None:
-        return self.pick_one_host(self.compatible_hosts(customer, inventory_path, spec))
-
-
-    def _pick_playbook_group(self, customer: str, inventory_path: Path, spec: PlaybookSpec):
-        groups = self.compatible_group_limits(customer, inventory_path, spec)
-        return self.selector.select('Select group', ['Group'], [Choice(g, (g[0],), (g[0],)) for g in groups])
-
+                if int(selected) == len(choices)+1:
+                    overrides.pop(field.name, None)
+                else:
+                    overrides[field.name] = field.parse(choices[int(selected)-1])
+                continue
+            self.ui.result('Enter keeps the current choice. A single - removes the override. Ctrl+C cancels.', level='info')
+            if field.type == 'secret_ref':
+                self.ui.result('Enter the NAME of an existing Vault variable, not its secret value. Default: vault_checkmk_unifi_password.', level='warning')
+            if field.type in {'list', 'sequence'}:
+                self.ui.result('Use [] for an explicitly empty list. Structured rules use a one-line YAML/JSON list.', level='info')
+            while True:
+                raw = self.ask('Value', default='', show_default=False)
+                if not raw:
+                    break
+                if raw.strip() == '-':
+                    overrides.pop(field.name, None)
+                    break
+                try:
+                    overrides[field.name] = field.parse(raw)
+                    break
+                except ValueError as exc:
+                    self.ui.result(str(exc), level='warning')
 
     def run_playbook_flow(self, customer: str, inventory_path: Path, spec: PlaybookSpec) -> None:
-        playbook_path = self.playbooks.path(spec, customer)
-        if not playbook_path.is_file():
-            self.ui.result(f'This playbook is not installed: {playbook_path}', level='warning', title='Playbook unavailable')
+        path = self.playbooks.path(spec, customer)
+        if not path.is_file():
+            self.ui.result(f'Playbook not installed: {path}', level='warning')
             self.pause()
             return
-        targets, label = self.select_targets(customer, inventory_path, spec.platforms, title=f'Playbooks > {spec.category} > {spec.name}')
+        self.clear()
+        self.header(self.breadcrumb(customer, f'Playbooks > {spec.category} > {spec.name}'), spec.description)
+        versions = self.playbooks.dependency_check(spec)
+        targets, label = self.select_targets(customer, inventory_path, spec.platforms, title=spec.name)
         if not targets:
             return
-        limit = ':'.join(host.fqdn for host in targets)
-        self.clear()
-        self.header(self.breadcrumb(customer, f'Playbooks > {spec.category} > Review'))
-        vault = inventory_path.parent / 'group_vars/all/vault.yml'
-        rows = [('Playbook', spec.name), ('File', playbook_path), ('Inventory', inventory_path),
-                ('Selection', label), ('Targets', '\n'.join(h.fqdn for h in targets)),
-                ('Vault', f'{customer}@prompt' if vault.is_file() else 'Not present'),
-                ('Connection password', 'Prompted by Ansible (--ask-pass)' if spec.ask_pass else 'Inventory / Vault')]
-        if spec.extra_vars:
-            rows.append(('Extra variables', ', '.join(spec.extra_vars)))
-        self.ui.review('Run playbook', rows, warning='The playbook may change the selected hosts. No other hosts are included in --limit.')
-        self.ui.footer('review')
-        if not self.confirm('Run this playbook?', default=False):
-            return
-        # Do not unlock a Linux key for a Windows-only target selection.
-        if any('linux' in h.memberships for h in targets) and self.ssh.status(customer).complete and vault.is_file():
+        selected_platforms = {p for h in targets for p in h.memberships}
+        fields = [f for f in spec.inputs if not f.platforms or selected_platforms.intersection(f.platforms)]
+        overrides = {}
+        is_cleanup = any(f.name == 'checkmk_cleanup_enabled' for f in fields)
+        if is_cleanup:
+            # Destructive approval is never inherited silently from inventory.
+            overrides['checkmk_cleanup_enabled'] = False
+        ask_become_pass = False
+        can_become = bool(selected_platforms.intersection(spec.become_platforms))
+        while True:
+            self.clear()
+            self.header(self.breadcrumb(customer, f'Playbooks > {spec.name}'), spec.description)
+            self.ui.details([('Targets', f'{len(targets)} ({label})'),
+                             ('Inputs', 'Only explicit overrides are passed; other values remain inherited.'),
+                             ('Dependencies', ', '.join(f'{k} {v}' for k, v in versions.items()) or 'ansible-core')])
+            if overrides:
+                self.ui.table(['Explicit override', 'Value'], [(f.label, self.option_display(f, overrides)) for f in fields if f.name in overrides])
+            if is_cleanup:
+                self.ui.result('Cleanup defaults to preview, even when inventory enables deletion. Enable it explicitly here to remove files.', level='warning')
+            items = [MenuItem('1', 'Review and run', 'No execution before confirmation'),
+                     MenuItem('2', 'Change run options', 'Defaults, diagnostics and operation-specific inputs')]
+            if can_become:
+                items.append(MenuItem('3', 'Prompt for privilege-escalation password', 'Enabled' if ask_become_pass else 'Disabled; use configured escalation'))
+            if spec.customer_specific and 'sophosxgs' in spec.platforms:
+                items.append(MenuItem('4', 'Prepare selected Sophos host variables', 'Separate, confirmed file edits; fixed firewall policy stays unchanged'))
+            chosen = self.menu(items, back='Cancel')
+            if chosen == '0':
+                return
+            if chosen == '2':
+                self.edit_playbook_options(fields, overrides)
+                if is_cleanup:
+                    overrides.setdefault('checkmk_cleanup_enabled', False)
+                continue
+            if chosen == '3':
+                ask_become_pass = not ask_become_pass
+                continue
+            if chosen == '4':
+                keys = tuple(self.playbooks.profile(customer).get('required_network_keys', ()))
+                for host in targets:
+                    self.configure_sophos(customer, inventory_path, host=host, required_keys=keys)
+                continue
+            self.playbooks.validate_overrides(spec, overrides)
+            self.clear()
+            self.header(self.breadcrumb(customer, f'Playbooks > {spec.category} > Review'))
+            vault = inventory_path.parent / 'group_vars/all/vault.yml'
+            rows = [('Playbook', spec.name), ('Description', spec.description), ('File', path), ('Inventory', inventory_path),
+                    ('Targets', '\n'.join(h.fqdn for h in targets)),
+                    ('Credentials', 'Existing inventory / Vault; no service-account changes'),
+                    ('Vault', f'{customer}: local unlock/retry before launch' if vault.is_file() else 'Not present'),
+                    ('Connection password', 'Ansible --ask-pass' if spec.ask_pass else 'No additional prompt'),
+                    ('Escalation password', 'Ansible --ask-become-pass' if ask_become_pass else 'Configured credentials / passwordless escalation')]
+            rows += [(f.label, self.option_display(f, overrides)) for f in fields if f.name in overrides]
+            self.ui.review('Run playbook', rows, warning=spec.warning or 'Review the selected scope before continuing.')
+            if spec.customer_specific:
+                profile = self.playbooks.profile(customer)
+                self.ui.details([('Required network keys', ', '.join(profile.get('required_network_keys', ())) or 'Defined by this customer profile'),
+                                 ('VLAN parent', profile.get('vlan_parent', 'Defined by the profile'))])
+            self.ui.footer('review')
+            if not self.confirm('Run this playbook?', default=False):
+                continue
+            if is_cleanup and overrides.get('checkmk_cleanup_enabled'):
+                if not self.confirm('Delete the obsolete managed files on the selected hosts?', default=False):
+                    continue
+            break
+        if 'linux' in selected_platforms and self.ssh.status(customer).complete and vault.is_file():
             if self.ssh.ensure_key_loaded(customer):
                 self.ui.result('Customer SSH key loaded into ssh-agent.')
-        self.ui.result('Playbook output remains live so native password prompts, pauses and diagnostics remain usable.', level='info')
-        self.playbooks.run(customer, inventory_path, spec, limit=limit)
-        self.ui.result(f'{spec.name} completed for the selected scope.', title='Playbook finished')
+        self.ui.result('Ansible output remains live. Diagnostics never enable ANSIBLE_DEBUG or disable no_log.', level='info')
+        self.playbooks.run(customer, inventory_path, spec, limit=':'.join(h.fqdn for h in targets),
+                           overrides=overrides, ask_become_pass=ask_become_pass)
+        self.ui.result(f'{spec.name} completed for the selected hosts.', title='Playbook finished')
         self.pause()
-
diff --git a/scripts/src/aim/ui/selection.py b/scripts/src/aim/ui/selection.py
index 1b043fe..8c18813 100644
--- a/scripts/src/aim/ui/selection.py
+++ b/scripts/src/aim/ui/selection.py
@@ -70,6 +70,16 @@ class Selector:
             if raw.startswith('/'):
                 query, page = raw[1:].strip(), 0
                 continue
+            if multiple and raw.casefold() == 'a':
+                if not indices:
+                    feedback = 'No matching items to toggle.'
+                elif all(i in selected for i in indices):
+                    selected.difference_update(indices)
+                    feedback = f'Cleared all {len(indices)} matching item(s).'
+                else:
+                    selected.update(indices)
+                    feedback = f'Selected all {len(indices)} matching item(s).'
+                continue
             if raw.casefold() in {'n', 'p'}:
                 page = max(0, min(pages - 1, page + (1 if raw.casefold() == 'n' else -1)))
                 continue
diff --git a/scripts/src/aim/ui/targets.py b/scripts/src/aim/ui/targets.py
index 52c9b16..f78e887 100644
--- a/scripts/src/aim/ui/targets.py
+++ b/scripts/src/aim/ui/targets.py
@@ -43,7 +43,7 @@ class TargetScreens:
             self.header(self.breadcrumb(customer, title), 'Platforms: ' + (', '.join(platforms) or 'all'))
             scope = self.menu([
                 MenuItem('1', 'All compatible hosts', f'{len(candidates)} hosts; reviewed before execution'),
-                MenuItem('2', 'From a group or subgroup', 'Filter first, then select hosts'),
+                MenuItem('2', 'From a group or subgroup', 'Choose all compatible members or individual hosts'),
                 MenuItem('3', 'Select multiple hosts', 'Toggle one number at a time'),
                 MenuItem('4', 'Select one host', 'Single target'),
             ], back='Cancel')
@@ -62,16 +62,35 @@ class TargetScreens:
                 for platform, membership in h.memberships.items():
                     if platforms and platform not in platforms:
                         continue
-                    groups.setdefault((platform, ''), []).append(h)
+                    paths = {''}
                     for sub in membership.subgroups:
-                        groups.setdefault((platform, sub), []).append(h)
+                        parts = sub.split('/')
+                        paths.update('/'.join(parts[:depth]) for depth in range(1, len(parts) + 1))
+                    for sub in paths:
+                        groups.setdefault((platform, sub), {})[h.fqdn] = h
+            # A parent group includes descendant subgroups. Hosts in overlapping
+            # memberships still become one explicit target, never a group pattern.
+            groups = {pair: sorted(hosts.values(), key=lambda h: h.fqdn.casefold())
+                      for pair, hosts in groups.items()}
             group_choices = [Choice(pair, (f'{pair[0]} / {pair[1]}' if pair[1] else pair[0], str(len(hosts))))
                              for pair, hosts in sorted(groups.items())]
             pair = self.selector.select('Select group or subgroup', ['Group path', 'Hosts'], group_choices)
             if pair is None:
                 continue
             label = f'{pair[0]} / {pair[1]}' if pair[1] else pair[0]
-            chosen = self.pick_multiple_hosts(groups[pair], f'Select hosts from {label}')
+            self.clear()
+            self.header(self.breadcrumb(customer, title), f'{label}: {len(groups[pair])} compatible hosts')
+            group_mode = self.menu([
+                MenuItem('1', 'Select all hosts in this group/subgroup',
+                         f'{len(groups[pair])} compatible hosts; final run review still required'),
+                MenuItem('2', 'Select individual hosts', 'Choose a subset of this group'),
+            ], back='Back to target scope')
+            if group_mode == '0':
+                continue
+            if group_mode == '1':
+                chosen = list(groups[pair])
+            else:
+                chosen = self.pick_multiple_hosts(groups[pair], f'Select hosts from {label}')
             return chosen, f'{label} ({len(chosen)} selected)'
 
