diff --git a/.github/scripts/set-crate-version-from-tag.sh b/.github/scripts/set-crate-version-from-tag.sh
new file mode 100755
index 0000000..20b457c
--- /dev/null
+++ b/.github/scripts/set-crate-version-from-tag.sh
@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# Bump the version of the supportfile Rust crates from the pushed git tag.
+#
+# Used by .github/workflows/rust-python-packages.yml when the workflow is
+# triggered by a tag of the form `v<semver>` (e.g. `v0.1.2`). The leading
+# `v` is stripped and the resulting version is written to all three crate
+# Cargo.toml files so the published artifacts match the tag:
+#
+#   - rca-tool/lib/supportfile_core    (published to crates.io as `supportfile`)
+#   - rca-tool/lib/supportfile_py      (built as a Python wheel)
+#   - rca-tool/lib/supportfile_wasm    (used by the Leptos front-end build)
+#
+# After updating Cargo.toml files, the corresponding Cargo.lock entries
+# are refreshed so subsequent `cargo --locked` invocations stay green.
+#
+# Environment:
+#   GITHUB_REF_NAME — tag name as provided by GitHub Actions (e.g. `v0.1.2`).
+#                      Falls back to parsing `GITHUB_REF` if unset.
+
+set -euo pipefail
+
+ref_name="${GITHUB_REF_NAME:-}"
+if [[ -z "$ref_name" && -n "${GITHUB_REF:-}" ]]; then
+    ref_name="${GITHUB_REF#refs/tags/}"
+fi
+
+if [[ -z "$ref_name" ]]; then
+    echo "ERROR: neither GITHUB_REF_NAME nor GITHUB_REF is set" >&2
+    exit 1
+fi
+
+if [[ ! "$ref_name" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-].+)?$ ]]; then
+    echo "ERROR: tag '$ref_name' does not look like a semver tag (expected vX.Y.Z)" >&2
+    exit 1
+fi
+
+version="${ref_name#v}"
+echo "Setting supportfile crate versions to $version (from tag $ref_name)"
+
+# Repo root is the working directory when invoked by Actions; resolve relative
+# to this script so it can also be run locally from anywhere.
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+repo_root="$(cd "$script_dir/../.." && pwd)"
+
+declare -a crate_dirs=(
+    "$repo_root/rca-tool/lib/supportfile_core"
+    "$repo_root/rca-tool/lib/supportfile_py"
+    "$repo_root/rca-tool/lib/supportfile_wasm"
+)
+
+for dir in "${crate_dirs[@]}"; do
+    toml="$dir/Cargo.toml"
+    if [[ ! -f "$toml" ]]; then
+        echo "ERROR: $toml not found" >&2
+        exit 1
+    fi
+    # Replace the FIRST `version = "..."` line only (package version, not
+    # dependency versions). Cargo convention places it in the [package]
+    # table at the top of the file.
+    sed -i -E "0,/^version[[:space:]]*=[[:space:]]*\".*\"/ s//version = \"$version\"/" "$toml"
+    echo "  updated $toml"
+done
+
+# Refresh Cargo.lock entries for the renamed packages so `cargo --locked`
+# continues to work in subsequent build/test/publish steps. Each crate has
+# its own lockfile; path dependencies don't hit the network.
+declare -A lock_updates=(
+    ["$repo_root/rca-tool/lib/supportfile_core"]="supportfile"
+    ["$repo_root/rca-tool/lib/supportfile_py"]="supportfile_py supportfile"
+    ["$repo_root/rca-tool/lib/supportfile_wasm"]="supportfile-wasm supportfile"
+)
+
+for dir in "${!lock_updates[@]}"; do
+    pkgs="${lock_updates[$dir]}"
+    if [[ -f "$dir/Cargo.lock" ]]; then
+        args=()
+        for p in $pkgs; do
+            args+=(-p "$p")
+        done
+        echo "  refreshing $dir/Cargo.lock for: $pkgs"
+        (cd "$dir" && cargo update "${args[@]}" --offline 2>/dev/null \
+            || cd "$dir" && cargo update "${args[@]}")
+    fi
+done
+
+echo "Done."
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 0000000..413e079
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,304 @@
+name: Build and Deploy to GitHub Pages
+
+on:
+  push:
+    branches: [ main, master, rca-tool ]
+    tags: [ 'v*' ]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: "pages"
+  cancel-in-progress: false
+
+jobs:
+  tests:
+    uses: ./.github/workflows/test.yml
+
+  build:
+    # Local tests (the `tests` job above) run on every push, but the GitHub
+    # Pages build/deploy only happens for version releases (v* tags) or a
+    # manual run. The tag only gates the deploy — no version is injected into
+    # the built site.
+    if: ${{ startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch' }}
+    needs: tests
+    runs-on: ubuntu-latest
+    outputs:
+      leptos_js: ${{ steps.asset_manifest.outputs.leptos_js }}
+      leptos_wasm: ${{ steps.asset_manifest.outputs.leptos_wasm }}
+      leptos_css: ${{ steps.asset_manifest.outputs.leptos_css }}
+    
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v6
+    
+    - name: Setup Node.js
+      uses: actions/setup-node@v5
+      with:
+        node-version: '22'
+
+    - name: Setup Rust toolchain
+      uses: dtolnay/rust-toolchain@stable
+      with:
+        targets: wasm32-unknown-unknown
+
+    - name: Cache Rust build artifacts
+      uses: Swatinem/rust-cache@v2
+      with:
+        workspaces: |
+          rca-tool/web-leptos -> target
+          rca-tool/lib/lzma_stream_wasm -> target
+
+    # sccache speeds up the Leptos/WASM compilation on regular pushes. It is
+    # skipped on release tag builds.
+    - name: Restore sccache files
+      id: restore-sccache
+      if: ${{ !startsWith(github.ref, 'refs/tags/') }}
+      uses: actions/cache/restore@v5
+      with:
+        path: ${{ github.workspace }}/.sccache
+        key: leptos-web-${{ runner.os }}-${{ runner.arch }}-sccache-
+        restore-keys: leptos-web-${{ runner.os }}-${{ runner.arch }}-sccache-
+
+    - name: Install sccache
+      if: ${{ !startsWith(github.ref, 'refs/tags/') }}
+      uses: taiki-e/install-action@v2
+      with:
+        tool: sccache
+
+    - name: Configure sccache
+      if: ${{ !startsWith(github.ref, 'refs/tags/') }}
+      run: |
+        set -euo pipefail
+        SCCACHE_PATH="$(command -v sccache)"
+        SCCACHE_DIR="${GITHUB_WORKSPACE}/.sccache"
+        mkdir -p "$SCCACHE_DIR"
+
+        echo "Cache restore matched key: ${{ steps.restore-sccache.outputs.cache-matched-key }}"
+        du -sh "$SCCACHE_DIR" 2>/dev/null || true
+
+        echo "SCCACHE_DIR=$SCCACHE_DIR" | tee -a "$GITHUB_ENV"
+        echo "SCCACHE_CACHE_SIZE=2G" | tee -a "$GITHUB_ENV"
+        echo "CARGO_INCREMENTAL=0" | tee -a "$GITHUB_ENV"
+        echo "RUSTC_WRAPPER=$SCCACHE_PATH" | tee -a "$GITHUB_ENV"
+
+        SCCACHE_DIR="$SCCACHE_DIR" SCCACHE_CACHE_SIZE=2G "$SCCACHE_PATH" --start-server
+        "$SCCACHE_PATH" --zero-stats || true
+        "$SCCACHE_PATH" --show-stats || true
+
+    - name: Install Trunk
+      uses: taiki-e/install-action@v2
+      with:
+        tool: trunk
+
+    - name: Install wasm-pack
+      uses: taiki-e/install-action@v2
+      with:
+        tool: wasm-pack
+
+    - name: Build Leptos UI
+      run: ./build.sh
+      working-directory: rca-tool/web-leptos
+
+    - name: Prepare deployment directory
+      run: |
+        cd rca-tool/
+        rm -rf _site
+        mkdir -p _site
+        cp -r web-leptos/dist/* _site/
+        cp README.md _site/ || true
+        touch _site/.nojekyll
+        
+    - name: List deployment files
+      run: |
+        echo "Files to be deployed:"
+        ls -lh rca-tool/_site/
+
+    - name: Capture Leptos asset manifest
+      id: asset_manifest
+      run: |
+        set -euo pipefail
+        cd rca-tool/_site
+        leptos_js=$(grep -o 'rca-tool-leptos-[^"]*\.js' index.html | head -n 1)
+        leptos_wasm=$(grep -o 'rca-tool-leptos-[^"]*_bg\.wasm' index.html | head -n 1)
+        leptos_css=$(grep -o 'styles-[^"]*\.css' index.html | head -n 1)
+
+        echo "Leptos JS:   ${leptos_js}"
+        echo "Leptos WASM: ${leptos_wasm}"
+        echo "Leptos CSS:  ${leptos_css}"
+
+        echo "leptos_js=${leptos_js}" >> "$GITHUB_OUTPUT"
+        echo "leptos_wasm=${leptos_wasm}" >> "$GITHUB_OUTPUT"
+        echo "leptos_css=${leptos_css}" >> "$GITHUB_OUTPUT"
+        
+    - name: Setup Pages
+      uses: actions/configure-pages@v4
+      
+    - name: Upload artifact
+      uses: actions/upload-pages-artifact@v3
+      with:
+        path: 'rca-tool/_site'
+
+    - name: Show sccache stats
+      if: ${{ always() && !startsWith(github.ref, 'refs/tags/') }}
+      run: sccache --show-stats || true
+
+    - name: Prepare sccache files for saving
+      id: prepare-save-sccache
+      if: ${{ always() && !startsWith(github.ref, 'refs/tags/') }}
+      run: echo "SCCACHE_TIMESTAMP=$(date -u +%F-%T)" | tee -a "$GITHUB_OUTPUT"
+
+    - name: Save sccache files
+      if: ${{ always() && !startsWith(github.ref, 'refs/tags/') }}
+      uses: actions/cache/save@v5
+      with:
+        key: ${{ steps.restore-sccache.outputs.cache-primary-key }}${{ steps.prepare-save-sccache.outputs.SCCACHE_TIMESTAMP }}
+        path: ${{ github.workspace }}/.sccache
+
+  deploy:
+    if: ${{ startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch' }}
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    needs: build
+    outputs:
+      page_url: ${{ steps.deployment.outputs.page_url }}
+    
+    steps:
+    - name: Deploy to GitHub Pages
+      id: deployment
+      uses: actions/deploy-pages@v4
+
+  post-deploy-test:
+    if: ${{ startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch' }}
+    runs-on: ubuntu-latest
+    needs: [build, deploy]
+    
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v6
+      
+    - name: Setup Node.js
+      uses: actions/setup-node@v5
+      with:
+        node-version: '22'
+        
+    - name: Install dependencies
+      run: npm ci
+      working-directory: rca-tool/tests
+      
+    - name: Generate test fixtures
+      run: |
+        chmod +x create-fixtures.sh
+        ./create-fixtures.sh
+      working-directory: rca-tool/tests
+      
+    - name: Install Playwright Edge
+      run: npx playwright install --with-deps msedge
+      working-directory: rca-tool/tests
+      
+    - name: Wait for deployment to be ready
+      env:
+        DEPLOYED_URL: ${{ needs.deploy.outputs.page_url }}
+        EXPECTED_LEPTOS_JS: ${{ needs.build.outputs.leptos_js }}
+        EXPECTED_LEPTOS_WASM: ${{ needs.build.outputs.leptos_wasm }}
+        EXPECTED_LEPTOS_CSS: ${{ needs.build.outputs.leptos_css }}
+      run: |
+        set -euo pipefail
+        CACHE_BUSTER="${GITHUB_RUN_ID}-${GITHUB_SHA}"
+        ROOT_URL="${DEPLOYED_URL%/}/"
+        ROOT_URL_BUSTED="${ROOT_URL}?cb=${CACHE_BUSTER}"
+        WORKER_URL="${ROOT_URL}assets/liblzma-streaming-worker.js?v=${CACHE_BUSTER}"
+        LEPTOS_JS_URL="${ROOT_URL}${EXPECTED_LEPTOS_JS}?cb=${CACHE_BUSTER}"
+        LEPTOS_WASM_URL="${ROOT_URL}${EXPECTED_LEPTOS_WASM}?cb=${CACHE_BUSTER}"
+        LEPTOS_CSS_URL="${ROOT_URL}${EXPECTED_LEPTOS_CSS}?cb=${CACHE_BUSTER}"
+
+        echo "Waiting for GitHub Pages to serve the freshly built site..."
+        echo "Root URL: ${ROOT_URL}"
+        echo "Expected JS: ${EXPECTED_LEPTOS_JS}"
+        echo "Expected WASM: ${EXPECTED_LEPTOS_WASM}"
+        echo "Expected CSS: ${EXPECTED_LEPTOS_CSS}"
+
+        for attempt in {1..30}; do
+          root_html="$(curl -fsSL "${ROOT_URL_BUSTED}" || true)"
+          worker_source="$(curl -fsSL "${WORKER_URL}" || true)"
+
+          root_ok=0
+          worker_ok=0
+          js_ok=0
+          wasm_ok=0
+          css_ok=0
+
+          if [[ "${root_html}" == *'RCA Tool'* \
+             && "${root_html}" == *"${EXPECTED_LEPTOS_JS}"* \
+             && "${root_html}" == *"${EXPECTED_LEPTOS_WASM}"* \
+             && "${root_html}" == *"${EXPECTED_LEPTOS_CSS}"* ]]; then
+            root_ok=1
+          fi
+          # Check that the bundled worker asset is present and contains expected
+          # sentinel strings: versionedAsset (from worker.js) and parsers/services
+          # (from services.js, bundled into liblzma-streaming-worker.js).
+          if [[ "${worker_source}" == *'versionedAsset'* \
+             && "${worker_source}" == *'parsers/services'* ]]; then
+            worker_ok=1
+          fi
+          if curl -fsI "${LEPTOS_JS_URL}" >/dev/null; then
+            js_ok=1
+          fi
+          if curl -fsI "${LEPTOS_WASM_URL}" >/dev/null; then
+            wasm_ok=1
+          fi
+          if curl -fsI "${LEPTOS_CSS_URL}" >/dev/null; then
+            css_ok=1
+          fi
+
+          echo "Attempt ${attempt}/30: root=${root_ok} worker=${worker_ok} js=${js_ok} wasm=${wasm_ok} css=${css_ok}"
+
+          if [[ ${root_ok} -eq 1 && ${worker_ok} -eq 1 && ${js_ok} -eq 1 && ${wasm_ok} -eq 1 && ${css_ok} -eq 1 ]]; then
+            echo "Deployment is ready."
+            break
+          fi
+
+          if [[ ${attempt} -eq 30 ]]; then
+            echo "Deployment did not become ready in time."
+            echo "--- Root preview ---"
+            printf '%s\n' "${root_html}" | head -n 40 || true
+            echo "--- Worker preview ---"
+            printf '%s\n' "${worker_source}" | sed -n '1,40p' || true
+            exit 1
+          fi
+
+          sleep 10
+        done
+        
+    - name: Run post-deployment tests against Leptos
+      env:
+        DEPLOYED_URL: ${{ needs.deploy.outputs.page_url }}
+        CACHE_BUSTER: ${{ github.run_id }}-${{ github.sha }}
+      run: |
+        echo "Testing deployed Leptos UI at ${DEPLOYED_URL} (cache buster: ${CACHE_BUSTER})"
+        npx playwright test --config=playwright.leptos.config.js --project=deployed-leptos --reporter=list
+      working-directory: rca-tool/tests
+      
+    - name: Upload post-deployment test results
+      if: always()
+      uses: actions/upload-artifact@v7
+      with:
+        name: post-deploy-test-results
+        path: |
+          rca-tool/tests/playwright-report*/
+          rca-tool/tests/test-results/
+        retention-days: 30
+
+    - name: Upload post-deployment coverage report
+      if: always()
+      uses: actions/upload-artifact@v7
+      with:
+        name: post-deploy-coverage-report
+        path: rca-tool/tests/coverage-report*/
+        retention-days: 30
diff --git a/.github/workflows/rust-python-packages.yml b/.github/workflows/rust-python-packages.yml
new file mode 100644
index 0000000..5788de1
--- /dev/null
+++ b/.github/workflows/rust-python-packages.yml
@@ -0,0 +1,565 @@
+name: Rust and Python Package CI
+
+'on':
+  pull_request:
+  push:
+    branches:
+      - main
+      - master
+      - rca-tool
+    tags:
+      - 'v*'
+      - 'rust-parser-v*'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  RUST_CORE_DIR: rca-tool/lib/supportfile_core
+  RUST_MCP_DIR: rca-tool/lib/supportfile_mcp
+  PY_PKG_DIR: rca-tool/lib/supportfile_py
+
+jobs:
+  build-rust-core:
+    name: Build Rust core (${{ matrix.os }}-${{ matrix.arch }})
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: linux
+            arch: amd64
+            runner: ubuntu-24.04
+            rust_target: x86_64-unknown-linux-gnu
+          - os: linux
+            arch: arm64
+            runner: ubuntu-24.04-arm
+            rust_target: aarch64-unknown-linux-gnu
+          - os: macos
+            arch: arm64
+            runner: macos-26
+            rust_target: aarch64-apple-darwin
+          - os: windows
+            arch: amd64
+            runner: windows-latest
+            rust_target: x86_64-pc-windows-msvc
+            bin_ext: '.exe'
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Setup Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.rust_target }}
+
+      - name: Set crate versions from tag
+        if: startsWith(github.ref, 'refs/tags/v')
+        run: .github/scripts/set-crate-version-from-tag.sh
+
+      - name: Cache Rust build artifacts
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: |
+            ${{ env.RUST_CORE_DIR }} -> target
+            ${{ env.RUST_MCP_DIR }} -> target
+            ${{ env.PY_PKG_DIR }} -> target
+
+      # sccache speeds up compilation on regular pushes/PRs. It is skipped on
+      # release tag builds so that published crates/wheels come from clean,
+      # uncached builds.
+      # sccache is configured through a POSIX shell script and is skipped on
+      # Windows runners (which default to PowerShell); Swatinem/rust-cache still
+      # provides cross-platform caching there.
+      - name: Restore sccache files
+        id: restore-sccache
+        if: ${{ !startsWith(github.ref, 'refs/tags/') && matrix.os != 'windows' }}
+        uses: actions/cache/restore@v5
+        with:
+          path: ${{ github.workspace }}/.sccache
+          key: rust-core-${{ runner.os }}-${{ matrix.arch }}-sccache-
+          restore-keys: rust-core-${{ runner.os }}-${{ matrix.arch }}-sccache-
+
+      - name: Install sccache
+        if: ${{ !startsWith(github.ref, 'refs/tags/') && matrix.os != 'windows' }}
+        uses: taiki-e/install-action@v2
+        with:
+          tool: sccache
+
+      - name: Configure sccache
+        if: ${{ !startsWith(github.ref, 'refs/tags/') && matrix.os != 'windows' }}
+        run: |
+          set -euo pipefail
+          SCCACHE_PATH="$(command -v sccache)"
+          SCCACHE_DIR="${GITHUB_WORKSPACE}/.sccache"
+          mkdir -p "$SCCACHE_DIR"
+
+          echo "Cache restore matched key: ${{ steps.restore-sccache.outputs.cache-matched-key }}"
+          echo "Contents of SCCACHE_DIR ($SCCACHE_DIR):"
+          ls -la "$SCCACHE_DIR" || echo "  (empty or missing)"
+          du -sh "$SCCACHE_DIR" 2>/dev/null || true
+
+          echo "SCCACHE_DIR=$SCCACHE_DIR" | tee -a "$GITHUB_ENV"
+          echo "SCCACHE_CACHE_SIZE=2G" | tee -a "$GITHUB_ENV"
+          echo "CARGO_INCREMENTAL=0" | tee -a "$GITHUB_ENV"
+          echo "RUSTC_WRAPPER=$SCCACHE_PATH" | tee -a "$GITHUB_ENV"
+
+          SCCACHE_DIR="$SCCACHE_DIR" SCCACHE_CACHE_SIZE=2G "$SCCACHE_PATH" --start-server
+          "$SCCACHE_PATH" --zero-stats || true
+          "$SCCACHE_PATH" --show-stats || true
+
+      - name: Build Rust crate
+        working-directory: ${{ env.RUST_CORE_DIR }}
+        run: cargo build --locked --release --target "${{ matrix.rust_target }}"
+
+      - name: Build rca_cli binary
+        working-directory: ${{ env.RUST_CORE_DIR }}
+        run: cargo build --locked --release --features cli --bin rca_cli --target "${{ matrix.rust_target }}"
+
+      - name: Test Rust crate
+        working-directory: ${{ env.RUST_CORE_DIR }}
+        run: cargo test --locked --features cli --target "${{ matrix.rust_target }}"
+
+      - name: Verify crate can be packaged
+        if: matrix.os == 'linux'
+        working-directory: ${{ env.RUST_CORE_DIR }}
+        run: cargo package --locked --allow-dirty
+
+      - name: Build MCP server
+        working-directory: ${{ env.RUST_MCP_DIR }}
+        run: cargo build --locked --release --target "${{ matrix.rust_target }}"
+
+      - name: Test MCP server
+        working-directory: ${{ env.RUST_MCP_DIR }}
+        run: cargo test --locked --target "${{ matrix.rust_target }}"
+
+      - name: Verify MCP crate can be packaged
+        if: matrix.os == 'linux'
+        working-directory: ${{ env.RUST_MCP_DIR }}
+        run: cargo package --locked --allow-dirty
+
+      # The `.crate` source packages are platform-independent, so they are only
+      # uploaded from the Linux builds. The compiled binaries below are produced
+      # for every OS/arch in the matrix (Linux + macOS).
+      - name: Upload Rust crate artifact
+        if: matrix.os == 'linux'
+        uses: actions/upload-artifact@v7
+        with:
+          name: rust-crate-${{ matrix.os }}-${{ matrix.arch }}
+          path: ${{ env.RUST_CORE_DIR }}/target/package/*.crate
+          if-no-files-found: error
+          retention-days: 14
+
+      - name: Upload MCP crate artifact
+        if: matrix.os == 'linux'
+        uses: actions/upload-artifact@v7
+        with:
+          name: rust-mcp-crate-${{ matrix.os }}-${{ matrix.arch }}
+          path: ${{ env.RUST_MCP_DIR }}/target/package/*.crate
+          if-no-files-found: error
+          retention-days: 14
+
+      - name: Upload rca_cli binary artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: rca_cli-${{ matrix.os }}-${{ matrix.arch }}
+          path: ${{ env.RUST_CORE_DIR }}/target/${{ matrix.rust_target }}/release/rca_cli${{ matrix.bin_ext }}
+          if-no-files-found: error
+          retention-days: 14
+
+      - name: Upload supportfile_mcp binary artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: supportfile_mcp-${{ matrix.os }}-${{ matrix.arch }}
+          path: ${{ env.RUST_MCP_DIR }}/target/${{ matrix.rust_target }}/release/supportfile_mcp${{ matrix.bin_ext }}
+          if-no-files-found: error
+          retention-days: 14
+
+      - name: Show sccache stats
+        if: ${{ always() && !startsWith(github.ref, 'refs/tags/') && matrix.os != 'windows' }}
+        run: sccache --show-stats || true
+
+      - name: Prepare sccache files for saving
+        id: prepare-save-sccache
+        if: ${{ always() && !startsWith(github.ref, 'refs/tags/') && matrix.os != 'windows' }}
+        run: echo "SCCACHE_TIMESTAMP=$(date -u +%F-%T)" | tee -a "$GITHUB_OUTPUT"
+
+      - name: Save sccache files
+        if: ${{ always() && !startsWith(github.ref, 'refs/tags/') && matrix.os != 'windows' }}
+        uses: actions/cache/save@v5
+        with:
+          key: ${{ steps.restore-sccache.outputs.cache-primary-key }}${{ steps.prepare-save-sccache.outputs.SCCACHE_TIMESTAMP }}
+          path: ${{ github.workspace }}/.sccache
+
+  build-python-wheel:
+    name: Build Python wheel (${{ matrix.os }}-${{ matrix.arch }})
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: linux
+            arch: amd64
+            runner: ubuntu-24.04
+            maturin_target: x86_64
+            rust_target: x86_64-unknown-linux-gnu
+            manylinux: '2014'
+          - os: linux
+            arch: arm64
+            runner: ubuntu-24.04-arm
+            maturin_target: aarch64
+            rust_target: aarch64-unknown-linux-gnu
+            manylinux: '2014'
+          - os: macos
+            arch: arm64
+            runner: macos-26
+            maturin_target: aarch64
+            rust_target: aarch64-apple-darwin
+            manylinux: 'auto'
+          - os: windows
+            arch: amd64
+            runner: windows-latest
+            maturin_target: x64
+            rust_target: x86_64-pc-windows-msvc
+            manylinux: 'auto'
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Setup Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.rust_target }}
+
+      - name: Set crate versions from tag
+        if: startsWith(github.ref, 'refs/tags/v')
+        run: .github/scripts/set-crate-version-from-tag.sh
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.12'
+
+      - name: Cache Rust build artifacts
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: ${{ env.PY_PKG_DIR }} -> target
+
+      # Use PyO3/maturin-action which, for Linux targets, runs maturin inside a
+      # manylinux2014 Docker container. This produces wheels with a
+      # `manylinux_2_17_*` (a.k.a. manylinux2014) platform tag, which PyPI
+      # accepts. Building maturin directly on ubuntu-24.04 produces plain
+      # `linux_*` wheels that PyPI rejects with HTTP 400 "unsupported platform
+      # tag". For macOS targets the `manylinux` input is ignored and maturin
+      # builds native `macosx_*` wheels.
+      - name: Build wheel
+        uses: PyO3/maturin-action@v1
+        with:
+          target: ${{ matrix.maturin_target }}
+          manylinux: ${{ matrix.manylinux }}
+          working-directory: ${{ env.PY_PKG_DIR }}
+          args: --release --out dist --strip
+
+      - name: Upload wheel artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: python-wheels-${{ matrix.os }}-${{ matrix.arch }}
+          path: ${{ env.PY_PKG_DIR }}/dist/*.whl
+          if-no-files-found: error
+          retention-days: 14
+
+  build-vscode-extension:
+    name: Package VS Code extension (${{ matrix.vsce_target }})
+    needs:
+      - build-rust-core
+    runs-on: ubuntu-latest
+    env:
+      EXT_DIR: rca-tool/vscode-extension
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Map each VS Code platform target to the binary artifacts produced by
+          # build-rust-core (named rca_cli-<os>-<arch> / supportfile_mcp-<os>-<arch>).
+          - vsce_target: linux-x64
+            artifact_suffix: linux-amd64
+            bin_ext: ''
+          - vsce_target: linux-arm64
+            artifact_suffix: linux-arm64
+            bin_ext: ''
+          - vsce_target: darwin-arm64
+            artifact_suffix: macos-arm64
+            bin_ext: ''
+          - vsce_target: win32-x64
+            artifact_suffix: windows-amd64
+            bin_ext: '.exe'
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: '24'
+
+      # When triggered by a `v<semver>` tag, override the manifest version so
+      # the packaged VSIX matches the release tag instead of the committed
+      # placeholder version. vsce reads the version from package.json at
+      # package time, so this must run before `vsce package`.
+      - name: Set extension version from tag
+        if: startsWith(github.ref, 'refs/tags/v')
+        working-directory: ${{ env.EXT_DIR }}
+        run: |
+          set -euo pipefail
+          version="${GITHUB_REF_NAME#v}"
+          echo "Setting extension version to $version (from tag $GITHUB_REF_NAME)"
+          npm version "$version" --no-git-tag-version --allow-same-version
+
+      - name: Download rca_cli binary
+        uses: actions/download-artifact@v8
+        with:
+          name: rca_cli-${{ matrix.artifact_suffix }}
+          path: dl-rca
+
+      - name: Download supportfile_mcp binary
+        uses: actions/download-artifact@v8
+        with:
+          name: supportfile_mcp-${{ matrix.artifact_suffix }}
+          path: dl-mcp
+
+      # Place the platform binaries where the extension expects them (bin/).
+      # The extension restores the Unix executable bit at runtime, so the bit
+      # not surviving the VSIX is fine.
+      - name: Stage platform binaries
+        run: |
+          set -euo pipefail
+          mkdir -p "$EXT_DIR/bin"
+          cp "dl-rca/rca_cli${{ matrix.bin_ext }}" "$EXT_DIR/bin/rca_cli${{ matrix.bin_ext }}"
+          cp "dl-mcp/supportfile_mcp${{ matrix.bin_ext }}" "$EXT_DIR/bin/supportfile_mcp${{ matrix.bin_ext }}"
+          ls -la "$EXT_DIR/bin"
+
+      - name: Install extension dependencies
+        working-directory: ${{ env.EXT_DIR }}
+        run: npm install --no-audit --no-fund
+
+      - name: Type-check and bundle
+        working-directory: ${{ env.EXT_DIR }}
+        run: |
+          npm run lint
+          npm run package
+
+      - name: Package VSIX
+        working-directory: ${{ env.EXT_DIR }}
+        run: |
+          npx --yes @vscode/vsce package \
+            --target ${{ matrix.vsce_target }} \
+            --no-dependencies \
+            --out "rca-tool-${{ matrix.vsce_target }}.vsix"
+
+      - name: Upload VSIX artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: vscode-extension-${{ matrix.vsce_target }}
+          path: ${{ env.EXT_DIR }}/rca-tool-${{ matrix.vsce_target }}.vsix
+          if-no-files-found: error
+          retention-days: 14
+
+  # Publishing to external registries.
+  # Wheels and crates are also uploaded as GitHub artifacts (see build-* jobs
+  # above) for verification.
+
+  publish-cargo:
+    name: Publish Rust crate to crates.io
+    # Only publish on `v<semver>` tags. The version-rewrite step below is gated
+    # on the same condition, so a broader `refs/tags/` gate would publish the
+    # committed placeholder version (0.0.0) for non-`v` tags (e.g. rust-parser-v*).
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs:
+      - build-rust-core
+      - build-python-wheel
+    runs-on: ubuntu-24.04
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Setup Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Set crate versions from tag
+        if: startsWith(github.ref, 'refs/tags/v')
+        run: .github/scripts/set-crate-version-from-tag.sh
+
+      - name: Publish crate
+        working-directory: ${{ env.RUST_CORE_DIR }}
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+        run: cargo publish --locked --allow-dirty --token "$CARGO_REGISTRY_TOKEN"
+
+      - name: Publish MCP crate
+        working-directory: ${{ env.RUST_MCP_DIR }}
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+        run: cargo publish --locked --allow-dirty --token "$CARGO_REGISTRY_TOKEN"
+
+  publish-pypi:
+    name: Publish Python wheels to PyPI
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs:
+      - build-python-wheel
+    runs-on: ubuntu-24.04
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Download wheel artifacts
+        uses: actions/download-artifact@v8
+        with:
+          pattern: python-wheels-*
+          path: dist
+          merge-multiple: true
+
+      - name: Publish wheels
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist
+          skip-existing: true
+
+  publish-release:
+    name: Attach binaries to GitHub Release
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs:
+      - build-rust-core
+      - build-python-wheel
+      - build-vscode-extension
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+
+    steps:
+      # Each binary was uploaded as its own artifact (rca_cli-<os>-<arch> and
+      # supportfile_mcp-<os>-<arch>), each containing a single binary named
+      # `rca_cli`/`rca_cli.exe` (or `supportfile_mcp`/`supportfile_mcp.exe`).
+      # Download them into per-artifact subdirectories so the platform-specific
+      # names are preserved.
+      - name: Download binary artifacts
+        uses: actions/download-artifact@v8
+        with:
+          pattern: '{rca_cli,supportfile_mcp}-*'
+          path: artifacts
+
+      # Wheels and source crates already carry unique, version-bearing file
+      # names, so they can be merged into single flat directories.
+      - name: Download wheel artifacts
+        uses: actions/download-artifact@v8
+        with:
+          pattern: python-wheels-*
+          path: wheels
+          merge-multiple: true
+
+      - name: Download crate artifacts
+        uses: actions/download-artifact@v8
+        with:
+          pattern: '{rust-crate,rust-mcp-crate}-*'
+          path: crates
+          merge-multiple: true
+
+      # VSIX packages already carry the platform target in their file name.
+      - name: Download VSIX artifacts
+        uses: actions/download-artifact@v8
+        with:
+          pattern: vscode-extension-*
+          path: vsix
+          merge-multiple: true
+
+      # Flatten into release-assets/ using the artifact name (which encodes
+      # os+arch) as the asset name for binaries, appending `.exe` for Windows
+      # binaries. Wheels (*.whl), source crates (*.crate), and VSIX packages
+      # (*.vsix) are copied as-is.
+      - name: Stage release assets
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          mkdir -p release-assets
+          for dir in artifacts/*/; do
+            name="$(basename "$dir")"
+            for f in "$dir"*; do
+              case "$(basename "$f")" in
+                *.exe) ext='.exe' ;;
+                *) ext='' ;;
+              esac
+              cp "$f" "release-assets/${name}${ext}"
+            done
+          done
+          for f in wheels/*.whl crates/*.crate vsix/*.vsix; do
+            cp "$f" "release-assets/$(basename "$f")"
+          done
+          echo "Release assets:"
+          ls -la release-assets
+
+      - name: Attach binaries to release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: release-assets/*
+          fail_on_unmatched_files: true
+
+  publish-vsce:
+    name: Publish VS Code extension
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs:
+      - build-vscode-extension
+    runs-on: ubuntu-latest
+    # Secrets are mapped to env so step-level `if` conditions can detect whether
+    # they are configured. When a secret is absent it resolves to an empty
+    # string, the matching publish step is skipped, and the job still succeeds.
+    env:
+      VSCE_PAT: ${{ secrets.VSCE_PAT }}
+      OVSX_PAT: ${{ secrets.OVSX_PAT }}
+
+    steps:
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: '24'
+
+      - name: Download VSIX artifacts
+        uses: actions/download-artifact@v8
+        with:
+          pattern: vscode-extension-*
+          path: vsix
+          merge-multiple: true
+
+      - name: List VSIX packages
+        run: ls -la vsix
+
+      - name: Publish to VS Code Marketplace
+        if: env.VSCE_PAT != ''
+        run: |
+          set -euo pipefail
+          # Sanity-check the secret without leaking it: report length only.
+          # A mismatch here (e.g. trailing newline/whitespace from a bad paste)
+          # is the most common cause of a 401 when the PAT itself is valid.
+          echo "VSCE_PAT length: ${#VSCE_PAT}"
+          # vsce can publish all platform-specific packages in one invocation.
+          # Pass the token explicitly with -p rather than relying on env pickup.
+          npx --yes @vscode/vsce publish --no-dependencies -p "$VSCE_PAT" $(printf -- '--packagePath %s ' vsix/*.vsix)
+
+      - name: Skip VS Code Marketplace (no VSCE_PAT)
+        if: env.VSCE_PAT == ''
+        run: echo "VSCE_PAT secret not set — skipping VS Code Marketplace publish."
+
+      - name: Publish to Open VSX
+        if: env.OVSX_PAT != ''
+        run: |
+          set -euo pipefail
+          for vsix in vsix/*.vsix; do
+            npx --yes ovsx publish "$vsix" --pat "$OVSX_PAT"
+          done
+
+      - name: Skip Open VSX (no OVSX_PAT)
+        if: env.OVSX_PAT == ''
+        run: echo "OVSX_PAT secret not set — skipping Open VSX publish."
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..08eb1d1
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,208 @@
+name: Run Tests
+
+on:
+  pull_request:
+  workflow_dispatch:
+  workflow_call:
+
+jobs:
+  test:
+    name: Tests (${{ matrix.os }})
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: linux
+            runner: ubuntu-latest
+          - os: macos
+            runner: macos-26
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v6
+      
+    - name: Setup Node.js
+      uses: actions/setup-node@v5
+      with:
+        node-version: '22'
+
+    - name: Setup Rust toolchain
+      uses: dtolnay/rust-toolchain@stable
+      with:
+        targets: wasm32-unknown-unknown
+
+    - name: Cache Rust build artifacts
+      uses: Swatinem/rust-cache@v2
+      with:
+        workspaces: |
+          rca-tool/web-leptos -> target
+          rca-tool/lib/lzma_stream_wasm -> target
+          rca-tool/lib/supportfile_core -> target
+          rca-tool/lib/supportfile_mcp -> target
+
+    # sccache speeds up compilation on regular pushes/PRs. It is skipped on
+    # release tag builds.
+    - name: Restore sccache files
+      id: restore-sccache
+      if: ${{ !startsWith(github.ref, 'refs/tags/') }}
+      uses: actions/cache/restore@v5
+      with:
+        path: ${{ github.workspace }}/.sccache
+        key: tests-${{ runner.os }}-${{ runner.arch }}-sccache-
+        restore-keys: tests-${{ runner.os }}-${{ runner.arch }}-sccache-
+
+    - name: Install sccache
+      if: ${{ !startsWith(github.ref, 'refs/tags/') }}
+      uses: taiki-e/install-action@v2
+      with:
+        tool: sccache
+
+    - name: Configure sccache
+      if: ${{ !startsWith(github.ref, 'refs/tags/') }}
+      run: |
+        set -euo pipefail
+        SCCACHE_PATH="$(command -v sccache)"
+        SCCACHE_DIR="${GITHUB_WORKSPACE}/.sccache"
+        mkdir -p "$SCCACHE_DIR"
+
+        echo "Cache restore matched key: ${{ steps.restore-sccache.outputs.cache-matched-key }}"
+        du -sh "$SCCACHE_DIR" 2>/dev/null || true
+
+        echo "SCCACHE_DIR=$SCCACHE_DIR" | tee -a "$GITHUB_ENV"
+        echo "SCCACHE_CACHE_SIZE=2G" | tee -a "$GITHUB_ENV"
+        echo "CARGO_INCREMENTAL=0" | tee -a "$GITHUB_ENV"
+        echo "RUSTC_WRAPPER=$SCCACHE_PATH" | tee -a "$GITHUB_ENV"
+
+        SCCACHE_DIR="$SCCACHE_DIR" SCCACHE_CACHE_SIZE=2G "$SCCACHE_PATH" --start-server
+        "$SCCACHE_PATH" --zero-stats || true
+        "$SCCACHE_PATH" --show-stats || true
+
+    - name: Install Trunk
+      uses: taiki-e/install-action@v2
+      with:
+        tool: trunk
+
+    - name: Install wasm-pack
+      uses: taiki-e/install-action@v2
+      with:
+        tool: wasm-pack
+
+    - name: Install cargo-llvm-cov
+      uses: taiki-e/install-action@v2
+      with:
+        tool: cargo-llvm-cov
+
+    - name: Build Rust CLI
+      run: cargo build --locked --release --features cli --bin rca_cli
+      working-directory: rca-tool/lib/supportfile_core
+
+    - name: Build MCP server
+      run: cargo build --locked --release
+      working-directory: rca-tool/lib/supportfile_mcp
+        
+    - name: Build Leptos UI
+      run: ./build.sh
+      working-directory: rca-tool/web-leptos
+
+    - name: Install test dependencies
+      run: npm ci
+      working-directory: rca-tool/tests
+
+    - name: Building fixtures
+      run: |
+        chmod +x create-fixtures.sh
+        ./create-fixtures.sh
+      working-directory: rca-tool/tests
+ 
+    - name: Install Playwright Edge (Linux)
+      if: matrix.os == 'linux'
+      run: npx playwright install --with-deps msedge
+      working-directory: rca-tool/tests
+
+    # macOS runners can't install browser system dependencies via apt, so
+    # `--with-deps` is omitted; Edge itself is downloaded the same way.
+    - name: Install Playwright Edge (macOS)
+      if: matrix.os == 'macos'
+      run: npx playwright install msedge
+      working-directory: rca-tool/tests
+
+    - name: Generate Rust library coverage
+      run: bash instrument-coverage.sh
+      working-directory: rca-tool/tests
+      
+    - name: Run Leptos web tests
+      run: npx playwright test --config=playwright.leptos.config.js --project=local-leptos
+      working-directory: rca-tool/tests
+      
+    - name: Run accessibility checks against Leptos
+      run: |
+        npx http-server ../web-leptos/dist -p 8080 -c-1 > /tmp/rca-tool-http-server.log 2>&1 &
+        ACCESSIBILITY_URL=http://localhost:8080/ node accessibility-check.js
+      working-directory: rca-tool/tests
+    
+    - name: Test Rust CLI with all fixtures
+      run: |
+        # Test Rust CLI with all fixture files (excluding intentionally corrupted ones)
+        failed=0
+        total=0
+        rust_cli="../lib/supportfile_core/target/release/rca_cli"
+        if [[ ! -x "${rust_cli}" ]]; then
+          echo "Rust CLI binary not found: ${rust_cli}"
+          exit 1
+        fi
+        for fixture in fixtures/*.tar.xz; do
+          # Skip intentionally corrupted test files
+          if [[ "$fixture" == *"corrupted"* ]]; then
+            echo "Skipping: $fixture (intentionally corrupted)"
+            continue
+          fi
+          total=$((total + 1))
+          echo "Testing: $fixture"
+          if "${rust_cli}" "$fixture" > /dev/null 2>&1; then
+            echo "  [OK] $fixture"
+          else
+            echo "  [FAIL] $fixture"
+            failed=$((failed + 1))
+          fi
+        done
+        echo ""
+        echo "Rust CLI tests completed: $((total - failed))/$total passed"
+        if [ $failed -gt 0 ]; then
+          exit 1
+        fi
+      working-directory: rca-tool/tests
+      
+    - name: Upload test results
+      if: always()
+      uses: actions/upload-artifact@v7
+      with:
+        name: test-results-${{ matrix.os }}
+        path: |
+          rca-tool/tests/playwright-report*/
+          rca-tool/tests/test-results/
+        retention-days: 30
+
+    - name: Upload coverage report
+      if: always()
+      uses: actions/upload-artifact@v7
+      with:
+        name: coverage-report-${{ matrix.os }}
+        path: rca-tool/tests/coverage-report*/
+        retention-days: 30
+
+    - name: Show sccache stats
+      if: ${{ always() && !startsWith(github.ref, 'refs/tags/') }}
+      run: sccache --show-stats || true
+
+    - name: Prepare sccache files for saving
+      id: prepare-save-sccache
+      if: ${{ always() && !startsWith(github.ref, 'refs/tags/') }}
+      run: echo "SCCACHE_TIMESTAMP=$(date -u +%F-%T)" | tee -a "$GITHUB_OUTPUT"
+
+    - name: Save sccache files
+      if: ${{ always() && !startsWith(github.ref, 'refs/tags/') }}
+      uses: actions/cache/save@v5
+      with:
+        key: ${{ steps.restore-sccache.outputs.cache-primary-key }}${{ steps.prepare-save-sccache.outputs.SCCACHE_TIMESTAMP }}
+        path: ${{ github.workspace }}/.sccache
diff --git a/.gitignore b/.gitignore
index e81a679..c18363c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,14 @@
 *.dll
 *.exe
 *.pyc
+*.swp
+
+# rca-tool
+test-results/
+playwright-report/
+rca-tool/tests/fixtures/
+rca-tool/tmp/
+node_modules/
+build-streaming/
+dist-streaming/
+xz-*/
diff --git a/rca-tool/DEVELOPER.md b/rca-tool/DEVELOPER.md
new file mode 100644
index 0000000..0ddc419
--- /dev/null
+++ b/rca-tool/DEVELOPER.md
@@ -0,0 +1,512 @@
+# Developer documentation
+
+How to build and contribute to rca-tool.
+
+## Functionality
+
+Currently, the tool manages:
+
+|Function|Description|Mature code?|crm/hb|scc|sos|console /messages / syslog / plain text files|inspect|
+|--------|-----------|------|------|---|---|-----------|-------|
+|Azure vm size|Extract Azure VM Size, from wireserver metadata|🗸|n.a.|🗸|🗸|||
+|Azure BYOS/PAYG|Licensing source for Azure, from wireserver metadata.|𐄂|n.a.|🗸|🗸|||
+|Distro detection|It finds distribution mayor and minor version from OS files or wireserver metadata|🗸|🗸|🗸|🗸||🗸|
+|Cluster node detection and validation|Detects if a node name is declared in both cluster config and hosts file|🗸|🗸|🗸|🗸||🗸|
+|Corosync configuration and validation|Azure best practices are compared. Needs improvement for non-Suse|𐄂|🗸|🗸|🗸||🗸|
+|Cluster resource extraction|List resources, active node for each. Adding constains would be useful.|🗸|🗸|🗸|🗸|||
+|Corosync runtime status|Details which nodes are active, which is localhost|🗸|🗸|🗸|🗸|||
+|Fencing detection|Azure fencing or SDB. Needs warning if two are active at the same time.|🗸|🗸|🗸|🗸|||
+|Cluster events|Migrations are detected and listed|🗸|🗸|🗸|🗸||🗸|
+|Live migration|Azure Live Migrations are detected and listed|🗸|🗸|🗸|🗸|🗸|🗸|
+|Kernel reboot events|Shutdown, reboots and kernel starts are listed. Shows kernel version when boots|🗸|🗸|🗸|🗸|🗸|🗸|
+|Out of memory/oomk events|If the system cannot allocate memory for processes or has out of memory events, they are detected and listed.|🗸|n.a.|🗸|🗸|🗸|🗸|
+|Cluster packages|Validation of packages install in specific version ranges. Needs improvement for non-Suse.|||||||
+|AV Detection|MS Defender, Cloudstrike Falcon, Illumio, Trend Micro, Guardicore|🗸|n.a.|🗸|🗸|||
+|DLM Service Detection|Detects if DLM (Distributed Lock Manager) service is enabled and alerts|🗸|n.a.|🗸|🗸|||
+|Kernel parameters and validation|It grabs kernel parameters (sysctl) and displays them raw. If SAP Hana is found, it also validates best practices.|🗸|||🗸|||
+|Huge Pages Detection|Detects static huge pages and Transparent Huge Pages (THP) configuration. Shows warnings for unused pages and recommendations for SAP HANA.|🗸|n.a.|🗸|🗸|||
+|Raw fstab|It grab the raw fstab.|🗸|n.a.|🗸|🗸||🗸|
+|Azure Site Recovery|It detects if the involflt_start service is enabled.|🗸|n.a.|🗸||||
+|XFS corruption|If we see a message about xfs corruption, it is listed as an event.|🗸||🗸|🗸||🗸|
+|XFS duplicate UUID|If the is a kernel message about a duplicate UUID XFS mount, it is listed as an event.|🗸||🗸|🗸|🗸|🗸|
+|Emergency mode|Detects when system entered emergency mode from log messages|🗸|n.a.|🗸|🗸||🗸|
+|NVME Detection|If NVME disks are found, they are listed.|🗸|n.a.||🗸|||
+|Network Kernel Parameters|Recommended and optional kernel parameters for network are verified on the collected sysctl.|🗸|n.a.|🗸|🗸|||
+|Raw list of distro packages|Shows a raw list of packages from dpkg -l, dnf list, yum list and rpm.txt|🗸|n.a.|🗸|🗸|||
+|Azure Storage Type Detection|Standard SSD, Premium SSDv2, Ultradisk, etc.|🗸|n.a.|n.a.|🗸|||
+|SSH error detection|Failed to start and permission errors|𐄂|n.a.|🗸|🗸|🗸||
+|Network Interfaces|Detects interfaces, DHCP/static, drivers, accelerated networking from ifcfg/netplan files|🗸|n.a.|🗸|🗸||🗸|
+|Firewall Rules|Detects firewall technology (firewalld, nftables, iptables) and configuration|🗸|n.a.|🗸|🗸||🗸|
+|InspectIaaSDisk results|Parses disk inspection diagnostics: request info, filesystem status, OS metadata, mount points, and mount failures with warnings|🗸|n.a.|n.a.|n.a.|n.a.|🗸|
+|Azure Linux Agent config|Parses /etc/waagent.conf: extensions, firewall, swap, FIPS, auto-update, SCSI timeout. Flags risky settings.|🗸|n.a.|🗸|🗸||🗸|
+|(WIP)||𐄂|n.a.|🗸|🗸|||
+
+
+Note: "n.a." in this table, means that some data is not present on all type of debug files.
+
+## Architecture overview
+
+The detectors live in the **Rust crate `supportfile`** (`rca-tool/lib/supportfile_core`).
+Two thin bindings expose the same functions to other ecosystems:
+
+- **`supportfile-wasm`** — `wasm-bindgen` build consumed by the Leptos web UI
+  (`rca-tool/web-leptos`) and by the legacy JS worker.
+- **`supportfile_py`** — PyO3 / maturin build published to PyPI as
+  [`supportfile`](https://pypi.org/project/supportfile/).
+
+Both bindings re-export the same `parse_*_json` functions, so a detector
+written once in Rust is automatically available from Python, JavaScript, and
+the browser.
+
+## Using the published Rust crate
+
+The Rust crate is published to crates.io as
+[`supportfile`](https://crates.io/crates/supportfile).
+
+```toml
+# Cargo.toml
+[dependencies]
+supportfile = "0.1"
+```
+
+Minimal example — pass a tiny string straight to a detector and inspect the
+typed result:
+
+```rust
+use supportfile::parse_secure_boot;
+
+fn main() {
+    // Positive detection: SecureBoot is present and disabled.
+    let r = parse_secure_boot("SecureBoot disabled\n", "");
+    assert!(r.found);
+    assert_eq!(r.enabled, Some(false));
+    assert!(r.supported);
+    println!("{:?}", r);
+    // SecureBootResult { found: true, enabled: Some(false),
+    //                    supported: true, state_text: "SecureBoot disabled",
+    //                    source_path: "", source_line: Some(1) }
+}
+```
+
+Every detector also has a `parse_<name>_json` variant that returns a JSON
+string — that is the form the WASM and Python bindings call.
+
+## Using the published Python package
+
+```bash
+python3 -m venv .venv
+. .venv/bin/activate
+pip install supportfile
+```
+
+Minimal example — pass a tiny string and parse the returned JSON:
+
+```python
+import json
+import supportfile
+
+result = json.loads(supportfile.parse_secure_boot("SecureBoot disabled\n", ""))
+assert result["found"] is True
+assert result["enabled"] is False        # positive detection
+assert result["supported"] is True
+print(result)
+# {'found': True, 'enabled': False, 'supported': True,
+#  'state_text': 'SecureBoot disabled', 'source_path': '', 'source_line': 1}
+```
+
+## Command-line tools
+
+Both bindings ship an example CLI that walks an SCC / sosreport archive
+(`.tar`, `.tar.gz`, `.tar.xz`) and runs every registered parser.
+
+### Rust CLI (`rca_cli`)
+
+`rca_cli` is built as a binary under the `cli` feature of `supportfile`:
+
+```bash
+cd rca-tool/lib/supportfile_core
+
+# Human-readable summary
+cargo run --release --features cli --bin rca_cli -- \
+    ../../tests/fixtures/scc_test-secureboot-disabled.tar.xz
+
+# Raw JSON (one object per parser)
+cargo run --release --features cli --bin rca_cli -- \
+    ../../tests/fixtures/scc_test-secureboot-disabled.tar.xz --json
+
+# List every parser that ships with the binary
+cargo run --release --features cli --bin rca_cli -- --list-parsers
+```
+
+### Python CLI (`examples/rca_cli.py`)
+
+After `pip install supportfile`, run the Python mirror of the same CLI:
+
+```bash
+cd rca-tool/lib/supportfile_py
+
+python examples/rca_cli.py tests/fixtures/scc_test-secureboot-disabled.tar.xz
+python examples/rca_cli.py tests/fixtures/scc_test-secureboot-disabled.tar.xz --json
+python examples/rca_cli.py --list-parsers
+
+# Run a single parser
+python examples/rca_cli.py archive.tar.xz --parser secureBoot
+```
+
+## MCP server (`supportfile_mcp`)
+
+`supportfile_mcp` (`rca-tool/lib/supportfile_mcp`) is a
+[Model Context Protocol](https://modelcontextprotocol.io) server that exposes
+the analyzer as MCP **tools**, so AI agents (GitHub Copilot custom agents /
+Agency, Claude Desktop, or any MCP client) can triage support archives without
+shelling out by hand.
+
+It is a thin adapter: it runs the compiled `rca_cli` binary under the hood and
+reshapes its JSON for agent consumption. Because it reuses `rca_cli`, the
+archive walk, parallel parser dispatch, and multi-file merge are exactly the
+same as the CLI — there is no second copy of the analysis logic.
+
+It speaks MCP over **stdio** (newline-delimited JSON-RPC 2.0 on
+stdin/stdout). The process stays alive until its stdin is closed.
+
+### Install
+
+Install both binaries with `cargo install`; they land in `~/.cargo/bin`, which
+is normally on your `PATH`.
+
+From crates.io:
+
+```bash
+# The CLI the server shells out to. The `cli` feature pulls in the
+# archive/parallelism stack and builds the `rca_cli` binary.
+cargo install supportfile --features cli
+
+# The MCP server itself.
+cargo install supportfile_mcp
+```
+
+From a local checkout (handy while developing):
+
+```bash
+cargo install --path rca-tool/lib/supportfile_core --features cli
+cargo install --path rca-tool/lib/supportfile_mcp
+```
+
+Both binaries (`rca_cli` and `supportfile_mcp`) end up in `~/.cargo/bin`, so the
+server finds `rca_cli` automatically — no extra configuration needed.
+
+### Binary resolution (`RCA_CLI_BIN`)
+
+The server locates `rca_cli` via the `RCA_CLI_BIN` environment variable, and
+falls back to `rca_cli` on `PATH`. After `cargo install` (above) `rca_cli` is
+already on `PATH`, so you can just run:
+
+```bash
+supportfile_mcp
+```
+
+Set `RCA_CLI_BIN` only when `rca_cli` lives somewhere off `PATH` — for example a
+`target/release` directory from a plain `cargo build`:
+
+```bash
+export RCA_CLI_BIN=/abs/path/to/rca-tool/lib/supportfile_core/target/release/rca_cli
+supportfile_mcp
+```
+
+If `rca_cli` cannot be spawned, every tool call returns an MCP error telling you
+to set `RCA_CLI_BIN`.
+
+### Tools exposed
+
+| Tool | Parameters | Maps to | Returns |
+|------|-----------|---------|---------|
+| `list_parsers` | _(none)_ | `rca_cli --list-parsers` | JSON array of `{ "name", "pattern" }` — every detector and the file-path regex it runs on |
+| `analyze_archive` | `archive_path` (string, required), `parser` (string, optional) | `rca_cli <path> --json [--parser NAME]` | The full merged JSON findings (`fileCount`, `matchedFiles`, `fileTypes`, plus one key per parser) |
+| `summarize_findings` | `archive_path` (string, required) | `rca_cli <path> --json` (filtered) | Compact JSON: `{ "fileCount", "matchedFiles", "firedCount", "findings" }`, where `findings` holds **only the detectors that fired** (`found=true` or `count>0`) |
+
+`archive_path` accepts the same inputs as the CLI: a `.tar`, `.tar.gz`,
+`.tar.xz`, or `.zip` archive, or a bare plaintext log file.
+
+`summarize_findings` is the recommended starting point for an agent: it strips
+out detectors that found nothing, so the result is small enough to ground a
+model without flooding it with empty sections. Use `analyze_archive` (optionally
+with `parser`) to drill into a specific detector once you know what fired.
+
+### Driving it manually over stdio
+
+The server is a normal MCP stdio server, so you can exercise it by piping
+JSON-RPC frames to its stdin (one JSON object per line). The sequence below
+initializes the session, lists the tools, and summarizes an archive:
+
+```bash
+cd rca-tool   # so the fixture path below resolves
+
+{
+  printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"manual","version":"0"}}}'
+  printf '%s\n' '{"jsonrpc":"2.0","method":"notifications/initialized"}'
+  printf '%s\n' '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'
+  printf '%s\n' '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"summarize_findings","arguments":{"archive_path":"tests/fixtures/scc_test-automation.tar.xz"}}}'
+} | supportfile_mcp
+```
+
+Each request line produces one JSON-RPC response line on stdout. Calling a tool
+uses `tools/call` with `params.name` set to the tool and `params.arguments`
+holding its parameters, e.g. to run a single parser:
+
+```json
+{"jsonrpc":"2.0","id":4,"method":"tools/call","params":{"name":"analyze_archive","arguments":{"archive_path":"archive.tar.xz","parser":"sshServiceIssues"}}}
+```
+
+> The `rca_cli` binary writes its `Analyzing: <file>` progress line to **stderr**,
+> so the JSON on stdout that the server parses stays clean.
+
+### Using it from a GitHub Copilot / Agency custom agent
+
+Custom agents declare MCP servers in their Markdown front matter. A ready-to-use
+sample lives at [`.github/agents/rca-triage.md`](../.github/agents/rca-triage.md);
+its front matter wires up this server:
+
+```yaml
+---
+name: rca-triage
+description: Triages Linux support archives (sosreport / supportconfig) for Azure VMs using the rca-tool analyzer.
+mcp-servers:
+  rca-tool:
+    type: local
+    command: supportfile_mcp   # must be on PATH, or use an absolute path
+    args: []
+    tools: ["*"]               # expose all three tools
+---
+```
+
+For the agent to launch the server, install both binaries with `cargo install`
+(see [Install](#install) above) so `supportfile_mcp` and `rca_cli` land on
+`PATH`; otherwise replace `command` with the absolute path to the binary and set
+`RCA_CLI_BIN`. Once configured, the agent can call `list_parsers`,
+`summarize_findings`, and `analyze_archive` directly during a conversation.
+
+### Using it from VS Code
+
+VS Code (1.102+) has native MCP support for Copilot **agent mode**. You
+register the server in an `mcp.json` file; VS Code launches it on demand and
+exposes its three tools to the model.
+
+First install both binaries (see [Install](#install) above):
+
+```bash
+cargo install supportfile --features cli
+cargo install supportfile_mcp
+```
+
+**Workspace scope** (committed, shared with the repo) — create
+`.vscode/mcp.json`. Because `cargo install` puts both binaries on `PATH`, the
+command is just the binary name and no `env` is needed:
+
+```jsonc
+{
+  "servers": {
+    "rca-tool": {
+      "type": "stdio",
+      "command": "supportfile_mcp"
+    }
+  }
+}
+```
+
+**User scope** (available in every workspace) — run **MCP: Open User
+Configuration** from the Command Palette and use the same shape:
+
+```jsonc
+{
+  "servers": {
+    "rca-tool": {
+      "type": "stdio",
+      "command": "supportfile_mcp"
+    }
+  }
+}
+```
+
+`type: "stdio"` matches how the server communicates (newline-delimited
+JSON-RPC on stdin/stdout). If `~/.cargo/bin` is not on the `PATH` that VS Code
+sees, set `"command"` to the absolute path (`~/.cargo/bin/supportfile_mcp`) and
+add an `"env"` block with `RCA_CLI_BIN` pointing at `~/.cargo/bin/rca_cli`.
+
+To start and use it:
+
+1. Open `.vscode/mcp.json`. VS Code shows a **Start** CodeLens above the server
+   entry — click it (or run **MCP: List Servers** and start it there).
+2. Open the Chat view and switch to **Agent** mode.
+3. Click the **Tools** icon; `list_parsers`, `analyze_archive`, and
+   `summarize_findings` appear under `rca-tool`.
+4. Prompt it, for example:
+   > Summarize the findings in `rca-tool/tests/fixtures/scc_test-automation.tar.xz`
+
+   The model calls `summarize_findings` first, then drills in with
+   `analyze_archive` as needed.
+
+To point the server at an `rca_cli` that is not on `PATH` (e.g. a
+`target/release` build), set `RCA_CLI_BIN` via an `env` block, optionally
+prompting for the path with an input:
+
+```jsonc
+{
+  "inputs": [
+    {
+      "id": "rca_cli_path",
+      "type": "promptString",
+      "description": "Path to the rca_cli binary"
+    }
+  ],
+  "servers": {
+    "rca-tool": {
+      "type": "stdio",
+      "command": "supportfile_mcp",
+      "env": { "RCA_CLI_BIN": "${input:rca_cli_path}" }
+    }
+  }
+}
+```
+
+As with the manual stdio run, the server's `Analyzing: <file>` line goes to
+stderr, so it never corrupts the JSON-RPC stream VS Code reads on stdout.
+
+## Building and running the web interface
+
+The browser UI is a client-side Leptos / WebAssembly app under
+`rca-tool/web-leptos`.
+
+Prerequisites:
+
+```bash
+rustup target add wasm32-unknown-unknown
+cargo install trunk wasm-pack
+```
+
+Production build (also copies the JS worker and liblzma WASM assets):
+
+```bash
+cd rca-tool/web-leptos
+./build.sh
+# Output: dist/
+```
+
+Local development server with hot reload:
+
+```bash
+cd rca-tool/web-leptos
+./build.sh            # one-time, to populate assets/
+trunk serve --open    # http://localhost:8090
+```
+
+If you have already built the JS assets and only want to iterate on Rust
+code, you can skip the heavy liblzma rebuild:
+
+```bash
+SKIP_LZMA_WASM_BUILD=1 ./build.sh
+```
+
+## Browser Compatibility
+
+This project uses modern web APIs and requires a recent browser with:
+- WebAssembly support
+- File API support
+- Drag and Drop API support
+
+Currently all testing is done with MS Edge via Playwright.
+
+## Adding rules
+
+New detectors are added Rust-first in
+`rca-tool/lib/supportfile_core/src/parsers/`. The
+[SecureBoot detector](lib/supportfile_core/src/parsers/azure.rs) is a good
+small reference.
+
+Steps:
+
+1. Add a `XxxResult` struct (`#[derive(Debug, Clone, Serialize)]`) and a
+   `parse_xxx(content: &str, source_path: &str) -> XxxResult` function in the
+   appropriate `parsers/*.rs` file. Add unit tests next to it.
+2. Add a `parse_xxx_json(content: &str, source_path: &str) -> String` wrapper
+   and re-export both from `lib.rs`.
+3. Expose to JS / WASM in
+   [`lib/supportfile_wasm/src/lib.rs`](lib/supportfile_wasm/src/lib.rs) with
+   `#[wasm_bindgen(js_name = parseXxx)]`.
+4. Expose to Python in
+   [`lib/supportfile_py/src/lib.rs`](lib/supportfile_py/src/lib.rs) via
+   `wrap_pyfunction!`.
+5. Register the file pattern in the JS worker
+   ([`src/parsers/*.js`](src/parsers/) + [`src/worker.js`](src/worker.js)) so
+   the browser worker dispatches the right files to the new parser.
+6. Render the result in a Leptos section under
+   [`web-leptos/src/components/sections/`](web-leptos/src/components/sections/)
+   and wire it into [`analysis_view.rs`](web-leptos/src/components/analysis_view.rs).
+7. Add a fixture in [`tests/create-fixtures.sh`](tests/create-fixtures.sh) and
+   a Playwright test in the matching `tests/*.spec.js` file.
+
+## Debug mode
+
+For reviewing the rules, you can run the web page with the following query
+parameter so the browser worker logs verbose per-parser output to the
+DevTools console:
+
+```
+http://localhost:8090/?debug=cluster
+```
+
+Useful modes are `cluster`, `app` and `all`.
+
+## Testing
+
+The Rust crates carry their own unit tests; run them from each crate
+directory:
+
+```bash
+cd rca-tool/lib/supportfile_core
+cargo test
+```
+
+End-to-end browser tests are driven by Playwright against the Leptos build:
+
+```bash
+cd rca-tool/tests
+npm ci
+bash create-fixtures.sh
+npx playwright install --with-deps msedge
+
+# Run the full Leptos suite
+node_modules/.bin/playwright test \
+    --config=playwright.leptos.config.js \
+    --project=local-leptos
+
+# Run a single spec, or filter by test name
+node_modules/.bin/playwright test \
+    --config=playwright.leptos.config.js \
+    --project=local-leptos azure.spec.js
+
+node_modules/.bin/playwright test \
+    --config=playwright.leptos.config.js \
+    --project=local-leptos -g "SecureBoot"
+
+# Accessibility checks
+node accessibility-check.js
+```
+
+The Playwright config automatically builds and serves the Leptos app, so the
+first run takes longer while `./build.sh` populates `web-leptos/dist/`.
+
+## TODO
+
+If you want to contribute to the project, the current priority is not to add more functionality, but to have parity and testing of the 4 supported type of files, since they contain different information, packaged in different ways, it is possible that (as an example, this used to happen but is not fixed) you are able to find a kernel reboot on an sos report, but not on an scc file from the same server.
+
+1. Parity for all types of files, with testing
+2. Adding detection from cases or from cluster specialist's recommendations
+3. Adding more detectors: automation platforms, better cluster resources and events, package history, others
+
+If possible, moving the rules to a rust WASM code would make the analysis of the files even faster. (see Limitations)
+
+## Limitations
+
+Due to the need to run with streaming, we currently support only gzip and xz files, using a C library compiled for WASM.
+
+If other mature libraries for compression can be compiled and used with streaming, it should be possible to support other types for files like ZIP, or zstd.
\ No newline at end of file
diff --git a/rca-tool/README.md b/rca-tool/README.md
new file mode 100644
index 0000000..c006774
--- /dev/null
+++ b/rca-tool/README.md
@@ -0,0 +1,53 @@
+# RCA Tool
+
+A Root Cause Analysis (RCA) tool that analyzes support and diagnostic files (hb_report, crm_report, supportconfig and sosreport) from .tar.gz and .tar.xz archives, and summarizes Azure VM, distribution, OS, kernel and cluster resources and parameters, with validation of cluster best practices and event detection (live migration, reboots, oom killer).
+
+## Features
+
+- Streaming Decompression: Memory-efficient processing of large files using liblzma
+- File Listing: Shows complete contents of archives
+- No Server Dependencies: Everything runs in the browser
+- Privacy-First: No files sent to servers
+- Fast Performance: Native WASM speed via Emscripten
+- Zero install: No need to download files, specific OS, dependency install
+- IBM Colorblind-safe palette and web accesiblity: To make this a diverse and inclusive tool
+- CI testing: Uses playright to verify code and help developers
+- GitHub Pages: Serverless and easy deployment via GitHub actions
+
+## How to Use
+
+1. Open the [web page](https://azure.github.io/azure-support-scripts/) in your browser
+   - Note: Change GitHub user in URL, if using a fork for development
+2. Drag a cluster diagnostic file (.tar.gz or .tar.xz) onto the drop zone
+3. The application will analyze the archive and display:
+   - File type detected (hb_report, crm_report, supportconfig or sosreport)
+   - Complete list of files in the archive
+   - Key diagnostic information
+
+## Architecture
+
+```mermaid
+flowchart TD;
+A(File stream to local browser) -->|stream decompression with wasm| B(Multiple patterns)
+B --> C{if file is fstab}
+B --> D{if file is ha.txt}
+B --> K{if file is ha.txt}
+B --> E{if file is instance metadata json}
+C --> F(extract raw) --> I
+D --> G(extract cluster config) --> I
+K --> L(extract cluster nodes) --> I
+E --> H(extract Azure VM properties) --> I
+I(data structure) --> J(Web render)
+```
+
+### Components
+
+- libzmla is compiled for WASM with Emscripten SDK
+- Patterns and rules are run in javascript
+- Rendering is HTML with CSS
+- Unit testing and accesibility testing is done with Playwright and MS Edge browser
+
+
+## License
+
+This project is open source and available under the MIT License.
\ No newline at end of file
diff --git a/rca-tool/cli/archive-processor.js b/rca-tool/cli/archive-processor.js
new file mode 100644
index 0000000..5632929
--- /dev/null
+++ b/rca-tool/cli/archive-processor.js
@@ -0,0 +1,701 @@
+/**
+ * Archive Processor for CLI
+ * 
+ * Handles streaming decompression and processing of .tar.xz, .tar.gz, and .tar files.
+ * Single-pass streaming approach - processes files as they are extracted.
+ */
+
+import fs from 'fs';
+import path from 'path';
+import { createReadStream } from 'fs';
+import { createGunzip } from 'zlib';
+import tar from 'tar-stream';
+import lzma from 'lzma-native';
+import { SCC_RULES } from './parser-loader.js';
+import { PerformanceTracker } from './performance-loader.js';
+
+const PLAINTEXT_EXTS = new Set(['.log', '.txt', '.out']);
+const GZIP_MAGIC = Buffer.from([0x1f, 0x8b]);
+const XZ_MAGIC = Buffer.from([0xfd, 0x37, 0x7a, 0x58, 0x5a, 0x00]);
+const ZIP_MAGIC = Buffer.from([0x50, 0x4b, 0x03, 0x04]);
+
+/**
+ * Detect a bare plaintext log file (not an archive container).
+ * Recognises common log extensions and falls back to magic-byte sniffing.