     def pick_windows_member_targets(self, customer: str, inventory_path: Path):
diff --git a/scripts/src/aim/ui/vault_credentials.py b/scripts/src/aim/ui/vault_credentials.py
new file mode 100644
index 0000000..86e6eca
--- /dev/null
+++ b/scripts/src/aim/ui/vault_credentials.py
@@ -0,0 +1,19 @@
+"""Built-in terminal presentation for the reusable local Vault unlock workflow."""
+from aim.exceptions import OperationCancelled
+from aim.ui.components import text
+
+
+class TerminalVaultInteraction:
+    def __init__(self, ui):
+        self.ui = ui
+
+    def request_password(self, customer: str) -> str:
+        try:
+            # Console.input returns the literal password; Prompt.ask would strip
+            # surrounding whitespace. Do not record it in command/result history.
+            return self.ui.console.input(text(f'Vault password ({customer}): '), password=True)
+        except (KeyboardInterrupt, EOFError):
+            raise OperationCancelled('Vault unlock cancelled.') from None
+
+    def rejected(self, message: str) -> None:
+        self.ui.result(message, title='Vault password not accepted', level='warning')
diff --git a/scripts/src/aim/variables/__pycache__/__init__.cpython-313.pyc b/scripts/src/aim/variables/__pycache__/__init__.cpython-313.pyc
deleted file mode 100644
index 9780c2446d7f1d207883e829c5833a885f7b1d09..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 147
zcmey&%ge<81kYx!%mUGmK?DpiLK&Y~fQ+dO=?t2Tek&P@n1H;`AgNnM`l%(!`iXhP
znMpaR`o+mbnFS@q`o%>+vCLfkvc#gyM4&{metdjpUS>&ryk0@&Ee@O9{FKt1RJ$Tp
Upb;P|ib0Hz%#4hTMa)1J0ERLnJpcdz

diff --git a/scripts/src/aim/variables/__pycache__/viewer.cpython-313.pyc b/scripts/src/aim/variables/__pycache__/viewer.cpython-313.pyc
deleted file mode 100644
index 107b6f6fb2a4353a3d3e9181ec96e886ddb453a7..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1770
zcmbVMK~Ec35Pr|zU2F_2#jzl?X*PtEZlu~M4fIfIm58WqqM!=Ps4A^ii&@O3%dRtT
zO@Sy;)k75yRn!A&d#T7N<(6ws`3t751bRwORaJ4TLZzs;&aAyaXilBO?ChI)^Jc#H
z%{%Ds?qn!`{<wW}J;B)T^b?EHGWfwL8k?-dO8h#z#(^7TC$1;1B_V0B0XD=+$w5|9
z#xMg3C{@+e_Q^E4%-Fskgm&l#zQAAQV>?``kS~_@E`E^5l}+{;172c~C~-)Z5`&nn
z)Is@gDxj89B_*=7k_sJF%}mRlSsPq?-g9PM=Sv6nHB3@zr;JV@JINS7=#A2U((6Ub
zq^fM2Pj7RXuGB>sEIS~~gj9s%EkXv}g0>ol94$CurC|HQ#bXMh0&Xo71p&C`E*DnX
z=ZnHhR6)MBCR3K>`fg}hvj4^M^0A|X@{{_C?VTR_w&ws%R>3+Cg&K+KZlJNr$_U82
zoG}|Ko5OEQN{O+y?eH?2Io@|WVn&T)kG^Fd?<yzW!hC+RoSdOzPRLmM|IPMy0rMBw
zFq=!qfpjsrm(V&PNQZW1Sr+GsSB9CXP8X?InO+J+Xd#9|c2*&%*CKoU^|CMOwORn7
zvtYys8w)Ntl`w#{${_%lgFt(mE_eow^UNTySeAWwhOyw4nd6b@CyC2B-qwxNjFtHc
z+f)s9<1Awt%u{9WBo{eQvq;<yS6GX#=O9HA`BBMhZF)dA`ek~e>iEuT4T^H)#Ff(~
zk)QB_itUMF{xFdEC<amOBMBP0sb9`r{$cV-`f>V6=6m})8-M>1DRh55Fv5RIkMMQ%
zVt#GeGd0;cYkPI)DnI}cQDp}>x9SLv)SOjUghFZ}f=;SX^@4d*fi5aC74uvwU%38)
zR3HdKL33`Pv>H*Pa^<O)H9>EM_!JeAHlsKCFEullp7y=gIP+e!uh{4+?&;b4cQ@|t
z>KAtO3tLM~z3^ywM<2hZkmL5o?fZ8&?(AiA_da^6=XP>aTc;ilJ{bJ@gI~{GZsw+%
z`cxw|1%%2Ab3pu!=3o{LnuC{JY59L}|A>vPD^AJ`I37M!D~^REBTmDssLW)99v~~2
zRBHHq38LH~VySr7e}+AF^kKLdLWQ{L*<JnYj(&DadD!!yXV)0tF~%RQHjVe2`eY+D
z8TAhY^t7q9j!cRWz`zwSQArJ)unzuur-wH^N3ZGU?a0UvZ%`!NDO`*#Ges|wZ!bIe
zB6V8Ua<EYM$nLVNTXoxOdvps44kGki-|+*>f*wjhb;AfMnX@cG4|&D1!w}s0dgutt
z+GeeqX$*iKtw@m}vZ%gc&k|fc|F@>8SNZc^u3q7-c#4=dRjOyPjvZk=K)A{dg4lEC
vTTMh6M{)h=6q%Z6bx;JHdqxv3`ceIr<edM;hW=m!&$VuTg+F7YqmBOptDApe

diff --git a/scripts/src/aim/vault/__pycache__/__init__.cpython-313.pyc b/scripts/src/aim/vault/__pycache__/__init__.cpython-313.pyc
deleted file mode 100644
index 4bbfc1b09158f01563c71210d783b42d75aaf4d5..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 143
zcmey&%ge<81kYx!%mUGmK?DpiLK&Y~fQ+dO=?t2Tek&P@n1H;`AgNn=`l%(!`iXhP
znMpaR`o+mbnFS@q`o%>+vCLfkvc%Gy68-r2%)HE!_;|g7%3B;Zx%nxjIjMF<tU&D`
R<BLIzkIamWj77{q769HBA*=uZ

diff --git a/scripts/src/aim/vault/__pycache__/manager.cpython-313.pyc b/scripts/src/aim/vault/__pycache__/manager.cpython-313.pyc
deleted file mode 100644
index 6ffbd0ace8ba6e2c4483ff10f091d5aa57ff4a1a..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 12543
zcmd5?YfxL+eZN;%Z-gWSNI<}r0o%yNV0(=piyw;(czJtukr$gy6j{1}Y;mQWD}f=|
zU3b!KA(@QvW?ZvPXO^9&iQUO`{h=S+X*zY9CfQ9ht+a9iy<xLE(`GvRrGsOqPMk0O
z|IgLcm1Nf2<U=M0bnbaS|L6bso%5i)+{%Fa?>BB;40{>oKQW>@gA!mL{2K(WGd#ny
z157_lSTBZk1G;{Wa5T&f=!qWExB&w(z*j$D>^Bh;%`*&``z^#m!^Qz?e;FyGVbg%E
zznqlQuzA4V?;wtTCvo;ykP4b+8F2Mil1du34pjA5lWH0+8*uk~h{wyk#5FR!jW0jK
z)-VvV*D<`KL#K?nL-{bIhUPgTuR_fuwUeCB^%0ivv2s~R6ywQIG8z{ph*~0{WGEa9
zNzyRH^k+iJDg2)68XAOeO?NzXAtt<#iYJ8#9}dMrgin&FI0<>xJ(rUL5ks+4@#*Q1
z80if~V?xBo$rWKGAsCv0q!84XZ6qZIg<N^rDkU*B7@mzlJGG%iA~qL<CPI@!B$yD$
zbX1aZ!}FZ&3Ji`0M|+0O40et71o@s*qkSX8Jl2~DrDDmTlq9KeGDU>o1c^@vlhDg3
z<QgG1FNopXy3h}&MA!$rAaI>|i6Jb{5FO7FZaeJnOM0H$2|2tTLIxT#62qj)XO_#(
zVqZKgTT1%K1!V}*imXq-a>@D&@pw!&3YVi&Qo6+q`;4+V7!*U(LNF*>gTd)|Bn7h#
z%C=zebE!})m*WTqC!$13#-gGi#vvOL3ibvPs)H~)*r{+Zl!R5kkV*<tFi70c^#k}Z
z@}71f8Ey}WQWTc6T?&(EA}O^?1k$3@?R0(Gm31X;i8)dMb*P6kkZj=n8S|ml{>A<^
zoAb3n(x7G+Et(!u!Lbki0{r4d<8^fm90MoM)iD?Ka1bhZJq;Oo7jK{;(@SQ)lCR=T
z7`w>k$<zX=)x23rC05?eTWI+*-osmI$i~<3Wi(XI*YY+Rvh#I(ISn}=1P1_mb@C2U
zF=_ODO19BW8lrSWKB|G?hI6L_C%|ABD1d$7gur!X%o)Q}>L!_6?C>o(4B?cNj86+h
z^66x~B*Z4jb|@fWRj-$9fe&tNRE#EZdkXt&Q<H14f(g7U%vx>ZSM79Jiw1&ZNC$Ep
z0@s-U<A-ml^JA$J7hpSBC5dPElrc;*<I@e#*G!UlDiNFs5ve^Ciz(aQHa8vf>FDTX
z6A?a_iV^|hJD|F3&d;)7UZfJUDvG9r)LjqB5>f_C$5DCpmBm+99osXG?JHARM|*nz
zV8$_+HY>DKG)X)kbdqNwKqr|SIz;nMn~<m*&rf))(VyeQ`GOEoNk`>s%?xRRWFJRI
zPRUv}MI|^>G2s?RXG(TM0h%pg<6d<Ojd-e3l3ZCdTP1NT6qL4sr_6V5ac;RL>u6li
zuRH3N4}7cst@^*(l6CA&oA)XkTR1E11b*y;XCZK%8PDhO`HgFV9CQ)bK5fRlPTg36
zorEb3KQ7N5>OC{ac;<b6WeX$T9B=gk5BE;QQ)1*<Z&6X$WDB%U%;5Q0x(pJIBS*c?
zV2&7qxrXG1qD3gp#wC`J?yoTG4)4m=RmZ-JW8b=KXS#*Yx<=Es(G8Aq?x$-p9L`S|
zD&Q#SV*C#TkN}Rc`N;#_d6~V8Sg=HJ3UK*K9M8hiAeDksmq=UIkEz4`9(DA;M;*hH
zb$DZ&9!{lcSl&W6E;t(%Bk@@Y7(3<B!2}4}**J;FjNDvYA{Gbn`eeC!wWd-UghlFd
zP?Dx-OKLA#>Lp>0<|L*_ND_Q{atKzA96=9>l5~OxB!c`&<|c(CO3Il~EG0;VR8pQ4
zrW3JHQV61UAlIEmBFr(?wxT?glF}@ASC|hgJU8l>_b(V9TAB9K?A@6k&VP44?I-Ev
zO!o9_w(auzfx&mq{`>iN&!@*;*<hG1-6<W2v0=6wKOH@~_15mYXMcG9yXVtq#B_pW
zd!%e@a=oqh$(HV03{L9?W3X72Ls&>TsNPY!I}1z%lsFLa1B}RRPAdfrNFUHYjqRwk
z8v+`i)In>wge6X8QC<ex!UI_1{BY<?9nZm^{)o=YjF+o<YCEC<`f;eK+BcAA7osu1
z`BAKwINq@N2zcWWosJPr<H+r)3z*b%#hXy3i01JsHP4TlMu}@=0)-_|%9gl-`gJ8)
z5ZwdoR!{=PONql0ytyN{r=q2xG%}(R2jj8u7T(I29pPYR)^V>|pptq1G{dBTdnCRS
zu=<<SbnP1`<86B&s;&U+n=QZ3F!zALkK(_?jr|~CL;19q4Oms)1T{D9fwyUG5A`uj
z8Sp(Y7vQg;rrGZ)=>np3Ml7AtPBmAf5WbwZA7TAIHAnlxm~vcr9JO5P)V|cYQQ?CV
zrw)vWTn&NU^2F%I+w<j|px?OytexR2pV5u)Q_}-xwSGI&>wYy|`}$Ra){+?Q<ndKU
zbYgj++<&kjI~UB4xEXfC>_<LU;?$=7$k|F9U#*TT-wul1V`?$pt>z2t_z5+2?8>Hd
zcuvjNzW$S1SPiLb?PazU(s{R<uYDVtu|F*=T}l^|+%~3_$&VcNXacyzR-hm+bDABl
zKgMlkCfJWJGyHS4#CWgTtBDE03ScWw^ro9&)bbzK>m;X?@Og#_3gzBWP?JrG5D~<r
zB%7%L6pUYbT-FBWhoZUcffB|95hkLSWiApW^A;+{P(A(V3QS36XCE6<$%#FOLH#y^
zy%vvvbt$t}P`^VH0wi+Dxy1Z-DuKMJ=<!a2p6<OMctc(^RK3$+LP9n23=B#(K`Ue~
zk$i03lN&=c^4RoT0<6PC5*q}w^8s?z=B{DB@8n=lklL7?^GB3Ua@D~A^-fTewiA>s
zFNnjah{mN?DK#6Cya}+4qtX-@z0I;2$A-G6qK;NW`{V!)$Ed82Y?!_T^Cw2kK*e8n
zjY5q$36Z&OP|m~2IGIzdN?lx%_3?xt%I1;ai~f<}!E>@{BzVf-(={p^M}j?Lrv|~k
zjbIUiLPIvpl4w$p^^w$cLbgVws0hle7>1NsJQRWSXgDcb&!U{~AtX)+3Q3s*)0tWb
z1UZFlB?6eyxB~))Ly_QxIWRb>wN8@KY&1DVwMv49qihVv#fj*oY|rVFksvigpvS0q
zNp|$YO7u{Jn0Dy17bxU-{zw2lltQw8E;Jp3F`}knfhAIw0`?u|qML}wpsmAbrezaq
ztUzfp2TG1?B!UD=iDZW+K(Q}yikW5%LnT;~VjW*e#C?$(fr76vKQnvKtkKl`wKB)m
z&c)8F#}<#RRo1MTZL8*njJe^Sc`JmkmMxa8nrk!W+Lh+pRcQ<zTz6D{WoAJSt*kn>
zWgOd9c4Qqsh?iHdmbYZeTW*)%J@CWM?{=m!Hj?IFT6ejZ=DyaxGLUh#FPvJhsJ!8M
z-LqWzmlxi=^v0!cpM1OjR)1#8!SA^KsrK({Gh0sH?a5a3FPy}3wXfGM?_ZW~zW826
z#~t?v&7Ic<mrk!$)!i7pHn`%sdEl)r_p0{(+*7w!Q~##r4a>?iH~CwZbmRWpz4vN5
z)pAuot=e(l!fZeKh+|v_H*Acn`bN#Qnw3LKHJOUtH)qy8+rH6!^I)cN|7zo*Oyi+D
z#%$w>f2msa^kzK0>vhfP?St96p>)*{DE>94S!|{Cp^<SnuAI2tcjpV~Gh^?}r_X&h
zJrueZo=8t#%!V(e8)Iubc702HOI+P?G_&LAow4kW-uoQuex6<E{m@ap>hQw<P3~>`
zEqk`*@M_DcOv|Zs_u18!7c(s{uDf@qTPL&bskC!y-L`!t{Pyu%$5(ehm)ZT?>h6)u
z?vZ=8GaEX6dBcA>T{ldxo0hqsI2#}BWb9|yjaJ541wq%rpH_4{egt!E{Yk~{-#&CR
zRZR~Vw!C4@Q~zi;mQ0tAY_vea<3~P>-h(LCeJp(%Xyu>Fy7u(fao;=K<?7pN_`cNx
zk?(Ii)VI&@gW8kZA@a@%cfU^e?pAAGo8?`f8B*TeXYD&-dAHL9;UDR&{T{=QY%GS|
zEQUQChU={TEv6!?Sr5H|;=?{@1>Sfap#k`oI!$znx`1vovq=?-dEtR#FK<(8>Z8DZ
zq9V)q(U2=~1tZ|bp>4&Xu?9*Ba-<R$;8a1oi4mwD&#Slr{WyX%)TyGeXbyR`mCv^b
zb3l_zKTHOp9vK4fakIjsfkh>OVSJ3V@L4rhEmt7J8jdG>(WF**B<0?gnW!*JK}Cgg
zU%);>=!MaXfafz5@HT~`p`0Kh<Vm>bls73{NokI<IyW7oYE;o~Fdg}#bQ!!-`~lh2
z=NCVJ_2tEv*Ii93-C36}ZSxf|C<UKc24rR@;uV$4#*70j_U4SEd1W-~*tP1|d-DS3
z)GjxFL$BaC>#q8A!>O#RJ8kQRE*8q3w5ak#iGbNB6Xj+E832$~-B6J$AVsc}AT+3i
zqFdxJ^a&Wx%kUvb(GxI1U$Ep!NRSPR5sO2`<<6}(7`T9ofz*?WS395nStu{Hf(NVZ
zth!;pW?#OXb+)WJTQknqoBZv@tg~amu<mdzb=>G&KAClFO`EqWD})M=>hf5}@jsGd
zJDxwZcqn;}YVCT^+Vh81V**rbN10yYHnlwSKo)NRTap92n)Bz6tk!^fXi?kLY)w9I
zYr>)B{8d_cH3WNZ9#+&iJst^i26D&?;DM@1c=*cpa413HekmD=r;_suWa&kPC8w|X
z%Cv(`=CJ`h%2el})T8M<WCAnH*eqxn*jy21;bA5z@T4NTBA>?!#T1oi6G)!Ym%;np
z&+mFg!&-U$^2AE)_T}3b@0!vFp8s*vJCT2db3U4*&Q<4*jC02d(CFT~Rrd{?%er9P
zFf%sSYFRz}Q(Uey>pGgY9bI!&Bd<uC>z_ieuY)@J8P_MD=|6y=(QPJZR6$1Zn>_8p
z>gJp#h^Aedb)2uI=Rr8c08daHU?Q7fC8MsV2q%L^y#a%UM5w$>rE_Xg=dF0a1#@Cs
zV0lh7j^|Mlz$BV;n8f9PIbR!i$q*>AV_)iodJ&9O!@2pCI&NOCwl_A0U;xjG#-SYw
zno!vGS<6|I#I?hH1@r^6PC-kF8v)B1-4O5t#2!SeXaV%6L2WtUI>6GK8gsx}sX^?y
z(HD*n`wSTKDNtgP8%MC5I^L*`(7#Ph)4sfkH;*@|aZp)c4N9F_pSK+0=(xW#4l`7o
zU+q>+fG^-aWqbktGQL~Q4CFBvu^eo0trg_+C62ZNC=gt#B6?)k(2hI}ISN<!`LW!p
zE(h%XJOZLM3RskV4@A}304|i@<q&KgP~bCKX*D$VrGOa~1wfSSDrG@U$ELVR9&LdV
zn~s6EYrPMhSN0u{EChl}oH|FK7T7ghb<r$3$F3rj5<)5jRc`YU2h0Iy@o0x&e<`}<
z;Nef3#dsdGfqTM2{79pRa&^2^5<OcoNQnB;Vk~jm$*1^HMWDiuR&|L}35Uv|E;Uob
zg+LCKKaKDBPpNgZuZ9|_t<%%5weC^p1Fb)ms|C1c0Xi=kTa8w`fOfmJ{?!oRNADG^
z^Jz7G%<JE54WC!@wXeTl3#%cm#Vri14XV>64m66|BdnL1WF?)KkvP#LS|*r}$DshL
z%Hc-aKA}Ywf%4VOk99>NUiuC|ob-0}4QbF182?gx4hoRGvs0kAdjVjQ1Tq5<kQZ)1
zy%dPTh@up>EBBpVtl2h7=3qX(RIe<$ui_vX&L)^%5ID{@F<z?c!r1`c8Lt@C;i;Hm
zt{c3}5J)1V^-1OsH^I_tNO~y`Zy$7Rdx-=E$rr%O-8x>$X`@Fc1yQ)1AjjncMY=zj
zDN;NZ1?^t|OGCMMX*){qgQVka`C6}Giy#-6Uw_10VbZRi_x5+M%q~a%`~(DkLsgV7
zR#dSHvVwFwucx=b96{m%1t&EDC>-g52<b%+DTW|fkUsPVz*BTDGJ^5E>P7H=dcKv8
z+4}@K=8dHAK?qz-s<Qy(jErKH-8~8thfrE18liWV0K-L6VMOkf_9F3c3Q?W;LrOe6
z6%yeY2<)NqxFj~$S=_W2kvF{k#AhQ>z}{Hdnj;jz9(_AE)%_-MLa4S;D^7Og2u6VS
z81S-1A{Q_#gkBiE2ztQ$nA}Af5EVY;h$3ExH~*&TOA_vsqE6xsH#r9$fO6p}c<n)9
zJn|V#;UpnRf>_|QG#ZLTWCLJz(~_c(ZpSQy-!xT}Okqj5v<JvBEKszKM6tw0OgE-P
zMA&?l1r`wMsj@jvqLWd0jzgxgFj}7gnJKF&vq6Gp5+zO96%L7UF^boX>Nz5xqfG$h
zM&GTF1QsT=31K>#gvUSR3MQq{qoj>}qNP>ro>NG@N+Sl1q~&d&NcGsG^mib6eht@&
z#jxBbTfdc_8z-)v$W}Hln9){-mkOFCOcA=RO$+*a=6cLTyszpjuYzs7La+8e&LDPq
z7EB+w_bm1<bba7(El5k!^;g&H58U==>klvKuUXdWw!Ch-Z(=-czp^q%05@tl^WNc+
zTf1)V{Q6|(@JQNRmuWZy=HoqAPi8-u>^-ZFo{Xbs&0V)}`sWTeAdCRFt?bHr_N;n3
zGM<h*pHB1V?gcNT!;`CFF%uTE!Fbx!k@h4OZ40_}v-PUw%a*0aB?0EKZg(vm{))K3
zZRkE_X?YSKT(4{R`t~K$?+O#vY<;urjk1+f_i9>-Aj2|%3;``{+WD<rZ|(YK>$U!+
zQ_IzBp1QBS@*g$cwW^vMeb@SyrInuL*v;ObRy_lY($xN_0-(2tH2@B-Rd`o?H($Cl
zb?5xu*>vZ~y%$E)fwAlh=hDveSb6x`@M_hrOx3QNhqF}&z_M}M7ka_6ak>?7kb;2c
zv+nV<b9}ARedGAG<Jrol)ylR^Wm~$vYqj!Zrt%~$bS~>YkB!1Ezq<Hp79K4;pLMj-
zEFtTjNINIiZT74EU+!O$?%B2>pcr|3_}1`hYgeYVYqj-EruED{+Y4)zo)2w~tNn}p
zE6of2@7Z?#=D}%}+42JW$fcl(zuh>%lsgLwJf=9p_gd_O4aV=cy9Ya%9~e$H4mNS`
z>^!v{Vn1%O4(>Poc#j#w9Th`Ht_b-9A)_FFdLaMne+0<ixEV%7o!_d4wC`pppQ=t$
zP#}-#X>|~a(9{b605&TFfCA5=GOU#x&l_z#yvyT_6wELIn1MWqx)LyB6JTMpD^^W~
zgg(sxX5bTmys4(P&E&7(sG_DBWtIX(EpJeP^0is-n_OJ`y;=`yNSiaf0<sRv#-8rJ
z(GkC_7lC8T#<P8VpldJ(j|h=yQj^gtI>HI!j0%Zh2^A8l*i<Z1p#}G4Gf@&3WqmlF
zn1kycAsG=S@Wsc|A(Ilx^aKn_z6sM(;1k?WDk!LUAb$<flBZ@k*1v&d>0R)C59q}1
zyn1o*;??+KJZs;&z^$3fuG$yvOP5#N_slI?ta4@SEx5~R|J|ULHD~30lb&KN)=jaN
zb@R5BX1u*vZ8?@{Ikws|m}wdOiFxQr<OQ`%_^}UAoBM+tbKTQls!Zmd(dkPGWEloX
z+QG|du{liD7!hK^6ZdLL;y++%tn&ZfK)g`<YB^md(hL;=enUH+>Q#8fhZmAmn<~s8
ze~U$sDFD@DSk@26MS<$!P!5g7$JKb{ISx06tzPgx?frt67Qxc<_ToIBQR|adCbyxK
z(g~jBC%Z-+v8Wc+t%Q6n3_V$E^VH3IcpF=A5k!;-awJlVULAUXA}AN9WG{vefG69O
zXTsA$atgFhw1deEdM~5*C+Jb#_e~7p;UnKhuO2-&ddR+%qv^#Edf2OkivMfOFLkV;
z>7kJ|46zT5I>Ww)W}P9xf^asvex<V-tPeN{ZD8nsYqlDy9-d?^;JbAO??Y>uq2XcO
zK|{;K1nV#ivyU3}2Dj23cH*l;wR$2&@!TN6!y%X9EeL&(4tlvBQWVwNDy1%f?GT2C
zYWU<JITeduP_E0%ND7`>$J+23SyAt63R2o6`f44B03QgLum?N5PG}P@hlK=v1h3$~
zHYHIpI+Q1rDE0`LdW`JA%z}sMl=aEwn5r6Vl5!JI)1WiuNjkA(6G*9aO-mMAHXl`<
zh94*Y2t`=<NoY%Ka4gHd&ousm+4eKW@-wF5eWvCYO#S=Jv0pHIKVZ5uO!xat$NS8_
s_nBwz8yQ{MQgep&JksgdiVX%l*biOJ21XxQCv~j*m+)YXRaX7~04-_MjsO4v

diff --git a/scripts/src/aim/vault/manager.py b/scripts/src/aim/vault/manager.py
index 7433d8e..0c05eea 100644
--- a/scripts/src/aim/vault/manager.py
+++ b/scripts/src/aim/vault/manager.py
@@ -1,5 +1,9 @@
 from __future__ import annotations
 