+ */
+function isPlaintextLog(filePath) {
+    const ext = path.extname(filePath).toLowerCase();
+    if (PLAINTEXT_EXTS.has(ext)) return true;
+    let head;
+    try {
+        const fd = fs.openSync(filePath, 'r');
+        head = Buffer.alloc(512);
+        const n = fs.readSync(fd, head, 0, 512, 0);
+        fs.closeSync(fd);
+        head = head.subarray(0, n);
+    } catch {
+        return false;
+    }
+    if (head.length === 0) return false;
+    if (head.subarray(0, 2).equals(GZIP_MAGIC)) return false;
+    if (head.subarray(0, 6).equals(XZ_MAGIC)) return false;
+    if (head.subarray(0, 4).equals(ZIP_MAGIC)) return false;
+    // Tar magic "ustar" lives at offset 257
+    if (head.length >= 263 && head.subarray(257, 262).toString('ascii') === 'ustar') {
+        return false;
+    }
+    let printable = 0;
+    for (const b of head) {
+        if (b === 9 || b === 10 || b === 13 || (b >= 32 && b < 127)) printable++;
+    }
+    return printable / head.length > 0.85;
+}
+
+/**
+ * Process an archive file and run all parsers on its contents (streaming)
+ * @param {string} archivePath - Path to the archive file
+ * @param {object} options - Processing options
+ * @returns {Promise<object>} - Analysis results
+ */
+export async function processArchive(archivePath, options = {}) {
+    const { debug, parserFilter, performance: perfMode } = options;
+    
+    const results = {
+        fileCount: 0,
+        directories: [],
+        files: [],
+        fileTypes: {}
+    };
+    
+    // Parser results storage
+    const analysisResults = {};
+    
+    // Performance tracking
+    const pt = perfMode ? new PerformanceTracker() : null;
+    
+    // Get parsers to use
+    const parsersToUse = Object.entries(SCC_RULES)
+        .filter(([name, parser]) => {
+            if (!parser.filePattern) return false;
+            if (parserFilter && name !== parserFilter) return false;
+            return true;
+        });
+    
+    debugLog(`Using ${parsersToUse.length} parsers`);
+    
+    // Determine archive type
+    const ext = path.extname(archivePath).toLowerCase();
+    const basename = path.basename(archivePath).toLowerCase();
+    
+    // .txz is another common extension for .tar.xz (used by SUSE/openSUSE SCC reports)
+    const isXz = ext === '.xz' || ext === '.txz' || basename.endsWith('.tar.xz');
+    const isGz = ext === '.gz' || basename.endsWith('.tar.gz') || basename.endsWith('.tgz');
+    const isPlaintext = !isXz && !isGz && isPlaintextLog(archivePath);
+    if (isPlaintext) {
+        debugLog(`Detected plaintext log file: ${archivePath}`);
+    }
+    
+    return new Promise((resolve, reject) => {
+        const extract = tar.extract();
+        
+        extract.on('entry', (header, stream, next) => {
+            const filename = header.name;
+            
+            if (header.type === 'directory') {
+                results.directories.push(filename);
+                stream.resume();
+                next();
+                return;
+            }
+            
+            // Track file info
+            results.files.push({ name: filename, size: header.size });
+            results.fileCount++;
+            
+            const fileExt = path.extname(filename) || '(no extension)';
+            results.fileTypes[fileExt] = (results.fileTypes[fileExt] || 0) + 1;
+            
+            // Normalize sos_strings tailed file paths back to their original paths
+            // sosreport stores large log files in sos_strings/<plugin>/var.log.<path>.<file>.tailed
+            // and creates symlinks from the original paths (which are 0-byte in tar stream)
+            let matchFilename = filename;
+            const tailedMatch = filename.match(/sos_strings\/[^\/]+\/(.+)\.tailed$/);
+            if (tailedMatch) {
+                const dottedPath = tailedMatch[1];
+                let originalPath;
+                const extMatch = dottedPath.match(/^(.+)\.((log|conf|txt|xml)(?:[.-].+)?)$/);
+                if (extMatch) {
+                    const segments = extMatch[1].split('.');
+                    const fileBase = segments.pop();
+                    const dirPath = segments.join('/');
+                    originalPath = dirPath + '/' + fileBase + '.' + extMatch[2];
+                } else {
+                    const segments = dottedPath.split('.');
+                    const fileName = segments.pop();
+                    const dirPath = segments.join('/');
+                    originalPath = dirPath + '/' + fileName;
+                }
+                const reportPrefix = filename.substring(0, filename.indexOf('sos_strings'));
+                matchFilename = reportPrefix + originalPath;
+                debugLog(`Normalized sos_strings tailed path: ${filename} -> ${matchFilename}`);
+            }
+            
+            // Find matching parsers for this file
+            const matchingParsers = parsersToUse.filter(([name, parser]) => 
+                parser.filePattern.test(matchFilename)
+            );
+            
+            if (matchingParsers.length === 0) {
+                // No parser matches this file, skip reading content
+                stream.resume();
+                next();
+                return;
+            }
+            
+            // Read file content for parsing
+            const chunks = [];
+            stream.on('data', chunk => chunks.push(chunk));
+            stream.on('end', () => {
+                const decodeStart = pt ? performance.now() : 0;
+                const content = Buffer.concat(chunks).toString('utf8');
+                const decodeMs = pt ? performance.now() - decodeStart : 0;
+                
+                if (pt) {
+                    pt.startFile();
+                    pt.recordDecode(decodeMs);
+                }
+                
+                debugLog(`Processing: ${matchFilename} (${content.length} bytes) with ${matchingParsers.length} parsers`);
+                
+                // Split lines ONCE and share across all matching parsers
+                // Avoids each parser re-splitting the same content (e.g. 10 parsers × 44MB = 10 redundant splits)
+                const lines = content.split('\n');
+                
+                // Run each matching parser
+                for (const [parserName, parser] of matchingParsers) {
+                    try {
+                        const parseStart = pt ? performance.now() : 0;
+                        const result = parser.parse(content, matchFilename, lines);
+                        const parseMs = pt ? performance.now() - parseStart : 0;
+                        
+                        // Handle multi-file parsers (like blockDevices that accumulate data)
+                        if (parser.multiFile) {
+                            if (!analysisResults[parserName]) {
+                                analysisResults[parserName] = result;
+                            } else {
+                                // Merge result into existing
+                                mergeMultiFileResult(analysisResults[parserName], result, parserName);
+                            }
+                        }
+                        // Handle processAllRotations parsers (like log file parsers)
+                        else if (parser.processAllRotations) {
+                            if (!analysisResults[parserName]) {
+                                // Initialize based on parser type
+                                if (parserName === 'rhuiErrors') {
+                                    analysisResults[parserName] = {
+                                        found: false,
+                                        hasCertExpiration: false,
+                                        hasHttp403: false,
+                                        hasHttp400: false,
+                                        hasConnectionError: false,
+                                        errors: [],
+                                        affectedRepos: [],
+                                        warnings: [],
+                                        recommendations: []
+                                    };
+                                } else if (parserName === 'clusterEvents') {
+                                    analysisResults[parserName] = {
+                                        found: false,
+                                        count: 0,
+                                        resourceMigrations: [],
+                                        fencingEvents: []
+                                    };
+                                } else {
+                                    analysisResults[parserName] = {
+                                        count: 0,
+                                        events: []
+                                    };
+                                }
+                            }
+                            
+                            // Merge results
+                            if (parserName === 'rhuiErrors') {
+                                analysisResults[parserName].found = analysisResults[parserName].found || result.found;
+                                analysisResults[parserName].hasCertExpiration = analysisResults[parserName].hasCertExpiration || result.hasCertExpiration;
+                                analysisResults[parserName].hasHttp403 = analysisResults[parserName].hasHttp403 || result.hasHttp403;
+                                analysisResults[parserName].hasHttp400 = analysisResults[parserName].hasHttp400 || result.hasHttp400;
+                                analysisResults[parserName].hasConnectionError = analysisResults[parserName].hasConnectionError || result.hasConnectionError;
+                                
+                                result.errors?.forEach(err => {
+                                    analysisResults[parserName].errors.push({ ...err, sourceFile: filename });
+                                });
+                                result.affectedRepos?.forEach(repo => {
+                                    if (!analysisResults[parserName].affectedRepos.includes(repo)) {
+                                        analysisResults[parserName].affectedRepos.push(repo);
+                                    }
+                                });
+                                result.warnings?.forEach(warning => {
+                                    if (!analysisResults[parserName].warnings.find(w => w.type === warning.type)) {
+                                        analysisResults[parserName].warnings.push(warning);
+                                    }
+                                });
+                            } else if (parserName === 'clusterEvents') {
+                                // clusterEvents returns { found, resourceMigrations, fencingEvents, totalEvents }
+                                if (result.found) {
+                                    analysisResults[parserName].found = true;
+                                    result.resourceMigrations?.forEach(m => {
+                                        analysisResults[parserName].resourceMigrations.push({ ...m, sourceFile: matchFilename });
+                                    });
+                                    result.fencingEvents?.forEach(f => {
+                                        analysisResults[parserName].fencingEvents.push({ ...f, sourceFile: matchFilename });
+                                    });
+                                    analysisResults[parserName].count = 
+                                        analysisResults[parserName].resourceMigrations.length + 
+                                        analysisResults[parserName].fencingEvents.length;
+                                }
+                            } else if (result.count !== undefined && result.events) {
+                                analysisResults[parserName].count += result.count;
+                                analysisResults[parserName].events.push(...result.events.map(e => ({
+                                    ...e,
+                                    sourceFile: filename
+                                })));
+                            }
+                        } else {
+                            // Single file parser - just store result
+                            if (!analysisResults[parserName] || result.found) {
+                                analysisResults[parserName] = result;
+                            }
+                        }
+                        
+                        debugLog(`Parser ${parserName} result: found=${result.found}`);
+                        
+                        // Track per-parser performance
+                        if (pt) {
+                            pt.recordParser(matchFilename, parserName, parseMs, result, analysisResults[parserName]);
+                        }
+                    } catch (error) {
+                        debugLog(`Parser ${parserName} error on ${filename}: ${error.message}`);
+                    }
+                }
+                
+                // Track per-file performance
+                if (pt) {
+                    pt.endFile(matchFilename, content.length, matchingParsers.length);
+                }
+                
+                next();
+            });
+            stream.on('error', next);
+        });
+        
+        extract.on('finish', () => {
+            debugLog(`Finished processing ${results.fileCount} files`);
+            
+            // Post-processing: correlate fstab with block devices
+            correlateFstabWithBlockDevices(analysisResults);
+            
+            // Post-processing: compare mtab with fstab
+            compareMtabWithFstab(analysisResults);
+            
+            // Post-processing: distro-aware corosync warning filtering
+            const osReleaseData = analysisResults.osRelease || analysisResults.sysinfo || analysisResults.basicEnvironment || null;
+            const isSUSE = osReleaseData && osReleaseData.name && 
+                          (osReleaseData.name.toLowerCase().includes('suse') || 
+                           (osReleaseData.prettyName && osReleaseData.prettyName.toLowerCase().includes('suse')));
+            const isRHEL = osReleaseData && osReleaseData.name &&
+                          (osReleaseData.name.toLowerCase().includes('red hat') ||
+                           osReleaseData.name.toLowerCase().includes('rhel') ||
+                           (osReleaseData.prettyName && (osReleaseData.prettyName.toLowerCase().includes('red hat') || osReleaseData.prettyName.toLowerCase().includes('rhel'))));
+            const distroFamily = isSUSE ? 'sles' : (isRHEL ? 'rhel' : 'unknown');
+            
+            if (analysisResults.corosyncConfig) {
+                analysisResults.corosyncConfig.distroFamily = distroFamily;
+                if (analysisResults.corosyncConfig.warnings) {
+                    if (isRHEL) {
+                        // RHEL guide recommends same totem values as SUSE, except transport should be 'knet'
+                        // Reference: https://learn.microsoft.com/en-us/azure/sap/workloads/high-availability-guide-rhel-pacemaker
+                        
+                        // Remove the SUSE-specific transport warning (which expects 'udpu')
+                        analysisResults.corosyncConfig.warnings = analysisResults.corosyncConfig.warnings.filter(w => 
+                            w.parameter !== 'totem.transport'
+                        );
+                        
+                        // Add RHEL-specific transport check: should be 'knet' for RHEL 8+
+                        if (analysisResults.corosyncConfig.totemTransport !== null && analysisResults.corosyncConfig.totemTransport !== 'knet') {
+                            analysisResults.corosyncConfig.warnings.push({
+                                parameter: 'totem.transport',
+                                expected: 'knet',
+                                actual: analysisResults.corosyncConfig.totemTransport,
+                                severity: 'warning',
+                                message: `Totem transport value is '${analysisResults.corosyncConfig.totemTransport}', but should be 'knet' for RHEL 8+ Azure environments`,
+                                documentationUrl: 'https://learn.microsoft.com/en-us/azure/sap/workloads/high-availability-guide-rhel-pacemaker'
+                            });
+                        }
+                        
+                        // Update documentation URLs to RHEL guide
+                        analysisResults.corosyncConfig.warnings.forEach(w => {
+                            w.documentationUrl = 'https://learn.microsoft.com/en-us/azure/sap/workloads/high-availability-guide-rhel-pacemaker';
+                        });
+                        
+                        debugLog('Applied RHEL-specific corosync validation (transport: knet)');
+                    } else if (!isSUSE) {
+                        analysisResults.corosyncConfig.warnings = analysisResults.corosyncConfig.warnings.filter(w => 
+                            w.parameter !== 'totem.transport'
+                        );
+                    }
+                }
+            }
+            
+            resolve({
+                ...results,
+                ...analysisResults,
+                ...(pt ? { _performanceData: pt.getReport() } : {})
+            });
+        });
+        
+        extract.on('error', reject);
+        
+        // Create the decompression pipeline
+        const fileStream = createReadStream(archivePath);
+        
+        if (isXz) {
+            debugLog('Using LZMA decompression');
+            const decompressor = lzma.createDecompressor();
+            fileStream.pipe(decompressor).pipe(extract);
+        } else if (isGz) {
+            debugLog('Using Gzip decompression');
+            fileStream.pipe(createGunzip()).pipe(extract);
+        } else if (isPlaintext) {
+            debugLog('Wrapping plaintext file as synthetic tar entry');
+            // Wrap the plaintext file in a single-entry in-memory tar so the
+            // existing entry handler (with all its merging/multi-file logic)
+            // runs unchanged. The synthetic name <basename>/messages ensures
+            // syslog-style file_pattern regexes match.
+            const pack = tar.pack();
+            const syntheticName = `${path.basename(archivePath)}/messages`;
+            const stat = fs.statSync(archivePath);
+            const entry = pack.entry({ name: syntheticName, size: stat.size }, err => {
+                if (err) extract.emit('error', err);
+                pack.finalize();
+            });
+            fileStream.pipe(entry);
+            pack.pipe(extract);
+        } else {
+            debugLog('No decompression needed');
+            fileStream.pipe(extract);
+        }
+    });
+}
+
+function debugLog(...args) {
+    if (global.DEBUG_MODE) {
+        console.error('[DEBUG]', ...args);
+    }
+}
+
+/**
+ * Merge results from multi-file parsers
+ * These parsers accumulate data across multiple files
+ */
+function mergeMultiFileResult(existing, newResult, parserName) {
+    // Merge found flag
+    existing.found = existing.found || newResult.found;
+    
+    // Special handling for networkInterfaces (delegate to parser's mergeResults)
+    if (parserName === 'networkInterfaces') {
+        // networkInterfacesParser.mergeResults handles everything except found flag (already merged above)
+        // Merge interfaces
+        for (const [name, iface] of Object.entries(newResult.interfaces || {})) {
+            if (!existing.interfaces[name]) {
+                existing.interfaces[name] = iface;
+            } else {
+                const e = existing.interfaces[name];
+                if (iface.state && !e.state) e.state = iface.state;
+                if (iface.mac && !e.mac) e.mac = iface.mac;
+                if (iface.mtu && !e.mtu) e.mtu = iface.mtu;
+                if (iface.driver && !e.driver) e.driver = iface.driver;
+                if (iface.driverInfo && !e.driverInfo) e.driverInfo = iface.driverInfo;
+                if (iface.accelNet) e.accelNet = true;
+                if (iface.bootproto && !e.bootproto) e.bootproto = iface.bootproto;
+                if (iface.master && !e.master) e.master = iface.master;
+                if (iface.type && !e.type) e.type = iface.type;
+                if (iface.firmwareVersion && !e.firmwareVersion) e.firmwareVersion = iface.firmwareVersion;
+                if (iface.busInfo && !e.busInfo) e.busInfo = iface.busInfo;
+                for (const ip of (iface.ipv4 || [])) {
+                    if (!e.ipv4.some(a => a.address === ip.address)) e.ipv4.push(ip);
+                }
+                for (const ip of (iface.ipv6 || [])) {
+                    if (!e.ipv6.some(a => a.address === ip.address)) e.ipv6.push(ip);
+                }
+            }
+        }
+        Object.assign(existing.raw, newResult.raw || {});
+        return;
+    }
+
+    // Special handling for firewallRules (deep merge of per-type fields)
+    if (parserName === 'firewallRules') {
+        // Merge firewalld
+        existing.firewalld.detected = existing.firewalld.detected || newResult.firewalld.detected;
+        existing.firewalld.running = existing.firewalld.running || newResult.firewalld.running;
+        if (newResult.firewalld.config) existing.firewalld.config = newResult.firewalld.config;
+        if (newResult.firewalld.zones) existing.firewalld.zones = newResult.firewalld.zones;
+        if (newResult.firewalld.directRules) existing.firewalld.directRules = (existing.firewalld.directRules || '') + newResult.firewalld.directRules;
+        if (newResult.firewalld.passthroughs) existing.firewalld.passthroughs = (existing.firewalld.passthroughs || '') + newResult.firewalld.passthroughs;
+        if (newResult.firewalld.chains) existing.firewalld.chains = (existing.firewalld.chains || '') + newResult.firewalld.chains;
+        if (newResult.firewalld.logDenied) existing.firewalld.logDenied = newResult.firewalld.logDenied;
+        if (newResult.firewalld.backend) existing.firewalld.backend = newResult.firewalld.backend;
+        // Merge iptables / ip6tables
+        existing.iptables.detected = existing.iptables.detected || newResult.iptables.detected;
+        existing.iptables.rules.push(...(newResult.iptables.rules || []));
+        existing.iptables.modules.push(...(newResult.iptables.modules || []));
+        existing.ip6tables.detected = existing.ip6tables.detected || newResult.ip6tables.detected;
+        existing.ip6tables.rules.push(...(newResult.ip6tables.rules || []));
+        existing.ip6tables.modules.push(...(newResult.ip6tables.modules || []));
+        // Merge ebtables
+        existing.ebtables.detected = existing.ebtables.detected || newResult.ebtables.detected;
+        if (newResult.ebtables.config) existing.ebtables.config = newResult.ebtables.config;
+        // Merge nftables
+        existing.nftables.detected = existing.nftables.detected || newResult.nftables.detected;
+        if (newResult.nftables.ruleset) existing.nftables.ruleset = newResult.nftables.ruleset;
+        if (newResult.nftables.tables) existing.nftables.tables = newResult.nftables.tables;
+        // Merge warnings and raw sections
+        newResult.warnings?.forEach(w => { if (!existing.warnings.includes(w)) existing.warnings.push(w); });
+        Object.assign(existing.rawSections, newResult.rawSections || {});
+        // Re-determine active firewall using the parser's logic
+        if (existing.firewalld.running) existing.activeFirewall = 'firewalld';
+        else if (existing.nftables.ruleset && existing.nftables.ruleset !== '(empty)' && existing.nftables.ruleset.length > 10) existing.activeFirewall = 'nftables';
+        else if (existing.iptables.rules.length > 0) existing.activeFirewall = 'iptables';
+        else if (existing.ip6tables.rules.length > 0) existing.activeFirewall = 'ip6tables';
+        else existing.activeFirewall = 'none';
+        return;
+    }
+    
+    // Special handling for clusterEvents (has resourceMigrations and fencingEvents arrays)
+    if (parserName === 'clusterEvents') {
+        if (newResult.resourceMigrations) {
+            if (!existing.resourceMigrations) existing.resourceMigrations = [];
+            existing.resourceMigrations.push(...newResult.resourceMigrations);
+        }
+        if (newResult.fencingEvents) {
+            if (!existing.fencingEvents) existing.fencingEvents = [];
+            existing.fencingEvents.push(...newResult.fencingEvents);
+        }
+        existing.count = (existing.resourceMigrations?.length || 0) + (existing.fencingEvents?.length || 0);
+        return;
+    }
+    
+    // Merge arrays (like disks, partitions)
+    for (const key of ['disks', 'partitions', 'warnings']) {
+        if (Array.isArray(newResult[key])) {
+            if (!existing[key]) existing[key] = [];
+            for (const item of newResult[key]) {
+                // Avoid duplicates by checking for unique identifier
+                const isDupe = existing[key].some(e => 
+                    (e.name && e.name === item.name) || 
+                    (e.device && e.device === item.device) ||
+                    (JSON.stringify(e) === JSON.stringify(item))
+                );
+                if (!isDupe) {
+                    existing[key].push(item);
+                }
+            }
+        }
+    }
+    
+    // Merge maps (like uuidMap, deviceMap, mountPoints)
+    for (const key of ['uuidMap', 'deviceMap', 'mountPoints']) {
+        if (newResult[key] && typeof newResult[key] === 'object') {
+            if (!existing[key]) existing[key] = {};
+            Object.assign(existing[key], newResult[key]);
+        }
+    }
+    
+    // Merge raw output
+    if (newResult.rawOutput && typeof newResult.rawOutput === 'object') {
+        if (!existing.rawOutput) existing.rawOutput = {};
+        Object.assign(existing.rawOutput, newResult.rawOutput);
+    }
+}
+
+/**
+ * Correlate fstab entries with block device information
+ * Detects UUID mismatches, missing UUIDs, and filesystem type mismatches
+ */
+function correlateFstabWithBlockDevices(results) {
+    const fstab = results.fstabAnalysis;
+    const blockDevices = results.blockDevices;
+    
+    if (!fstab?.found || !blockDevices?.found) {
+        debugLog('Cannot correlate: fstab or blockDevices not found');
+        return;
+    }
+    
+    // Create a storage correlation result
+    const correlation = {
+        found: true,
+        mountedVolumes: [],
+        warnings: [],
+        errors: []
+    };
+    
+    for (const entry of fstab.entries) {
+        const mountInfo = {
+            mountpoint: entry.mountpoint,
+            source: entry.source,
+            fstabFstype: entry.fstype,
+            actualDevice: null,
+            actualUuid: null,
+            actualFstype: null,
+            status: 'unknown',
+            issues: []
+        };
+        
+        if (entry.sourceType === 'uuid' && entry.uuid) {
+            // Look up UUID in block devices
+            const device = blockDevices.uuidMap[entry.uuid] || 
+                          blockDevices.uuidMap[entry.uuid.toLowerCase()] ||
+                          blockDevices.uuidMap[entry.uuid.toUpperCase()];
+            
+            if (device) {
+                const deviceInfo = blockDevices.deviceMap[device];
+                mountInfo.actualDevice = device;
+                mountInfo.actualUuid = deviceInfo?.uuid;
+                mountInfo.actualFstype = deviceInfo?.fstype;
+                mountInfo.status = 'found';
+                
+                // Check for filesystem type mismatch
+                if (entry.fstype !== 'auto' && deviceInfo?.fstype && 
+                    entry.fstype.toLowerCase() !== deviceInfo.fstype.toLowerCase()) {
+                    mountInfo.status = 'warning';
+                    mountInfo.issues.push({
+                        type: 'fstype_mismatch',
+                        message: `Filesystem type mismatch: fstab expects '${entry.fstype}' but device has '${deviceInfo.fstype}'`,
+                        severity: 'warning'
+                    });
+                    correlation.warnings.push({
+                        mountpoint: entry.mountpoint,
+                        message: `Filesystem type mismatch for ${entry.mountpoint}: fstab='${entry.fstype}', actual='${deviceInfo.fstype}'`
+                    });
+                }
+                
+                // Check if mount point matches
+                if (deviceInfo?.mountpoint && deviceInfo.mountpoint !== entry.mountpoint) {
+                    mountInfo.issues.push({
+                        type: 'mountpoint_mismatch',
+                        message: `Device mounted at '${deviceInfo.mountpoint}' but fstab expects '${entry.mountpoint}'`,
+                        severity: 'info'
+                    });
+                }
+            } else {
+                // UUID not found - this is a problem
+                mountInfo.status = 'error';
+                mountInfo.issues.push({
+                    type: 'uuid_not_found',
+                    message: `UUID '${entry.uuid}' referenced in fstab not found on any block device`,
+                    severity: 'error'
+                });
+                correlation.errors.push({
+                    mountpoint: entry.mountpoint,
+                    uuid: entry.uuid,
+                    message: `UUID ${entry.uuid} for ${entry.mountpoint} not found on any device. The disk may have been replaced or reformatted.`
+                });
+            }
+        } else if (entry.sourceType === 'device' && entry.device) {
+            // Direct device reference
+            const deviceInfo = blockDevices.deviceMap[entry.device];
+            if (deviceInfo) {
+                mountInfo.actualDevice = entry.device;
+                mountInfo.actualUuid = deviceInfo.uuid;
+                mountInfo.actualFstype = deviceInfo.fstype;
+                mountInfo.status = 'found';
+            } else {
+                // Check if it's a symlink path like /dev/disk/cloud/azure_resource-part1
+                // These won't be in deviceMap directly
+                mountInfo.status = 'symlink';
+                mountInfo.issues.push({
+                    type: 'symlink_device',
+                    message: `Device path '${entry.device}' is likely a symlink, actual device unknown`,
+                    severity: 'info'
+                });
+            }
+        }
+        
+        correlation.mountedVolumes.push(mountInfo);
+    }
+    
+    // Add summary
+    correlation.summary = {
+        totalEntries: fstab.entries.length,
+        foundDevices: correlation.mountedVolumes.filter(m => m.status === 'found').length,
+        warnings: correlation.warnings.length,
+        errors: correlation.errors.length
+    };
+    
+    results.storageCorrelation = correlation;
+    debugLog('Storage correlation complete:', correlation.summary);
+}
+
+/**
+ * Compare mtab entries with fstab to find mounts not defined in fstab.
+ * These are typically hand-mounted filesystems or cluster-managed resources.
+ * Mutates results.mtabAnalysis to include extraMounts.
+ */
+function compareMtabWithFstab(results) {
+    const mtab = results.mtabAnalysis;
+    if (!mtab?.found) {
+        debugLog('Cannot compare mtab: mtabAnalysis not found');
+        return;
+    }
+
+    const fstab = results.fstabAnalysis;
+
+    // Build a set of fstab mountpoints for fast lookup
+    const fstabMountpoints = new Set();
+    if (fstab?.found && fstab.entries) {
+        for (const entry of fstab.entries) {
+            fstabMountpoints.add(entry.mountpoint);
+        }
+    }
+
+    // Count real vs virtual mounts
+    let realMounts = 0;
+    let virtualMounts = 0;
+    const typeBreakdown = {};
+    for (const entry of mtab.entries) {
+        if (entry.isVirtualFs) {
+            virtualMounts++;
+        } else {
+            realMounts++;
+        }
+        typeBreakdown[entry.fstype] = (typeBreakdown[entry.fstype] || 0) + 1;
+    }
+
+    // Find mounts in mtab that are NOT in fstab (excluding virtual filesystems)
+    const extraMounts = [];
+    for (const entry of mtab.entries) {
+        if (entry.isVirtualFs) continue;
+        if (!fstabMountpoints.has(entry.mountpoint)) {
+            extraMounts.push({
+                source: entry.source,
+                mountpoint: entry.mountpoint,
+                fstype: entry.fstype,
+                options: entry.options,
+                sourceType: entry.sourceType,
+                reason: 'Not found in /etc/fstab - possibly hand-mounted or cluster-managed'
+            });
+        }
+    }
+
+    // Collect autofs entries separately for visibility
+    const autofsMounts = mtab.entries.filter(e => e.fstype === 'autofs');
+
+    mtab.realMounts = realMounts;
+    mtab.virtualMounts = virtualMounts;
+    mtab.typeBreakdown = typeBreakdown;
+    mtab.extraMounts = extraMounts;
+    mtab.autofsMounts = autofsMounts;
+    debugLog('mtab vs fstab comparison complete:', extraMounts.length, 'extra mounts,', realMounts, 'real,', virtualMounts, 'virtual,', autofsMounts.length, 'autofs');
+}
+
+export default { processArchive };
diff --git a/rca-tool/cli/build.js b/rca-tool/cli/build.js
new file mode 100644
index 0000000..cbd4a0f
--- /dev/null
+++ b/rca-tool/cli/build.js
@@ -0,0 +1,159 @@
+#!/usr/bin/env node
+/**
+ * Build script to bundle the CLI into a single file using esbuild
+ * 
+ * The build process:
+ * 1. Bundles all JS files into a single CJS file
+ * 2. Reads all parsers from src/parsers/
+ * 3. Post-processes the bundle to inject embedded parsers
+ * 4. Creates a single .cjs file that can be run anywhere
+ */
+
+import * as esbuild from 'esbuild';
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+// Load all parsers and return them as a JSON string for embedding
+function loadParsersForBundle() {
+    const parsersDir = path.join(__dirname, '..', 'src', 'parsers');
+    const files = fs.readdirSync(parsersDir).filter(f => f.endsWith('.js'));
+    
+    const parsers = {};
+    for (const file of files) {
+        const filePath = path.join(parsersDir, file);
+        const content = fs.readFileSync(filePath, 'utf8');
+        parsers[file] = content;
+    }
+    
+    return JSON.stringify(parsers);
+}
+
+// Load performance.js source for embedding
+function loadPerformanceForBundle() {
+    const perfPath = path.join(__dirname, '..', 'src', 'performance.js');
+    return JSON.stringify(fs.readFileSync(perfPath, 'utf8'));
+}
+
+async function build() {
+    console.log('Building CLI bundle...\n');
+
+    try {
+        // Ensure dist directory exists
+        const distDir = path.join(__dirname, 'dist');
+        if (!fs.existsSync(distDir)) {
+            fs.mkdirSync(distDir, { recursive: true });
+        }
+
+        const tempFile = path.join(__dirname, 'dist', 'rca-cli.temp.js');
+        const outfile = path.join(__dirname, 'dist', 'rca-cli.cjs');
+
+        // Step 1: Bundle without minification (to allow post-processing)
+        // Enable tree-shaking to remove unused code from libraries
+        const result = await esbuild.build({
+            entryPoints: [path.join(__dirname, 'cli.js')],
+            bundle: true,
+            platform: 'node',
+            target: 'node18',
+            outfile: tempFile,
+            format: 'cjs',
+            // Mark native modules as external (they can't be bundled)
+            external: ['lzma-native'],
+            minify: false, // Don't minify yet - we need to do post-processing
+            treeShaking: true, // Enable tree-shaking to remove unused exports
+            sourcemap: false,
+            metafile: true,
+            logOverride: {
+                // Suppress import.meta warnings - the code has __dirname fallback for CJS
+                'empty-import-meta': 'silent',
+            },
+        });
+
+        // Step 2: Post-process to inject embedded parsers
+        let content = fs.readFileSync(tempFile, 'utf8');
+        
+        // Load parsers and create the injection code
+        const parsersJson = loadParsersForBundle();
+        
+        // Replace the placeholder with actual parser data
+        const originalLength = content.length;
+        content = content.replace(
+            /EMBEDDED_PARSERS\s*=\s*null/,
+            `EMBEDDED_PARSERS = ${parsersJson}`
+        );
+        
+        // Also embed performance.js source
+        const performanceJson = loadPerformanceForBundle();
+        content = content.replace(
+            /EMBEDDED_PERFORMANCE\s*=\s*null/,
+            `EMBEDDED_PERFORMANCE = ${performanceJson}`
+        );
+        
+        if (content.length === originalLength) {
+            console.error('Warning: EMBEDDED_PARSERS replacement may have failed');
+        } else {
+            console.log(`  Injected parsers (added ${content.length - originalLength} bytes)`);
+        }
+        
+        // Remove any existing shebang before writing (will be added in final step)
+        content = content.replace(/^#!.*\n?/gm, '');
+        
+        // Write the post-processed content back
+        fs.writeFileSync(tempFile, content);
+
+        // Step 3: Re-bundle with full minification
+        // This allows esbuild to properly minify all libraries including their internals
+        await esbuild.build({
+            entryPoints: [tempFile],
+            bundle: false, // Already bundled, just minify
+            platform: 'node',
+            target: 'node18',
+            outfile: outfile,
+            format: 'cjs',
+            minify: true,
+            minifyWhitespace: true,
+            minifyIdentifiers: true,
+            minifySyntax: true,
+            sourcemap: false,
+            banner: {
+                js: '#!/usr/bin/env node',
+            },
+        });
+
+        // Clean up temp file
+        fs.unlinkSync(tempFile);
+        
+        // Make the file executable
+        fs.chmodSync(outfile, 0o755);
+
+        // Get output file size
+        const stats = fs.statSync(outfile);
+        const sizeKB = (stats.size / 1024).toFixed(2);
+
+        console.log(`Bundle created: dist/rca-cli.cjs (${sizeKB} KB)`);
+
+        // Count embedded parsers
+        const parsersCount = Object.keys(JSON.parse(parsersJson)).length;
+        console.log(`  Embedded ${parsersCount} parsers`);
+
+        // Analyze the bundle
+        if (result.metafile) {
+            const inputs = Object.keys(result.metafile.inputs);
+            console.log(`  Bundled ${inputs.length} modules`);
+        }
+
+        console.log('\nTo use the bundled CLI:');
+        console.log('  ./dist/rca-cli.cjs <file.tar.xz>');
+        console.log('  node dist/rca-cli.cjs <file.tar.xz>');
+        console.log('\nNote: lzma-native is external and must be installed separately.');
+        console.log('  npm install lzma-native');
+
+    } catch (error) {
+        console.error('Build failed:', error);
+        process.exit(1);
+    }
+}
+
+build();
diff --git a/rca-tool/cli/cli.js b/rca-tool/cli/cli.js
new file mode 100644
index 0000000..b45d494
--- /dev/null
+++ b/rca-tool/cli/cli.js
@@ -0,0 +1,837 @@
+#!/usr/bin/env node
+/**
+ * RCA CLI Tool
+ * 
+ * Command-line interface for analyzing sosreports and support bundles.
+ * Uses the same parsers as the web tool.
+ * 
+ * Usage:
+ *   node cli.js <file.tar.xz> [options]
+ *   node cli.js --help
+ * 
+ * Options:
+ *   --json           Output results as JSON
+ *   --debug          Enable debug logging
+ *   --parser <name>  Run only a specific parser
+ *   --list-parsers   List available parsers
+ *   --extract <dir>  Extract results to individual files
+ */
+
+import fs from 'fs';
+import path from 'path';
+import { loadParsers, SCC_RULES } from './parser-loader.js';
+import { processArchive } from './archive-processor.js';
+import { formatPerformanceReport } from './performance-loader.js';
+
+// Handle both ESM and CJS environments
+const getDirname = () => {
+    // For bundled CJS, use __dirname if available
+    if (typeof __dirname !== 'undefined') {
+        return __dirname;
+    }
+    // For ESM, derive from import.meta.url
+    const { fileURLToPath } = require('url');
+    return path.dirname(fileURLToPath(import.meta.url));
+};
+
+// Parse command line arguments
+function parseArgs() {
+    const args = process.argv.slice(2);
+    const options = {
+        file: null,
+        json: false,
+        debug: false,
+        performance: false,
+        parser: null,
+        listParsers: false,
+        help: false,
+        extract: null
+    };
+
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === '--help' || arg === '-h') {
+            options.help = true;
+        } else if (arg === '--json' || arg === '-j') {
+            options.json = true;
+        } else if (arg === '--debug' || arg === '-d') {
+            options.debug = true;
+        } else if (arg === '--performance' || arg === '--perf') {
+            options.performance = true;
+        } else if (arg === '--list-parsers' || arg === '-l') {
+            options.listParsers = true;
+        } else if (arg === '--parser' || arg === '-p') {
+            options.parser = args[++i];
+        } else if (arg === '--extract' || arg === '-e') {
+            options.extract = args[++i] || './rca-output';
+        } else if (!arg.startsWith('-')) {
+            options.file = arg;
+        }
+    }
+
+    return options;
+}
+
+function showHelp() {
+    console.log(`
+RCA CLI Tool - Analyze sosreports and support bundles
+
+Usage:
+  node cli.js <file.tar.xz> [options]
+  npx rca-cli <file.tar.xz> [options]
+
+Arguments:
+  <file>              Path to a .tar.xz, .tar.gz, or .tar file
+
+Options:
+  -h, --help           Show this help message
+  -j, --json           Output results as JSON
+  -d, --debug          Enable debug logging
+  --performance        Output per-file/parser timing (TSV to stderr)
+  -p, --parser <name>  Run only a specific parser
+  -l, --list-parsers   List available parsers
+  -e, --extract <dir>  Extract results to individual files in <dir>
+
+Examples:
+  node cli.js sosreport.tar.xz
+  node cli.js sosreport.tar.xz --json > results.json
+  node cli.js sosreport.tar.xz --parser rhuiErrors --debug
+  node cli.js sosreport.tar.xz --performance 2>perf.tsv
+  node cli.js sosreport.tar.xz --extract ./output
+`);
+}
+
+function listParsers() {
+    console.log('\nAvailable parsers:\n');
+    const parsers = Object.entries(SCC_RULES)
+        .filter(([name, parser]) => parser.filePattern)
+        .sort((a, b) => a[0].localeCompare(b[0]));
+
+    for (const [name, parser] of parsers) {
+        const pattern = parser.filePattern.toString();
+        const multiFile = parser.processAllRotations ? ' [multi-file]' : '';
+        console.log(`  ${name}${multiFile}`);
+        console.log(`    Pattern: ${pattern}`);
+    }
+    console.log(`\nTotal: ${parsers.length} parsers\n`);
+}
+
+/**
+ * Extract results to individual JSON files
+ */
+function extractResults(results, outputDir) {
+    if (!fs.existsSync(outputDir)) {
+        fs.mkdirSync(outputDir, { recursive: true });
+    }
+
+    // Write summary
+    fs.writeFileSync(
+        path.join(outputDir, 'summary.json'),
+        JSON.stringify({
+            fileCount: results.fileCount,
+            directories: results.directories?.length || 0,
+            fileTypes: results.fileTypes
+        }, null, 2)
+    );
+
+    // Write each parser result
+    const parserResults = {};
+    for (const [key, value] of Object.entries(results)) {
+        if (['fileCount', 'directories', 'files', 'fileTypes'].includes(key)) continue;
+        if (value && typeof value === 'object') {
+            const filename = `${key}.json`;
+            fs.writeFileSync(
+                path.join(outputDir, filename),
+                JSON.stringify(value, null, 2)
+            );
+            parserResults[key] = filename;
+        }
+    }
+
+    // Write index
+    fs.writeFileSync(
+        path.join(outputDir, 'index.json'),
+        JSON.stringify({ generated: new Date().toISOString(), files: parserResults }, null, 2)
+    );
+
+    return Object.keys(parserResults).length;
+}
+
+function formatResults(results, options) {
+    if (options.json) {
+        return JSON.stringify(results, null, 2);
+    }
+
+    let output = '\n';
+    output += '='.repeat(70) + '\n';
+    output += '  RCA Analysis Results\n';
+    output += '='.repeat(70) + '\n\n';
+
+    output += `Files processed: ${results.fileCount}\n`;
+    output += `Directories: ${results.directories?.length || 0}\n\n`;
+
+    // AZURE VM PROPERTIES
+    if (results.azureVMProperties?.found || results.osRelease?.found) {
+        output += '-'.repeat(70) + '\n';
+        output += 'AZURE VM PROPERTIES\n';
+        output += '-'.repeat(70) + '\n';
+        const vm = results.azureVMProperties || {};
+        if (vm.vmSize) output += `  VM Size: ${vm.vmSize}\n`;
+        if (vm.publisher) output += `  Publisher: ${vm.publisher}\n`;
+        if (vm.offer) output += `  Offer: ${vm.offer}\n`;
+        if (vm.sku) output += `  SKU: ${vm.sku}\n`;
+        if (vm.billingModel) output += `  Billing Model: ${vm.billingModel}\n`;
+        if (vm.osDiskType) output += `  OS Disk Type: ${vm.osDiskType}\n`;
+        if (vm.dataDisks?.length > 0) {
+            output += `  Data Disks: ${vm.dataDisks.length}\n`;
+            vm.dataDisks.forEach(d => output += `    - LUN ${d.lun}: ${d.storageAccountType} (${d.diskSizeGB} GB)\n`);
+        }
+        if (results.osRelease?.found) {
+            output += '  Operating System:\n';
+            if (results.osRelease.prettyName) output += `    Distribution: ${results.osRelease.prettyName}\n`;
+            else if (results.osRelease.name) output += `    Distribution: ${results.osRelease.name}\n`;
+            if (results.osRelease.versionId) output += `    Version: ${results.osRelease.versionId}\n`;
+        }
+        output += '\n';
+    }
+
+    // CLUSTER CONFIGURATION
+    const hasCluster = results.corosyncConfig?.found || results.clusterNodes?.found || results.pacemakerResources?.found || results.fencingConfig?.found || results.clusterDaemonStatus?.found || results.clusterMaintenanceMode?.found || results.sbdConfig?.found || results.azureFenceAuth?.found || results.iscsiConfig?.found || (results.azureScheduledEvents?.found && results.azureScheduledEvents?.warnings?.length > 0);
+    if (hasCluster) {
+        output += '-'.repeat(70) + '\n';
+        output += 'CLUSTER CONFIGURATION\n';
+        output += '-'.repeat(70) + '\n';
+        if (results.corosyncConfig?.found) {
+            output += '  Corosync:\n';
+            if (results.corosyncConfig.totemToken) output += `    Token: ${results.corosyncConfig.totemToken}\n`;
+            if (results.corosyncConfig.totemConsensus) output += `    Consensus: ${results.corosyncConfig.totemConsensus}\n`;
+            if (results.corosyncConfig.totemTransport) output += `    Transport: ${results.corosyncConfig.totemTransport}\n`;
+            results.corosyncConfig.warnings?.forEach(w => output += `    [WARN] ${w.message}\n`);
+        }
+        if (results.clusterNodes?.found && results.clusterNodes.nodes?.length > 0) {
+            output += `  Cluster Nodes (${results.clusterNodes.nodes.length}):\n`;
+            results.clusterNodes.nodes.forEach(n => output += `    - ${n.name || n.id}${n.state ? ' (' + n.state + ')' : ''}\n`);
+        }
+        if (results.pacemakerResources?.found && results.pacemakerResources.resources?.length > 0) {
+            output += `  Pacemaker Resources (${results.pacemakerResources.resources.length}):\n`;
+            results.pacemakerResources.resources.slice(0, 15).forEach(r => output += `    - ${r.name}: ${r.type}${r.state ? ' [' + r.state + ']' : ''}\n`);
+            if (results.pacemakerResources.resources.length > 15) output += `    ... and ${results.pacemakerResources.resources.length - 15} more\n`;
+        }
+        if (results.fencingConfig?.found) {
+            output += '  Fencing:\n';
+            if (results.fencingConfig.fenceAgents?.length > 0) output += `    Agents: ${results.fencingConfig.fenceAgents.join(', ')}\n`;
+            results.fencingConfig.warnings?.forEach(w => output += `    [WARN] ${w.message}\n`);
+        }
+        // Cluster maintenance mode
+        if (results.clusterMaintenanceMode?.found) {
+            output += '  Maintenance Mode:\n';
+            const mm = results.clusterMaintenanceMode;
+            output += `    Enabled: ${mm.maintenanceMode ? 'YES' : 'NO'}\n`;
+            if (mm.maintenanceMode) {
+                output += `    [WARN] Cluster is in maintenance mode - no automatic failover!\n`;
+            }
+        }
+        // Azure Fence Authentication
+        if (results.azureFenceAuth?.found) {
+            output += '  Azure Fence Auth:\n';
+            const auth = results.azureFenceAuth;
+            output += `    Method: ${auth.authMethod || 'unknown'}\n`;
+            if (auth.usesServicePrincipal && auth.appId) output += `    App ID: ${auth.appId}\n`;
+            if (auth.usesMsi && auth.msiClientId) output += `    MSI Client ID: ${auth.msiClientId}\n`;
+            auth.warnings?.forEach(w => output += `    [WARN] ${w.message}\n`);
+        }
+        // SBD Configuration
+        if (results.sbdConfig?.found) {
+            output += '  SBD Configuration:\n';
+            const sbd = results.sbdConfig;
+            if (sbd.devices?.length > 0) output += `    Devices: ${sbd.devices.join(', ')}\n`;
+            if (sbd.watchdogDevice) output += `    Watchdog: ${sbd.watchdogDevice}\n`;
+            if (sbd.startmode) output += `    Start Mode: ${sbd.startmode}\n`;
+            sbd.warnings?.forEach(w => output += `    [WARN] ${w.message}\n`);
+        }
+        // iSCSI Configuration
+        if (results.iscsiConfig?.found) {
+            output += '  iSCSI Configuration:\n';
+            const iscsi = results.iscsiConfig;
+            if (iscsi.initiatorName) output += `    Initiator: ${iscsi.initiatorName}\n`;
+            if (iscsi.discoveryServers?.length > 0) output += `    Discovery Servers: ${iscsi.discoveryServers.length}\n`;
+            if (iscsi.sessions?.length > 0) {
+                output += `    Active Sessions: ${iscsi.sessions.length}\n`;
+                iscsi.sessions.forEach(s => {
+                    const state = s.connectionState ? ` [${s.connectionState}]` : '';
+                    output += `      - ${s.ip}:${s.port} ${s.iqn}${state}\n`;
+                });
+            }
+            if (iscsi.targets?.length > 0 && (!iscsi.sessions || iscsi.sessions.length === 0)) {
+                output += `    Configured Targets: ${iscsi.targets.length} (no active sessions!)\n`;
+            }
+            if (iscsi.iscsidConfig?.['node.startup']) output += `    node.startup: ${iscsi.iscsidConfig['node.startup']}\n`;
+            iscsi.warnings?.forEach(w => {
+                const prefix = w.severity === 'error' ? '[ERROR]' : '[WARN]';
+                output += `    ${prefix} ${w.message}\n`;
+            });
+        }
+        // Cluster daemon status (corosync/pacemaker enabled/disabled)
+        if (results.clusterDaemonStatus?.found) {
+            output += '  Daemon Status:\n';
+            const daemons = results.clusterDaemonStatus.daemons;
+            ['corosync', 'pacemaker', 'pcsd'].forEach(daemon => {
+                const d = daemons[daemon];
+                if (d && d.active !== null) {
+                    const status = `${d.active ? 'active' : 'inactive'}/${d.enabled ? 'enabled' : 'disabled'}`;
+                    const marker = (!d.active || !d.enabled) ? '[!]' : '   ';
+                    output += `    ${marker} ${daemon}: ${status}\n`;
+                }
+            });
+            // Show warnings/errors
+            results.clusterDaemonStatus.warnings?.forEach(w => {
+                const prefix = w.severity === 'error' ? '[ERROR]' : '[WARN]';
+                output += `    ${prefix} ${w.message}\n`;
+                if (w.recommendation) output += `            Recommendation: ${w.recommendation}\n`;
+            });
+        }
+        // Azure Scheduled Events (health-azure) configuration
+        if (results.azureScheduledEvents?.found && results.azureScheduledEvents.warnings?.length > 0) {
+            output += '  Azure Scheduled Events:\n';
+            results.azureScheduledEvents.warnings.forEach(w => {
+                const prefix = w.severity === 'error' ? '[ERROR]' : '[WARN]';
+                output += `    ${prefix} ${w.message}\n`;
+                if (w.stoppedResources?.length > 0) {
+                    output += `            Stopped resources: ${w.stoppedResources.slice(0, 5).join(', ')}`;
+                    if (w.stoppedResources.length > 5) output += ` (and ${w.stoppedResources.length - 5} more)`;
+                    output += '\n';
+                }
+                if (w.recommendation) output += `            Recommendation: ${w.recommendation}\n`;
+            });
+        }
+        output += '\n';
+    }
+
+    // DISTRIBUTION
+    const hasDistro = results.rhuiConfig?.found || results.eusVersionLock?.found || results.rhelRhuiCheck?.found || results.cryptoPolicies?.found || results.rhuiErrors?.found || results.distroPackages?.found;
+    if (hasDistro) {
+        output += '-'.repeat(70) + '\n';
+        output += 'DISTRIBUTION\n';
+        output += '-'.repeat(70) + '\n';
+        if (results.rhelRhuiCheck?.found) {
+            output += '  RHUI Package: ';
+            if (results.rhelRhuiCheck.hasRhuiPackage) {
+                output += `${results.rhelRhuiCheck.rhuiPackages?.join(', ') || 'installed'}`;
+                if (results.rhelRhuiCheck.rhuiType) output += ` (${results.rhelRhuiCheck.rhuiType})`;
+            } else output += '[WARN] Not found';
+            output += '\n';
+        }
+        if (results.eusVersionLock?.found) {
+            output += '  EUS Version Lock: ';
+            if (results.eusVersionLock.hasReleaseverFile) output += `${results.eusVersionLock.releasever} (from ${results.eusVersionLock.source})`;
+            else output += 'Not locked';
+            output += '\n';
+        }
+        if (results.cryptoPolicies?.found) {
+            output += `  Crypto Policy: ${results.cryptoPolicies.policy}`;
+            if (!results.cryptoPolicies.isDefault) output += ' (non-default)';
+            output += '\n';
+        }
+        if (results.rhuiConfig?.found && results.rhuiConfig.repos?.length > 0) {
+            const enabled = results.rhuiConfig.repos.filter(r => r.enabled);
+            const eus = enabled.filter(r => r.isEus);
+            output += `  RHUI Repositories: ${enabled.length} enabled`;
+            if (eus.length > 0) output += ` (${eus.length} EUS)`;
+            output += '\n';
+        }
+        if (results.rhuiErrors?.found) {
+            output += '  RHUI Connectivity:\n';
+            if (results.rhuiErrors.hasCertExpiration) output += '    [ERROR] Certificate Expiration Detected\n';
+            if (results.rhuiErrors.hasHttp403) output += '    [ERROR] HTTP 403 Errors (likely expired certificate)\n';
+            if (results.rhuiErrors.hasHttp400) output += '    [WARN] HTTP 400 Errors (EUS version may be unavailable)\n';
+            if (results.rhuiErrors.hasConnectionError) output += '    [WARN] Connection Errors\n';
+            if (results.rhuiErrors.affectedRepos?.length > 0) output += `    Affected repos: ${results.rhuiErrors.affectedRepos.join(', ')}\n`;
+            if (results.rhuiErrors.errors?.length > 0) output += `    Total errors: ${results.rhuiErrors.errors.length}\n`;
+            results.rhuiErrors.warnings?.forEach(w => {
+                output += `    [WARN] ${w.message}\n`;
+                if (w.recommendation) output += `           Recommendation: ${w.recommendation}\n`;
+            });
+        }
+        if (results.distroPackages?.found) {
+            output += `  Packages: ${results.distroPackages.packageCount || Object.keys(results.distroPackages.packages || {}).length} installed\n`;
+            results.distroPackages.warnings?.forEach(w => output += `    [WARN] ${w.package}: ${w.message}\n`);
+        }
+        output += '\n';
+    }
+
+    // STORAGE
+    const hasStorage = results.lvmConfig?.found || results.raidConfig?.found || results.btrfsConfig?.found || results.fstab?.found || results.blockDevices?.found || results.storageCorrelation?.found || results.mtabAnalysis?.found;
+    if (hasStorage) {
+        output += '-'.repeat(70) + '\n';
+        output += 'STORAGE\n';
+        output += '-'.repeat(70) + '\n';
+        
+        // Block Devices
+        if (results.blockDevices?.found) {
+            const disks = results.blockDevices.disks || [];
+            const parts = results.blockDevices.partitions || [];
+            if (disks.length > 0 || parts.length > 0) {
+                output += `  Block Devices: ${disks.length} disk(s), ${parts.length} partition(s)\n`;
+                disks.forEach(d => {
+                    output += `    - ${d.name}: ${d.size || 'unknown size'}`;
+                    if (d.model) output += ` (${d.model})`;
+                    output += '\n';
+                });
+            }
+        }
+        
+        if (results.lvmConfig?.found) {
+            output += '  LVM:\n';
+            if (results.lvmConfig.pvs?.length > 0) output += `    Physical Volumes: ${results.lvmConfig.pvs.length}\n`;
+            if (results.lvmConfig.vgs?.length > 0) output += `    Volume Groups: ${results.lvmConfig.vgs.length}\n`;
+            if (results.lvmConfig.lvs?.length > 0) output += `    Logical Volumes: ${results.lvmConfig.lvs.length}\n`;
+        }
+        if (results.raidConfig?.found && results.raidConfig.arrays?.length > 0) {
+            output += `  RAID Arrays (${results.raidConfig.arrays.length}):\n`;
+            results.raidConfig.arrays.forEach(a => output += `    - ${a.device}: ${a.level} (${a.state})\n`);
+            results.raidConfig.warnings?.forEach(w => output += `    [WARN] ${w.message}\n`);
+        }
+        if (results.btrfsConfig?.found) {
+            if (results.btrfsConfig.filesystems?.length > 0) output += `  BTRFS Filesystems: ${results.btrfsConfig.filesystems.length}\n`;
+            if (results.btrfsConfig.subvolumes?.length > 0) output += `  BTRFS Subvolumes: ${results.btrfsConfig.subvolumes.length}\n`;
+        }
+        if (results.fstab?.found && results.fstab.entries?.length > 0) {
+            output += `  Fstab Entries: ${results.fstab.entries.length}\n`;
+            results.fstab.warnings?.forEach(w => output += `    [WARN] ${w.message}\n`);
+        }
+        
+        // Storage Correlation (UUID checks)
+        if (results.storageCorrelation?.found) {
+            const errors = results.storageCorrelation.errors || [];
+            const warnings = results.storageCorrelation.warnings || [];
+            if (errors.length > 0 || warnings.length > 0) {
+                output += '  Fstab/UUID Correlation:\n';
+                errors.forEach(e => {
+                    output += `    [ERROR] ${e.mountpoint}: UUID ${e.uuid} not found on any device\n`;
+                    if (e.expectedFstype) output += `            Expected filesystem: ${e.expectedFstype}\n`;
+                });
+                warnings.forEach(w => {
+                    output += `    [WARN] ${w.mountpoint}: ${w.message}\n`;
+                });
+            }
+        }
+
+        // Mtab / Fstab comparison
+        if (results.mtabAnalysis?.found) {
+            const extraMounts = results.mtabAnalysis.extraMounts || [];
+            const realCount = results.mtabAnalysis.realMounts ?? results.mtabAnalysis.entries?.length ?? 0;
+            const virtualCount = results.mtabAnalysis.virtualMounts ?? 0;
+            output += `  Mounted Filesystems (mtab): ${realCount} real mount(s)`;
+            if (virtualCount > 0) {
+                output += ` (${virtualCount} virtual/autofs excluded)`;
+            }
+            output += `\n`;
+            if (extraMounts.length > 0) {
+                output += `  Mounts NOT in fstab (${extraMounts.length}):\n`;
+                extraMounts.forEach(m => {
+                    output += `    [WARN] ${m.mountpoint} <- ${m.source} (${m.fstype})\n`;
+                    output += `           ${m.reason}\n`;
+                });
+            }
+            const autofsMounts = results.mtabAnalysis.autofsMounts || [];
+            if (autofsMounts.length > 0) {
+                output += `  Autofs Mounts (${autofsMounts.length} automounter entries):\n`;
+                autofsMounts.forEach(m => {
+                    output += `    [AUTO] ${m.mountpoint} <- ${m.source} (${m.options})\n`;
+                });
+            }
+        }
+        output += '\n';
+    }
+
+    // EVENTS
+    const hasEvents = results.liveMigration?.count > 0 || results.kernelReboots?.count > 0 || results.oomKiller?.count > 0 || results.xfsErrors?.count > 0 || results.clusterEvents?.count > 0 || results.emergencyMode?.found;
+    if (hasEvents) {
+        output += '-'.repeat(70) + '\n';
+        output += 'EVENTS\n';
+        output += '-'.repeat(70) + '\n';
+        if (results.liveMigration?.count > 0) {
+            output += `  Live Migration: ${results.liveMigration.count} event(s)\n`;
+            results.liveMigration.events?.slice(0, 5).forEach(e => output += `    - ${e.timestamp}: ${e.type || 'migration'}\n`);
+            if (results.liveMigration.events?.length > 5) output += `    ... and ${results.liveMigration.events.length - 5} more\n`;
+        }
+        if (results.kernelReboots?.count > 0) {
+            output += `  Kernel Reboots: ${results.kernelReboots.count} event(s)\n`;
+            results.kernelReboots.events?.slice(0, 5).forEach(e => output += `    - ${e.timestamp}: ${e.type || 'reboot'}\n`);
+            if (results.kernelReboots.events?.length > 5) output += `    ... and ${results.kernelReboots.events.length - 5} more\n`;
+        }
+        if (results.oomKiller?.count > 0) {
+            output += `  [WARN] OOM Killer: ${results.oomKiller.count} event(s)\n`;
+            results.oomKiller.events?.slice(0, 5).forEach(e => output += `    - ${e.timestamp}: ${e.process || 'killed'}\n`);
+        }
+        if (results.xfsErrors?.count > 0) {
+            output += `  [ERROR] XFS Errors: ${results.xfsErrors.count} event(s)\n`;
+            results.xfsErrors.events?.slice(0, 5).forEach(e => output += `    - ${e.timestamp}: ${e.message || e.type || 'error'}\n`);
+        }
+        if (results.clusterEvents?.count > 0) output += `  Cluster Events: ${results.clusterEvents.count} event(s)\n`;
+        if (results.emergencyMode?.found) {
+            output += '  [WARN] Emergency Mode: Detected\n';
+            if (results.emergencyMode.reason) output += `    Reason: ${results.emergencyMode.reason}\n`;
+        }
+        output += '\n';
+    }
+
+    // KERNEL AND SYSTEM
+    const hasKernel = results.kernelTuning?.found || results.hugePages?.found;
+    if (hasKernel) {
+        output += '-'.repeat(70) + '\n';
+        output += 'KERNEL AND SYSTEM\n';
+        output += '-'.repeat(70) + '\n';
+        if (results.kernelTuning?.found) {
+            if (results.kernelTuning.params && Object.keys(results.kernelTuning.params).length > 0) {
+                output += '  Kernel Parameters:\n';
+                ['vm.swappiness', 'net.ipv4.tcp_keepalive_time', 'kernel.sched_migration_cost_ns'].forEach(p => {
+                    if (results.kernelTuning.params[p] !== undefined) output += `    ${p} = ${results.kernelTuning.params[p]}\n`;
+                });
+            }
+            results.kernelTuning.warnings?.forEach(w => output += `    [WARN] ${w.message}\n`);
+        }
+        if (results.hugePages?.found) {
+            output += '  Huge Pages:\n';
+            if (results.hugePages.staticHugePages) output += `    Static: ${results.hugePages.staticHugePages.total_mb || 0} MB\n`;
+            if (results.hugePages.transparentHugePages?.anon_mb > 0) output += `    Transparent: ${results.hugePages.transparentHugePages.anon_mb} MB\n`;
+            results.hugePages.recommendations?.forEach(r => output += `    [INFO] ${r.message}\n`);
+        }
+        output += '\n';
+    }
+
+    // SECURITY
+    const hasSecurity = results.falconSensor?.found || results.msDefender?.found || results.trendMicro?.found || results.illumio?.found || results.guardicoreAgent?.found;
+    if (hasSecurity) {
+        output += '-'.repeat(70) + '\n';
+        output += 'SECURITY\n';
+        output += '-'.repeat(70) + '\n';
+        if (results.falconSensor?.found) {
+            output += `  CrowdStrike Falcon: ${results.falconSensor.installed ? 'Installed' : 'Detected'}`;
+            if (results.falconSensor.version) output += ` (v${results.falconSensor.version})`;
+            output += '\n';
+        }
+        if (results.msDefender?.found) {
+            output += `  Microsoft Defender: ${results.msDefender.installed ? 'Installed' : 'Detected'}`;
+            if (results.msDefender.version) output += ` (v${results.msDefender.version})`;
+            output += '\n';
+        }
+        if (results.trendMicro?.found) output += '  Trend Micro: Detected\n';
+        if (results.illumio?.found) output += '  Illumio: Detected\n';
+        if (results.guardicoreAgent?.found) output += '  Guardicore: Detected\n';
+        output += '\n';
+    }
+
+    // AZURE SITE RECOVERY
+    if (results.azureSiteRecovery?.found || results.involfltVersion?.found) {
+        output += '-'.repeat(70) + '\n';
+        output += 'AZURE SITE RECOVERY\n';
+        output += '-'.repeat(70) + '\n';
+        if (results.azureSiteRecovery?.found) {
+            output += `  ASR Agent: ${results.azureSiteRecovery.installed ? 'Installed' : 'Detected'}`;
+            if (results.azureSiteRecovery.status) output += ` (${results.azureSiteRecovery.status})`;
+            output += '\n';
+        }
+        if (results.involfltVersion?.found) output += `  InMage/Involflt: ${results.involfltVersion.version || 'Detected'}\n`;
+        if (results.involfltKernelVersion?.found) output += `  Involflt Kernel: ${results.involfltKernelVersion.version || 'Detected'}\n`;
+        output += '\n';
+    }
+
+    // NETWORKING
+    if (results.hostsFile?.found || results.sshService?.found || results.firewallRules?.found || results.networkInterfaces?.found) {
+        output += '-'.repeat(70) + '\n';
+        output += 'NETWORKING\n';
+        output += '-'.repeat(70) + '\n';
+
+        // Network Interfaces
+        if (results.networkInterfaces?.found) {
+            const ni = results.networkInterfaces;
+            const ifaces = Object.values(ni.interfaces || {}).filter(i => i.name !== 'lo');
+            const hasAccelNet = ifaces.some(i => i.accelNet);
+            output += `  Network Interfaces: ${ifaces.length} interface(s)${hasAccelNet ? ' [Accelerated Networking detected]' : ''}\n`;
+            for (const iface of ifaces) {
+                const ipv4 = (iface.ipv4 || []).map(ip => ip.address + (ip.prefix ? '/' + ip.prefix : '')).join(', ') || '-';
+                const driver = iface.driver || '-';
+                const bootproto = iface.bootproto ? iface.bootproto.toUpperCase() : '-';
+                let accelLabel = '-';
+                if (iface.accelNet) {
+                    accelLabel = iface.driver === 'mana' ? 'MANA' : 'Yes';
+                } else if (iface.driver === 'hv_netvsc') {
+                    const linkedIface = ifaces.find(s => s.master === iface.name && s.accelNet);
+                    accelLabel = linkedIface ? `Yes (via ${linkedIface.name})` : 'No';
+                }
+                output += `    ${iface.name}: ${iface.state || '-'} | ${ipv4} | MAC: ${iface.mac || '-'} | MTU: ${iface.mtu || '-'} | ${bootproto} | Driver: ${driver} | AccelNet: ${accelLabel}\n`;
+                if (iface.master) output += `      (linked to ${iface.master})\n`;
+            }
+        }
+
+        if (results.hostsFile?.found && results.hostsFile.entries?.length > 0) output += `  Hosts File: ${results.hostsFile.entries.length} entries\n`;
+        if (results.sshService?.found) {
+            output += `  SSH Service: ${results.sshService.status || 'Detected'}\n`;
+            results.sshService.warnings?.forEach(w => output += `    [WARN] ${w.message}\n`);
+        }
+
+        // Firewall Rules
+        if (results.firewallRules?.found) {
+            const fw = results.firewallRules;
+            output += `  Firewall (active: ${fw.activeFirewall || 'none'}):\n`;
+
+            // Warnings
+            fw.warnings?.forEach(w => output += `    [WARN] ${w}\n`);
+
+            // firewalld
+            if (fw.firewalld?.detected) {
+                const status = fw.firewalld.running ? 'RUNNING' : 'not running';
+                output += `    firewalld: ${status}`;
+                if (fw.firewalld.backend) output += ` (backend: ${fw.firewalld.backend})`;
+                output += '\n';
+                if (fw.firewalld.config) {
+                    const cfg = fw.firewalld.config;
+                    if (cfg.DefaultZone) output += `      DefaultZone: ${cfg.DefaultZone}\n`;
+                    if (cfg.LogDenied) output += `      LogDenied: ${cfg.LogDenied}\n`;
+                    if (cfg.AllowZoneDrifting) output += `      AllowZoneDrifting: ${cfg.AllowZoneDrifting}\n`;
+                }
+                if (fw.firewalld.zones && !fw.firewalld.zones.includes('FirewallD is not running')) {
+                    output += '      Zones:\n';
+                    fw.firewalld.zones.split('\n').forEach(l => output += `        ${l}\n`);
+                }
+                if (fw.firewalld.directRules?.trim()) {
+                    output += '      Direct Rules:\n';
+                    fw.firewalld.directRules.trim().split('\n').forEach(l => output += `        ${l}\n`);
+                }
+            }
+
+            // nftables
+            if (fw.nftables?.detected) {
+                const hasRules = fw.nftables.ruleset && fw.nftables.ruleset !== '(empty)' && fw.nftables.ruleset.length > 10;
+                output += `    nftables: ${hasRules ? 'rules present' : 'no rules'}\n`;
+                if (fw.nftables.tables) output += `      Tables: ${fw.nftables.tables}\n`;
+                if (hasRules) {
+                    output += '      Ruleset:\n';
+                    fw.nftables.ruleset.split('\n').forEach(l => output += `        ${l}\n`);
+                }
+            }
+
+            // iptables
+            if (fw.iptables?.detected) {
+                const hasRules = fw.iptables.rules?.length > 0;
+                const allUnloaded = fw.iptables.modules?.length > 0 && !hasRules;
+                output += `    iptables: ${hasRules ? fw.iptables.rules.length + ' table(s) with rules' : allUnloaded ? 'modules not loaded' : 'no rules'}\n`;
+                if (hasRules) {
+                    fw.iptables.rules.forEach(r => {
+                        output += `      [${r.heading}]\n`;
+                        r.raw.split('\n').forEach(l => output += `        ${l}\n`);
+                    });
+                }
+                if (allUnloaded) {
+                    fw.iptables.modules.forEach(m => output += `      ${m.module}: not loaded\n`);
+                }
+            }
+
+            // ip6tables
+            if (fw.ip6tables?.detected) {
+                const hasRules = fw.ip6tables.rules?.length > 0;
+                const allUnloaded = fw.ip6tables.modules?.length > 0 && !hasRules;
+                output += `    ip6tables: ${hasRules ? fw.ip6tables.rules.length + ' table(s) with rules' : allUnloaded ? 'modules not loaded' : 'no rules'}\n`;
+                if (hasRules) {
+                    fw.ip6tables.rules.forEach(r => {
+                        output += `      [${r.heading}]\n`;
+                        r.raw.split('\n').forEach(l => output += `        ${l}\n`);
+                    });
+                }
+                if (allUnloaded) {
+                    fw.ip6tables.modules.forEach(m => output += `      ${m.module}: not loaded\n`);
+                }
+            }
+
+            // ebtables
+            if (fw.ebtables?.detected) {
+                output += '    ebtables: config present\n';
+            }
+        }
+        output += '\n';
+    }
+
+    // KERNEL CRASH DUMPS (vmcore)
+    if (results.vmcore?.found && results.vmcore.crashes?.length > 0) {
+        output += '-'.repeat(70) + '\n';
+        output += 'KERNEL CRASH DUMPS\n';
+        output += '-'.repeat(70) + '\n';
+        const vc = results.vmcore;
+        if (vc.kdumpStatus) {
+            output += `  Kdump: ${vc.kdumpStatus.raw}\n`;
+        }
+        output += `  Crash dumps found: ${vc.crashes.length}\n`;
+        vc.crashes.forEach(crash => {
+            output += `\n  [${crash.date || 'unknown date'}]\n`;
+            output += `    Panic: ${crash.panicReason || 'unknown'}\n`;
+            if (crash.kernelVersion) output += `    Kernel: ${crash.kernelVersion}\n`;
+            if (crash.comm) output += `    Process: ${crash.comm} (PID ${crash.pid || '-'})\n`;
+            // Show vmcore size if available
+            if (vc.crashListing?.entries) {
+                const entry = vc.crashListing.entries.find(e => e.crashDate === crash.date);
+                if (entry) {
+                    output += `    Vmcore size: ${entry.sizeGB >= 1.0 ? entry.sizeGB + ' GB' : entry.sizeMB + ' MB'}\n`;
+                }
+            }
+            if (crash.callTrace?.length > 0) {
+                output += `    Call Trace (${crash.callTrace.length} frames):\n`;
+                crash.callTrace.slice(0, 10).forEach(frame => {
+                    output += `      ${frame}\n`;
+                });
+                if (crash.callTrace.length > 10) {
+                    output += `      ... (${crash.callTrace.length - 10} more frames)\n`;
+                }
+            }
+        });
+        if (vc.crashListing) {
+            output += `\n  Total vmcore disk usage: ${vc.crashListing.totalGB} GB across ${vc.crashListing.count} dump(s)\n`;
+        }
+        output += '\n';
+    }
+
+    // APPLICATIONS (SAP)
+    if (results.basicEnvironment?.found && (results.basicEnvironment.sapProductDetected || results.basicEnvironment.epicProductDetected)) {
+        output += '-'.repeat(70) + '\n';
+        output += 'APPLICATIONS\n';
+        output += '-'.repeat(70) + '\n';
+        if (results.basicEnvironment.sapProductDetected) output += '  SAP: Detected\n';
+        if (results.basicEnvironment.epicProductDetected) output += '  SAP EPIC: Detected\n';
+        output += '\n';
+    }
+
+    // DEBUGFS (ADVANCED)
+    const hasHvBalloon = results.hvBalloon?.found;
+    const hasExtfrag = results.extfrag?.found;
+    if (hasHvBalloon || hasExtfrag) {
+        output += '-'.repeat(70) + '\n';
+        output += 'DEBUGFS (ADVANCED)\n';
+        output += '-'.repeat(70) + '\n';
+
+        if (hasHvBalloon) {
+            const hv = results.hvBalloon;
+            output += '  Hyper-V Dynamic Memory (hv-balloon)\n';
+            if (hv.hostVersion) output += `    Host version: ${hv.hostVersion}\n`;
+            if (hv.capabilities) output += `    Capabilities: ${hv.capabilities}\n`;
+            if (hv.state !== null) output += `    State: ${hv.state} (${hv.stateText || 'Unknown'})\n`;
+            output += `    Committed memory: ${hv.committedMemoryGB} GB (${hv.totalPagesCommitted.toLocaleString()} pages)\n`;
+            output += `    Max dynamic memory: ${hv.maxDynamicMemoryGB} GB (${hv.maxDynamicPageCount.toLocaleString()} pages)\n`;
+            output += `    Ballooned memory: ${hv.balloonedMemoryMB} MB (${hv.pagesBallooned.toLocaleString()} pages)\n`;
+            output += `    Pages added: ${hv.pagesAdded.toLocaleString()}\n`;
+            output += `    Pages onlined: ${hv.pagesOnlined.toLocaleString()}\n`;
+            if (hv.maxDynamicMemoryGB > 0) {
+                const usagePct = Math.round((hv.committedMemoryGB / hv.maxDynamicMemoryGB) * 100);
+                output += `    Memory utilization: ${usagePct}%\n`;
+            }
+            if (hv.warnings.length > 0) {
+                hv.warnings.forEach(w => {
+                    output += `    [!] ${w}\n`;
+                });
+            }
+            output += '\n';
+        }
+
+        if (hasExtfrag) {
+            const ef = results.extfrag;
+            const orderLabels = ['4K', '8K', '16K', '32K', '64K', '128K', '256K', '512K', '1M', '2M', '4M'];
+            output += '  Memory Fragmentation Index\n';
+            ef.zones.forEach(zone => {
+                output += `    Node ${zone.node}, zone ${zone.zone}\n`;
+                if (zone.unusableIndex && zone.unusableIndex.length > 0) {
+                    output += '      Unusable: ';
+                    output += zone.unusableIndex.map((v, i) => {
+                        const label = i < orderLabels.length ? orderLabels[i] : 'o' + i;
+                        return label + '=' + v.toFixed(3);
+                    }).join('  ');
+                    output += '\n';
+                }
+                if (zone.extfragIndex && zone.extfragIndex.length > 0) {
+                    output += '      Extfrag: ';
+                    output += zone.extfragIndex.map((v, i) => {
+                        const label = i < orderLabels.length ? orderLabels[i] : 'o' + i;
+                        return label + '=' + v.toFixed(3);
+                    }).join('  ');
+                    output += '\n';
+                }
+            });
+            if (ef.warnings.length > 0) {
+                ef.warnings.forEach(w => {
+                    output += `    [!] ${w}\n`;
+                });
+            }
+            output += '\n';
+        }
+    }
+
+    output += '='.repeat(70) + '\n';
+    return output;
+}
+
+async function main() {
+    const options = parseArgs();
+
+    // Enable debug mode globally
+    if (options.debug) {
+        global.DEBUG_MODE = true;
+    }
+
+    // Load parsers
+    await loadParsers();
+
+    if (options.help) {
+        showHelp();
+        process.exit(0);
+    }
+
+    if (options.listParsers) {
+        listParsers();
+        process.exit(0);
+    }
+
+    if (!options.file) {
+        console.error('Error: No input file specified\n');
+        showHelp();
+        process.exit(1);
+    }
+
+    // Check file exists
+    if (!fs.existsSync(options.file)) {
+        console.error(`Error: File not found: ${options.file}`);
+        process.exit(1);
+    }
+
+    try {
+        console.error(`\nAnalyzing: ${options.file}\n`);
+        
+        const results = await processArchive(options.file, {
+            debug: options.debug,
+            performance: options.performance,
+            parserFilter: options.parser
+        });
+
+        // Print performance report if requested
+        if (options.performance && results._performanceData) {
+            const memoryMB = process.memoryUsage().heapUsed / (1024 * 1024);
+            console.error(formatPerformanceReport(results._performanceData, memoryMB));
+            delete results._performanceData;
+        }
+
+        // Extract to files if requested
+        if (options.extract) {
+            const count = extractResults(results, options.extract);
+            console.error(`Extracted ${count} result files to: ${options.extract}\n`);
+        }
+
+        const output = formatResults(results, options);
+        console.log(output);
+
+    } catch (error) {
+        console.error(`Error processing file: ${error.message}`);
+        if (options.debug) {
+            console.error(error.stack);
+        }
+        process.exit(1);
+    }
+}
+
+main();
diff --git a/rca-tool/cli/package-lock.json b/rca-tool/cli/package-lock.json
new file mode 100644
index 0000000..57f7bf6
--- /dev/null
+++ b/rca-tool/cli/package-lock.json
@@ -0,0 +1,674 @@
+{
+  "name": "rca-cli",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "rca-cli",
+      "version": "1.0.0",
+      "dependencies": {
+        "lzma-native": "^8.0.6",
+        "tar-stream": "^3.1.7"
+      },
+      "bin": {
+        "rca-cli": "cli.js",
+        "rca-cli-bundled": "dist/rca-cli.cjs"
+      },
+      "devDependencies": {
+        "esbuild": "^0.27.2"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/@esbuild/aix-ppc64": {
+      "version": "0.27.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.2.tgz",
+      "integrity": "sha512-GZMB+a0mOMZs4MpDbj8RJp4cw+w1WV5NYD6xzgvzUJ5Ek2jerwfO2eADyI6ExDSUED+1X8aMbegahsJi+8mgpw==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm": {
+      "version": "0.27.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.27.2.tgz",
+      "integrity": "sha512-DVNI8jlPa7Ujbr1yjU2PfUSRtAUZPG9I1RwW4F4xFB1Imiu2on0ADiI/c3td+KmDtVKNbi+nffGDQMfcIMkwIA==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm64": {
+      "version": "0.27.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.27.2.tgz",
+      "integrity": "sha512-pvz8ZZ7ot/RBphf8fv60ljmaoydPU12VuXHImtAs0XhLLw+EXBi2BLe3OYSBslR4rryHvweW5gmkKFwTiFy6KA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-x64": {
+      "version": "0.27.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.27.2.tgz",
+      "integrity": "sha512-z8Ank4Byh4TJJOh4wpz8g2vDy75zFL0TlZlkUkEwYXuPSgX8yzep596n6mT7905kA9uHZsf/o2OJZubl2l3M7A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-arm64": {
+      "version": "0.27.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.27.2.tgz",
+      "integrity": "sha512-davCD2Zc80nzDVRwXTcQP/28fiJbcOwvdolL0sOiOsbwBa72kegmVU0Wrh1MYrbuCL98Omp5dVhQFWRKR2ZAlg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-x64": {
+      "version": "0.27.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.27.2.tgz",
+      "integrity": "sha512-ZxtijOmlQCBWGwbVmwOF/UCzuGIbUkqB1faQRf5akQmxRJ1ujusWsb3CVfk/9iZKr2L5SMU5wPBi1UWbvL+VQA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.27.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.27.2.tgz",
+      "integrity": "sha512-lS/9CN+rgqQ9czogxlMcBMGd+l8Q3Nj1MFQwBZJyoEKI50XGxwuzznYdwcav6lpOGv5BqaZXqvBSiB/kJ5op+g==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-x64": {
+      "version": "0.27.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.27.2.tgz",
+      "integrity": "sha512-tAfqtNYb4YgPnJlEFu4c212HYjQWSO/w/h/lQaBK7RbwGIkBOuNKQI9tqWzx7Wtp7bTPaGC6MJvWI608P3wXYA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm": {
+      "version": "0.27.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.27.2.tgz",
+      "integrity": "sha512-vWfq4GaIMP9AIe4yj1ZUW18RDhx6EPQKjwe7n8BbIecFtCQG4CfHGaHuh7fdfq+y3LIA2vGS/o9ZBGVxIDi9hw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm64": {
+      "version": "0.27.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.27.2.tgz",
+      "integrity": "sha512-hYxN8pr66NsCCiRFkHUAsxylNOcAQaxSSkHMMjcpx0si13t1LHFphxJZUiGwojB1a/Hd5OiPIqDdXONia6bhTw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ia32": {
+      "version": "0.27.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.27.2.tgz",
+      "integrity": "sha512-MJt5BRRSScPDwG2hLelYhAAKh9imjHK5+NE/tvnRLbIqUWa+0E9N4WNMjmp/kXXPHZGqPLxggwVhz7QP8CTR8w==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-loong64": {
+      "version": "0.27.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.27.2.tgz",
+      "integrity": "sha512-lugyF1atnAT463aO6KPshVCJK5NgRnU4yb3FUumyVz+cGvZbontBgzeGFO1nF+dPueHD367a2ZXe1NtUkAjOtg==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-mips64el": {
+      "version": "0.27.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.27.2.tgz",
+      "integrity": "sha512-nlP2I6ArEBewvJ2gjrrkESEZkB5mIoaTswuqNFRv/WYd+ATtUpe9Y09RnJvgvdag7he0OWgEZWhviS1OTOKixw==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ppc64": {
+      "version": "0.27.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.27.2.tgz",
+      "integrity": "sha512-C92gnpey7tUQONqg1n6dKVbx3vphKtTHJaNG2Ok9lGwbZil6DrfyecMsp9CrmXGQJmZ7iiVXvvZH6Ml5hL6XdQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-riscv64": {
+      "version": "0.27.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.27.2.tgz",
+      "integrity": "sha512-B5BOmojNtUyN8AXlK0QJyvjEZkWwy/FKvakkTDCziX95AowLZKR6aCDhG7LeF7uMCXEJqwa8Bejz5LTPYm8AvA==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-s390x": {
+      "version": "0.27.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.27.2.tgz",
+      "integrity": "sha512-p4bm9+wsPwup5Z8f4EpfN63qNagQ47Ua2znaqGH6bqLlmJ4bx97Y9JdqxgGZ6Y8xVTixUnEkoKSHcpRlDnNr5w==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-x64": {
+      "version": "0.27.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.27.2.tgz",
+      "integrity": "sha512-uwp2Tip5aPmH+NRUwTcfLb+W32WXjpFejTIOWZFw/v7/KnpCDKG66u4DLcurQpiYTiYwQ9B7KOeMJvLCu/OvbA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.27.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.27.2.tgz",
+      "integrity": "sha512-Kj6DiBlwXrPsCRDeRvGAUb/LNrBASrfqAIok+xB0LxK8CHqxZ037viF13ugfsIpePH93mX7xfJp97cyDuTZ3cw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-x64": {
+      "version": "0.27.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.27.2.tgz",
+      "integrity": "sha512-HwGDZ0VLVBY3Y+Nw0JexZy9o/nUAWq9MlV7cahpaXKW6TOzfVno3y3/M8Ga8u8Yr7GldLOov27xiCnqRZf0tCA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.27.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.27.2.tgz",
+      "integrity": "sha512-DNIHH2BPQ5551A7oSHD0CKbwIA/Ox7+78/AWkbS5QoRzaqlev2uFayfSxq68EkonB+IKjiuxBFoV8ESJy8bOHA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-x64": {
+      "version": "0.27.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.27.2.tgz",
+      "integrity": "sha512-/it7w9Nb7+0KFIzjalNJVR5bOzA9Vay+yIPLVHfIQYG/j+j9VTH84aNB8ExGKPU4AzfaEvN9/V4HV+F+vo8OEg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openharmony-arm64": {
+      "version": "0.27.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.27.2.tgz",
+      "integrity": "sha512-LRBbCmiU51IXfeXk59csuX/aSaToeG7w48nMwA6049Y4J4+VbWALAuXcs+qcD04rHDuSCSRKdmY63sruDS5qag==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/sunos-x64": {
+      "version": "0.27.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.27.2.tgz",
+      "integrity": "sha512-kMtx1yqJHTmqaqHPAzKCAkDaKsffmXkPHThSfRwZGyuqyIeBvf08KSsYXl+abf5HDAPMJIPnbBfXvP2ZC2TfHg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-arm64": {
+      "version": "0.27.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.27.2.tgz",
+      "integrity": "sha512-Yaf78O/B3Kkh+nKABUF++bvJv5Ijoy9AN1ww904rOXZFLWVc5OLOfL56W+C8F9xn5JQZa3UX6m+IktJnIb1Jjg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-ia32": {
+      "version": "0.27.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.27.2.tgz",
+      "integrity": "sha512-Iuws0kxo4yusk7sw70Xa2E2imZU5HoixzxfGCdxwBdhiDgt9vX9VUCBhqcwY7/uh//78A1hMkkROMJq9l27oLQ==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-x64": {
+      "version": "0.27.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.27.2.tgz",
+      "integrity": "sha512-sRdU18mcKf7F+YgheI/zGf5alZatMUTKj/jNS6l744f9u3WFu4v7twcUI9vu4mknF4Y9aDlblIie0IM+5xxaqQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/b4a": {
+      "version": "1.7.3",
+      "resolved": "https://registry.npmjs.org/b4a/-/b4a-1.7.3.tgz",
+      "integrity": "sha512-5Q2mfq2WfGuFp3uS//0s6baOJLMoVduPYVeNmDYxu5OUA1/cBfvr2RIS7vi62LdNj/urk1hfmj867I3qt6uZ7Q==",
+      "license": "Apache-2.0",
+      "peerDependencies": {
+        "react-native-b4a": "*"
+      },
+      "peerDependenciesMeta": {
+        "react-native-b4a": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/bare-events": {
+      "version": "2.8.2",
+      "resolved": "https://registry.npmjs.org/bare-events/-/bare-events-2.8.2.tgz",
+      "integrity": "sha512-riJjyv1/mHLIPX4RwiK+oW9/4c3TEUeORHKefKAKnZ5kyslbN+HXowtbaVEqt4IMUB7OXlfixcs6gsFeo/jhiQ==",
+      "license": "Apache-2.0",
+      "peerDependencies": {
+        "bare-abort-controller": "*"
+      },
+      "peerDependenciesMeta": {
+        "bare-abort-controller": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/esbuild": {
+      "version": "0.27.2",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.2.tgz",
+      "integrity": "sha512-HyNQImnsOC7X9PMNaCIeAm4ISCQXs5a5YasTXVliKv4uuBo1dKrG0A+uQS8M5eXjVMnLg3WgXaKvprHlFJQffw==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.27.2",
+        "@esbuild/android-arm": "0.27.2",
+        "@esbuild/android-arm64": "0.27.2",
+        "@esbuild/android-x64": "0.27.2",
+        "@esbuild/darwin-arm64": "0.27.2",
+        "@esbuild/darwin-x64": "0.27.2",
+        "@esbuild/freebsd-arm64": "0.27.2",
+        "@esbuild/freebsd-x64": "0.27.2",
+        "@esbuild/linux-arm": "0.27.2",
+        "@esbuild/linux-arm64": "0.27.2",
+        "@esbuild/linux-ia32": "0.27.2",
+        "@esbuild/linux-loong64": "0.27.2",
+        "@esbuild/linux-mips64el": "0.27.2",
+        "@esbuild/linux-ppc64": "0.27.2",
+        "@esbuild/linux-riscv64": "0.27.2",
+        "@esbuild/linux-s390x": "0.27.2",
+        "@esbuild/linux-x64": "0.27.2",
+        "@esbuild/netbsd-arm64": "0.27.2",
+        "@esbuild/netbsd-x64": "0.27.2",
+        "@esbuild/openbsd-arm64": "0.27.2",
+        "@esbuild/openbsd-x64": "0.27.2",
+        "@esbuild/openharmony-arm64": "0.27.2",
+        "@esbuild/sunos-x64": "0.27.2",
+        "@esbuild/win32-arm64": "0.27.2",
+        "@esbuild/win32-ia32": "0.27.2",
+        "@esbuild/win32-x64": "0.27.2"
+      }
+    },
+    "node_modules/events-universal": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/events-universal/-/events-universal-1.0.1.tgz",
+      "integrity": "sha512-LUd5euvbMLpwOF8m6ivPCbhQeSiYVNb8Vs0fQ8QjXo0JTkEHpz8pxdQf0gStltaPpw0Cca8b39KxvK9cfKRiAw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "bare-events": "^2.7.0"
+      }
+    },
+    "node_modules/fast-fifo": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/fast-fifo/-/fast-fifo-1.3.2.tgz",
+      "integrity": "sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ==",
+      "license": "MIT"
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "license": "ISC"
+    },
+    "node_modules/lzma-native": {
+      "version": "8.0.6",
+      "resolved": "https://registry.npmjs.org/lzma-native/-/lzma-native-8.0.6.tgz",
+      "integrity": "sha512-09xfg67mkL2Lz20PrrDeNYZxzeW7ADtpYFbwSQh9U8+76RIzx5QsJBMy8qikv3hbUPfpy6hqwxt6FcGK81g9AA==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "dependencies": {
+        "node-addon-api": "^3.1.0",
+        "node-gyp-build": "^4.2.1",
+        "readable-stream": "^3.6.0"
+      },
+      "bin": {
+        "lzmajs": "bin/lzmajs"
+      },
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
+    "node_modules/node-addon-api": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-3.2.1.tgz",
+      "integrity": "sha512-mmcei9JghVNDYydghQmeDX8KoAm0FAiYyIcUt/N4nhyAipB17pllZQDOJD2fotxABnt4Mdz+dKTO7eftLg4d0A==",
+      "license": "MIT"
+    },
+    "node_modules/node-gyp-build": {
+      "version": "4.8.4",
+      "resolved": "https://registry.npmjs.org/node-gyp-build/-/node-gyp-build-4.8.4.tgz",
+      "integrity": "sha512-LA4ZjwlnUblHVgq0oBF3Jl/6h/Nvs5fzBLwdEF4nuxnFdsfajde4WfxtJr3CaiH+F6ewcIB/q4jQ4UzPyid+CQ==",
+      "license": "MIT",
+      "bin": {
+        "node-gyp-build": "bin.js",
+        "node-gyp-build-optional": "optional.js",
+        "node-gyp-build-test": "build-test.js"
+      }
+    },
+    "node_modules/readable-stream": {
+      "version": "3.6.2",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
+      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
+      "license": "MIT",
+      "dependencies": {
+        "inherits": "^2.0.3",
+        "string_decoder": "^1.1.1",
+        "util-deprecate": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/safe-buffer": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/streamx": {
+      "version": "2.23.0",
+      "resolved": "https://registry.npmjs.org/streamx/-/streamx-2.23.0.tgz",
+      "integrity": "sha512-kn+e44esVfn2Fa/O0CPFcex27fjIL6MkVae0Mm6q+E6f0hWv578YCERbv+4m02cjxvDsPKLnmxral/rR6lBMAg==",
+      "license": "MIT",
+      "dependencies": {
+        "events-universal": "^1.0.0",
+        "fast-fifo": "^1.3.2",
+        "text-decoder": "^1.1.0"
+      }
+    },
+    "node_modules/string_decoder": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
+      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "~5.2.0"
+      }
+    },
+    "node_modules/tar-stream": {
+      "version": "3.1.7",
+      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-3.1.7.tgz",
+      "integrity": "sha512-qJj60CXt7IU1Ffyc3NJMjh6EkuCFej46zUqJ4J7pqYlThyd9bO0XBTmcOIhSzZJVWfsLks0+nle/j538YAW9RQ==",
+      "license": "MIT",
+      "dependencies": {
+        "b4a": "^1.6.4",
+        "fast-fifo": "^1.2.0",
+        "streamx": "^2.15.0"
+      }
+    },
+    "node_modules/text-decoder": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/text-decoder/-/text-decoder-1.2.3.tgz",
+      "integrity": "sha512-3/o9z3X0X0fTupwsYvR03pJ/DjWuqqrfwBgTQzdWDiQSm9KitAyz/9WqsT2JQW7KV2m+bC2ol/zqpW37NHxLaA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "b4a": "^1.6.4"
+      }
+    },
+    "node_modules/util-deprecate": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
+      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
+      "license": "MIT"
+    }
+  }
+}
diff --git a/rca-tool/cli/package.json b/rca-tool/cli/package.json
new file mode 100644
index 0000000..187730e
--- /dev/null
+++ b/rca-tool/cli/package.json
@@ -0,0 +1,33 @@
+{
+  "name": "rca-cli",
+  "version": "1.0.0",
+  "description": "CLI tool for RCA analysis of sosreports and support bundles",
+  "type": "module",
+  "main": "cli.js",
+  "bin": {
+    "rca-cli": "./cli.js",
+    "rca-cli-bundled": "./dist/rca-cli.cjs"
+  },
+  "scripts": {
+    "start": "node cli.js",
+    "build": "node build.js",
+    "test": "./test-cli.sh",
+    "test:quick": "./test-cli.sh --quick"
+  },
+  "dependencies": {
+    "lzma-native": "^8.0.6",
+    "tar-stream": "^3.1.7"
+  },
+  "devDependencies": {
+    "esbuild": "^0.27.2"
+  },
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "files": [
+    "cli.js",
+    "archive-processor.js",
+    "parser-loader.js",
+    "dist/rca-cli.cjs"
+  ]
+}
diff --git a/rca-tool/cli/parser-loader.js b/rca-tool/cli/parser-loader.js
new file mode 100644
index 0000000..4c446df
--- /dev/null
+++ b/rca-tool/cli/parser-loader.js
@@ -0,0 +1,372 @@
+/**
+ * Parser Loader for CLI
+ * 
+ * Loads the parsers from src/parsers/ and makes them available for use.