+from aim.locking import customer_locked
+
+from aim.permissions import preserve_replacement_metadata
+
 from dataclasses import dataclass
 import os
 import subprocess
@@ -13,6 +17,7 @@ from aim.external import command_available, run_external, stable_cwd
 from aim.permissions import apply_managed_permissions
 from aim.templates import VAULT_TEMPLATE_SECTIONS
 from aim.structure import vault_structure_from_text
+from aim.vault.session import unlocked_vault
 
 
 @dataclass(frozen=True)
@@ -22,8 +27,9 @@ class VaultStatus:
 
 
 class VaultManager:
-    def __init__(self, customers):
+    def __init__(self, customers, *, vault_interaction=None):
         self.customers = customers
+        self.vault_interaction = vault_interaction
 
     def path(self, customer: str) -> Path:
         return self.customers.require(customer) / "group_vars/all/vault.yml"
@@ -47,8 +53,10 @@ class VaultManager:
             "vault_windows_local_ansible_password": DoubleQuotedScalarString(values.get("vault_windows_local_ansible_password", "")),
             "ansible_vault_linux_ssh_pass": DoubleQuotedScalarString(values.get("ansible_vault_linux_ssh_pass", "")),
             "vault_linux_ssh_key_passphrase": DoubleQuotedScalarString(values.get("vault_linux_ssh_key_passphrase", "")),
+            "vault_checkmk_unifi_password": DoubleQuotedScalarString(values.get("vault_checkmk_unifi_password", "")),
         }
 
+    @customer_locked
     def create(self, customer: str, values: dict[str, str] | None = None) -> bool:
         import tempfile
         path = self.path(customer)
@@ -98,19 +106,25 @@ class VaultManager:
         return str(value or "")
 
 
+    @customer_locked
     def view_text(self, customer: str) -> str:
         path = self.path(customer)
         if not path.exists():
             raise FileNotFoundError(path)
         self._require_command()
-        result = run_external(
-            ["ansible-vault", "view", "--vault-id", f"{customer}@prompt", str(path)],
-            cwd=self.customers.require(customer), capture_stdout=True,
-        )
-        if result.returncode:
-            raise ExternalCommandFailed("Vault read failed")
-        return result.stdout
+        with unlocked_vault(path, customer, cwd=self.customers.require(customer),
+                            interaction=self.vault_interaction, capture=True) as access:
+            if access.text is not None:
+                return access.text
+            result = run_external(
+                ["ansible-vault", "view", *access.arguments, str(path)],
+                cwd=self.customers.require(customer), capture_stdout=True,
+            )
+            if result.returncode:
+                raise ExternalCommandFailed("Vault read failed")
+            return result.stdout
 
+    @customer_locked
     def consolidate_template(self, customer: str) -> bool:
         """Add missing AIM template keys/comments while preserving all existing values/custom keys."""
         path = self.path(customer)
@@ -161,29 +175,44 @@ class VaultManager:
                 raise ExternalCommandFailed("Encryption did not produce a Vault document")
             if path.read_bytes() != original:
                 raise ExternalCommandFailed("Vault changed externally; consolidation was not applied")
+            preserve_replacement_metadata(tmp, path)
             os.replace(tmp, path)
-            apply_managed_permissions(path, self.customers.config.required_group)
             return True
         finally:
             tmp.unlink(missing_ok=True)
 
+    @customer_locked
     def edit(self, customer: str) -> None:
         path = self.path(customer)
         if not path.exists():
             raise FileNotFoundError(path)
         self._require_command()
-        env = os.environ.copy()
-        env.setdefault("EDITOR", "nano")
-        env.setdefault("VISUAL", env["EDITOR"])
-        result = run_external(
-            ["ansible-vault", "edit", "--vault-id", f"{customer}@prompt", str(path)],
-            cwd=self.customers.require(customer),
-            env=env,
-        )
-        if result.returncode:
-            raise ExternalCommandFailed("Vault edit failed")
-        apply_managed_permissions(path, self.customers.config.required_group)
+        import tempfile
+        from aim.locking import InventoryLock
+        with InventoryLock(self.customers.require(customer) / "hosts.yml"), unlocked_vault(
+            path, customer, cwd=self.customers.require(customer), interaction=self.vault_interaction,
+        ) as access:
+            access.ensure_current()
+            original = path.read_bytes()
+            with tempfile.TemporaryDirectory(prefix=".aim-vault-edit-", dir=path.parent) as directory:
+                staged = Path(directory) / "vault.yml"
+                staged.write_bytes(original)
+                staged.chmod(0o600)
+                env = os.environ.copy()
+                env.setdefault("EDITOR", "nano")
+                env.setdefault("VISUAL", env["EDITOR"])
+                result = run_external(
+                    ["ansible-vault", "edit", *access.arguments, str(staged)],
+                    cwd=self.customers.require(customer), env=env,
+                )
+                if result.returncode or not staged.read_bytes().startswith(b"$ANSIBLE_VAULT;"):
+                    raise ExternalCommandFailed("Vault edit failed; original encrypted file was preserved")
+                if path.read_bytes() != original:
+                    raise ExternalCommandFailed("Vault changed externally; edit was not published")
+                preserve_replacement_metadata(staged, path)
+                os.replace(staged, path)
 
+    @customer_locked
     def delete(self, customer: str) -> None:
         path = self.path(customer)
         if not path.exists():
diff --git a/scripts/src/aim/vault/session.py b/scripts/src/aim/vault/session.py
new file mode 100644
index 0000000..2e30a98
--- /dev/null
+++ b/scripts/src/aim/vault/session.py
@@ -0,0 +1,122 @@
+"""Local, pre-launch Vault unlock with interface-supplied password interaction.
+
+No UI imports or terminal emulation. The terminal opts into this workflow; legacy
+manager callers with no interaction retain native prompts. Never retry an editor,
+playbook, or other operation after yielding the validated password source.
+"""
+from __future__ import annotations
+
+from contextlib import contextmanager, ExitStack
+from dataclasses import dataclass, field
+import hashlib
+import os
+from pathlib import Path
+import tempfile
+from typing import Protocol
+
+from aim.exceptions import ExternalCommandFailed, OperationCancelled
+from aim.external import command_available
+from aim.runtime.process import run_process
+from aim.runtime.secrets import SecretBroker
+from aim.services.v1.credentials import validate_secrets
+from aim.services.v1.models import ServiceError
+
+
+class VaultInteraction(Protocol):
+    def request_password(self, customer: str) -> str:
+        """Return an unmodified password for this attempt, or cancel."""
+        ...
+
+    def rejected(self, message: str) -> None:
+        """Display a fixed, non-secret retry explanation."""
+        ...
+
+
+@dataclass(frozen=True)
+class VaultAccess:
+    arguments: tuple[str, ...]
+    text: str | None = field(default=None, repr=False)
+    path: Path | None = field(default=None, repr=False)
+    digest: str | None = field(default=None, repr=False)
+
+    def ensure_current(self) -> None:
+        if self.path is not None and hashlib.sha256(self.path.read_bytes()).hexdigest() != self.digest:
+            raise ExternalCommandFailed('Vault changed during unlock; review the operation again. Nothing was launched.')
+
+
+def _probe(executable, path, arguments, cwd, env, *, capture):
+    diagnostics = bytearray()
+    try:
+        rc, output = run_process([executable, 'view', *arguments, str(path)],
+                                 cwd=cwd, env=env, timeout=30, capture=capture,
+                                 stderr_output=diagnostics, stage='vault_unlock')
+        # Exact native 2.19 diagnostic, and ONLY from ansible-vault view, before
+        # an editor/playbook can start. Exit code 1/4 by itself proves nothing.
+        rejected = rc != 0 and b'Decryption failed (no vault secrets were found that could decrypt)' in diagnostics
+        if rc != 0 and not rejected:
+            raise ExternalCommandFailed('Vault preflight failed for a reason other than a rejected password. Check the native ansible-vault installation, file and configuration; no operation was launched.')
+        return rejected, output
+    except ServiceError as exc:
+        raise ExternalCommandFailed(f'Vault preflight failed ({exc.code}); no editor or playbook was launched.') from None
+    finally:
+        diagnostics[:] = b'\0' * len(diagnostics)
+
+
+@contextmanager
+def unlocked_vault(path: Path, customer: str, *, cwd: Path,
+                   interaction: VaultInteraction | None = None, capture: bool = False,
+                   executable: str = 'ansible-vault', env: dict[str, str] | None = None):
+    """Yield one operation-owned native password source after local validation.
+
+    The conventional customer Vault alone is prevalidated. Additional/inline Vault
+    secrets discovered later remain native failures and must not replay a playbook.
+    No interaction is installed for unattended clients; they use services.v1.
+    """
+    if interaction is None:
+        yield VaultAccess(('--vault-id', f'{customer}@prompt'))
+        return
+    if not command_available(executable):
+        raise ExternalCommandFailed(f'Required command not found: {executable}')
+    original = path.read_bytes()
+    if not original.startswith(b'$ANSIBLE_VAULT;'):
+        raise ExternalCommandFailed('The customer Vault is not an encrypted Vault document; no operation was launched.')
+    original_digest = hashlib.sha256(original).hexdigest()
+    probe_env = dict(os.environ if env is None else env)
+    probe_env.update(ANSIBLE_DEBUG='False', ANSIBLE_NOCOLOR='True',
+                     ANSIBLE_LOG_PATH='/dev/null', ANSIBLE_VERBOSITY='0',
+                     ANSIBLE_ASK_VAULT_PASS='False')
+    try:
+        while True:
+            submitted = interaction.request_password(customer)
+            try:
+                values = validate_secrets({'vault_password': submitted})
+            except ServiceError:
+                interaction.rejected('Enter a nonempty single-line Vault password (maximum 8192 UTF-8 bytes), or press Ctrl+C to cancel.')
+                continue
+            finally:
+                submitted = None
+            with tempfile.TemporaryDirectory(prefix='aim-vault-unlock-') as temp, ExitStack() as stack:
+                directory = Path(temp)
+                directory.chmod(0o700)
+                try:
+                    # Valid for this foreground operation only, never a session cache.
+                    broker = stack.enter_context(SecretBroker(directory, values, lifetime=86400))
+                    arguments = ('--vault-id', f'{customer}@{broker.helper("vault_password")}')
+                except ServiceError as exc:
+                    raise ExternalCommandFailed(f'Vault credential channel failed ({exc.code}); no operation was launched.') from None
+                finally:
+                    values.clear()
+                access = VaultAccess(arguments, path=path, digest=original_digest)
+                access.ensure_current()
+                rejected, output = _probe(executable, path, arguments, cwd, probe_env, capture=capture)
+                access.ensure_current()
+                if rejected:
+                    interaction.rejected('Vault password not accepted, or ciphertext is damaged. Re-enter the password, or press Ctrl+C to cancel. No editor or playbook has started.')
+                    continue
+                text = output.decode('utf-8') if capture else None
+                output = b''
+                access = VaultAccess(arguments, text, path, original_digest)
+                yield access
+                return  # Consumer failures propagate; they never restart the workflow.
+    except (KeyboardInterrupt, EOFError):
+        raise OperationCancelled('Vault unlock cancelled. No automatic replay was attempted.') from None
diff --git a/scripts/src/aim/winrm/__pycache__/__init__.cpython-313.pyc b/scripts/src/aim/winrm/__pycache__/__init__.cpython-313.pyc
deleted file mode 100644
index e645d327b9ff2a1abcf2a5ca4e42b4b140dbac3d..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 190
zcmey&%ge<81kY!#%u)x^k3k$5V1zP0a{w7r8G;##7}6OvnW_}RGxJjN%ZovDkgq~w
za&l^Mu|jTQUSfJ`ZfahMo}VV;E%x~Ml>FrQ_>~NwLB`zD(@!l))=$hU&P>Wl)h|vi
z$}A`;)-Nssie={NmuKb`<?6@BXXa&=#K-FuRNmsS$<0qG%}KQ@VgqUiIi(onj1SC=
NjEuJ!)QVVu8~`BsGh6@w

diff --git a/scripts/src/aim/winrm/__pycache__/manager.cpython-313.pyc b/scripts/src/aim/winrm/__pycache__/manager.cpython-313.pyc
deleted file mode 100644
index 847e8cf749dd452efdbec430a9f58e891a0fcfa2..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 32034
zcmd6QYj9gve%}QMkRS-~C6c13*A+~OfJ}gIQlv>)6dxi*k>c_awrtXdA>fjN4FdGN
zpd?aOvdxE-PO`DQ$=2Fwn$;$0Y<IVf(sm~9WZQao+l|vtps6icth4nro5?scol=oA
z&M5uR-~XI@FD^h(lCzmiuk6Evd)}}A`TZZ~+y`#AQ^50=-+cd7@v0#FIsMQd8~0cq
zyaCTQ1WAxA6T*3mViC!2ov<oa_P0nWVt;Ll4S$O!?B|P>Viw0XQF7j)IGEo)QF`8~
zIGMkAqU^j&aWQ|%g!_ECQhvTdsSt&F!6QhH20<$AvhvcE%0;Ws`5FE2Su$neL?W3A
zr((&3I)&f1>2T@_{e59@@&f+uyAVssN;ob>!tt;orIc7=5wB}UuH$tg93M(9Erk=&
z(Qqs-M}5{zRfN9?g|FgO_;Os%xRjMdNY>&<cqO=7#Q#_xoVQSa%nOP|63_=0wBL%h
z7c~fqeZE+#m23^dtF|sJtx|$_b&@^jokQ9$71JA~RH~Osn9m6x+KzW+(gCTI`CLbY
z!vCZO$;o243y1T!(m|<=#VRipOFAUESZIahmdXQ`-EpMDQU%3$)v8oVN2E#?yXuG_
z9o-$5-bkWU&Ei{>>cTM)=a{sQ<+D$!QEC>ee4dQ!`B-9Rax$C<FUrbi73jF|Ao}=h
zGMQ3SN_bhsn29M_O^JvYO<q$)RaUOXBC>x49x)t=$f_zPufo5q$dP1XA-1@p$We+u
zGbxVE&Q41Kr*m+8QVgr=%95;_L&TUWhU1DHj;@Mwf+j(f6^J*HEA%rU4k0r+k&1=m
zh^olqH6@lx$q8pN5nmNkNimFaV^_l|8MRzmPAXw#RgA_^l~fWwZ);C$t53WZOI;Bc
zF!NM#DH)Z;*6!9;t)L~;Jt|(if-F;4WHGsnNlcR*(GxNCimV32Y1I5$Qi<{kBxKgu
zcsPP|v4p6uTwYd^tQ*40B3hV8sR3t1TSROok{?sp@}Lr)ZwQwv<Los#i^BVssrN0J
zV%~LF7&cXoFDMjKrF5d0@wdpSNJ}`O#?T`zYD9@Gr_>fz!MoT}%e7cSS!%)Bq7e)%
zuVx&f5UQREg)+6~!42rI_fys-aK0*R*B$y=*#mfm2nOAFi2Shno`L5Z!kiHn6uLCO
zSBo4i7lb)&c?uv?L7`meu<Eg7%c9`3POTl9kzZfIphQJ&)r+7d;zDvI5$zLwR>gtb
z6si&^Mu`?hrIJLY8g8aCr0@(vS}$Y{=Qb@bxB-dO<8Zzz{H#K}vwy3?w^8Byq`E16
za`eM%AI8$&>CNh|q+MUxDH1AADz%82GhoGd!8+g*RKnZ=I%P>%gVq_N*@&$@l0^bl
zl8SnZL}5;&;({<k`Q<$xA!v?4J&^a9(zBf+H`tHvGR1J^hSD#JA=$dLS|*B)nB!yE
z@*mWwNU}@CQb})-RY=&-!m9i@f^exu-yhf>g8eA_J1EQ?*qs7(&?b$D>3&RT7L3V*
z_X}20I4X$vHzf`f9TgTV$Amc=boP`8VIO7z=$omnHF{|FFV#I;ii}d`>hw_Lfj*#8
zWMM(zW$1r>j;YURm3>BI<txgREQObsv2$e{Dkhwqh{&1Z<idg~r($2VU?N(sJ+!Z+
z7W}8MWE}`jMroUKD|RH$6oW!y^=GU}HDd!INn{)sL(k7#oVxHrrsQI1Xl7(^mOQgF
z!KtB4@j{fvu|-#wmNTUz*CX;W5uS`a5>Ki!B1$8Ql2q{f3W%1^p0O=s%gxxL;Z!(d
zTMaM8GuDM@rWkZu4lk)x1(6=UWU51yZ%8AKAr}2;?xNWh;V80DzXykw&Awl~x^CNc
zxZWyzv+VZZdzQP$*2^{=ou9ZX-g^F5p1(EwTkYR^=9|xaxB3qn-f!4A*zxZ#|Iw>|
z`0B>NGanw`bdRlDcdU-m>QAcny>sB}2X43DR^NO6<EpL?>b5Iu-YI>%^mgOD%BC-h
zgzD~{N}<&Kmh(;Lt*#$C4t!CCS3j=m`n#W1)ISjHrPVvuB6sa4mDTS!zV5hP{hO|x
zV!>Vgx1ZaEnu8Ani@O&2ZM&*=?C?I^DM5mV>J%FA{o{3KPYK_DruuAC(GT1X_<zvk
zJlj?BgSH~_cQN;rbLi=!9~RXOHCTUmz(W28=TMXVhmBV9pRka>$p(Lf`c{9+;K6*d
zJn+B+Y=#vdv;?hEkz}LQ6D$haq>?~MtA+kG3YcM;qHsK(v0q85DK%qf^!l^Qpu!nj
zA{Af4v{_6f75V*=j7y_#A&Q!*)_-AZNMJvsxnab>PM6B;*JH3eL)fnqDhp`L4WKPs
zRzeY3NrkS4<1x&joXlt|&s6GZmbLBfec^q(LKGllTX;R1$XH{`83#p8gqP%uLywj}
z@oGca`eGxxiWPyKIOEBkdxhe(pe(f)&R2y`T~*ta`?qWAx4kE~16|wR=IxH&?K5NB
z-q!8r&ifUPgLOMa&W7rpB3DiMPEmQKb4MsIb#h8>9xbArY_$Fg%l8|gxik2i|45cB
z?Fbeb)CnVP+S*K;TF|yf9D@eQ78AWHNd0NH^jbh??Q^AieS&tq9*N>$@eIwhyhke5
zV~9c!l-iFti4wHRofi>5FD=gyp38eKRbT4t(srgS<(@MrJ?67RDxKS>CkvM7B}z`I
ztfd%b6`;Q}2DR1GVefHC?%tw=Bj}i^&%V`tdJl#PKpfQHO65UIE`R`PW&g5uebgSZ
zsL^*{#Z;z5o6u_wZ0d>n)FsfV;f1IkrcY*b*h44am7gswKOr>W+lAQm&pyNidgwML
zc3^cWuAD;sA6oq}{J-?DUMn|%q=cC1Z-{Lw1Z|eXk<|OvOi|=oG*hw?3lSb&JH~66
zT@)O0FEC~aI7tzG<qCCT#`#=0z9RFD!9j?ZP;I7qR>!`>I`ma&j1^i^3V{~o0y#9(
zGDX-h7{1In6u|rt&~nD9$f*^D_A{B|uu``2l`%>+PR@C9CMdllg?)w5fFk%ZrAAj|
ziWOO1iKkR5hHXXJ?Wi<F%pL26I@VZ?<p>z>&mfVy1qZOy;o5Q>-f$eg9lPi7{<LEM
zC)J12hkG}x`_ityyq`aF*KWDJAG^JGT_3v#KCJ(wy6)EX-w3P^ZM!Po8h>;AmVD23
zXuJO4?c_$ie|>!0Rk`JQYQy!^o$;-f@r{=8j~dgn^P4S;_gq&#sXew`)o^>{PUm;`
zz4yX*j(kv)e)ffQ<%=Lg?@YWsu~p;UsPW$Q-M1Ijm9LNPIE2c&tqKwUeNy*yI&d*P
zJ^Rtsbn|nYb<d|OpC@E_?2COu`ROh9z<+lSJXC3ke&2bva;UNBhmFpm_L7`!#ekf&
zF!mx;=EX~3N+B5MvnUJrqnv}2PmC*wbu$s<%%Pml&kL0(2jV=~5WH3XX8Enuo%$a;
zIyqg{s0P9X!KiNF3F#_W1MuoudKxt7Deass#SCwnOJK!-ir9(9NyW_N^v)i%&k(ba
z_vqN%pe&$CLEDT$U9-_82T>WRw8PqB)B<?jptqOK&J?N%=pX1AQRV_@+bEUjnL&3Y
zSFk9To-Mk4<!eK;8b=Klc|`?;6p8mV7E+T6{zzF0$Hl8*1zaas@aMu<SYjm03<s2p
zXpj;l=Q(nohm&zGD#?{)Z1RfAiBjoRN=QWNq0{eYKm4)i!;&-LS(lbm$|Xwr0-Uvg
zWM=FiOOU2~4n~ob5S3fJ4Bi~jw<M;97)2^3IZh(VD2@`QLTJQ%B^*#VA}eYtxg;w}
zl!A!LWNhG`0gqS}6&Y_BkE)Roj%g3F`D%1ih;R)=5g~?Oyt`+1;h5B0>TkmV%*Y`$
zpSo&qrEbsuUdNr)-#raNk*;puu@_Z3*KJtqRSjE};zp%-r+=fe<?iu~%AOCN-l!Z|
zw{MqKzBTaXz+2D0`7F}BHSy-e?L+T*-)p$rlWuw@UEhDtHSkH*;oH$I@2L&%sSkY{
zRTtKax67)w$`0W_#*<!3zwlD}(#vUYXtVm2wCfen4%cD6=FHfEW*x&a#Cd+>9}&w0
z?fUGFVvS_iaF(-^!T8UZaTlsePcFflGg>p_;NfN$@<-rjhKY)^YcXgb9^jmkLO4e<
z5DG9+iR56I$N^s|^Od4z#(K<_XRcYoi8w^}@}3!k56uPyosyFpI#Zi{r~9O`R)ZUs
zTupd==|vt}Dx)-#o8F-;62as>mwqLSaHMiztqQ49s*<WD$m*op77OH<`vZ2VK2QYz
zfq<>Wk|^6Fr+=Q!Y0lusf$JKwI4kJTQJv{sss66Twnu*)%BwVfLe6;zRM8c5%^cYs
zs?QsS@{Z}@(&5LWJk+4zeA=UCg+|J*<J`x{9lE(pz;|Toq0R*Pm*e5p%gN+x51S2W
zC5EF*BohRi1&*d5oZLHhL4bKIhvXKDqD-UDl&_FOo3k<tXU&a@ap|l9J~OtfAo<|o
zVoSMHvBvyHFJbL?R=!J;Sx`>1XqTkA5Y44V*BT*xCDAIHtH{gYm?BbijqK{tX4mR&
z+z`#>5Iq)e-dt<Qd#{&|uuKWyw2Ccb%_aHU{9XQzc7IoACs^eu6Lk>2<Z#ojLhArA
z4BOe%jGO-r0Y-y|^%W_<gf7VxCz7Ffa&fI7_NMB*Z(|V^VlOkUMF>*B5HBDTY&og0
z`kKmj((HD4GOts(yxZt`(TvTj_)a)aBgCNCOXPc*9KsPCg);z7L?+|XI*{*MP6(Hx
z@&aws9H|pvVY{mG3i+~|r#lamXUdK0@T{t{zxA%pRO*H4Z<NcFYlIxye8I?TQ$16J
z{W9a$e}+iT#5ZC>t_GgZV*0vlae5(aCw?ktCoUX`idO#}u;W(+CIRAjKYgV2o}=xj
z6^9w%pV+Lvkak`8X~nVJpGVoxGn>_eY1beGLXaPEsCwj{WBAMR1N$3phc@;%uaA9N
zUAI-;yiwi!-t669*sOjL9K`V0pG<szVrzJQV|adj=$8G>^INWC8?Iw_PQ2&YbotYP
zGaIhK?cQ+;xpj5JbtHYXYs1xT;xX>II)EJx4_memd$t>WsO<3x%l3(rpL)-1H;--m
z+P9zXO`q)BZtK2ZR@{5!eu?uy17sRU>h70TRYAJ3?{NA0<c?QxS7}_!*gaSO&xlWX
z>dx$UJKkIU&gt)Ud~p4b2hx?}PsXO`Sfe?#S@%l1lCTE&lnDzMl^w`NjJ~XS_u#h=
zZXN60IM$nfX5z<=3tvbS=f?&o6Bz0ptuOjfy>s+LNyH4t2}U!R;>G0u$Au|{whWyu
zcofT!083$PRRAfHEogrRlQWzPcMS0i;7+j~KMxWaaD_pl0?daQcmS{nGX;eEg%}Jl
zEG0oZn2Dl9$sF;0>?s6WNRca*G9cwJ337}rKT#SiEeKznIsibuN~JOepPcZym~St*
zVG<}243OLm9vQ$xuPJ)9JPVIz43SSZ{K@+wh@O};z(^tB0fj*Ei~%^ZWk?lz8}+|4
zPh~@OpH!)bN>u@q`T{jPuE)v#z4YBI;F78nZa_9Sfi{9{bA<TV6Ljl&wpwyvT=^ck
z{-<oNb3Q#62IHRAe+7*Zo6Ei{)5~EnuF&ji*3)PIYA~)MSTPgGzSVvDTxT$@O@CVu
z#vOsO`bf6s!IDN{Z<P;)YT)bW+PPg|gP7uIaw!~3_|*uMCDDB7LHgH00D-HrXb8Rn
z$|@?j){(_+Jc}oQZ;wr+@1bTfVa5`87#I|XrzEYe&<IDaK-(=|j-?>F1C9yA!wGW|
z<qgy@V>z={m6b4R?aaq|HOBVo=P?Y(r`$v)3Qh5hJ*-AzF`rHO1^QKy1I3mTnR0r;
zQ-`7nHB)bnpf@RWxw|v`r&zj;Ot?tBnoLYX<SB!(kI3SH*d(Qr%T3O~Xw*Nux-5(S
zK~<HPF2`4=fYn54RfRY*U<`xAd2=-|$iXC+_mOto*{BT&veW=#wsL@mP0mI&yhH`&
z!AA{NB79{zQ79a5S#rHih%+|}K}29g)6~7x*B6`}Jry`7rzB>f;+-2xLPepZ5Hbph
z$l0(ecXw)G`Q_``QddzyKA$tTAbRJ(5kQ249LCkDm3aK3G6KoUs<%;(@AHW_AmCAw
z*U*Q&TSPrfyoQNF%5ZgMc{v`FqfO#Xr?WAVx{k_E$=CcBFTV=i&zI=lz%*(Ti7k`K
zO(KQXdz*&Y8ft15wVwB(2Z7kAd!BsQ0zo7(@}~X**Kl@qoLOg3b5UoMfT82v(wIPB