+ * Handles the browser-style parser definitions for Node.js compatibility.
+ */
+
+import fs from 'fs';
+import path from 'path';
+import vm from 'vm';
+import { fileURLToPath } from 'url';
+
+// Handle both ESM and CJS environments for __dirname
+const getDirname = () => {
+    // For bundled CJS, use __dirname if available
+    if (typeof __dirname !== 'undefined') {
+        return __dirname;
+    }
+    // For ESM, derive from import.meta.url
+    return path.dirname(fileURLToPath(import.meta.url));
+};
+
+// Global debug function
+global.debugLog = (...args) => {
+    if (global.DEBUG_MODE) {
+        console.error('[DEBUG]', ...args);
+    }
+};
+
+// Parser rules container with utility functions
+export const SCC_RULES = {
+    // Utility function for deduplication (from worker.js)
+    deduplicateEvents: function(existingEvents, newEvents, comparisonFields) {
+        const addedEvents = [];
+        let duplicateCount = 0;
+        
+        for (const newEvent of newEvents) {
+            const isDuplicate = existingEvents.some(existing => {
+                return comparisonFields.every(field => {
+                    const existVal = existing[field];
+                    const newVal = newEvent[field];
+                    if (existVal === undefined && newVal === undefined) return true;
+                    if (existVal === undefined || newVal === undefined) return false;
+                    return String(existVal).trim() === String(newVal).trim();
+                });
+            });
+            
+            if (!isDuplicate) {
+                addedEvents.push(newEvent);
+            } else {
+                duplicateCount++;
+            }
+        }
+        
+        return { addedEvents, duplicateCount };
+    },
+    
+    // Extract raw file content (simple passthrough)
+    extractRawFile: function(content, filename) {
+        return {
+            found: true,
+            content: content,
+            filename: filename
+        };
+    },
+    
+    // Extract a specific section from supportconfig/sosreport files
+    // Returns: { found: boolean, content: string, lines: array }
+    extractSection: function(content, filename, sectionMarker, directFilePattern) {
+        // If filename matches direct pattern, return content as-is
+        if (directFilePattern && filename.includes(directFilePattern)) {
+            return {
+                found: true,
+                content: content,
+                lines: content.split('\n')
+            };
+        }
+        
+        // Look for section marker in supportconfig format
+        const lines = content.split('\n');
+        let inSection = false;
+        const sectionLines = [];
+        
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            
+            // Check for section end marker - SCC files use various section types
+            // #==[ Configuration File ]===, #==[ Command ]===, #==[ Log File ]===, etc.
+            if (inSection && line.trim().startsWith('#==[ ')) {
+                break;
+            }
+            
+            if (!inSection && line.includes(sectionMarker)) {
+                inSection = true;
+                continue;
+            }
+            
+            if (inSection) {
+                sectionLines.push(line);
+            }
+        }
+        
+        if (sectionLines.length === 0) {
+            return {
+                found: false,
+                content: '',
+                lines: []
+            };
+        }
+        
+        return {
+            found: true,
+            content: sectionLines.join('\n'),
+            lines: sectionLines
+        };
+    },
+    
+    // Extract timestamp from log line
+    extractTimestamp: function(line) {
+        if (!line) return null;
+        
+        // ISO format: 2025-11-11T10:30:45.123456+00:00
+        const isoMatch = line.match(/(\d{4}-\d{2}-\d{2}[T\s]\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:[+-]\d{2}:\d{2})?)/);
+        if (isoMatch) return isoMatch[1];
+        
+        // Syslog format: Aug 23 14:31:48
+        const syslogMatch = line.match(/(\w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}(?:\.\d+)?)/);
+        if (syslogMatch) return syslogMatch[1];
+        
+        return null;
+    },
+    
+    // Parse key=value file format
+    parseKeyValueFile: function(content, options = {}) {
+        const result = {};
+        const separator = options.separator || '=';
+        const lines = content.split('\n');
+        
+        for (const line of lines) {
+            const trimmed = line.trim();
+            if (!trimmed || trimmed.startsWith('#')) continue;
+            
+            const sepIndex = trimmed.indexOf(separator);
+            if (sepIndex === -1) continue;
+            
+            const key = trimmed.substring(0, sepIndex).trim();
+            const value = trimmed.substring(sepIndex + 1).trim();
+            result[key] = value;
+        }
+        
+        return result;
+    },
+    
+    // Strip ANSI escape codes
+    stripAnsiCodes: function(text) {
+        if (!text) return text;
+        return text.replace(/\x1B\[[0-9;]*[a-zA-Z]/g, '');
+    },
+    
+    // Compare version strings
+    compareVersion: function(actual, expected, operator) {
+        if (!actual || !expected) return false;
+        
+        const parseVersion = (v) => {
+            return v.split(/[.-]/).map(p => {
+                const num = parseInt(p, 10);
+                return isNaN(num) ? 0 : num;
+            });
+        };
+        
+        const actualParts = parseVersion(actual);
+        const expectedParts = parseVersion(expected);
+        const maxLen = Math.max(actualParts.length, expectedParts.length);
+        
+        let comparison = 0;
+        for (let i = 0; i < maxLen; i++) {
+            const a = actualParts[i] || 0;
+            const e = expectedParts[i] || 0;
+            if (a < e) { comparison = -1; break; }
+            if (a > e) { comparison = 1; break; }
+        }
+        
+        switch (operator) {
+            case 'gt': return comparison > 0;
+            case 'gte': return comparison >= 0;
+            case 'lt': return comparison < 0;
+            case 'lte': return comparison <= 0;
+            case 'eq': return comparison === 0;
+            default: return false;
+        }
+    },
+    
+    // Grep-like search in content
+    grepLines: function(content, patterns, options = {}) {
+        const lines = content.split('\n');
+        const matches = [];
+        const patternArray = Array.isArray(patterns) ? patterns : [patterns];
+        
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            for (const pattern of patternArray) {
+                const regex = pattern instanceof RegExp ? pattern : new RegExp(pattern, 'i');
+                if (regex.test(line)) {
+                    matches.push({
+                        line: line,
+                        lineNumber: i + 1,
+                        match: line.match(regex)
+                    });
+                    if (options.firstMatchOnly) return { found: true, matches };
+                    break;
+                }
+            }
+        }
+        
+        return { found: matches.length > 0, matches };
+    },
+    
+    // Detect systemd service status
+    detectSystemdService: function(content, filename, serviceName, severity, message) {
+        const lines = content.split('\n');
+        for (const line of lines) {
+            if (line.includes(serviceName)) {
+                const isEnabled = line.includes('enabled');
+                const isActive = line.includes('active') && !line.includes('inactive');
+                return {
+                    found: true,
+                    enabled: isEnabled,
+                    active: isActive,
+                    severity: severity,
+                    message: message,
+                    sourceLine: line.trim()
+                };
+            }
+        }
+        return { found: false };
+    },
+    
+    // Detect security software
+    detectSecuritySoftware: function(content, parserName, packagePrefix, processIndicators, displayName, message) {
+        // Check for package
+        const lines = content.split('\n');
+        for (const line of lines) {
+            if (packagePrefix && line.includes(packagePrefix)) {
+                return {
+                    found: true,
+                    type: 'package',
+                    name: displayName,
+                    message: message,
+                    sourceLine: line.trim()
+                };
+            }
+            if (processIndicators) {
+                for (const indicator of processIndicators) {
+                    if (line.includes(indicator)) {
+                        return {
+                            found: true,
+                            type: 'process',
+                            name: displayName,
+                            message: message,
+                            sourceLine: line.trim()
+                        };
+                    }
+                }
+            }
+        }
+        return { found: false };
+    },
+    
+    // Check SAP exclusions
+    checkSAPExclusions: function(content, parserName, exclusionKeywords) {
+        // Placeholder - implement if needed
+        return { found: false, excluded: false };
+    }
+};
+
+// Placeholder for embedded parsers - will be replaced by esbuild plugin during build
+// In development, this remains null and parsers are loaded from filesystem
+let EMBEDDED_PARSERS = null;
+
+// This will be replaced by the esbuild plugin with actual parser content
+// DO NOT MODIFY THIS LINE - it's a build marker
+// @EMBEDDED_PARSERS_PLACEHOLDER@
+
+// Silent console - only logs when DEBUG_MODE is true
+const silentConsole = {
+    log: (...args) => { if (global.DEBUG_MODE) console.error('[parser]', ...args); },
+    error: (...args) => console.error(...args),
+    warn: (...args) => { if (global.DEBUG_MODE) console.error('[parser warn]', ...args); },
+    info: (...args) => { if (global.DEBUG_MODE) console.error('[parser]', ...args); },
+    debug: (...args) => { if (global.DEBUG_MODE) console.error('[parser debug]', ...args); },
+};
+
+/**
+ * Load a parser from its source content
+ */
+function loadParserFromContent(content, filename) {
+    // Create a sandbox context with debugLog and SCC_RULES available
+    const sandbox = {
+        debugLog: global.debugLog,
+        console: silentConsole,
+        SCC_RULES: SCC_RULES,  // Make utility functions available to parsers
+        // Export parsers will be captured here
+        module: { exports: {} },
+        exports: {}
+    };
+    
+    // Execute the parser file in the sandbox
+    try {
+        const script = new vm.Script(content, { filename });
+        const context = vm.createContext(sandbox);
+        script.runInContext(context);
+        
+        // Extract parser variables from the sandbox
+        // Look for variables ending in 'Parser'
+        const parserNames = content.match(/const\s+(\w+Parser)\s*=/g) || [];
+        
+        for (const match of parserNames) {
+            const parserName = match.replace(/const\s+/, '').replace(/\s*=/, '');
+            
+            // Try to get the parser from sandbox
+            const evalScript = new vm.Script(parserName, { filename });
+            try {
+                const parser = evalScript.runInContext(context);
+                if (parser && parser.filePattern && typeof parser.parse === 'function') {
+                    // Convert parser name to rule name (remove 'Parser' suffix)
+                    let ruleName = parserName.replace(/Parser$/, '');
+                    // First letter lowercase
+                    ruleName = ruleName.charAt(0).toLowerCase() + ruleName.slice(1);
+                    
+                    SCC_RULES[ruleName] = parser;
+                    debugLog(`Loaded parser: ${ruleName} from ${filename}`);
+                }
+            } catch (e) {
+                // Parser might not be defined in global scope
+            }
+        }
+    } catch (error) {
+        console.error(`Error loading parser ${filename}:`, error.message);
+    }
+}
+
+/**
+ * Load all parsers - either from embedded (bundled) or filesystem (development)
+ */
+export async function loadParsers() {
+    if (EMBEDDED_PARSERS) {
+        // Bundled mode: load from embedded parsers
+        debugLog('Loading embedded parsers...');
+        for (const [filename, content] of Object.entries(EMBEDDED_PARSERS)) {
+            loadParserFromContent(content, filename);
+        }
+    } else {
+        // Development mode: load from filesystem
+        const currentDir = getDirname();
+        const parsersDir = path.join(currentDir, '..', 'src', 'parsers');
+        
+        debugLog(`Loading parsers from ${parsersDir}...`);
+        
+        // Read all JS files in the parsers directory
+        const files = fs.readdirSync(parsersDir).filter(f => f.endsWith('.js'));
+        
+        for (const file of files) {
+            const filePath = path.join(parsersDir, file);
+            const content = fs.readFileSync(filePath, 'utf8');
+            loadParserFromContent(content, filePath);
+        }
+    }
+    
+    debugLog(`Loaded ${Object.keys(SCC_RULES).filter(k => SCC_RULES[k]?.filePattern).length} parsers`);
+}
+
+export default { loadParsers, SCC_RULES };
diff --git a/rca-tool/cli/performance-loader.js b/rca-tool/cli/performance-loader.js
new file mode 100644
index 0000000..f0d8429
--- /dev/null
+++ b/rca-tool/cli/performance-loader.js
@@ -0,0 +1,53 @@
+/**
+ * Performance module loader for CLI
+ * 
+ * Loads the shared src/performance.js (which is a plain script, not ESM)
+ * and re-exports its classes and functions for use in CLI ESM code.
+ */
+
+import fs from 'fs';
+import path from 'path';
+import vm from 'vm';
+import { fileURLToPath } from 'url';
+
+// Handle both ESM and CJS environments for __dirname
+const getDirname = () => {
+    // For bundled CJS, use __dirname if available
+    if (typeof __dirname !== 'undefined') {
+        return __dirname;
+    }
+    // For ESM, derive from import.meta.url
+    return path.dirname(fileURLToPath(import.meta.url));
+};
+
+// Placeholder for embedded performance code - will be replaced by build script
+// In development, this remains null and performance.js is loaded from filesystem
+let EMBEDDED_PERFORMANCE = null;
+
+// Load performance code from either embedded or filesystem source
+function loadPerformanceCode() {
+    if (EMBEDDED_PERFORMANCE) {
+        return EMBEDDED_PERFORMANCE;
+    }
+    // Development mode: load from filesystem
+    const currentDir = getDirname();
+    const perfPath = path.join(currentDir, '..', 'src', 'performance.js');
+    return fs.readFileSync(perfPath, 'utf8');
+}
+
+const perfCode = loadPerformanceCode();
+
+// Evaluate in a sandbox that mimics the global scope
+const sandbox = {
+    performance: globalThis.performance,
+    self: {},           // captures the exported symbols
+    console: console,
+};
+const script = new vm.Script(perfCode, { filename: 'performance.js' });
+const context = vm.createContext(sandbox);
+script.runInContext(context);
+
+// Re-export
+export const PerformanceTracker = sandbox.self.PerformanceTracker;
+export const countEvents = sandbox.self.countEvents;
+export const formatPerformanceReport = sandbox.self.formatPerformanceReport;
diff --git a/rca-tool/cli/test-cli.sh b/rca-tool/cli/test-cli.sh
new file mode 100755
index 0000000..b6df4b8
--- /dev/null
+++ b/rca-tool/cli/test-cli.sh
@@ -0,0 +1,146 @@
+#!/bin/bash
+#
+# Test script to run the CLI tool against all fixtures
+#
+# Usage:
+#   ./test-cli.sh          # Run all tests
+#   ./test-cli.sh --quick  # Run quick subset of tests
+#
+
+# Don't use set -e as arithmetic operations can return non-zero
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CLI="$SCRIPT_DIR/dist/rca-cli.cjs"
+FIXTURES_DIR="$SCRIPT_DIR/../tests/fixtures"
+OUTPUT_DIR="$SCRIPT_DIR/test-output"
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+# Counters
+PASSED=0
+FAILED=0
+SKIPPED=0
+
+# Quick mode - only test a subset
+QUICK_MODE=false
+if [[ "$1" == "--quick" || "$1" == "-q" ]]; then
+    QUICK_MODE=true
+fi
+
+# Quick test fixtures (representative subset)
+QUICK_FIXTURES=(
+    "scc_test-azure-vm.tar.xz"
+    "scc_test-huge-pages.tar.xz"
+    "scc_test-kernel-tuning.tar.xz"
+    "scc_test-cluster-nodes.tar.xz"
+    "scc_test-fstab.tar.xz"
+    "scc_test-lvm.tar.xz"
+    "scc_test-antivirus.tar.xz"
+    "sosreport-rpm-raw.tar.xz"
+)
+
+# Create output directory
+mkdir -p "$OUTPUT_DIR"
+
+echo "========================================"
+echo "  RCA CLI Test Runner"
+echo "========================================"
+echo ""
+
+# Check if CLI exists
+if [ ! -f "$CLI" ]; then
+    echo -e "${RED}Error: CLI not found at $CLI${NC}"
+    echo "Run 'npm run build' first to create the bundle"
+    exit 1
+fi
+
+# Check if fixtures exist
+if [ ! -d "$FIXTURES_DIR" ]; then
+    echo -e "${RED}Error: Fixtures directory not found at $FIXTURES_DIR${NC}"
+    exit 1
+fi
+
+# Count fixtures
+if [ "$QUICK_MODE" = true ]; then
+    TOTAL=${#QUICK_FIXTURES[@]}
+    echo "Running quick test with $TOTAL fixtures"
+else
+    TOTAL=$(find "$FIXTURES_DIR" -maxdepth 1 -name "*.tar.xz" | wc -l)
+    echo "Found $TOTAL fixture files"
+fi
+echo ""
+
+# Function to test a single fixture
+test_fixture() {
+    local fixture="$1"
+    local filename=$(basename "$fixture")
+    local testname="${filename%.tar.xz}"
+    
+    # Skip corrupted test (expected to fail)
+    if [[ "$filename" == *"corrupted"* ]]; then
+        echo -e "${YELLOW}SKIP${NC} $filename (expected failure test)"
+        ((SKIPPED++))
+        return
+    fi
+    
+    echo -n "Testing: $filename ... "
+    
+    # Run CLI and capture output
+    local output_file="$OUTPUT_DIR/${testname}.txt"
+    local json_file="$OUTPUT_DIR/${testname}.json"
+    
+    # Run with text output
+    if "$CLI" "$fixture" > "$output_file" 2>&1; then
+        # Check that output is not empty and contains expected sections
+        if grep -q "RCA Analysis Results" "$output_file"; then
+            echo -e "${GREEN}PASS${NC}"
+            ((PASSED++))
+        else
+            echo -e "${RED}FAIL${NC} (no results in output)"
+            ((FAILED++))
+        fi
+    else
+        echo -e "${RED}FAIL${NC} (exit code $?)"
+        ((FAILED++))
+    fi
+}
+
+# Run tests
+if [ "$QUICK_MODE" = true ]; then
+    for filename in "${QUICK_FIXTURES[@]}"; do
+        fixture="$FIXTURES_DIR/$filename"
+        if [ -f "$fixture" ]; then
+            test_fixture "$fixture"
+        else
+            echo -e "${YELLOW}SKIP${NC} $filename (not found)"
+            ((SKIPPED++))
+        fi
+    done
+else
+    for fixture in "$FIXTURES_DIR"/*.tar.xz; do
+        test_fixture "$fixture"
+    done
+fi
+
+echo ""
+echo "========================================"
+echo "  Results"
+echo "========================================"
+echo -e "  ${GREEN}Passed:${NC}  $PASSED"
+echo -e "  ${RED}Failed:${NC}  $FAILED"
+echo -e "  ${YELLOW}Skipped:${NC} $SKIPPED"
+echo "  Total:   $TOTAL"
+echo ""
+echo "Output files saved to: $OUTPUT_DIR"
+echo ""
+
+# Exit with failure if any tests failed
+if [ $FAILED -gt 0 ]; then
+    exit 1
+fi
+
+exit 0
diff --git a/rca-tool/fixtures-gen/.gitignore b/rca-tool/fixtures-gen/.gitignore
new file mode 100644
index 0000000..ea8c4bf
--- /dev/null
+++ b/rca-tool/fixtures-gen/.gitignore
@@ -0,0 +1 @@
+/target
diff --git a/rca-tool/fixtures-gen/Cargo.lock b/rca-tool/fixtures-gen/Cargo.lock
new file mode 100644
index 0000000..e6cfca0
--- /dev/null
+++ b/rca-tool/fixtures-gen/Cargo.lock
@@ -0,0 +1,321 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "adler2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "arbitrary"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
+dependencies = [
+ "derive_arbitrary",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "crc32fast"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
+
+[[package]]
+name = "derive_arbitrary"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "fixtures-gen"
+version = "0.1.0"
+dependencies = [
+ "supportfile",
+ "zip",
+]
+
+[[package]]
+name = "flate2"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
+[[package]]
+name = "indexmap"
+version = "2.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+dependencies = [
+ "equivalent",
+ "hashbrown",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "log"
+version = "0.4.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "953f07c43838f8e6f9758cab68bf5bed85465e7587ebe0b823f1bcd81978ad3a"
+
+[[package]]
+name = "memchr"
+version = "2.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88904434abc2901f197fe8cc55f0445e7ded921dba5911dad2e2b39b48e663c4"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "regex"
+version = "1.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1292b7759ae1cb9ec195452d1390a074f0cd8541ab7a5a8c31cd6db45d4a6ba"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.150"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
+
+[[package]]
+name = "supportfile"
+version = "0.1.1"
+dependencies = [
+ "regex",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.118"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "zip"
+version = "2.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fabe6324e908f85a1c52063ce7aa26b68dcb7eb6dbc83a2d148403c9bc3eba50"
+dependencies = [
+ "arbitrary",
+ "crc32fast",
+ "crossbeam-utils",
+ "displaydoc",
+ "flate2",
+ "indexmap",
+ "memchr",
+ "thiserror",
+ "zopfli",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
+
+[[package]]
+name = "zopfli"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f05cd8797d63865425ff89b5c4a48804f35ba0ce8d125800027ad6017d2b5249"
+dependencies = [
+ "bumpalo",
+ "crc32fast",
+ "log",
+ "simd-adler32",
+]
diff --git a/rca-tool/fixtures-gen/Cargo.toml b/rca-tool/fixtures-gen/Cargo.toml
new file mode 100644
index 0000000..d18dca8
--- /dev/null
+++ b/rca-tool/fixtures-gen/Cargo.toml
@@ -0,0 +1,19 @@
+[package]
+name = "fixtures-gen"
+version = "0.1.0"
+edition = "2021"
+publish = false
+description = "Deterministic generator for the RCA Tool Playwright test fixtures"
+license = "MIT"
+
+[[bin]]
+name = "fixtures-gen"
+path = "src/main.rs"
+
+[dependencies]
+# Reuse the real parsers so generated fixtures are validated against the exact
+# detection logic the app ships (see the round-trip tests in `src/hana.rs`).
+supportfile = { path = "../lib/supportfile_core" }
+# Archive writer for the `.zip` fixtures (HANA log bundles). `tar`/`liblzma`
+# can be added the same way when the `.tar.xz` scc fixtures are ported.
+zip = { version = "2", default-features = false, features = ["deflate"] }
diff --git a/rca-tool/fixtures-gen/src/archive.rs b/rca-tool/fixtures-gen/src/archive.rs
new file mode 100644
index 0000000..4380469
--- /dev/null
+++ b/rca-tool/fixtures-gen/src/archive.rs
@@ -0,0 +1,53 @@
+//! Deterministic archive writers for the test fixtures.
+//!
+//! Only `.zip` is needed for the HANA proof-of-concept; a `.tar.xz` writer can
+//! be added here (using the `tar` + `liblzma` crates already vendored by
+//! `supportfile`) when the scc-style fixtures are ported off `create-fixtures.sh`.
+
+use std::collections::BTreeSet;
+use std::io::Write;
+use std::path::Path;
+
+use zip::write::SimpleFileOptions;
+
+pub type BoxError = Box<dyn std::error::Error>;
+
+/// Fixed archive timestamp so generated fixtures are byte-stable across runs
+/// and machines (archive formats embed mtimes, which otherwise churn).
+fn fixed_mtime() -> zip::DateTime {
+    zip::DateTime::from_date_and_time(2026, 1, 1, 0, 0, 0).expect("valid fixed DOS timestamp")
+}
+
+/// Write `entries` (`archive-path -> bytes`) into a deflate `.zip` at `out_path`,
+/// emitting an explicit directory entry for every parent folder so the layout
+/// matches how real HANA log bundles are shipped (`T31 HANA Logs/`).
+pub fn write_zip(out_path: &Path, entries: &[(&str, &[u8])]) -> Result<(), BoxError> {
+    if let Some(parent) = out_path.parent() {
+        std::fs::create_dir_all(parent)?;
+    }
+
+    let opts = SimpleFileOptions::default()
+        .compression_method(zip::CompressionMethod::Deflated)
+        .last_modified_time(fixed_mtime())
+        .unix_permissions(0o644);
+
+    let mut dirs: BTreeSet<String> = BTreeSet::new();
+    for (name, _) in entries {
+        if let Some(idx) = name.rfind('/') {
+            dirs.insert(name[..idx].to_string());
+        }
+    }
+
+    let file = std::fs::File::create(out_path)?;
+    let mut zip = zip::ZipWriter::new(file);
+
+    for dir in &dirs {
+        zip.add_directory(dir.clone(), opts)?;
+    }
+    for (name, data) in entries {
+        zip.start_file((*name).to_string(), opts)?;
+        zip.write_all(data)?;
+    }
+    zip.finish()?;
+    Ok(())
+}
diff --git a/rca-tool/fixtures-gen/src/hana.rs b/rca-tool/fixtures-gen/src/hana.rs
new file mode 100644
index 0000000..daddfe1
--- /dev/null
+++ b/rca-tool/fixtures-gen/src/hana.rs
@@ -0,0 +1,210 @@
+//! Composable generators for SAP HANA `indexserver_*.trc` trace fixtures.
+//!
+//! Instead of pasting multi-kilobyte real traces into the repo, each detector's
+//! input is built from small, parameterized line builders. The asserted tokens
+//! (savepoint version `609685`, contended object `SAPHANADB:ADR2`, OOM host
+//! `vmltmdbuspd01`, merge `rc = 2465`, …) live in exactly one place, and the
+//! `#[cfg(test)]` round-trip tests below feed the output through the real
+//! `supportfile` parsers so a format drift fails `cargo test` immediately —
+//! the failure mode that previously slipped through to CI.
+
+/// Standard HANA trace-line header:
+/// `[<thread>]{<conn>}[<txn>] <ts> <sev> <component> <src>(<ln>) : <msg>`
+fn header(ts: &str, sev: char, component: &str, src: &str, msg: &str) -> String {
+    format!("[1527771]{{-1}}[-1/-1] {ts} {sev} {component} {src} : {msg}")
+}
+
+// ---------------------------------------------------------------------------
+// Savepoints fixture (hana_test-savepoints.zip)
+// ---------------------------------------------------------------------------
+
+fn periodic_savepoint(ts: &str, version: u64) -> String {
+    let msg = format!(
+        "Savepoint current savepoint version: {version}, restart redo log position: 0x33cb84d9ca6, \
+         next savepoint version: {}, last snapshot SP version: 609683",
+        version + 1
+    );
+    header(ts, 'i', "Savepoint", "SavepointImpl.cpp(03481)", &msg)
+}
+
+fn replication_snapshot(ts: &str, version: u64) -> String {
+    let msg = format!(
+        "Snapshot current savepoint version: {version}, restart redo log position: 0x33cb9c4b4fb, \
+         next savepoint version: {}, last snapshot SP version: {version}, kind: Replication",
+        version + 1
+    );
+    header(ts, 'i', "Savepoint", "SavepointImpl.cpp(03481)", &msg)
+}
+
+fn slow_callback(ts: &str, took_ms: u64) -> String {
+    let msg =
+        format!("Callback PersistenceSessionSavepointCallback::spBeginRestart() took {took_ms}ms.");
+    header(ts, 'w', "Savepoint", "SavepointImpl.cpp(05733)", &msg)
+}
+
+/// Build the savepoints trace: periodic savepoints (starting at version
+/// `609685`), a couple of replication snapshots, and one real slow-callback
+/// warning (`took 12384ms` → "stalled for 12.4s").
+pub fn savepoints_trace() -> String {
+    let mut lines: Vec<String> = Vec::new();
+
+    let periodic = [
+        ("2026-06-03 19:54:09.350130", 609685u64),
+        ("2026-06-03 19:59:12.402952", 609686),
+        ("2026-06-03 20:09:07.268164", 609689),
+        ("2026-06-03 20:14:11.000354", 609690),
+    ];
+    for (ts, v) in periodic {
+        lines.push(periodic_savepoint(ts, v));
+    }
+
+    let snapshots = [
+        ("2026-06-03 20:04:04.157061", 609687u64),
+        ("2026-06-03 20:19:06.936939", 609691),
+    ];
+    for (ts, v) in snapshots {
+        lines.push(replication_snapshot(ts, v));
+    }
+
+    lines.push(slow_callback("2026-06-04 21:44:46.620914", 12384));
+
+    let mut out = lines.join("\n");
+    out.push('\n');
+    out
+}
+
+// ---------------------------------------------------------------------------
+// Trace-events fixture (hana_test-trace-events.zip): deadlocks / OOM / merge
+// ---------------------------------------------------------------------------
+
+/// A `Lock`/`WaitGraph.cc` deadlock record: a header line followed by the
+/// indented `Deadlock detected` cycle with a victim and one more participant.
+fn deadlock_block(ts: &str, object: &str) -> String {
+    let head = format!("[1528819]{{303164}}[1551/16004765485] {ts} e Lock WaitGraph.cc(00250) : ");
+    let victim = format!(
+        "    [(victim) CONNID=303164, SESSIONID=303164, CLIENT_HOST=VMLTMAPUSPD07, \
+         CLIENT_IP=10.105.10.76, CLIENT_PID=1467392, APPUSER = ZWLATMTMS, DBUSER=SAPHANADB, \
+         ID=1551, TYPE=USER, STATE=ACTIVE, LOCK_TYPE=RECORD_LOCK, OBJECT_ID=29593135, \
+         OBJECT_NAME={object}, STMT_HASH=259829e7fca4f2c336f63a2447378053, \
+         STMT=UPDATE \"ADR2\" SET \"COUNTRY\" = ? WHERE \"CLIENT\" = ?]"
+    );
+    let other = format!(
+        "    [CONNID=302171, SESSIONID=302171, CLIENT_HOST=VMLTMAPUSPD03, CLIENT_IP=10.105.10.53, \
+         CLIENT_PID=1405775, APPUSER = ZWLATMTMS, DBUSER=SAPHANADB, ID=586, TYPE=USER, \
+         STATE=ACTIVE, LOCK_TYPE=RECORD_LOCK, OBJECT_ID=29593135, OBJECT_NAME={object}, \
+         STMT_HASH=259829e7fca4f2c336f63a2447378053, \
+         STMT=UPDATE \"ADR2\" SET \"COUNTRY\" = ? WHERE \"CLIENT\" = ?]"
+    );
+    format!("{head}\n  Deadlock detected\n   - Deadlock cycle\n{victim}\n{other}\n")
+}
+
+/// An `OUT OF MEMORY occurred` block from the `Memory` component, including the
+/// IPMM short-info line that carries the global allocation limit.
+fn oom_block(ts: &str, host: &str) -> String {
+    let head = header(
+        ts,
+        'e',
+        "Memory",
+        "mmReportMemoryProblems.cpp(02088)",
+        "OUT OF MEMORY occurred.",
+    );
+    format!(
+        "{head}\n\
+         MemoryType: NearDRAM\n\
+         Host: {host}\n\
+         Executable: hdbindexserver\n\
+         PID: 1312305\n\
+         Failed to allocate 64mb (67108864b).\n\
+         Allocation failure type: GLOBAL_ALLOCATION_LIMIT\n\
+         IPMM NearDRAM short info:\n\
+         GLOBAL_ALLOCATION_LIMIT (GAL) = 3.62tb (3983937077248b), SHARED_MEMORY = 50.62gb (54358601728b)\n"
+    )
+}
+
+fn merge_error(ts: &str, table: &str, table_id: u64) -> String {
+    let msg = format!(
+        "Error in local merge: not enough merge tokens for delta merge or optimize compression : \
+         table = {table} (t {table_id}), merge motivation = AutoMerge, rc = 2465"
+    );
+    format!("[2564393]{{-1}}[-1/9223372036854775806] {ts} e delta_merge CsTableMerge.cpp(02527) : {msg}")
+}
+
+/// Build the trace-events trace: several deadlock cycles on `SAPHANADB:ADR2`,
+/// one OOM block on `vmltmdbuspd01`, and a batch of `rc = 2465` merge failures.
+pub fn trace_events_trace() -> String {
+    let mut out = String::new();
+
+    for ts in [
+        "2026-06-01 13:41:24.116632",
+        "2026-06-01 13:50:38.351886",
+        "2026-06-01 13:50:41.862160",
+    ] {
+        out.push_str(&deadlock_block(ts, "SAPHANADB:ADR2"));
+    }
+
+    out.push_str(&oom_block("2026-06-04 17:32:51.297072", "vmltmdbuspd01"));
+
+    for (table, id) in [
+        ("T31::SAPHANADB:/1DH/ML000000006", 551461u64),
+        ("T31::SAPHANADB:/1DH/ML00000000A", 562676),
+        ("T31::SAPHANADB:BGRFC_I_RUNNABLE", 16785),
+    ] {
+        out.push_str(&merge_error("2026-06-04 22:20:41.349323", table, id));
+        out.push('\n');
+    }
+
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use supportfile::{
+        parse_hana_deadlocks, parse_hana_merge_errors, parse_hana_oom, parse_hana_savepoints,
+    };
+
+    const TRC: &str = "T31 HANA Logs/indexserver_test.trc";
+
+    #[test]
+    fn savepoints_fixture_round_trips_through_the_parser() {
+        let r = parse_hana_savepoints(&savepoints_trace(), TRC);
+        assert!(r.found, "savepoints detected");
+        assert!(r.count >= 2, "periodic savepoints: {}", r.count);
+        assert!(r.snapshot_count >= 1, "snapshot savepoints: {}", r.snapshot_count);
+        assert!(
+            r.savepoints.iter().any(|s| s.savepoint_version == Some(609685)),
+            "savepoint version 609685 present"
+        );
+        assert!(
+            r.warnings.iter().any(|w| {
+                w.r#type == "hana_savepoint_slow_callback" && w.message.contains("12.4s")
+            }),
+            "slow-callback warning rendered as 12.4s"
+        );
+    }
+
+    #[test]
+    fn trace_events_fixture_round_trips_through_the_parser() {
+        let trc = trace_events_trace();
+
+        let d = parse_hana_deadlocks(&trc, TRC);
+        assert!(d.found && d.count >= 1, "deadlocks detected: {}", d.count);
+        assert!(
+            d.top_objects.iter().any(|c| c.name == "SAPHANADB:ADR2"),
+            "contended object SAPHANADB:ADR2"
+        );
+
+        let o = parse_hana_oom(&trc, TRC);
+        assert!(o.found && o.count >= 1, "oom detected: {}", o.count);
+        assert_eq!(o.events[0].host.as_deref(), Some("vmltmdbuspd01"));
+        assert_eq!(o.events[0].failure_type.as_deref(), Some("GLOBAL_ALLOCATION_LIMIT"));
+
+        let m = parse_hana_merge_errors(&trc, TRC);
+        assert!(m.found, "merge errors detected");
+        assert!(
+            m.token_exhaustion_count >= 1,
+            "merge-token exhaustion (rc=2465): {}",
+            m.token_exhaustion_count
+        );
+    }
+}
diff --git a/rca-tool/fixtures-gen/src/main.rs b/rca-tool/fixtures-gen/src/main.rs
new file mode 100644
index 0000000..d739ade
--- /dev/null
+++ b/rca-tool/fixtures-gen/src/main.rs
@@ -0,0 +1,69 @@
+//! `fixtures-gen` — deterministic builder for the RCA Tool Playwright fixtures.
+//!
+//! Proof-of-concept scope: builds the two SAP HANA `.zip` fixtures consumed by
+//! `tests/hana.spec.js` and `tests/hana-trace-events.spec.js`. No archives or
+//! binaries are committed — the `.zip` files are generated on demand into the
+//! (gitignored) `tests/fixtures/` directory.
+//!
+//! Usage:
+//!   fixtures-gen [--out <dir>] [--only <archive-name.zip>]
+//!
+//! Defaults `--out` to `tests/fixtures`.
+
+mod archive;
+mod hana;
+
+use std::path::PathBuf;
+
+/// Each fixture: output archive name + the in-archive trace content generator.
+/// All HANA archives package a single `T31 HANA Logs/indexserver_test.trc`
+/// (the path the JS router matches via `/(indexserver|nameserver).*\.trc$/`).
+const FIXTURES: &[(&str, fn() -> String)] = &[
+    ("hana_test-savepoints.zip", hana::savepoints_trace),
+    ("hana_test-trace-events.zip", hana::trace_events_trace),
+];
+
+const TRACE_ARCNAME: &str = "T31 HANA Logs/indexserver_test.trc";
+
+fn main() -> Result<(), archive::BoxError> {
+    let mut out = PathBuf::from("tests/fixtures");
+    let mut only: Option<String> = None;
+
+    let mut args = std::env::args().skip(1);
+    while let Some(arg) = args.next() {
+        match arg.as_str() {
+            "--out" => {
+                out = PathBuf::from(args.next().ok_or("--out requires a directory argument")?)
+            }
+            "--only" => only = Some(args.next().ok_or("--only requires an archive name")?),
+            "-h" | "--help" => {
+                println!("usage: fixtures-gen [--out <dir>] [--only <archive-name.zip>]");
+                return Ok(());
+            }
+            other => return Err(format!("unknown argument: {other}").into()),
+        }
+    }
+
+    std::fs::create_dir_all(&out)?;
+
+    let mut built = 0usize;
+    for (name, generate) in FIXTURES {
+        if let Some(filter) = &only {
+            if filter != name {
+                continue;
+            }
+        }
+        let content = generate();
+        archive::write_zip(
+            &out.join(name),
+            &[(TRACE_ARCNAME, content.as_bytes())],
+        )?;
+        println!("[OK] {}", out.join(name).display());
+        built += 1;
+    }
+
+    if built == 0 {
+        return Err("no fixtures matched the requested filter".into());
+    }
+    Ok(())
+}
diff --git a/rca-tool/jsdoc.json b/rca-tool/jsdoc.json
new file mode 100644
index 0000000..9a05587
--- /dev/null
+++ b/rca-tool/jsdoc.json
@@ -0,0 +1,24 @@
+{
+    "source": {
+        "include": ["src/", "tests/"],
+        "includePattern": ".+\\.js$",
+        "exclude": ["src/LAZY_LOADING_GUIDE.js", "src/lazy-parsers.js", "tests/node_modules", "tests/test-results", "tests/playwright-report", "tests/fixtures"]
+    },
+    "opts": {
+        "destination": "docs/",
+        "recurse": true,
+        "readme": "README.md"
+    },
+    "plugins": ["plugins/markdown"],
+    "templates": {
+        "cleverLinks": true,
+        "monospaceLinks": false,
+        "default": {
+            "outputSourceFiles": false,
+            "includeDate": true
+        }
+    },
+    "tags": {
+        "allowUnknownTags": true
+    }
+}
diff --git a/rca-tool/lib/lzma_stream_wasm/Cargo.lock b/rca-tool/lib/lzma_stream_wasm/Cargo.lock
new file mode 100644
index 0000000..188b5b7
--- /dev/null
+++ b/rca-tool/lib/lzma_stream_wasm/Cargo.lock
@@ -0,0 +1,156 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "bumpalo"
+version = "3.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "console_error_panic_hook"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a06aeb73f470f66dcdbf7223caeebb85984942f22f1adb2a088cf9668146bbbc"
+dependencies = [
+ "cfg-if",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "crc"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5eb8a2a1cd12ab0d987a5d5e825195d372001a4094a0376319d5a0ad71c1ba0d"
+dependencies = [
+ "crc-catalog",
+]
+
+[[package]]
+name = "crc-catalog"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "217698eaf96b4a3f0bc4f3662aaa55bdf913cd54d7204591faa790070c6d0853"
+
+[[package]]
+name = "lzma-rs"
+version = "0.3.0"
+source = "git+https://github.com/fede2cr/lzma-rs?branch=streaming#56087255b51c42f01f8a830235eb54d7c928fd2b"
+dependencies = [
+ "byteorder",
+ "crc",
+]
+
+[[package]]
+name = "lzma-stream-wasm"
+version = "0.0.1"
+dependencies = [
+ "console_error_panic_hook",
+ "lzma-rs",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+
+[[package]]
+name = "syn"
+version = "2.0.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.121"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49ace1d07c165b0864824eee619580c4689389afa9dc9ed3a4c75040d82e6790"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.121"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e68e6f4afd367a562002c05637acb8578ff2dea1943df76afb9e83d177c8578"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.121"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d95a9ec35c64b2a7cb35d3fead40c4238d0940c86d107136999567a4703259f2"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.121"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4e0100b01e9f0d03189a92b96772a1fb998639d981193d7dbab487302513441"
+dependencies = [
+ "unicode-ident",
+]
diff --git a/rca-tool/lib/lzma_stream_wasm/Cargo.toml b/rca-tool/lib/lzma_stream_wasm/Cargo.toml
new file mode 100644
index 0000000..17b9e82
--- /dev/null
+++ b/rca-tool/lib/lzma_stream_wasm/Cargo.toml
@@ -0,0 +1,20 @@
+[package]
+name = "lzma-stream-wasm"
+version = "0.0.1"
+edition = "2021"
+description = "Pure-Rust XZ streaming decoder exposed as wasm-bindgen for the RCA Tool worker."
+license = "MIT"
+publish = false
+
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+wasm-bindgen = "0.2"
+lzma-rs = { git = "https://github.com/fede2cr/lzma-rs", branch = "streaming", features = ["stream"] }
+console_error_panic_hook = "0.1"
+
+[profile.release]
+opt-level = "z"
+lto = true
+codegen-units = 1
diff --git a/rca-tool/lib/lzma_stream_wasm/src/lib.rs b/rca-tool/lib/lzma_stream_wasm/src/lib.rs
new file mode 100644
index 0000000..9029286
--- /dev/null
+++ b/rca-tool/lib/lzma_stream_wasm/src/lib.rs
@@ -0,0 +1,202 @@
+//! Pure-Rust streaming XZ decoder for the RCA Tool worker.
+//!
+//! Mirrors the worker-facing `xz_stream_*` API previously provided by the
+//! C-based liblzma wrapper so the JS worker can drive the Rust backend
+//! directly.
+//!
+//! This implementation is backed by `github.com/fede2cr/lzma-rs`
+//! (`streaming` branch), which adds a push-based [`XzStream<W>`] decoder.
+//! Each `process` call feeds input directly into the decoder and returns any
+//! newly produced output.
+
+use std::cell::RefCell;
+use std::collections::HashMap;
+use std::io::Write;
+
+use lzma_rs::decompress::XzStream;
+use wasm_bindgen::prelude::*;
+
+const STATUS_NEED_MORE: i32 = 0;
+const STATUS_FINISHED: i32 = 1;
+const STATUS_INVALID_HANDLE: i32 = -1;
+const STATUS_ALREADY_FINISHED: i32 = 1;
+const STATUS_ALREADY_ERROR: i32 = -2;
+const STATUS_DECODE_ERROR: i32 = -3;
+
+#[wasm_bindgen(start)]
+pub fn start() {
+    console_error_panic_hook::set_once();
+}
+
+#[derive(Default)]
+struct VecSink {
+    buf: Vec<u8>,
+}
+
+impl Write for VecSink {
+    fn write(&mut self, data: &[u8]) -> std::io::Result<usize> {
+        self.buf.extend_from_slice(data);
+        Ok(data.len())
+    }
+
+    fn flush(&mut self) -> std::io::Result<()> {
+        Ok(())
+    }
+}
+
+struct StreamState {
+    decoder: Option<XzStream<VecSink>>,
+    finished: bool,
+    error: Option<String>,
+}
+
+thread_local! {
+    static STREAMS: RefCell<HashMap<u32, StreamState>> = RefCell::new(HashMap::new());
+    static NEXT_ID: RefCell<u32> = RefCell::new(1);
+}
+
+#[wasm_bindgen]
+pub struct ProcessResult {
+    output: Vec<u8>,
+    status: i32,
+}
+
+#[wasm_bindgen]
+impl ProcessResult {
+    #[wasm_bindgen(getter)]
+    pub fn output(self) -> Vec<u8> {
+        self.output
+    }
+
+    #[wasm_bindgen(getter)]
+    pub fn status(&self) -> i32 {
+        self.status
+    }
+}
+
+#[wasm_bindgen(js_name = xzStreamInit)]
+pub fn xz_stream_init() -> u32 {
+    let id = NEXT_ID.with(|next_id| {
+        let id = *next_id.borrow();
+        *next_id.borrow_mut() = id.wrapping_add(1).max(1);
+        id
+    });
+
+    STREAMS.with(|streams| {
+        streams.borrow_mut().insert(
+            id,
+            StreamState {
+                decoder: Some(XzStream::new(VecSink::default())),
+                finished: false,
+                error: None,
+            },
+        );
+    });
+
+    id
+}
+
+#[wasm_bindgen(js_name = xzStreamProcess)]
+pub fn xz_stream_process(handle: u32, input: &[u8]) -> ProcessResult {
+    STREAMS.with(|streams| {
+        let mut streams = streams.borrow_mut();
+        let state = match streams.get_mut(&handle) {
+            Some(state) => state,
+            None => {
+                return ProcessResult {
+                    output: Vec::new(),
+                    status: STATUS_INVALID_HANDLE,
+                };
+            }
+        };
+
+        if state.error.is_some() {
+            return ProcessResult {
+                output: Vec::new(),
+                status: STATUS_ALREADY_ERROR,
+            };
+        }
+        if state.finished {
+            return ProcessResult {
+                output: Vec::new(),
+                status: STATUS_ALREADY_FINISHED,
+            };
+        }
+
+        if input.is_empty() {
+            let decoder = match state.decoder.take() {
+                Some(decoder) => decoder,
+                None => {
+                    state.error = Some("decoder already consumed".to_string());
+                    return ProcessResult {
+                        output: Vec::new(),
+                        status: STATUS_DECODE_ERROR,
+                    };
+                }
+            };
+
+            match decoder.finish() {
+                Ok(sink) => {
+                    state.finished = true;
+                    ProcessResult {
+                        output: sink.buf,
+                        status: STATUS_FINISHED,
+                    }
+                }
+                Err(error) => {
+                    state.error = Some(format!("{:?}", error));
+                    ProcessResult {
+                        output: Vec::new(),
+                        status: STATUS_DECODE_ERROR,
+                    }
+                }
+            }
+        } else {
+            let decoder = match state.decoder.as_mut() {
+                Some(decoder) => decoder,
+                None => {
+                    state.error = Some("decoder already consumed".to_string());
+                    return ProcessResult {
+                        output: Vec::new(),
+                        status: STATUS_DECODE_ERROR,
+                    };
+                }
+            };
+
+            if let Err(error) = decoder.write_all(input) {
+                state.error = Some(error.to_string());
+                return ProcessResult {
+                    output: Vec::new(),
+                    status: STATUS_DECODE_ERROR,
+                };
+            }
+
+            let sink = decoder
+                .get_sink_mut()
+                .expect("XzStream sink unavailable after successful write");
+
+            ProcessResult {
+                output: std::mem::take(&mut sink.buf),
+                status: STATUS_NEED_MORE,
+            }
+        }
+    })
+}
+
+#[wasm_bindgen(js_name = xzStreamError)]
+pub fn xz_stream_error(handle: u32) -> String {
+    STREAMS.with(|streams| match streams.borrow().get(&handle) {
+        Some(state) => state
+            .error
+            .clone()
+            .unwrap_or_else(|| "no error".to_string()),
+        None => "invalid handle".to_string(),
+    })
+}
+
+#[wasm_bindgen(js_name = xzStreamFree)]
+pub fn xz_stream_free(handle: u32) {
+    STREAMS.with(|streams| {
+        streams.borrow_mut().remove(&handle);
+    });
+}
diff --git a/rca-tool/lib/supportfile_core/Cargo.lock b/rca-tool/lib/supportfile_core/Cargo.lock
new file mode 100644
index 0000000..4f30227
--- /dev/null
+++ b/rca-tool/lib/supportfile_core/Cargo.lock
@@ -0,0 +1,598 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "adler2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "arbitrary"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
+dependencies = [
+ "derive_arbitrary",
+]
+
+[[package]]
+name = "bitflags"
+version = "2.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
+
+[[package]]
+name = "bumpalo"
+version = "3.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
+
+[[package]]
+name = "cc"
+version = "1.2.61"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d16d90359e986641506914ba71350897565610e87ce0ad9e6f28569db3dd5c6d"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "crc32fast"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82b8f8f868b36967f9606790d1903570de9ceaf870a7bf9fbbd3016d636a2cb2"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-deque"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9dd111b7b7f7d55b72c0a6ae361660ee5853c9af73f70c3c2ef6858b950e2e51"
+dependencies = [
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
+
+[[package]]
+name = "derive_arbitrary"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "either"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys",
+]
+
+[[package]]
+name = "filetime"
+version = "0.2.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f98844151eee8917efc50bd9e8318cb963ae8b297431495d3f758616ea5c57db"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "libredox",
+]
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "flate2"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+ "wasip2",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"
+
+[[package]]
+name = "hermit-abi"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
+
+[[package]]
+name = "indexmap"
+version = "2.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+dependencies = [
+ "equivalent",
+ "hashbrown",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "jobserver"
+version = "0.1.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9afb3de4395d6b3e67a780b6de64b51c978ecf11cb9a462c66be7d4ca9039d33"
+dependencies = [
+ "getrandom",
+ "libc",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.186"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+
+[[package]]
+name = "liblzma"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6033b77c21d1f56deeae8014eb9fbe7bdf1765185a6c508b5ca82eeaed7f899"
+dependencies = [
+ "liblzma-sys",
+ "num_cpus",
+]
+
+[[package]]
+name = "liblzma-sys"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a60851d15cd8c5346eca4ab8babff585be2ae4bc8097c067291d3ffe2add3b6"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+]
+
+[[package]]
+name = "libredox"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e02f3bb43d335493c96bf3fd3a321600bf6bd07ed34bc64118e9293bdffea46c"
+dependencies = [
+ "bitflags",
+ "libc",
+ "plain",
+ "redox_syscall",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "log"
+version = "0.4.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+
+[[package]]
+name = "memchr"
+version = "2.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "num_cpus"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91df4bbde75afed763b708b7eee1e8e7651e02d97f6d5dd763e89367e957b23b"
+dependencies = [
+ "hermit-abi",
+ "libc",
+]
+
+[[package]]
+name = "pkg-config"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+
+[[package]]
+name = "plain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "rayon"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb39b166781f92d482534ef4b4b1b2568f42613b53e5b6c160e24cfbfa30926d"
+dependencies = [
+ "either",
+ "rayon-core",
+]
+
+[[package]]
+name = "rayon-core"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22e18b0f0062d30d4230b2e85ff77fdfe4326feb054b9783a3460d8435c8ab91"
+dependencies = [
+ "crossbeam-deque",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f450ad9c3b1da563fb6948a8e0fb0fb9269711c9c73d9ea1de5058c79c8d643a"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "regex"
+version = "1.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.149"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
+
+[[package]]
+name = "supportfile"
+version = "0.0.0"
+dependencies = [
+ "crossbeam-channel",
+ "flate2",
+ "liblzma",
+ "rayon",
+ "regex",
+ "serde",
+ "serde_json",
+ "tar",
+ "zip",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "tar"
+version = "0.4.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22692a6476a21fa75fdfc11d452fda482af402c008cdbaf3476414e122040973"
+dependencies = [
+ "filetime",
+ "libc",
+ "xattr",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "wasip2"
+version = "1.0.3+wasi-0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20064672db26d7cdc89c7798c48a0fdfac8213434a1186e5ef29fd560ae223d6"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "xattr"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
+dependencies = [
+ "libc",
+ "rustix",
+]
+
+[[package]]
+name = "zip"
+version = "2.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fabe6324e908f85a1c52063ce7aa26b68dcb7eb6dbc83a2d148403c9bc3eba50"
+dependencies = [
+ "arbitrary",
+ "crc32fast",
+ "crossbeam-utils",
+ "displaydoc",
+ "flate2",
+ "indexmap",
+ "memchr",
+ "thiserror",
+ "zopfli",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
+
+[[package]]
+name = "zopfli"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f05cd8797d63865425ff89b5c4a48804f35ba0ce8d125800027ad6017d2b5249"
+dependencies = [
+ "bumpalo",
+ "crc32fast",
+ "log",
+ "simd-adler32",
+]
diff --git a/rca-tool/lib/supportfile_core/Cargo.toml b/rca-tool/lib/supportfile_core/Cargo.toml
new file mode 100644
index 0000000..71645c3
--- /dev/null
+++ b/rca-tool/lib/supportfile_core/Cargo.toml
@@ -0,0 +1,55 @@
+[package]
+name = "supportfile"
+version = "0.0.0"
+edition = "2021"
+description = "Supportfile library core for support file analysis"
+license = "MIT"
+readme = "README.md"
+
+[lib]
+crate-type = ["rlib"]
+
+# The `rca_cli` binary pulls in the archive + parallelism stack
+# (`tar`, `liblzma`, `flate2`, `zip`, `rayon`, `crossbeam-channel`),
+# all of which are optional dependencies activated by the `cli`
+# feature.  Declare the binary explicitly with `required-features`
+# so plain `cargo build` / `cargo test` / `cargo package` (no
+# features) skip it instead of failing on unresolved imports.
+[[bin]]
+name = "rca_cli"
+path = "src/bin/rca_cli.rs"
+required-features = ["cli"]
+
+[features]
+default = []
+# Enables the bundled `rca_cli` command-line analyzer. Pulled in automatically
+# when building the binary target (see `required-features` below).
+cli = [
+    "dep:tar",
+    "dep:liblzma",
+    "dep:flate2",
+    "dep:zip",
+    "dep:rayon",
+    "dep:crossbeam-channel",
+]
+
+[dependencies]
+regex = "1"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+# Archive handling — only needed by the `rca_cli` binary. Kept optional so
+# library consumers (WASM / PyO3) don't pull these in.
+tar = { version = "0.4", optional = true }
+# `liblzma` is a maintained fork of `xz2` that exposes the multi-threaded
+# decoder (`lzma_stream_decoder_mt`) via `MtStreamBuilder`. Used by `rca_cli`
+# to parallelize `.tar.xz` / `.txz` decompression.
+liblzma = { version = "0.4", features = ["parallel"], optional = true }
+flate2 = { version = "1", optional = true }
+zip = { version = "2", default-features = false, features = ["deflate"], optional = true }
+# Worker-pool parallelism for the `rca_cli` parser dispatch loop. The reader
+# thread streams archive members; rayon workers run the regex-heavy parsers
+# in parallel and the per-thread `ArchiveResults` are merged in `reduce`.
+rayon = { version = "1", optional = true }
+crossbeam-channel = { version = "0.5", optional = true }
+
+
diff --git a/rca-tool/lib/supportfile_core/README.md b/rca-tool/lib/supportfile_core/README.md
new file mode 100644
index 0000000..9c56e2f
--- /dev/null
+++ b/rca-tool/lib/supportfile_core/README.md
@@ -0,0 +1,97 @@
+# supportfile
+
+Shared Rust core for parsing and analyzing Linux support bundles
+(supportconfig, sosreport, and ad‑hoc text dumps). It is the single
+source of truth for parser logic that is reused across the
+[`rca-tool`](../../README.md) frontends:
+
+- the Leptos web UI (compiled to WebAssembly)
+- the [`supportfile`](../supportfile_py) Python extension (via PyO3)
+- the [`supportfile_wasm`](../supportfile_wasm) browser bindings
+- the `rca_cli` example binary in this crate
+
+## Scope
+
+The crate exposes a collection of parser modules under
+[`src/parsers`](src/parsers), each focused on a specific area of a
+support bundle:
+
+| Module               | Purpose                                              |
+| -------------------- | ---------------------------------------------------- |
+| `automation`         | Cloud‑init / Azure Linux agent automation logs       |
+| `azure`              | Azure guest metadata and platform fingerprints       |
+| `cluster`            | Pacemaker / Corosync state and high‑CPU events       |
+| `debugfs`            | `debugfs` / kernel debug captures                    |
+| `events`             | Generic timestamped event extraction                 |
+| `network_interfaces` | NIC inventory, addressing, link state                |
+| `networking`         | Routing, firewall, name resolution                   |
+| `packages`           | Installed package inventory (rpm/dpkg)               |
+| `services`           | systemd unit and service state                       |
+| `storage`            | Block devices, filesystems, multipath                |
+| `unix`               | Generic Unix host facts (uname, uptime, sysctl, …)   |
+| `vmcore`             | Kernel crash / vmcore artifacts                      |
+
+All parser entry points are re‑exported at the crate root, so most
+callers only need:
+
+```rust
+use supportfile::*;
+```
+
+## Building
+
+```bash
+cargo build --release
+cargo test
+```
+
+The crate is built and tested as a regular `rlib`. WebAssembly and
+Python bindings live in sibling crates and depend on this one.
+
+## Example: `rca_cli`
+
+A reference command‑line analyzer is included as an example. It can
+ingest plain directories or compressed bundles
+(`.tar`, `.tar.gz` / `.tgz`, `.tar.xz` / `.txz`, `.zip`) and print
+the results as JSON.
+
+```bash
+cargo run --release --example rca_cli -- /path/to/supportbundle.tar.xz
+```
+
+`.tar.xz` decompression uses the multi‑threaded `liblzma` decoder for
+faster ingestion of large bundles.
+
+## Dependencies
+
+Runtime:
+
+- `regex` — pattern matching across log lines
+- `serde` / `serde_json` — structured output for all parsers
+
+Dev / example only:
+
+- `tar`, `flate2`, `zip`, `liblzma` — archive handling for `rca_cli`
+
+## Layout
+
+```
+supportfile_core/
+├── Cargo.toml
+├── src/
+│   ├── lib.rs           # re‑exports every parser module
+│   └── parsers/         # one file per parser domain
+└── examples/
+    └── rca_cli.rs       # reference CLI driver
+```
+
+## Versioning and publishing
+
+Version is tracked in [`Cargo.toml`](Cargo.toml). Release packaging,
+crates.io publishing, and the matching Python wheel build are wired
+into the repository CI workflow at
+`.github/workflows/rust-python-packages.yml`.
+
+## License
+
+MIT — see [`LICENSE.txt`](../LICENSE.txt).
diff --git a/rca-tool/lib/supportfile_core/src/bin/rca_cli.rs b/rca-tool/lib/supportfile_core/src/bin/rca_cli.rs
new file mode 100644
index 0000000..dd8d25f
--- /dev/null
+++ b/rca-tool/lib/supportfile_core/src/bin/rca_cli.rs
@@ -0,0 +1,844 @@
+//! `rca_cli` — pure-Rust CLI for the `supportfile` library.
+//!
+//! Mirrors the Python example under `lib/supportfile_py/examples/rca_cli.py`
+//! and the JavaScript CLI under `rca-tool/cli/cli.js`. It walks a
+//! supportconfig (SCC) or sosreport (SOS) archive (`.tar`, `.tar.gz`,
+//! `.tar.xz`, `.zip`, or a plaintext log), routes each member to one or more
+//! `parse_*_json` functions based on a regex registry, decodes the JSON,
+//! optionally merges multi-file results, and prints either a human summary or
+//! raw JSON.
+//!
+//! The archive walk, parser registry, parallel dispatch, and result merging
+//! all live in the reusable [`supportfile::engine`] module so that this binary
+//! and any in-process consumer (e.g. an MCP server linking the library) share
+//! the exact same analysis engine. This binary remains a separately-buildable
+//! component (gated behind the `cli` feature) used by CI and by external tools
+//! that integrate over its stdin/stdout contract; it is now a thin presentation
+//! wrapper that owns only argument parsing and the human-readable summary.
+//!
+//! Build & run from the workspace:
+//!