zh<^EXkrjqMa1wOXOaA+{EvF8wNMAPBfD~TRW*eK51FSZt@SN0o6wD=46#XrlVR}0p
zQwbIq4jj=8S5RC^S&>c2Bsn#$Dbq}|!5krcRrdOvH$^$F%H|G&Fzzu)3zhoF*+?Uv
zJBHL8HaFRr><+{HU@Prrff{3uGIm&%Vo}6vGBa^lpginLPOx(%yL`k9<JF*P#(ZC9
z?&`CY2p6U<D$VoAHp01U*77#!^Omn)&rotD9%Ty_>}xWPjpuA|{KD+`)cl}XI-rW)
zY}P*7rZk$Ttw4|SCZipGTKZbdz$B=ttf&E6x7hPkFJCx%4f3Ob5Nk1b$ME`M5%4+X
zTx&k7%Ly3Ut~0b+O)wouc&c;pqiapO_TR!WXJK-{Y>+hOTlr<|IuDN&)Osbap+Q&V
zcwG6Xv|BN0b(Y6&D_o^Vu-a3;16f`>1JM9%p)&S36~j4iVz8B8A!kn>{8tg0DPCCy
ze+#j~Wk&HcrJ(7|o&&G+zfst;K_5m8ghG-_F3cu*cRpucna7zczebV11}Ed>ok$z6
z^6T`XOzZd%2u~g_uDnIbZjtj_<h)Ie42LOYh<chIE)zd&00e!DH}Z!kLt+fWzAx~|
zxW7XMHCP!-UIRw35KBI@SuLeqlFpKAKeua-Zq**&s6D<}+q6~d->CI(*0!uWe_C<i
zw)CEJ^Kd(3*e5rur_!#epH}4X?-0S8xcBV?hrf03n+LZJv~3({OV_vGJ$Co}-Trjl
zne{S*u}`-See53o$niK$-~NX5;f{^{9R*o?SH&)Ne#_Ol;p*IO^u9as?TM|%{*A`|
z?WY3Up5{-Q+qatgKW^?%4@_<i%x(<Kri1gF121hhzr58fZ#2v4g{95r#Qjoxclqan
z-CeQc$};TZBm%HC)!CpioV5st!TuYffGH*l5WV+K4t%h%d2(c@$oec~0L3H&aF7hZ
zO)`KACIb+&S^nHIfKd9CXgVaPn-@0g7SolBTm~>_70O2}JFi%U%7bY~!xv%p`<{E)
zc*S*?KX`Wd)R?vCBdc?)Dp!X|yawa^ufTmG&flVQ7I|E>p_T&|ZQUb|$=G5~qYZ<1
zLq4{@w{*akHTVdVbif|86_5_(a{dnVMcz}0(`Q`0jdAt%IhUSb#^CSuHv%)y*0}oO
zthq*>dc-i>$flDF9+9a>I9E^V5zf_@whB;xSoR5HRf4dB)xZ2b;^Co!fC3_Dh0?Yv
zP;%)z#Kuk{_cB2gr0O6kOrEfXLA$gsV3leD)>ccxjdTSRCzrmK<rt;fL^(L;YM5!)
zO9$o*RY|a1=WD?~Hw3IugB)aPkcvI>{8l#495u)xlgh)8iJ0EyszD01(vUoudik()
z1Zt4VU}Yg`gg%3rJjswsNJsS+$uIzi0XP0->m0N{l5<9=#yKBbyLb+kUn!<TF1%%n
z@g&Uh#XN|j#1^llV7#3Wml*P3+%*9Z&Ox6TOo?$h4Abvq0@l?~&&ps^fEvI#m`rGt
zHS~gVgPd=W^Uuh62M&bshW!k$mY<u8`}3LH{fkt8jltC-F+R7C@_L4xesTuLIZe(f
zIItTgepmS>_mgCw@x<Y;V-`P-i)|!RoE02R;0zFuDtJQwP;6;D0eu58yx2H9+CxJ*
z(HLgSOBxtv+|^7n4we`|ud}(!Kx~8DW;-x+C7f7<_yT}>0fy|HM|d8V?6UvjN(%J=
zfPO8u3<*b{-qB<kuY*R|1*Mc^JPrWg#IPQ>)&YimEGzstPMU*8t@#&dmM|19`la#V
zU8p{?qL7w<S8NVkML$of;Z)IY5+sNc%#>j5xJuYImROO+H^k?mf<gN^f2%Qvp#bBt
z{4vHhf}i(8_0*`pT?(flS@AZ_&o_xri*t&+C|?JfA5kOWW!cMEPrPqxYywMVg4bHL
z^-&=KMz*DU)LnZ`{0~Rh1%{Gwd%3(@fmnRNZ#vg{`6?w1+8(QvFOS^|a&)bSr`;o6
zfz>VY#m#Ue7RoQt;`kTj6vE+WS?*+pl3PH|84r`fi|7HyWeHZR+H}Q{AhQzex2dFW
zk@ILg{shpvid&47aQdTWk+t$KDgWOm=Q24Fa!9SjQ8Xh5WAt;JoI;=)8=hbW)XdLO
z^$A9i3L$DJ9_g${=rYa4Oh*p9ezHU^3vl*d!YQcws$*DrWV3oS?HYZwChSYW?oXcx
zS)c#dJ@L`?CqdTT8~eL~tZVAlM}BhXska@sY@ars*gn|?{Jh=LwcS6w-PpeE?SrZA
z(dt|F-zd9ZBphzssS~Q|fPX)2ZvBIa_b0ZRhc}vsx1a8YN!{VP`}X2`z+K0_^7Wye
z>MY#l2)c$L=zwtek_kY+Z22@FJ=^Vso=XTly9hm(GxU5Uo88Zgo|~69>t0V+zRp4O
zBtY^7%g&4rnkDx8o_oT0rGaMu(8*Cx(T_aN(YBINn3I-+X2IlA4kg(JVAuj;UI?T$
zVmR9Igg6?|U3&@{u0bCJ^K{LyrbLgKha3xNs<P%i3^_7Gyo7@eh?vZC41^6-2CWmB
zr$E0{A~`kfQC6?^lmM+#K?9yL$(1#k%jz`P(YPXR2$QFUp{1Mm1RcPoMZm13z?(3S
z$s#G}OlnN|8@z?-oq+>eY%r^_7Bc*iYN<t19dq}y){)Um0W?cgjUEH_ks)GPA)_Cu
zo*5z@$TLJdz|+Hg=-(Eq2@rLIbg<V3G@b2Tn1=-2Gj#AN?~xAmLE;h~Lb&sZY76}j
zVjj-R20w8m@kp;F=#CraR47s09d97Z)nQ(OUpR_1v=Oi;=vJ-ySocv#cTqHO?&Qo$
zLYyXHk3=#h+9*k}qMtDk>DYv3PYKABa}u%Tx!neotEkV~fn6Y#kQNrD38k)8^L^2;
z1rat~6R9$$&0Gu1o*-m<Z-(;M_Yo}$4zrP&v@SlQZ5gK6@*+%&WM!>(*$|rfIc*4}
zuBX<H4RLx=ut-Ki*3Lp-;@z{j0M87-OS3ld&b<Wb?;GN)$ymbM<ZSYhS&og4M$$nj
z!kj>CIBo<})r^hI)H9_FXizVYLfJ%^Vyz~uLEOtLu{e-j0D8LBOj%Tp%P_K$L#ZT0
zY>=ZZ$!pcSJIjPd;>eA`dS!`x338I;khl<C^&<KI4LNh<5W!>0FU132MlkTlOBC=j
zIj}y^Om9edmnp`{F0x2v@;e4RmMOyP<S6721!UGXnNm8D8Y0~Zovw<a<Je!w7-5D_
zq(@Q7VPJzn3?{8(mAgy<5ptL;?@jnJWqiCtbbL!mQP>JOOt4oDUoHmW0OSC(i#Mir
zC_5=KCvq^yp7G)YGk$}^jC^t4C%Vymx^?1X_l5NIrNUc2iO||M_P4E%!E)vBv!B+B
z_dH#97dAZu5LNZm;pMS@7_QJh>!>YXAHlYL@JL$h*=Xolp8$B-uB?5>^|tF%ap=>g
z_$Q4`@0D#fLc(_Peu=HEVaF+WJGMPd_p3^4>pm|kLoW5kHoaY0Pq}w(A3MJ7^=}_L
z0qI&T&is^ARex@Gy32tiYMb7(eK&H~_npM|A|HDHcqzT_!us%b&Ec(@#*LcBJ8x{%
zbljCUYM%MvwT+tb^^xt0nzwGgdGoDbeDfFS5L(&WWw+<wyYk+Pcdw<Nel~sR%)QD%
z900h}2vOfgbN@##r{%;(ZE~G3*qswwo{kMq$KBUAJ*PgH+ZveO7?|D~nAsSZ*%qJP
z61z6Ut`DxI#jdn??pE<{y0^s>@4CP3-V!_RR<qyx4t((vtY;=ITkZ?^@1aVPp5GrS
z8tEwduN}@&OG$(#tNs{bv{QJ?Pnb>MJSMg=>x3m?m&gWv59`QF-RxYEo!QFLw9k8t
zE$JMHd`Te@j){0<YZEC}0TTjKEUZM3_~JqvyS@=79NDcFMl7(1hXuX^LN5b6Ks@(^
z<-n>JZF+3owOUbJf+IhF8}y!If=Xip%nH}g0{ct>SR$1LjT;ppXmc9*T)>9vnt@0y
z|9RrtVtn!+y~lOI5`drECM3#C{a+p|+ckO>xn~q0jH0<##;khl^UEMnBmhDI10Ivv
zj7_TQwH5>s)q33kUu-i+cjulplu4A&0W|U_SU%UN`*moi_a&Y04VD9VmIurC3C~rk
z))qmvLZtZ>j6R9vNP3y~NHuyr^jxBtGm~gl*4So`l(jg8hq(0Uc|0~v&F(av)@kb`
zU>k{4RcoS>K+v4XvW0_F%Q$D3s4$J(zF^Kc1uJB$WKC2IRxDWb^USK1=d~dC>eeP^
z*r6`bn}DLX8Mh*+*q|3z=vIR$)BVB<A%^oM3ov|O!b6zk(m9T(E(S2ko!Evu75+N*
zlgEkH#_1Y{lz%cAU4cl9o97s2A<jk!y_Qr>gfuvOQCSQpVr%R`YB(Omy#=Cw6i5Ox
z#*?CdTA}+GQZd}y02O?0?Zr2kU`C>{G$GQSaezi5Ml5Q2^X~kdjjyTzlmp@!FRvqE
zBZ#ZWI%GEKKTm;v5(i>8S4ICYPHSHgJDiP|S8*x@$#iw}UIr&;DV~=V0{aUxAwe1~
ze+aQ=lR360JX@bLM@Z=P078W>2Bpy1?#=-ZWL=bx&pE67Ys?tsKfqZ-m30j@4zSZ@
z7)(4VUJPmjy=LtbGZyFCGsAj-$RomRDI(*tji`7T0!c1n#E(QW2Xb?$>GwX{_wpO_
zs?S^@@7$pO#jt;^)!+Mc%fL%d`w*#-B4sS%XFF86uROX;0*J6Y*A(oSiZF^G8?cK(
zF^=I6h!W;XDz=7NaWLB_u9fuT=woX2^k<lvbbW+FJK!ucbhvghzeJ;5D+xk*bjgTF
zmd@yus$KIZV`J;2He;i?k+CYW@}H@v!{q!&a=u3n6L%3~4VWm07088b1gfE*hDlFK
z`8I`+f|)CnGj?XeuKXUohVD8XRh4G)J7YKs#--1I-LXh2Qv{Ja1FVp)<>JmvNi-6o
zW7*1|BB}D<$YCgyP-Uh#D#L;xo^b$pUydc@XvWTDr_Ad9YD~Vy>r}!k6jj<NQIUK-
zlCiPnNoD1tQvBk;w1P%LXK0cuYTk*$ywG<sD(ViLuL^(e*!L4h)sC&S+O}T2QzO9K
zx~gTPs^zZZ!{^g-EM3)-u6osUG75K-ytDN7(pFvHovZKO{Ps<FKCo`p4sO&AZq^R1
zkFt|f=RfNC$d{Ia>F4It!I#qBmp7|JX;)~wrs18*w<ou1n(oZJ*SWE;<!<*M4gBH2
zR>$avXE*kpTX$?%*1h9?+r3r!)Sc?Bijx}^C$}n^H!7Nu>2~GhgCgs`@*Tknm{}~~
z3IkkNkZw5t(b#5XaNYjXikj`Z1MggU`^ueS1LbWU?b|row|TUGvu@yn=m%=LZfN}+
zGTX6Qs*Z0TZ{9lId$%;**tb(;sp@}FR7BYqA$y0tRJQ!YbpVassyp#<-HAIZ@80<K
zjk|5X`wJi1HtI&U>Mm^5UHItv&AQ<Fx$S-X-|2h1@Al&6z7y-ipBD?Rx?9oT8r~{9
zwo!Hr*59|f*N5*H3kMEAu-ht~|EvDcE!%d*zPGNwc|BeKG}`yTF1V*Hzb4(Pd8hvE
z`r9Y&cs8qWS;L9%7QHw82V?J#rMt#H@@zIwZhEIST^IjH{h|Am&yHX#b^h(=r9$Na
z+_-@1vW|xe{8D=Mg|zp@&FZ;yIGT1v{|=2q@c;d52U4lWF@^riGlRBs-NKI!HjM4J
z{iwGO?w@o!$7+f`5-P?jiax5a!#@=<<5XHj*v%~uqL?%W_ASPp3haIb;9hO#MLgpv
zB=ic}^HEL<P->tU#?wZ5h43#k9EPAL|H+<%FNAcnXV7#+Q0UB=WQds{Mk_6d7M(bm
zrL_>aRVaiHVL;xipKKyTS?D~zj%k>|uAxE&7R^76YW2C+Cb;2Gi+03^C@xXr!C{dR
zDt7*q@tmSA<2W~c(R6OrfDOY#0ge+g2hW`g8RoAcO)C;&`bTx`fDt14MJ<fq3bpo>
zIS890m*M0_@)c+7$rTvX=%-x?-eeq$%SnDJy_C-LFfTI%f<0_Bid`d#OUObh#1&j@
za2o?0mQMV<a3&Y*Fa_9jG9HVpk`d<uWLH0*1!^cn8|?Jp3l}a94%4n53c>6&3rxsn
zl|d7eQ7tJl2Z#B-=WI-_pbq?1A*`hv#)(v0h=|awkA_`b1)5xerEfkU<665YgB6-q
z6ho+KE>-fvs!djOJ)C9{JB#V2ZPKRLwC6(wO6GB4oPx%kCAwmiZbP6c%5~O$O(C5#
zKcOWh)u?6&MOL3iAFv<(+*WJx*cqxkttBj;osDc25D=iz)Qo*ucd-CA)3it&xoT0f
z=>jt{%ts@#*VE)_7ClW(9w0!zw)C-KGsl3wo;*udvZ8I`DY8X0c`y&89B2#ZtUv_X
zW>S8#V)QOI3MK2?!C|dXR^Pk^K>?g=OuH+bC6>r6UpyC2UWR!A*Z&Sd?6*jFuSqf#