+//! ```text
+//! cd rca-tool/lib/supportfile_core
+//! cargo run --features cli --bin rca_cli -- ../../tests/fixtures/scc_test-azure-vm.tar.xz
+//! cargo run --features cli --bin rca_cli -- ../../tests/fixtures/scc_test-azure-vm.tar.xz --json
+//! cargo run --features cli --bin rca_cli -- --list-parsers
+//! ```
+
+use std::collections::BTreeMap;
+use std::env;
+use std::path::Path;
+use std::process::ExitCode;
+
+use serde_json::{Map, Value};
+
+use supportfile::engine::{is_empty_scalar, parsers, process_archive, ArchiveResults};
+
+// ---------------------------------------------------------------------------
+// Output helpers (CLI presentation only)
+// ---------------------------------------------------------------------------
+
+fn has_data(v: &Value) -> bool {
+    match v {
+        Value::Null => false,
+        Value::Bool(b) => *b,
+        Value::Number(n) => n.as_f64().map(|x| x != 0.0).unwrap_or(false),
+        Value::String(s) => !s.is_empty(),
+        Value::Array(a) => !a.is_empty(),
+        Value::Object(o) => {
+            if o.get("found").and_then(Value::as_bool).unwrap_or(false) {
+                return true;
+            }
+            if let Some(c) = o.get("count").and_then(Value::as_i64) {
+                if c > 0 {
+                    return true;
+                }
+            }
+            for (k, val) in o {
+                if matches!(k.as_str(), "found" | "count" | "warnings" | "errors") {
+                    continue;
+                }
+                if !is_empty_scalar(val) {
+                    return true;
+                }
+            }
+            false
+        }
+    }
+}
+
+const SEP: &str = "======================================================================";
+const SUB: &str = "----------------------------------------------------------------------";
+
+fn section(title: &str) -> String {
+    format!("\n{SUB}\n{title}\n{SUB}\n")
+}
+
+fn list_warnings(items: Option<&Value>, indent: &str) -> String {
+    let Some(Value::Array(arr)) = items else {
+        return String::new();
+    };
+    let mut out = String::new();
+    for w in arr {
+        if let Value::Object(o) = w {
+            let severity = o
+                .get("severity")
+                .and_then(Value::as_str)
+                .unwrap_or("warn")
+                .to_uppercase();
+            let msg = o
+                .get("message")
+                .and_then(Value::as_str)
+                .or_else(|| o.get("type").and_then(Value::as_str))
+                .map(|s| s.to_string())
+                .unwrap_or_else(|| serde_json::to_string(w).unwrap_or_default());
+            out.push_str(&format!("{indent}[{severity}] {msg}\n"));
+            if let Some(rec) = o.get("recommendation").and_then(Value::as_str) {
+                out.push_str(&format!("{indent}        Recommendation: {rec}\n"));
+            }
+        } else if let Some(s) = w.as_str() {
+            out.push_str(&format!("{indent}[WARN] {s}\n"));
+        }
+    }
+    out
+}
+
+fn s(o: &Map<String, Value>, k: &str) -> Option<String> {
+    o.get(k).and_then(|v| match v {
+        Value::String(s) => Some(s.clone()),
+        Value::Number(n) => Some(n.to_string()),
+        Value::Bool(b) => Some(b.to_string()),
+        _ => None,
+    })
+}
+
+fn arr_len(v: Option<&Value>) -> usize {
+    v.and_then(|x| x.as_array()).map(|a| a.len()).unwrap_or(0)
+}
+
+fn obj<'a>(r: &'a BTreeMap<String, Value>, k: &str) -> Option<&'a Map<String, Value>> {
+    r.get(k).and_then(|v| v.as_object())
+}
+
+fn count_events(r: &BTreeMap<String, Value>, k: &str) -> i64 {
+    match r.get(k) {
+        Some(Value::Object(o)) => o
+            .get("count")
+            .and_then(Value::as_i64)
+            .unwrap_or_else(|| arr_len(o.get("events")) as i64),
+        Some(Value::Array(a)) => a.len() as i64,
+        _ => 0,
+    }
+}
+
+fn format_text(results: &ArchiveResults) -> String {
+    let r = &results.parser_results;
+    let mut out = format!("\n{SEP}\n  RCA Analysis Results (rust)\n{SEP}\n\n");
+    out.push_str(&format!("Files processed: {}\n", results.file_count));
+    out.push_str(&format!(
+        "Files matched by parsers: {}\n\n",
+        results.matched_files
+    ));
+
+    let has = |k: &str| r.get(k).map_or(false, has_data);
+
+    // ----- Azure VM properties / OS -----
+    if has("azureVMProperties") || has("osRelease") {
+        out.push_str(&section("AZURE VM PROPERTIES"));
+        if let Some(vm) = obj(r, "azureVMProperties") {
+            for (label, key) in [
+                ("VM Size", "vm_size"),
+                ("Publisher", "publisher"),
+                ("Offer", "offer"),
+                ("SKU", "sku"),
+                ("License Type", "license_type"),
+                ("Billing Model", "billing_model"),
+                ("Detection Method", "detection_method"),
+                ("OS Disk Type", "os_disk_type"),
+            ] {
+                if let Some(v) = s(vm, key) {
+                    if !v.is_empty() {
+                        out.push_str(&format!("  {label}: {v}\n"));
+                    }
+                }
+            }
+            if let Some(disks) = vm.get("data_disks").and_then(Value::as_array) {
+                if !disks.is_empty() {
+                    out.push_str(&format!("  Data Disks: {}\n", disks.len()));
+                }
+            }
+        }
+        if let Some(osrel) = obj(r, "osRelease") {
+            if has("osRelease") {
+                out.push_str("  Operating System:\n");
+                if let Some(name) = s(osrel, "pretty_name").or_else(|| s(osrel, "name")) {
+                    out.push_str(&format!("    Distribution: {name}\n"));
+                }
+                if let Some(v) = s(osrel, "version_id") {
+                    out.push_str(&format!("    Version: {v}\n"));
+                }
+            }
+        }
+        out.push('\n');
+    }
+
+    // ----- Cluster -----
+    if ["corosyncConfig", "clusterStatus", "clusterMaintenanceMode"]
+        .iter()
+        .any(|k| has(k))
+    {
+        out.push_str(&section("CLUSTER"));
+        if let Some(cc) = obj(r, "corosyncConfig") {
+            if has_data(&Value::Object(cc.clone())) {
+                out.push_str("  Corosync:\n");
+                for (label, key) in [
+                    ("Token", "totem_token"),
+                    ("Consensus", "totem_consensus"),
+                    ("Transport", "totem_transport"),
+                    ("Quorum provider", "quorum_provider"),
+                    ("Expected votes", "quorum_expected_votes"),
+                    ("Two-node mode", "quorum_two_node"),
+                ] {
+                    if let Some(v) = s(cc, key) {
+                        out.push_str(&format!("    {label}: {v}\n"));
+                    }
+                }
+                out.push_str(&list_warnings(cc.get("warnings"), "    "));
+            }
+        }
+        if let Some(cs) = obj(r, "clusterStatus") {
+            if has_data(&Value::Object(cs.clone())) {
+                out.push_str("  Status:\n");
+                for (label, key) in [
+                    ("Cluster name", "cluster_name"),
+                    ("DC node", "dc_node"),
+                    ("Nodes configured", "nodes_configured"),
+                    ("Resources configured", "resources_configured"),
+                    ("Quorum status", "quorum_status"),
+                ] {
+                    if let Some(v) = s(cs, key) {
+                        out.push_str(&format!("    {label}: {v}\n"));
+                    }
+                }
+                if let Some(ns) = cs.get("node_statuses").and_then(Value::as_array) {
+                    for n in ns {
+                        if let Some(o) = n.as_object() {
+                            let name = s(o, "name").unwrap_or_default();
+                            let state = if o.get("online").and_then(Value::as_bool).unwrap_or(false)
+                            {
+                                "online"
+                            } else {
+                                "offline"
+                            };
+                            out.push_str(&format!("    - {name}: {state}\n"));
+                        }
+                    }
+                }
+            }
+        }
+        if let Some(mm) = obj(r, "clusterMaintenanceMode") {
+            if has_data(&Value::Object(mm.clone())) {
+                let on = mm
+                    .get("maintenance_mode")
+                    .and_then(Value::as_bool)
+                    .unwrap_or(false);
+                out.push_str(&format!(
+                    "  Maintenance Mode: {}\n",
+                    if on { "YES" } else { "no" }
+                ));
+                let res = arr_len(mm.get("resources_in_maintenance"));
+                if res > 0 {
+                    out.push_str(&format!("    Resources in maintenance: {res}\n"));
+                }
+            }
+        }
+        out.push('\n');
+    }
+
+    // ----- Storage -----
+    let storage_keys = [
+        "lvmConfig",
+        "raidConfig",
+        "btrfsConfig",
+        "blockDevices",
+        "fstabAnalysis",
+        "dfOutput",
+        "mtabAnalysis",
+    ];
+    if storage_keys.iter().any(|k| has(k)) {
+        out.push_str(&section("STORAGE"));
+        if let Some(bd) = obj(r, "blockDevices") {
+            if has_data(&Value::Object(bd.clone())) {
+                out.push_str(&format!(
+                    "  Block Devices: {} disk(s), {} partition(s)\n",
+                    arr_len(bd.get("disks")),
+                    arr_len(bd.get("partitions"))
+                ));
+            }
+        }
+        if let Some(lvm) = obj(r, "lvmConfig") {
+            if has_data(&Value::Object(lvm.clone())) {
+                out.push_str(&format!(
+                    "  LVM: {} PV(s), {} VG(s), {} LV(s)\n",
+                    arr_len(lvm.get("pvs")),
+                    arr_len(lvm.get("vgs")),
+                    arr_len(lvm.get("lvs"))
+                ));
+                out.push_str(&list_warnings(lvm.get("warnings"), "    "));
+            }
+        }
+        if let Some(raid) = obj(r, "raidConfig") {
+            if has_data(&Value::Object(raid.clone())) {
+                let n = arr_len(raid.get("arrays"));
+                if n > 0 {
+                    out.push_str(&format!("  RAID Arrays: {n}\n"));
+                }
+                out.push_str(&list_warnings(raid.get("warnings"), "    "));
+            }
+        }
+        if let Some(btrfs) = obj(r, "btrfsConfig") {
+            if has_data(&Value::Object(btrfs.clone())) {
+                out.push_str(&format!(
+                    "  BTRFS: {} fs, {} subvol(s)\n",
+                    arr_len(btrfs.get("filesystems")),
+                    arr_len(btrfs.get("subvolumes"))
+                ));
+            }
+        }
+        if let Some(fa) = obj(r, "fstabAnalysis") {
+            if has_data(&Value::Object(fa.clone())) {
+                out.push_str(&format!(
+                    "  Fstab entries: {}\n",
+                    arr_len(fa.get("entries"))
+                ));
+                out.push_str(&list_warnings(fa.get("warnings"), "    "));
+            }
+        }
+        if let Some(df) = obj(r, "dfOutput") {
+            if has_data(&Value::Object(df.clone())) {
+                out.push_str(&format!(
+                    "  df entries: {}\n",
+                    arr_len(df.get("filesystems"))
+                ));
+            }
+        }
+        if let Some(mt) = obj(r, "mtabAnalysis") {
+            if has_data(&Value::Object(mt.clone())) {
+                let extras = arr_len(mt.get("extra_mounts"));
+                let mut line = format!("  Mtab entries: {}", arr_len(mt.get("entries")));
+                if extras > 0 {
+                    line.push_str(&format!(" ({extras} not in fstab)"));
+                }
+                line.push('\n');
+                out.push_str(&line);
+            }
+        }
+        out.push('\n');
+    }
+
+    // ----- Networking -----
+    if ["networkInterfaces", "firewallRules", "sshServiceIssues"]
+        .iter()
+        .any(|k| has(k))
+    {
+        out.push_str(&section("NETWORKING"));
+        if let Some(ni) = obj(r, "networkInterfaces") {
+            if has_data(&Value::Object(ni.clone())) {
+                if let Some(ifaces) = ni.get("interfaces").and_then(Value::as_object) {
+                    let real: Vec<(&String, &Value)> =
+                        ifaces.iter().filter(|(n, _)| n.as_str() != "lo").collect();
+                    let accelnet = real.iter().any(|(_, v)| {
+                        v.as_object()
+                            .and_then(|o| o.get("accel_net").and_then(Value::as_bool))
+                            .unwrap_or(false)
+                    });
+                    out.push_str(&format!(
+                        "  Network Interfaces: {} interface(s){}\n",
+                        real.len(),
+                        if accelnet {
+                            " [Accelerated Networking]"
+                        } else {
+                            ""
+                        }
+                    ));
+                    for (_, v) in &real {
+                        if let Some(i) = v.as_object() {
+                            let name = s(i, "name").unwrap_or_default();
+                            let state = s(i, "state").unwrap_or_else(|| "-".into());
+                            let mac = s(i, "mac").unwrap_or_else(|| "-".into());
+                            let driver = s(i, "driver").unwrap_or_else(|| "-".into());
+                            let ipv4 = i
+                                .get("ipv4")
+                                .and_then(Value::as_array)
+                                .map(|arr| {
+                                    let parts: Vec<String> = arr
+                                        .iter()
+                                        .filter_map(|a| a.as_object().and_then(|o| s(o, "address")))
+                                        .collect();
+                                    if parts.is_empty() {
+                                        "-".to_string()
+                                    } else {
+                                        parts.join(", ")
+                                    }
+                                })
+                                .unwrap_or_else(|| "-".to_string());
+                            out.push_str(&format!(
+                                "    {name}: {state} | {ipv4} | MAC {mac} | driver {driver}\n"
+                            ));
+                        }
+                    }
+                }
+            }
+        }
+        if let Some(fw) = obj(r, "firewallRules") {
+            if has_data(&Value::Object(fw.clone())) {
+                let active = s(fw, "active_firewall").unwrap_or_else(|| "none".into());
+                out.push_str(&format!("  Firewall: active = {active}\n"));
+                out.push_str(&list_warnings(fw.get("warnings"), "    "));
+            }
+        }
+        if let Some(ssh) = obj(r, "sshServiceIssues") {
+            if has_data(&Value::Object(ssh.clone())) {
+                let n = ssh.get("count").and_then(Value::as_i64).unwrap_or(0);
+                out.push_str(&format!("  SSH issues: {n} event(s)\n"));
+            }
+        }
+        out.push('\n');
+    }
+
+    // ----- Events -----
+    let event_counts: Vec<(&str, i64)> = vec![
+        ("High CPU", count_events(r, "highCpuEvents")),
+        ("Cluster", count_events(r, "clusterEvents")),
+        ("Kernel reboots", count_events(r, "kernelReboots")),
+        ("OOM killer", count_events(r, "oomKiller")),
+        ("XFS errors", count_events(r, "xfsErrors")),
+        ("Automation", count_events(r, "automationEvents")),
+        ("Emergency mode", count_events(r, "emergencyMode")),
+    ];
+    if event_counts.iter().any(|(_, c)| *c > 0) {
+        out.push_str(&section("EVENTS"));
+        for (label, count) in event_counts {
+            if count > 0 {
+                out.push_str(&format!("  {label}: {count} event(s)\n"));
+            }
+        }
+        out.push('\n');
+    }
+
+    // ----- Packages / RHUI -----
+    let pkg_keys = [
+        "distroPackages",
+        "rhuiConfig",
+        "rhelRhuiCheck",
+        "eusVersionLock",
+        "rhuiErrors",
+        "cryptoPolicies",
+        "fipsModeSetup",
+        "kernelCmdline",
+        "kernelTuning",
+        "hugePages",
+    ];
+    if pkg_keys.iter().any(|k| has(k)) {
+        out.push_str(&section("PACKAGES / DISTRIBUTION"));
+        if let Some(dp) = obj(r, "distroPackages") {
+            if has_data(&Value::Object(dp.clone())) {
+                let count = dp
+                    .get("package_count")
+                    .and_then(Value::as_i64)
+                    .unwrap_or_else(|| {
+                        dp.get("packages")
+                            .and_then(Value::as_object)
+                            .map(|o| o.len() as i64)
+                            .unwrap_or(0)
+                    });
+                out.push_str(&format!("  Packages: {count}\n"));
+                out.push_str(&list_warnings(dp.get("warnings"), "    "));
+            }
+        }
+        if let Some(rc) = obj(r, "rhuiConfig") {
+            if has_data(&Value::Object(rc.clone())) {
+                if let Some(repos) = rc.get("repos").and_then(Value::as_array) {
+                    let enabled = repos
+                        .iter()
+                        .filter(|x| {
+                            x.as_object()
+                                .and_then(|o| o.get("enabled").and_then(Value::as_bool))
+                                .unwrap_or(false)
+                        })
+                        .count();
+                    out.push_str(&format!("  RHUI Repositories: {enabled} enabled\n"));
+                }
+            }
+        }
+        if let Some(ev) = obj(r, "eusVersionLock") {
+            if has_data(&Value::Object(ev.clone())) {
+                let v = s(ev, "releasever").unwrap_or_else(|| "not locked".into());
+                out.push_str(&format!("  EUS releasever: {v}\n"));
+            }
+        }
+        if let Some(cp) = obj(r, "cryptoPolicies") {
+            if has_data(&Value::Object(cp.clone())) {
+                let v = s(cp, "policy").unwrap_or_default();
+                out.push_str(&format!("  Crypto Policy: {v}\n"));
+            }
+        }
+        if let Some(fp) = obj(r, "fipsModeSetup") {
+            if has_data(&Value::Object(fp.clone())) {
+                let on = fp
+                    .get("fips_enabled")
+                    .and_then(Value::as_bool)
+                    .unwrap_or(false);
+                out.push_str(&format!(
+                    "  FIPS Mode: {}\n",
+                    if on { "enabled" } else { "disabled" }
+                ));
+            }
+        }
+        if let Some(kc) = obj(r, "kernelCmdline") {
+            if has_data(&Value::Object(kc.clone())) {
+                if let Some(v) = s(kc, "cmdline") {
+                    out.push_str(&format!("  Kernel cmdline: {v}\n"));
+                }
+            }
+        }
+        if let Some(re_) = obj(r, "rhuiErrors") {
+            if has_data(&Value::Object(re_.clone())) {
+                let n = re_.get("count").and_then(Value::as_i64).unwrap_or(0);
+                out.push_str(&format!("  RHUI errors: {n}\n"));
+            }
+        }
+        if let Some(kt) = obj(r, "kernelTuning") {
+            if has_data(&Value::Object(kt.clone())) {
+                out.push_str("  Kernel tuning:\n");
+                if let Some(params) = kt.get("parameters").and_then(Value::as_object) {
+                    for k in [
+                        "vm.swappiness",
+                        "vm.nr_hugepages",
+                        "net.core.rmem_max",
+                        "net.core.wmem_max",
+                    ] {
+                        if let Some(v) = params.get(k) {
+                            out.push_str(&format!("    {k} = {}\n", v));
+                        }
+                    }
+                }
+                out.push_str(&list_warnings(kt.get("azure_network_warnings"), "    "));
+            }
+        }
+        if let Some(hp) = obj(r, "hugePages") {
+            if has_data(&Value::Object(hp.clone())) {
+                let total = hp
+                    .get("total")
+                    .and_then(Value::as_i64)
+                    .or_else(|| hp.get("nr_hugepages").and_then(Value::as_i64))
+                    .unwrap_or(0);
+                let mut line = format!("  HugePages: total={total}");
+                if let Some(free) = hp
+                    .get("free")
+                    .and_then(Value::as_i64)
+                    .or_else(|| hp.get("free_hugepages").and_then(Value::as_i64))
+                {
+                    line.push_str(&format!(" free={free}"));
+                }
+                if let Some(size) = hp
+                    .get("size_kb")
+                    .and_then(Value::as_i64)
+                    .or_else(|| hp.get("hugepagesize_kb").and_then(Value::as_i64))
+                {
+                    line.push_str(&format!(" size={size}KB"));
+                }
+                line.push('\n');
+                out.push_str(&line);
+            }
+        }
+        out.push('\n');
+    }
+
+    // ----- Azure agent / extensions -----
+    if [
+        "waagentConfig",
+        "waagentLog",
+        "azureExtensions",
+        "suseCloudRegister",
+    ]
+    .iter()
+    .any(|k| has(k))
+    {
+        out.push_str(&section("AZURE AGENT / EXTENSIONS"));
+        if let Some(wc) = obj(r, "waagentConfig") {
+            if has_data(&Value::Object(wc.clone())) {
+                out.push_str("  waagent.conf: parsed\n");
+                out.push_str(&list_warnings(wc.get("warnings"), "    "));
+            }
+        }
+        if let Some(wl) = obj(r, "waagentLog") {
+            if has_data(&Value::Object(wl.clone())) {
+                let v = s(wl, "agent_version").unwrap_or_else(|| "unknown".into());
+                out.push_str(&format!("  waagent.log: agent {v}\n"));
+                if wl
+                    .get("has_errors")
+                    .and_then(Value::as_bool)
+                    .unwrap_or(false)
+                {
+                    out.push_str("    [WARN] errors detected\n");
+                }
+            }
+        }
+        if let Some(ax) = obj(r, "azureExtensions") {
+            if has_data(&Value::Object(ax.clone())) {
+                if let Some(events) = ax.get("events").and_then(Value::as_array) {
+                    out.push_str(&format!("  Extensions: {}\n", events.len()));
+                    for ev in events {
+                        if let Some(o) = ev.as_object() {
+                            let healthy =
+                                o.get("healthy").and_then(Value::as_bool).unwrap_or(false);
+                            let marker = if healthy { "OK " } else { "BAD" };
+                            let label = s(o, "label").unwrap_or_default();
+                            let version = s(o, "version").unwrap_or_default();
+                            let status = s(o, "status").unwrap_or_default();
+                            out.push_str(&format!(
+                                "    [{marker}] {label} v{version} -> {status}\n"
+                            ));
+                        }
+                    }
+                }
+            }
+        }
+        if let Some(sc) = obj(r, "suseCloudRegister") {
+            if has_data(&Value::Object(sc.clone())) {
+                let bm = s(sc, "billing_model").unwrap_or_else(|| "n/a".into());
+                let rs = s(sc, "registration_server").unwrap_or_else(|| "-".into());
+                out.push_str(&format!("  SUSE Cloud Register: {bm} via {rs}\n"));
+            }
+        }
+        out.push('\n');
+    }
+
+    // ----- Security software -----
+    let sec = [
+        ("falconSensor", "CrowdStrike Falcon"),
+        ("msDefender", "Microsoft Defender"),
+        ("trendMicro", "Trend Micro"),
+        ("illumio", "Illumio"),
+        ("guardicoreAgent", "Guardicore"),
+    ];
+    if sec.iter().any(|(k, _)| has(k)) {
+        out.push_str(&section("SECURITY SOFTWARE"));
+        for (key, label) in sec {
+            if let Some(v) = obj(r, key) {
+                if has_data(&Value::Object(v.clone())) {
+                    let msg = s(v, "message").unwrap_or_default();
+                    out.push_str(&format!("  {label}: detected"));
+                    if !msg.is_empty() {
+                        out.push_str(&format!(" ({msg})"));
+                    }
+                    out.push('\n');
+                }
+            }
+        }
+        out.push('\n');
+    }
+
+    // ----- vmcore / kdump -----
+    let vm_keys = ["vmcoreDmesg", "kdumpStatus", "crashListing", "kdumpConf"];
+    if vm_keys.iter().any(|k| has(k)) {
+        out.push_str(&section("KERNEL CRASH DUMPS"));
+        if let Some(ks) = obj(r, "kdumpStatus") {
+            if has_data(&Value::Object(ks.clone())) {
+                let on = ks
+                    .get("operational")
+                    .and_then(Value::as_bool)
+                    .unwrap_or(false);
+                out.push_str(&format!(
+                    "  Kdump operational: {}\n",
+                    if on { "yes" } else { "no" }
+                ));
+            }
+        }
+        if let Some(cl) = obj(r, "crashListing") {
+            if has_data(&Value::Object(cl.clone())) {
+                let count = cl.get("count").and_then(Value::as_i64).unwrap_or(0);
+                let total = s(cl, "total_gb").unwrap_or_else(|| "0".into());
+                out.push_str(&format!("  Crash entries: {count}, {total} GB total\n"));
+                if let Some(entries) = cl.get("entries").and_then(Value::as_array) {
+                    for e in entries.iter().take(5) {
+                        if let Some(o) = e.as_object() {
+                            let date = s(o, "crash_date").unwrap_or_default();
+                            let mb = s(o, "size_mb").unwrap_or_default();
+                            out.push_str(&format!("    - {date}: {mb} MB\n"));
+                        }
+                    }
+                }
+            }
+        }
+        if let Some(vd) = obj(r, "vmcoreDmesg") {
+            if has_data(&Value::Object(vd.clone())) {
+                out.push_str("  Latest vmcore-dmesg:\n");
+                if let Some(v) = s(vd, "panic_reason") {
+                    out.push_str(&format!("    Panic: {v}\n"));
+                }
+                if let Some(v) = s(vd, "kernel_version") {
+                    out.push_str(&format!("    Kernel: {v}\n"));
+                }
+                if let Some(v) = s(vd, "hardware") {
+                    out.push_str(&format!("    Hardware: {v}\n"));
+                }
+                if let Some(ct) = vd.get("call_trace").and_then(Value::as_array) {
+                    if !ct.is_empty() {
+                        out.push_str(&format!("    Call trace ({} frames, top 5):\n", ct.len()));
+                        for frame in ct.iter().take(5) {
+                            if let Some(f) = frame.as_str() {
+                                out.push_str(&format!("      {f}\n"));
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        if let Some(kdc) = obj(r, "kdumpConf") {
+            if has_data(&Value::Object(kdc.clone())) {
+                out.push_str("  /etc/kdump.conf:\n");
+                for k in ["path", "core_collector", "default_action", "failure_action"] {
+                    if let Some(v) = s(kdc, k) {
+                        out.push_str(&format!("    {k} = {v}\n"));
+                    }
+                }
+            }
+        }
+        out.push('\n');
+    }
+
+    // ----- Debugfs -----
+    if has("hvBalloon") || has("extfrag") {
+        out.push_str(&section("DEBUGFS"));
+        if let Some(hv) = obj(r, "hvBalloon") {
+            if has_data(&Value::Object(hv.clone())) {
+                let committed = s(hv, "committed_memory_gb").unwrap_or_else(|| "?".into());
+                let max = s(hv, "max_dynamic_memory_gb").unwrap_or_else(|| "?".into());
+                out.push_str(&format!(
+                    "  Hyper-V balloon: committed {committed} GB / max {max} GB\n"
+                ));
+                out.push_str(&list_warnings(hv.get("warnings"), "    "));
+            }
+        }
+        if let Some(ef) = obj(r, "extfrag") {
+            if has_data(&Value::Object(ef.clone())) {
+                out.push_str(&format!(
+                    "  Memory fragmentation zones: {}\n",
+                    arr_len(ef.get("zones"))
+                ));
+                out.push_str(&list_warnings(ef.get("warnings"), "    "));
+            }
+        }
+        out.push('\n');
+    }
+
+    out.push_str(SEP);
+    out.push('\n');
+    out
+}
+
+// ---------------------------------------------------------------------------
+// CLI plumbing
+// ---------------------------------------------------------------------------
+
+struct CliArgs {
+    file: Option<String>,
+    json: bool,
+    debug: bool,
+    list: bool,
+    parser: Option<String>,
+}
+
+fn parse_args() -> Result<CliArgs, String> {
+    let mut args = env::args().skip(1);
+    let mut out = CliArgs {
+        file: None,
+        json: false,
+        debug: false,
+        list: false,
+        parser: None,
+    };
+    while let Some(a) = args.next() {
+        match a.as_str() {
+            "-h" | "--help" => {
+                print_usage();
+                std::process::exit(0);
+            }
+            "-j" | "--json" => out.json = true,
+            "-d" | "--debug" => out.debug = true,
+            "-l" | "--list-parsers" => out.list = true,
+            "-p" | "--parser" => {
+                out.parser = Some(
+                    args.next()
+                        .ok_or_else(|| "--parser requires a value".to_string())?,
+                );
+            }
+            other if other.starts_with('-') => {
+                return Err(format!("unknown option: {other}"));
+            }
+            other => {
+                if out.file.is_some() {
+                    return Err(format!("unexpected positional arg: {other}"));
+                }
+                out.file = Some(other.to_string());
+            }
+        }
+    }
+    Ok(out)
+}
+
+fn print_usage() {
+    println!(
+        "rca_cli - example CLI for the supportfile Rust library\n\n\
+         Usage:\n  \
+           rca_cli <archive> [--json] [--parser NAME] [--debug]\n  \
+           rca_cli --list-parsers\n\n\
+         Options:\n  \
+           -j, --json          Print raw merged JSON instead of summary text\n  \
+           -d, --debug         Log per-file parser dispatch to stderr\n  \
+           -p, --parser NAME   Run only the parser with this name\n  \
+           -l, --list-parsers  List parser names + file regexes and exit\n  \
+           -h, --help          Show this help"
+    );
+}
+
+fn run() -> Result<(), String> {
+    let args = parse_args()?;
+
+    if args.list {
+        println!("Available parsers:");
+        for p in parsers() {
+            println!("  {:<24} -> {}", p.name, p.pattern);
+        }
+        return Ok(());
+    }
+
+    let file = args
+        .file
+        .ok_or_else(|| "missing archive path (use --help for usage)".to_string())?;
+    eprintln!("Analyzing: {file}");
+    let results = process_archive(Path::new(&file), args.parser.as_deref(), args.debug)?;
+
+    if args.json {
+        println!(
+            "{}",
+            serde_json::to_string_pretty(&results.to_json())
+                .map_err(|e| format!("json encode: {e}"))?
+        );
+    } else {
+        print!("{}", format_text(&results));
+    }
+    Ok(())
+}
+
+fn main() -> ExitCode {
+    match run() {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(e) => {
+            eprintln!("error: {e}");
+            ExitCode::FAILURE
+        }
+    }
+}
diff --git a/rca-tool/lib/supportfile_core/src/engine.rs b/rca-tool/lib/supportfile_core/src/engine.rs
new file mode 100644
index 0000000..157b8e6
--- /dev/null
+++ b/rca-tool/lib/supportfile_core/src/engine.rs
@@ -0,0 +1,1190 @@
+//! In-process analysis engine for supportconfig (SCC) / sosreport (SOS)
+//! archives.
+//!
+//! This module is the reusable core extracted from the `rca_cli` binary: it
+//! owns the parser registry, the archive walk (`.tar`, `.tar.gz`, `.tar.xz`,
+//! `.zip`, and plaintext logs), inner-member decompression, the parallel
+//! parser dispatch, and multi-file result merging. The `rca_cli` binary and
+//! any in-process consumer (e.g. an MCP server linking the library directly)
+//! call [`process_archive`] / [`analyze_archive`] instead of shelling out.
+//!
+//! Gated behind the `cli` feature because it depends on the archive and
+//! parallelism crates (tar, liblzma, flate2, zip, rayon, crossbeam-channel)
+//! that lean library / WASM / PyO3 builds do not need.
+
+use std::collections::{BTreeMap, HashMap};
+use std::fs::File;
+use std::io::Read;
+use std::path::Path;
+use std::sync::Arc;
+
+use crossbeam_channel::bounded;
+use flate2::read::GzDecoder;
+use liblzma::read::XzDecoder;
+use liblzma::stream::{MtStreamBuilder, Stream};
+use rayon::iter::{ParallelBridge, ParallelIterator};
+use regex::Regex;
+use serde_json::{Map, Value};
+use tar::Archive;
+
+// ---------------------------------------------------------------------------
+// Parser registry
+// ---------------------------------------------------------------------------
+
+/// Parser entry point used by the registry.
+///
+/// All parsers receive `(content, source_path)`. Parsers that have not yet
+/// been migrated to carry source provenance simply ignore `source_path`; this
+/// is achieved with the `compat_shims!` macro below.
+pub type ParseFn = fn(&str, &str) -> String;
+
+/// One registry entry: a named parser, the path regex that selects which
+/// archive members it runs on, and whether results from multiple matching
+/// files should be merged.
+pub struct ParserSpec {
+    /// Output key under which results are stored.
+    pub name: &'static str,
+    /// Regex applied to each member's path (with a leading `/`).
+    pub pattern: &'static str,
+    /// Pointer to one of the `parse_*_json` functions in `supportfile`.
+    pub func: ParseFn,
+    /// When true, results from successive matching files are merged.
+    pub multi_file: bool,
+}
+
+/// Generate compatibility shims for parser functions that still take only
+/// `content`. Each shim has the same name as the underlying `crate::`
+/// function and shadows the `crate::` import within this module.
+macro_rules! compat_shims {
+    ($($name:ident),* $(,)?) => {
+        $(
+            fn $name(content: &str, _source_path: &str) -> String {
+                crate::$name(content)
+            }
+        )*
+    };
+}
+
+compat_shims!();
+
+/// The full parser registry: maps file-path regexes to the
+/// `supportfile::parse_*_json` functions.
+pub fn parsers() -> Vec<ParserSpec> {
+    vec![
+        // ----- Cluster ----------------------------------------------------
+        ParserSpec {
+            name: "highCpuEvents",
+            pattern: r"/(pacemaker\.log|corosync\.log|cluster\.log|ha-log|messages|localmessages|journalctl[^/]*)(?:[.-]\d+)?(?:\.txt)?(?:\.gz)?$|/ha\.txt$",
+            func: crate::parse_pacemaker_high_cpu_json,
+            multi_file: true,
+        },
+        ParserSpec {
+            name: "clusterEvents",
+            pattern: r"/(pacemaker\.log|corosync\.log|cluster\.log|ha-log|messages|journalctl[^/]*)(?:[.-]\d+)?(?:\.txt)?(?:\.gz)?$|/ha\.txt$",
+            func: crate::parse_cluster_events_json,
+            multi_file: true,
+        },
+        ParserSpec {
+            name: "clusterStatus",
+            pattern: r"cib\.xml$|/crm_mon.*\.txt$|/crm_mon.*\.xml$|/ha\.txt$|/pcs_status",
+            func: crate::parse_cluster_status_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "corosyncConfig",
+            pattern: r"/(ha\.txt|corosync\.conf)$",
+            func: crate::parse_corosync_config_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "clusterMaintenanceMode",
+            pattern: r"cib\.xml$|/crm_mon.*\.txt$|/ha\.txt$",
+            func: crate::parse_cluster_maintenance_mode_json,
+            multi_file: false,
+        },
+        // ----- Automation -------------------------------------------------
+        ParserSpec {
+            name: "automationEvents",
+            pattern: r"/(messages|localmessages|syslog|journalctl[^/]*)(?:[.-]\d+)?(?:\.txt)?$",
+            func: crate::parse_automation_events_json,
+            multi_file: true,
+        },
+        // ----- Azure ------------------------------------------------------
+        ParserSpec {
+            name: "azureVMProperties",
+            pattern: r"(?:instance_metadata\.json|public_cloud/metadata\.txt)$",
+            func: crate::parse_azure_vm_properties_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "suseCloudRegister",
+            pattern: r"public_cloud/cloudregister\.txt$",
+            func: crate::parse_suse_cloud_register_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "waagentConfig",
+            pattern: r"/etc/waagent\.conf$",
+            func: crate::parse_waagent_config_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "waagentLog",
+            pattern: r"/waagent\.log$",
+            func: crate::parse_waagent_log_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "azureExtensions",
+            pattern: r"var/lib/waagent/[^/]+/config/HandlerStatus$",
+            func: crate::parse_azure_extensions_json,
+            multi_file: true,
+        },
+        // ----- Debugfs ----------------------------------------------------
+        ParserSpec {
+            name: "hvBalloon",
+            pattern: r"sys/kernel/debug/hv[-_]balloon$",
+            func: crate::parse_hv_balloon_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "extfrag",
+            pattern: r"sys/kernel/debug/extfrag/(extfrag_index|unusable_index)$",
+            func: crate::parse_extfrag_json,
+            multi_file: true,
+        },
+        // ----- System events ---------------------------------------------
+        ParserSpec {
+            name: "emergencyMode",
+            pattern: r"/(messages|localmessages|journalctl[^/]*|console.*\.log)(?:[.-]\d+)?(?:\.txt)?$",
+            func: crate::parse_emergency_mode_json,
+            multi_file: true,
+        },
+        ParserSpec {
+            name: "kernelReboots",
+            pattern: r"/(messages|localmessages|ha-log|journalctl[^/]*)(?:[.-]\d+)?(?:\.txt)?$",
+            func: crate::parse_kernel_reboots_json,
+            multi_file: true,
+        },
+        ParserSpec {
+            name: "oomKiller",
+            pattern: r"/(messages|localmessages|journalctl[^/]*)(?:[.-]\d+)?(?:\.txt)?$",
+            func: crate::parse_oom_killer_json,
+            multi_file: true,
+        },
+        ParserSpec {
+            name: "xfsErrors",
+            pattern: r"/(messages|localmessages|journalctl[^/]*)(?:[.-]\d+)?(?:\.txt)?$",
+            func: crate::parse_xfs_errors_json,
+            multi_file: true,
+        },
+        // ----- Networking -------------------------------------------------
+        ParserSpec {
+            name: "firewallRules",
+            pattern: r"network\.txt$|sos_commands/firewalld/|sos_commands/firewall_tables/|etc/sysconfig/(?:iptables-config|ebtables-config|nftables\.conf|firewalld)$|etc/firewalld/firewalld\.conf$",
+            func: crate::parse_firewall_rules_json,
+            multi_file: true,
+        },
+        ParserSpec {
+            name: "networkInterfaces",
+            pattern: r"network\.txt$|sos_commands/networking/ip_-o_addr$|sos_commands/networking/ip_-s_-d_link$|sos_commands/networking/ethtool_-i_\w+|sos_commands/networkmanager/nmcli_con_show_id_|etc/sysconfig/network-scripts/ifcfg-|etc/sysconfig/network/(?:network/)?ifcfg-|etc/netplan/|var/log/cloud-init-output\.log$|(?:^|/)messages$",
+            func: crate::parse_network_interfaces_json,
+            multi_file: true,
+        },
+        ParserSpec {
+            name: "packetLoss",
+            pattern: r"network\.txt$|sos_commands/networking/ip_-s_-d_link$|sos_commands/networking/ip_-s_link$",
+            func: crate::parse_packet_loss_json,
+            multi_file: true,
+        },
+        ParserSpec {
+            name: "ringBuffer",
+            pattern: r"network\.txt$|sos_commands/networking/ethtool_-g_\w+",
+            func: crate::parse_ring_buffer_json,
+            multi_file: true,
+        },
+        ParserSpec {
+            name: "networkSysctl",
+            pattern: r"/env\.txt$|/sysctl\.conf$|sos_commands/kernel/sysctl_-a$|etc/sysctl\.d/",
+            func: crate::parse_network_sysctl_json,
+            multi_file: true,
+        },
+        // ----- Packages ---------------------------------------------------
+        ParserSpec {
+            name: "distroPackages",
+            pattern: r"/(rpm\.txt|installed-rpms|package-data|dpkg_-l|dnf[_-]list[_-]installed|yum[_-]list[_-]installed|var/log/zypp/history|var/log/(?:dnf|yum)\.log)$",
+            func: crate::parse_distro_packages_json,
+            multi_file: false,
+        },
+        // ----- Services ---------------------------------------------------
+        ParserSpec {
+            name: "sshServiceIssues",
+            pattern: r"/(messages|localmessages|syslog|journalctl[^/]*|console.*\.log)(?:[.-]\d+)?(?:\.txt)?$",
+            func: crate::parse_ssh_service_issues_json,
+            multi_file: true,
+        },
+        ParserSpec {
+            name: "dlmService",
+            pattern: r"sos_commands/systemd/systemctl_list-unit-files$",
+            func: crate::parse_dlm_service_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "azureSiteRecovery",
+            pattern: r"(?:sos_commands/systemd/systemctl_list-unit-files|systemd-status\.txt)$",
+            func: crate::parse_azure_site_recovery_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "guardicoreAgent",
+            pattern: r"(?:sos_commands/systemd/systemctl_list-unit-files|systemd-status\.txt)$",
+            func: crate::parse_guardicore_agent_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "illumio",
+            pattern: r"sos_commands/systemd/systemctl_list-units_--all$",
+            func: crate::parse_illumio_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "trendMicro",
+            pattern: r"sos_commands/systemd/systemctl_list-units_--all$",
+            func: crate::parse_trend_micro_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "falconSensor",
+            pattern: r"/(rpm\.txt|installed-rpms|package-data|ps\.txt|ps_.*\.txt)$",
+            func: crate::parse_falcon_sensor_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "falconSensorConfig",
+            pattern: r"/(falconctl|CrowdStrike.*config|falcon.*conf)$",
+            func: crate::parse_falcon_sensor_config_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "msDefender",
+            pattern: r"/(rpm\.txt|installed-rpms|package-data|ps\.txt|ps_.*\.txt)$",
+            func: crate::parse_ms_defender_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "msDefenderConfig",
+            pattern: r"/(mdatp.*|defender.*config)$",
+            func: crate::parse_ms_defender_config_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "involfltVersion",
+            pattern: r"modules\.txt$",
+            func: crate::parse_involflt_version_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "involfltKernelVersion",
+            pattern: r"/(messages|boot)(?:[.-]\d+)?(?:\.txt)?$",
+            func: crate::parse_involflt_kernel_version_json,
+            multi_file: false,
+        },
+        // ----- Storage ----------------------------------------------------
+        ParserSpec {
+            name: "lvmConfig",
+            pattern: r"/(lvm\.txt|pvs\.txt|vgs\.txt|lvs\.txt|pvdisplay|vgdisplay|lvdisplay)$|/lvm2/pvs_|/lvm2/vgs_|/lvm2/lvs_",
+            func: crate::parse_lvm_config_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "raidConfig",
+            pattern: r"/(mdstat|md-arrays\.txt|mdadm\.txt|proc/mdstat)$",
+            func: crate::parse_raid_config_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "btrfsConfig",
+            pattern: r"/(btrfs\.txt|fs-btrfs\.txt|btrfs-filesystem-show\.txt|btrfs-subvolume-list\.txt)$",
+            func: crate::parse_btrfs_config_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "blockDevices",
+            pattern: r"/sos_commands/block/(lsblk|lsblk_-f_-a_-l|blkid_-c_\.dev\.null)$|(?:^|/)results\.txt$",
+            func: crate::parse_block_devices_json,
+            multi_file: true,
+        },
+        ParserSpec {
+            name: "fstabAnalysis",
+            pattern: r"/etc/fstab$|/fs-diskio\.txt$",
+            func: crate::parse_fstab_analysis_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "dfOutput",
+            pattern: r"/df$|/df_-aliT|/df_-al_|/fs-diskio\.txt$",
+            func: crate::parse_df_output_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "mtabAnalysis",
+            pattern: r"/etc/mtab$|/proc/mounts$|/proc/self/mounts$|/fs-diskio\.txt$|/mount_-l$|/mount$",
+            func: crate::parse_mtab_analysis_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "nfsMounts",
+            pattern: r"/etc/fstab$|/etc/mtab$|/proc/mounts$|/proc/self/mounts$|/fs-diskio\.txt$|/mount_-l$|/mount$",
+            func: crate::parse_nfs_mounts_json,
+            multi_file: true,
+        },
+        // ----- SAP HANA --------------------------------------------------
+        ParserSpec {
+            name: "hanaSavepoints",
+            pattern: r"/(indexserver|nameserver)[^/]*\.trc$",
+            func: crate::parse_hana_savepoints_json,
+            multi_file: true,
+        },
+        ParserSpec {
+            name: "hanaDeadlocks",
+            pattern: r"/(indexserver|nameserver)[^/]*\.trc$",
+            func: crate::parse_hana_deadlocks_json,
+            multi_file: true,
+        },
+        ParserSpec {
+            name: "hanaOom",
+            pattern: r"/(indexserver|nameserver)[^/]*\.trc$",
+            func: crate::parse_hana_oom_json,
+            multi_file: true,
+        },
+        ParserSpec {
+            name: "hanaMergeErrors",
+            pattern: r"/(indexserver|nameserver)[^/]*\.trc$",
+            func: crate::parse_hana_merge_errors_json,
+            multi_file: true,
+        },
+        // ----- OS / filesystem -------------------------------------------
+        ParserSpec {
+            name: "basicEnvironment",
+            pattern: r"basic-environment\.txt$",
+            func: crate::parse_basic_environment_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "osRelease",
+            pattern: r"/usr/lib/os-release$|/etc/os-release$|/sysinfo\.txt$|/basic-environment\.txt$|/etc/(redhat|centos|SuSE|system)-release$",
+            func: crate::parse_os_release_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "fstab",
+            pattern: r"/etc/fstab$|/fs-diskio\.txt$",
+            func: crate::parse_fstab_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "inspectDiskResults",
+            pattern: r"(?:^|/)results\.txt$",
+            func: crate::parse_inspect_disk_results_json,
+            multi_file: false,
+        },
+        // ----- Kernel tuning ---------------------------------------------
+        ParserSpec {
+            name: "kernelTuning",
+            pattern: r"sos_commands/kernel/sysctl_-a$|/env\.txt$|/etc/sysctl\.conf$|/sysctl\.d/[^/]*\.conf$",
+            func: crate::parse_kernel_tuning_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "hugePages",
+            pattern: r"/proc/meminfo$",
+            func: crate::parse_huge_pages_json,
+            multi_file: false,
+        },
+        // ----- Time sync (Azure PTP) -------------------------------------
+        ParserSpec {
+            name: "timeSync",
+            pattern: r"sos_commands/kernel/lsmod$|/modules\.txt$",
+            func: crate::parse_time_sync_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "ptpClockSource",
+            pattern: r"sos_commands/chrony/chronyc_sources$|/etc/chrony\.conf$|/etc/chrony/chrony\.conf$|/ntp\.txt$",
+            func: crate::parse_ptp_clock_source_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "timeSyncService",
+            pattern: r"sos_commands/systemd/systemctl_list-unit-files$|/systemd-status\.txt$|/ntp\.txt$",
+            func: crate::parse_time_sync_service_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "timedatectl",
+            pattern: r"sos_commands/systemd/timedatectl$|/ntp\.txt$",
+            func: crate::parse_timedatectl_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "ptpDevice",
+            pattern: r"sos_commands/block/ls_-lanR_\.dev$|/udev\.txt$",
+            func: crate::parse_ptp_device_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "chronyTracking",
+            pattern: r"sos_commands/chrony/chronyc_tracking$|/ntp\.txt$",
+            func: crate::parse_chrony_tracking_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "chronyMakestep",
+            pattern: r"/etc/chrony\.conf$|/etc/chrony/chrony\.conf$|/ntp\.txt$",
+            func: crate::parse_chrony_makestep_json,
+            multi_file: false,
+        },
+        // ----- RHUI ------------------------------------------------------
+        ParserSpec {
+            name: "rhuiConfig",
+            pattern: r"/(rh-cloud.*\.repo|rhui-.*\.repo|yum\.repos\.d\.txt|dnf\.repos\.d\.txt|yum\.repos\.d/.*\.repo)$",
+            func: crate::parse_rhui_config_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "eusVersionLock",
+            pattern: r"/(releasever|yum-vars\.txt|dnf-vars\.txt|etc/yum/vars|etc/dnf/vars|dnf/vars/releasever|yum/vars/releasever)$",
+            func: crate::parse_eus_version_lock_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "rhelRhuiCheck",
+            pattern: r"/(installed-rpms|rpm-qa\.txt|rpm_-qa|package-data)$",
+            func: crate::parse_rhel_rhui_check_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "rhuiErrors",
+            pattern: r"/(dnf\.log|yum\.log|rhsm\.log)(\.\d+)?$",
+            func: crate::parse_rhui_errors_json,
+            multi_file: true,
+        },
+        // ----- Security --------------------------------------------------
+        ParserSpec {
+            name: "cryptoPolicies",
+            pattern: r"/crypto-policies/(config|state/current)$",
+            func: crate::parse_crypto_policies_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "fipsModeSetup",
+            pattern: r"sos_commands/crypto/fips-mode-setup",
+            func: crate::parse_fips_mode_setup_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "kernelCmdline",
+            pattern: r"/proc/cmdline$|/boot\.txt$",
+            func: crate::parse_kernel_cmdline_json,
+            multi_file: false,
+        },
+        // ----- OS tuning (SAP-on-Azure QualityCheck ports) ---------------
+        ParserSpec {
+            name: "tunedProfile",
+            pattern: r"sos_commands/tuned/tuned-adm_active$|/tuned-adm.*\.txt$",
+            func: crate::parse_tuned_profile_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "selinux",
+            pattern: r"/etc/selinux/config$|sos_commands/selinux/sestatus$|/selinux\.txt$",
+            func: crate::parse_selinux_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "swapSpace",
+            pattern: r"/proc/meminfo$",
+            func: crate::parse_swap_space_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "fstrim",
+            pattern: r"sos_commands/systemd/systemctl_list-unit-files$|/systemd-status\.txt$|sos_commands/.*fstrim.*$",
+            func: crate::parse_fstrim_json,
+            multi_file: false,
+        },
+        // ----- Leapp -----------------------------------------------------
+        ParserSpec {
+            name: "leappReport",
+            pattern: r"var/log/leapp/leapp-report\.(txt|json)$",
+            func: crate::parse_leapp_report_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "leappLog",
+            pattern: r"var/log/leapp/leapp-(preupgrade|upgrade)\.log$",
+            func: crate::parse_leapp_log_json,
+            multi_file: false,
+        },
+        // ----- vmcore / kdump --------------------------------------------
+        ParserSpec {
+            name: "vmcoreDmesg",
+            pattern: r"var/crash/[^/]+/vmcore-dmesg\.txt$",
+            func: crate::parse_vmcore_dmesg_json,
+            multi_file: true,
+        },
+        ParserSpec {
+            name: "kdumpStatus",
+            pattern: r"sos_commands/kdump/kdumpctl_status$",
+            func: crate::parse_kdump_status_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "crashListing",
+            pattern: r"sos_commands/kdump/ls_-alZR_\.var\.crash$",
+            func: crate::parse_crash_listing_json,
+            multi_file: false,
+        },
+        ParserSpec {
+            name: "kdumpConf",
+            pattern: r"etc/kdump\.conf$",
+            func: crate::parse_kdump_conf_json,
+            multi_file: false,
+        },
+    ]
+}
+
+// ---------------------------------------------------------------------------
+// Result merging
+// ---------------------------------------------------------------------------
+
+/// Best-effort recursive merge of two parser results.
+///
+/// - Objects merge key-by-key.
+/// - Arrays concatenate.
+/// - `found` is OR'ed; numeric `count` is summed.
+/// - Scalars keep the existing non-empty value, otherwise take the new one.
+fn merge(existing: Value, new: Value) -> Value {
+    match (existing, new) {
+        (Value::Null, v) | (v, Value::Null) => v,
+        (Value::Object(mut a), Value::Object(b)) => {
+            for (k, v) in b {
+                let merged = match a.remove(&k) {
+                    Some(prev) => match k.as_str() {
+                        "found" => Value::Bool(
+                            prev.as_bool().unwrap_or(false) || v.as_bool().unwrap_or(false),
+                        ),
+                        "count" if prev.is_i64() && v.is_i64() => {
+                            Value::from(prev.as_i64().unwrap_or(0) + v.as_i64().unwrap_or(0))
+                        }
+                        _ => merge(prev, v),
+                    },
+                    None => v,
+                };
+                a.insert(k, merged);
+            }
+            Value::Object(a)
+        }
+        (Value::Array(mut a), Value::Array(b)) => {
+            a.extend(b);
+            Value::Array(a)
+        }
+        (existing, new) => {
+            if !is_empty_scalar(&existing) {
+                existing
+            } else {
+                new
+            }
+        }
+    }
+}
+
+/// True for scalar / container values that carry no information: null, false,
+/// zero, empty string, empty array, empty object.
+pub fn is_empty_scalar(v: &Value) -> bool {
+    match v {
+        Value::Null => true,
+        Value::Bool(b) => !*b,
+        Value::Number(n) => n.as_f64().map(|x| x == 0.0).unwrap_or(false),
+        Value::String(s) => s.is_empty(),
+        Value::Array(a) => a.is_empty(),
+        Value::Object(o) => o.is_empty(),
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Archive processing
+// ---------------------------------------------------------------------------
+
+/// Accumulated results for a whole archive: file bookkeeping plus the merged
+/// per-parser output keyed by the parser's registry name.
+pub struct ArchiveResults {
+    pub file_count: usize,
+    pub matched_files: usize,
+    pub parser_results: BTreeMap<String, Value>,
+    pub file_types: BTreeMap<String, usize>,
+}
+
+impl Default for ArchiveResults {
+    fn default() -> Self {
+        Self {
+            file_count: 0,
+            matched_files: 0,
+            parser_results: BTreeMap::new(),
+            file_types: BTreeMap::new(),
+        }
+    }
+}
+
+impl ArchiveResults {
+    /// Build the combined JSON object used by the CLI `--json` output and by
+    /// in-process consumers: top-level `fileCount`, `matchedFiles`,
+    /// `fileTypes`, plus one key per parser that produced results.
+    pub fn to_json(&self) -> Value {
+        let mut combined: Map<String, Value> = Map::new();
+        combined.insert("fileCount".to_string(), Value::from(self.file_count));
+        combined.insert("matchedFiles".to_string(), Value::from(self.matched_files));
+        combined.insert(
+            "fileTypes".to_string(),
+            serde_json::to_value(&self.file_types).unwrap_or(Value::Null),
+        );
+        for (k, v) in &self.parser_results {
+            combined.insert(k.clone(), v.clone());
+        }
+        Value::Object(combined)
+    }
+}
+
+fn value_is_empty(v: &Value) -> bool {
+    match v {
+        Value::Object(o) => !o.get("found").and_then(Value::as_bool).unwrap_or(false),
+        Value::Array(a) => a.is_empty(),
+        _ => false,
+    }
+}
+
+/// Combine two `ArchiveResults` (typically one per worker thread) into one.
+///
+/// - Numeric counters and the `file_types` histogram are summed.
+/// - `parser_results` are merged per parser according to its registry entry:
+///   `multi_file` parsers go through [`merge`] (deep array concatenation /
+///   counter sums); single-file parsers prefer the non-empty value, matching
+///   the sequential semantics in [`process_entry`].
+fn merge_archive_results(
+    multi_file_lookup: &HashMap<&str, bool>,
+    mut a: ArchiveResults,
+    b: ArchiveResults,
+) -> ArchiveResults {
+    a.file_count += b.file_count;
+    a.matched_files += b.matched_files;
+    for (k, v) in b.file_types {
+        *a.file_types.entry(k).or_insert(0) += v;
+    }
+    for (key, val_b) in b.parser_results {
+        match a.parser_results.remove(&key) {
+            None => {
+                a.parser_results.insert(key, val_b);
+            }
+            Some(val_a) => {
+                let is_multi = multi_file_lookup
+                    .get(key.as_str())
+                    .copied()
+                    .unwrap_or(false);
+                let merged = if is_multi {
+                    merge(val_a, val_b)
+                } else if value_is_empty(&val_b) {
+                    val_a
+                } else {
+                    val_b
+                };
+                a.parser_results.insert(key, merged);
+            }
+        }
+    }
+    a
+}
+
+fn detect_format(path: &Path) -> &'static str {
+    let name = path
+        .file_name()
+        .and_then(|n| n.to_str())
+        .unwrap_or("")
+        .to_lowercase();
+    if name.ends_with(".tar.xz") || name.ends_with(".txz") {
+        "tar.xz"
+    } else if name.ends_with(".tar.gz") || name.ends_with(".tgz") {
+        "tar.gz"
+    } else if name.ends_with(".tar") {
+        "tar"
+    } else if name.ends_with(".xz") {
+        "tar.xz" // bare .xz is assumed to wrap a tar (matches Python tarfile "r:*")
+    } else if name.ends_with(".gz") {
+        "tar.gz"
+    } else if name.ends_with(".zip") {
+        "zip"
+    } else if name.ends_with(".log") || name.ends_with(".txt") || name.ends_with(".out") {
+        "plaintext"
+    } else {
+        // Sniff magic bytes to distinguish a headerless tar from a console log.
+        match File::open(path) {
+            Ok(mut f) => {
+                let mut buf = [0u8; 6];
+                let n = f.read(&mut buf).unwrap_or(0);
+                if n >= 6 && buf == [0xfd, 0x37, 0x7a, 0x58, 0x5a, 0x00] {
+                    "tar.xz"
+                } else if n >= 2 && buf[0] == 0x1f && buf[1] == 0x8b {
+                    "tar.gz"
+                } else if n >= 4 && buf[..4] == [0x50, 0x4b, 0x03, 0x04] {
+                    "zip"
+                } else if n > 0
+                    && buf[..n]
+                        .iter()
+                        .all(|&b| b == 0x09 || b == 0x0a || b == 0x0d || (0x20..=0x7e).contains(&b))
+                {
+                    "plaintext"
+                } else {
+                    "tar"
+                }
+            }
+            Err(_) => "tar",
+        }
+    }
+}
+
+fn open_tar_reader(path: &Path) -> std::io::Result<Box<dyn Read>> {
+    let file = File::open(path)?;
+    Ok(match detect_format(path) {
+        "tar.xz" => Box::new(open_xz_mt(file)?),
+        "tar.gz" => Box::new(GzDecoder::new(file)),
+        _ => Box::new(file),
+    })
+}
+
+/// If the given member bytes start with a gzip or xz magic header, decompress
+/// them in-memory and strip the trailing `.gz` / `.xz` from `name` so that
+/// parser file-pattern regexes can match the underlying filename. Returns the
+/// (possibly rewritten) name and the (possibly decompressed) byte buffer.
+///
+/// Designed for nested compression inside tar/zip archives — e.g. rotated
+/// `messages-YYYYMMDD.gz` log files inside a `.tar.xz` supportconfig.
+fn maybe_decompress_inner(name: String, buf: Vec<u8>, debug: bool) -> (String, Vec<u8>) {
+    // gzip: 1f 8b
+    if buf.len() >= 2 && buf[0] == 0x1f && buf[1] == 0x8b {
+        let mut out = Vec::new();
+        match GzDecoder::new(buf.as_slice()).read_to_end(&mut out) {
+            Ok(_) => {
+                let stripped = name.strip_suffix(".gz").unwrap_or(&name).to_string();
+                if debug {
+                    eprintln!(
+                        "[debug] inner gzip member {name} -> {stripped} ({} -> {} bytes)",
+                        buf.len(),
+                        out.len()
+                    );
+                }
+                return (stripped, out);
+            }
+            Err(e) => {
+                if debug {
+                    eprintln!("[debug] inner gzip decompress failed for {name}: {e}");
+                }
+            }
+        }
+    }
+    // xz: fd 37 7a 58 5a 00
+    if buf.len() >= 6 && buf[..6] == [0xfd, 0x37, 0x7a, 0x58, 0x5a, 0x00] {
+        let mut out = Vec::new();
+        match XzDecoder::new(buf.as_slice()).read_to_end(&mut out) {
+            Ok(_) => {
+                let stripped = name.strip_suffix(".xz").unwrap_or(&name).to_string();
+                if debug {
+                    eprintln!(
+                        "[debug] inner xz member {name} -> {stripped} ({} -> {} bytes)",
+                        buf.len(),
+                        out.len()
+                    );
+                }
+                return (stripped, out);
+            }
+            Err(e) => {
+                if debug {
+                    eprintln!("[debug] inner xz decompress failed for {name}: {e}");
+                }
+            }
+        }
+    }
+    (name, buf)
+}
+
+/// Convert a byte buffer to `String` without copying when the bytes are
+/// already valid UTF-8. Falls back to a lossy copy otherwise.
+fn bytes_to_string(buf: Vec<u8>) -> String {
+    match String::from_utf8(buf) {
+        Ok(s) => s,
+        Err(e) => String::from_utf8_lossy(e.as_bytes()).into_owned(),
+    }
+}
+
+/// Open an `.xz` stream using liblzma's multi-threaded decoder
+/// (`lzma_stream_decoder_mt`). Falls back to the single-threaded decoder if
+/// the running liblzma is too old to support MT decoding.
+///
+/// Note: parallel decoding only happens for `.xz` files compressed into
+/// multiple blocks (e.g. produced by `xz -T0` / `xz -T N`). Files compressed
+/// with default single-threaded `xz` contain a single block and will decode
+/// on one thread no matter how many threads are requested. To benefit from
+/// this on a single-block archive, recompress with `xz -T0`.
+fn open_xz_mt(file: File) -> std::io::Result<XzDecoder<File>> {
+    let threads: u32 = std::thread::available_parallelism()
+        .map(|n| n.get() as u32)
+        .unwrap_or(1);
+
+    // Note: `MtStreamBuilder` in liblzma 0.4 does not expose a `flags()`
+    // setter; the underlying `lzma_mt.flags` defaults to 0, which is correct
+    // for ordinary single-stream `.xz` files (the common case for SCC/SOS
+    // archives). Streams that are the concatenation of several `.xz` files
+    // would require `LZMA_CONCATENATED`, which is not reachable here.
+    let stream_result: Result<Stream, _> = MtStreamBuilder::new()
+        .threads(threads.max(1))
+        .memlimit_stop(u64::MAX)
+        .decoder();
+
+    match stream_result {
+        Ok(stream) => Ok(XzDecoder::new_stream(file, stream)),
+        Err(_) => Ok(XzDecoder::new(file)),
+    }
+}
+
+struct CompiledParser {
+    spec_index: usize,
+    re: Regex,
+}
+
+/// Check whether *any* active parser's file pattern matches `member_path`.
+///
+/// Used as a fast pre-filter before reading the content of an archive member,
+/// so that large files which no parser cares about are skipped entirely
+/// (no `read_to_end`, no inner-decompress, no UTF-8 decode).
+fn any_parser_matches(member_path: &str, active: &[CompiledParser]) -> bool {
+    let probe = format!("/{member_path}");
+    active.iter().any(|cp| cp.re.is_match(&probe))
+}
+
+/// Bookkeeping-only update for skipped (non-matching) entries: increment
+/// `file_count` and the file-type histogram without reading content.
+fn record_skipped(member_path: &str, results: &mut ArchiveResults) {
+    results.file_count += 1;
+    let ext = Path::new(member_path)
+        .extension()
+        .and_then(|e| e.to_str())
+        .map(|s| format!(".{s}"))
+        .unwrap_or_else(|| "(none)".to_string());
+    *results.file_types.entry(ext).or_insert(0) += 1;
+}
+
+/// Apply the matching parsers to a single archive member's text content.
+fn process_entry(
+    member_path: &str,
+    content: &str,
+    specs: &[ParserSpec],
+    active: &[CompiledParser],
+    results: &mut ArchiveResults,
+    debug: bool,
+) {
+    results.file_count += 1;
+    let ext = Path::new(member_path)
+        .extension()
+        .and_then(|e| e.to_str())
+        .map(|s| format!(".{s}"))
+        .unwrap_or_else(|| "(none)".to_string());
+    *results.file_types.entry(ext).or_insert(0) += 1;
+
+    let probe = format!("/{member_path}");
+    let matching: Vec<&CompiledParser> =
+        active.iter().filter(|cp| cp.re.is_match(&probe)).collect();
+    if matching.is_empty() {
+        return;
+    }
+
+    results.matched_files += 1;
+    if debug {
+        let names: Vec<&str> = matching
+            .iter()
+            .map(|cp| specs[cp.spec_index].name)
+            .collect();
+        eprintln!(
+            "[debug] {member_path} ({} chars) -> {}",
+            content.len(),
+            names.join(", ")
+        );
+    }
+
+    // Each matching parser is independent and CPU-bound (regex-heavy). When
+    // a single file matches several parsers (common for SCC log/config
+    // bundles) we run them on the rayon thread pool so they overlap.
+    // The outer call site already lives inside a `par_bridge` worker, but
+    // rayon nested-parallelism is cooperative and adds no overhead when the
+    // pool is saturated -- the inner `into_par_iter` simply yields back.
+    use rayon::prelude::*;
+    let parsed_outputs: Vec<(usize, Value)> = matching
+        .par_iter()
+        .filter_map(|cp| {
+            let spec = &specs[cp.spec_index];
+            let raw = (spec.func)(content, member_path);
+            match serde_json::from_str::<Value>(&raw) {
+                Ok(v) => Some((cp.spec_index, v)),
+                Err(e) => {
+                    if debug {
+                        eprintln!(
+                            "[debug] parser '{}' produced invalid JSON on {member_path}: {e}",
+                            spec.name
+                        );
+                    }
+                    None
+                }
+            }
+        })
+        .collect();
+
+    for (spec_index, parsed) in parsed_outputs {
+        let spec = &specs[spec_index];
+        let key = spec.name.to_string();
+        if spec.multi_file {
+            let prev = results.parser_results.remove(&key).unwrap_or(Value::Null);
+            results.parser_results.insert(key, merge(prev, parsed));
+        } else {
+            let is_empty = match &parsed {
+                Value::Object(o) => !o.get("found").and_then(Value::as_bool).unwrap_or(false),
+                Value::Array(a) => a.is_empty(),
+                _ => false,
+            };
+            if !results.parser_results.contains_key(&key) || !is_empty {
+                results.parser_results.insert(key, parsed);
+            }
+        }
+    }
+}
+
+/// Walk an archive (or plaintext log) at `path`, dispatch each member to the
+/// matching parsers, and return the merged [`ArchiveResults`].
+///
+/// `parser_filter`, when `Some(name)`, restricts the run to the single parser
+/// with that registry name. `debug` enables per-file dispatch logging to
+/// stderr.
+pub fn process_archive(
+    path: &Path,
+    parser_filter: Option<&str>,
+    debug: bool,
+) -> Result<ArchiveResults, String> {
+    let specs = parsers();
+    let active: Vec<CompiledParser> = specs
+        .iter()
+        .enumerate()
+        .filter(|(_, s)| parser_filter.map_or(true, |n| n == s.name))
+        .map(|(i, s)| {
+            Regex::new(s.pattern)
+                .map(|re| CompiledParser { spec_index: i, re })
+                .map_err(|e| format!("invalid regex for {}: {e}", s.name))
+        })
+        .collect::<Result<_, _>>()?;
+
+    if let Some(name) = parser_filter {
+        if active.is_empty() {
+            return Err(format!(
+                "Unknown parser '{name}'. Use --list-parsers to see names."
+            ));
+        }
+    }
+
+    let mut results = ArchiveResults {
+        file_count: 0,
+        matched_files: 0,
+        parser_results: BTreeMap::new(),
+        file_types: BTreeMap::new(),
+    };
+
+    if detect_format(path) == "zip" {
+        let file = File::open(path).map_err(|e| format!("opening {}: {e}", path.display()))?;
+        let mut zip = zip::ZipArchive::new(file).map_err(|e| format!("zip open: {e}"))?;
+        for i in 0..zip.len() {
+            let mut entry = match zip.by_index(i) {
+                Ok(e) => e,
+                Err(e) => {
+                    if debug {
+                        eprintln!("[debug] zip entry {i} error: {e}");
+                    }
+                    continue;
+                }
+            };
+            if !entry.is_file() {
+                continue;
+            }
+            let name = entry.name().to_string();
+            // Pre-filter: skip the read entirely if no parser cares about
+            // either the original name or the inner-decompressed name.
+            let candidate = name
+                .strip_suffix(".gz")
+                .or_else(|| name.strip_suffix(".xz"))
+                .unwrap_or(&name);
+            if !any_parser_matches(&name, &active) && !any_parser_matches(candidate, &active) {
+                record_skipped(&name, &mut results);
+                continue;
+            }
+            let mut buf = Vec::new();
+            if let Err(e) = entry.read_to_end(&mut buf) {
+                if debug {
+                    eprintln!("[debug] read error {name}: {e}");
+                }
+                continue;
+            }
+            let (logical_name, raw) = maybe_decompress_inner(name, buf, debug);
+            let content = bytes_to_string(raw);
+            process_entry(
+                &logical_name,
+                &content,
+                &specs,
+                &active,
+                &mut results,
+                debug,
+            );
+        }
+        return Ok(results);
+    }
+
+    if detect_format(path) == "plaintext" {
+        // Mirror the Leptos web UI's `analyze_plaintext` path: read the file
+        // as a single console log and route it through the parser registry
+        // using a synthetic `messages` basename so the event parsers' file
+        // patterns match.
+        let mut file = File::open(path).map_err(|e| format!("opening {}: {e}", path.display()))?;
+        let mut buf = Vec::new();
+        file.read_to_end(&mut buf)
+            .map_err(|e| format!("reading {}: {e}", path.display()))?;
+        let original_name = path
+            .file_name()
+            .and_then(|n| n.to_str())
+            .unwrap_or("input.log")
+            .to_string();
+        let (_logical_name, raw) = maybe_decompress_inner(original_name.clone(), buf, debug);
+        let content = bytes_to_string(raw);
+        // Use a synthetic path that ends in `/messages` (with the original
+        // name preserved as a parent directory) so file-pattern regexes
+        // like `/(messages|localmessages|...)` match while the original
+        // filename remains visible in the file inventory.
+        let synthetic = format!("{original_name}/messages");
+        process_entry(&synthetic, &content, &specs, &active, &mut results, debug);
+        return Ok(results);
+    }
+
+    // ---- Tar branch (parallel) -------------------------------------------
+    //
+    // The reader thread walks the tar sequentially (libtar can't be split),
+    // pre-filters by path, increments bookkeeping for skipped entries, and
+    // pushes (logical_name, raw_bytes) for matching entries through a bounded
+    // crossbeam channel. Inner-archive decompression and UTF-8 decoding plus
+    // the regex-heavy parser dispatch happen in parallel on the rayon thread
+    // pool via `par_bridge` + `fold` + `reduce`.
+    let active = Arc::new(active);
+    let specs = Arc::new(specs);
+    let multi_file_lookup: HashMap<&str, bool> =
+        specs.iter().map(|s| (s.name, s.multi_file)).collect();
+
+    let workers = rayon::current_num_threads().max(1);
+    let (tx, rx) = bounded::<(String, Vec<u8>)>(workers * 4);
+
+    let path_for_reader = path.to_path_buf();
+    let active_for_reader = Arc::clone(&active);
+    let reader_handle = std::thread::spawn(move || -> Result<ArchiveResults, String> {
+        let mut local = ArchiveResults::default();
+        let reader = open_tar_reader(&path_for_reader)
+            .map_err(|e| format!("opening {}: {e}", path_for_reader.display()))?;
+        let mut archive = Archive::new(reader);
+        for entry in archive
+            .entries()
+            .map_err(|e| format!("reading entries: {e}"))?
+        {
+            let mut entry = match entry {
+                Ok(e) => e,
+                Err(e) => {
+                    if debug {
+                        eprintln!("[debug] entry error: {e}");
+                    }
+                    continue;
+                }
+            };
+            if !entry.header().entry_type().is_file() {
+                continue;
+            }
+            let path_in_tar = match entry.path() {
+                Ok(p) => p.to_string_lossy().into_owned(),
+                Err(_) => continue,
+            };
+            let candidate = path_in_tar
+                .strip_suffix(".gz")
+                .or_else(|| path_in_tar.strip_suffix(".xz"))
+                .unwrap_or(&path_in_tar);
+            if !any_parser_matches(&path_in_tar, &active_for_reader)
+                && !any_parser_matches(candidate, &active_for_reader)
+            {
+                record_skipped(&path_in_tar, &mut local);
+                continue;
+            }
+            let mut buf = Vec::new();
+            if let Err(e) = entry.read_to_end(&mut buf) {
+                if debug {
+                    eprintln!("[debug] read error {path_in_tar}: {e}");
+                }
+                continue;
+            }
+            if tx.send((path_in_tar, buf)).is_err() {
+                break;
+            }
+        }
+        // Dropping `tx` here closes the channel so the workers' iterator
+        // terminates and `reduce` can return.
+        drop(tx);
+        Ok(local)
+    });
+
+    let active_for_workers = Arc::clone(&active);
+    let specs_for_workers = Arc::clone(&specs);
+    let worker_results: ArchiveResults = rx
+        .into_iter()
+        .par_bridge()
+        .fold(ArchiveResults::default, |mut acc, (name, buf)| {
+            let (logical_name, raw) = maybe_decompress_inner(name, buf, debug);
+            let content = bytes_to_string(raw);
+            process_entry(
+                &logical_name,
+                &content,
+                &specs_for_workers,
+                &active_for_workers,
+                &mut acc,
+                debug,
+            );
+            acc
+        })
+        .reduce(ArchiveResults::default, |a, b| {
+            merge_archive_results(&multi_file_lookup, a, b)
+        });
+
+    let reader_results = reader_handle
+        .join()
+        .map_err(|_| "reader thread panicked".to_string())??;
+    let merged = merge_archive_results(&multi_file_lookup, reader_results, worker_results);
+
+    Ok(merged)
+}
+
+/// Analyze an archive (or plaintext log) and return the combined JSON value
+/// (`{fileCount, matchedFiles, fileTypes, ...parsers}`).
+///
+/// Convenience wrapper over [`process_archive`] + [`ArchiveResults::to_json`]
+/// for in-process consumers that want the same shape as the CLI `--json`
+/// output.
+pub fn analyze_archive(
+    path: &Path,
+    parser_filter: Option<&str>,
+    debug: bool,
+) -> Result<Value, String> {
+    Ok(process_archive(path, parser_filter, debug)?.to_json())
+}
diff --git a/rca-tool/lib/supportfile_core/src/lib.rs b/rca-tool/lib/supportfile_core/src/lib.rs
new file mode 100644
index 0000000..22b62e8
--- /dev/null
+++ b/rca-tool/lib/supportfile_core/src/lib.rs
@@ -0,0 +1,35 @@
+pub mod parsers;
+
+/// In-process supportconfig/sosreport analysis engine (parser registry,
+/// archive walk, parallel dispatch, result merging). Feature-gated because it
+/// pulls in the archive and parallelism crates that lean library / WASM /
+/// PyO3 builds do not need.
+#[cfg(feature = "cli")]
+pub mod engine;
+
+/// Cache a compiled `Regex` at the call site so it's only built once per
+/// process. Returns `&'static Regex`. Each call-site location gets its own
+/// `OnceLock`. Use this in place of `Regex::new(LITERAL).unwrap()` in any
+/// hot parser path -- benchmark showed >300 per-call recompiles costing
+/// 8-15s per archive on large sosreports.
+#[macro_export]
+macro_rules! cached_regex {
+    ($pat:expr) => {{
+        static RE: ::std::sync::OnceLock<::regex::Regex> = ::std::sync::OnceLock::new();
+        RE.get_or_init(|| ::regex::Regex::new($pat).expect("invalid regex literal"))
+    }};
+}
+
+pub use parsers::automation::*;
+pub use parsers::azure::*;
+pub use parsers::cluster::*;
+pub use parsers::debugfs::*;
+pub use parsers::events::*;
+pub use parsers::hana::*;
+pub use parsers::network_interfaces::*;
+pub use parsers::networking::*;
+pub use parsers::packages::*;
+pub use parsers::services::*;
+pub use parsers::storage::*;
+pub use parsers::unix::*;
+pub use parsers::vmcore::*;
diff --git a/rca-tool/lib/supportfile_core/src/parsers/automation.rs b/rca-tool/lib/supportfile_core/src/parsers/automation.rs
new file mode 100644
index 0000000..988ac3c
--- /dev/null
+++ b/rca-tool/lib/supportfile_core/src/parsers/automation.rs
@@ -0,0 +1,286 @@
+use regex::Regex;
+use serde::{Deserialize, Serialize};
+use std::sync::OnceLock;
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct AutomationEvent {
+    pub timestamp: String,
+    pub line_number: usize,
+    pub tool_type: String,
+    pub pattern_type: String,
+    pub command: Option<String>,
+    pub raw_line: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct AutomationResult {
+    pub found: bool,
+    pub count: usize,
+    pub events: Vec<AutomationEvent>,
+    pub source_path: String,
+}
+
+fn extract_timestamp(line: &str) -> Option<String> {
+    static ISO_RE: OnceLock<Regex> = OnceLock::new();
+    static SYSLOG_RE: OnceLock<Regex> = OnceLock::new();
+    let iso_re = ISO_RE.get_or_init(|| {
+        Regex::new(r"^(\d{4}-\d{2}-\d{2}[T\s]\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:[+-]\d{2}:\d{2})?)")
+            .unwrap()
+    });
+    let syslog_re = SYSLOG_RE
+        .get_or_init(|| Regex::new(r"^(\w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}(?:\.\d+)?)").unwrap());
+    iso_re
+        .captures(line)
+        .and_then(|c| c.get(1).map(|m| m.as_str().to_string()))
+        .or_else(|| {
+            syslog_re
+                .captures(line)
+                .and_then(|c| c.get(1).map(|m| m.as_str().to_string()))
+        })
+}
+
+fn strip_ansi_codes(input: &str) -> String {
+    static ANSI_RE: OnceLock<Regex> = OnceLock::new();
+    let re = ANSI_RE.get_or_init(|| Regex::new(r"\x1B\[[0-9;]*[A-Za-z]").unwrap());
+    re.replace_all(input, "").into_owned()
+}
+
+pub fn parse_automation_events(content: &str, source_path: &str) -> AutomationResult {
+    static ANSIBLE_CMD_RE: OnceLock<Regex> = OnceLock::new();
+    static ANSIBLE_SETUP_RE: OnceLock<Regex> = OnceLock::new();
+    static PUPPET_AGENT_RE: OnceLock<Regex> = OnceLock::new();
+    static PUPPET_APPLY_RE: OnceLock<Regex> = OnceLock::new();
+    static PUPPET_RUN_RE: OnceLock<Regex> = OnceLock::new();
+    static CHEF_CLIENT_RE: OnceLock<Regex> = OnceLock::new();
+    static CHEF_SOLO_RE: OnceLock<Regex> = OnceLock::new();
+    static CHEF_APPLY_RE: OnceLock<Regex> = OnceLock::new();
+
+    let ansible_cmd_re =
+        ANSIBLE_CMD_RE.get_or_init(|| Regex::new(r"ansible-command:\s*(.+)").unwrap());
+    let ansible_setup_re =
+        ANSIBLE_SETUP_RE.get_or_init(|| Regex::new(r"ansible-setup:\s*(.+)").unwrap());
+    let puppet_agent_re =
+        PUPPET_AGENT_RE.get_or_init(|| Regex::new(r"puppet-agent:\s*(.+)").unwrap());
+    let puppet_apply_re = PUPPET_APPLY_RE.get_or_init(|| Regex::new(r"(puppet apply.+)").unwrap());
+    let puppet_run_re = PUPPET_RUN_RE.get_or_init(|| Regex::new(r"puppet-run:\s*(.+)").unwrap());
+    let chef_client_re =
+        CHEF_CLIENT_RE.get_or_init(|| Regex::new(r"chef-client\[\d+\]:\s*(.+)").unwrap());
+    let chef_solo_re =
+        CHEF_SOLO_RE.get_or_init(|| Regex::new(r"chef-solo\[\d+\]:\s*(.+)").unwrap());
+    let chef_apply_re =
+        CHEF_APPLY_RE.get_or_init(|| Regex::new(r"chef-apply\[\d+\]:\s*(.+)").unwrap());
+
+    let lines: Vec<&str> = content.lines().collect();
+    let mut events = Vec::new();
+
+    for (i, line) in lines.iter().enumerate() {
+        if !(line.contains("ansible-") || line.contains("puppet") || line.contains("chef-")) {
+            continue;
+        }
+
+        let mut tool_type: Option<&str> = None;
+        let mut pattern_type: Option<&str> = None;
+        let mut command: Option<String> = None;
+        let mut end_line = i + 1;
+
+        if let Some(caps) = ansible_cmd_re.captures(line) {
+            tool_type = Some("ansible");
+            pattern_type = Some("command");
+            command = caps.get(1).map(|m| m.as_str().trim().to_string());
+        } else if let Some(caps) = ansible_setup_re.captures(line) {
+            tool_type = Some("ansible");
+            pattern_type = Some("setup");
+            command = caps.get(1).map(|m| m.as_str().trim().to_string());
+        } else if let Some(caps) = puppet_agent_re.captures(line) {
+            tool_type = Some("puppet");
+            pattern_type = Some("agent");
+            command = caps.get(1).map(|m| m.as_str().trim().to_string());
+        } else if let Some(caps) = puppet_run_re.captures(line) {
+            tool_type = Some("puppet");
+            pattern_type = Some("run");
+            command = caps.get(1).map(|m| m.as_str().trim().to_string());
+        } else if let Some(caps) = puppet_apply_re.captures(line) {
+            tool_type = Some("puppet");
+            pattern_type = Some("apply");
+            command = caps.get(1).map(|m| m.as_str().trim().to_string());
+        } else if let Some(caps) = chef_client_re.captures(line) {
+            let message =
+                strip_ansi_codes(caps.get(1).map(|m| m.as_str()).unwrap_or_default().trim());
+            if [
+                "Starting Chef",
+                "Chef Infra Client finished",
+                "Chef Run complete",
+                "Chef Client finished",
+                "Synchronizing Cookbooks",
+                "Installing Cookbook Gems",
+                "Compiling Cookbooks",
+                "Converging",
+                "FATAL:",
+                "ERROR:",
+            ]
+            .iter()
+            .any(|kw| message.contains(kw))
+            {
+                tool_type = Some("chef");
+                pattern_type = Some("client");
+                let mut context = vec![message];
+                for j in 1..=5 {
+                    if let Some(next_line) = lines.get(i + j) {
+                        if let Some(next_caps) = chef_client_re.captures(next_line) {
+                            context.push(strip_ansi_codes(
+                                next_caps
+                                    .get(1)
+                                    .map(|m| m.as_str())
+                                    .unwrap_or_default()
+                                    .trim(),
+                            ));
+                            end_line = i + j + 1;
+                        } else {
+                            break;
+                        }
+                    }
+                }
+                command = Some(context.join(" | "));
+            }
+        } else if let Some(caps) = chef_solo_re.captures(line) {
+            let message =
+                strip_ansi_codes(caps.get(1).map(|m| m.as_str()).unwrap_or_default().trim());
+            if [
+                "Starting Chef",
+                "Chef Solo finished",
+                "Chef Run complete",
+                "Synchronizing Cookbooks",
+                "Compiling Cookbooks",
+                "Converging",
+                "FATAL:",
+                "ERROR:",
+            ]
+            .iter()
+            .any(|kw| message.contains(kw))
+            {
+                tool_type = Some("chef");
+                pattern_type = Some("solo");
+                command = Some(message);
+            }
+        } else if let Some(caps) = chef_apply_re.captures(line) {
+            let message =
+                strip_ansi_codes(caps.get(1).map(|m| m.as_str()).unwrap_or_default().trim());
+            if [
+                "Starting Chef",
+                "Chef Apply finished",
+                "Chef Run complete",
+                "Compiling Cookbooks",
+                "Converging",
+                "FATAL:",
+                "ERROR:",
+            ]
+            .iter()
+            .any(|kw| message.contains(kw))
+            {
+                tool_type = Some("chef");
+                pattern_type = Some("apply");
+                command = Some(message);
+            }
+        }
+
+        if let (Some(tool_type), Some(pattern_type)) = (tool_type, pattern_type) {
+            events.push(AutomationEvent {
+                timestamp: extract_timestamp(line)
+                    .unwrap_or_else(|| "Date not detected".to_string()),
+                line_number: i + 1,
+                tool_type: tool_type.to_string(),
+                pattern_type: pattern_type.to_string(),
+                command,
+                raw_line: line.trim().to_string(),
+                source_path: source_path.to_string(),
+                source_line: Some(i + 1),
+                source_line_end: Some(end_line),
+            });
+        }
+    }
+
+    AutomationResult {
+        found: !events.is_empty(),
+        count: events.len(),
+        events,
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_automation_events_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_automation_events(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const PATH: &str = "var/log/messages";
+
+    #[test]
+    fn detects_ansible_and_puppet_events() {
+        let content = concat!(
+            "Jan 10 12:00:00 node1 root: ansible-command: /usr/bin/ansible-playbook site.yml\n",
+            "Jan 10 12:05:00 node1 root: puppet-agent: Applying configuration version 99\n"
+        );
+
+        let result = parse_automation_events(content, PATH);
+        assert!(result.found);
+        assert_eq!(result.count, 2);
+        assert_eq!(result.events[0].tool_type, "ansible");
+        assert_eq!(result.events[1].tool_type, "puppet");
+    }
+
+    #[test]
+    fn captures_chef_context() {
+        let content = concat!(
+            "Jan 10 12:00:00 node1 chef-client[123]: Starting Chef Infra Client\n",
+            "Jan 10 12:00:01 node1 chef-client[123]: Compiling Cookbooks...\n",
+            "Jan 10 12:00:02 node1 chef-client[123]: Chef Run complete\n"
+        );
+
+        let result = parse_automation_events(content, PATH);
+        assert!(result.found);
+        assert_eq!(result.events[0].tool_type, "chef");
+        assert!(result.events[0]
+            .command
+            .as_deref()
+            .unwrap_or("")
+            .contains("Chef Run complete"));
+    }
+
+    #[test]
+    fn automation_records_carry_source_provenance() {
+        let content = concat!(
+            "Jan 10 12:00:00 node1 root: ansible-command: /usr/bin/ansible-playbook site.yml\n",
+            "Jan 10 12:05:00 node1 root: puppet-agent: Applying configuration version 99\n",
+            "Jan 10 12:06:00 node1 chef-client[123]: Starting Chef Infra Client\n",
+            "Jan 10 12:06:01 node1 chef-client[123]: Compiling Cookbooks...\n",
+        );
+        let result = parse_automation_events(content, PATH);
+        assert!(result.found);
+        assert_eq!(result.source_path, PATH);
+        assert_eq!(result.events[0].source_path, PATH);
+        assert_eq!(result.events[0].source_line, Some(1));
+        assert_eq!(result.events[1].source_line, Some(2));
+        // Chef event spans context lines 3-4
+        assert_eq!(result.events[2].source_line, Some(3));
+        assert_eq!(result.events[2].source_line_end, Some(4));
+        for e in &result.events {
+            assert_eq!(e.source_path, PATH);
+            assert!(e.source_line.is_some());
+        }
+    }
+
+    #[test]
+    fn automation_json_wrapper_includes_source_path() {
+        let json =
+            parse_automation_events_json("Jan 10 12:00:00 node1 root: ansible-command: ls\n", PATH);
+        assert!(json.contains("\"source_path\":\"var/log/messages\""));
+        assert!(json.contains("\"source_line\":1"));
+    }
+}
diff --git a/rca-tool/lib/supportfile_core/src/parsers/azure.rs b/rca-tool/lib/supportfile_core/src/parsers/azure.rs
new file mode 100644
index 0000000..c980b96
--- /dev/null
+++ b/rca-tool/lib/supportfile_core/src/parsers/azure.rs
@@ -0,0 +1,984 @@
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use std::collections::HashMap;
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct AzureVmDataDisk {
+    pub lun: Option<i64>,
+    pub name: Option<String>,
+    pub disk_size_gb: Option<i64>,
+    pub storage_account_type: Option<String>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct AzureVmPropertiesResult {
+    pub found: bool,
+    pub vm_size: Option<String>,
+    pub publisher: Option<String>,
+    pub offer: Option<String>,
+    pub sku: Option<String>,
+    pub billing_code: Option<String>,
+    pub license_type: Option<String>,
+    pub billing_model: Option<String>,
+    pub detection_method: Option<String>,
+    pub os_disk_type: Option<String>,
+    pub data_disks: Vec<AzureVmDataDisk>,
+    pub has_ultra_disk: bool,
+    pub has_premium_v2: bool,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct AzureVmGenerationResult {
+    pub found: bool,
+    pub vm_size: Option<String>,
+    pub vm_generation: Option<u32>,
+    pub is_legacy_generation: bool,
+    pub recommendation: Option<String>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct SuseCloudRegisterResult {
+    pub found: bool,
+    pub billing_model: Option<String>,
+    pub detection_method: Option<String>,
+    pub registration_server: Option<String>,
+    pub registration_type: Option<String>,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct WaagentConfigWarning {
+    pub severity: String,
+    pub setting: String,
+    pub value: String,
+    pub message: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct WaagentConfigSummary {
+    pub extensions_enabled: Option<bool>,
+    pub provisioning_agent: Option<String>,
+    pub resource_disk_format: Option<bool>,
+    pub resource_disk_enable_swap: Option<bool>,
+    pub resource_disk_swap_size_mb: Option<i64>,
+    pub resource_disk_mount_point: Option<String>,
+    pub enable_firewall: Option<bool>,
+    pub enable_fips: Option<bool>,
+    pub root_device_scsi_timeout: Option<i64>,
+    pub logs_verbose: Option<bool>,
+    pub logs_collect: Option<bool>,
+    pub auto_update_enabled: Option<bool>,
+    pub auto_update_ga_family: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct WaagentConfigResult {
+    pub found: bool,
+    pub config: HashMap<String, String>,
+    pub summary: WaagentConfigSummary,
+    pub warnings: Vec<WaagentConfigWarning>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct WaagentLogEntry {
+    pub timestamp: Option<String>,
+    pub line: String,
+    pub line_number: usize,
+    pub correlation_id: Option<String>,
+    pub extension_name: Option<String>,
+    pub operation: Option<String>,
+    pub message: Option<String>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct WaagentVersionEntry {
+    pub version: String,
+    pub first_seen: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct WaagentExtensionStatus {
+    pub name: String,
+    pub status: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct WaagentLogResult {
+    pub found: bool,
+    pub agent_version: Option<String>,
+    pub agent_version_history: Vec<WaagentVersionEntry>,
+    pub goal_state_errors: Vec<WaagentLogEntry>,
+    pub extension_errors: Vec<WaagentLogEntry>,
+    pub resource_disk_errors: Vec<WaagentLogEntry>,
+    pub imds_errors: Vec<WaagentLogEntry>,
+    pub status_file_warnings: Vec<WaagentLogEntry>,
+    pub other_errors: Vec<WaagentLogEntry>,
+    pub other_warnings: Vec<WaagentLogEntry>,
+    pub extension_status_summary: Option<Vec<WaagentExtensionStatus>>,
+    pub total_errors: usize,
+    pub total_warnings: usize,
+    pub has_errors: bool,
+    pub has_warnings: bool,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct SecureBootResult {
+    pub found: bool,
+    pub enabled: Option<bool>,
+    pub supported: bool,
+    pub state_text: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+}
+
+fn norm_bool(val: Option<&String>) -> Option<bool> {
+    let value = val?.trim().to_ascii_lowercase();
+    match value.as_str() {
+        "y" | "yes" | "true" => Some(true),
+        "n" | "no" | "false" => Some(false),
+        _ => None,
+    }
+}
+
+fn detect_billing_model(
+    license_type: Option<&str>,
+    billing_code: Option<&str>,
+) -> (Option<String>, Option<String>) {
+    let license_upper = license_type
+        .map(|s| s.trim())
+        .filter(|s| !s.is_empty())
+        .map(|s| s.to_ascii_uppercase());
+
+    if let Some(ref lt) = license_upper {
+        if ["RHEL_BYOS", "SLES_BYOS"].contains(&lt.as_str()) {
+            return (
+                Some("BYOS".to_string()),
+                Some(format!(
+                    "License Type: {}",
+                    license_type.unwrap_or_default()
+                )),
+            );
+        }
+        if [
+            "RHEL_BASE",
+            "RHEL_SAPAPPS",
+            "RHEL_BASESAPHA",
+            "RHEL_SAPHA",
+            "RHEL_EUS",
+            "SLES",
+            "SLES_SAP",
+            "SLES_STANDARD",
+            "SLES_HPC",
+            "UBUNTU_PRO",
+        ]
+        .contains(&lt.as_str())
+        {
+            return (
+                Some("PAYG".to_string()),
+                Some(format!(
+                    "License Type: {}",
+                    license_type.unwrap_or_default()
+                )),
+            );
+        }
+    }
+
+    if let Some(code) = billing_code {
+        if [
+            "Linux_IaaS",
+            "Linux_IaaS_Canonical",
+            "Linux_IaaS_Software_Store",
+            "Linux_IaaS_Oracle",
+            "Linux_IaaS_OpenLogic",
+            "Linux_IaaS_Software_RedHat_Support_on_Store",
+            "Linux_IaaS_Software_suse_sles_hpc_byos",
+            "Linux_IaaS_Software_suse_sles_sap_byos",
+            "Linux_IaaS_Software_SUSE_BYOS",
+        ]
+        .contains(&code)
+        {
+            return (
+                Some("BYOS".to_string()),
+                Some(format!("Billing Code: {}", code)),
+            );
+        }
+        if [
+            "Linux_IaaS_SUSE",
+            "Linux_IaaS_RedHat_Support",
+            "Linux_IaaS_Software_SLES_Basic",
+            "Linux_IaaS_Software_SUSE_Support",
+            "Linux_IaaS_Software_RedHat_HA",
+            "Linux_IaaS_Software_RedHat_SAP_HA",
+            "Linux_IaaS_Software_SLES_for_HPC_Priority",
+            "Linux_IaaS_Software_SLES_for_SAP",
+            "Linux_IaaS_Software_SLES_Standard",
+            "Linux_IaaS_Software_RedHat-SAP_BusApp",
+        ]
+        .contains(&code)
+        {
+            return (
+                Some("PAYG".to_string()),
+                Some(format!("Billing Code: {}", code)),
+            );
+        }
+    }
+
+    (None, None)
+}
+
+fn extract_vm_generation(vm_size: &str) -> Option<u32> {
+    crate::cached_regex!(r"(?i)_v(\d+)$")
+        .captures(vm_size.trim())
+        .and_then(|c| c.get(1).and_then(|m| m.as_str().parse::<u32>().ok()))
+}
+
+pub fn parse_azure_vm_generation(content: &str, source_path: &str) -> AzureVmGenerationResult {
+    let vm = parse_azure_vm_properties(content, source_path);
+    let vm_size = vm.vm_size.clone();
+    let vm_generation = vm_size.as_deref().and_then(extract_vm_generation);
+    let is_legacy_generation = vm_generation.is_some_and(|g| g <= 3);
+
+    let recommendation = if is_legacy_generation {
+        Some(
+            "Legacy VM generation detected (v3 or older). Consider migrating to newer SKUs such as v6 for better price/performance."
+                .to_string(),
+        )
+    } else {
+        None
+    };
+
+    AzureVmGenerationResult {
+        found: vm_size.is_some(),
+        vm_size,
+        vm_generation,
+        is_legacy_generation,
+        recommendation,
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_azure_vm_properties(content: &str, source_path: &str) -> AzureVmPropertiesResult {
+    if let Ok(metadata) = serde_json::from_str::<Value>(content) {
+        let compute = metadata.get("compute").unwrap_or(&metadata);
+        let vm_size = compute
+            .get("vmSize")
+            .and_then(Value::as_str)
+            .map(|s| s.to_string());
+        let offer = compute
+            .get("offer")
+            .and_then(Value::as_str)
+            .map(|s| s.to_string());
+        let publisher = compute
+            .get("publisher")
+            .and_then(Value::as_str)
+            .map(|s| s.to_string());
+        let sku = compute
+            .get("sku")
+            .and_then(Value::as_str)
+            .map(|s| s.to_string());
+        let license_type = compute
+            .get("licenseType")
+            .and_then(Value::as_str)
+            .map(|s| s.to_string());
+        let billing_code = compute
+            .get("billingCode")
+            .and_then(Value::as_str)
+            .map(|s| s.to_string());
+
+        let os_disk_type = compute
+            .get("storageProfile")
+            .and_then(|sp| sp.get("osDisk"))
+            .and_then(|os| os.get("managedDisk"))
+            .and_then(|md| md.get("storageAccountType"))
+            .and_then(Value::as_str)
+            .map(|s| s.to_string());
+
+        let data_disks = compute
+            .get("storageProfile")
+            .and_then(|sp| sp.get("dataDisks"))
+            .and_then(Value::as_array)
+            .map(|arr| {
+                arr.iter()
+                    .map(|disk| AzureVmDataDisk {
+                        lun: disk.get("lun").and_then(Value::as_i64),
+                        name: disk
+                            .get("name")
+                            .and_then(Value::as_str)
+                            .map(|s| s.to_string()),
+                        disk_size_gb: disk.get("diskSizeGB").and_then(Value::as_i64),
+                        storage_account_type: disk
+                            .get("managedDisk")
+                            .and_then(|md| md.get("storageAccountType"))
+                            .and_then(Value::as_str)
+                            .map(|s| s.to_string()),
+                        source_path: source_path.to_string(),
+                    })
+                    .collect::<Vec<_>>()
+            })
+            .unwrap_or_default();
+
+        let (billing_model, detection_method) =
+            detect_billing_model(license_type.as_deref(), billing_code.as_deref());
+        let has_ultra_disk = os_disk_type.as_deref() == Some("UltraSSD_LRS")
+            || data_disks
+                .iter()
+                .any(|d| d.storage_account_type.as_deref() == Some("UltraSSD_LRS"));
+        let has_premium_v2 = os_disk_type.as_deref() == Some("PremiumV2_LRS")
+            || data_disks
+                .iter()
+                .any(|d| d.storage_account_type.as_deref() == Some("PremiumV2_LRS"));
+
+        return AzureVmPropertiesResult {
+            found: true,
+            vm_size,
+            publisher,
+            offer,
+            sku,
+            billing_code,
+            license_type,
+            billing_model,
+            detection_method,
+            os_disk_type,
+            data_disks,
+            has_ultra_disk,
+            has_premium_v2,
+            source_path: source_path.to_string(),
+        };
+    }
+
+    let mut values = HashMap::new();
+    for line in content.lines() {
+        if let Some(caps) = crate::cached_regex!(r"^(\w+):\s*(.+)$").captures(line.trim()) {
+            values.insert(
+                caps.get(1)
+                    .map(|m| m.as_str())
+                    .unwrap_or_default()
+                    .to_string(),
+                caps.get(2)
+                    .map(|m| m.as_str())
+                    .unwrap_or_default()
+                    .trim()
+                    .to_string(),
+            );
+        }
+    }
+
+    let vm_size = values.get("vmSize").cloned();
+    let offer = values.get("offer").cloned();
+    let publisher = values.get("publisher").cloned();
+    let sku = values.get("sku").cloned();
+    let license_type = values.get("licenseType").cloned();
+    let billing_code = values.get("billingCode").cloned();
+    let (billing_model, detection_method) =
+        detect_billing_model(license_type.as_deref(), billing_code.as_deref());
+
+    AzureVmPropertiesResult {
+        found: !(vm_size.is_none()
+            && offer.is_none()
+            && publisher.is_none()
+            && sku.is_none()
+            && license_type.is_none()
+            && billing_code.is_none()),
+        vm_size,
+        publisher,
+        offer,
+        sku,
+        billing_code,
+        license_type,
+        billing_model,
+        detection_method,
+        os_disk_type: None,
+        data_disks: Vec::new(),
+        has_ultra_disk: false,
+        has_premium_v2: false,
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_suse_cloud_register(content: &str, source_path: &str) -> SuseCloudRegisterResult {
+    let truncated = if content.len() > 100 * 1024 {
+        &content[..100 * 1024]
+    } else {
+        content
+    };
+    let mut registration_server: Option<String> = None;
+    let mut server_line: Option<usize> = None;
+
+    for (line_idx, line) in truncated.lines().enumerate().take(1000) {
+        let line_no = line_idx + 1;
+        let trimmed = line.trim();
+        if let Some(caps) =
+            crate::cached_regex!(r"SUSEConnect\s+--url\s+(https?://[^\s]+)").captures(trimmed)
+        {
+            registration_server = caps.get(1).map(|m| m.as_str().trim().to_string());
+            server_line = Some(line_no);
+            break;
+        }
+        if let Some(caps) = crate::cached_regex!(r"(?i)url\s*=\s*(.+)").captures(trimmed) {
+            registration_server = caps.get(1).map(|m| m.as_str().trim().to_string());
+            server_line = Some(line_no);
+            break;
+        }
+        if registration_server.is_none() {
+            if let Some(caps) = crate::cached_regex!(r"(?i)server\s*=\s*(.+)").captures(trimmed) {
+                registration_server = caps.get(1).map(|m| m.as_str().trim().to_string());
+                server_line = Some(line_no);
+                break;
+            }
+        }
+    }
+
+    let mut billing_model = None;
+    let mut detection_method = None;
+    let mut registration_type = None;
+
+    if let Some(server) = registration_server.clone() {
+        let server_lower = server.to_ascii_lowercase();
+        if server_lower.contains("smt-azure")
+            || server_lower.contains("smt.suse.de")
+            || server_lower.contains("susecloud.net")
+            || server_lower.contains("update.suse.com")
+        {
+            billing_model = Some("PAYG".to_string());
+            registration_type = Some("Microsoft SMT (Subscription Management Tool)".to_string());
+            detection_method = Some(format!("Cloud Registration: {}", server));
+        } else if server_lower.contains("scc.suse.com")
+            || server_lower.contains("customer.suse.com")
+        {
+            billing_model = Some("BYOS".to_string());
+            registration_type = Some("SUSE Customer Center (SCC)".to_string());
+            detection_method = Some(format!("Cloud Registration: {}", server));
+        } else if server_lower.contains("rmt") || !server_lower.contains("suse") {
+            billing_model = Some("BYOS".to_string());
+            registration_type = Some("Custom RMT Server".to_string());
+            detection_method = Some(format!("Cloud Registration: {}", server));
+        }
+    }
+
+    SuseCloudRegisterResult {
+        found: billing_model.is_some(),
+        billing_model,
+        detection_method,
+        registration_server,
+        registration_type,
+        source_path: source_path.to_string(),
+        source_line: server_line,
+    }
+}
+
+pub fn parse_waagent_config(content: &str, source_path: &str) -> WaagentConfigResult {
+    let mut config = HashMap::new();
+    let mut config_lines: HashMap<String, usize> = HashMap::new();
+    for (line_idx, line) in content.lines().enumerate() {
+        let line_no = line_idx + 1;
+        let trimmed = line.trim();
+        if trimmed.is_empty() || trimmed.starts_with('#') {
+            continue;
+        }
+        if let Some((k, v)) = trimmed.split_once('=') {
+            let key = k.trim().to_string();
+            config_lines.insert(key.clone(), line_no);
+            config.insert(key, v.trim().to_string());
+        }
+    }
+
+    let summary = WaagentConfigSummary {
+        extensions_enabled: norm_bool(config.get("Extensions.Enabled")),
+        provisioning_agent: config
+            .get("Provisioning.Agent")
+            .cloned()
+            .or_else(|| config.get("Provisioning.Enabled").cloned()),
+        resource_disk_format: norm_bool(config.get("ResourceDisk.Format")),
+        resource_disk_enable_swap: norm_bool(config.get("ResourceDisk.EnableSwap")),
+        resource_disk_swap_size_mb: config
+            .get("ResourceDisk.SwapSizeMB")
+            .and_then(|v| v.parse::<i64>().ok()),
+        resource_disk_mount_point: config.get("ResourceDisk.MountPoint").cloned(),
+        enable_firewall: norm_bool(config.get("OS.EnableFirewall")),
+        enable_fips: norm_bool(config.get("OS.EnableFIPS")),
+        root_device_scsi_timeout: config
+            .get("OS.RootDeviceScsiTimeout")
+            .and_then(|v| v.parse::<i64>().ok()),
+        logs_verbose: norm_bool(config.get("Logs.Verbose")),
+        logs_collect: norm_bool(config.get("Logs.Collect")),
+        auto_update_enabled: norm_bool(config.get("AutoUpdate.Enabled")),
+        auto_update_ga_family: config.get("AutoUpdate.GAFamily").cloned(),
+    };
+
+    let mut warnings = Vec::new();
+    if summary.extensions_enabled == Some(false) {
+        warnings.push(WaagentConfigWarning {
+            severity: "warning".to_string(),
+            setting: "Extensions.Enabled".to_string(),
+            value: config
+                .get("Extensions.Enabled")
+                .cloned()
+                .unwrap_or_default(),
+            message:
+                "VM extensions are disabled — extensions (monitoring, backups, CSE) will not run."
+                    .to_string(),
+            source_path: source_path.to_string(),
+            source_line: config_lines.get("Extensions.Enabled").copied(),
+        });
+    }
+    if summary.resource_disk_enable_swap == Some(true) {
+        warnings.push(WaagentConfigWarning {
+            severity: "info".to_string(),
+            setting: "ResourceDisk.EnableSwap".to_string(),
+            value: format!("{} ({} MB)", config.get("ResourceDisk.EnableSwap").cloned().unwrap_or_default(), summary.resource_disk_swap_size_mb.unwrap_or(0)),
+            message: "Swap is enabled on the resource (temporary) disk. Data on this disk is not persistent across VM maintenance events.".to_string(),
+            source_path: source_path.to_string(),
+            source_line: config_lines.get("ResourceDisk.EnableSwap").copied(),
+        });
+    }
+    if summary.enable_firewall == Some(false) {
+        warnings.push(WaagentConfigWarning {
+            severity: "warning".to_string(),
+            setting: "OS.EnableFirewall".to_string(),
+            value: config.get("OS.EnableFirewall").cloned().unwrap_or_default(),
+            message: "The Azure agent OS-level firewall (wire-server access control) is disabled."
+                .to_string(),
+            source_path: source_path.to_string(),
+            source_line: config_lines.get("OS.EnableFirewall").copied(),
+        });
+    }
+    if summary.enable_fips == Some(true) {
+        warnings.push(WaagentConfigWarning {
+            severity: "info".to_string(),
+            setting: "OS.EnableFIPS".to_string(),
+            value: config.get("OS.EnableFIPS").cloned().unwrap_or_default(),
+            message: "FIPS mode is enabled for the Azure agent.".to_string(),
+            source_path: source_path.to_string(),
+            source_line: config_lines.get("OS.EnableFIPS").copied(),
+        });
+    }
+    if summary.auto_update_enabled == Some(false) {
+        warnings.push(WaagentConfigWarning {
+            severity: "info".to_string(),
+            setting: "AutoUpdate.Enabled".to_string(),
+            value: config
+                .get("AutoUpdate.Enabled")
+                .cloned()
+                .unwrap_or_default(),
+            message: "Auto-update of the Azure Linux Agent is disabled.".to_string(),
+            source_path: source_path.to_string(),
+            source_line: config_lines.get("AutoUpdate.Enabled").copied(),
+        });
+    }
+
+    WaagentConfigResult {
+        found: !config.is_empty(),
+        config,
+        summary,
+        warnings,
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_waagent_log(content: &str, source_path: &str) -> WaagentLogResult {
+    let lines: Vec<&str> = content.lines().collect();
+    let ts_regex = crate::cached_regex!(r"^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})\.\d+Z\s+");
+    let heartbeat_regex = crate::cached_regex!(r"WALinuxAgent-(\S+)\s+is running");
+    let corr_regex = crate::cached_regex!(r"correlation ID: ([0-9a-f-]+)");
+    let name_regex = crate::cached_regex!(r"name=([^,\s]+)");
+    let op_regex = crate::cached_regex!(r"op=([^,\s]+)");
+    let msg_regex = crate::cached_regex!(r"message=(.+)");
+    let ext_regex = crate::cached_regex!(r"extension\s+(\S+)");
+    let tuple_regex = crate::cached_regex!(r#"\(\\?\"([^\"\\]+)\\?\",\s*\\?\"([^\"\\]+)\\?\"\)"#);
+
+    let mut version_history = Vec::new();
+    let mut current_version: Option<String> = None;
+    let mut goal_state_errors = Vec::new();
+    let mut extension_errors = Vec::new();
+    let mut resource_disk_errors = Vec::new();
+    let mut imds_errors = Vec::new();
+    let mut status_file_warnings = Vec::new();
+    let mut other_errors = Vec::new();
+    let mut other_warnings = Vec::new();
+
+    for (i, line) in lines.iter().enumerate() {
+        if line.is_empty() {
+            continue;
+        }
+        let timestamp = ts_regex
+            .captures(line)
+            .and_then(|c| c.get(1).map(|m| m.as_str().replace('T', " ")));
+
+        if let Some(caps) = heartbeat_regex.captures(line) {
+            let version = caps
+                .get(1)
+                .map(|m| m.as_str().to_string())
+                .unwrap_or_default();
+            if current_version.as_deref() != Some(version.as_str()) {
+                current_version = Some(version.clone());
+                version_history.push(WaagentVersionEntry {
+                    version,
+                    first_seen: timestamp.clone(),
+                });
+            }
+            continue;
+        }
+
+        let mut entry = WaagentLogEntry {
+            timestamp: timestamp.clone(),
+            line: line.chars().take(500).collect(),
+            line_number: i + 1,
+            correlation_id: None,
+            extension_name: None,
+            operation: None,
+            message: None,
+            source_path: source_path.to_string(),
+        };
+
+        if line.contains(" ERROR ") {
+            if line.contains("Error fetching the goal state") {
+                entry.correlation_id = corr_regex
+                    .captures(line)
+                    .and_then(|c| c.get(1).map(|m| m.as_str().to_string()));
+                goal_state_errors.push(entry);
+            } else if line.contains("op=Enable") || line.contains("op=Install") {
+                entry.extension_name = name_regex
+                    .captures(line)
+                    .and_then(|c| c.get(1).map(|m| m.as_str().to_string()));
+                entry.operation = op_regex
+                    .captures(line)
+                    .and_then(|c| c.get(1).map(|m| m.as_str().to_string()));
+                entry.message = msg_regex
+                    .captures(line)
+                    .and_then(|c| c.get(1).map(|m| m.as_str().chars().take(300).collect()));
+                extension_errors.push(entry);
+            } else if line.contains("ResourceDisk") || line.contains("resource disk") {
+                entry.message = Some(line.chars().take(300).collect());
+                resource_disk_errors.push(entry);
+            } else {
+                other_errors.push(entry);
+            }
+        } else if line.contains(" WARNING ") {
+            if line.contains("IMDS_CONNECTION_ERROR") {
+                imds_errors.push(entry);
+            } else if line.contains("no status file was reported")
+                || line.contains("incorrect format")
+            {
+                entry.extension_name = ext_regex.captures(line).and_then(|c| {
+                    c.get(1)
+                        .map(|m| m.as_str().trim_end_matches(':').to_string())
+                });
+                status_file_warnings.push(entry);
+            } else if line.contains("ResourceDisk") || line.contains("resource disk") {
+                entry.message = Some(line.chars().take(300).collect());
+                resource_disk_errors.push(entry);
+            } else {
+                other_warnings.push(entry);
+            }
+        }
+    }
+
+    let mut extension_status_summary = None;
+    for line in lines.iter().rev() {
+        if line.contains("Extension status:") {
+            if let Some(caps) = crate::cached_regex!(r"Extension status:\s*\[(.+)\]").captures(line)
+            {
+                let raw = caps.get(1).map(|m| m.as_str()).unwrap_or_default();
+                let entries = tuple_regex
+                    .captures_iter(raw)
+                    .filter_map(|m| {
+                        Some(WaagentExtensionStatus {
+                            name: m.get(1)?.as_str().to_string(),
+                            status: m.get(2)?.as_str().to_string(),
+                        })
+                    })
+                    .collect::<Vec<_>>();
+                if !entries.is_empty() {
+                    extension_status_summary = Some(entries);
+                }
+            }
+            break;
+        }
+    }
+
+    let total_errors = goal_state_errors.len()
+        + extension_errors.len()
+        + resource_disk_errors.len()
+        + other_errors.len();
+    let total_warnings = imds_errors.len() + status_file_warnings.len() + other_warnings.len();
+
+    WaagentLogResult {
+        found: true,
+        agent_version: current_version,
+        agent_version_history: version_history,
+        goal_state_errors,
+        extension_errors,
+        resource_disk_errors,
+        imds_errors,
+        status_file_warnings,
+        other_errors,
+        other_warnings,
+        extension_status_summary,
+        total_errors,
+        total_warnings,
+        has_errors: total_errors > 0,
+        has_warnings: total_warnings > 0,
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_azure_vm_properties_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_azure_vm_properties(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_azure_vm_generation_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_azure_vm_generation(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_suse_cloud_register_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_suse_cloud_register(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_waagent_config_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_waagent_config(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_waagent_log_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_waagent_log(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+/// Parse the output of `mokutil --sb-state` as captured by sosreport at
+/// `sos_commands/boot/mokutil_--sb-state`.
+///
+/// Recognized states:
+///   - "SecureBoot enabled"  -> enabled = Some(true),  supported = true
+///   - "SecureBoot disabled" -> enabled = Some(false), supported = true
+///   - "EFI variables are not supported on this system" (or similar)
+///     -> enabled = None, supported = false
+///
+/// This information is only present in sosreport archives; supportconfig
+/// does not capture an equivalent file.
+pub fn parse_secure_boot(content: &str, source_path: &str) -> SecureBootResult {
+    let truncated = if content.len() > 16 * 1024 {
+        &content[..16 * 1024]
+    } else {
+        content
+    };
+
+    let mut found = false;
+    let mut enabled: Option<bool> = None;
+    let mut supported = true;
+    let mut state_text = String::new();
+    let mut source_line: Option<usize> = None;
+
+    for (line_idx, line) in truncated.lines().enumerate().take(50) {
+        let trimmed = line.trim();
+        if trimmed.is_empty() {
+            continue;
+        }
+        let lower = trimmed.to_ascii_lowercase();
+        if lower.contains("secureboot enabled") || lower == "secureboot: enabled" {
+            found = true;
+            enabled = Some(true);
+            supported = true;
+            state_text = trimmed.to_string();
+            source_line = Some(line_idx + 1);
+            break;
+        }
+        if lower.contains("secureboot disabled") || lower == "secureboot: disabled" {
+            found = true;
+            enabled = Some(false);
+            supported = true;
+            state_text = trimmed.to_string();
+            source_line = Some(line_idx + 1);
+            break;
+        }
+        if lower.contains("efi variables are not supported")
+            || lower.contains("efi variables not supported")
+            || lower.contains("this system doesn't support secure boot")
+        {
+            found = true;
+            enabled = None;
+            supported = false;
+            state_text = trimmed.to_string();
+            source_line = Some(line_idx + 1);
+            break;
+        }
+    }
+
+    SecureBootResult {
+        found,
+        enabled,
+        supported,
+        state_text,
+        source_path: source_path.to_string(),
+        source_line,
+    }
+}
+
+pub fn parse_secure_boot_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_secure_boot(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parses_vm_properties_from_json() {
+        let input = r#"{
+          "compute": {
+            "vmSize": "Standard_D4s_v5",
+            "publisher": "RedHat",
+            "offer": "RHEL",
+            "sku": "9-lvm",
+            "licenseType": "RHEL_BYOS",
+            "storageProfile": {
+              "osDisk": { "managedDisk": { "storageAccountType": "Premium_LRS" } },
+              "dataDisks": [
+                { "lun": 0, "name": "data0", "diskSizeGB": 128, "managedDisk": { "storageAccountType": "UltraSSD_LRS" } }
+              ]
+            }
+          }
+        }"#;
+
+        let result = parse_azure_vm_properties(input, "");
+        assert!(result.found);
+        assert_eq!(result.billing_model.as_deref(), Some("BYOS"));
+        assert!(result.has_ultra_disk);
+    }
+
+    #[test]
+    fn detects_legacy_vm_generation() {
+        let input = r#"{
+                    "compute": {
+                        "vmSize": "Standard_D8s_v2"
+                    }
+                }"#;
+
+        let result = parse_azure_vm_generation(input, "");
+        assert!(result.found);
+        assert_eq!(result.vm_generation, Some(2));
+        assert!(result.is_legacy_generation);
+        assert!(result.recommendation.is_some());
+    }
+
+    #[test]
+    fn detects_modern_vm_generation() {
+        let input = r#"{
+                    "compute": {
+                        "vmSize": "Standard_D4s_v6"
+                    }
+                }"#;
+
+        let result = parse_azure_vm_generation(input, "");
+        assert!(result.found);
+        assert_eq!(result.vm_generation, Some(6));
+        assert!(!result.is_legacy_generation);
+        assert!(result.recommendation.is_none());
+    }
+
+    #[test]
+    fn parses_suse_registration() {
+        let input = "Registration: /usr/sbin/SUSEConnect --url https://scc.suse.com";
+        let result = parse_suse_cloud_register(input, "");
+        assert!(result.found);
+        assert_eq!(result.billing_model.as_deref(), Some("BYOS"));
+    }
+
+    #[test]
+    fn parses_waagent_config_and_warnings() {
+        let input = concat!(
+            "Extensions.Enabled=n\n",
+            "ResourceDisk.EnableSwap=y\n",
+            "ResourceDisk.SwapSizeMB=2048\n",
+            "OS.EnableFirewall=n\n",
+            "AutoUpdate.Enabled=n\n"
+        );
+        let result = parse_waagent_config(input, "");
+        assert!(result.found);
+        assert_eq!(result.summary.extensions_enabled, Some(false));
+        assert!(result.warnings.len() >= 3);
+    }
+
+    #[test]
+    fn parses_waagent_log_categories() {
+        let input = concat!(
+            "2026-02-19T06:05:04.123456Z INFO ExtHandler WALinuxAgent-2.9.1 is running\n",
+            "2026-02-19T06:06:04.123456Z ERROR ExtHandler Error fetching the goal state [incarnation 4] from wireserver, correlation ID: abcd-1234\n",
+            "2026-02-19T06:06:05.123456Z ERROR ExtHandler name=CustomScript, op=Enable, message=Enable failed\n",
+            "2026-02-19T06:06:06.123456Z WARNING ExtHandler IMDS_CONNECTION_ERROR failed to connect\n",
+            "2026-02-19T06:06:07.123456Z INFO ExtHandler Extension status: [(\"CustomScript\", \"error\")]\n"
+        );
+        let result = parse_waagent_log(input, "");
+        assert!(result.found);
+        assert_eq!(result.agent_version.as_deref(), Some("2.9.1"));
+        assert_eq!(result.goal_state_errors.len(), 1);
+        assert_eq!(result.extension_errors.len(), 1);
+        assert_eq!(result.imds_errors.len(), 1);
+    }
+
+    #[test]
+    fn secure_boot_detects_disabled() {
+        let result = parse_secure_boot(
+            "SecureBoot disabled\n",
+            "sos_commands/boot/mokutil_--sb-state",
+        );
+        assert!(result.found);
+        assert_eq!(result.enabled, Some(false));
+        assert!(result.supported);
+        assert_eq!(result.state_text, "SecureBoot disabled");
+        assert_eq!(result.source_line, Some(1));
+    }
+
+    #[test]
+    fn secure_boot_detects_enabled() {
+        let result = parse_secure_boot(
+            "SecureBoot enabled\n",
+            "sos_commands/boot/mokutil_--sb-state",
+        );
+        assert!(result.found);
+        assert_eq!(result.enabled, Some(true));
+        assert!(result.supported);
+    }
+
+    #[test]
+    fn secure_boot_detects_unsupported() {
+        let result = parse_secure_boot(
+            "EFI variables are not supported on this system\n",
+            "sos_commands/boot/mokutil_--sb-state",
+        );
+        assert!(result.found);
+        assert_eq!(result.enabled, None);
+        assert!(!result.supported);
+    }
+
+    #[test]
+    fn secure_boot_empty_returns_not_found() {
+        let result = parse_secure_boot("", "sos_commands/boot/mokutil_--sb-state");
+        assert!(!result.found);
+        assert_eq!(result.enabled, None);
+    }
+}
diff --git a/rca-tool/lib/supportfile_core/src/parsers/cluster.rs b/rca-tool/lib/supportfile_core/src/parsers/cluster.rs
new file mode 100644
index 0000000..f10b5fa
--- /dev/null
+++ b/rca-tool/lib/supportfile_core/src/parsers/cluster.rs
@@ -0,0 +1,4688 @@
+use regex::Regex;
+use serde::{Deserialize, Serialize};
+use std::collections::HashSet;
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct ParserWarning {
+    pub kind: String,
+    pub severity: String,
+    pub message: String,
+    pub parameter: Option<String>,
+    pub expected: Option<String>,
+    pub actual: Option<String>,
+    pub recommendation: Option<String>,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct CorosyncConfigResult {
+    pub found: bool,
+    pub totem_token: Option<i64>,
+    pub totem_retransmits: Option<i64>,
+    pub totem_join: Option<i64>,
+    pub totem_consensus: Option<i64>,
+    pub totem_max_messages: Option<i64>,
+    pub totem_transport: Option<String>,
+    pub quorum_provider: Option<String>,
+    pub quorum_expected_votes: Option<i64>,
+    pub quorum_two_node: Option<i64>,
+    pub warnings: Vec<ParserWarning>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct ClusterNodeStatus {
+    pub name: String,
+    pub status: String,
+    pub online: bool,
+    pub is_dc: bool,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct ClusterStatusResult {
+    pub found: bool,
+    pub cluster_name: Option<String>,
+    pub dc_node: Option<String>,
+    pub nodes_configured: Option<i64>,
+    pub resources_configured: Option<i64>,
+    pub last_updated: Option<String>,
+    pub quorum_status: Option<String>,
+    pub node_statuses: Vec<ClusterNodeStatus>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct HighCpuEvent {
+    pub timestamp: String,
+    pub source_node: String,
+    pub resource: String,
+    pub cpu_load: f64,
+    pub severity: String,
+    pub action: String,
+    pub raw_line: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct ResourceMigrationEvent {
+    pub timestamp: Option<String>,
+    pub resource: String,
+    pub from_node: Option<String>,
+    pub to_node: Option<String>,
+    pub action: String,
+    pub severity: Option<String>,
+    pub cpu_load: Option<f64>,
+    pub error: Option<String>,
+    pub raw_line: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct FencingEvent {
+    pub timestamp: Option<String>,
+    pub target_node: String,
+    pub action: String,
+    pub status: String,
+    pub agent: Option<String>,
+    pub raw_line: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct ClusterEventsResult {
+    pub found: bool,
+    pub resource_migrations: Vec<ResourceMigrationEvent>,
+    pub fencing_events: Vec<FencingEvent>,
+    pub total_events: usize,
+    pub count: usize,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct ClusterMaintenanceResult {
+    pub found: bool,
+    pub maintenance_mode: Option<bool>,
+    pub resources_in_maintenance: Vec<String>,
+    pub warnings: Vec<ParserWarning>,
+    pub source_path: String,
+}
+
+#[allow(clippy::too_many_arguments)]
+fn make_warning(
+    kind: &str,
+    severity: &str,
+    message: String,
+    parameter: Option<&str>,
+    expected: Option<String>,
+    actual: Option<String>,
+    recommendation: Option<&str>,
+    source_path: &str,
+    source_line: Option<usize>,
+) -> ParserWarning {
+    ParserWarning {
+        kind: kind.to_string(),
+        severity: severity.to_string(),
+        message,
+        parameter: parameter.map(|s| s.to_string()),
+        expected,
+        actual,
+        recommendation: recommendation.map(|s| s.to_string()),
+        source_path: source_path.to_string(),
+        source_line,
+        source_line_end: source_line,
+    }
+}
+
+fn parse_syslog_prefix(line: &str) -> (Option<String>, Option<String>, String) {
+    use std::sync::OnceLock;
+    static ISO_RE: OnceLock<Regex> = OnceLock::new();
+    static SYSLOG_RE: OnceLock<Regex> = OnceLock::new();
+    static SYSLOG_PARTS_RE: OnceLock<Regex> = OnceLock::new();
+
+    let iso_re = ISO_RE.get_or_init(|| {
+        Regex::new(r"^(\d{4}-\d{2}-\d{2}[T\s]\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:[+-]\d{2}:\d{2})?)")
+            .unwrap()
+    });
+    let syslog_re = SYSLOG_RE
+        .get_or_init(|| Regex::new(r"^(\w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}(?:\.\d+)?)").unwrap());
+    let syslog_parts_re = SYSLOG_PARTS_RE.get_or_init(|| {
+        Regex::new(r"^\w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}(?:\.\d+)?\s+(\S+)\s+.+?:\s*(.+)$")
+            .unwrap()
+    });
+
+    let timestamp = iso_re
+        .captures(line)
+        .and_then(|c| c.get(1).map(|m| m.as_str().to_string()))
+        .or_else(|| {
+            syslog_re
+                .captures(line)
+                .and_then(|c| c.get(1).map(|m| m.as_str().to_string()))
+        });
+
+    if let Some(caps) = syslog_parts_re.captures(line) {
+        let node = caps.get(1).map(|m| m.as_str().to_string());
+        let message = caps
+            .get(2)
+            .map(|m| m.as_str().to_string())
+            .unwrap_or_else(|| line.trim().to_string());
+        (timestamp, node, message)
+    } else {
+        (timestamp, None, line.trim().to_string())
+    }
+}
+
+fn is_systemd_resource(resource: &str) -> bool {
+    let lower = resource.to_ascii_lowercase();
+    lower.ends_with(".service")
+        || lower.ends_with(".target")
+        || lower.ends_with(".socket")
+        || lower.ends_with(".mount")
+        || lower.ends_with(".swap")
+        || lower.ends_with(".path")
+        || lower.ends_with(".timer")
+        || lower.ends_with(".device")
+        || lower.ends_with(".scope")
+        || lower.ends_with(".slice")
+        || resource.contains('@')
+}
+
+fn is_system_resource(resource: &str) -> bool {
+    use std::sync::OnceLock;
+    static RE: OnceLock<Regex> = OnceLock::new();
+    RE.get_or_init(|| {
+        Regex::new(r"^(?i)(Getty|Login|Console|Session|User|Seat|agetty|mingetty|mgetty|plymouth|systemd-|dbus|polkit|NetworkManager|ModemManager|firewalld|sshd|crond?|rsyslog|auditd|chronyd?|ntpd?)$")
+            .unwrap()
+    })
+    .is_match(resource)
+}
+
+fn is_non_cluster_node(node: &str) -> bool {
+    use std::sync::OnceLock;
+    static RE: OnceLock<Regex> = OnceLock::new();
+    RE.get_or_init(|| {
+        Regex::new(r"^(?i)(tty\d*[\.\-]?\d*|tty\d*\.{3}|pts/?\d*|console|localhost|127\.0\.0\.1|::1|\d+|port|ports?|socket|sockets?)\.{0,3}$").unwrap()
+    })
+    .is_match(node)
+}
+
+/// Returns true if the line clearly originates from a Pacemaker / Corosync /
+/// SBD / pcsd-related process (used to filter out unrelated systemd / app
+/// messages that happen to mention "Starting" or "Stopping").
+fn is_cluster_log_source(line: &str) -> bool {
+    use std::sync::OnceLock;
+    static RE: OnceLock<Regex> = OnceLock::new();
+    RE.get_or_init(|| {
+        Regex::new(r"(?i)\b(pacemaker(?:-[a-z]+)?|corosync|pcsd|sbd|crmd|lrmd|pengine|attrd|cib|stonith(?:-ng|d)?|fenced|booth|crm_resource|crm_mon|crm_node|crm_attribute)\b").unwrap()
+    })
+    .is_match(line)
+}
+
+// ---------------------------------------------------------------------------
+// Corosync config
+// ---------------------------------------------------------------------------
+
+pub fn parse_corosync_config(content: &str, source_path: &str) -> CorosyncConfigResult {
+    let mut result = CorosyncConfigResult {
+        found: false,
+        totem_token: None,
+        totem_retransmits: None,
+        totem_join: None,
+        totem_consensus: None,
+        totem_max_messages: None,
+        totem_transport: None,
+        quorum_provider: None,
+        quorum_expected_votes: None,
+        quorum_two_node: None,
+        warnings: Vec::new(),
+        source_path: source_path.to_string(),
+    };
+
+    // Track which line each value came from so warnings can point at the
+    // offending statement in the original file.
+    let mut lines_for: std::collections::HashMap<&'static str, usize> =
+        std::collections::HashMap::new();
+
+    let mut in_totem = false;
+    let mut in_quorum = false;
+    let mut totem_depth = 0i32;
+    let mut quorum_depth = 0i32;
+
+    for (idx, raw_line) in content.lines().enumerate() {
+        let line_no = idx + 1;
+        let line = raw_line.trim();
+        if line.is_empty() {
+            continue;
+        }
+
+        if !in_totem && line.starts_with("totem") {
+            in_totem = true;
+            result.found = true;
+        }
+        if !in_quorum && line.starts_with("quorum") {
+            in_quorum = true;
+            result.found = true;
+        }
+
+        if in_totem {
+            totem_depth += line.matches('{').count() as i32;
+            totem_depth -= line.matches('}').count() as i32;
+
+            if let Some(v) = crate::cached_regex!(r"^token\s*:\s*(\d+)").captures(line) {
+                result.totem_token = v.get(1).and_then(|m| m.as_str().parse::<i64>().ok());
+                lines_for.insert("totem.token", line_no);
+            }
+            if let Some(v) =
+                crate::cached_regex!(r"^token_retransmits_before_loss_const\s*:\s*(\d+)")
+                    .captures(line)
+            {
+                result.totem_retransmits = v.get(1).and_then(|m| m.as_str().parse::<i64>().ok());
+                lines_for.insert("totem.token_retransmits_before_loss_const", line_no);
+            }
+            if let Some(v) = crate::cached_regex!(r"^join\s*:\s*(\d+)").captures(line) {
+                result.totem_join = v.get(1).and_then(|m| m.as_str().parse::<i64>().ok());
+                lines_for.insert("totem.join", line_no);
+            }
+            if let Some(v) = crate::cached_regex!(r"^consensus\s*:\s*(\d+)").captures(line) {
+                result.totem_consensus = v.get(1).and_then(|m| m.as_str().parse::<i64>().ok());
+                lines_for.insert("totem.consensus", line_no);
+            }
+            if let Some(v) = crate::cached_regex!(r"^max_messages\s*:\s*(\d+)").captures(line) {
+                result.totem_max_messages = v.get(1).and_then(|m| m.as_str().parse::<i64>().ok());
+                lines_for.insert("totem.max_messages", line_no);
+            }
+            if let Some(v) = crate::cached_regex!(r"^transport\s*:\s*(\w+)").captures(line) {
+                result.totem_transport = v.get(1).map(|m| m.as_str().to_string());
+                lines_for.insert("totem.transport", line_no);
+            }
+
+            if totem_depth == 0 && line.contains('}') {
+                in_totem = false;
+            }
+        }
+
+        if in_quorum {
+            quorum_depth += line.matches('{').count() as i32;
+            quorum_depth -= line.matches('}').count() as i32;
+
+            if let Some(v) = crate::cached_regex!(r"^provider\s*:\s*(\w+)").captures(line) {
+                result.quorum_provider = v.get(1).map(|m| m.as_str().to_string());
+                lines_for.insert("quorum.provider", line_no);
+            }
+            if let Some(v) = crate::cached_regex!(r"^expected_votes\s*:\s*(\d+)").captures(line) {
+                result.quorum_expected_votes =
+                    v.get(1).and_then(|m| m.as_str().parse::<i64>().ok());
+                lines_for.insert("quorum.expected_votes", line_no);
+            }
+            if let Some(v) = crate::cached_regex!(r"^two_node\s*:\s*(\d+)").captures(line) {
+                result.quorum_two_node = v.get(1).and_then(|m| m.as_str().parse::<i64>().ok());
+                lines_for.insert("quorum.two_node", line_no);
+            }
+
+            if quorum_depth == 0 && line.contains('}') {
+                in_quorum = false;
+            }
+        }
+    }
+
+    let checks: [(&'static str, Option<String>, Option<String>); 9] = [
+        (
+            "totem.token",
+            result.totem_token.map(|v| v.to_string()),
+            Some("30000".to_string()),
+        ),
+        (
+            "totem.token_retransmits_before_loss_const",
+            result.totem_retransmits.map(|v| v.to_string()),
+            Some("10".to_string()),
+        ),
+        (
+            "totem.join",
+            result.totem_join.map(|v| v.to_string()),
+            Some("60".to_string()),
+        ),
+        (
+            "totem.consensus",
+            result.totem_consensus.map(|v| v.to_string()),
+            Some("36000".to_string()),
+        ),
+        (
+            "totem.max_messages",
+            result.totem_max_messages.map(|v| v.to_string()),
+            Some("20".to_string()),
+        ),
+        (
+            "totem.transport",
+            result.totem_transport.clone(),
+            Some("udpu".to_string()),
+        ),
+        (
+            "quorum.provider",
+            result.quorum_provider.clone(),
+            Some("corosync_votequorum".to_string()),
+        ),
+        (
+            "quorum.expected_votes",
+            result.quorum_expected_votes.map(|v| v.to_string()),
+            Some("2".to_string()),
+        ),
+        (
+            "quorum.two_node",
+            result.quorum_two_node.map(|v| v.to_string()),
+            Some("1".to_string()),
+        ),
+    ];
+
+    for (parameter, actual, expected) in checks {
+        if let (Some(actual_value), Some(expected_value)) = (actual, expected) {
+            if actual_value != expected_value {
+                let line_no = lines_for.get(parameter).copied();
+                result.warnings.push(make_warning(
+                    "config_mismatch",
+                    "warning",
+                    format!(
+                        "{} is {}, but should be {} for Azure environments",
+                        parameter, actual_value, expected_value
+                    ),
+                    Some(parameter),
+                    Some(expected_value),
+                    Some(actual_value),
+                    None,
+                    source_path,
+                    line_no,
+                ));
+            }
+        }
+    }
+
+    result
+}
+
+// ---------------------------------------------------------------------------
+// Cluster status (cib.xml / crm_mon text)
+// ---------------------------------------------------------------------------
+
+pub fn parse_cluster_status(content: &str, source_path: &str) -> ClusterStatusResult {
+    let mut result = ClusterStatusResult {
+        found: false,
+        cluster_name: None,
+        dc_node: None,
+        nodes_configured: None,
+        resources_configured: None,
+        last_updated: None,
+        quorum_status: None,
+        node_statuses: Vec::new(),
+        source_path: source_path.to_string(),
+    };
+
+    let mut seen = HashSet::new();
+
+    if let Some(caps) =
+        crate::cached_regex!(r#"name=["']cluster-name["']\s+value=["']([^"']+)["']"#)
+            .captures(content)
+    {
+        result.cluster_name = caps.get(1).map(|m| m.as_str().to_string());
+        result.found = true;
+    }
+    if let Some(caps) = crate::cached_regex!(r#"have-quorum=["']([01])["']"#).captures(content) {
+        result.quorum_status = Some(if caps.get(1).map(|m| m.as_str()) == Some("1") {
+            "with quorum".to_string()
+        } else {
+            "without quorum".to_string()
+        });
+        result.found = true;
+    }
+    if let Some(caps) = crate::cached_regex!(
+        r#"<current_dc[^>]+(?:name|uname)=["']([^"']+)["'][^>]*with_quorum=["'](true|false)["']"#
+    )
+    .captures(content)
+    {
+        result.dc_node = caps.get(1).map(|m| m.as_str().to_string());
+        result.quorum_status = Some(if caps.get(2).map(|m| m.as_str()) == Some("true") {
+            "with quorum".to_string()
+        } else {
+            "without quorum".to_string()
+        });
+        result.found = true;
+    }
+
+    let cluster_name_re = crate::cached_regex!(r"(?i)^Cluster name:\s+(.+)$");
+    let stack_re = crate::cached_regex!(r"(?i)^Stack:\s+(\w+)");
+    let dc_re = crate::cached_regex!(r"(?i)^Current DC:\s+([^\s]+)");
+    let last_re = crate::cached_regex!(r"(?i)^Last updated:\s+(.+)$");
+    let nodes_cfg_re = crate::cached_regex!(r"(?i)(\d+)\s+nodes?\s+configured");
+    let res_cfg_re = crate::cached_regex!(r"(?i)(\d+)\s+resource(?:\s+instances?)?\s+configured");
+    let online_re = crate::cached_regex!(r"(?i)Online:\s*\[\s*([^\]]+)\s*\]");
+    let offline_re = crate::cached_regex!(r"(?i)Offline:\s*\[\s*([^\]]+)\s*\]");
+    let node_re = crate::cached_regex!(r"(?i)\*?\s*Node\s+([^\s:]+)[^:]*:\s*(\w+)");
+
+    for (idx, line) in content.lines().enumerate() {
+        let line_no = idx + 1;
+        let trimmed = line.trim();
+
+        if let Some(caps) = cluster_name_re.captures(trimmed) {
+            if result.cluster_name.is_none() {
+                result.cluster_name = caps.get(1).map(|m| m.as_str().trim().to_string());
+            }
+            result.found = true;
+        }
+        if let Some(caps) = stack_re.captures(trimmed) {
+            if result.cluster_name.is_none() {
+                result.cluster_name = caps.get(1).map(|m| m.as_str().trim().to_string());
+            }
+            result.found = true;
+        }
+        if let Some(caps) = dc_re.captures(trimmed) {
+            if result.dc_node.is_none() {
+                result.dc_node = caps.get(1).map(|m| m.as_str().trim().to_string());
+            }
+            result.found = true;
+        }
+        if let Some(caps) = last_re.captures(trimmed) {
+            if result.last_updated.is_none() {
+                result.last_updated = caps.get(1).map(|m| m.as_str().trim().to_string());
+            }
+            result.found = true;
+        }
+        if let Some(caps) = nodes_cfg_re.captures(trimmed) {
+            result.nodes_configured = caps.get(1).and_then(|m| m.as_str().parse::<i64>().ok());
+            result.found = true;
+        }
+        if let Some(caps) = res_cfg_re.captures(trimmed) {
+            result.resources_configured = caps.get(1).and_then(|m| m.as_str().parse::<i64>().ok());
+            result.found = true;
+        }
+        if trimmed.to_ascii_lowercase().contains("with quorum") {
+            result.quorum_status = Some("with quorum".to_string());
+        } else if trimmed.to_ascii_lowercase().contains("without quorum") {
+            result.quorum_status = Some("without quorum".to_string());
+        }
+
+        if let Some(caps) = online_re.captures(trimmed) {
+            if let Some(nodes) = caps.get(1) {
+                for node in nodes.as_str().split_whitespace() {
+                    if seen.insert(node.to_string()) {
+                        let is_dc = result.dc_node.as_deref() == Some(node);
+                        result.node_statuses.push(ClusterNodeStatus {
+                            name: node.to_string(),
+                            status: "online".to_string(),
+                            online: true,
+                            is_dc,
+                            source_path: source_path.to_string(),
+                            source_line: Some(line_no),
+                            source_line_end: Some(line_no),
+                        });
+                    }
+                }
+            }
+            result.found = true;
+        }
+
+        if let Some(caps) = offline_re.captures(trimmed) {
+            if let Some(nodes) = caps.get(1) {
+                for node in nodes.as_str().split_whitespace() {
+                    if seen.insert(node.to_string()) {
+                        result.node_statuses.push(ClusterNodeStatus {
+                            name: node.to_string(),
+                            status: "offline".to_string(),
+                            online: false,
+                            is_dc: false,
+                            source_path: source_path.to_string(),
+                            source_line: Some(line_no),
+                            source_line_end: Some(line_no),
+                        });
+                    }
+                }
+            }
+            result.found = true;
+        }
+
+        if let Some(caps) = node_re.captures(trimmed) {
+            let node = caps.get(1).map(|m| m.as_str()).unwrap_or_default();
+            let status = caps
+                .get(2)
+                .map(|m| m.as_str().to_ascii_lowercase())
+                .unwrap_or_else(|| "unknown".to_string());
+            if seen.insert(node.to_string()) {
+                let is_dc = result.dc_node.as_deref() == Some(node);
+                result.node_statuses.push(ClusterNodeStatus {
+                    name: node.to_string(),
+                    online: status == "online",
+                    is_dc,
+                    status,
+                    source_path: source_path.to_string(),
+                    source_line: Some(line_no),
+                    source_line_end: Some(line_no),
+                });
+            }
+            result.found = true;
+        }
+    }
+
+    result
+}
+
+// ---------------------------------------------------------------------------
+// Pacemaker high CPU
+// ---------------------------------------------------------------------------
+
+pub fn parse_pacemaker_high_cpu(content: &str, source_path: &str) -> Vec<HighCpuEvent> {
+    let regex = Regex::new(
+        r"^(?P<timestamp>[A-Z][a-z]{2}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2})\s+(?P<node>\S+)\s+pacemaker-controld\[\d+\]:\s+\w+:\s+High CPU load detected:\s*(?P<load>\d+(?:\.\d+)?)",
+    )
+    .unwrap();
+
+    content
+        .lines()
+        .enumerate()
+        .filter_map(|(idx, line)| {
+            let line_no = idx + 1;
+            let captures = regex.captures(line)?;
+            let cpu_load = captures
+                .get(3)
+                .and_then(|m| m.as_str().parse::<f64>().ok())
+                .unwrap_or(0.0);
+            let timestamp = captures
+                .name("timestamp")
+                .map(|m| m.as_str().to_string())
+                .unwrap_or_default();
+            let source_node = captures
+                .name("node")
+                .map(|m| m.as_str().to_string())
+                .unwrap_or_default();
+
+            Some(HighCpuEvent {
+                timestamp,
+                source_node: source_node.clone(),
+                resource: "pacemaker-controld".to_string(),
+                cpu_load,
+                severity: "warning".to_string(),
+                action: format!(
+                    "high CPU load detected on {} ({:.6})",
+                    source_node, cpu_load
+                ),
+                raw_line: line.to_string(),
+                source_path: source_path.to_string(),
+                source_line: Some(line_no),
+                source_line_end: Some(line_no),
+            })
+        })
+        .collect()
+}
+
+// ---------------------------------------------------------------------------
+// Cluster events (migrations + fencing)
+// ---------------------------------------------------------------------------
+
+pub fn parse_cluster_events(content: &str, source_path: &str) -> ClusterEventsResult {
+    let move_re = crate::cached_regex!(
+        r"(?i)(?:Moving|Migrating)\s+(?:resource\s+)?(\S+)\s+from\s+(\S+)\s+to\s+(\S+)"
+    );
+    let start_re =
+        crate::cached_regex!(r"(?i)(?:Starting|Transition.*Starting)\s+(\S+)\s+on\s+(\S+)");
+    let stop_re = crate::cached_regex!(r"(?i)(?:Stopping|Stopped)\s+(\S+)\s+on\s+(\S+)");
+    let result_op_re =
+        crate::cached_regex!(r"(?i)Result of (start|stop) operation for (\S+) on (\S+):\s*(\w+)");
+    let op_re = crate::cached_regex!(
+        r"(?i)Operation\s+(\S+?)_(?:start|stop|monitor|migrate)_\d+:\s*\w+\s*\(node=(\S+)\)"
+    );
+    let high_cpu_re = crate::cached_regex!(r"(?i)High CPU load detected:\s*([0-9]+(?:\.[0-9]+)?)");
+    let fence_request_re = crate::cached_regex!(
+        r"(?i)Requesting\s+fencing\s+\((\w+)\)\s+(?:of\s+|targeting\s+)?(?:node\s+)?(\S+)"
+    );
+    let fence_success_re =
+        crate::cached_regex!(r"(?i)(?:Fencing|stonith.*?fence)\s+(\S+).*?(?:success|succeeded)");
+    let peer_term_re = crate::cached_regex!(
+        r"(?i)(?:Peer|peer)\s+(\S+)\s+was\s+(?:terminated|fenced)\s+\((\w+)\)"
+    );
+    let peer_not_term_re =
+        crate::cached_regex!(r"(?i)(?:Peer|peer)\s+(\S+)\s+was\s+not\s+terminated\s+\((\w+)\)");
+    let fence_fail_re =
+        crate::cached_regex!(r"(?i)(?:Fencing|stonith.*?fence)\s+(\S+).*?(?:fail|error)");
+    let fence_will_re =
+        crate::cached_regex!(r"(?i)(?:Cluster\s+node|Node|peer)\s+(\S+)\s+will\s+be\s+fenced");
+    let fence_agent_re =
+        crate::cached_regex!(r"(?i)(fence_\w+).*?(?:Called|for)\s+.*?(?:node\s+)?(\S+)");
+    let monitor_failure_re = crate::cached_regex!(
+        r"(?i)Unexpected\s+result\s+\((error|failed|timeout|not running):\s*([^)]+)\).*?(?:for\s+(?:monitor|start|stop|promote|demote)\s+of\s+)?(\S+?)(?::(\d+))?\s+on\s+(\S+)"
+    );
+    let timeout_re = crate::cached_regex!(
+        r"(?i)(?:Resource agent did not complete within|operation.* timed out after)\s+(\d+)s"
+    );
+    let transition_fail_re = crate::cached_regex!(
+        r"(?i)Transition\s+\d+\s+action\s+\d+\s+\(([^)]+)_(?:monitor|start|stop|promote|demote)_\d+\s+on\s+(\S+)\).*?expected\s+'([^']+)'\s+but\s+got\s+'([^']+)'"
+    );
+
+    let mut resource_migrations = Vec::new();
+    let mut fencing_events = Vec::new();
+
+    for (idx, line) in content.lines().enumerate() {
+        let line_no = idx + 1;
+        let trimmed = line.trim();
+        if trimmed.is_empty() {
+            continue;
+        }
+
+        if !(trimmed.contains("oving")
+            || trimmed.contains("igrat")
+            || trimmed.contains("tarting")
+            || trimmed.contains("topping")
+            || trimmed.contains("Operation")
+            || trimmed.contains("Result of")
+            || trimmed.contains("fence")
+            || trimmed.contains("stonith")
+            || trimmed.contains("Peer")
+            || trimmed.contains("terminated")
+            || trimmed.contains("fenced")
+            || trimmed.contains("Unexpected")
+            || trimmed.contains("Transition")
+            || trimmed.contains("High CPU")
+            || trimmed.contains("CPU load")
+            || trimmed.contains("timed out")
+            || trimmed.contains("did not complete"))
+        {
+            continue;
+        }
+
+        let (timestamp, source_node, message_text) = parse_syslog_prefix(trimmed);
+        let sp = source_path.to_string();
+        let sl = Some(line_no);
+        let is_cluster_src = is_cluster_log_source(trimmed);
+
+        if let Some(caps) = high_cpu_re.captures(&message_text) {
+            let cpu_load = caps.get(1).and_then(|m| m.as_str().parse::<f64>().ok());
+            let load_text = caps.get(1).map(|m| m.as_str()).unwrap_or("unknown");
+            resource_migrations.push(ResourceMigrationEvent {
+                timestamp,
+                resource: "pacemaker-controld".to_string(),
+                from_node: source_node.clone(),
+                to_node: None,
+                action: match source_node.clone() {
+                    Some(node) => format!("high CPU load detected on {} ({})", node, load_text),
+                    None => format!("high CPU load detected ({})", load_text),
+                },
+                severity: Some("warning".to_string()),
+                cpu_load,
+                error: None,
+                raw_line: trimmed.to_string(),
+                source_path: sp.clone(),
+                source_line: sl,
+                source_line_end: sl,
+            });
+            continue;
+        }
+
+        if let Some(caps) = move_re.captures(&message_text) {
+            resource_migrations.push(ResourceMigrationEvent {
+                timestamp,
+                resource: caps
+                    .get(1)
+                    .map(|m| m.as_str().to_string())
+                    .unwrap_or_default(),
+                from_node: caps.get(2).map(|m| m.as_str().to_string()),
+                to_node: caps.get(3).map(|m| m.as_str().to_string()),
+                action: "migration".to_string(),
+                severity: None,
+                cpu_load: None,
+                error: None,
+                raw_line: trimmed.to_string(),
+                source_path: sp.clone(),
+                source_line: sl,
+                source_line_end: sl,
+            });
+            continue;
+        }
+
+        if let Some(caps) = start_re.captures(&message_text) {
+            let resource = caps.get(1).map(|m| m.as_str()).unwrap_or_default();
+            let node = caps.get(2).map(|m| m.as_str()).unwrap_or_default();
+            if is_cluster_src
+                && !message_text.contains("systemd")
+                && !is_systemd_resource(resource)
+                && !is_system_resource(resource)
+                && !is_non_cluster_node(node)
+            {
+                resource_migrations.push(ResourceMigrationEvent {
+                    timestamp,
+                    resource: resource.to_string(),
+                    from_node: None,
+                    to_node: Some(node.to_string()),
+                    action: "start".to_string(),
+                    severity: None,
+                    cpu_load: None,
+                    error: None,
+                    raw_line: trimmed.to_string(),
+                    source_path: sp.clone(),
+                    source_line: sl,
+                    source_line_end: sl,
+                });
+            }
+            continue;
+        }
+
+        if let Some(caps) = stop_re.captures(&message_text) {
+            let resource = caps.get(1).map(|m| m.as_str()).unwrap_or_default();
+            let node = caps.get(2).map(|m| m.as_str()).unwrap_or_default();
+            if is_cluster_src
+                && !message_text.contains("systemd")
+                && !is_systemd_resource(resource)
+                && !is_system_resource(resource)
+                && !is_non_cluster_node(node)
+            {
+                resource_migrations.push(ResourceMigrationEvent {
+                    timestamp,
+                    resource: resource.to_string(),
+                    from_node: Some(node.to_string()),
+                    to_node: None,
+                    action: "stop".to_string(),
+                    severity: None,
+                    cpu_load: None,
+                    error: None,
+                    raw_line: trimmed.to_string(),
+                    source_path: sp.clone(),
+                    source_line: sl,
+                    source_line_end: sl,
+                });
+            }
+            continue;
+        }
+
+        if let Some(caps) = result_op_re.captures(&message_text) {
+            let action = caps
+                .get(1)
+                .map(|m| m.as_str().to_ascii_lowercase())
+                .unwrap_or_else(|| "unknown".to_string());
+            let resource = caps.get(2).map(|m| m.as_str()).unwrap_or_default();
+            let node = caps.get(3).map(|m| m.as_str()).unwrap_or_default();
+            if is_cluster_src
+                && !message_text.contains("systemd")
+                && !is_systemd_resource(resource)
+                && !is_system_resource(resource)
+                && !is_non_cluster_node(node)
+            {
+                resource_migrations.push(ResourceMigrationEvent {
+                    timestamp,
+                    resource: resource.to_string(),
+                    from_node: if action == "stop" {
+                        Some(node.to_string())
+                    } else {
+                        None
+                    },
+                    to_node: if action == "start" {
+                        Some(node.to_string())
+                    } else {
+                        None
+                    },
+                    action,
+                    severity: None,
+                    cpu_load: None,
+                    error: None,
+                    raw_line: trimmed.to_string(),
+                    source_path: sp.clone(),
+                    source_line: sl,
+                    source_line_end: sl,
+                });
+            }
+            continue;
+        }
+
+        if let Some(caps) = op_re.captures(&message_text) {
+            let resource = caps.get(1).map(|m| m.as_str()).unwrap_or_default();
+            let node = caps.get(2).map(|m| m.as_str()).unwrap_or_default();
+            let action = if message_text.contains("_start_") {
+                "start"
+            } else if message_text.contains("_stop_") {
+                "stop"
+            } else {
+                "operation"
+            };
+
+            if is_cluster_src
+                && !is_systemd_resource(resource)
+                && !is_system_resource(resource)
+                && !is_non_cluster_node(node)
+            {
+                resource_migrations.push(ResourceMigrationEvent {
+                    timestamp,
+                    resource: resource.to_string(),
+                    from_node: if action == "stop" {
+                        Some(node.to_string())
+                    } else {
+                        None
+                    },
+                    to_node: if action == "start" {
+                        Some(node.to_string())
+                    } else {
+                        None
+                    },
+                    action: action.to_string(),
+                    severity: None,
+                    cpu_load: None,
+                    error: None,
+                    raw_line: trimmed.to_string(),
+                    source_path: sp.clone(),
+                    source_line: sl,
+                    source_line_end: sl,
+                });
+            }
+            continue;
+        }
+
+        if let Some(caps) = fence_request_re.captures(trimmed) {
+            fencing_events.push(FencingEvent {
+                timestamp,
+                target_node: caps
+                    .get(2)
+                    .map(|m| m.as_str().to_string())
+                    .unwrap_or_default(),
+                action: caps
+                    .get(1)
+                    .map(|m| m.as_str().to_string())
+                    .unwrap_or_else(|| "fence".to_string()),
+                status: "requested".to_string(),
+                agent: None,
+                raw_line: trimmed.to_string(),
+                source_path: sp.clone(),
+                source_line: sl,
+                source_line_end: sl,
+            });
+            continue;
+        }
+
+        if let Some(caps) = fence_success_re.captures(&message_text) {
+            fencing_events.push(FencingEvent {
+                timestamp,
+                target_node: caps
+                    .get(1)
+                    .map(|m| m.as_str().to_string())
+                    .unwrap_or_default(),
+                action: "fence".to_string(),
+                status: "success".to_string(),
+                agent: None,
+                raw_line: trimmed.to_string(),
+                source_path: sp.clone(),
+                source_line: sl,
+                source_line_end: sl,
+            });
+            continue;
+        }
+
+        if let Some(caps) = peer_term_re.captures(&message_text) {
+            fencing_events.push(FencingEvent {
+                timestamp,
+                target_node: caps
+                    .get(1)
+                    .map(|m| m.as_str().to_string())
+                    .unwrap_or_default(),
+                action: caps
+                    .get(2)
+                    .map(|m| m.as_str().to_string())
+                    .unwrap_or_else(|| "fence".to_string()),
+                status: "success".to_string(),
+                agent: None,
+                raw_line: trimmed.to_string(),
+                source_path: sp.clone(),
+                source_line: sl,
+                source_line_end: sl,
+            });
+            continue;
+        }
+
+        if let Some(caps) = peer_not_term_re.captures(&message_text) {
+            fencing_events.push(FencingEvent {
+                timestamp,
+                target_node: caps
+                    .get(1)
+                    .map(|m| m.as_str().to_string())
+                    .unwrap_or_default(),
+                action: caps
+                    .get(2)
+                    .map(|m| m.as_str().to_string())
+                    .unwrap_or_else(|| "fence".to_string()),
+                status: "failed".to_string(),
+                agent: None,
+                raw_line: trimmed.to_string(),
+                source_path: sp.clone(),
+                source_line: sl,
+                source_line_end: sl,
+            });
+            continue;
+        }
+
+        if let Some(caps) = fence_fail_re.captures(&message_text) {
+            fencing_events.push(FencingEvent {
+                timestamp,
+                target_node: caps
+                    .get(1)
+                    .map(|m| m.as_str().to_string())
+                    .unwrap_or_default(),
+                action: "fence".to_string(),
+                status: "failed".to_string(),
+                agent: None,
+                raw_line: trimmed.to_string(),
+                source_path: sp.clone(),
+                source_line: sl,
+                source_line_end: sl,
+            });
+            continue;
+        }
+
+        if let Some(caps) = fence_will_re.captures(&message_text) {
+            fencing_events.push(FencingEvent {
+                timestamp,
+                target_node: caps
+                    .get(1)
+                    .map(|m| m.as_str().to_string())
+                    .unwrap_or_default(),
+                action: "fence".to_string(),
+                status: "pending".to_string(),
+                agent: None,
+                raw_line: trimmed.to_string(),
+                source_path: sp.clone(),
+                source_line: sl,
+                source_line_end: sl,
+            });
+            continue;
+        }
+
+        if let Some(caps) = fence_agent_re.captures(&message_text) {
+            fencing_events.push(FencingEvent {
+                timestamp,
+                target_node: caps
+                    .get(2)
+                    .map(|m| m.as_str().to_string())
+                    .unwrap_or_default(),
+                action: "fence".to_string(),
+                status: "in_progress".to_string(),
+                agent: caps.get(1).map(|m| m.as_str().to_string()),
+                raw_line: trimmed.to_string(),
+                source_path: sp.clone(),
+                source_line: sl,
+                source_line_end: sl,
+            });
+            continue;
+        }
+
+        if let Some(caps) = monitor_failure_re.captures(&message_text) {
+            let resource = match (caps.get(3), caps.get(4)) {
+                (Some(base), Some(instance)) => format!("{}:{}", base.as_str(), instance.as_str()),
+                (Some(base), None) => base.as_str().to_string(),
+                _ => String::new(),
+            };
+            let node = caps.get(5).map(|m| m.as_str().to_string());
+            let err = format!(
+                "{}: {}",
+                caps.get(1).map(|m| m.as_str()).unwrap_or("error"),
+                caps.get(2).map(|m| m.as_str()).unwrap_or("unknown")
+            );
+            resource_migrations.push(ResourceMigrationEvent {
+                timestamp,
+                resource,
+                from_node: node,
+                to_node: None,
+                action: "failure".to_string(),
+                severity: Some("error".to_string()),
+                cpu_load: None,
+                error: Some(err),
+                raw_line: trimmed.to_string(),
+                source_path: sp.clone(),
+                source_line: sl,
+                source_line_end: sl,
+            });
+            continue;
+        }
+
+        if let Some(caps) = timeout_re.captures(&message_text) {
+            resource_migrations.push(ResourceMigrationEvent {
+                timestamp,
+                resource: "unknown".to_string(),
+                from_node: None,
+                to_node: None,
+                action: "timeout".to_string(),
+                severity: Some("warning".to_string()),
+                cpu_load: None,
+                error: Some(format!(
+                    "Operation timeout after {}s",
+                    caps.get(1).map(|m| m.as_str()).unwrap_or("0")
+                )),
+                raw_line: trimmed.to_string(),
+                source_path: sp.clone(),
+                source_line: sl,
+                source_line_end: sl,
+            });
+            continue;
+        }
+
+        if let Some(caps) = transition_fail_re.captures(&message_text) {
+            resource_migrations.push(ResourceMigrationEvent {
+                timestamp,
+                resource: caps
+                    .get(1)
+                    .map(|m| m.as_str().to_string())
+                    .unwrap_or_default(),
+                from_node: caps.get(2).map(|m| m.as_str().to_string()),
+                to_node: None,
+                action: "transition_failure".to_string(),
+                severity: Some("error".to_string()),
+                cpu_load: None,
+                error: Some(format!(
+                    "Expected '{}' but got '{}'",
+                    caps.get(3).map(|m| m.as_str()).unwrap_or("unknown"),
+                    caps.get(4).map(|m| m.as_str()).unwrap_or("unknown")
+                )),
+                raw_line: trimmed.to_string(),
+                source_path: sp.clone(),
+                source_line: sl,
+                source_line_end: sl,
+            });
+        }
+    }
+
+    let total = resource_migrations.len() + fencing_events.len();
+    ClusterEventsResult {
+        found: total > 0,
+        resource_migrations,
+        fencing_events,
+        total_events: total,
+        count: total,
+        source_path: source_path.to_string(),
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Cluster maintenance mode
+// ---------------------------------------------------------------------------
+
+pub fn parse_cluster_maintenance_mode(
+    content: &str,
+    source_path: &str,
+) -> ClusterMaintenanceResult {
+    let mut result = ClusterMaintenanceResult {
+        found: false,
+        maintenance_mode: None,
+        resources_in_maintenance: Vec::new(),
+        warnings: Vec::new(),
+        source_path: source_path.to_string(),
+    };
+
+    // Locate the line of the cluster-wide maintenance-mode property, if any.