zud&oB<`V>8y6rJDGtEv03RKnEE6NIntdWnYF<7h!T|t{2Gu9;0KSTMeWc&Z+G|i+>
zE--mX<7}ES1)`XB%DkrNR~S`9^{(8rsysl=DS+8|gJ>0;SQ;(EELl!!-9a?hKM1LJ
zzUEwOk71z9Os@5eZ$8l+Sx#nW2rH202P@DtH?%r2CW!3##U^gk4}M{lHjKWUoBa$^
zL$-bBRGw?9nb85r2R}&56{>8_Hp<sIRk;vLyoPpriEy2p9#6njAjZuy{IlE;1%z$)
z5cvY<mXnlLeX?F6nunfZOBmxp_S4)V*IW-8WZoaFR{la=@~BFQeoCj?Yrg<y@eT1J
z^b2%WfKP%IZbN;8tQu&<1LM)aIlK(aCMAAM!3S>;@@r*0aW$;OU@hbIk*Nb6mRM%{
z%?xaP(PN(Z`9`m1WE{Ym6ngEOmtK&byLh2c2-~c{U(Yu}Fc6)e#J!84(H`V#9Q`2X
z_B_}bZ5f-2YnskRLPglRRKe=!CCEk+o7j?85t$vjeRNzY0zn022+>(Opo=ux)rY%N
zWqY7W;@2ZKIcdnoA!`ts%TBBqQV5+S88vP;>eFm4#Xp)<U<#BSFYGD_IdwUfq)ySh
zc}h;59lt2iywEy<8^!Yu3BZyjz;5l)0)wW}_RdkagZ)QsX~exW(2p2%W6*Iure;w@
zOJo={7n=v&8G>cGipM`W>5oRmv9Z3Tr9PE9kGJ*GQXDlu<8k&sdmUZ~H&h^_0Z&_?
z)q^WI`Gs}^9(Ko_=h@TFem-DgB(BDy1D+clZS7qny&XONk+W^x{?5yt5r1!QM<<=#
z9v$i)Ztom!@4o3FSrfa>bHLN;ISn}t&&J55d$@D3r*{O&+Ixrmot>xJ{DWtQTm7S5
zXNP-6275cs4)!3I1bTG9lWVo+5o1fZ>2ko+?h&<481OV|K97h##81{%^fN0PrJLkP
zIP%RJ97Oi=H5#)459%xPxy6D&%l!O4&8UGqb4Zqoa<EnKGg7GF@G#{Nms2w6Ga(F>
z+MRvH`;fg;WV&#4ke`X-(O6}9Me>`<f-so|Jm&KiTC315ZC^R9d9)7Grzov=M&a0<
zFw~ho56t~}`&p&gnDX92DIT%qbbpJUCzG!Aw`9AHjbjUI3+4s)sHdHtGtRm3ivi#g
zI$6QwRp<qhf_c3rvca0dh=WE00+@eIKAafhA()uW8djzwTBZ|Q7$z?_o5O)CC$<Re
z8xRDk+J(b3oq0R+a6XnTR>TM>nl2x_0qjLmGjC%^^n=?WOh&IXOok8&zv&bGB)$=G
zU`iuYoT%`H^UCAopRX`lLIa8fP1+b3Jc+N#nF2WC_HH=k<CnB^7<^yhIMy%0+$puP
z%&6Aj3a-k5fHcD8ofJ|i5et2#k+ic~*{?LpiK~4>7bmBKvm-N8gOejH4l7=KrIDmZ
zsG%;m1QiPmCsd3fD9RXe83A-(_3qBZ7obp9#!WH8O!97IvoqCzpBv&Y#;1v5o?#n0
zN*bRAY~q4c%`+Nais44z@#(9bUlz~30zhZV5IjRX_L?j<wYB#IPBw{tx<6^pINiO0
z_O4EfR{$!FTwg|FZ3$52j9Nod4XG(VeD(?~9(4|rCMIj>u6e4*B^H#$$o5pT)_p|X
zv)x7hyo`52KQyaQy?O1l89~=RqCnawhOWfoQMM@#;bq@EGlSIj{Q1e%-JprOZB&Ut
zZ>}BlWSj__q^6FYN~Q)ENM!F{OmWOc8<H=8-Wm?Cs@@)$79el4s6Lxy7^D~Zll9@A
z><q~w4RH2KBeh5etQ5rGppCTWgCkmyaHXakr8dSEVwj@X95J=olzjzeq8I=_5vUQm
zql)%Fv8g@K6=?4bbo30|Aie+1wm?UqJJ5!=U4b6>+tA#cj%d<5fl9&2SVgAJB-$!A
z73^GYxofP6RB9O%3>F{Yh<A<7^AezS-@IXNF>l2DlB^Dm--Nu1_C`4St%^;v`Zb{g
z>~`*g6JO^e^E&>Dxz;)^<{*plc#o*JQ7XR^9IT8+0HEeE4b<$Fm8Hvc1~8?KYJk02
zW^Z=EF~Da&{tBs@_#6jyLG9&hxN~)e-ul7o8N3mV8oTOd2Kz9k1?ONGH{)f!;U7=<
zFw~DSU1mj^W+RoY_r*U*;T)#YOd3yIraQ8kL?)GtB;(@j&@}i7veTZ1;!Eu6J=Kk_
zWP7@ZZ5Kz3NofW{)Fti6Fcwvo+0f3JqH9@)y&-b0#GhYna~iFONw80I^&;_QoQ`Ly
z$s@-7Q9W6h-aLN3`fx-N_Y*O4)2h{PK^t>Z{qkG&4?Yv}>#y^8j7ZMnEO1kynrcD@
zR#CPe>Ii^Q6kh;)e`*CQmSjG#F-w3la@t|cIc&<N;n4OsQwL~ojDpMu&{-jdAQ$+b
zQ%IU^+`^j<pwptlvLOiX&*8#AH^GZ(gp@E1^FDI9m?j|07p!$kY{i*p9XfCoCz~gj
zn4xDx7NZT-0JPM&F-Bc-*iaKM*hGMxwF|@_s41|lwl(buN=-Qed{P@Yx_c7zsih4j
zB3K0fFs$}GFI}B4&<L>MR6j5>D6WZ#2mam+BX(IFl872ec1{=1;ix&6(~ZPsB7^{d
zBl>{~#!I8M5LZ$~zBKcgGj~*j{TmwU?ig)vZT0tbwDy9D47d8vwsm#-2YcFvhTGas
z4WAtvD#S$2q7Kis8`%t>I@R0V-O=Vh+tb<O@9YWp_)m2XcKe6gy1F_#dPY0W4xKW%
z$Xz)6i5N+(`#HZy;%Q(56CcM#{Tj2UM!*U}Z^Bm?+f7763icRIl(C@&s)$Q-2f-yy
z&5DD;*|Cc=<FhZ2FlTmT(t|Tyi^&9W2;dGi9zx?QvkW5jn3>53(+svNfh=h&?`y%=
zB(BIyVKuN6izrDoxsZYZC;O%Z?UF4Rqt2Gr_Likss)f43$QZom3^Q2eAIlg|EF@3&
zgHgGXR8D7AIOvW37VT|6;XL|s1t`twJ-eyD#T>1_Wmh4Lgb;ZGPp@5bp`OnAMdFot
ziJsH_#EOqcPjlY6?Non@_M#tT^#VTQ5kEbKBXF>99n`-;gA(;1Vtus|z!e*QaJ*DJ
zJ^i3IWRrplOv0Wwwj7uB(_<>18K=kD)$V|$;H&qD(ockzc5cS=jW1kGoDJg(Cji~*
zX?Au9eX@6qe!7%peBm7U)x`oS_XzE0P+=^rL}z6Mml^^gpQh7H7%i$vZUBk^%Zbxk
z38R~|$OQtZYcJx{EaMB<eeuzh*RpA}#_Sz|*NSC&F)@s3nTVQel^f8nZMIqr{a623
zEQ%XR^q$jx^^aT!k)x?M8(Weu#4w*vPtUfsVtN(`q3M()&Bf^+Ht^iv-(n1Rb_UGi
zm=!*|Vwx0rD?^KLdavq2GlXwTutm{74)UTv*M+Kep=QR<{^1qA%&5*|m=5|+Hu!@n
z{r3p^OY3AB_uK$lOWC4w7M5N|qgiOfS;&p`_y3>OeOSg-Ea-}M^bz;>x0tJIG^4*|
z_we*{tc)c~1An?723>5P9p~pjNnCz>p8Gr6=RwMe4rY%W%wL6|bUtg09gweM(de1<
z59%KPI_;lI0*5a^C?>+2U}H(5H>R!9CnF~k;@MTY4TvfKWbwr7E6LO|jXB#je}~0s
zWY6a<=#t(Xt<h*Q$TTNWyJdG2_FOv&?{YWhCl=z-9>8UIxfvL;Jc{tdl00ZShDieD
z8JZek>W5}{Sf7CQk)Mx4GxkMYsm!%QCKE<LBxEy40Eq+~Fev2bNlhwVUX0n6aB+G_
z6M7gD0K%~<6D}erL&?js4(uJB+fNcd#QMK!?nYbB@TuO>ks*KAP-myVv$v-m(58LZ
z-`?3aG&nNa)7jP9d-Fz5?`Us(cQ>$4dplzFbPxG^hq{LR-6NxCJBLs843BmW-h8Qv
z-%*2H2M33TMuxjP{XLzC+S%RF;UDbn8S)Qzw{>*(wsv-RwfEe-F*JC#tFx=C-9J1s
zGKg5cZT?ejJtO`RNZUJy+XhF6dfJgIZn{~3xB_xf2twJVu8?&ykE#n*8Y8g0gMx!X
z1JcT6uJrb{HH#gmxEzak5fX8Uq%ULQHqS{)b<#tuFbjEF%K$+BrjsO{j~E<HK`x%T
zA@0@NR39o3YGO4NURtJcf|%f?Ig&LIS-;4>(*yV#Ohu-W*GOZQh+U@;Alzgks^X?4
zs>Zo#4OOf%tqj&DiE6o|T-OEq!GwxUV-pu9=OuumYp{x)*JtLu0dNSjLs-DFVVQ8D
z&<sC7G$UVyL0>X~7+m}GJiZ~O#fB!BwIR!BJDpF7&k;9<ubN$f7Kh2%VR=cmBxW&1
z1Sg(w2pjj(09-<?erfUo)3A=s!ULH$qyqT-*i#~zRcP-hGNQwrg2pjIg1Ru|3Mmmc
z%wr}j$<daT1l>P|v@osAYW`p!yvpno1I|XCHQA`5<4tmX5-|ggPK#a-outBwA;~%!
z<&vcRQR*!)6~Lkxc@kt`a7`sZv&l$`v++vm5m6}6EKVm10Iju_rJodPx;~Z61*jl4
z62!-7+RSVXa+z2%{2+|?q*;!kDtex#Iv36~%gEDr0JNH9Q$ha#8y6-TV6rt+C-?#v
z<isL|oumW!upL(;P(?Lsnsd{WLl{BWUeo94Fjts$tUeQ{2ec~$uqbs7oHdlEXADe)
zUHTl=?7@%?ncJXWo0(xSD}j#{H_YKePcA&@6G5y)0pnv<xYJ5ip|11c!Ylfs9)PZ{
z`ydJ2Rhg@3vlF4&)L5p`goY-!6Z0+-AWNSdBWY$MjoOAt;W41`RG5}b$&Y#zh&*#K
zIGr2aq%kXy;9@W|j4jJs*apGl%<L;*x3zXcvvT76Az4>Mp@K@TGU=msx*k#(pNpIH
z(t$~SlNH$yE58FLW2aAcsmkxt3uZoCf`K3{mdPxcEGT_tdFH~(JxcN^IX@$ZjD}$h
z%$IkjO!LsihFL3Om8>9XYH1I*|J~0kty=(JqpuH!(7l;P)~-qIJA`}0x<~fFe}sI$
zDm<tbN^4+WTX%4~p=Z0kWBb7A?L*?XCcZhbb*OXWQ0Mm1z}C^uyPo^*l6}tglFuuJ
z{f9Lh+0?sh-(I`hwAs|R)ik)#H25LB=Qrynw(4d!>Sof?i<@<G>t#FEDQmUui+P)1
zcm0!dX<Xa<%%-hn=Ovp^TCwx8Eyn<PvnpsZJ!TfJ)9J5VN>A$+uC6(p_b&8N1~MjP
z2CHPkz1N*bm#RB)U(KaXeBjB3Xn62pFbl3>4@X|Z-V%j$9v=ou(f1wcvK2om@$jWf
zI<cq(@O_u>Ace1(kLeiv{7!>kBj4A^p{o#7stF$|K2osWgq?^!P?|818M$e97-YE6
zOdqnxMZW>NRMmq*aBo4iP+7B8(YI02w_RSn{^I(D+kp>Wh1oQj3tP4Ca4B?33g<-0
z{8al&2sgfmRXrMs_Owz6bqF&+S3V}+{~?DC3;3MuyCD3$<~Y4&CpXU<z6ry}(opIz
zn}(I+;HNoR?orB<)rfU7dzY<|t6+`TFtC_xEST@tbL+;+DSzVBG@QJ(dHGP@Xyd=a
zpNF+10-l4oGcFTeZKlorrI+~q7<skH=EvHi<-*RevY3Th%?=Z=P&(I|u|bj*$0uJ3
zC1SLNMP=FFr`prGR#37>NB@*!vV=c_Z>^HGh?)VJF-;NEWO(wfFVxst`Y37wFb^L^
zb%yAhThQ6S?+S%pUkS&xkctq#T?6~cI4q#>J%LcBB!txy35Aq>s2;BEr_UcpmSjk|
zqWl&@I&R0mthGSC7&%wT`8ql8l0!?EQ|C{}_gCcnZ#bFSP>5$3g1ASC;mnP!qNq`d
zKqvdyB36h7Gp7O`^>dKVUl#6L?RLjsms{+IK|YJCA6TvS8Owtrcz2i=H_p>rx4l7o
z3E$^OD(ueBJyrHgmd{UE>|LK1yX;}h&Y^z$q~+7{svSFdke$17r-XSO!hu6OrOfLT
z4vRZw%<IDW-W@mdmJ81E&nuYs4a*ga{UFPRJX$u)%d=r#o(=Q5gxdNYH}jTLjup&X
zDLCDqS26Ew(aV%$)rlQDd5|M&Q^LHsPG8(9WnL#`Q^ve5O6z9csUkr<e!rsE-tcL4
z?T#IPk-VmUr-XbCp`v=HlzdL1s%EE*eC0SY@i!Fz^Q)Gp?arMAi{NkDam!ZwyoF`K
zd|D>l?+}o6Dfc^t%6&U!-0u<^PHHKUt+V`Za7GWg>`d9q>`vA}_^b5~`FQt`kM|Dw
zc;}E0Ik>;5fR9fInhU-vn!pPy?COw^f}KZTXL*$4<fFsyw5_ME#ABBk9mC=C70mm1
zfIa}K*eSf;^d<mFKR(w@d_iK7U2@58i-uT3`x>drzT1TFPR5q-608FtoZ_IeO37i<
zGk3~n9Q}NKomK=)SNtcav^U~(h{f_}g6Gc#_fLe<p9mFyCe;6haOls3Q-2|}{!ii5
Q7sb~~EzZ9d$Yt&Qe~w&q1ONa4