+    let mm_re =
+        crate::cached_regex!(r#"name=["']maintenance-mode["']\s+value=["'](true|false)["']"#);
+    let mut maintenance_line: Option<usize> = None;
+    let mut disabled_line: Option<usize> = None;
+    let resource_re = crate::cached_regex!(
+        r"(?i)(?:Resource|Clone Set|Primary/Secondary Set|Resource Group):\s+([^\s(]+).*?\(.*?maintenance.*?\)"
+    );
+    let mut resource_lines: Vec<(String, usize)> = Vec::new();
+
+    for (idx, line) in content.lines().enumerate() {
+        let line_no = idx + 1;
+        if maintenance_line.is_none() && mm_re.is_match(line) {
+            maintenance_line = Some(line_no);
+        }
+        if disabled_line.is_none() && line.contains("Resource management is DISABLED") {
+            disabled_line = Some(line_no);
+        }
+        if let Some(caps) = resource_re.captures(line) {
+            if let Some(name) = caps.get(1).map(|m| m.as_str().to_string()) {
+                resource_lines.push((name, line_no));
+            }
+        }
+    }
+
+    if let Some(caps) = mm_re.captures(content) {
+        let enabled = caps
+            .get(1)
+            .map(|m| m.as_str().eq_ignore_ascii_case("true"))
+            .unwrap_or(false);
+        result.found = true;
+        result.maintenance_mode = Some(enabled);
+        if enabled {
+            result.warnings.push(make_warning(
+                "cluster_in_maintenance",
+                "warning",
+                "Cluster is in maintenance mode - resources will not be managed".to_string(),
+                None,
+                None,
+                None,
+                Some("Run \"crm configure property maintenance-mode=false\" to exit maintenance mode when ready"),
+                source_path,
+                maintenance_line,
+            ));
+        }
+    }
+
+    if content.contains("Resource management is DISABLED") {
+        result.found = true;
+        result.maintenance_mode = Some(true);
+        if !result
+            .warnings
+            .iter()
+            .any(|w| w.kind == "cluster_in_maintenance")
+        {
+            result.warnings.push(make_warning(
+                "cluster_in_maintenance",
+                "warning",
+                "Cluster resource management is DISABLED".to_string(),
+                None,
+                None,
+                None,
+                Some("Check if cluster is in maintenance mode or stonith is disabled"),
+                source_path,
+                disabled_line,
+            ));
+        }
+    }
+
+    let mut first_res_line: Option<usize> = None;
+    for (name, line_no) in &resource_lines {
+        if !result.resources_in_maintenance.contains(name) {
+            result.resources_in_maintenance.push(name.clone());
+            if first_res_line.is_none() {
+                first_res_line = Some(*line_no);
+            }
+        }
+    }
+
+    if !result.resources_in_maintenance.is_empty() {
+        result.found = true;
+        result.warnings.push(make_warning(
+            "resources_in_maintenance",
+            "info",
+            format!(
+                "{} resource(s) in maintenance mode",
+                result.resources_in_maintenance.len()
+            ),
+            None,
+            None,
+            None,
+            None,
+            source_path,
+            first_res_line,
+        ));
+    }
+
+    result
+}
+
+// ===========================================================================
+// New text-based parsers (Phase 4 port from cluster.js)
+// ===========================================================================
+
+// Helper: extract a section from an SCC aggregated file (like ha.txt).
+// Looks for `# <marker>` line; collects subsequent lines until the next
+// section marker (`#==` or another `# /…` header).
+fn extract_scc_section(content: &str, marker: &str) -> Option<String> {
+    let mut lines: Vec<&str> = Vec::new();
+    let mut in_section = false;
+    for line in content.lines() {
+        if !in_section {
+            if line.trim_start().starts_with('#') && line.contains(marker) {
+                in_section = true;
+                continue;
+            }
+        } else {
+            // End on next section header (#==…) or comment-style header for a different file
+            if line.starts_with("#==") {
+                break;
+            }
+            if line.trim_start().starts_with("# /") && !line.contains(marker) {
+                break;
+            }
+            lines.push(line);
+        }
+    }
+    if lines.is_empty() {
+        None
+    } else {
+        Some(lines.join("\n"))
+    }
+}
+
+// ---------------------------------------------------------------------------
+// hostsFile  (parses /etc/hosts; embedded inside network.txt for SCC)
+// ---------------------------------------------------------------------------
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct HostsEntry {
+    pub ip: String,
+    pub hostnames: Vec<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct HostsFileResult {
+    pub found: bool,
+    pub entries: Vec<HostsEntry>,
+    pub all_hostnames: Vec<String>,
+    pub source_path: String,
+}
+
+pub fn parse_hosts_file(content: &str, source_path: &str) -> HostsFileResult {
+    let body = if source_path.ends_with("network.txt") || source_path.contains("/network.txt") {
+        match extract_scc_section(content, "/etc/hosts") {
+            Some(s) => s,
+            None => {
+                return HostsFileResult {
+                    found: false,
+                    entries: Vec::new(),
+                    all_hostnames: Vec::new(),
+                    source_path: source_path.to_string(),
+                };
+            }
+        }
+    } else {
+        content.to_string()
+    };
+
+    let mut entries: Vec<HostsEntry> = Vec::new();
+    let mut hostname_set: HashSet<String> = HashSet::new();
+
+    for line in body.lines() {
+        let trimmed = line.trim();
+        if trimmed.is_empty() || trimmed.starts_with('#') {
+            continue;
+        }
+        let parts: Vec<&str> = trimmed.split_whitespace().collect();
+        if parts.len() < 2 {
+            continue;
+        }
+        let ip = parts[0].to_string();
+        let names: Vec<String> = parts[1..].iter().map(|s| s.to_string()).collect();
+        for n in &names {
+            hostname_set.insert(n.clone());
+        }
+        entries.push(HostsEntry {
+            ip,
+            hostnames: names,
+        });
+    }
+
+    let mut all_hostnames: Vec<String> = hostname_set.into_iter().collect();
+    all_hostnames.sort();
+
+    HostsFileResult {
+        found: !entries.is_empty(),
+        entries,
+        all_hostnames,
+        source_path: source_path.to_string(),
+    }
+}
+
+// ---------------------------------------------------------------------------
+// corosyncStatus  (parses corosync-cfgtool -s output)
+// ---------------------------------------------------------------------------
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct CorosyncStatusNode {
+    pub node_id: String,
+    pub status: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct CorosyncStatusResult {
+    pub found: bool,
+    pub valid: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub local_node_id: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub transport: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub nodes: Option<Vec<CorosyncStatusNode>>,
+    pub source_path: String,
+}
+
+pub fn parse_corosync_status(content: &str, source_path: &str) -> CorosyncStatusResult {
+    use std::sync::OnceLock;
+    static INIT_ERR: OnceLock<Regex> = OnceLock::new();
+    static LOCAL_RE: OnceLock<Regex> = OnceLock::new();
+    static NODE_RE: OnceLock<Regex> = OnceLock::new();
+    let init_err = INIT_ERR
+        .get_or_init(|| Regex::new(r"(?i)Could not initialize corosync configuration").unwrap());
+    let local_re = LOCAL_RE
+        .get_or_init(|| Regex::new(r"(?i)Local node ID\s+(\d+).*transport\s+(\w+)").unwrap());
+    let node_re = NODE_RE.get_or_init(|| Regex::new(r"(?i)nodeid:\s*(\d+):\s*(\w+)").unwrap());
+
+    let mut local_node_id: Option<String> = None;
+    let mut transport: Option<String> = None;
+    let mut nodes: Vec<CorosyncStatusNode> = Vec::new();
+
+    for raw in content.lines() {
+        let trimmed = raw.trim();
+        if init_err.is_match(trimmed) {
+            return CorosyncStatusResult {
+                found: true,
+                valid: false,
+                error: Some(trimmed.to_string()),
+                local_node_id: None,
+                transport: None,
+                nodes: None,
+                source_path: source_path.to_string(),
+            };
+        }
+        if let Some(caps) = local_re.captures(trimmed) {
+            local_node_id = caps.get(1).map(|m| m.as_str().to_string());
+            transport = caps.get(2).map(|m| m.as_str().to_string());
+        }
+        if let Some(caps) = node_re.captures(trimmed) {
+            nodes.push(CorosyncStatusNode {
+                node_id: caps
+                    .get(1)
+                    .map(|m| m.as_str().to_string())
+                    .unwrap_or_default(),
+                status: caps
+                    .get(2)
+                    .map(|m| m.as_str().to_string())
+                    .unwrap_or_default(),
+            });
+        }
+    }
+
+    CorosyncStatusResult {
+        found: true,
+        valid: true,
+        error: None,
+        local_node_id,
+        transport,
+        nodes: Some(nodes),
+        source_path: source_path.to_string(),
+    }
+}
+
+// ---------------------------------------------------------------------------
+// clusterDaemonStatus  (parses pcs status "Daemon Status:" section)
+// ---------------------------------------------------------------------------
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Default)]
+pub struct DaemonState {
+    pub active: Option<bool>,
+    pub enabled: Option<bool>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Default)]
+pub struct DaemonStatusMap {
+    pub corosync: DaemonState,
+    pub pacemaker: DaemonState,
+    pub pcsd: DaemonState,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct DaemonWarning {
+    pub severity: String,
+    pub daemon: String,
+    pub message: String,
+    pub recommendation: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct ClusterDaemonStatusResult {
+    pub found: bool,
+    pub daemons: DaemonStatusMap,
+    pub warnings: Vec<DaemonWarning>,
+    pub corosync_enabled: Option<bool>,
+    pub pacemaker_enabled: Option<bool>,
+    pub corosync_active: Option<bool>,
+    pub pacemaker_active: Option<bool>,
+    pub source_path: String,
+}
+
+pub fn parse_cluster_daemon_status(content: &str, source_path: &str) -> ClusterDaemonStatusResult {
+    use std::sync::OnceLock;
+    static SECTION_RE: OnceLock<Regex> = OnceLock::new();
+    static DAEMON_RE: OnceLock<Regex> = OnceLock::new();
+    static SECTION_HEADER_RE: OnceLock<Regex> = OnceLock::new();
+    let section_re = SECTION_RE.get_or_init(|| Regex::new(r"(?i)^Daemon Status:?$").unwrap());
+    let daemon_re = DAEMON_RE
+        .get_or_init(|| Regex::new(r"(?i)^\s*(corosync|pacemaker|pcsd):\s*(\w+)/(\w+)").unwrap());
+    let section_header_re =
+        SECTION_HEADER_RE.get_or_init(|| Regex::new(r"^[A-Z][a-z]+ [A-Z]").unwrap());
+
+    let mut daemons = DaemonStatusMap::default();
+    let mut warnings: Vec<DaemonWarning> = Vec::new();
+    let mut found = false;
+    let mut in_section = false;
+
+    for raw in content.lines() {
+        let line = raw.trim();
+        if section_re.is_match(line) {
+            in_section = true;
+            continue;
+        }
+        if in_section
+            && (line.is_empty() || section_header_re.is_match(line))
+            && !daemon_re.is_match(line)
+        {
+            in_section = false;
+        }
+        if in_section {
+            if let Some(caps) = daemon_re.captures(line) {
+                let daemon = caps
+                    .get(1)
+                    .map(|m| m.as_str().to_ascii_lowercase())
+                    .unwrap_or_default();
+                let active_status = caps
+                    .get(2)
+                    .map(|m| m.as_str().to_ascii_lowercase())
+                    .unwrap_or_default();
+                let enabled_status = caps
+                    .get(3)
+                    .map(|m| m.as_str().to_ascii_lowercase())
+                    .unwrap_or_default();
+                let state = DaemonState {
+                    active: Some(active_status == "active"),
+                    enabled: Some(enabled_status == "enabled"),
+                };
+                match daemon.as_str() {
+                    "corosync" => daemons.corosync = state,
+                    "pacemaker" => daemons.pacemaker = state,
+                    "pcsd" => daemons.pcsd = state,
+                    _ => {}
+                }
+                found = true;
+
+                if daemon == "corosync" && enabled_status == "disabled" {
+                    warnings.push(DaemonWarning {
+                        severity: "error".to_string(),
+                        daemon: "corosync".to_string(),
+                        message: "Corosync is disabled and will not start automatically after reboot. Cluster resources will not start after system restart.".to_string(),
+                        recommendation: "Run \"pcs cluster enable --all\" or \"systemctl enable corosync\" on all nodes to enable automatic cluster startup.".to_string(),
+                    });
+                }
+                if daemon == "pacemaker" && enabled_status == "disabled" {
+                    warnings.push(DaemonWarning {
+                        severity: "warning".to_string(),
+                        daemon: "pacemaker".to_string(),
+                        message: "Pacemaker is disabled and will not start automatically after reboot.".to_string(),
+                        recommendation: "Run \"pcs cluster enable --all\" or \"systemctl enable pacemaker\" on all nodes.".to_string(),
+                    });
+                }
+                if daemon == "corosync" && active_status != "active" {
+                    warnings.push(DaemonWarning {
+                        severity: "error".to_string(),
+                        daemon: "corosync".to_string(),
+                        message: "Corosync is not running. The cluster cannot function without corosync.".to_string(),
+                        recommendation: "Run \"pcs cluster start\" or \"systemctl start corosync\" to start the cluster.".to_string(),
+                    });
+                }
+                if daemon == "pacemaker" && active_status != "active" {
+                    warnings.push(DaemonWarning {
+                        severity: "error".to_string(),
+                        daemon: "pacemaker".to_string(),
+                        message: "Pacemaker is not running. Cluster resources cannot be managed.".to_string(),
+                        recommendation: "Run \"pcs cluster start\" or \"systemctl start pacemaker\" to start the resource manager.".to_string(),
+                    });
+                }
+            }
+        }
+    }
+
+    if !found {
+        return ClusterDaemonStatusResult {
+            found: false,
+            daemons: DaemonStatusMap::default(),
+            warnings: Vec::new(),
+            corosync_enabled: None,
+            pacemaker_enabled: None,
+            corosync_active: None,
+            pacemaker_active: None,
+            source_path: source_path.to_string(),
+        };
+    }
+
+    ClusterDaemonStatusResult {
+        found: true,
+        corosync_enabled: daemons.corosync.enabled,
+        pacemaker_enabled: daemons.pacemaker.enabled,
+        corosync_active: daemons.corosync.active,
+        pacemaker_active: daemons.pacemaker.active,
+        daemons,
+        warnings,
+        source_path: source_path.to_string(),
+    }
+}
+
+// ---------------------------------------------------------------------------
+// sbdConfig  (parses /etc/sysconfig/sbd or embedded in ha.txt)
+// ---------------------------------------------------------------------------
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct SbdWarning {
+    #[serde(rename = "type")]
+    pub kind: String,
+    pub severity: String,
+    pub message: String,
+    pub recommendation: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub documentation_url: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct SbdRecommendation {
+    #[serde(rename = "type")]
+    pub kind: String,
+    pub severity: String,
+    pub message: String,
+    pub detail: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct SbdConfigResult {
+    pub found: bool,
+    pub sbd_device: Option<String>,
+    pub sbd_devices: Vec<String>,
+    pub sbd_pacemaker: Option<String>,
+    pub sbd_startmode: Option<String>,
+    pub sbd_delay_start: Option<String>,
+    pub sbd_watchdog_dev: Option<String>,
+    pub sbd_watchdog_timeout: Option<i64>,
+    pub sbd_timeout_action: Option<String>,
+    pub warnings: Vec<SbdWarning>,
+    pub recommendations: Vec<SbdRecommendation>,
+    pub source_file: Option<String>,
+    pub source_path: String,
+}
+
+pub fn parse_sbd_config(content: &str, source_path: &str) -> SbdConfigResult {
+    let mut result = SbdConfigResult {
+        found: false,
+        sbd_device: None,
+        sbd_devices: Vec::new(),
+        sbd_pacemaker: None,
+        sbd_startmode: None,
+        sbd_delay_start: None,
+        sbd_watchdog_dev: None,
+        sbd_watchdog_timeout: None,
+        sbd_timeout_action: None,
+        warnings: Vec::new(),
+        recommendations: Vec::new(),
+        source_file: None,
+        source_path: source_path.to_string(),
+    };
+
+    let body = if source_path.contains("ha.txt") {
+        match extract_scc_section(content, "/etc/sysconfig/sbd") {
+            Some(s) => s,
+            None => return result,
+        }
+    } else {
+        content.to_string()
+    };
+
+    if body.contains("sbd dump") || body.contains("==[ Command ]") {
+        return result;
+    }
+
+    use std::sync::OnceLock;
+    static DEVICE_RE: OnceLock<Regex> = OnceLock::new();
+    static PACEMAKER_RE: OnceLock<Regex> = OnceLock::new();
+    static STARTMODE_RE: OnceLock<Regex> = OnceLock::new();
+    static DELAY_RE: OnceLock<Regex> = OnceLock::new();
+    static WD_DEV_RE: OnceLock<Regex> = OnceLock::new();
+    static WD_TO_RE: OnceLock<Regex> = OnceLock::new();
+    static TO_ACTION_RE: OnceLock<Regex> = OnceLock::new();
+    let device_re =
+        DEVICE_RE.get_or_init(|| Regex::new(r#"^SBD_DEVICE=["']?([^"'\n]+?)["']?$"#).unwrap());
+    let pacemaker_re =
+        PACEMAKER_RE.get_or_init(|| Regex::new(r#"^SBD_PACEMAKER=["']?(\w+)["']?"#).unwrap());
+    let startmode_re =
+        STARTMODE_RE.get_or_init(|| Regex::new(r#"^SBD_STARTMODE=["']?(\w+)["']?"#).unwrap());
+    let delay_re =
+        DELAY_RE.get_or_init(|| Regex::new(r#"^SBD_DELAY_START=["']?([^"'\n]+?)["']?$"#).unwrap());
+    let wd_dev_re = WD_DEV_RE
+        .get_or_init(|| Regex::new(r#"^SBD_WATCHDOG_DEV=["']?([^"'\n]+?)["']?$"#).unwrap());
+    let wd_to_re =
+        WD_TO_RE.get_or_init(|| Regex::new(r#"^SBD_WATCHDOG_TIMEOUT=["']?(\d+)["']?"#).unwrap());
+    let to_action_re = TO_ACTION_RE
+        .get_or_init(|| Regex::new(r#"^SBD_TIMEOUT_ACTION=["']?([^"'\n]+?)["']?$"#).unwrap());
+
+    for raw in body.lines() {
+        let trimmed = raw.trim();
+        if trimmed.is_empty() || trimmed.starts_with('#') {
+            continue;
+        }
+        if let Some(caps) = device_re.captures(trimmed) {
+            result.found = true;
+            let v = caps
+                .get(1)
+                .map(|m| m.as_str().to_string())
+                .unwrap_or_default();
+            result.sbd_device = Some(v.clone());
+            result.sbd_devices = v
+                .split(';')
+                .filter(|s| !s.trim().is_empty())
+                .map(|s| s.to_string())
+                .collect();
+            result.source_file = Some(source_path.to_string());
+        }
+        if let Some(caps) = pacemaker_re.captures(trimmed) {
+            result.found = true;
+            let v = caps
+                .get(1)
+                .map(|m| m.as_str().to_ascii_lowercase())
+                .unwrap_or_default();
+            if v != "yes" {
+                result.warnings.push(SbdWarning {
+                    kind: "sbd_pacemaker_disabled".to_string(),
+                    severity: "warning".to_string(),
+                    message: format!("SBD_PACEMAKER is not set to \"yes\" (current: {})", v),
+                    recommendation: "Set SBD_PACEMAKER=yes for proper Pacemaker integration"
+                        .to_string(),
+                    documentation_url: None,
+                });
+            }
+            result.sbd_pacemaker = Some(v);
+        }
+        if let Some(caps) = startmode_re.captures(trimmed) {
+            result.found = true;
+            let v = caps
+                .get(1)
+                .map(|m| m.as_str().to_ascii_lowercase())
+                .unwrap_or_default();
+            if v != "always" {
+                result.warnings.push(SbdWarning {
+                    kind: "sbd_startmode_not_always".to_string(),
+                    severity: "info".to_string(),
+                    message: format!("SBD_STARTMODE is \"{}\" (recommended: \"always\")", v),
+                    recommendation: "Consider setting SBD_STARTMODE=always for Azure deployments"
+                        .to_string(),
+                    documentation_url: None,
+                });
+            }
+            result.sbd_startmode = Some(v);
+        }
+        if let Some(caps) = delay_re.captures(trimmed) {
+            result.found = true;
+            let v = caps
+                .get(1)
+                .map(|m| m.as_str().to_ascii_lowercase())
+                .unwrap_or_default();
+            if v == "no" || v == "yes" {
+                result.warnings.push(SbdWarning {
+                    kind: "sbd_delay_start_not_numeric".to_string(),
+                    severity: "warning".to_string(),
+                    message: format!("SBD_DELAY_START is \"{}\" but should be a numeric value", v),
+                    recommendation: "Set SBD_DELAY_START to a specific delay value in seconds (e.g., 216) per Azure best practices".to_string(),
+                    documentation_url: Some("https://learn.microsoft.com/en-us/azure/sap/workloads/high-availability-guide-suse-pacemaker".to_string()),
+                });
+            }
+            result.sbd_delay_start = Some(v);
+        }
+        if let Some(caps) = wd_dev_re.captures(trimmed) {
+            result.found = true;
+            result.sbd_watchdog_dev = caps.get(1).map(|m| m.as_str().to_string());
+        }
+        if let Some(caps) = wd_to_re.captures(trimmed) {
+            result.found = true;
+            result.sbd_watchdog_timeout = caps.get(1).and_then(|m| m.as_str().parse::<i64>().ok());
+        }
+        if let Some(caps) = to_action_re.captures(trimmed) {
+            result.found = true;
+            result.sbd_timeout_action = caps.get(1).map(|m| m.as_str().to_string());
+        }
+    }
+
+    let n = result.sbd_devices.len();
+    if n == 2 {
+        result.warnings.push(SbdWarning {
+            kind: "sbd_two_devices".to_string(),
+            severity: "warning".to_string(),
+            message: "Only 2 SBD devices configured - this is not recommended".to_string(),
+            recommendation: "Use 1 or 3 SBD devices. With 2 devices, Pacemaker cannot automatically fence if one becomes unavailable.".to_string(),
+            documentation_url: Some("https://learn.microsoft.com/en-us/azure/sap/workloads/high-availability-guide-suse-pacemaker".to_string()),
+        });
+    } else if n > 0 {
+        let detail = if n == 3 {
+            "Optimal configuration for high availability".to_string()
+        } else if n == 1 {
+            "Single device configuration".to_string()
+        } else {
+            format!("{} devices configured", n)
+        };
+        result.recommendations.push(SbdRecommendation {
+            kind: "sbd_device_count".to_string(),
+            severity: "info".to_string(),
+            message: format!("{} SBD device(s) configured", n),
+            detail,
+        });
+    }
+
+    result
+}
+
+// ---------------------------------------------------------------------------
+// azureFenceAuth  (parses fence_azure_arm config from CIB / ha.txt)
+// ---------------------------------------------------------------------------
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct AzureFenceWarning {
+    #[serde(rename = "type")]
+    pub kind: String,
+    pub severity: String,
+    pub message: String,
+    pub recommendation: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub documentation_url: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct AzureFenceRecommendation {
+    #[serde(rename = "type")]
+    pub kind: String,
+    pub severity: String,
+    pub message: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct AzureFenceAuthResult {
+    pub found: bool,
+    pub auth_method: Option<String>,
+    pub subscription_id: Option<String>,
+    pub resource_group: Option<String>,
+    pub tenant_id: Option<String>,
+    pub has_login: bool,
+    pub has_password: bool,
+    pub pcmk_monitor_retries: Option<i64>,
+    pub pcmk_action_limit: Option<i64>,
+    pub power_timeout: Option<i64>,
+    pub pcmk_reboot_timeout: Option<i64>,
+    pub pcmk_delay_max: Option<i64>,
+    pub pcmk_host_map: Option<String>,
+    pub warnings: Vec<AzureFenceWarning>,
+    pub recommendations: Vec<AzureFenceRecommendation>,
+    pub source_file: Option<String>,
+    pub source_path: String,
+}
+
+fn cap_str(content: &str, pattern: &str) -> Option<String> {
+    Regex::new(pattern).ok().and_then(|re| {
+        re.captures(content)
+            .and_then(|c| c.get(1).map(|m| m.as_str().to_string()))
+    })
+}
+
+fn cap_int(content: &str, pattern: &str) -> Option<i64> {
+    cap_str(content, pattern).and_then(|s| s.parse::<i64>().ok())
+}
+
+pub fn parse_azure_fence_auth(content: &str, source_path: &str) -> AzureFenceAuthResult {
+    let mut result = AzureFenceAuthResult {
+        found: false,
+        auth_method: None,
+        subscription_id: None,
+        resource_group: None,
+        tenant_id: None,
+        has_login: false,
+        has_password: false,
+        pcmk_monitor_retries: None,
+        pcmk_action_limit: None,
+        power_timeout: None,
+        pcmk_reboot_timeout: None,
+        pcmk_delay_max: None,
+        pcmk_host_map: None,
+        warnings: Vec::new(),
+        recommendations: Vec::new(),
+        source_file: None,
+        source_path: source_path.to_string(),
+    };
+
+    if !content.contains("fence_azure_arm") {
+        return result;
+    }
+    result.found = true;
+    result.source_file = Some(source_path.to_string());
+
+    // MSI
+    let msi_re = crate::cached_regex!(r#"(?i)name=["']msi["']\s+value=["'](true|false)["']"#);
+    if let Some(caps) = msi_re.captures(content) {
+        if caps
+            .get(1)
+            .map(|m| m.as_str().eq_ignore_ascii_case("true"))
+            .unwrap_or(false)
+        {
+            result.auth_method = Some("msi".to_string());
+            result.recommendations.push(AzureFenceRecommendation {
+                kind: "using_msi".to_string(),
+                severity: "info".to_string(),
+                message:
+                    "Azure fence agent is using Managed Identity (MSI) - recommended configuration"
+                        .to_string(),
+            });
+        }
+    }
+
+    let login_re = crate::cached_regex!(r#"(?i)name=["']login["']\s+value=["']([^"']+)["']"#);
+    if login_re.is_match(content) {
+        result.has_login = true;
+        if result.auth_method.is_none() {
+            result.auth_method = Some("service_principal".to_string());
+        }
+    }
+
+    let passwd_re = crate::cached_regex!(r#"(?i)name=["'](?:passwd|password)["']\s+value="#);
+    if passwd_re.is_match(content) {
+        result.has_password = true;
+        if result.auth_method.is_none() {
+            result.auth_method = Some("service_principal".to_string());
+        }
+    }
+
+    if result.auth_method.as_deref() == Some("service_principal") {
+        result.warnings.push(AzureFenceWarning {
+            kind: "using_service_principal".to_string(),
+            severity: "warning".to_string(),
+            message: "Azure fence agent is using Service Principal authentication".to_string(),
+            recommendation: "Consider migrating to Managed Identity (MSI) for improved security and easier credential management".to_string(),
+            documentation_url: Some("https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-high-availability-change-from-spn-to-msi-for/ba-p/3609278".to_string()),
+        });
+    }
+
+    result.subscription_id = cap_str(
+        content,
+        r#"(?i)name=["']subscriptionId["']\s+value=["']([^"']+)["']"#,
+    );
+    result.resource_group = cap_str(
+        content,
+        r#"(?i)name=["']resourceGroup["']\s+value=["']([^"']+)["']"#,
+    );
+    result.tenant_id = cap_str(
+        content,
+        r#"(?i)name=["']tenantId["']\s+value=["']([^"']+)["']"#,
+    );
+    result.pcmk_monitor_retries = cap_int(
+        content,
+        r#"(?i)name=["']pcmk_monitor_retries["']\s+value=["'](\d+)["']"#,
+    );
+    result.pcmk_action_limit = cap_int(
+        content,
+        r#"(?i)name=["']pcmk_action_limit["']\s+value=["'](\d+)["']"#,
+    );
+    result.power_timeout = cap_int(
+        content,
+        r#"(?i)name=["']power_timeout["']\s+value=["'](\d+)["']"#,
+    );
+    result.pcmk_reboot_timeout = cap_int(
+        content,
+        r#"(?i)name=["']pcmk_reboot_timeout["']\s+value=["'](\d+)["']"#,
+    );
+    result.pcmk_delay_max = cap_int(
+        content,
+        r#"(?i)name=["']pcmk_delay_max["']\s+value=["'](\d+)["']"#,
+    );
+    result.pcmk_host_map = cap_str(
+        content,
+        r#"(?i)name=["']pcmk_host_map["']\s+value=["']([^"']+)["']"#,
+    );
+
+    result
+}
+
+// ---------------------------------------------------------------------------
+// iscsiConfig  (initiator, targets, sessions, hosts, iscsid.conf)
+// ---------------------------------------------------------------------------
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct IscsiPortal {
+    pub ip: String,
+    pub port: i64,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct IscsiTarget {
+    pub iqn: String,
+    pub portals: Vec<IscsiPortal>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct IscsiDiscovery {
+    pub ip: String,
+    pub port: i64,
+    pub method: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct IscsiSession {
+    pub session_id: i64,
+    pub ip: String,
+    pub port: i64,
+    pub iqn: String,
+    #[serde(rename = "type")]
+    pub kind: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub connection_state: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub session_state: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct IscsiHost {
+    pub host_number: i64,
+    pub state: String,
+    pub transport: String,
+    pub ip: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct IscsiSetting {
+    // Stored as a list of key/value pairs because the keys (e.g.
+    // "node.session.timeo.replacement_timeout") contain underscores that
+    // would be mangled by the JS bridge's snake→camel transform. The JS
+    // shim re-projects this into the legacy `iscsidConfig` object shape.
+    pub name: String,
+    pub value: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct IscsiServiceStatus {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub iscsi_service: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub iscsid_service: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct IscsiWarning {
+    #[serde(rename = "type")]
+    pub kind: String,
+    pub severity: String,
+    pub message: String,
+    pub recommendation: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct IscsiConfigResult {
+    pub found: bool,
+    pub initiator_name: Option<String>,
+    pub targets: Vec<IscsiTarget>,
+    pub discovery_servers: Vec<IscsiDiscovery>,
+    pub sessions: Vec<IscsiSession>,
+    pub hosts: Vec<IscsiHost>,
+    pub node_startup: Option<String>,
+    pub iscsid_config: Vec<IscsiSetting>,
+    pub service_status: IscsiServiceStatus,
+    pub warnings: Vec<IscsiWarning>,
+    pub source_file: Option<String>,
+    pub source_path: String,
+}
+
+pub fn parse_iscsi_config(content: &str, source_path: &str) -> IscsiConfigResult {
+    let mut result = IscsiConfigResult {
+        found: false,
+        initiator_name: None,
+        targets: Vec::new(),
+        discovery_servers: Vec::new(),
+        sessions: Vec::new(),
+        hosts: Vec::new(),
+        node_startup: None,
+        iscsid_config: Vec::new(),
+        service_status: IscsiServiceStatus {
+            iscsi_service: None,
+            iscsid_service: None,
+        },
+        warnings: Vec::new(),
+        source_file: None,
+        source_path: source_path.to_string(),
+    };
+
+    // InitiatorName
+    if let Some(caps) = crate::cached_regex!(r"(?i)InitiatorName=([^\s\n]+)").captures(content) {
+        result.found = true;
+        result.initiator_name = caps.get(1).map(|m| m.as_str().to_string());
+        result.source_file = Some(source_path.to_string());
+    }
+
+    // iscsid.conf settings
+    let settings = [
+        "node.startup",
+        "node.session.timeo.replacement_timeout",
+        "node.conn[0].timeo.login_timeout",
+        "node.conn[0].timeo.logout_timeout",
+        "node.session.initial_login_retry_max",
+        "node.session.iscsi.FirstBurstLength",
+        "node.session.iscsi.MaxBurstLength",
+        "discovery.sendtargets.iscsi.MaxRecvDataSegmentLength",
+    ];
+    for setting in &settings {
+        let escaped = regex::escape(setting);
+        let pattern = format!(r"(?i){}\s*=\s*([^\n]+)", escaped);
+        if let Ok(re) = Regex::new(&pattern) {
+            if let Some(caps) = re.captures(content) {
+                if let Some(v) = caps.get(1).map(|m| m.as_str().trim().to_string()) {
+                    result.found = true;
+                    result.iscsid_config.push(IscsiSetting {
+                        name: setting.to_string(),
+                        value: v,
+                    });
+                }
+            }
+        }
+    }
+
+    if let Some(s) = result
+        .iscsid_config
+        .iter()
+        .find(|s| s.name == "node.startup")
+    {
+        result.node_startup = Some(s.value.to_ascii_lowercase());
+    }
+
+    // Discovery servers
+    let mut seen_disc: HashSet<String> = HashSet::new();
+    let disc_re = crate::cached_regex!(r"(\d+\.\d+\.\d+\.\d+):(\d+)\s+via\s+(\w+)");
+    for caps in disc_re.captures_iter(content) {
+        let ip = caps
+            .get(1)
+            .map(|m| m.as_str().to_string())
+            .unwrap_or_default();
+        let port: i64 = caps
+            .get(2)
+            .and_then(|m| m.as_str().parse().ok())
+            .unwrap_or(0);
+        let key = format!("{}:{}", ip, port);
+        if seen_disc.insert(key) {
+            result.found = true;
+            result.discovery_servers.push(IscsiDiscovery {
+                ip,
+                port,
+                method: caps
+                    .get(3)
+                    .map(|m| m.as_str().to_string())
+                    .unwrap_or_default(),
+            });
+        }
+    }
+
+    // Targets
+    let mut targets_by_iqn: std::collections::HashMap<String, IscsiTarget> =
+        std::collections::HashMap::new();
+    let mut iqn_order: Vec<String> = Vec::new();
+    let target_re = crate::cached_regex!(r"(\d+\.\d+\.\d+\.\d+):(\d+),\d+\s+(iqn\.[^\s\n(]+)");
+    for caps in target_re.captures_iter(content) {
+        let ip = caps
+            .get(1)
+            .map(|m| m.as_str().to_string())
+            .unwrap_or_default();
+        let port: i64 = caps
+            .get(2)
+            .and_then(|m| m.as_str().parse().ok())
+            .unwrap_or(0);
+        let iqn = caps
+            .get(3)
+            .map(|m| m.as_str().trim().to_string())
+            .unwrap_or_default();
+        let entry = targets_by_iqn.entry(iqn.clone()).or_insert_with(|| {
+            iqn_order.push(iqn.clone());
+            IscsiTarget {
+                iqn: iqn.clone(),
+                portals: Vec::new(),
+            }
+        });
+        let portal_key = format!("{}:{}", ip, port);
+        if !entry
+            .portals
+            .iter()
+            .any(|p| format!("{}:{}", p.ip, p.port) == portal_key)
+        {
+            entry.portals.push(IscsiPortal { ip, port });
+        }
+    }
+    for iqn in iqn_order {
+        if let Some(t) = targets_by_iqn.remove(&iqn) {
+            result.found = true;
+            result.targets.push(t);
+        }
+    }
+
+    // Sessions
+    let mut seen_sess: HashSet<String> = HashSet::new();
+    let sess_re = Regex::new(
+        r"tcp:\s+\[(\d+)\]\s+(\d+\.\d+\.\d+\.\d+):(\d+),\d+\s+(iqn\.[^\s\n(]+)(?:\s+\(([^)]+)\))?",
+    )
+    .unwrap();
+    for caps in sess_re.captures_iter(content) {
+        let session_id_str = caps
+            .get(1)
+            .map(|m| m.as_str().to_string())
+            .unwrap_or_default();
+        if !seen_sess.insert(session_id_str.clone()) {
+            continue;
+        }
+        result.found = true;
+        result.sessions.push(IscsiSession {
+            session_id: session_id_str.parse().unwrap_or(0),
+            ip: caps
+                .get(2)
+                .map(|m| m.as_str().to_string())
+                .unwrap_or_default(),
+            port: caps
+                .get(3)
+                .and_then(|m| m.as_str().parse().ok())
+                .unwrap_or(0),
+            iqn: caps
+                .get(4)
+                .map(|m| m.as_str().trim().to_string())
+                .unwrap_or_default(),
+            kind: caps
+                .get(5)
+                .map(|m| m.as_str().to_string())
+                .unwrap_or_else(|| "unknown".to_string()),
+            connection_state: None,
+            session_state: None,
+        });
+    }
+
+    // Connection state per session
+    let state_re = Regex::new(
+        r"Current Portal:\s+(\d+\.\d+\.\d+\.\d+):(\d+)[\s\S]*?iSCSI Connection State:\s*([^\n]+)[\s\S]*?iSCSI Session State:\s*([^\n]+)",
+    )
+    .unwrap();
+    for caps in state_re.captures_iter(content) {
+        let ip = caps
+            .get(1)
+            .map(|m| m.as_str().to_string())
+            .unwrap_or_default();
+        let port: i64 = caps
+            .get(2)
+            .and_then(|m| m.as_str().parse().ok())
+            .unwrap_or(0);
+        let conn = caps
+            .get(3)
+            .map(|m| m.as_str().trim().to_string())
+            .unwrap_or_default();
+        let sess = caps
+            .get(4)
+            .map(|m| m.as_str().trim().to_string())
+            .unwrap_or_default();
+        if let Some(s) = result
+            .sessions
+            .iter_mut()
+            .find(|s| s.ip == ip && s.port == port)
+        {
+            s.connection_state = Some(conn);
+            s.session_state = Some(sess);
+        }
+    }
+
+    // Hosts
+    let host_re = Regex::new(
+        r"Host Number:\s*(\d+)[\s\S]*?State:\s*(\w+)[\s\S]*?Transport:\s*(\w+)[\s\S]*?IPaddress:\s*([^\n]+)",
+    )
+    .unwrap();
+    for caps in host_re.captures_iter(content) {
+        result.found = true;
+        result.hosts.push(IscsiHost {
+            host_number: caps
+                .get(1)
+                .and_then(|m| m.as_str().parse().ok())
+                .unwrap_or(0),
+            state: caps
+                .get(2)
+                .map(|m| m.as_str().trim().to_string())
+                .unwrap_or_default(),
+            transport: caps
+                .get(3)
+                .map(|m| m.as_str().trim().to_string())
+                .unwrap_or_default(),
+            ip: caps
+                .get(4)
+                .map(|m| m.as_str().trim().to_string())
+                .unwrap_or_default(),
+        });
+    }
+
+    // Service status
+    if let Some(caps) =
+        crate::cached_regex!(r"iscsi\.service[\s\S]*?Active:\s*([^\n]+)").captures(content)
+    {
+        result.service_status.iscsi_service = caps.get(1).map(|m| m.as_str().trim().to_string());
+    }
+    if let Some(caps) =
+        crate::cached_regex!(r"iscsid\.service[\s\S]*?Active:\s*([^\n]+)").captures(content)
+    {
+        result.service_status.iscsid_service = caps.get(1).map(|m| m.as_str().trim().to_string());
+    }
+
+    // Warnings
+    if result.sessions.is_empty() && !result.targets.is_empty() {
+        result.warnings.push(IscsiWarning {
+            kind: "iscsi_no_active_sessions".to_string(),
+            severity: "warning".to_string(),
+            message: "iSCSI targets configured but no active sessions".to_string(),
+            recommendation: "Check iSCSI connectivity and network status".to_string(),
+        });
+    }
+    for s in &result.sessions {
+        if let Some(state) = &s.connection_state {
+            if state != "LOGGED IN" {
+                result.warnings.push(IscsiWarning {
+                    kind: "iscsi_session_not_logged_in".to_string(),
+                    severity: "error".to_string(),
+                    message: format!("iSCSI session to {} is not logged in ({})", s.ip, state),
+                    recommendation: "Check iSCSI target availability and network connectivity"
+                        .to_string(),
+                });
+            }
+        }
+    }
+    if !result.sessions.is_empty() {
+        let mut by_iqn: std::collections::HashMap<String, usize> = std::collections::HashMap::new();
+        let mut iqn_order: Vec<String> = Vec::new();
+        for s in &result.sessions {
+            if !by_iqn.contains_key(&s.iqn) {
+                iqn_order.push(s.iqn.clone());
+            }
+            *by_iqn.entry(s.iqn.clone()).or_insert(0) += 1;
+        }
+        for iqn in iqn_order {
+            let count = by_iqn[&iqn];
+            if count < 3 {
+                result.warnings.push(IscsiWarning {
+                    kind: "iscsi_insufficient_paths".to_string(),
+                    severity: "info".to_string(),
+                    message: format!("iSCSI target {} has only {} path(s)", iqn, count),
+                    recommendation:
+                        "Azure iSCSI SBD typically requires 3 paths for high availability"
+                            .to_string(),
+                });
+            }
+        }
+    }
+
+    result
+}
+
+// ---------------------------------------------------------------------------
+// liveMigration  (detects Hyper-V live migration via hv_utils sequence)
+// ---------------------------------------------------------------------------
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct LiveMigrationEvent {
+    pub timestamp: String,
+    pub line_number: usize,
+    pub raw_line: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct LiveMigrationResult {
+    pub found: bool,
+    pub count: usize,
+    pub events: Vec<LiveMigrationEvent>,
+    pub source_path: String,
+}
+
+pub fn parse_live_migration(content: &str, source_path: &str) -> LiveMigrationResult {
+    let lines: Vec<&str> = content.lines().collect();
+    let mut migrations: Vec<LiveMigrationEvent> = Vec::new();
+
+    let mut i = 0usize;
+    while i < lines.len() {
+        let line = lines[i];
+        if !(line.contains("hv_utils") || line.contains("hv_balloon") || line.contains("hv_netvsc"))
+        {
+            i += 1;
+            continue;
+        }
+        if line.contains("hv_utils: Heartbeat IC") {
+            let heartbeat = i;
+            // find hv_balloon within next 100 lines
+            let end_b = (i + 100).min(lines.len());
+            let mut balloon: Option<usize> = None;
+            for j in (i + 1)..end_b {
+                if lines[j].contains("hv_balloon") {
+                    balloon = Some(j);
+                    break;
+                }
+            }
+            if let Some(b) = balloon {
+                let end_n = (heartbeat + 100).min(lines.len());
+                let mut netvsc: Option<usize> = None;
+                for k in (b + 1)..end_n {
+                    if lines[k].contains("hv_netvsc") {
+                        netvsc = Some(k);
+                        break;
+                    }
+                }
+                if let Some(n) = netvsc {
+                    let (timestamp, _node, _msg) = parse_syslog_prefix(lines[heartbeat]);
+                    migrations.push(LiveMigrationEvent {
+                        timestamp: timestamp.unwrap_or_else(|| "Unknown".to_string()),
+                        line_number: heartbeat + 1,
+                        raw_line: lines[heartbeat].to_string(),
+                    });
+                    i = n;
+                }
+            }
+        }
+        i += 1;
+    }
+
+    LiveMigrationResult {
+        found: !migrations.is_empty(),
+        count: migrations.len(),
+        events: migrations,
+        source_path: source_path.to_string(),
+    }
+}
+
+// ---------------------------------------------------------------------------
+// sapInstanceErrors  (scans logs for SAPInstance / Filesystem RA errors)
+// ---------------------------------------------------------------------------
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct SapInstanceError {
+    #[serde(rename = "type")]
+    pub kind: String,
+    pub severity: String,
+    pub resource_name: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub profile_path: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub service_name: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub mount_point: Option<String>,
+    pub timestamp: Option<String>,
+    pub line_number: usize,
+    pub message: String,
+    pub recommendation: String,
+    pub raw_line: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Default)]
+pub struct SapInstanceErrorsSummary {
+    pub start_profile_error_count: usize,
+    pub gray_status_error_count: usize,
+    pub filesystem_error_count: usize,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct SapInstanceErrorsResult {
+    pub found: bool,
+    pub errors: Vec<SapInstanceError>,
+    pub start_profile_errors: Vec<SapInstanceError>,
+    pub gray_status_errors: Vec<SapInstanceError>,
+    pub filesystem_errors: Vec<SapInstanceError>,
+    pub error_count: usize,
+    pub summary: SapInstanceErrorsSummary,
+    pub source_path: String,
+}
+
+pub fn parse_sap_instance_errors(content: &str, source_path: &str) -> SapInstanceErrorsResult {
+    use std::sync::OnceLock;
+    static START_RE: OnceLock<Regex> = OnceLock::new();
+    static GRAY_RE: OnceLock<Regex> = OnceLock::new();
+    static FS_RE: OnceLock<Regex> = OnceLock::new();
+    static TS_RE: OnceLock<Regex> = OnceLock::new();
+    let start_re = START_RE.get_or_init(|| {
+        Regex::new(r"(?i)SAPInstance\(([^)]+)\)\[\d+\]:\s*ERROR:\s*Expected\s+(\S+)\s+to be the instance START profile").unwrap()
+    });
+    let gray_re = GRAY_RE.get_or_init(|| {
+        Regex::new(r"(?i)SAPInstance\(([^)]+)\)\[\d+\]:\s*ERROR:\s*SAP instance service\s+(\S+)\s+is not running with status GRAY").unwrap()
+    });
+    let fs_re = FS_RE.get_or_init(|| {
+        Regex::new(r"(?i)Filesystem\(([^)]+)\)\[\d+\]:\s*ERROR:\s*Couldn't unmount\s+(\S+)")
+            .unwrap()
+    });
+    let ts_re = TS_RE.get_or_init(|| Regex::new(r"^(\w+\s+\d+\s+\d+:\d+:\d+)").unwrap());
+
+    let mut start_profile_errors: Vec<SapInstanceError> = Vec::new();
+    let mut gray_status_errors: Vec<SapInstanceError> = Vec::new();
+    let mut filesystem_errors: Vec<SapInstanceError> = Vec::new();
+    let mut errors: Vec<SapInstanceError> = Vec::new();
+
+    for (i, raw_line) in content.lines().enumerate() {
+        if !(raw_line.contains("SAPInstance") || raw_line.contains("Filesystem(")) {
+            continue;
+        }
+        let timestamp = ts_re
+            .captures(raw_line)
+            .and_then(|c| c.get(1).map(|m| m.as_str().to_string()));
+
+        if let Some(caps) = start_re.captures(raw_line) {
+            let resource_name = caps
+                .get(1)
+                .map(|m| m.as_str().to_string())
+                .unwrap_or_default();
+            let profile_path = caps
+                .get(2)
+                .map(|m| m.as_str().to_string())
+                .unwrap_or_default();
+            let exists = start_profile_errors.iter().any(|e| {
+                e.resource_name == resource_name
+                    && e.profile_path.as_deref() == Some(profile_path.as_str())
+            });
+            if !exists {
+                let err = SapInstanceError {
+                    kind: "start_profile_not_found".to_string(),
+                    severity: "error".to_string(),
+                    resource_name,
+                    profile_path: Some(profile_path.clone()),
+                    service_name: None,
+                    mount_point: None,
+                    timestamp: timestamp.clone(),
+                    line_number: i + 1,
+                    message: format!(
+                        "SAP profile file \"{}\" not found for resource {}",
+                        profile_path,
+                        caps.get(1).map(|m| m.as_str()).unwrap_or("")
+                    ),
+                    recommendation: "Verify that the START_PROFILE path points to an existing SAP profile file. The profile filename should match the virtual hostname configured for the SAP instance. Check /sapmnt/<SID>/profile/ for available profiles.".to_string(),
+                    raw_line: raw_line.trim().to_string(),
+                };
+                start_profile_errors.push(err.clone());
+                errors.push(err);
+            }
+        }
+        if let Some(caps) = gray_re.captures(raw_line) {
+            let resource_name = caps
+                .get(1)
+                .map(|m| m.as_str().to_string())
+                .unwrap_or_default();
+            let service_name = caps
+                .get(2)
+                .map(|m| m.as_str().to_string())
+                .unwrap_or_default();
+            let exists = gray_status_errors.iter().any(|e| {
+                e.resource_name == resource_name
+                    && e.service_name.as_deref() == Some(service_name.as_str())
+            });
+            if !exists {
+                let err = SapInstanceError {
+                    kind: "sap_service_gray_status".to_string(),
+                    severity: "error".to_string(),
+                    resource_name: resource_name.clone(),
+                    profile_path: None,
+                    service_name: Some(service_name.clone()),
+                    mount_point: None,
+                    timestamp: timestamp.clone(),
+                    line_number: i + 1,
+                    message: format!(
+                        "SAP service \"{}\" is not running (status GRAY) for resource {}",
+                        service_name, resource_name
+                    ),
+                    recommendation: "GRAY status indicates the SAP service failed to start or crashed. Check SAP instance logs under /usr/sap/<SID>/<INSTANCE>/work/ for startup errors. Verify NFS mounts are available and SAP profile is correct.".to_string(),
+                    raw_line: raw_line.trim().to_string(),
+                };
+                gray_status_errors.push(err.clone());
+                errors.push(err);
+            }
+        }
+        if let Some(caps) = fs_re.captures(raw_line) {
+            let resource_name = caps
+                .get(1)
+                .map(|m| m.as_str().to_string())
+                .unwrap_or_default();
+            let mount_point = caps
+                .get(2)
+                .map(|m| m.as_str().to_string())
+                .unwrap_or_default();
+            let exists = filesystem_errors.iter().any(|e| {
+                e.resource_name == resource_name
+                    && e.mount_point.as_deref() == Some(mount_point.as_str())
+            });
+            if !exists {
+                let err = SapInstanceError {
+                    kind: "filesystem_unmount_error".to_string(),
+                    severity: "warning".to_string(),
+                    resource_name: resource_name.clone(),
+                    profile_path: None,
+                    service_name: None,
+                    mount_point: Some(mount_point.clone()),
+                    timestamp,
+                    line_number: i + 1,
+                    message: format!(
+                        "Failed to unmount filesystem \"{}\" for resource {}",
+                        mount_point, resource_name
+                    ),
+                    recommendation: "Check for processes still using the filesystem with \"lsof\" or \"fuser\". This may indicate SAP processes did not stop cleanly before failover.".to_string(),
+                    raw_line: raw_line.trim().to_string(),
+                };
+                filesystem_errors.push(err.clone());
+                errors.push(err);
+            }
+        }
+    }
+
+    let found = !errors.is_empty();
+    let summary = SapInstanceErrorsSummary {
+        start_profile_error_count: start_profile_errors.len(),
+        gray_status_error_count: gray_status_errors.len(),
+        filesystem_error_count: filesystem_errors.len(),
+    };
+    SapInstanceErrorsResult {
+        found,
+        error_count: errors.len(),
+        errors,
+        start_profile_errors,
+        gray_status_errors,
+        filesystem_errors,
+        summary,
+        source_path: source_path.to_string(),
+    }
+}
+
+// ---------------------------------------------------------------------------
+// JSON wrappers
+// ---------------------------------------------------------------------------
+
+pub fn parse_pacemaker_high_cpu_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_pacemaker_high_cpu(content, source_path))
+        .unwrap_or_else(|_| "[]".to_string())
+}
+
+pub fn parse_cluster_events_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_cluster_events(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_cluster_status_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_cluster_status(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_corosync_config_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_corosync_config(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_cluster_maintenance_mode_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_cluster_maintenance_mode(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_hosts_file_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_hosts_file(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_corosync_status_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_corosync_status(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_cluster_daemon_status_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_cluster_daemon_status(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_sbd_config_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_sbd_config(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_azure_fence_auth_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_azure_fence_auth(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_iscsi_config_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_iscsi_config(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_live_migration_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_live_migration(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_sap_instance_errors_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_sap_instance_errors(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+// ============================================================================
+// XML attribute helper (regex-based, mirrors JS parseXMLSimple usage pattern)
+// ============================================================================
+
+/// Iterate over every opening tag with the given name, returning each tag's
+/// attributes as a list of (name, value) pairs. Matches both `<tag attrs>` and
+/// `<tag attrs/>`.
+fn iter_xml_tags(content: &str, tag: &str) -> Vec<std::collections::HashMap<String, String>> {
+    let pattern = format!(r#"<{}\b([^>]*?)/?>"#, regex::escape(tag));
+    let re = match Regex::new(&pattern) {
+        Ok(r) => r,
+        Err(_) => return Vec::new(),
+    };
+    let attr_re = crate::cached_regex!(r#"([A-Za-z_][A-Za-z0-9_:.\-]*)\s*=\s*"([^"]*)""#);
+    let mut out = Vec::new();
+    for caps in re.captures_iter(content) {
+        let attrs_str = caps.get(1).map(|m| m.as_str()).unwrap_or("");
+        let mut map = std::collections::HashMap::new();
+        for ac in attr_re.captures_iter(attrs_str) {
+            let k = ac.get(1).unwrap().as_str().to_string();
+            let v = ac.get(2).unwrap().as_str().to_string();
+            map.insert(k, v);
+        }
+        out.push(map);
+    }
+    out
+}
+
+// ============================================================================
+// parse_cluster_nodes — ha.txt / corosync.conf / cib.xml / crm_mon
+// ============================================================================
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct NodeIpEntry {
+    /// Hostname; the JS shim projects [{host,ip}, ...] back to {host: ip} object.
+    pub host: String,
+    pub ip: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct ClusterNodesResult {
+    pub nodes: Vec<String>,
+    /// Vec form to dodge JS bridge key-mangling; shim converts to {host: ip}.
+    pub node_to_ip_map: Vec<NodeIpEntry>,
+}
+
+pub fn parse_cluster_nodes(content: &str, _source_path: &str) -> ClusterNodesResult {
+    let mut node_set: HashSet<String> = HashSet::new();
+    let mut node_to_ip: Vec<NodeIpEntry> = Vec::new();
+
+    // XML CIB extraction (uname/id attributes on <node> tags)
+    if content.contains("<node") && (content.contains("<cib") || content.contains("uname=")) {
+        let id_only_digits = crate::cached_regex!(r"^\d+$");
+        for attrs in iter_xml_tags(content, "node") {
+            if let Some(uname) = attrs.get("uname") {
+                if !uname.is_empty() {
+                    node_set.insert(uname.clone());
+                    continue;
+                }
+            }
+            if let Some(id) = attrs.get("id") {
+                if !id_only_digits.is_match(id) {
+                    node_set.insert(id.clone());
+                }
+            }
+        }
+    }
+
+    let nodelist_re = crate::cached_regex!(r"(?i)^nodelist\s*\{");
+    let node_block_re = crate::cached_regex!(r"(?i)^node\s*\{");
+    let name_re = crate::cached_regex!(r"(?i)^name:\s*([a-zA-Z][a-zA-Z0-9_\-\.]+)");
+    let ring0_re = crate::cached_regex!(r"(?i)^ring0_addr:\s*(.+)$");
+    let ipv4_re = crate::cached_regex!(r"^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$");
+    let host_re = crate::cached_regex!(r"^[a-zA-Z][a-zA-Z0-9_\-\.]+$");
+    let plain_node_re = crate::cached_regex!(r"(?i)^node[:\s]+([a-zA-Z][a-zA-Z0-9_\-\.]+)");
+    let crm_node_re =
+        crate::cached_regex!(r"(?i)(?:\*\s+)?Node\s+([a-zA-Z0-9][a-zA-Z0-9_\-\.]+)(?:\s+\(|:)");
+    let name_simple_re = crate::cached_regex!(r"(?i)^\s*name:");
+    let name_value_re = crate::cached_regex!(r"(?i)name:\s*([a-zA-Z0-9][a-zA-Z0-9_\-\.]+)");
+    let ipv4_inline_re = crate::cached_regex!(r"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}");
+
+    let mut in_nodelist = false;
+    let mut in_node = false;
+    let mut depth: i32 = 0;
+    let mut current_name: Option<String> = None;
+    let mut current_ring0: Option<String> = None;
+
+    for line in content.lines() {
+        let trimmed = line.trim();
+        if nodelist_re.is_match(trimmed) {
+            in_nodelist = true;
+            depth = 1;
+            continue;
+        }
+        if in_nodelist {
+            if node_block_re.is_match(trimmed) {
+                in_node = true;
+                current_name = None;
+                current_ring0 = None;
+                depth += 1;
+                continue;
+            }
+            if in_node {
+                if let Some(c) = name_re.captures(trimmed) {
+                    current_name = Some(c.get(1).unwrap().as_str().to_string());
+                }
+                if let Some(c) = ring0_re.captures(trimmed) {
+                    let addr = c.get(1).unwrap().as_str().trim().to_string();
+                    if ipv4_re.is_match(&addr) || host_re.is_match(&addr) {
+                        current_ring0 = Some(addr);
+                    }
+                }
+                if trimmed == "}" {
+                    in_node = false;
+                    depth -= 1;
+                    if let (Some(n), Some(r)) = (&current_name, &current_ring0) {
+                        if ipv4_re.is_match(r) {
+                            node_to_ip.push(NodeIpEntry {
+                                host: n.clone(),
+                                ip: r.clone(),
+                            });
+                        }
+                    }
+                    if let Some(n) = current_name.take() {
+                        node_set.insert(n);
+                    }
+                    current_ring0 = None;
+                    continue;
+                }
+            }
+            if trimmed == "}" {
+                depth -= 1;
+            } else if trimmed.ends_with('{') {
+                depth += 1;
+            }
+            if depth == 0 {
+                in_nodelist = false;
+            }
+            continue;
+        }
+
+        if let Some(c) = plain_node_re.captures(trimmed) {
+            node_set.insert(c.get(1).unwrap().as_str().to_string());
+            continue;
+        }
+        if let Some(c) = crm_node_re.captures(trimmed) {
+            node_set.insert(c.get(1).unwrap().as_str().to_string());
+            continue;
+        }
+        if name_simple_re.is_match(trimmed) {
+            if let Some(c) = name_value_re.captures(trimmed) {
+                let n = c.get(1).unwrap().as_str();
+                if !ipv4_inline_re.is_match(n) {
+                    node_set.insert(n.to_string());
+                }
+            }
+        }
+    }
+
+    let excluded: HashSet<&str> = [
+        "online",
+        "offline",
+        "standby",
+        "maintenance",
+        "pending",
+        "unclean",
+        "node",
+        "nodes",
+        "cluster",
+        "member",
+        "members",
+        "list",
+        "attributes",
+        "stonith",
+        "fencing",
+        "resource",
+        "resources",
+        "status",
+    ]
+    .iter()
+    .copied()
+    .collect();
+    let starts_alpha = crate::cached_regex!(r"^[a-zA-Z]");
+    let valid_chars = crate::cached_regex!(r"^[a-zA-Z0-9_\-\.]+$");
+
+    let mut nodes: Vec<String> = node_set
+        .into_iter()
+        .filter(|n| {
+            if ipv4_re.is_match(n) {
+                return true;
+            }
+            if !starts_alpha.is_match(n) {
+                return false;
+            }
+            if n.len() < 3 {
+                return false;
+            }
+            if excluded.contains(n.to_lowercase().as_str()) {
+                return false;
+            }
+            valid_chars.is_match(n)
+        })
+        .collect();
+    nodes.sort();
+
+    ClusterNodesResult {
+        nodes,
+        node_to_ip_map: node_to_ip,
+    }
+}
+
+// ============================================================================
+// parse_fencing_config — cib.xml / crm config / pcs_config
+// ============================================================================
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct FencingDevice {
+    pub name: String,
+    #[serde(rename = "type")]
+    pub kind: String,
+    pub agent: String,
+    pub cloud: Option<String>,
+    pub source_file: String,
+    pub source_line: usize,
+    pub pattern: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct FencingConfigResult {
+    pub found: bool,
+    pub stonith_enabled: Option<bool>,
+    pub stonith_source_file: Option<String>,
+    pub stonith_source_pattern: Option<String>,
+    pub fencing_devices: Vec<FencingDevice>,
+    pub count: usize,
+}
+
+fn classify_fence_agent(agent_type: &str) -> (String, Option<String>) {
+    if agent_type.contains("azure") {
+        ("Azure Fencing".to_string(), Some("Azure".to_string()))
+    } else if agent_type.contains("aws") {
+        ("AWS Fencing".to_string(), Some("AWS".to_string()))
+    } else if agent_type.contains("gce") {
+        ("GCP Fencing".to_string(), Some("GCP".to_string()))
+    } else if let Some(rest) = agent_type.strip_prefix("external/") {
+        (format!("External {}", rest.to_uppercase()), None)
+    } else if let Some(rest) = agent_type.strip_prefix("fence_") {
+        (format!("Fence {}", rest.to_uppercase()), None)
+    } else {
+        (agent_type.to_string(), None)
+    }
+}
+
+pub fn parse_fencing_config(content: &str, source_path: &str) -> FencingConfigResult {
+    let mut devices: Vec<FencingDevice> = Vec::new();
+    let mut stonith_enabled: Option<bool> = None;
+    let mut stonith_source_file: Option<String> = None;
+    let mut stonith_source_pattern: Option<String> = None;
+
+    // XML branch
+    if content.contains("<primitive") || content.contains("<nvpair") {
+        // ha.txt extraction of cibadmin -Q section
+        let xml_owned;
+        let xml_content: &str = if source_path.contains("ha.txt") {
+            if let Some(sec) = extract_scc_section(content, "/usr/sbin/cibadmin -Q") {
+                xml_owned = sec;
+                xml_owned.as_str()
+            } else {
+                content
+            }
+        } else {
+            content
+        };
+
+        for attrs in iter_xml_tags(xml_content, "nvpair") {
+            if attrs.get("name").map(|s| s.as_str()) == Some("stonith-enabled") {
+                if let Some(v) = attrs.get("value") {
+                    if v == "true" {
+                        stonith_enabled = Some(true);
+                        stonith_source_file = Some(source_path.to_string());
+                        stonith_source_pattern =
+                            Some(r#"<nvpair name="stonith-enabled" value="true"/>"#.to_string());
+                    } else if v == "false" {
+                        stonith_enabled = Some(false);
+                        stonith_source_file = Some(source_path.to_string());
+                        stonith_source_pattern =
+                            Some(r#"<nvpair name="stonith-enabled" value="false"/>"#.to_string());
+                    }
+                }
+            }
+        }
+
+        for attrs in iter_xml_tags(xml_content, "primitive") {
+            let device_name = match attrs.get("id") {
+                Some(s) if !s.is_empty() => s.clone(),
+                _ => continue,
+            };
+            let agent_type = attrs.get("type").cloned().unwrap_or_default();
+            let agent_class = attrs.get("class").cloned().unwrap_or_default();
+            if agent_type.contains("fence_azure_arm") {
+                if !devices.iter().any(|d| d.name == device_name) {
+                    devices.push(FencingDevice {
+                        name: device_name,
+                        kind: "fence_azure_arm".to_string(),
+                        agent: "Azure Fencing Agent".to_string(),
+                        cloud: Some("Azure".to_string()),
+                        source_file: source_path.to_string(),
+                        source_line: 0,
+                        pattern: r#"XML: <primitive ... type="fence_azure_arm">"#.to_string(),
+                    });
+                }
+            } else if agent_class == "stonith" && !agent_type.is_empty() {
+                if !devices.iter().any(|d| d.name == device_name) {
+                    let (agent, cloud) = classify_fence_agent(&agent_type);
+                    devices.push(FencingDevice {
+                        name: device_name,
+                        kind: agent_type.clone(),
+                        agent,
+                        cloud,
+                        source_file: source_path.to_string(),
+                        source_line: 0,
+                        pattern: format!(
+                            r#"XML: <primitive class="stonith" type="{}">"#,
+                            agent_type
+                        ),
+                    });
+                }
+            }
+        }
+    }
+
+    // Line-based scan for crm/pcs formats
+    let stonith_true_re = crate::cached_regex!(r"(?i)stonith-enabled[=:\s]*true");
+    let stonith_false_re = crate::cached_regex!(r"(?i)stonith-enabled[=:\s]*false");
+    let azure_fence_crm_re =
+        crate::cached_regex!(r"^primitive\s+([^\s]+).*?(?:stonith:)?fence_azure_arm");
+    let pcs_azure_re =
+        crate::cached_regex!(r"^Resource:\s+([^\s]+)\s+\(class=stonith\s+type=fence_azure_arm");
+    let crm_fence_re = crate::cached_regex!(r"^primitive\s+([^\s]+).*?stonith:(\S+)");
+    let pcs_fence_re =
+        crate::cached_regex!(r"^Resource:\s+([^\s]+)\s+\(class=stonith\s+type=([^)\s]+)");
+
+    for (idx, line) in content.lines().enumerate() {
+        let trimmed = line.trim();
+        let line_num = idx + 1;
+
+        if stonith_true_re.is_match(trimmed) && !trimmed.contains('<') {
+            stonith_enabled = Some(true);
+            stonith_source_file = Some(source_path.to_string());
+            stonith_source_pattern = Some("stonith-enabled: true".to_string());
+        }
+        if stonith_false_re.is_match(trimmed) && !trimmed.contains('<') {
+            stonith_enabled = Some(false);
+            stonith_source_file = Some(source_path.to_string());
+            stonith_source_pattern = Some("stonith-enabled: false".to_string());
+        }
+
+        if !trimmed.contains('<') {
+            if let Some(c) = azure_fence_crm_re.captures(trimmed) {
+                let name = c.get(1).unwrap().as_str().to_string();
+                if !devices.iter().any(|d| d.name == name) {
+                    devices.push(FencingDevice {
+                        name,
+                        kind: "fence_azure_arm".to_string(),
+                        agent: "Azure Fencing Agent".to_string(),
+                        cloud: Some("Azure".to_string()),
+                        source_file: source_path.to_string(),
+                        source_line: line_num,
+                        pattern: "crm: primitive ... fence_azure_arm".to_string(),
+                    });
+                }
+            }
+        }
+        if let Some(c) = pcs_azure_re.captures(trimmed) {
+            let name = c.get(1).unwrap().as_str().to_string();
+            if !devices.iter().any(|d| d.name == name) {
+                devices.push(FencingDevice {
+                    name,
+                    kind: "fence_azure_arm".to_string(),
+                    agent: "Azure Fencing Agent".to_string(),
+                    cloud: Some("Azure".to_string()),
+                    source_file: source_path.to_string(),
+                    source_line: line_num,
+                    pattern: "pcs: Resource ... (class=stonith type=fence_azure_arm)".to_string(),
+                });
+            }
+        }
+        if !trimmed.contains('<') {
+            if let Some(c) = crm_fence_re.captures(trimmed) {
+                let name = c.get(1).unwrap().as_str().to_string();
+                let agent_type = c.get(2).unwrap().as_str().to_string();
+                if !devices.iter().any(|d| d.name == name) {
+                    let (agent, cloud) = if agent_type.contains("azure") {
+                        ("Azure Fencing".to_string(), Some("Azure".to_string()))
+                    } else if agent_type.contains("aws") {
+                        ("AWS Fencing".to_string(), Some("AWS".to_string()))
+                    } else if agent_type.contains("gce") {
+                        ("GCP Fencing".to_string(), Some("GCP".to_string()))
+                    } else {
+                        (agent_type.clone(), None)
+                    };
+                    devices.push(FencingDevice {
+                        name,
+                        kind: agent_type.clone(),
+                        agent,
+                        cloud,
+                        source_file: source_path.to_string(),
+                        source_line: line_num,
+                        pattern: format!("crm: primitive ... stonith:{}", agent_type),
+                    });
+                }
+            }
+        }
+        if let Some(c) = pcs_fence_re.captures(trimmed) {
+            let name = c.get(1).unwrap().as_str().to_string();
+            if !devices.iter().any(|d| d.name == name) {
+                let agent_type = c.get(2).unwrap().as_str().to_string();
+                let (agent, cloud) = if agent_type.contains("azure") {
+                    ("Azure Fencing".to_string(), Some("Azure".to_string()))
+                } else if agent_type.contains("aws") {
+                    ("AWS Fencing".to_string(), Some("AWS".to_string()))
+                } else if agent_type.contains("gce") {
+                    ("GCP Fencing".to_string(), Some("GCP".to_string()))
+                } else {
+                    (agent_type.clone(), None)
+                };
+                devices.push(FencingDevice {
+                    name,
+                    kind: agent_type.clone(),
+                    agent,
+                    cloud,
+                    source_file: source_path.to_string(),
+                    source_line: line_num,
+                    pattern: format!("pcs: Resource ... (class=stonith type={})", agent_type),
+                });
+            }
+        }
+    }
+
+    if !devices.is_empty() && stonith_enabled.is_none() {
+        stonith_enabled = Some(true);
+        stonith_source_file = Some(source_path.to_string());
+        stonith_source_pattern = Some("Inferred from presence of stonith devices".to_string());
+    }
+
+    let count = devices.len();
+    FencingConfigResult {
+        found: true,
+        stonith_enabled,
+        stonith_source_file,
+        stonith_source_pattern,
+        fencing_devices: devices,
+        count,
+    }
+}
+
+// ============================================================================
+// parse_azure_scheduled_events
+// ============================================================================
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct HealthAzureNode {
+    pub node: String,
+    pub value: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct HealthAzureResource {
+    pub found: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub line: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct AzureSEWarning {
+    pub severity: String,
+    #[serde(rename = "type")]
+    pub kind: String,
+    pub message: String,
+    pub recommendation: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub stopped_resources: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub online_nodes: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub nodes_missing: Option<Vec<String>>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct AzureScheduledEventsResult {
+    pub found: bool,
+    pub health_azure_configured: bool,
+    pub health_azure_resource: Option<HealthAzureResource>,
+    pub node_health_strategy: Option<String>,
+    pub nodes_with_health_azure: Vec<HealthAzureNode>,
+    pub nodes_without_health_azure: Vec<String>,
+    pub stopped_resources: Vec<String>,
+    pub online_nodes: Vec<String>,
+    pub warnings: Vec<AzureSEWarning>,
+}
+
+pub fn parse_azure_scheduled_events(
+    content: &str,
+    _source_path: &str,
+) -> AzureScheduledEventsResult {
+    let mut result = AzureScheduledEventsResult {
+        found: false,
+        health_azure_configured: false,
+        health_azure_resource: None,
+        node_health_strategy: None,
+        nodes_with_health_azure: Vec::new(),
+        nodes_without_health_azure: Vec::new(),
+        stopped_resources: Vec::new(),
+        online_nodes: Vec::new(),
+        warnings: Vec::new(),
+    };
+
+    let node_attrs_re = crate::cached_regex!(r"(?i)^Node Attributes:?$");
+    let full_resources_re =
+        crate::cached_regex!(r"(?i)^(Full List of Resources|Active Resources|Resources):?$");
+    let node_list_re = crate::cached_regex!(r"(?i)^Node List:?$");
+    let other_section_re =
+        crate::cached_regex!(r"(?i)^(Migration Summary|Operations|Fencing History):?$");
+    let node_online_re = crate::cached_regex!(r"(?i)^\*?\s*Node\s+(\S+).*:\s*(online|offline)");
+    let node_context_re = crate::cached_regex!(r"(?i)^\*?\s*Node:?\s+(\S+)");
+    let health_azure_re = crate::cached_regex!(r"(?i)^\*?\s*#health-azure\s*:\s*(-?\d+|undefined)");
+    let stopped_re = crate::cached_regex!(r"(?i)^\*?\s*(\S+)\s+\([^)]+\):\s+Stopped");
+    let health_strat_re = crate::cached_regex!(r"(?i)node-health-strategy\s*[:=]\s*(\S+)");
+    let cib_health_attr_re =
+        crate::cached_regex!(r#"(?i)name=["']#health-azure["']\s+value=["']([^"']+)["']"#);
+    let cib_strat_re =
+        crate::cached_regex!(r#"(?i)name=["']node-health-strategy["']\s+value=["']([^"']+)["']"#);
+    let health_events_re = crate::cached_regex!(r"(?i)health-azure-events");
+
+    let mut in_node_attrs = false;
+    let mut in_resource_list = false;
+    let mut in_node_list = false;
+    let mut current_node: Option<String> = None;
+
+    for line in content.lines() {
+        let trimmed = line.trim();
+
+        if node_attrs_re.is_match(trimmed) {
+            in_node_attrs = true;
+            in_resource_list = false;
+            in_node_list = false;
+            continue;
+        }
+        if full_resources_re.is_match(trimmed) {
+            in_resource_list = true;
+            in_node_attrs = false;
+            in_node_list = false;
+            continue;
+        }
+        if node_list_re.is_match(trimmed) {
+            in_node_list = true;
+            in_node_attrs = false;
+            in_resource_list = false;
+            continue;
+        }
+        if other_section_re.is_match(trimmed) {
+            in_node_attrs = false;
+            in_resource_list = false;
+            in_node_list = false;
+        }
+
+        if in_node_list {
+            if let Some(c) = node_online_re.captures(trimmed) {
+                if c.get(2).unwrap().as_str().to_lowercase() == "online" {
+                    result
+                        .online_nodes
+                        .push(c.get(1).unwrap().as_str().to_string());
+                }
+            }
+        }
+
+        if in_node_attrs {
+            if let Some(c) = node_context_re.captures(trimmed) {
+                let n = c.get(1).unwrap().as_str().trim_end_matches(':').to_string();
+                current_node = Some(n);
+                continue;
+            }
+            if let Some(c) = health_azure_re.captures(trimmed) {
+                if let Some(node) = &current_node {
+                    result.health_azure_configured = true;
+                    result.nodes_with_health_azure.push(HealthAzureNode {
+                        node: node.clone(),
+                        value: c.get(1).unwrap().as_str().to_string(),
+                    });
+                }
+            }
+        }
+
+        if in_resource_list {
+            if let Some(c) = stopped_re.captures(trimmed) {
+                let rsc = c.get(1).unwrap().as_str();
+                if !rsc.to_lowercase().contains("health-azure") {
+                    result.stopped_resources.push(rsc.to_string());
+                }
+            }
+            if health_events_re.is_match(trimmed) {
+                result.health_azure_resource = Some(HealthAzureResource {
+                    found: true,
+                    line: Some(trimmed.to_string()),
+                    source: None,
+                });
+            }
+        }
+
+        if let Some(c) = health_strat_re.captures(trimmed) {
+            result.node_health_strategy = Some(c.get(1).unwrap().as_str().to_string());
+        }
+    }
+
+    if content.contains("<cib") || content.contains("<nvpair") {
+        if cib_health_attr_re.is_match(content) {
+            result.health_azure_configured = true;
+        }
+        if let Some(c) = cib_strat_re.captures(content) {
+            result.node_health_strategy = Some(c.get(1).unwrap().as_str().to_string());
+        }
+        if health_events_re.is_match(content) && result.health_azure_resource.is_none() {
+            result.health_azure_resource = Some(HealthAzureResource {
+                found: true,
+                line: None,
+                source: Some("cib.xml".to_string()),
+            });
+        }
+    }
+
+    result.found = !result.online_nodes.is_empty()
+        || !result.stopped_resources.is_empty()
+        || result.health_azure_configured
+        || result.health_azure_resource.is_some();
+
+    if !result.found {
+        return AzureScheduledEventsResult {
+            found: false,
+            ..result
+        };
+    }
+
+    if !result.stopped_resources.is_empty() && !result.online_nodes.is_empty() {
+        if !result.health_azure_configured && result.health_azure_resource.is_none() {
+            result.warnings.push(AzureSEWarning {
+                severity: "error".to_string(),
+                kind: "health_azure_not_configured".to_string(),
+                message: format!(
+                    "{} cluster resource(s) are stopped while {} node(s) are online. Azure Scheduled Events (health-azure) is NOT configured.",
+                    result.stopped_resources.len(),
+                    result.online_nodes.len()
+                ),
+                recommendation: "Configure Azure Scheduled Events by creating the health-azure-events resource and setting #health-azure attribute on all nodes. See: https://learn.microsoft.com/en-us/azure/sap/workloads/high-availability-guide-rhel-pacemaker#configure-pacemaker-for-azure-scheduled-events".to_string(),
+                stopped_resources: Some(result.stopped_resources.clone()),
+                online_nodes: Some(result.online_nodes.clone()),
+                nodes_missing: None,
+            });
+        }
+        if result.node_health_strategy.as_deref() == Some("custom")
+            && !result.health_azure_configured
+        {
+            result.warnings.push(AzureSEWarning {
+                severity: "error".to_string(),
+                kind: "health_azure_attribute_missing".to_string(),
+                message: "node-health-strategy is set to \"custom\" but #health-azure attribute is not configured on nodes. Resources cannot be scheduled.".to_string(),
+                recommendation: "Initialize the #health-azure attribute on all nodes: sudo crm_attribute --node <node-name> --name '#health-azure' --update 0".to_string(),
+                stopped_resources: None,
+                online_nodes: Some(result.online_nodes.clone()),
+                nodes_missing: None,
+            });
+        }
+    }
+
+    if !result.nodes_with_health_azure.is_empty()
+        && result.online_nodes.len() > result.nodes_with_health_azure.len()
+    {
+        let nodes_with_attr: HashSet<&String> = result
+            .nodes_with_health_azure
+            .iter()
+            .map(|n| &n.node)
+            .collect();
+        let missing: Vec<String> = result
+            .online_nodes
+            .iter()
+            .filter(|n| !nodes_with_attr.contains(*n))
+            .cloned()
+            .collect();
+        if !missing.is_empty() {
+            result.nodes_without_health_azure = missing.clone();
+            result.warnings.push(AzureSEWarning {
+                severity: "warning".to_string(),
+                kind: "health_azure_partial".to_string(),
+                message: format!(
+                    "#health-azure attribute is configured on some nodes but missing on: {}",
+                    missing.join(", ")
+                ),
+                recommendation:
+                    "Set the #health-azure attribute on all cluster nodes for consistent behavior."