diff --git a/scripts/src/aim/winrm/manager.py b/scripts/src/aim/winrm/manager.py
index a5d2f4b..a9ee9ca 100644
--- a/scripts/src/aim/winrm/manager.py
+++ b/scripts/src/aim/winrm/manager.py
@@ -8,7 +8,7 @@ from pathlib import Path
 from ruamel.yaml import YAML
 from ruamel.yaml.scalarstring import LiteralScalarString
 
-from aim.exceptions import ExternalCommandFailed
+from aim.exceptions import ExternalCommandFailed, WinRMConnectionFailed
 from aim.external import command_available, run_external
 
 
@@ -78,7 +78,7 @@ class WinRMManager:
                 cwd=self.config.root_dir, ui_mode="compact",
             )
             if result.returncode:
-                raise ExternalCommandFailed(f"WinRM connection test failed for {fqdn}")
+                raise WinRMConnectionFailed(f"WinRM connection test failed for {fqdn}")
 
     def test_connection(self, fqdn: str, ip: str, username: str, password: str) -> None:
         self._run_ping(fqdn, ip, username, password)
@@ -143,6 +143,16 @@ class WinRMManager:
                                 "groups": ["S-1-5-32-544"],
                                 "groups_action": "add",
                             },
+                        },
+                        {
+                            "name": "Enable remote administrative token for local accounts",
+                            "ansible.windows.win_regedit": {
+                                "path": r"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System",
+                                "name": "LocalAccountTokenFilterPolicy",
+                                "data": 1,
+                                "type": "dword",
+                                "state": "present",
+                            },
                         }
                     ],
                 }
@@ -552,7 +562,29 @@ try {
     `$sans = @(`$hostName, `$fqdn) + `$hostIPs + `$additionalSans | Where-Object { `$_ } | Select-Object -Unique
     `$cert = Get-ChildItem Cert:\LocalMachine\My | Where-Object { `$_.FriendlyName -eq 'WinRM' -and `$_.NotAfter -gt (Get-Date).AddDays(7) } | Sort-Object NotAfter -Descending | Select-Object -First 1
     if (-not `$cert) {
-        `$cert = New-SelfSignedCertificate -DnsName `$sans -TextExtension '2.5.29.37={text}1.3.6.1.5.5.7.3.1' -FriendlyName 'WinRM' -CertStoreLocation 'Cert:\LocalMachine\My'
+        # Older PKI cmdlet implementations expose a reduced parameter set.
+        # DnsName + LocalMachine\My creates the SSL server certificate; add
+        # optional metadata/extensions only when the installed cmdlet supports them.
+        `$certCommand = Get-Command New-SelfSignedCertificate -ErrorAction Stop
+        `$certParams = @{ DnsName = `$sans }
+        if (`$certCommand.Parameters.ContainsKey('CertStoreLocation')) { `$certParams['CertStoreLocation'] = 'Cert:\LocalMachine\My' }
+        if (`$certCommand.Parameters.ContainsKey('FriendlyName')) { `$certParams['FriendlyName'] = 'WinRM' }
+        if (`$certCommand.Parameters.ContainsKey('TextExtension')) { `$certParams['TextExtension'] = '2.5.29.37={text}1.3.6.1.5.5.7.3.1' }
+        try {
+            `$cert = New-SelfSignedCertificate @certParams
+        } catch {
+            if (`$_.CategoryInfo.Reason -ne 'InvalidStorePathException' -or -not `$certParams.ContainsKey('CertStoreLocation')) { throw }
+            # Windows Server 2012 R2 / PowerShell 4 can expose CertStoreLocation
+            # but reject the valid Cert:\LocalMachine\My argument. Creating from
+            # inside the certificate store is the native compatibility path.
+            `$certParams.Remove('CertStoreLocation')
+            Push-Location 'Cert:\LocalMachine\My'
+            try { `$cert = New-SelfSignedCertificate @certParams }
+            finally { Pop-Location }
+        }
+        if (`$cert.FriendlyName -ne 'WinRM') {
+            try { `$cert.FriendlyName = 'WinRM' } catch { }
+        }
     }
     `$httpsListener = Get-ChildItem WSMan:\localhost\Listener -ErrorAction SilentlyContinue | Where-Object { `$_.Keys -contains 'Transport=HTTPS' } | Select-Object -First 1
     if (-not `$httpsListener) { New-Item -Path WSMan:\localhost\Listener -Transport HTTPS -Address * -CertificateThumbPrint `$cert.Thumbprint -Force | Out-Null }