+                        .to_string(),
+                stopped_resources: None,
+                online_nodes: None,
+                nodes_missing: Some(missing),
+            });
+        }
+    }
+
+    result
+}
+
+// ============================================================================
+// parse_sap_instance_config
+// ============================================================================
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct SapInstanceWarning {
+    pub severity: String,
+    #[serde(rename = "type")]
+    pub kind: String,
+    pub message: String,
+    pub recommendation: String,
+    pub resource_name: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub instance_name: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub start_profile: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct SapInstance {
+    pub resource_name: String,
+    pub instance_name: Option<String>,
+    pub start_profile: Option<String>,
+    #[serde(rename = "isERS")]
+    pub is_ers: bool,
+    pub automatic_recover: Option<bool>,
+    pub warnings: Vec<SapInstanceWarning>,
+    pub line_number: usize,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct SapInstanceConfigResult {
+    pub found: bool,
+    pub instances: Vec<SapInstance>,
+    pub warnings: Vec<SapInstanceWarning>,
+    pub instance_count: usize,
+    pub warning_count: usize,
+}
+
+pub fn parse_sap_instance_config(content: &str, _source_path: &str) -> SapInstanceConfigResult {
+    let mut instances: Vec<SapInstance> = Vec::new();
+    let mut warnings: Vec<SapInstanceWarning> = Vec::new();
+    let mut found = false;
+
+    let resource_re = crate::cached_regex!(r"(?i)Resource:\s+(\S+)\s+\(.*type=SAPInstance\)");
+    let xml_resource_re =
+        crate::cached_regex!(r#"(?i)<primitive\s+id="([^"]+)"[^>]*type="SAPInstance""#);
+    let next_section_re = crate::cached_regex!(r"^Resource:|^Group:");
+    let attrs_re = crate::cached_regex!(r"(?i)Attributes:\s+(.*)");
+    let instance_name_re = crate::cached_regex!(r"InstanceName=(\S+)");
+    let start_profile_re = crate::cached_regex!(r"START_PROFILE=(\S+)");
+    let is_ers_re = crate::cached_regex!(r"(?i)IS_ERS=(\S+)");
+    let auto_recover_re = crate::cached_regex!(r"(?i)AUTOMATIC_RECOVER=(\S+)");
+    let xml_nvpair_re =
+        crate::cached_regex!(r#"(?i)<nvpair[^>]*name="([^"]+)"[^>]*value="([^"]+)""#);
+    let profile_path_re = crate::cached_regex!(r"/sapmnt/([^/]+)/profile/([^/]+)$");
+    let instance_format_re =
+        crate::cached_regex!(r"(?i)^([A-Z0-9]{3})_(ASCS|SCS|ERS|D|J)(\d{2})_(.+)$");
+
+    let mut current: Option<SapInstance> = None;
+    let mut in_sap = false;
+
+    for (i, line) in content.lines().enumerate() {
+        let trimmed = line.trim();
+        let line_num = i + 1;
+
+        if let Some(c) = resource_re.captures(trimmed) {
+            if let Some(prev) = current.take() {
+                instances.push(prev);
+            }
+            current = Some(SapInstance {
+                resource_name: c.get(1).unwrap().as_str().to_string(),
+                instance_name: None,
+                start_profile: None,
+                is_ers: false,
+                automatic_recover: None,
+                warnings: Vec::new(),
+                line_number: line_num,
+            });
+            in_sap = true;
+            found = true;
+            continue;
+        }
+        if let Some(c) = xml_resource_re.captures(trimmed) {
+            if let Some(prev) = current.take() {
+                instances.push(prev);
+            }
+            current = Some(SapInstance {
+                resource_name: c.get(1).unwrap().as_str().to_string(),
+                instance_name: None,
+                start_profile: None,
+                is_ers: false,
+                automatic_recover: None,
+                warnings: Vec::new(),
+                line_number: line_num,
+            });
+            in_sap = true;
+            found = true;
+            continue;
+        }
+
+        if in_sap && next_section_re.is_match(trimmed) && !trimmed.contains("SAPInstance") {
+            if let Some(prev) = current.take() {
+                instances.push(prev);
+            }
+            in_sap = false;
+        }
+
+        if let Some(cur) = current.as_mut() {
+            if let Some(am) = attrs_re.captures(trimmed) {
+                let s = am.get(1).unwrap().as_str();
+                if let Some(c) = instance_name_re.captures(s) {
+                    cur.instance_name = Some(c.get(1).unwrap().as_str().to_string());
+                }
+                if let Some(c) = start_profile_re.captures(s) {
+                    cur.start_profile = Some(c.get(1).unwrap().as_str().to_string());
+                }
+                if let Some(c) = is_ers_re.captures(s) {
+                    cur.is_ers = c.get(1).unwrap().as_str().to_lowercase() == "true";
+                }
+                if let Some(c) = auto_recover_re.captures(s) {
+                    cur.automatic_recover =
+                        Some(c.get(1).unwrap().as_str().to_lowercase() == "true");
+                }
+            }
+            if let Some(c) = xml_nvpair_re.captures(trimmed) {
+                let name = c.get(1).unwrap().as_str();
+                let value = c.get(2).unwrap().as_str();
+                match name {
+                    "InstanceName" => cur.instance_name = Some(value.to_string()),
+                    "START_PROFILE" => cur.start_profile = Some(value.to_string()),
+                    "IS_ERS" => cur.is_ers = value.to_lowercase() == "true",
+                    "AUTOMATIC_RECOVER" => {
+                        cur.automatic_recover = Some(value.to_lowercase() == "true")
+                    }
+                    _ => {}
+                }
+            }
+        }
+    }
+
+    if let Some(last) = current.take() {
+        instances.push(last);
+    }
+
+    // Validate
+    for instance in instances.iter_mut() {
+        if let Some(sp) = instance.start_profile.clone() {
+            if let Some(pm) = profile_path_re.captures(&sp) {
+                let profile_filename = pm.get(2).unwrap().as_str();
+                if let Some(inst_name) = instance.instance_name.clone() {
+                    let instance_parts: Vec<&str> = inst_name.split('_').collect();
+                    let profile_parts: Vec<&str> = profile_filename.split('_').collect();
+                    if instance_parts.len() >= 3 && profile_parts.len() >= 3 {
+                        let instance_hostname = instance_parts[2..].join("_");
+                        let profile_hostname = profile_parts[2..].join("_");
+                        if instance_hostname != profile_hostname {
+                            let w = SapInstanceWarning {
+                                severity: "warning".to_string(),
+                                kind: "hostname_mismatch".to_string(),
+                                message: format!(
+                                    "InstanceName hostname \"{}\" does not match START_PROFILE hostname \"{}\"",
+                                    instance_hostname, profile_hostname
+                                ),
+                                recommendation: "Verify that InstanceName and START_PROFILE reference the same virtual hostname for the SAP instance.".to_string(),
+                                resource_name: instance.resource_name.clone(),
+                                instance_name: Some(inst_name.clone()),
+                                start_profile: Some(sp.clone()),
+                            };
+                            instance.warnings.push(w.clone());
+                            warnings.push(w);
+                        }
+                    }
+                }
+            }
+        } else {
+            let w = SapInstanceWarning {
+                severity: "error".to_string(),
+                kind: "missing_start_profile".to_string(),
+                message: "START_PROFILE attribute is missing".to_string(),
+                recommendation: "Add START_PROFILE parameter pointing to the SAP instance profile file at /sapmnt/<SID>/profile/<SID>_<INSTANCE>_<virtual_hostname>".to_string(),
+                resource_name: instance.resource_name.clone(),
+                instance_name: None,
+                start_profile: None,
+            };
+            instance.warnings.push(w.clone());
+            warnings.push(w);
+        }
+
+        if let Some(inst_name) = instance.instance_name.clone() {
+            if !instance_format_re.is_match(&inst_name) {
+                let w = SapInstanceWarning {
+                    severity: "warning".to_string(),
+                    kind: "invalid_instance_format".to_string(),
+                    message: format!(
+                        "InstanceName \"{}\" does not follow expected format <SID>_<INSTANCE>_<hostname>",
+                        inst_name
+                    ),
+                    recommendation: "InstanceName should be in format <SID>_<InstanceType><InstanceNumber>_<virtual_hostname>, e.g., PJU_SCS01_sapascs".to_string(),
+                    resource_name: instance.resource_name.clone(),
+                    instance_name: None,
+                    start_profile: None,
+                };
+                instance.warnings.push(w.clone());
+                warnings.push(w);
+            }
+        } else {
+            let w = SapInstanceWarning {
+                severity: "error".to_string(),
+                kind: "missing_instance_name".to_string(),
+                message: "InstanceName attribute is missing".to_string(),
+                recommendation: "Add InstanceName parameter in format <SID>_<InstanceType><InstanceNumber>_<virtual_hostname>".to_string(),
+                resource_name: instance.resource_name.clone(),
+                instance_name: None,
+                start_profile: None,
+            };
+            instance.warnings.push(w.clone());
+            warnings.push(w);
+        }
+    }
+
+    if !found {
+        return SapInstanceConfigResult {
+            found: false,
+            instances: Vec::new(),
+            warnings: Vec::new(),
+            instance_count: 0,
+            warning_count: 0,
+        };
+    }
+
+    let instance_count = instances.len();
+    let warning_count = warnings.len();
+    SapInstanceConfigResult {
+        found: true,
+        instances,
+        warnings,
+        instance_count,
+        warning_count,
+    }
+}
+
+// ============================================================================
+// parse_pacemaker_resources — biggest port (~810 LOC of JS)
+// ============================================================================
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct PacemakerResource {
+    pub name: String,
+    #[serde(rename = "type")]
+    pub kind: String,
+    pub provider: String,
+    #[serde(rename = "class")]
+    pub class_field: String,
+    pub format: String,
+    pub node: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status: Option<String>,
+    pub maintenance: bool,
+    pub group_member: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub group_name: Option<String>,
+    pub clone_member: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub clone_name: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub location_score: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct ResourceGroup {
+    pub name: String,
+    #[serde(rename = "type")]
+    pub kind: String,
+    pub members: Vec<String>,
+    pub node: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status: Option<String>,
+    #[serde(default)]
+    pub maintenance: bool,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct FailedAction {
+    pub action: String,
+    pub node: String,
+    pub state: String,
+    pub return_code: String,
+    pub details: String,
+}
+
+/// Polymorphic constraint (location, colocation, order). Unused fields are
+/// skipped at serialization to byte-match JS output.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Default)]
+pub struct PacemakerConstraint {
+    pub id: String,
+    #[serde(rename = "type")]
+    pub kind: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub resource: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub node: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub role: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub score: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub with_resource: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub first_resource: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub first_action: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub then_resource: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub then_action: Option<String>,
+    /// Order constraint "kind" attribute (Mandatory/Optional/Serialize). Renamed
+    /// to `kind` in JSON; the parent `kind` field is renamed to `type` so this
+    /// does not collide.
+    #[serde(rename = "kind", skip_serializing_if = "Option::is_none")]
+    pub kind_field: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub symmetrical: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Default)]
+pub struct PacemakerResourcesResult {
+    pub found: bool,
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    pub resources: Vec<PacemakerResource>,
+    #[serde(default)]
+    pub count: usize,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub groups: Vec<ResourceGroup>,
+    #[serde(default)]
+    pub groups_count: usize,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub constraints: Vec<PacemakerConstraint>,
+    #[serde(default)]
+    pub constraints_count: usize,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub failed_actions: Vec<FailedAction>,
+    #[serde(default)]
+    pub failed_actions_count: usize,
+}
+
+pub fn parse_pacemaker_resources(content: &str, source_path: &str) -> PacemakerResourcesResult {
+    let mut resources: Vec<PacemakerResource> = Vec::new();
+    let mut constraints: Vec<PacemakerConstraint> = Vec::new();
+    let mut group_data: Vec<ResourceGroup> = Vec::new();
+
+    let is_ha_txt = source_path.contains("ha.txt");
+    let mut relevant_owned: Option<String> = None;
+
+    if is_ha_txt {
+        let cib_start = content.find("<cib");
+        let cib_end = content.find("</cib>");
+
+        let mut crm_mon_sections: Vec<String> = Vec::new();
+        let mut crm_status_section: Option<String> = None;
+
+        // Split on `^#==[ Command ]====`
+        let split_re = crate::cached_regex!(r"(?m)^#==\[ Command \]====");
+        let parts: Vec<&str> = split_re.split(content).collect();
+        let cmd_line_re = crate::cached_regex!(r"(?m)^[=\s]*#\s*([^\n]+)");
+
+        for (i, part) in parts.iter().enumerate() {
+            if i == 0 {
+                continue;
+            }
+            let cm = match cmd_line_re.captures(part) {
+                Some(c) => c,
+                None => continue,
+            };
+            let cmd_match = cm.get(0).unwrap();
+            let command_line = cm.get(1).unwrap().as_str().trim().to_string();
+            let after = cmd_match.end();
+            let section_content = match part[after..].find('\n') {
+                Some(p) => &part[after + p + 1..],
+                None => "",
+            };
+
+            if command_line.contains("crm_mon")
+                && !command_line.contains("rpm")
+                && !command_line.contains("egrep")
+            {
+                crm_mon_sections.push(section_content.to_string());
+            } else if crate::cached_regex!(r"^crm\s+status").is_match(&command_line)
+                && !command_line.contains("rpm")
+            {
+                crm_status_section = Some(section_content.to_string());
+            }
+        }
+
+        let mut sections: Vec<String> = Vec::new();
+        if let (Some(s), Some(e)) = (cib_start, cib_end) {
+            sections.push(content[s..e + 6].to_string());
+        }
+        for s in &crm_mon_sections {
+            sections.push(s.clone());
+        }
+        if let Some(s) = crm_status_section {
+            sections.push(s);
+        }
+
+        if !sections.is_empty() {
+            relevant_owned = Some(sections.join("\n\n"));
+        } else {
+            // crm configure show fallback
+            let fallback_re =
+                Regex::new(r"(?ms)^#==\[ Command \]====.*?crm configure show.*?(?=^#==\[|\z)")
+                    .unwrap();
+            if let Some(m) = fallback_re.find(content) {
+                relevant_owned = Some(m.as_str().to_string());
+            } else {
+                return PacemakerResourcesResult {
+                    found: false,
+                    ..Default::default()
+                };
+            }
+        }
+    }
+
+    let relevant_content: &str = relevant_owned.as_deref().unwrap_or(content);
+    let content_lines: Vec<&str> = relevant_content.lines().collect();
+
+    // ---- XML branch ----
+    if relevant_content.contains("<cib") || relevant_content.contains("<primitive") {
+        // Groups
+        for attrs in iter_xml_tags(relevant_content, "group") {
+            if let Some(id) = attrs.get("id") {
+                if !id.is_empty() && !attrs.contains_key("crm-debug-origin") {
+                    group_data.push(ResourceGroup {
+                        name: id.clone(),
+                        kind: "group".to_string(),
+                        members: Vec::new(),
+                        node: None,
+                        status: None,
+                        maintenance: false,
+                    });
+                }
+            }
+        }
+
+        // Primitives
+        for attrs in iter_xml_tags(relevant_content, "primitive") {
+            let id = attrs.get("id").cloned().unwrap_or_default();
+            let kind = attrs.get("type").cloned().unwrap_or_default();
+            if id.is_empty() || kind.is_empty() {
+                continue;
+            }
+            resources.push(PacemakerResource {
+                name: id,
+                kind,
+                provider: attrs
+                    .get("provider")
+                    .cloned()
+                    .unwrap_or_else(|| "unknown".to_string()),
+                class_field: attrs
+                    .get("class")
+                    .cloned()
+                    .unwrap_or_else(|| "ocf".to_string()),
+                format: "xml".to_string(),
+                node: None,
+                status: None,
+                maintenance: false,
+                group_member: false,
+                group_name: None,
+                clone_member: false,
+                clone_name: None,
+                location_score: None,
+            });
+        }
+
+        // rsc_location
+        for attrs in iter_xml_tags(relevant_content, "rsc_location") {
+            let id = attrs.get("id").cloned().unwrap_or_default();
+            let rsc_name = attrs.get("rsc").cloned().unwrap_or_default();
+            if id.is_empty() || rsc_name.is_empty() {
+                continue;
+            }
+            let node = attrs.get("node").cloned();
+            let role = attrs
+                .get("role")
+                .cloned()
+                .unwrap_or_else(|| "Started".to_string());
+            let score = attrs.get("score").cloned();
+            constraints.push(PacemakerConstraint {
+                id: id.clone(),
+                kind: "location".to_string(),
+                resource: Some(rsc_name.clone()),
+                node: node.clone(),
+                role: Some(role.clone()),
+                score: score.clone(),
+                ..Default::default()
+            });
+            if let Some(n) = node.clone() {
+                if let Some(r) = resources.iter_mut().find(|r| r.name == rsc_name) {
+                    if r.node.is_none() {
+                        r.node = Some(n);
+                        r.status = Some(role);
+                        r.location_score = score;
+                    }
+                }
+            }
+        }
+
+        // rsc_colocation
+        for attrs in iter_xml_tags(relevant_content, "rsc_colocation") {
+            let id = attrs.get("id").cloned().unwrap_or_default();
+            let rsc = attrs.get("rsc").cloned().unwrap_or_default();
+            let with_rsc = attrs.get("with-rsc").cloned().unwrap_or_default();
+            if id.is_empty() || rsc.is_empty() || with_rsc.is_empty() {
+                continue;
+            }
+            constraints.push(PacemakerConstraint {
+                id,
+                kind: "colocation".to_string(),
+                resource: Some(rsc),
+                with_resource: Some(with_rsc),
+                score: attrs.get("score").cloned(),
+                ..Default::default()
+            });
+        }
+
+        // rsc_order
+        for attrs in iter_xml_tags(relevant_content, "rsc_order") {
+            let id = attrs.get("id").cloned().unwrap_or_default();
+            let first = attrs.get("first").cloned().unwrap_or_default();
+            let then = attrs.get("then").cloned().unwrap_or_default();
+            if id.is_empty() || first.is_empty() || then.is_empty() {
+                continue;
+            }
+            constraints.push(PacemakerConstraint {
+                id,
+                kind: "order".to_string(),
+                first_resource: Some(first),
+                first_action: Some(
+                    attrs
+                        .get("first-action")
+                        .cloned()
+                        .unwrap_or_else(|| "start".to_string()),
+                ),
+                then_resource: Some(then),
+                then_action: Some(
+                    attrs
+                        .get("then-action")
+                        .cloned()
+                        .unwrap_or_else(|| "start".to_string()),
+                ),
+                kind_field: Some(
+                    attrs
+                        .get("kind")
+                        .cloned()
+                        .unwrap_or_else(|| "Mandatory".to_string()),
+                ),
+                symmetrical: attrs.get("symmetrical").cloned(),
+                ..Default::default()
+            });
+        }
+    }
+
+    // ---- Text-format scan (crm/crm_mon/pcs) ----
+    let mut current_group: Option<String> = None;
+    let mut current_clone: Option<String> = None;
+    let mut in_pcs_resources = false;
+    let mut in_pcs_constraints = false;
+
+    let pcs_section_other_re = Regex::new(
+        r"^(Stonith Devices|Location Constraints|Ordering Constraints|Colocation Constraints|Ticket Constraints|Fencing Levels|Node Attributes|Migration Summary|Tickets|PCSD Status|Daemon Status):",
+    )
+    .unwrap();
+    let pcs_resource_re =
+        Regex::new(r"^Resource:\s+(\S+)\s+\(class=(\S+)(?:\s+provider=(\S+))?\s+type=([^)]+)\)")
+            .unwrap();
+    let pcs_group_re = crate::cached_regex!(r"^Group:\s+(\S+)");
+    let pcs_clone_re = crate::cached_regex!(r"^Clone:\s+(\S+)");
+    let pcs_status_marker_re =
+        crate::cached_regex!(r"^\*\s+\S+\s+\([\w:]+\):\s+(Started|Stopped|Master|Slave)");
+    let pcs_status_re = crate::cached_regex!(r"^\*\s+(\S+)\s+\(([\w:]+)\):\s+(\w+)(?:\s+(\S+))?");
+    let pcs_order_re =
+        Regex::new(r"^(\w+)\s+(\S+)\s+then\s+(\w+)\s+(\S+)\s+\(kind:(\w+)\)(?:\s+\(id:([^)]+)\))?")
+            .unwrap();
+    let pcs_coloc_re = crate::cached_regex!(r"^(\S+)\s+with\s+(\S+)\s+\(score:(\S+)\)");
+    let clone_set_re = Regex::new(
+        r"(?i)^\*?\s*(?:Clone Set|Master/Slave Set|Primary/Secondary Set):\s+(\S+)\s+\[(\S+)\](?:\s+\(([^)]+)\))?",
+    )
+    .unwrap();
+    let resource_group_re =
+        crate::cached_regex!(r"(?i)^\*?\s*Resource Group:\s+(\S+):?\s*(?:\(([^)]+)\))?");
+    let standalone_re = crate::cached_regex!(r"^\*\s+\S+");
+    let exclude_set_re = crate::cached_regex!(r"(?i)Resource Group|Clone Set|Master/Slave Set");
+    let crm_primitive_re = crate::cached_regex!(r"^primitive\s+(\S+)\s+(\S+):(\S+):(\S+)");
+    let mon_re = Regex::new(
+        r"^\*?\s*(\S+)\s+\((\S+)::(\S+):(\S+)\):\s+(\w+)(?:\s+(\S+))?(?:\s+\(([^)]+)\))?",
+    )
+    .unwrap();
+    let stonith_mon_re = Regex::new(
+        r"^\*?\s*(\S+)\s+\((\S+):(\S+)/(\S+)\):\s+(\w+)(?:\s+(\S+))?(?:\s+\(([^)]+)\))?",
+    )
+    .unwrap();
+    let status_alt_re = crate::cached_regex!(r"^(\S+)\s+\((\S+):(\S+):(\S+)\):\s+(\w+)\s+(\S+)");
+
+    for line in &content_lines {
+        let trimmed = line.trim();
+
+        if trimmed == "Resources:" || trimmed == "Full List of Resources:" {
+            in_pcs_resources = true;
+            in_pcs_constraints = false;
+            continue;
+        }
+        if pcs_section_other_re.is_match(trimmed) {
+            in_pcs_resources = false;
+            if trimmed.contains("Constraints:") {
+                in_pcs_constraints = true;
+            }
+            continue;
+        }
+
+        // pcs_config Resource:
+        if in_pcs_resources {
+            if let Some(c) = pcs_resource_re.captures(trimmed) {
+                let name = c.get(1).unwrap().as_str().to_string();
+                let cls = c.get(2).unwrap().as_str().to_string();
+                let provider = c
+                    .get(3)
+                    .map(|m| m.as_str().to_string())
+                    .unwrap_or_else(|| "heartbeat".to_string());
+                let kind = c.get(4).unwrap().as_str().to_string();
+                resources.push(PacemakerResource {
+                    name: name.clone(),
+                    kind,
+                    provider,
+                    class_field: cls,
+                    format: "pcs_config".to_string(),
+                    node: None,
+                    status: None,
+                    maintenance: false,
+                    group_member: current_group.is_some(),
+                    group_name: current_group.clone(),
+                    clone_member: current_clone.is_some(),
+                    clone_name: current_clone.clone(),
+                    location_score: None,
+                });
+                if let Some(gn) = &current_group {
+                    if let Some(g) = group_data.iter_mut().find(|g| &g.name == gn) {
+                        if !g.members.iter().any(|m| m == &name) {
+                            g.members.push(name.clone());
+                        }
+                    }
+                } else if let Some(cn) = &current_clone {
+                    if let Some(g) = group_data.iter_mut().find(|g| &g.name == cn) {
+                        if !g.members.iter().any(|m| m == &name) {
+                            g.members.push(name.clone());
+                        }
+                    }
+                }
+                continue;
+            }
+            if let Some(c) = pcs_group_re.captures(trimmed) {
+                let group_name = c.get(1).unwrap().as_str().to_string();
+                current_group = Some(group_name.clone());
+                current_clone = None;
+                if !group_data.iter().any(|g| g.name == group_name) {
+                    group_data.push(ResourceGroup {
+                        name: group_name,
+                        kind: "group".to_string(),
+                        members: Vec::new(),
+                        node: None,
+                        status: None,
+                        maintenance: false,
+                    });
+                }
+                continue;
+            }
+            if let Some(c) = pcs_clone_re.captures(trimmed) {
+                let clone_name = c.get(1).unwrap().as_str().to_string();
+                current_clone = Some(clone_name.clone());
+                current_group = None;
+                if !group_data.iter().any(|g| g.name == clone_name) {
+                    group_data.push(ResourceGroup {
+                        name: clone_name,
+                        kind: "clone".to_string(),
+                        members: Vec::new(),
+                        node: None,
+                        status: None,
+                        maintenance: false,
+                    });
+                }
+                continue;
+            }
+        }
+
+        // pcs_status format
+        if pcs_status_marker_re.is_match(trimmed) {
+            if let Some(c) = pcs_status_re.captures(trimmed) {
+                let name = c.get(1).unwrap().as_str().to_string();
+                let type_string = c.get(2).unwrap().as_str().to_string();
+                let status = c.get(3).unwrap().as_str().to_string();
+                let node = c.get(4).map(|m| m.as_str().to_string());
+
+                let (cls, provider, kind) = if type_string.contains("::") {
+                    let parts: Vec<&str> = type_string.splitn(3, ':').collect();
+                    let cls = parts.first().copied().unwrap_or("").to_string();
+                    let provider = parts.get(1).copied().unwrap_or("").replace(":", "");
+                    let kind = parts.get(2).copied().unwrap_or("").to_string();
+                    (cls, provider, kind)
+                } else if type_string.contains(':') {
+                    let mut sp = type_string.splitn(2, ':');
+                    let cls = sp.next().unwrap_or("").to_string();
+                    let kind = sp.next().unwrap_or("").to_string();
+                    (cls, "heartbeat".to_string(), kind)
+                } else {
+                    (
+                        "ocf".to_string(),
+                        "heartbeat".to_string(),
+                        type_string.clone(),
+                    )
+                };
+
+                if let Some(existing) = resources.iter_mut().find(|r| r.name == name) {
+                    existing.node = node.clone();
+                    existing.status = Some(status);
+                } else {
+                    resources.push(PacemakerResource {
+                        name,
+                        kind,
+                        provider,
+                        class_field: cls,
+                        format: "pcs_status".to_string(),
+                        node,
+                        status: Some(status),
+                        maintenance: false,
+                        group_member: current_group.is_some(),
+                        group_name: current_group.clone(),
+                        clone_member: false,
+                        clone_name: None,
+                        location_score: None,
+                    });
+                }
+                continue;
+            }
+        }
+
+        // pcs constraints
+        if in_pcs_constraints {
+            if let Some(c) = pcs_order_re.captures(trimmed) {
+                let first_action = c.get(1).unwrap().as_str().to_string();
+                let first_resource = c.get(2).unwrap().as_str().to_string();
+                let then_action = c.get(3).unwrap().as_str().to_string();
+                let then_resource = c.get(4).unwrap().as_str().to_string();
+                let kind = c.get(5).unwrap().as_str().to_string();
+                let id = c
+                    .get(6)
+                    .map(|m| m.as_str().to_string())
+                    .unwrap_or_else(|| format!("order-{}-{}", first_resource, then_resource));
+                constraints.push(PacemakerConstraint {
+                    id,
+                    kind: "order".to_string(),
+                    first_resource: Some(first_resource),
+                    first_action: Some(first_action),
+                    then_resource: Some(then_resource),
+                    then_action: Some(then_action),
+                    kind_field: Some(kind),
+                    ..Default::default()
+                });
+                continue;
+            }
+            if let Some(c) = pcs_coloc_re.captures(trimmed) {
+                let resource = c.get(1).unwrap().as_str().to_string();
+                let with_resource = c.get(2).unwrap().as_str().to_string();
+                let score = c.get(3).unwrap().as_str().to_string();
+                constraints.push(PacemakerConstraint {
+                    id: format!("colocation-{}-{}", resource, with_resource),
+                    kind: "colocation".to_string(),
+                    resource: Some(resource),
+                    with_resource: Some(with_resource),
+                    score: Some(score),
+                    ..Default::default()
+                });
+                continue;
+            }
+        }
+
+        // Clone Set / Master/Slave / Primary/Secondary
+        if let Some(c) = clone_set_re.captures(trimmed) {
+            let clone_name = c.get(1).unwrap().as_str().to_string();
+            let attributes = c.get(3).map(|m| m.as_str()).unwrap_or("");
+            let is_maintenance = attributes.contains("maintenance");
+            current_clone = Some(clone_name.clone());
+            if !group_data.iter().any(|g| g.name == clone_name) {
+                let kind = if trimmed.to_lowercase().contains("master") {
+                    "master-slave"
+                } else {
+                    "clone"
+                };
+                group_data.push(ResourceGroup {
+                    name: clone_name,
+                    kind: kind.to_string(),
+                    members: Vec::new(),
+                    node: None,
+                    status: if is_maintenance {
+                        Some("maintenance".to_string())
+                    } else {
+                        None
+                    },
+                    maintenance: is_maintenance,
+                });
+            }
+            continue;
+        }
+
+        // Resource Group
+        if let Some(c) = resource_group_re.captures(trimmed) {
+            let group_name = c.get(1).unwrap().as_str().trim_end_matches(':').to_string();
+            let attributes = c.get(2).map(|m| m.as_str()).unwrap_or("");
+            let is_maintenance = attributes.contains("maintenance");
+            current_group = Some(group_name.clone());
+            current_clone = None;
+            if !group_data.iter().any(|g| g.name == group_name) {
+                group_data.push(ResourceGroup {
+                    name: group_name,
+                    kind: "group".to_string(),
+                    members: Vec::new(),
+                    node: None,
+                    status: if is_maintenance {
+                        Some("maintenance".to_string())
+                    } else {
+                        None
+                    },
+                    maintenance: is_maintenance,
+                });
+            }
+            continue;
+        }
+
+        // Reset on top-level standalone
+        if standalone_re.is_match(trimmed) && !exclude_set_re.is_match(trimmed) {
+            // Top-level lines have less than 2 leading spaces
+            if !line.starts_with("  ") {
+                current_group = None;
+                current_clone = None;
+            }
+        }
+
+        // crm primitive
+        if let Some(c) = crm_primitive_re.captures(trimmed) {
+            let name = c.get(1).unwrap().as_str().to_string();
+            let cls = c.get(2).unwrap().as_str().to_string();
+            let provider = c.get(3).unwrap().as_str().to_string();
+            let kind = c.get(4).unwrap().as_str().to_string();
+            resources.push(PacemakerResource {
+                name,
+                kind,
+                provider,
+                class_field: cls,
+                format: "crm".to_string(),
+                node: None,
+                status: None,
+                maintenance: false,
+                group_member: false,
+                group_name: None,
+                clone_member: false,
+                clone_name: None,
+                location_score: None,
+            });
+            continue;
+        }
+
+        // crm_mon
+        if let Some(c) = mon_re.captures(trimmed) {
+            let name = c.get(1).unwrap().as_str().to_string();
+            let cls = c.get(2).unwrap().as_str().to_string();
+            let provider = c.get(3).unwrap().as_str().to_string();
+            let kind = c.get(4).unwrap().as_str().to_string();
+            let status = c.get(5).unwrap().as_str().to_string();
+            let node = c.get(6).map(|m| m.as_str().to_string());
+            let attributes = c.get(7).map(|m| m.as_str()).unwrap_or("");
+            let is_maintenance = attributes.contains("maintenance");
+
+            if let Some(existing) = resources.iter_mut().find(|r| r.name == name) {
+                existing.node = node.clone();
+                existing.status = Some(status);
+                existing.maintenance = is_maintenance;
+                if let Some(gn) = &current_group {
+                    existing.group_member = true;
+                    existing.group_name = Some(gn.clone());
+                    if let Some(g) = group_data.iter_mut().find(|g| &g.name == gn) {
+                        if !g.members.iter().any(|m| m == &name) {
+                            g.members.push(name.clone());
+                            if g.node.is_none() {
+                                g.node = node.clone();
+                            }
+                        }
+                    }
+                } else if let Some(cn) = &current_clone {
+                    existing.clone_member = true;
+                    existing.clone_name = Some(cn.clone());
+                    if let Some(g) = group_data.iter_mut().find(|g| &g.name == cn) {
+                        if !g.members.iter().any(|m| m == &name) {
+                            g.members.push(name.clone());
+                        }
+                    }
+                }
+            } else {
+                let r = PacemakerResource {
+                    name: name.clone(),
+                    kind,
+                    provider,
+                    class_field: cls,
+                    format: "crm_mon".to_string(),
+                    node: node.clone(),
+                    status: Some(status),
+                    maintenance: is_maintenance,
+                    group_member: current_group.is_some(),
+                    group_name: current_group.clone(),
+                    clone_member: current_clone.is_some(),
+                    clone_name: current_clone.clone(),
+                    location_score: None,
+                };
+                resources.push(r);
+                if let Some(gn) = &current_group {
+                    if let Some(g) = group_data.iter_mut().find(|g| &g.name == gn) {
+                        if !g.members.iter().any(|m| m == &name) {
+                            g.members.push(name.clone());
+                            if g.node.is_none() {
+                                g.node = node.clone();
+                            }
+                        }
+                    }
+                } else if let Some(cn) = &current_clone {
+                    if let Some(g) = group_data.iter_mut().find(|g| &g.name == cn) {
+                        if !g.members.iter().any(|m| m == &name) {
+                            g.members.push(name.clone());
+                        }
+                    }
+                }
+            }
+            continue;
+        }
+
+        // stonith mon (slash-separated agent)
+        if let Some(c) = stonith_mon_re.captures(trimmed) {
+            let name = c.get(1).unwrap().as_str().to_string();
+            let kind_class = c.get(2).unwrap().as_str().to_string();
+            let provider = c.get(3).unwrap().as_str().to_string();
+            let agent = c.get(4).unwrap().as_str().to_string();
+            let status = c.get(5).unwrap().as_str().to_string();
+            let node = c.get(6).map(|m| m.as_str().to_string());
+            let attributes = c.get(7).map(|m| m.as_str()).unwrap_or("");
+            let is_maintenance = attributes.contains("maintenance");
+
+            if let Some(existing) = resources.iter_mut().find(|r| r.name == name) {
+                existing.node = node.clone();
+                existing.status = Some(status);
+                existing.maintenance = is_maintenance;
+                if let Some(gn) = &current_group {
+                    existing.group_member = true;
+                    existing.group_name = Some(gn.clone());
+                    if let Some(g) = group_data.iter_mut().find(|g| &g.name == gn) {
+                        if !g.members.iter().any(|m| m == &name) {
+                            g.members.push(name.clone());
+                            if g.node.is_none() {
+                                g.node = node.clone();
+                            }
+                        }
+                    }
+                } else if let Some(cn) = &current_clone {
+                    existing.clone_member = true;
+                    existing.clone_name = Some(cn.clone());
+                    if let Some(g) = group_data.iter_mut().find(|g| &g.name == cn) {
+                        if !g.members.iter().any(|m| m == &name) {
+                            g.members.push(name.clone());
+                        }
+                    }
+                }
+            } else {
+                let r = PacemakerResource {
+                    name: name.clone(),
+                    kind: agent,
+                    provider,
+                    class_field: kind_class,
+                    format: "crm_mon_stonith".to_string(),
+                    node: node.clone(),
+                    status: Some(status),
+                    maintenance: is_maintenance,
+                    group_member: current_group.is_some(),
+                    group_name: current_group.clone(),
+                    clone_member: current_clone.is_some(),
+                    clone_name: current_clone.clone(),
+                    location_score: None,
+                };
+                resources.push(r);
+                if let Some(gn) = &current_group {
+                    if let Some(g) = group_data.iter_mut().find(|g| &g.name == gn) {
+                        if !g.members.iter().any(|m| m == &name) {
+                            g.members.push(name.clone());
+                            if g.node.is_none() {
+                                g.node = node.clone();
+                            }
+                        }
+                    }
+                } else if let Some(cn) = &current_clone {
+                    if let Some(g) = group_data.iter_mut().find(|g| &g.name == cn) {
+                        if !g.members.iter().any(|m| m == &name) {
+                            g.members.push(name.clone());
+                        }
+                    }
+                }
+            }
+            continue;
+        }
+
+        // alt status format
+        if let Some(c) = status_alt_re.captures(trimmed) {
+            let name = c.get(1).unwrap().as_str().to_string();
+            let cls = c.get(2).unwrap().as_str().to_string();
+            let provider = c.get(3).unwrap().as_str().to_string();
+            let kind = c.get(4).unwrap().as_str().to_string();
+            let status = c.get(5).unwrap().as_str().to_string();
+            let node = c.get(6).map(|m| m.as_str().to_string());
+            if let Some(existing) = resources.iter_mut().find(|r| r.name == name) {
+                existing.node = node;
+                existing.status = Some(status);
+            } else {
+                resources.push(PacemakerResource {
+                    name,
+                    kind,
+                    provider,
+                    class_field: cls,
+                    format: "status".to_string(),
+                    node,
+                    status: Some(status),
+                    maintenance: false,
+                    group_member: false,
+                    group_name: None,
+                    clone_member: false,
+                    clone_name: None,
+                    location_score: None,
+                });
+            }
+            continue;
+        }
+    }
+
+    if resources.is_empty() {
+        return PacemakerResourcesResult {
+            found: false,
+            ..Default::default()
+        };
+    }
+
+    // Failed Resource Actions
+    let mut failed_actions: Vec<FailedAction> = Vec::new();
+    let mut in_failed = false;
+    let next_section_re = crate::cached_regex!(r"^(Node Attributes|Migration Summary|Tickets):");
+    let fail_re = crate::cached_regex!(r"^\*\s+(\S+)\s+on\s+(\S+)\s+'([^']+)'\s+\((\d+)\):\s+(.+)");
+
+    for line in &content_lines {
+        let trimmed = line.trim();
+        if trimmed == "Failed Resource Actions:" || trimmed == "Failed Actions:" {
+            in_failed = true;
+            continue;
+        }
+        if in_failed {
+            if trimmed.is_empty()
+                || (trimmed
+                    .chars()
+                    .next()
+                    .map(|c| c.is_ascii_uppercase())
+                    .unwrap_or(false)
+                    && next_section_re.is_match(trimmed))
+            {
+                if next_section_re.is_match(trimmed) {
+                    in_failed = false;
+                }
+                continue;
+            }
+            if trimmed.starts_with('*') {
+                if let Some(c) = fail_re.captures(trimmed) {
+                    failed_actions.push(FailedAction {
+                        action: c.get(1).unwrap().as_str().to_string(),
+                        node: c.get(2).unwrap().as_str().to_string(),
+                        state: c.get(3).unwrap().as_str().to_string(),
+                        return_code: c.get(4).unwrap().as_str().to_string(),
+                        details: c.get(5).unwrap().as_str().to_string(),
+                    });
+                }
+            }
+        }
+    }
+
+    let count = resources.len();
+    let groups_count = group_data.len();
+    let constraints_count = constraints.len();
+    let failed_actions_count = failed_actions.len();
+    PacemakerResourcesResult {
+        found: true,
+        resources,
+        count,
+        groups: group_data,
+        groups_count,
+        constraints,
+        constraints_count,
+        failed_actions,
+        failed_actions_count,
+    }
+}
+
+// ============================================================================
+// JSON wrappers for the 5 XML parsers
+// ============================================================================
+
+pub fn parse_cluster_nodes_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_cluster_nodes(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_fencing_config_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_fencing_config(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_azure_scheduled_events_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_azure_scheduled_events(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_sap_instance_config_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_sap_instance_config(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_pacemaker_resources_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_pacemaker_resources(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const HIGH_CPU_PATH: &str = "var/log/pacemaker/pacemaker.log";
+    const STATUS_PATH: &str = "sos_commands/pacemaker/crm_mon_-1";
+    const COROSYNC_PATH: &str = "etc/corosync/corosync.conf";
+    const EVENTS_PATH: &str = "var/log/messages";
+    const CIB_PATH: &str = "var/lib/pacemaker/cib/cib.xml";
+
+    #[test]
+    fn detects_high_cpu_event() {
+        let input = "Jan 10 12:23:45 node01 pacemaker-controld[2404]: notice: High CPU load detected: 23.270000\n";
+        let result = parse_pacemaker_high_cpu(input, HIGH_CPU_PATH);
+
+        assert_eq!(result.len(), 1);
+        assert_eq!(result[0].source_node, "node01");
+        assert!((result[0].cpu_load - 23.27).abs() < 0.0001);
+    }
+
+    #[test]
+    fn high_cpu_records_carry_source_provenance() {
+        let input = concat!(
+            "Jan 10 12:23:45 node01 pacemaker-controld[2404]: notice: High CPU load detected: 23.27\n",
+            "Jan 10 12:23:46 node01 pacemaker-controld[2404]: notice: High CPU load detected: 25.10\n",
+        );
+        let result = parse_pacemaker_high_cpu(input, HIGH_CPU_PATH);
+        assert_eq!(result.len(), 2);
+        assert_eq!(result[0].source_path, HIGH_CPU_PATH);
+        assert_eq!(result[0].source_line, Some(1));
+        assert_eq!(result[1].source_line, Some(2));
+    }
+
+    #[test]
+    fn parses_cluster_status_from_text() {
+        let input = "Cluster name: hacluster\nCurrent DC: node1\n2 nodes configured\n5 resource instances configured\nOnline: [ node1 ]\nOffline: [ node2 ]\n";
+        let result = parse_cluster_status(input, STATUS_PATH);
+
+        assert!(result.found);
+        assert_eq!(result.cluster_name.as_deref(), Some("hacluster"));
+        assert_eq!(result.dc_node.as_deref(), Some("node1"));
+        assert_eq!(result.nodes_configured, Some(2));
+        assert_eq!(result.resources_configured, Some(5));
+        assert_eq!(result.node_statuses.len(), 2);
+    }
+
+    #[test]
+    fn cluster_status_records_carry_source_provenance() {
+        let input =
+            "Cluster name: hacluster\nCurrent DC: node1\nOnline: [ node1 ]\nOffline: [ node2 ]\n";
+        let result = parse_cluster_status(input, STATUS_PATH);
+        assert_eq!(result.source_path, STATUS_PATH);
+        for n in &result.node_statuses {
+            assert_eq!(n.source_path, STATUS_PATH);
+            assert!(n.source_line.is_some());
+        }
+        // node1 came from line 3 (Online), node2 from line 4 (Offline)
+        let n1 = result
+            .node_statuses
+            .iter()
+            .find(|n| n.name == "node1")
+            .unwrap();
+        let n2 = result
+            .node_statuses
+            .iter()
+            .find(|n| n.name == "node2")
+            .unwrap();
+        assert_eq!(n1.source_line, Some(3));
+        assert_eq!(n2.source_line, Some(4));
+    }
+
+    #[test]
+    fn parses_corosync_config_and_warnings() {
+        let input = "totem {\n  token: 10000\n  token_retransmits_before_loss_const: 5\n  join: 30\n  consensus: 12000\n  max_messages: 17\n  transport: udp\n}\nquorum {\n  provider: corosync_bad\n  expected_votes: 3\n  two_node: 0\n}\n";
+        let result = parse_corosync_config(input, COROSYNC_PATH);
+
+        assert!(result.found);
+        assert_eq!(result.totem_token, Some(10000));
+        assert_eq!(result.quorum_provider.as_deref(), Some("corosync_bad"));
+        assert!(!result.warnings.is_empty());
+    }
+
+    #[test]
+    fn corosync_warnings_carry_source_provenance() {
+        let input = "totem {\n  token: 10000\n  token_retransmits_before_loss_const: 5\n  join: 30\n  consensus: 12000\n  max_messages: 17\n  transport: udp\n}\nquorum {\n  provider: corosync_bad\n  expected_votes: 3\n  two_node: 0\n}\n";
+        let result = parse_corosync_config(input, COROSYNC_PATH);
+        assert_eq!(result.source_path, COROSYNC_PATH);
+        for w in &result.warnings {
+            assert_eq!(w.source_path, COROSYNC_PATH);
+            assert!(
+                w.source_line.is_some(),
+                "warning missing source_line: {:?}",
+                w
+            );
+        }
+        // The token warning must point at line 2 where `token: 10000` lives.
+        let token_warn = result
+            .warnings
+            .iter()
+            .find(|w| w.parameter.as_deref() == Some("totem.token"))
+            .expect("token warning");
+        assert_eq!(token_warn.source_line, Some(2));
+        let provider_warn = result
+            .warnings
+            .iter()
+            .find(|w| w.parameter.as_deref() == Some("quorum.provider"))
+            .expect("provider warning");
+        assert_eq!(provider_warn.source_line, Some(10));
+    }
+
+    #[test]
+    fn parses_cluster_events_and_fencing() {
+        let input = concat!(
+            "Jan 10 12:23:45 node01 pacemaker-controld[2404]: notice: High CPU load detected: 23.270000\n",
+            "Jan 10 12:24:00 node01 pacemaker-controld[2404]: notice: Moving resource vip from node01 to node02\n",
+            "Jan 10 12:24:30 node01 pacemaker-fenced[1111]: notice: Requesting fencing (reboot) of node node02\n"
+        );
+        let result = parse_cluster_events(input, EVENTS_PATH);
+
+        assert!(result.found);
+        assert_eq!(result.resource_migrations.len(), 2);
+        assert_eq!(result.fencing_events.len(), 1);
+        assert_eq!(result.total_events, 3);
+    }
+
+    #[test]
+    fn cluster_events_records_carry_source_provenance() {
+        let input = concat!(
+            "Jan 10 12:23:45 node01 pacemaker-controld[2404]: notice: High CPU load detected: 23.27\n",
+            "Jan 10 12:24:00 node01 pacemaker-controld[2404]: notice: Moving resource vip from node01 to node02\n",
+            "Jan 10 12:24:30 node01 pacemaker-fenced[1111]: notice: Requesting fencing (reboot) of node node02\n"
+        );
+        let result = parse_cluster_events(input, EVENTS_PATH);
+        assert_eq!(result.source_path, EVENTS_PATH);
+        assert_eq!(result.resource_migrations[0].source_line, Some(1));
+        assert_eq!(result.resource_migrations[1].source_line, Some(2));
+        assert_eq!(result.fencing_events[0].source_line, Some(3));
+        for e in &result.resource_migrations {
+            assert_eq!(e.source_path, EVENTS_PATH);
+        }
+        for e in &result.fencing_events {
+            assert_eq!(e.source_path, EVENTS_PATH);
+        }
+    }
+
+    #[test]
+    fn detects_cluster_maintenance_mode() {
+        let input = concat!(
+            "<nvpair name=\"maintenance-mode\" value=\"true\"/>\n",
+            "Resource: vip_dummy (maintenance)\n"
+        );
+        let result = parse_cluster_maintenance_mode(input, CIB_PATH);
+
+        assert!(result.found);
+        assert_eq!(result.maintenance_mode, Some(true));
+        assert_eq!(
+            result.resources_in_maintenance,
+            vec!["vip_dummy".to_string()]
+        );
+        assert!(!result.warnings.is_empty());
+    }
+
+    #[test]
+    fn cluster_maintenance_warnings_carry_source_provenance() {
+        let input = concat!(
+            "<nvpair name=\"maintenance-mode\" value=\"true\"/>\n",
+            "Resource: vip_dummy (maintenance)\n"
+        );
+        let result = parse_cluster_maintenance_mode(input, CIB_PATH);
+        assert_eq!(result.source_path, CIB_PATH);
+        for w in &result.warnings {
+            assert_eq!(w.source_path, CIB_PATH);
+            assert!(
+                w.source_line.is_some(),
+                "warning missing source_line: {:?}",
+                w
+            );
+        }
+        let cluster_warn = result
+            .warnings
+            .iter()
+            .find(|w| w.kind == "cluster_in_maintenance")
+            .expect("cluster warn");
+        assert_eq!(cluster_warn.source_line, Some(1));
+        let res_warn = result
+            .warnings
+            .iter()
+            .find(|w| w.kind == "resources_in_maintenance")
+            .expect("res warn");
+        assert_eq!(res_warn.source_line, Some(2));
+    }
+
+    #[test]
+    fn cluster_json_wrappers_include_source_path() {
+        let json = parse_corosync_config_json("totem {\n  token: 10000\n}\n", COROSYNC_PATH);
+        assert!(json.contains("\"source_path\":\"etc/corosync/corosync.conf\""));
+    }
+}
diff --git a/rca-tool/lib/supportfile_core/src/parsers/debugfs.rs b/rca-tool/lib/supportfile_core/src/parsers/debugfs.rs
new file mode 100644
index 0000000..f990a82
--- /dev/null
+++ b/rca-tool/lib/supportfile_core/src/parsers/debugfs.rs
@@ -0,0 +1,324 @@
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct HvBalloonResult {
+    pub found: bool,
+    pub host_version: Option<String>,
+    pub capabilities: Option<String>,
+    pub state: Option<i64>,
+    pub state_text: Option<String>,
+    pub page_size: i64,
+    pub pages_added: i64,
+    pub pages_onlined: i64,
+    pub pages_ballooned: i64,
+    pub total_pages_committed: i64,
+    pub max_dynamic_page_count: i64,
+    pub committed_memory_gb: f64,
+    pub max_dynamic_memory_gb: f64,
+    pub ballooned_memory_mb: f64,
+    pub warnings: Vec<String>,
+    pub raw_content: String,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct ExtfragZone {
+    pub node: i64,
+    pub zone: String,
+    pub extfrag_index: Vec<f64>,
+    pub unusable_index: Vec<f64>,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct ExtfragResult {
+    pub found: bool,
+    pub zones: Vec<ExtfragZone>,
+    pub warnings: Vec<String>,
+    pub raw_content: String,
+    pub source_path: String,
+}
+
+pub fn parse_hv_balloon(content: &str, source_path: &str) -> HvBalloonResult {
+    let mut result = HvBalloonResult {
+        found: false,
+        host_version: None,
+        capabilities: None,
+        state: None,
+        state_text: None,
+        page_size: 4096,
+        pages_added: 0,
+        pages_onlined: 0,
+        pages_ballooned: 0,
+        total_pages_committed: 0,
+        max_dynamic_page_count: 0,
+        committed_memory_gb: 0.0,
+        max_dynamic_memory_gb: 0.0,
+        ballooned_memory_mb: 0.0,
+        warnings: Vec::new(),
+        raw_content: String::new(),
+        source_path: source_path.to_string(),
+    };
+
+    if content.trim().is_empty() {
+        return result;
+    }
+
+    result.raw_content = content.trim().to_string();
+    let pair_re = crate::cached_regex!(r"^(\S+(?:\s+\S+)*?)\s*:\s*(.+)$");
+
+    for line in content.lines() {
+        if let Some(caps) = pair_re.captures(line) {
+            let key = caps
+                .get(1)
+                .map(|m| {
+                    m.as_str()
+                        .trim()
+                        .to_ascii_lowercase()
+                        .replace([' ', '-'], "_")
+                })
+                .unwrap_or_default();
+            let value = caps.get(2).map(|m| m.as_str().trim()).unwrap_or_default();
+
+            match key.as_str() {
+                "host_version" => {
+                    result.host_version = Some(value.to_string());
+                    result.found = true;
+                }
+                "capabilities" => result.capabilities = Some(value.to_string()),
+                "state" => {
+                    if let Some(state_caps) = crate::cached_regex!(r"^(\d+)").captures(value) {
+                        result.state = state_caps
+                            .get(1)
+                            .and_then(|m| m.as_str().parse::<i64>().ok());
+                    }
+                    result.state_text = crate::cached_regex!(r"\(([^)]+)\)")
+                        .captures(value)
+                        .and_then(|c| c.get(1).map(|m| m.as_str().to_string()))
+                        .or_else(|| match result.state {
+                            Some(0) => Some("Not configured".to_string()),
+                            Some(1) => Some("Initialized".to_string()),
+                            Some(2) => Some("Ready".to_string()),
+                            Some(3) => Some("Operating".to_string()),
+                            Some(4) => Some("Degraded".to_string()),
+                            _ => Some("Unknown".to_string()),
+                        });
+                }
+                "page_size" => result.page_size = value.parse::<i64>().unwrap_or(4096),
+                "pages_added" => result.pages_added = value.parse::<i64>().unwrap_or(0),
+                "pages_onlined" => result.pages_onlined = value.parse::<i64>().unwrap_or(0),
+                "pages_ballooned" => result.pages_ballooned = value.parse::<i64>().unwrap_or(0),
+                "total_pages_committed" => {
+                    result.total_pages_committed = value.parse::<i64>().unwrap_or(0)
+                }
+                "max_dynamic_page_count" => {
+                    result.max_dynamic_page_count = value.parse::<i64>().unwrap_or(0)
+                }
+                _ => {}
+            }
+        }
+    }
+
+    if !result.found {
+        return result;
+    }
+
+    let bytes_per_gb = 1024_f64 * 1024_f64 * 1024_f64;
+    let bytes_per_mb = 1024_f64 * 1024_f64;
+    result.committed_memory_gb =
+        ((result.total_pages_committed as f64 * result.page_size as f64) / bytes_per_gb * 100.0)
+            .round()
+            / 100.0;
+    result.max_dynamic_memory_gb =
+        ((result.max_dynamic_page_count as f64 * result.page_size as f64) / bytes_per_gb * 100.0)
+            .round()
+            / 100.0;
+    result.ballooned_memory_mb =
+        ((result.pages_ballooned as f64 * result.page_size as f64) / bytes_per_mb * 100.0).round()
+            / 100.0;
+
+    if result.pages_ballooned > 0 {
+        result.warnings.push(format!(
+            "Ballooning active: host is reclaiming {} MB from the guest. This can cause memory pressure and allocation failures.",
+            result.ballooned_memory_mb
+        ));
+    }
+
+    if result.max_dynamic_page_count > 0 && result.total_pages_committed > 0 {
+        let usage_ratio =
+            result.total_pages_committed as f64 / result.max_dynamic_page_count as f64;
+        if usage_ratio > 0.9 {
+            result.warnings.push(format!(
+                "Memory near capacity: {} GB committed of {} GB maximum ({}%).",
+                result.committed_memory_gb,
+                result.max_dynamic_memory_gb,
+                (usage_ratio * 100.0).round() as i64
+            ));
+        }
+    }
+
+    result
+}
+
+pub fn parse_extfrag(content: &str, source_path: &str) -> ExtfragResult {
+    let mut result = ExtfragResult {
+        found: false,
+        zones: Vec::new(),
+        warnings: Vec::new(),
+        raw_content: content.trim().to_string(),
+        source_path: source_path.to_string(),
+    };
+
+    if content.trim().is_empty() {
+        return result;
+    }
+
+    let line_re = crate::cached_regex!(r"^Node\s+(\d+),\s+zone\s+(\S+)\s+(.+)$");
+    let mut current_field = if content.contains("unusable_index") {
+        "unusable"
+    } else {
+        "extfrag"
+    };
+
+    for (line_idx, line) in content.lines().enumerate() {
+        let line_no = line_idx + 1;
+        let trimmed = line.trim();
+        if trimmed.starts_with("===") {
+            let lower = trimmed.to_ascii_lowercase();
+            if lower.contains("extfrag_index") {
+                current_field = "extfrag";
+            } else if lower.contains("unusable_index") {
+                current_field = "unusable";
+            }
+            continue;
+        }
+
+        if let Some(caps) = line_re.captures(trimmed) {
+            let node = caps
+                .get(1)
+                .and_then(|m| m.as_str().parse::<i64>().ok())
+                .unwrap_or(0);
+            let zone_name = caps
+                .get(2)
+                .map(|m| m.as_str().to_string())
+                .unwrap_or_default();
+            let values = caps
+                .get(3)
+                .map(|m| {
+                    m.as_str()
+                        .split_whitespace()
+                        .filter_map(|v| v.parse::<f64>().ok())
+                        .collect::<Vec<_>>()
+                })
+                .unwrap_or_default();
+
+            let idx = result
+                .zones
+                .iter()
+                .position(|z| z.node == node && z.zone == zone_name)
+                .unwrap_or_else(|| {
+                    result.zones.push(ExtfragZone {
+                        node,
+                        zone: zone_name.clone(),
+                        extfrag_index: Vec::new(),
+                        unusable_index: Vec::new(),
+                        source_path: source_path.to_string(),
+                        source_line: Some(line_no),
+                    });
+                    result.zones.len() - 1
+                });
+
+            if current_field == "extfrag" {
+                result.zones[idx].extfrag_index = values;
+            } else {
+                result.zones[idx].unusable_index = values;
+            }
+            result.found = true;
+        }
+    }
+
+    let order_labels = [
+        "4K", "8K", "16K", "32K", "64K", "128K", "256K", "512K", "1M", "2M", "4M",
+    ];
+    for zone in &result.zones {
+        for ord in 9..zone.unusable_index.len() {
+            let val = zone.unusable_index[ord];
+            if val > 0.5 {
+                let severity = if val > 0.8 { "Severe" } else { "Moderate" };
+                let label = order_labels.get(ord).copied().unwrap_or("high order");
+                result.warnings.push(format!(
+                    "{} fragmentation on Node {} zone {} at {} (order {}): unusable index {:.3}. Huge page allocations may fail.",
+                    severity, zone.node, zone.zone, label, ord, val
+                ));
+            }
+        }
+        for ord in 9..zone.extfrag_index.len() {
+            let val = zone.extfrag_index[ord];
+            if val > 0.7 && val <= 1.0 {
+                let label = order_labels.get(ord).copied().unwrap_or("high order");
+                result.warnings.push(format!(
+                    "High external fragmentation on Node {} zone {} at {} (order {}): extfrag index {:.3}. Memory compaction may help.",
+                    zone.node, zone.zone, label, ord, val
+                ));
+            }
+        }
+    }
+
+    result
+}
+
+pub fn parse_hv_balloon_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_hv_balloon(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_extfrag_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_extfrag(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parses_hv_balloon_and_warnings() {
+        let input = concat!(
+            "host version : 6.3\n",
+            "state : 3 (Operating)\n",
+            "page_size : 4096\n",
+            "pages_ballooned : 1024\n",
+            "total_pages_committed : 950000\n",
+            "max_dynamic_page_count : 1000000\n"
+        );
+        let result = parse_hv_balloon(input, "sys/kernel/debug/hv-balloon");
+        assert!(result.found);
+        assert_eq!(result.state, Some(3));
+        assert_eq!(result.source_path, "sys/kernel/debug/hv-balloon");
+        assert!(result.warnings.len() >= 2);
+    }
+
+    #[test]
+    fn parses_extfrag_and_unusable_sections() {
+        let input = concat!(
+            "=== extfrag_index ===\n",
+            "Node 0, zone Normal 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.91 0.85\n",
+            "=== unusable_index ===\n",
+            "Node 0, zone Normal 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.92 0.81\n"
+        );
+        let result = parse_extfrag(input, "sys/kernel/debug/extfrag/extfrag_index");
+        assert!(result.found);
+        assert_eq!(result.zones.len(), 1);
+        assert_eq!(
+            result.zones[0].source_path,
+            "sys/kernel/debug/extfrag/extfrag_index"
+        );
+        assert_eq!(result.zones[0].source_line, Some(2));
+        assert!(!result.warnings.is_empty());
+    }
+}
diff --git a/rca-tool/lib/supportfile_core/src/parsers/events.rs b/rca-tool/lib/supportfile_core/src/parsers/events.rs
new file mode 100644
index 0000000..70b53f7
--- /dev/null
+++ b/rca-tool/lib/supportfile_core/src/parsers/events.rs
@@ -0,0 +1,504 @@
+use regex::Regex;
+use serde::{Deserialize, Serialize};
+use std::sync::OnceLock;
+
+fn extract_timestamp(line: &str) -> Option<String> {
+    static ISO_RE: OnceLock<Regex> = OnceLock::new();
+    static SYSLOG_RE: OnceLock<Regex> = OnceLock::new();
+    let iso_re = ISO_RE.get_or_init(|| {
+        Regex::new(r"^(\d{4}-\d{2}-\d{2}[T\s]\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:[+-]\d{2}:\d{2})?)")
+            .unwrap()
+    });
+    let syslog_re = SYSLOG_RE.get_or_init(|| {
+        Regex::new(r"^(\w{3})\s+(\d{1,2})\s+(\d{2}:\d{2}:\d{2}(?:\.\d+)?)").unwrap()
+    });
+    if let Some(c) = iso_re.captures(line) {
+        return c.get(1).map(|m| m.as_str().to_string());
+    }
+    // Normalise classic syslog timestamp so single-digit day numbers are zero
+    // padded ("Dec  2 ..." -> "Dec 02 ..."), matching the legacy JS parser
+    // behaviour required for cross-file deduplication.
+    syslog_re.captures(line).map(|c| {
+        let month = c.get(1).map(|m| m.as_str()).unwrap_or("");
+        let day = c.get(2).map(|m| m.as_str()).unwrap_or("");
+        let time = c.get(3).map(|m| m.as_str()).unwrap_or("");
+        format!("{} {:0>2} {}", month, day, time)
+    })
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct SimpleEvent {
+    pub timestamp: String,
+    pub line_number: usize,
+    pub raw_line: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct EmergencyModeResult {
+    pub found: bool,
+    pub count: usize,
+    pub events: Vec<SimpleEvent>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct KernelRebootEvent {
+    pub timestamp: String,
+    pub line_number: usize,
+    pub kernel_version: Option<String>,
+    pub event_type: String,
+    pub raw_line: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct KernelRebootsResult {
+    pub count: usize,
+    pub events: Vec<KernelRebootEvent>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct OomEvent {
+    pub timestamp: String,
+    pub line_number: usize,
+    pub pid: Option<String>,
+    pub process_name: Option<String>,
+    pub score: Option<String>,
+    pub total_vm: Option<String>,
+    pub invoked_by: Option<String>,
+    pub order: Option<String>,
+    pub event_type: String,
+    pub raw_line: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct OomKillerResult {
+    pub count: usize,
+    pub events: Vec<OomEvent>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct XfsErrorEvent {
+    pub timestamp: String,
+    pub line_number: usize,
+    pub device: String,
+    pub message: String,
+    pub raw_line: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct XfsErrorsResult {
+    pub count: usize,
+    pub events: Vec<XfsErrorEvent>,
+    pub source_path: String,
+}
+
+pub fn parse_emergency_mode(content: &str, source_path: &str) -> EmergencyModeResult {
+    static EMERGENCY_RE: OnceLock<Regex> = OnceLock::new();
+    let emergency_re =
+        EMERGENCY_RE.get_or_init(|| Regex::new(r"(?i)You are in emergency mode").unwrap());
+    let mut events = Vec::new();
+    for (i, line) in content.lines().enumerate() {
+        if !line.contains("emergency mode") {
+            continue;
+        }
+        if emergency_re.is_match(line) {
+            let line_no = i + 1;
+            events.push(SimpleEvent {
+                timestamp: extract_timestamp(line)
+                    .unwrap_or_else(|| "Date not detected".to_string()),
+                line_number: line_no,
+                raw_line: line.trim().to_string(),
+                source_path: source_path.to_string(),
+                source_line: Some(line_no),
+                source_line_end: Some(line_no),
+            });
+        }
+    }
+    EmergencyModeResult {
+        found: !events.is_empty(),
+        count: events.len(),
+        events,
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_kernel_reboots(content: &str, source_path: &str) -> KernelRebootsResult {
+    static KERNEL_RE: OnceLock<Regex> = OnceLock::new();
+    static SHUTDOWN_RE: OnceLock<Regex> = OnceLock::new();
+    static REBOOT_RE: OnceLock<Regex> = OnceLock::new();
+    let kernel_re = KERNEL_RE.get_or_init(|| {
+        Regex::new(r"(?i)(?:kernel:\s*)?(?:\[\s*[\d\.]+\]\s*(?:\[\s*T\d+\]\s*)?)?Linux version\s+([\d\.\-\w]+)").unwrap()
+    });
+    let shutdown_re = SHUTDOWN_RE.get_or_init(|| {
+        Regex::new(r"(?i)systemd.*Shutting down|systemd.*Starting Reboot|systemd.*Stopped target.*Shutdown").unwrap()
+    });
+    let reboot_re = REBOOT_RE.get_or_init(|| Regex::new(r"(?i)kernel:\s*reboot:").unwrap());
+
+    let mut events = Vec::new();
+    for (i, line) in content.lines().enumerate() {
+        if !(line.contains("Linux version")
+            || line.contains("hutting down")
+            || line.contains("tarting Reboot")
+            || line.contains("topped target")
+            || line.contains("reboot:"))
+        {
+            continue;
+        }
+        let line_no = i + 1;
+
+        if let Some(caps) = kernel_re.captures(line) {
+            events.push(KernelRebootEvent {
+                timestamp: extract_timestamp(line).unwrap_or_else(|| "Unknown".to_string()),
+                line_number: line_no,
+                kernel_version: caps.get(1).map(|m| m.as_str().to_string()),
+                event_type: "kernel_boot".to_string(),
+                raw_line: line.trim().to_string(),
+                source_path: source_path.to_string(),
+                source_line: Some(line_no),
+                source_line_end: Some(line_no),
+            });
+            continue;
+        }
+
+        if shutdown_re.is_match(line) {
+            let duplicate = events
+                .iter()
+                .any(|e| e.event_type == "systemd_shutdown" && e.line_number.abs_diff(line_no) < 5);
+            if !duplicate {
+                events.push(KernelRebootEvent {
+                    timestamp: extract_timestamp(line).unwrap_or_else(|| "Unknown".to_string()),
+                    line_number: line_no,
+                    kernel_version: None,
+                    event_type: "systemd_shutdown".to_string(),
+                    raw_line: line.trim().to_string(),
+                    source_path: source_path.to_string(),
+                    source_line: Some(line_no),
+                    source_line_end: Some(line_no),
+                });
+            }
+            continue;
+        }
+
+        if reboot_re.is_match(line) {
+            events.push(KernelRebootEvent {
+                timestamp: extract_timestamp(line).unwrap_or_else(|| "Unknown".to_string()),
+                line_number: line_no,
+                kernel_version: None,
+                event_type: "reboot_message".to_string(),
+                raw_line: line.trim().to_string(),
+                source_path: source_path.to_string(),
+                source_line: Some(line_no),
+                source_line_end: Some(line_no),
+            });
+        }
+    }
+    KernelRebootsResult {
+        count: events.len(),
+        events,
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_oom_killer(content: &str, source_path: &str) -> OomKillerResult {
+    static KILL_RE: OnceLock<Regex> = OnceLock::new();
+    static SCORE_RE: OnceLock<Regex> = OnceLock::new();
+    static VM_RE: OnceLock<Regex> = OnceLock::new();
+    static INVOKED_RE: OnceLock<Regex> = OnceLock::new();
+    static ORDER_RE: OnceLock<Regex> = OnceLock::new();
+    static PID_RE: OnceLock<Regex> = OnceLock::new();
+    static PROCESS_RE: OnceLock<Regex> = OnceLock::new();
+    static INVOKED_LINE_RE: OnceLock<Regex> = OnceLock::new();
+    static REAPER_LINE_RE: OnceLock<Regex> = OnceLock::new();
+    static ALLOC_RE: OnceLock<Regex> = OnceLock::new();
+    let kill_re = KILL_RE.get_or_init(|| {
+        Regex::new(r"(?i)Out of memory:.*Kill(?:ed)? process\s+(\d+)\s+\(([^)]+)\)").unwrap()
+    });
+    let score_re = SCORE_RE.get_or_init(|| Regex::new(r"(?i)score\s+(\d+)").unwrap());
+    let vm_re = VM_RE.get_or_init(|| Regex::new(r"(?i)total-vm:(\d+)kB").unwrap());
+    let invoked_re =
+        INVOKED_RE.get_or_init(|| Regex::new(r"(?i)\]\s+([^\s]+)\s+invoked oom-killer:").unwrap());
+    let order_re = ORDER_RE.get_or_init(|| Regex::new(r"(?i)order=(\d+)").unwrap());
+    let pid_re = PID_RE.get_or_init(|| Regex::new(r"(?i)reaped process\s+(\d+)").unwrap());
+    let process_re = PROCESS_RE.get_or_init(|| Regex::new(r"\]\s+([^\s:]+):").unwrap());
+    let invoked_line_re =
+        INVOKED_LINE_RE.get_or_init(|| Regex::new(r"(?i)invoked oom-killer:").unwrap());
+    let reaper_line_re = REAPER_LINE_RE.get_or_init(|| Regex::new(r"(?i)oom_reaper:").unwrap());
+    let alloc_re = ALLOC_RE.get_or_init(|| Regex::new(r"(?i)Cannot allocate memory").unwrap());
+
+    let mut events: Vec<OomEvent> = Vec::new();
+    for (i, line) in content.lines().enumerate() {
+        if !(line.contains("ut of memory")
+            || line.contains("oom-killer")
+            || line.contains("oom_reaper")
+            || line.contains("annot allocate memory"))
+        {
+            continue;
+        }
+        let line_no = i + 1;
+
+        if let Some(caps) = kill_re.captures(line) {
+            events.push(OomEvent {
+                timestamp: extract_timestamp(line).unwrap_or_else(|| "Unknown".to_string()),
+                line_number: line_no,
+                pid: caps.get(1).map(|m| m.as_str().to_string()),
+                process_name: caps.get(2).map(|m| m.as_str().to_string()),
+                score: score_re
+                    .captures(line)
+                    .and_then(|c| c.get(1).map(|m| m.as_str().to_string())),
+                total_vm: vm_re
+                    .captures(line)
+                    .and_then(|c| c.get(1).map(|m| format!("{}kB", m.as_str()))),
+                invoked_by: None,
+                order: None,
+                event_type: "oom_kill".to_string(),
+                raw_line: line.trim().to_string(),
+                source_path: source_path.to_string(),
+                source_line: Some(line_no),
+                source_line_end: Some(line_no),
+            });
+            continue;
+        }
+
+        if invoked_line_re.is_match(line) {
+            let duplicate = events
+                .iter()
+                .any(|e| e.event_type == "oom_invoked" && e.line_number.abs_diff(line_no) < 3);
+            if !duplicate {
+                events.push(OomEvent {
+                    timestamp: extract_timestamp(line).unwrap_or_else(|| "Unknown".to_string()),
+                    line_number: line_no,
+                    pid: None,
+                    process_name: None,
+                    score: None,
+                    total_vm: None,
+                    invoked_by: invoked_re
+                        .captures(line)
+                        .and_then(|c| c.get(1).map(|m| m.as_str().to_string())),
+                    order: order_re
+                        .captures(line)
+                        .and_then(|c| c.get(1).map(|m| m.as_str().to_string())),
+                    event_type: "oom_invoked".to_string(),
+                    raw_line: line.trim().to_string(),
+                    source_path: source_path.to_string(),
+                    source_line: Some(line_no),
+                    source_line_end: Some(line_no),
+                });
+            }
+            continue;
+        }
+
+        if reaper_line_re.is_match(line) {
+            let duplicate = events
+                .iter()
+                .any(|e| e.event_type == "oom_reaper" && e.line_number.abs_diff(line_no) < 3);
+            if !duplicate {
+                events.push(OomEvent {
+                    timestamp: extract_timestamp(line).unwrap_or_else(|| "Unknown".to_string()),
+                    line_number: line_no,
+                    pid: pid_re
+                        .captures(line)
+                        .and_then(|c| c.get(1).map(|m| m.as_str().to_string())),
+                    process_name: None,
+                    score: None,
+                    total_vm: None,
+                    invoked_by: None,
+                    order: None,
+                    event_type: "oom_reaper".to_string(),
+                    raw_line: line.trim().to_string(),
+                    source_path: source_path.to_string(),
+                    source_line: Some(line_no),
+                    source_line_end: Some(line_no),
+                });
+            }
+            continue;
+        }
+
+        if alloc_re.is_match(line) {
+            let duplicate = events
+                .iter()
+                .any(|e| e.event_type == "alloc_failure" && e.line_number.abs_diff(line_no) < 3);
+            if !duplicate {
+                events.push(OomEvent {
+                    timestamp: extract_timestamp(line).unwrap_or_else(|| "Unknown".to_string()),
+                    line_number: line_no,
+                    pid: None,
+                    process_name: process_re
+                        .captures(line)
+                        .and_then(|c| c.get(1).map(|m| m.as_str().to_string())),
+                    score: None,
+                    total_vm: None,
+                    invoked_by: None,
+                    order: None,
+                    event_type: "alloc_failure".to_string(),
+                    raw_line: line.trim().to_string(),
+                    source_path: source_path.to_string(),
+                    source_line: Some(line_no),
+                    source_line_end: Some(line_no),
+                });
+            }
+        }
+    }
+    OomKillerResult {
+        count: events.len(),
+        events,
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_xfs_errors(content: &str, source_path: &str) -> XfsErrorsResult {
+    static XFS_RE: OnceLock<Regex> = OnceLock::new();
+    static CRITICAL_RE: OnceLock<Regex> = OnceLock::new();
+    let xfs_pattern = XFS_RE.get_or_init(|| Regex::new(r"(?i)XFS\s+\(([^)]+)\):\s*(.+)").unwrap());
+    let critical_re = CRITICAL_RE.get_or_init(|| {
+        Regex::new(r"(?i)please unmount.*rectify|metadata.*corruption|corruption.*detected|corruption warning|internal error|shutting down filesystem|filesystem has been shut down|duplicate UUID.*can't mount|unrecovered unlinked inode").unwrap()
+    });
+
+    let mut events = Vec::new();
+    for (i, line) in content.lines().enumerate() {
+        if !line.contains("XFS") {
+            continue;
+        }
+        let trimmed = line.trim();
+        if let Some(caps) = xfs_pattern.captures(trimmed) {
+            let device = caps
+                .get(1)
+                .map(|m| m.as_str().to_string())
+                .unwrap_or_default();
+            let message = caps
+                .get(2)
+                .map(|m| m.as_str().trim().to_string())
+                .unwrap_or_default();
+            if critical_re.is_match(&message) {
+                let line_no = i + 1;
+                events.push(XfsErrorEvent {
+                    timestamp: extract_timestamp(trimmed).unwrap_or_else(|| "Unknown".to_string()),
+                    line_number: line_no,
+                    device,
+                    message,
+                    raw_line: trimmed.to_string(),
+                    source_path: source_path.to_string(),
+                    source_line: Some(line_no),
+                    source_line_end: Some(line_no),
+                });
+            }
+        }
+    }
+    XfsErrorsResult {
+        count: events.len(),
+        events,
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_emergency_mode_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_emergency_mode(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_kernel_reboots_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_kernel_reboots(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_oom_killer_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_oom_killer(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_xfs_errors_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_xfs_errors(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const PATH: &str = "var/log/messages";
+
+    #[test]
+    fn detects_emergency_mode() {
+        let input = "Jan 10 12:00:00 node1 systemd[1]: You are in emergency mode.";
+        let result = parse_emergency_mode(input, PATH);
+        assert!(result.found);
+        assert_eq!(result.count, 1);
+    }
+
+    #[test]
+    fn detects_kernel_reboot_events() {
+        let input = concat!(
+            "Jan 10 12:00:00 node1 kernel: Linux version 5.14.0-42\n",
+            "Jan 10 12:10:00 node1 systemd[1]: Shutting down.\n",
+            "Jan 10 12:10:01 node1 kernel: reboot: Restarting system\n"
+        );
+        let result = parse_kernel_reboots(input, PATH);
+        assert_eq!(result.count, 3);
+    }
+
+    #[test]
+    fn detects_oom_activity() {
+        let input = concat!(
+            "Jan 10 12:00:00 node1 kernel: myproc invoked oom-killer: gfp_mask=0x0 order=2\n",
+            "Jan 10 12:00:01 node1 kernel: Out of memory: Kill process 1234 (java) score 987 or sacrifice child total-vm:2048kB\n",
+            "Jan 10 12:00:02 node1 kernel: oom_reaper: reaped process 1234 (java)\n"
+        );
+        let result = parse_oom_killer(input, PATH);
+        assert_eq!(result.count, 3);
+        assert_eq!(result.events[1].process_name.as_deref(), Some("java"));
+    }
+
+    #[test]
+    fn detects_xfs_errors() {
+        let input = "Jan 10 12:00:00 node1 kernel: XFS (sdd1): Please unmount the filesystem and rectify the problem(s)";
+        let result = parse_xfs_errors(input, PATH);
+        assert_eq!(result.count, 1);
+        assert_eq!(result.events[0].device, "sdd1");
+    }
+
+    #[test]
+    fn events_carry_source_provenance() {
+        let input = concat!(
+            "Jan 10 12:00:00 node1 systemd[1]: You are in emergency mode.\n",
+            "Jan 10 12:00:01 node1 kernel: Out of memory: Kill process 1234 (java) score 987 total-vm:2048kB\n",
+            "Jan 10 12:00:02 node1 kernel: XFS (sdd1): Please unmount the filesystem and rectify the problem(s)\n",
+            "Jan 10 12:00:03 node1 kernel: Linux version 5.14.0-42\n"
+        );
+        let em = parse_emergency_mode(input, PATH);
+        assert_eq!(em.source_path, PATH);
+        assert_eq!(em.events[0].source_path, PATH);
+        assert_eq!(em.events[0].source_line, Some(1));
+
+        let oom = parse_oom_killer(input, PATH);
+        assert_eq!(oom.events[0].source_line, Some(2));
+        assert_eq!(oom.events[0].source_path, PATH);
+
+        let xfs = parse_xfs_errors(input, PATH);
+        assert_eq!(xfs.events[0].source_line, Some(3));
+        assert_eq!(xfs.events[0].source_path, PATH);
+
+        let kr = parse_kernel_reboots(input, PATH);
+        assert_eq!(kr.events[0].source_line, Some(4));
+        assert_eq!(kr.events[0].source_path, PATH);
+    }
+
+    #[test]
+    fn events_json_wrappers_include_source_path() {
+        let input = "Jan 10 12:00:00 node1 systemd[1]: You are in emergency mode.";
+        let json = parse_emergency_mode_json(input, PATH);
+        assert!(json.contains("\"source_path\":\"var/log/messages\""));
+    }
+}
diff --git a/rca-tool/lib/supportfile_core/src/parsers/hana.rs b/rca-tool/lib/supportfile_core/src/parsers/hana.rs
new file mode 100644
index 0000000..15d0ef9
--- /dev/null
+++ b/rca-tool/lib/supportfile_core/src/parsers/hana.rs
@@ -0,0 +1,1198 @@
+//! SAP HANA trace-file parsers.
+//!
+//! Currently provides a single detector, [`parse_hana_savepoints`], which
+//! scans HANA `indexserver_*.trc` / `nameserver_*.trc` trace files for
+//! savepoint activity emitted by the `Savepoint` trace component
+//! (`SavepointImpl.cpp`).
+//!
+//! A savepoint is the periodic flush of changed in-memory pages to the HANA
+//! data volume (default cadence `savepoint_interval_s = 300`). Each savepoint
+//! has a short blocking / critical phase that can stall writers; a long stall
+//! usually points at slow `/hana/data` storage. The detector surfaces every
+//! savepoint event plus warnings for:
+//!
+//! * `hana_savepoint_slow_callback` — a `w Savepoint ... took <N>ms` line
+//!   logged by HANA itself (escalated to `error` for very long stalls).
+//! * `hana_savepoint_cadence_gap` — an unusually long interval between two
+//!   consecutive periodic savepoints in the same file (possible stall / I/O
+//!   pressure).
+//!
+//! Unlike the rest of the RCA tool, these traces are *not* part of a standard
+//! sosreport / supportconfig bundle — they have to be collected separately
+//! (e.g. a HANA log ZIP). The parser is content-driven and only emits results
+//! when savepoint lines are actually present, so feeding it unrelated trace
+//! files is harmless.
+
+use regex::Regex;
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::sync::OnceLock;
+
+// ---------------------------------------------------------------------------
+// Tunables
+// ---------------------------------------------------------------------------
+
+/// HANA default `persistence/savepoint_interval_s`.
+const DEFAULT_SAVEPOINT_INTERVAL_S: f64 = 300.0;
+/// Flag a cadence gap when the observed interval exceeds this multiple of the
+/// (assumed default) interval.
+const CADENCE_GAP_FACTOR: f64 = 3.0;
+/// A slow-callback warning at/above this duration is escalated to `error`.
+const SLOW_CALLBACK_ERROR_MS: u64 = 60_000;
+/// Cap on the number of detailed savepoint records retained per file, to keep
+/// JSON output bounded on multi-day traces (count remains accurate).
+const MAX_SAVEPOINT_RECORDS: usize = 2_000;
+
+/// Cap on detailed records retained per detector (deadlocks / OOM / merge
+/// errors), keeping JSON bounded while the `count` totals stay accurate.
+const MAX_DETAIL_RECORDS: usize = 1_000;
+/// Number of entries kept in each "top contended objects / statements" list.
+const TOP_N: usize = 10;
+/// A deadlock count at/above this value is escalated from `warning` to `error`.
+const DEADLOCK_ERROR_COUNT: usize = 25;
+/// A merge-error count at/above this value is escalated to `error`.
+const MERGE_ERROR_ERROR_COUNT: usize = 50;
+/// HANA return code for "not enough merge tokens" (delta merge / compression).
+const RC_MERGE_TOKEN_EXHAUSTION: &str = "2465";
+
+// ---------------------------------------------------------------------------
+// Data model
+// ---------------------------------------------------------------------------
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct HanaWarning {
+    #[serde(rename = "type")]
+    pub r#type: String,
+    pub message: String,
+    pub details: Option<String>,
+    pub severity: Option<String>,
+    pub recommendation: Option<String>,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct HanaSavepoint {
+    /// HANA trace timestamp, e.g. `2026-06-03 19:54:09.350130`.
+    pub timestamp: String,
+    /// `Savepoint` (periodic / triggered) or `Snapshot`.
+    pub kind: String,
+    /// For snapshots, the `kind:` qualifier (e.g. `Replication`), if present.
+    pub snapshot_kind: Option<String>,
+    pub savepoint_version: Option<u64>,
+    pub next_savepoint_version: Option<u64>,
+    pub last_snapshot_version: Option<u64>,
+    pub restart_redo_log_position: Option<String>,
+    pub dropped_version: Option<u64>,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct HanaSavepointsResult {
+    pub found: bool,
+    /// Total number of periodic/triggered savepoint events (`Savepoint ...`).
+    pub count: usize,
+    /// Number of snapshot savepoint events (`Snapshot ...`).
+    pub snapshot_count: usize,
+    /// Most recent savepoint timestamp seen in this file.
+    pub last_savepoint: Option<String>,
+    /// Mean interval (seconds) between consecutive periodic savepoints.
+    pub avg_interval_s: Option<f64>,
+    /// Longest observed interval (seconds) between consecutive savepoints.
+    pub max_interval_s: Option<f64>,
+    pub savepoints: Vec<HanaSavepoint>,
+    pub warnings: Vec<HanaWarning>,
+    pub source_path: String,
+}
+
+impl Default for HanaSavepointsResult {
+    fn default() -> Self {
+        Self {
+            found: false,
+            count: 0,
+            snapshot_count: 0,
+            last_savepoint: None,
+            avg_interval_s: None,
+            max_interval_s: None,
+            savepoints: Vec::new(),
+            warnings: Vec::new(),
+            source_path: String::new(),
+        }
+    }
+}
+
+/// A `name -> count` tally entry used for "top contended objects / statements".
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct HanaCount {
+    pub name: String,
+    pub count: usize,
+}
+
+/// One transaction participating in a deadlock cycle.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct HanaDeadlockParty {
+    pub is_victim: bool,
+    pub conn_id: Option<String>,
+    pub client_host: Option<String>,
+    pub client_ip: Option<String>,
+    pub app_user: Option<String>,
+    pub db_user: Option<String>,
+    pub object_name: Option<String>,
+    pub lock_type: Option<String>,
+    pub stmt_hash: Option<String>,
+    pub statement: Option<String>,
+}
+
+/// A single `Deadlock detected` event from the `Lock` (`WaitGraph.cc`)
+/// component of a HANA indexserver alert trace.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct HanaDeadlock {
+    pub timestamp: String,
+    /// Number of transactions in the reported deadlock cycle.
+    pub participant_count: usize,
+    /// Distinct lock objects (tables) named in the cycle.
+    pub objects: Vec<String>,
+    /// The transaction HANA rolled back to break the cycle.
+    pub victim: Option<HanaDeadlockParty>,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq)]
+pub struct HanaDeadlocksResult {
+    pub found: bool,
+    pub count: usize,
+    pub last_deadlock: Option<String>,
+    /// Tables most frequently involved in a deadlock cycle.
+    pub top_objects: Vec<HanaCount>,
+    /// Statement hashes most frequently rolled back as the victim.
+    pub top_statements: Vec<HanaCount>,
+    pub deadlocks: Vec<HanaDeadlock>,
+    pub warnings: Vec<HanaWarning>,
+    pub source_path: String,
+}
+
+/// A single `OUT OF MEMORY occurred` event from the `Memory` component.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct HanaOomEvent {
+    pub timestamp: String,
+    pub memory_type: Option<String>,
+    pub host: Option<String>,
+    pub executable: Option<String>,
+    pub pid: Option<String>,
+    pub failed_alloc_bytes: Option<u64>,
+    pub failure_type: Option<String>,
+    /// Global allocation limit (bytes) from the IPMM short-info block.
+    pub global_allocation_limit_bytes: Option<u64>,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq)]
+pub struct HanaOomResult {
+    pub found: bool,
+    pub count: usize,
+    pub last_oom: Option<String>,
+    pub events: Vec<HanaOomEvent>,
+    pub warnings: Vec<HanaWarning>,
+    pub source_path: String,
+}
+
+/// A single delta-merge / optimize-compression failure.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct HanaMergeError {
+    pub timestamp: String,
+    /// `delta_merge` or `optimize_compres`.
+    pub component: String,
+    pub table: Option<String>,
+    pub table_id: Option<u64>,
+    pub motivation: Option<String>,
+    pub rc: Option<String>,
+    pub message: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq)]
+pub struct HanaMergeErrorsResult {
+    pub found: bool,
+    pub count: usize,
+    /// Failures attributed to delta merge (`delta_merge`).
+    pub merge_error_count: usize,
+    /// Failures attributed to optimize compression (`optimize_compres`).
+    pub compression_error_count: usize,
+    /// Failures whose return code is `2465` (merge-token exhaustion).
+    pub token_exhaustion_count: usize,
+    pub last_error: Option<String>,
+    /// Tables most frequently failing to merge / compress.
+    pub top_tables: Vec<HanaCount>,
+    pub errors: Vec<HanaMergeError>,
+    pub warnings: Vec<HanaWarning>,
+    pub source_path: String,
+}
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+/// Matches a standard HANA trace line emitted by the `Savepoint` component:
+/// `[<thread>]{<conn>}[<txn>] <date> <time> <sev> Savepoint <src>(<ln>) : <msg>`
+fn savepoint_line_re() -> &'static Regex {
+    static RE: OnceLock<Regex> = OnceLock::new();
+    RE.get_or_init(|| {
+        Regex::new(
+            r"^\[\d+\]\{[^}]*\}\[[^\]]*\]\s+(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}\.\d+)\s+([iwe])\s+Savepoint\s+\S+\(\d+\)\s*:\s*(.*)$",
+        )
+        .unwrap()
+    })
+}
+
+/// Matches any standard HANA trace-line header, capturing
+/// `(timestamp, severity, component, message)`:
+/// `[<thread>]{<conn>}[<txn>] <date> <time> <sev> <component> <src>(<ln>) : <msg>`
+fn trace_header_re() -> &'static Regex {
+    static RE: OnceLock<Regex> = OnceLock::new();
+    RE.get_or_init(|| {
+        Regex::new(
+            r"^\[\d+\]\{[^}]*\}\[[^\]]*\]\s+(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}\.\d+)\s+([iwedf])\s+(\S+)\s+\S+\(\d+\)\s*:\s*(.*)$",
+        )
+        .unwrap()
+    })
+}
+
+/// True when `line` begins a new HANA trace record (`[<thread>]{...`), used to
+/// bound multi-line blocks (deadlock cycles, OOM dumps).
+fn is_trace_header(line: &str) -> bool {
+    static RE: OnceLock<Regex> = OnceLock::new();
+    RE.get_or_init(|| Regex::new(r"^\[\d+\]\{").unwrap())
+        .is_match(line)
+}
+
+/// Take the top-`TOP_N` `(name, count)` entries from a tally, ordered by count
+/// descending then name ascending for deterministic output.
+fn top_counts(map: &HashMap<String, usize>) -> Vec<HanaCount> {
+    let mut entries: Vec<HanaCount> = map
+        .iter()
+        .map(|(name, count)| HanaCount {
+            name: name.clone(),
+            count: *count,
+        })
+        .collect();
+    entries.sort_by(|a, b| b.count.cmp(&a.count).then_with(|| a.name.cmp(&b.name)));
+    entries.truncate(TOP_N);
+    entries
+}
+
+fn capture_u64(re: &Regex, text: &str) -> Option<u64> {
+    re.captures(text)
+        .and_then(|c| c.get(1))
+        .and_then(|m| m.as_str().parse::<u64>().ok())
+}
+
+fn capture_str(re: &Regex, text: &str) -> Option<String> {
+    re.captures(text)
+        .and_then(|c| c.get(1))
+        .map(|m| m.as_str().to_string())
+}
+
+/// Parse a HANA trace timestamp (`YYYY-MM-DD HH:MM:SS.ffffff`) into seconds
+/// since the Unix epoch (UTC, naive — adequate for interval arithmetic).
+fn timestamp_to_secs(ts: &str) -> Option<f64> {
+    // ts: "2026-06-03 19:54:09.350130"
+    let (date, rest) = ts.split_once(' ')?;
+    let mut dparts = date.split('-');
+    let year: i64 = dparts.next()?.parse().ok()?;
+    let month: i64 = dparts.next()?.parse().ok()?;
+    let day: i64 = dparts.next()?.parse().ok()?;
+    let (hms, frac) = match rest.split_once('.') {
+        Some((a, b)) => (a, b),
+        None => (rest, "0"),
+    };
+    let mut tparts = hms.split(':');
+    let hh: i64 = tparts.next()?.parse().ok()?;
+    let mm: i64 = tparts.next()?.parse().ok()?;
+    let ss: i64 = tparts.next()?.parse().ok()?;
+    // Days from civil (Howard Hinnant's algorithm), valid for the Gregorian
+    // calendar — good enough for interval differences between two timestamps.
+    let y = if month <= 2 { year - 1 } else { year };
+    let era = if y >= 0 { y } else { y - 399 } / 400;
+    let yoe = y - era * 400;
+    let mp = (month + 9) % 12;
+    let doy = (153 * mp + 2) / 5 + day - 1;
+    let doe = yoe * 365 + yoe / 4 - yoe / 100 + doy;
+    let days = era * 146097 + doe - 719468;
+    let frac_secs: f64 = format!("0.{frac}").parse().unwrap_or(0.0);
+    Some(days as f64 * 86400.0 + hh as f64 * 3600.0 + mm as f64 * 60.0 + ss as f64 + frac_secs)
+}
+
+// ---------------------------------------------------------------------------
+// Parser
+// ---------------------------------------------------------------------------
+
+pub fn parse_hana_savepoints(content: &str, source_path: &str) -> HanaSavepointsResult {
+    static EVENT_RE: OnceLock<Regex> = OnceLock::new();
+    static VERSION_RE: OnceLock<Regex> = OnceLock::new();
+    static NEXT_RE: OnceLock<Regex> = OnceLock::new();
+    static LAST_SNAP_RE: OnceLock<Regex> = OnceLock::new();
+    static REDO_RE: OnceLock<Regex> = OnceLock::new();
+    static DROPPED_RE: OnceLock<Regex> = OnceLock::new();
+    static KIND_RE: OnceLock<Regex> = OnceLock::new();
+    static TOOK_RE: OnceLock<Regex> = OnceLock::new();
+
+    // `Savepoint current savepoint version: N` / `Snapshot current savepoint version: N`
+    let event_re = EVENT_RE
+        .get_or_init(|| Regex::new(r"^(Savepoint|Snapshot)\s+current savepoint version:").unwrap());
+    let version_re =
+        VERSION_RE.get_or_init(|| Regex::new(r"current savepoint version:\s*(\d+)").unwrap());
+    let next_re =
+        NEXT_RE.get_or_init(|| Regex::new(r"next savepoint version:\s*(\d+)").unwrap());
+    let last_snap_re =
+        LAST_SNAP_RE.get_or_init(|| Regex::new(r"last snapshot SP version:\s*(\d+)").unwrap());
+    let redo_re = REDO_RE
+        .get_or_init(|| Regex::new(r"restart redo log position:\s*(0x[0-9a-fA-F]+)").unwrap());
+    let dropped_re = DROPPED_RE.get_or_init(|| Regex::new(r"dropped:\s*(\d+)").unwrap());
+    let kind_re = KIND_RE.get_or_init(|| Regex::new(r"kind:\s*(\w+)").unwrap());
+    let took_re = TOOK_RE.get_or_init(|| Regex::new(r"took\s+(\d+)\s*ms").unwrap());
+
+    let line_re = savepoint_line_re();
+
+    let mut result = HanaSavepointsResult {
+        source_path: source_path.to_string(),
+        ..Default::default()
+    };
+
+    // (timestamp_secs, is_periodic_savepoint) for cadence analysis.
+    let mut periodic_times: Vec<(f64, usize)> = Vec::new();
+
+    for (i, line) in content.lines().enumerate() {
+        if !line.contains("Savepoint") {
+            continue;
+        }
+        let caps = match line_re.captures(line) {
+            Some(c) => c,
+            None => continue,
+        };
+        let line_no = i + 1;
+        let timestamp = caps.get(1).map(|m| m.as_str().to_string()).unwrap_or_default();
+        let severity = caps.get(2).map(|m| m.as_str()).unwrap_or("i");
+        let message = caps.get(3).map(|m| m.as_str()).unwrap_or("");
+
+        if event_re.is_match(message) {
+            let kind = if message.starts_with("Snapshot") {
+                "Snapshot"
+            } else {
+                "Savepoint"
+            };
+            let snapshot_kind = if kind == "Snapshot" {
+                capture_str(kind_re, message)
+            } else {
+                None
+            };
+            let sp = HanaSavepoint {
+                timestamp: timestamp.clone(),
+                kind: kind.to_string(),
+                snapshot_kind,
+                savepoint_version: capture_u64(version_re, message),
+                next_savepoint_version: capture_u64(next_re, message),
+                last_snapshot_version: capture_u64(last_snap_re, message),
+                restart_redo_log_position: capture_str(redo_re, message),
+                dropped_version: capture_u64(dropped_re, message),
+                source_path: source_path.to_string(),
+                source_line: Some(line_no),
+                source_line_end: Some(line_no),
+            };
+
+            if kind == "Snapshot" {
+                result.snapshot_count += 1;
+            } else {
+                result.count += 1;
+                if let Some(secs) = timestamp_to_secs(&timestamp) {
+                    periodic_times.push((secs, line_no));
+                }
+            }
+            result.last_savepoint = Some(timestamp);
+            if result.savepoints.len() < MAX_SAVEPOINT_RECORDS {
+                result.savepoints.push(sp);
+            }
+            continue;
+        }
+
+        // Slow-callback warning: HANA logs these at `w` (warning) level.
+        if severity == "w" {
+            if let Some(ms) = capture_u64(took_re, message) {
+                let secs = ms as f64 / 1000.0;
+                let severity_label = if ms >= SLOW_CALLBACK_ERROR_MS {
+                    "error"
+                } else {
+                    "warning"
+                };
+                result.warnings.push(HanaWarning {
+                    r#type: "hana_savepoint_slow_callback".to_string(),
+                    message: format!("HANA savepoint callback stalled for {secs:.1}s"),
+                    details: Some(message.to_string()),
+                    severity: Some(severity_label.to_string()),
+                    recommendation: Some(
+                        "A long savepoint callback indicates slow /hana/data storage or lock \
+                         contention; review data-volume I/O latency and throughput."
+                            .to_string(),
+                    ),
+                    source_path: source_path.to_string(),
+                    source_line: Some(line_no),
+                    source_line_end: Some(line_no),
+                });
+            }
+        }
+    }
+
+    // Cadence analysis over periodic savepoints in chronological order.
+    if periodic_times.len() >= 2 {
+        let mut times: Vec<(f64, usize)> = periodic_times.clone();
+        times.sort_by(|a, b| a.0.partial_cmp(&b.0).unwrap_or(std::cmp::Ordering::Equal));
+        let mut total = 0.0;
+        let mut intervals = 0u64;
+        let mut max_interval = 0.0_f64;
+        let gap_threshold = DEFAULT_SAVEPOINT_INTERVAL_S * CADENCE_GAP_FACTOR;
+        for win in times.windows(2) {
+            let delta = win[1].0 - win[0].0;
+            if delta < 0.0 {
+                continue;
+            }
+            total += delta;
+            intervals += 1;
+            if delta > max_interval {
+                max_interval = delta;
+            }
+            if delta > gap_threshold {
+                result.warnings.push(HanaWarning {
+                    r#type: "hana_savepoint_cadence_gap".to_string(),
+                    message: format!(
+                        "Gap of {:.0}s between consecutive savepoints (expected ~{:.0}s)",
+                        delta, DEFAULT_SAVEPOINT_INTERVAL_S
+                    ),
+                    details: Some(format!(
+                        "No periodic savepoint completed between trace lines {} and {}",
+                        win[0].1, win[1].1
+                    )),
+                    severity: Some("info".to_string()),
+                    recommendation: Some(
+                        "Long gaps between savepoints extend crash-recovery time and can signal \
+                         that savepoints are blocked on I/O; correlate with /hana/data latency."
+                            .to_string(),
+                    ),
+                    source_path: source_path.to_string(),
+                    source_line: Some(win[1].1),
+                    source_line_end: Some(win[1].1),
+                });
+            }
+        }
+        if intervals > 0 {
+            result.avg_interval_s = Some(total / intervals as f64);
+            result.max_interval_s = Some(max_interval);
+        }
+    }
+
+    result.found = result.count > 0 || result.snapshot_count > 0 || !result.warnings.is_empty();
+    result
+}
+
+pub fn parse_hana_savepoints_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_hana_savepoints(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    super::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "null".to_string())
+}
+
+// ===========================================================================
+// Deadlock detector
+// ===========================================================================
+
+/// Extract a `KEY=VALUE` field (value terminated by `,` or `]`) from a HANA
+/// deadlock participant line. `APPUSER = X` (with spaces) is handled too.
+fn participant_field(line: &str, key: &str) -> Option<String> {
+    // Build a tiny regex per (cached) key. The set of keys is fixed and small.
+    let pos = line.find(key)?;
+    let after = &line[pos + key.len()..];
+    let after = after.trim_start();
+    let after = after.strip_prefix('=')?.trim_start();
+    let end = after.find(|c| c == ',' || c == ']').unwrap_or(after.len());
+    let val = after[..end].trim();
+    if val.is_empty() {
+        None
+    } else {
+        Some(val.to_string())
+    }
+}
+
+/// Extract the trailing `STMT=...` statement text from a participant line.
+fn participant_statement(line: &str) -> Option<String> {
+    let pos = line.find("STMT=")?;
+    let mut stmt = line[pos + "STMT=".len()..].trim().to_string();
+    // Drop a single trailing `]` that closes the participant bracket.
+    if stmt.ends_with(']') {
+        stmt.pop();
+    }
+    let stmt = stmt.trim();
+    if stmt.is_empty() {
+        return None;
+    }
+    // Keep storage bounded; statements can be very long.
+    const MAX_STMT: usize = 500;
+    if stmt.len() > MAX_STMT {
+        let mut truncated: String = stmt.chars().take(MAX_STMT).collect();
+        truncated.push('…');
+        Some(truncated)
+    } else {
+        Some(stmt.to_string())
+    }
+}
+
+fn parse_deadlock_party(line: &str) -> HanaDeadlockParty {
+    HanaDeadlockParty {
+        is_victim: line.contains("(victim)"),
+        conn_id: participant_field(line, "CONNID"),
+        client_host: participant_field(line, "CLIENT_HOST"),
+        client_ip: participant_field(line, "CLIENT_IP"),
+        app_user: participant_field(line, "APPUSER"),
+        db_user: participant_field(line, "DBUSER"),
+        object_name: participant_field(line, "OBJECT_NAME"),
+        lock_type: participant_field(line, "LOCK_TYPE"),
+        stmt_hash: participant_field(line, "STMT_HASH"),
+        statement: participant_statement(line),
+    }
+}
+
+pub fn parse_hana_deadlocks(content: &str, source_path: &str) -> HanaDeadlocksResult {
+    let lines: Vec<&str> = content.lines().collect();
+    let header_re = trace_header_re();
+
+    let mut result = HanaDeadlocksResult {
+        source_path: source_path.to_string(),
+        ..Default::default()
+    };
+    let mut object_counts: HashMap<String, usize> = HashMap::new();
+    let mut stmt_counts: HashMap<String, usize> = HashMap::new();
+
+    let mut i = 0usize;
+    while i < lines.len() {
+        let line = lines[i];
+        let caps = match header_re.captures(line) {
+            Some(c) => c,
+            None => {
+                i += 1;
+                continue;
+            }
+        };
+        let component = caps.get(3).map(|m| m.as_str()).unwrap_or("");
+        if component != "Lock" || !line.contains("WaitGraph") {
+            i += 1;
+            continue;
+        }
+        let timestamp = caps.get(1).map(|m| m.as_str().to_string()).unwrap_or_default();
+        let start_line = i + 1;
+
+        // Gather the continuation block (until the next trace header / EOF).
+        let mut j = i + 1;
+        let mut block: Vec<&str> = Vec::new();
+        while j < lines.len() && !is_trace_header(lines[j]) {
+            block.push(lines[j]);
+            j += 1;
+        }
+        let end_line = j; // 1-based index of last block line (= j when j>start)
+
+        if block.iter().any(|l| l.contains("Deadlock detected")) {
+            let parties: Vec<HanaDeadlockParty> = block
+                .iter()
+                .filter(|l| l.contains("CONNID="))
+                .map(|l| parse_deadlock_party(l))
+                .collect();
+
+            // Distinct objects in the cycle.
+            let mut objects: Vec<String> = Vec::new();
+            for p in &parties {
+                if let Some(obj) = &p.object_name {
+                    if !objects.contains(obj) {
+                        objects.push(obj.clone());
+                    }
+                }
+            }
+            for obj in &objects {
+                *object_counts.entry(obj.clone()).or_insert(0) += 1;
+            }
+
+            let victim = parties.iter().find(|p| p.is_victim).cloned();
+            if let Some(v) = &victim {
+                if let Some(h) = &v.stmt_hash {
+                    *stmt_counts.entry(h.clone()).or_insert(0) += 1;
+                }
+            }
+
+            result.count += 1;
+            result.last_deadlock = Some(timestamp.clone());
+            if result.deadlocks.len() < MAX_DETAIL_RECORDS {
+                result.deadlocks.push(HanaDeadlock {
+                    timestamp,
+                    participant_count: parties.len(),
+                    objects,
+                    victim,
+                    source_path: source_path.to_string(),
+                    source_line: Some(start_line),
+                    source_line_end: Some(end_line.max(start_line)),
+                });
+            }
+        }
+        i = j;
+    }
+
+    if result.count > 0 {
+        result.top_objects = top_counts(&object_counts);
+        result.top_statements = top_counts(&stmt_counts);
+        let severity = if result.count >= DEADLOCK_ERROR_COUNT {
+            "error"
+        } else {
+            "warning"
+        };
+        let top_obj = result
+            .top_objects
+            .first()
+            .map(|c| format!("{} ({} deadlocks)", c.name, c.count))
+            .unwrap_or_else(|| "unknown".to_string());
+        result.warnings.push(HanaWarning {
+            r#type: "hana_deadlocks_detected".to_string(),
+            message: format!(
+                "{} deadlock(s) detected; HANA rolled back a victim transaction each time",
+                result.count
+            ),
+            details: Some(format!("Most contended object: {top_obj}")),
+            severity: Some(severity.to_string()),
+            recommendation: Some(
+                "Recurring deadlocks usually mean concurrent transactions update the same rows \
+                 in different orders. Review the contended table/statement and the application's \
+                 update ordering, batch size, and commit frequency."
+                    .to_string(),
+            ),
+            source_path: source_path.to_string(),
+            source_line: result.deadlocks.first().and_then(|d| d.source_line),
+            source_line_end: result.deadlocks.last().and_then(|d| d.source_line_end),
+        });
+    }
+
+    result.found = result.count > 0;
+    result
+}
+
+pub fn parse_hana_deadlocks_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_hana_deadlocks(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    super::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "null".to_string())
+}
+
+// ===========================================================================
+// Out-of-memory detector
+// ===========================================================================
+
+pub fn parse_hana_oom(content: &str, source_path: &str) -> HanaOomResult {
+    static MEMTYPE_RE: OnceLock<Regex> = OnceLock::new();
+    static HOST_RE: OnceLock<Regex> = OnceLock::new();
+    static EXEC_RE: OnceLock<Regex> = OnceLock::new();
+    static PID_RE: OnceLock<Regex> = OnceLock::new();
+    static FAILED_RE: OnceLock<Regex> = OnceLock::new();
+    static FAILTYPE_RE: OnceLock<Regex> = OnceLock::new();
+    static GAL_RE: OnceLock<Regex> = OnceLock::new();
+
+    let memtype_re = MEMTYPE_RE.get_or_init(|| Regex::new(r"(?m)^MemoryType:\s*(\S+)").unwrap());
+    let host_re = HOST_RE.get_or_init(|| Regex::new(r"(?m)^Host:\s*(\S+)").unwrap());
+    let exec_re = EXEC_RE.get_or_init(|| Regex::new(r"(?m)^Executable:\s*(\S+)").unwrap());
+    let pid_re = PID_RE.get_or_init(|| Regex::new(r"(?m)^PID:\s*(\d+)").unwrap());
+    let failed_re =
+        FAILED_RE.get_or_init(|| Regex::new(r"Failed to allocate \S+ \((\d+)b\)").unwrap());
+    let failtype_re =
+        FAILTYPE_RE.get_or_init(|| Regex::new(r"Allocation failure type:\s*(\S+)").unwrap());
+    let gal_re = GAL_RE
+        .get_or_init(|| Regex::new(r"GLOBAL_ALLOCATION_LIMIT \(GAL\)\s*=\s*[^(]*\((\d+)b\)").unwrap());
+
+    let lines: Vec<&str> = content.lines().collect();
+    let header_re = trace_header_re();
+
+    let mut result = HanaOomResult {
+        source_path: source_path.to_string(),
+        ..Default::default()
+    };
+
+    let mut i = 0usize;
+    while i < lines.len() {
+        let line = lines[i];
+        let caps = match header_re.captures(line) {
+            Some(c) => c,
+            None => {
+                i += 1;
+                continue;
+            }
+        };
+        let component = caps.get(3).map(|m| m.as_str()).unwrap_or("");
+        let message = caps.get(4).map(|m| m.as_str()).unwrap_or("");
+        if component != "Memory" || !message.starts_with("OUT OF MEMORY occurred") {
+            i += 1;
+            continue;
+        }
+        let timestamp = caps.get(1).map(|m| m.as_str().to_string()).unwrap_or_default();
+        let start_line = i + 1;
+
+        let mut j = i + 1;
+        while j < lines.len() && !is_trace_header(lines[j]) {
+            j += 1;
+        }
+        let block = lines[i..j].join("\n");
+
+        result.count += 1;
+        result.last_oom = Some(timestamp.clone());
+        if result.events.len() < MAX_DETAIL_RECORDS {
+            result.events.push(HanaOomEvent {
+                timestamp,
+                memory_type: capture_str(memtype_re, &block),
+                host: capture_str(host_re, &block),
+                executable: capture_str(exec_re, &block),
+                pid: capture_str(pid_re, &block),
+                failed_alloc_bytes: capture_u64(failed_re, &block),
+                failure_type: capture_str(failtype_re, &block),
+                global_allocation_limit_bytes: capture_u64(gal_re, &block),
+                source_path: source_path.to_string(),
+                source_line: Some(start_line),
+                source_line_end: Some(j.max(start_line)),
+            });
+        }
+        i = j;
+    }
+
+    if result.count > 0 {
+        let first = result.events.first();
+        let details = first.map(|e| {
+            let ft = e.failure_type.as_deref().unwrap_or("unknown");
+            let host = e.host.as_deref().unwrap_or("?");
+            format!("First OOM on {host}: allocation failure type {ft}")
+        });
+        result.warnings.push(HanaWarning {
+            r#type: "hana_out_of_memory".to_string(),
+            message: format!(
+                "{} HANA out-of-memory event(s) — an allocation hit the global allocation limit",
+                result.count
+            ),
+            details,
+            severity: Some("error".to_string()),
+            recommendation: Some(
+                "OOM means HANA could not allocate within its global allocation limit. Check the \
+                 largest memory consumers (column-store tables, statement memory, heap \
+                 allocators), reduce statement_memory_limit offenders, and verify the host has \
+                 enough physical RAM for the configured limit."
+                    .to_string(),
+            ),
+            source_path: source_path.to_string(),
+            source_line: first.and_then(|e| e.source_line),
+            source_line_end: result.events.last().and_then(|e| e.source_line_end),
+        });
+    }
+
+    result.found = result.count > 0;
+    result
+}
+
+pub fn parse_hana_oom_json(content: &str, source_path: &str) -> String {
+    let mut value =
+        serde_json::to_value(parse_hana_oom(content, source_path)).unwrap_or(serde_json::Value::Null);
+    super::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "null".to_string())
+}
+
+// ===========================================================================
+// Delta-merge / optimize-compression failure detector
+// ===========================================================================
+
+pub fn parse_hana_merge_errors(content: &str, source_path: &str) -> HanaMergeErrorsResult {
+    static TABLE_RE: OnceLock<Regex> = OnceLock::new();
+    static MOTIV_RE: OnceLock<Regex> = OnceLock::new();
+    static RC_RE: OnceLock<Regex> = OnceLock::new();
+
+    let table_re = TABLE_RE.get_or_init(|| Regex::new(r"table = (\S+) \(t (\d+)\)").unwrap());
+    let motiv_re = MOTIV_RE.get_or_init(|| Regex::new(r"merge motivation = (\w+)").unwrap());
+    let rc_re = RC_RE.get_or_init(|| Regex::new(r"\brc = (\d+)").unwrap());
+
+    let header_re = trace_header_re();
+
+    let mut result = HanaMergeErrorsResult {
+        source_path: source_path.to_string(),
+        ..Default::default()
+    };
+    let mut table_counts: HashMap<String, usize> = HashMap::new();
+
+    for (i, line) in content.lines().enumerate() {
+        if !line.contains("delta_merge") && !line.contains("optimize_compres") {
+            continue;
+        }
+        let caps = match header_re.captures(line) {
+            Some(c) => c,
+            None => continue,
+        };
+        let severity = caps.get(2).map(|m| m.as_str()).unwrap_or("");
+        let component = caps.get(3).map(|m| m.as_str()).unwrap_or("");
+        let message = caps.get(4).map(|m| m.as_str()).unwrap_or("");
+        if severity != "e" || (component != "delta_merge" && component != "optimize_compres") {
+            continue;
+        }
+
+        let (table, table_id) = match table_re.captures(message) {
+            Some(c) => (
+                c.get(1).map(|m| m.as_str().to_string()),
+                c.get(2).and_then(|m| m.as_str().parse::<u64>().ok()),
+            ),
+            None => (None, None),
+        };
+        let rc = capture_str(rc_re, message);
+
+        if component == "delta_merge" {
+            result.merge_error_count += 1;
+        } else {
+            result.compression_error_count += 1;
+        }
+        if rc.as_deref() == Some(RC_MERGE_TOKEN_EXHAUSTION) {
+            result.token_exhaustion_count += 1;
+        }
+        if let Some(t) = &table {
+            *table_counts.entry(t.clone()).or_insert(0) += 1;
+        }
+
+        result.count += 1;
+        result.last_error = Some(
+            caps.get(1).map(|m| m.as_str().to_string()).unwrap_or_default(),
+        );
+        if result.errors.len() < MAX_DETAIL_RECORDS {
+            result.errors.push(HanaMergeError {
+                timestamp: caps.get(1).map(|m| m.as_str().to_string()).unwrap_or_default(),
+                component: component.to_string(),
+                table,
+                table_id,
+                motivation: capture_str(motiv_re, message),
+                rc,
+                message: message.to_string(),
+                source_path: source_path.to_string(),
+                source_line: Some(i + 1),
+                source_line_end: Some(i + 1),
+            });
+        }
+    }
+
+    if result.count > 0 {
+        result.top_tables = top_counts(&table_counts);
+        let severity = if result.count >= MERGE_ERROR_ERROR_COUNT {
+            "error"
+        } else {
+            "warning"
+        };
+        let (message, recommendation) = if result.token_exhaustion_count > 0 {
+            (
+                format!(
+                    "{} delta-merge / compression failure(s); {} due to merge-token exhaustion (rc=2465)",
+                    result.count, result.token_exhaustion_count
+                ),
+                "Merge-token exhaustion (rc=2465) means too many merges were requested at once, \
+                 often a symptom of memory pressure or a merge backlog. Check for concurrent OOM \
+                 events, the mergedog configuration, and whether large tables need manual / \
+                 smart merge tuning.",
+            )
+        } else {
+            (
+                format!(
+                    "{} delta-merge / optimize-compression failure(s) in HANA",
+                    result.count
+                ),
+                "Failed merges leave tables with an oversized delta storage, hurting query \
+                 performance and memory. Review the affected tables and the indexserver alert \
+                 trace for the underlying cause.",
+            )
+        };
+        let top_table = result
+            .top_tables
+            .first()
+            .map(|c| format!("{} ({} failures)", c.name, c.count));
+        result.warnings.push(HanaWarning {
+            r#type: "hana_merge_failures".to_string(),
+            message,
+            details: top_table.map(|t| format!("Most affected table: {t}")),
+            severity: Some(severity.to_string()),
+            recommendation: Some(recommendation.to_string()),
+            source_path: source_path.to_string(),
+            source_line: result.errors.first().and_then(|e| e.source_line),
+            source_line_end: result.errors.last().and_then(|e| e.source_line_end),
+        });
+    }
+
+    result.found = result.count > 0;
+    result
+}
+
+pub fn parse_hana_merge_errors_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_hana_merge_errors(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    super::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "null".to_string())
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const PATH: &str = "T31 HANA Logs/indexserver_vmltmdbuspd01.39003.023.trc";
+
+    fn sp_line(ts: &str, msg: &str) -> String {
+        format!("[1527771]{{-1}}[-1/-1] {ts} i Savepoint        SavepointImpl.cpp(03481) : {msg}")
+    }
+
+    #[test]
+    fn detects_periodic_savepoint() {
+        let input = sp_line(
+            "2026-06-03 19:54:09.350130",
+            "Savepoint current savepoint version: 609685, restart redo log position: 0x33cb84d9ca6, next savepoint version: 609686, last snapshot SP version: 609683",
+        );
+        let r = parse_hana_savepoints(&input, PATH);
+        assert!(r.found);
+        assert_eq!(r.count, 1);
+        assert_eq!(r.snapshot_count, 0);
+        assert_eq!(r.savepoints.len(), 1);
+        let sp = &r.savepoints[0];
+        assert_eq!(sp.kind, "Savepoint");
+        assert_eq!(sp.savepoint_version, Some(609685));
+        assert_eq!(sp.next_savepoint_version, Some(609686));
+        assert_eq!(sp.last_snapshot_version, Some(609683));
+        assert_eq!(
+            sp.restart_redo_log_position.as_deref(),
+            Some("0x33cb84d9ca6")
+        );
+        assert_eq!(sp.source_line, Some(1));
+    }
+
+    #[test]
+    fn detects_snapshot_with_kind_and_dropped() {
+        let input = sp_line(
+            "2026-06-03 20:04:04.157061",
+            "Snapshot current savepoint version: 609687, restart redo log position: 0x33cb9c4b4fb, next savepoint version: 609688, last snapshot SP version: 609687, kind: Replication",
+        );
+        let r = parse_hana_savepoints(&input, PATH);
+        assert_eq!(r.snapshot_count, 1);
+        assert_eq!(r.count, 0);
+        let sp = &r.savepoints[0];
+        assert_eq!(sp.kind, "Snapshot");
+        assert_eq!(sp.snapshot_kind.as_deref(), Some("Replication"));
+    }
+
+    #[test]
+    fn detects_dropped_version() {
+        let input = sp_line(
+            "2026-06-03 20:04:05.051147",
+            "Savepoint current savepoint version: 609688, restart redo log position: 0x33cb9c54daa, next savepoint version: 609689, last snapshot SP version: 609687, dropped: 609683",
+        );
+        let r = parse_hana_savepoints(&input, PATH);
+        assert_eq!(r.savepoints[0].dropped_version, Some(609683));
+    }
+
+    #[test]
+    fn flags_slow_callback_warning() {
+        let input = format!(
+            "[1312462]{{-1}}[-1/-1] 2026-06-04 21:44:46.620914 w Savepoint        SavepointImpl.cpp(05733) : Callback PersistenceSessionSavepointCallback::spBeginRestart() took 12384ms."
+        );
+        let r = parse_hana_savepoints(&input, PATH);
+        assert!(r.found);
+        assert_eq!(r.warnings.len(), 1);
+        let w = &r.warnings[0];
+        assert_eq!(w.r#type, "hana_savepoint_slow_callback");
+        assert_eq!(w.severity.as_deref(), Some("warning"));
+        assert!(w.message.contains("12.4s"));
+    }
+
+    #[test]
+    fn escalates_very_slow_callback_to_error() {
+        let input = "[1312462]{-1}[-1/-1] 2026-06-04 21:44:46.620914 w Savepoint        SavepointImpl.cpp(05733) : Callback X() took 75000ms.";
+        let r = parse_hana_savepoints(input, PATH);
+        assert_eq!(r.warnings[0].severity.as_deref(), Some("error"));
+    }
+
+    #[test]
+    fn flags_cadence_gap() {
+        let mut input = String::new();
+        input.push_str(&sp_line(
+            "2026-06-03 19:54:00.000000",
+            "Savepoint current savepoint version: 1, next savepoint version: 2, last snapshot SP version: 0",
+        ));
+        input.push('\n');
+        // ~20 min later — well over the 3x300s gap threshold.
+        input.push_str(&sp_line(
+            "2026-06-03 20:14:00.000000",
+            "Savepoint current savepoint version: 2, next savepoint version: 3, last snapshot SP version: 0",
+        ));
+        let r = parse_hana_savepoints(&input, PATH);
+        assert_eq!(r.count, 2);
+        assert!(r
+            .warnings
+            .iter()
+            .any(|w| w.r#type == "hana_savepoint_cadence_gap"));
+        assert!(r.max_interval_s.unwrap() > 1000.0);
+    }
+
+    #[test]
+    fn ignores_non_savepoint_content() {
+        let input = "[123]{-1}[-1/-1] 2026-06-03 19:54:09.350130 i Logger SomeOther.cpp(01) : nothing here\nplain text line";
+        let r = parse_hana_savepoints(input, PATH);
+        assert!(!r.found);
+        assert_eq!(r.count, 0);
+        assert!(r.savepoints.is_empty());
+    }
+
+    #[test]
+    fn json_wrapper_fills_source_path() {
+        let input = sp_line(
+            "2026-06-03 19:54:09.350130",
+            "Savepoint current savepoint version: 1, next savepoint version: 2, last snapshot SP version: 0",
+        );
+        let json = parse_hana_savepoints_json(&input, PATH);
+        assert!(json.contains("\"found\":true"));
+        assert!(json.contains(PATH));
+    }
+
+    // ----- Deadlocks -----------------------------------------------------
+
+    const ALERT_PATH: &str = "T31 HANA Logs/indexserver_alert_vmltmdbuspd01.trc";
+
+    fn deadlock_block(ts: &str, victim_obj: &str, stmt_hash: &str) -> String {
+        format!(
+            "[1528819]{{303164}}[1551/16004765485] {ts} e Lock             WaitGraph.cc(00250) : \n  Deadlock detected\n   - Deadlock cycle\n    [(victim) CONNID=303164, SESSIONID=303164, CLIENT_HOST=VMLTMAPUSPD07, CLIENT_IP=10.105.10.76, CLIENT_PID=1467392, APPUSER = ZWLATMTMS, DBUSER=SAPHANADB, ID=1551, UPDATE_TRANSACTION_ID=16004765485, TYPE=USER, STATE=ACTIVE, ISOLATION_LEVEL=RC, LOCK_TYPE=RECORD_LOCK, ACQ_LOCK_MODE=NON_KEY_EXCLUSIVE, REQ_LOCK_MODE=NON_KEY_EXCLUSIVE, OBJECT_ID=29593135, OBJECT_NAME={victim_obj}, RECORD_ID=[KEY=E20DF99BBBE981FC, HASH=1C95F99BBBC99C20], WAITING_PART_ID=0, WAITING_PHYSICAL_PART_ID=0, IS_HESITANT_LOCK=false, APPLICATION_SOURCE=SAPLSZA0:47846, STMT_HASH={stmt_hash}, STMT=UPDATE \"ADR2\" SET \"COUNTRY\" = ? WHERE \"CLIENT\" = ?]\n    [CONNID=302171, SESSIONID=302171, CLIENT_HOST=VMLTMAPUSPD03, CLIENT_IP=10.105.10.53, APPUSER = ZWLATMTMS, DBUSER=SAPHANADB, ID=586, LOCK_TYPE=RECORD_LOCK, OBJECT_ID=29593135, OBJECT_NAME={victim_obj}, STMT_HASH={stmt_hash}, STMT=UPDATE \"ADR2\" SET \"COUNTRY\" = ? WHERE \"CLIENT\" = ?]"
+        )
+    }
+
+    #[test]
+    fn detects_deadlock_with_victim_and_objects() {
+        let input = deadlock_block(
+            "2026-06-01 13:41:24.116632",
+            "SAPHANADB:ADR2",
+            "259829e7fca4f2c336f63a2447378053",
+        );
+        let r = parse_hana_deadlocks(&input, ALERT_PATH);
+        assert!(r.found);
+        assert_eq!(r.count, 1);
+        let d = &r.deadlocks[0];
+        assert_eq!(d.participant_count, 2);
+        assert_eq!(d.objects, vec!["SAPHANADB:ADR2".to_string()]);
+        let v = d.victim.as_ref().unwrap();
+        assert!(v.is_victim);
+        assert_eq!(v.conn_id.as_deref(), Some("303164"));
+        assert_eq!(v.client_host.as_deref(), Some("VMLTMAPUSPD07"));
+        assert_eq!(v.app_user.as_deref(), Some("ZWLATMTMS"));
+        assert_eq!(v.object_name.as_deref(), Some("SAPHANADB:ADR2"));
+        assert_eq!(v.lock_type.as_deref(), Some("RECORD_LOCK"));
+        assert_eq!(v.stmt_hash.as_deref(), Some("259829e7fca4f2c336f63a2447378053"));
+        assert!(v.statement.as_deref().unwrap().starts_with("UPDATE"));
+        assert_eq!(r.top_objects[0].name, "SAPHANADB:ADR2");
+        assert_eq!(r.top_objects[0].count, 1);
+        assert_eq!(r.warnings[0].r#type, "hana_deadlocks_detected");
+        assert_eq!(r.warnings[0].severity.as_deref(), Some("warning"));
+    }
+
+    #[test]
+    fn escalates_many_deadlocks_to_error() {
+        let mut input = String::new();
+        for _ in 0..DEADLOCK_ERROR_COUNT {
+            input.push_str(&deadlock_block(
+                "2026-06-01 13:41:24.116632",
+                "SAPHANADB:ADR2",
+                "259829e7fca4f2c336f63a2447378053",
+            ));
+            input.push('\n');
+        }
+        let r = parse_hana_deadlocks(&input, ALERT_PATH);
+        assert_eq!(r.count, DEADLOCK_ERROR_COUNT);
+        assert_eq!(r.warnings[0].severity.as_deref(), Some("error"));
+    }
+
+    #[test]
+    fn ignores_non_deadlock_lock_lines() {
+        let input = "[123]{1}[1/1] 2026-06-01 13:41:24.116632 e Lock WaitGraph.cc(00250) : \n  Some other lock note";
+        let r = parse_hana_deadlocks(input, ALERT_PATH);
+        assert!(!r.found);
+        assert_eq!(r.count, 0);
+    }
+
+    // ----- Out of memory -------------------------------------------------
+
+    #[test]
+    fn detects_oom_event() {
+        let input = "[1335394]{-1}[-1/-1] 2026-06-04 17:32:51.297072 e Memory           mmReportMemoryProblems.cpp(02088) : OUT OF MEMORY occurred.\nMemoryType: NearDRAM\nHost: vmltmdbuspd01\nExecutable: hdbindexserver\nPID: 1312305\nFailed to allocate 64mb (67108864b).\nAllocation failure type: GLOBAL_ALLOCATION_LIMIT\nGLOBAL_ALLOCATION_LIMIT (GAL) = 3.62tb (3983937077248b), SHARED_MEMORY = 50.62gb (54358601728b)\n[1335395]{-1}[-1/-1] 2026-06-04 17:32:52.000000 i Logger Other.cpp(01) : next record";
+        let r = parse_hana_oom(input, ALERT_PATH);
+        assert!(r.found);
+        assert_eq!(r.count, 1);
+        let e = &r.events[0];
+        assert_eq!(e.memory_type.as_deref(), Some("NearDRAM"));
+        assert_eq!(e.host.as_deref(), Some("vmltmdbuspd01"));
+        assert_eq!(e.executable.as_deref(), Some("hdbindexserver"));
+        assert_eq!(e.pid.as_deref(), Some("1312305"));
+        assert_eq!(e.failed_alloc_bytes, Some(67108864));
+        assert_eq!(e.failure_type.as_deref(), Some("GLOBAL_ALLOCATION_LIMIT"));
+        assert_eq!(e.global_allocation_limit_bytes, Some(3983937077248));
+        assert_eq!(r.warnings[0].r#type, "hana_out_of_memory");
+        assert_eq!(r.warnings[0].severity.as_deref(), Some("error"));
+    }
+
+    #[test]
+    fn ignores_non_oom_memory_lines() {
+        let input = "[1]{-1}[-1/-1] 2026-06-04 17:32:51.297072 i Memory mm.cpp(01) : routine memory note";
+        let r = parse_hana_oom(input, ALERT_PATH);
+        assert!(!r.found);
+    }
+
+    // ----- Merge / compression errors ------------------------------------
+
+    #[test]
+    fn detects_merge_token_exhaustion() {
+        let input = "[2564393]{-1}[-1/9223372036854775806] 2026-06-04 22:06:50.349323 e delta_merge      CsTableMerge.cpp(02527) : Error in local merge: not enough merge tokens for delta merge or optimize compression : table = T31::SAPHANADB:/1DH/ML000000006 (t 551461), merge motivation = AutoMerge, rc = 2465";
+        let r = parse_hana_merge_errors(input, ALERT_PATH);
+        assert!(r.found);
+        assert_eq!(r.count, 1);
+        assert_eq!(r.merge_error_count, 1);
+        assert_eq!(r.compression_error_count, 0);
+        assert_eq!(r.token_exhaustion_count, 1);
+        let e = &r.errors[0];
+        assert_eq!(e.component, "delta_merge");
+        assert_eq!(e.table.as_deref(), Some("T31::SAPHANADB:/1DH/ML000000006"));
+        assert_eq!(e.table_id, Some(551461));
+        assert_eq!(e.motivation.as_deref(), Some("AutoMerge"));
+        assert_eq!(e.rc.as_deref(), Some("2465"));
+        assert_eq!(r.top_tables[0].name, "T31::SAPHANADB:/1DH/ML000000006");
+        assert_eq!(r.warnings[0].r#type, "hana_merge_failures");
+        assert!(r.warnings[0].message.contains("2465"));
+    }
+
+    #[test]
+    fn detects_optimize_compression_failure() {
+        let input = "[2495755]{-1}[-1/-1] 2026-06-04 22:20:41.621698 e optimize_compres RedoMerge.cpp(02512) : Last concurrent optimize compression failed: table = T31::SAPHANADB:/1DH/ML00000000A (t 562676), container id = 0xfe5225497c, last savepoint pos = 3562287544226";
+        let r = parse_hana_merge_errors(input, ALERT_PATH);
+        assert_eq!(r.compression_error_count, 1);
+        assert_eq!(r.merge_error_count, 0);
+        assert_eq!(r.token_exhaustion_count, 0);
+        assert_eq!(r.errors[0].component, "optimize_compres");
+        assert_eq!(r.errors[0].table_id, Some(562676));
+    }
+
+    #[test]
+    fn merge_json_wrapper_fills_source_path() {
+        let input = "[1]{-1}[-1/1] 2026-06-04 22:06:50.349323 e delta_merge CsTableMerge.cpp(02527) : Error in local merge: not enough merge tokens : table = T31::SAPHANADB:FOO (t 1), merge motivation = AutoMerge, rc = 2465";
+        let json = parse_hana_merge_errors_json(input, ALERT_PATH);
+        assert!(json.contains("\"found\":true"));
+        assert!(json.contains(ALERT_PATH));
+    }
+}
diff --git a/rca-tool/lib/supportfile_core/src/parsers/mod.rs b/rca-tool/lib/supportfile_core/src/parsers/mod.rs
new file mode 100644
index 0000000..a40d6d8
--- /dev/null
+++ b/rca-tool/lib/supportfile_core/src/parsers/mod.rs
@@ -0,0 +1,42 @@
+pub mod automation;
+pub mod azure;
+pub mod cluster;
+pub mod debugfs;
+pub mod events;
+pub mod hana;
+pub mod network_interfaces;
+pub mod networking;
+pub mod packages;
+pub mod services;
+pub mod storage;
+pub mod unix;
+pub mod vmcore;
+
+/// Recursively set the `source_path` field on every JSON object inside `value`
+/// to `source_path` whenever the object already has the field present and it
+/// is currently an empty string. Used by parser `_json` wrappers so that nested
+/// records (warnings, sub-records, etc.) inherit the wrapper's source path
+/// without each parser having to stamp them inline.
+pub(crate) fn fill_source_path(value: &mut serde_json::Value, source_path: &str) {
+    match value {
+        serde_json::Value::Object(map) => {
+            if let Some(serde_json::Value::String(s)) = map.get("source_path") {
+                if s.is_empty() {
+                    map.insert(
+                        "source_path".to_string(),
+                        serde_json::Value::String(source_path.to_string()),
+                    );
+                }
+            }
+            for (_, v) in map.iter_mut() {
+                fill_source_path(v, source_path);
+            }
+        }
+        serde_json::Value::Array(arr) => {
+            for v in arr.iter_mut() {
+                fill_source_path(v, source_path);
+            }
+        }
+        _ => {}
+    }
+}
diff --git a/rca-tool/lib/supportfile_core/src/parsers/network_interfaces.rs b/rca-tool/lib/supportfile_core/src/parsers/network_interfaces.rs
new file mode 100644
index 0000000..2c61ed6
--- /dev/null
+++ b/rca-tool/lib/supportfile_core/src/parsers/network_interfaces.rs
@@ -0,0 +1,907 @@
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeMap;
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct IpAddressInfo {
+    pub address: String,
+    pub scope: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source_file: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub line_number: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct InterfaceInfo {
+    pub name: String,
+    pub state: Option<String>,
+    pub mac: Option<String>,
+    pub mtu: Option<i64>,
+    pub ipv4: Vec<IpAddressInfo>,
+    pub ipv6: Vec<IpAddressInfo>,
+    pub driver: Option<String>,
+    pub driver_info: Option<String>,
+    pub accel_net: bool,
+    pub bootproto: Option<String>,
+    pub master: Option<String>,
+    pub iface_type: Option<String>,
+    pub firmware_version: Option<String>,
+    pub bus_info: Option<String>,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct NetworkInterfacesResult {
+    pub found: bool,
+    pub interfaces: BTreeMap<String, InterfaceInfo>,
+    pub source_path: String,
+}
+
+fn classify_driver(driver_name: &str) -> (String, bool) {
+    match driver_name.trim() {
+        "mlx4_core" | "mlx4_en" => ("Mellanox ConnectX-3 (mlx4)".to_string(), true),
+        "mlx5_core" => ("Mellanox ConnectX-4/5/6 (mlx5)".to_string(), true),
+        "mana" => ("Microsoft Azure Network Adapter (MANA)".to_string(), true),
+        "hv_netvsc" => ("Hyper-V NetVSC (synthetic)".to_string(), false),
+        other => (other.to_string(), false),
+    }
+}
+
+fn ensure_iface<'a>(
+    result: &'a mut NetworkInterfacesResult,
+    name: &str,
+    source_path: &str,
+    source_line: Option<usize>,
+) -> &'a mut InterfaceInfo {
+    result
+        .interfaces
+        .entry(name.to_string())
+        .or_insert_with(|| InterfaceInfo {
+            name: name.to_string(),
+            state: None,
+            mac: None,
+            mtu: None,
+            ipv4: Vec::new(),
+            ipv6: Vec::new(),
+            driver: None,
+            driver_info: None,
+            accel_net: false,
+            bootproto: None,
+            master: None,
+            iface_type: None,
+            firmware_version: None,
+            bus_info: None,
+            source_path: source_path.to_string(),
+            source_line,
+        })
+}
+
+fn add_ipv4(iface: &mut InterfaceInfo, address: String, scope: String) {
+    if !iface.ipv4.iter().any(|a| a.address == address) {
+        iface.ipv4.push(IpAddressInfo {
+            address,
+            scope,
+            source: None,
+            source_file: None,
+            line_number: None,
+        });
+    }
+}
+
+fn add_ipv6(iface: &mut InterfaceInfo, address: String, scope: String) {
+    if !iface.ipv6.iter().any(|a| a.address == address) {
+        iface.ipv6.push(IpAddressInfo {
+            address,
+            scope,
+            source: None,
+            source_file: None,
+            line_number: None,
+        });
+    }
+}
+
+/// Split SCC supportconfig content into sections delimited by `#==[ ... ]==`
+/// markers. Each section is `(heading, body)` where heading is the first
+/// `# <heading>` line after the marker and body is everything until the next
+/// marker.
+fn extract_scc_sections(content: &str) -> Vec<(String, String)> {
+    let marker_re = crate::cached_regex!(r"^#==\[.*\]==");
+    let mut sections: Vec<(String, String)> = Vec::new();
+    let mut current_heading: Option<String> = None;
+    let mut current_body: Vec<String> = Vec::new();
+    let mut expect_heading = false;
+    for line in content.lines() {
+        if marker_re.is_match(line) {
+            if let Some(h) = current_heading.take() {
+                sections.push((h, current_body.join("\n")));
+                current_body.clear();
+            }
+            expect_heading = true;
+            continue;
+        }
+        if expect_heading {
+            if let Some(stripped) = line.strip_prefix("# ") {
+                current_heading = Some(stripped.trim().to_string());
+                expect_heading = false;
+                continue;
+            } else if line.starts_with('#') {
+                current_heading = Some(line.trim_start_matches('#').trim().to_string());
+                expect_heading = false;
+                continue;
+            }
+        }
+        if current_heading.is_some() {
+            current_body.push(line.to_string());
+        }
+    }
+    if let Some(h) = current_heading.take() {
+        sections.push((h, current_body.join("\n")));
+    }
+    sections
+}
+
+fn parse_ip_addr_block(content: &str, result: &mut NetworkInterfacesResult, source_path: &str) {
+    let iface_re = crate::cached_regex!(r"^\d+:\s+(\S+?):\s+<([^>]*)>\s*(.*)");
+    let oneline_re =
+        crate::cached_regex!(r"^\d+:\s+(\S+)\s+(inet6?)\s+(\S+)(?:\s+brd\s+\S+)?\s+scope\s+(\S+)");
+    let mac_re = crate::cached_regex!(r"link/ether\s+([0-9a-f:]+)");
+    let inet_re = crate::cached_regex!(r"inet\s+(\S+)\s+(?:brd\s+\S+\s+)?scope\s+(\S+)");
+    let inet6_re = crate::cached_regex!(r"inet6\s+(\S+)\s+scope\s+(\S+)");
+    let state_re = crate::cached_regex!(r"state\s+(\S+)");
+    let mtu_re = crate::cached_regex!(r"mtu\s+(\d+)");
+    let master_re = crate::cached_regex!(r"master\s+(\S+)");
+    let mut current_iface_name: Option<String> = None;
+    for (line_idx, line) in content.lines().enumerate() {
+        let line_no = line_idx + 1;
+        // Try `ip -o addr` single-line format first.
+        if let Some(caps) = oneline_re.captures(line) {
+            let name = caps
+                .get(1)
+                .map(|m| {
+                    m.as_str()
+                        .split('@')
+                        .next()
+                        .unwrap_or(m.as_str())
+                        .to_string()
+                })
+                .unwrap_or_default();
+            let family = caps.get(2).map(|m| m.as_str()).unwrap_or("inet");
+            let addr = caps
+                .get(3)
+                .map(|m| m.as_str().to_string())
+                .unwrap_or_default();
+            let scope = caps
+                .get(4)
+                .map(|m| m.as_str().to_string())
+                .unwrap_or_else(|| "global".to_string());
+            if name != "lo" {
+                let iface = ensure_iface(result, &name, source_path, Some(line_no));
+                if family == "inet6" {
+                    add_ipv6(iface, addr, scope);
+                } else {
+                    add_ipv4(iface, addr, scope);
+                }
+                if iface.iface_type.is_none() {
+                    iface.iface_type = Some("ethernet".to_string());
+                }
+                if iface.state.is_none() {
+                    iface.state = Some("UP".to_string());
+                }
+                result.found = true;
+            }
+            continue;
+        }
+        if let Some(caps) = iface_re.captures(line) {
+            let name = caps
+                .get(1)
+                .map(|m| {
+                    m.as_str()
+                        .split('@')
+                        .next()
+                        .unwrap_or(m.as_str())
+                        .to_string()
+                })
+                .unwrap_or_default();
+            let flags = caps.get(2).map(|m| m.as_str()).unwrap_or_default();
+            let rest = caps.get(3).map(|m| m.as_str()).unwrap_or_default();
+            let iface = ensure_iface(result, &name, source_path, Some(line_no));
+            iface.state = if let Some(state_caps) = state_re.captures(rest) {
+                state_caps.get(1).map(|m| m.as_str().to_string())
+            } else if flags.contains("UP") {
+                Some("UP".to_string())
+            } else {
+                Some("DOWN".to_string())
+            };
+            iface.mtu = mtu_re
+                .captures(rest)
+                .and_then(|c| c.get(1).and_then(|m| m.as_str().parse::<i64>().ok()));
+            iface.iface_type = if flags.contains("LOOPBACK") {
+                Some("loopback".to_string())
+            } else if flags.contains("SLAVE") {
+                Some("linked".to_string())
+            } else {
+                Some("ethernet".to_string())
+            };
+            iface.master = master_re
+                .captures(rest)
+                .and_then(|c| c.get(1).map(|m| m.as_str().to_string()));
+            current_iface_name = Some(name);
+            result.found = true;
+            continue;
+        }
+        if let Some(iface_name) = current_iface_name.clone() {
+            let iface = ensure_iface(result, &iface_name, source_path, None);
+            if let Some(caps) = mac_re.captures(line) {
+                iface.mac = caps.get(1).map(|m| m.as_str().to_string());
+                continue;
+            }
+            if let Some(caps) = inet_re.captures(line) {
+                add_ipv4(
+                    iface,
+                    caps.get(1)
+                        .map(|m| m.as_str().to_string())
+                        .unwrap_or_default(),
+                    caps.get(2)
+                        .map(|m| m.as_str().to_string())
+                        .unwrap_or_else(|| "global".to_string()),
+                );
+                continue;
+            }
+            if let Some(caps) = inet6_re.captures(line) {
+                add_ipv6(
+                    iface,
+                    caps.get(1)
+                        .map(|m| m.as_str().to_string())
+                        .unwrap_or_default(),
+                    caps.get(2)
+                        .map(|m| m.as_str().to_string())
+                        .unwrap_or_else(|| "link".to_string()),
+                );
+                continue;
+            }
+        }
+    }
+}
+
+fn parse_ethtool_block(
+    content: &str,
+    result: &mut NetworkInterfacesResult,
+    iface_name: &str,
+    source_path: &str,
+) {
+    if content.is_empty() {
+        return;
+    }
+    if crate::cached_regex!(r"(?i)Cannot get driver|not supported").is_match(content) {
+        return;
+    }
+    let driver_re = crate::cached_regex!(r"(?m)^driver:\s*(\S+)");
+    let firmware_re = crate::cached_regex!(r"(?m)^firmware-version:\s*(.+)$");
+    let bus_re = crate::cached_regex!(r"(?m)^bus-info:\s*(\S+)");
+    let iface = ensure_iface(result, iface_name, source_path, None);
+    if let Some(caps) = driver_re.captures(content) {
+        let driver = caps
+            .get(1)
+            .map(|m| m.as_str().to_string())
+            .unwrap_or_default();
+        let (label, accel) = classify_driver(&driver);
+        iface.driver = Some(driver);
+        iface.driver_info = Some(label);
+        iface.accel_net = accel;
+    }
+    if let Some(caps) = firmware_re.captures(content) {
+        iface.firmware_version = caps.get(1).map(|m| m.as_str().trim().to_string());
+    }
+    if let Some(caps) = bus_re.captures(content) {
+        iface.bus_info = caps.get(1).map(|m| m.as_str().trim().to_string());
+    }
+    result.found = true;
+}
+
+fn parse_ifcfg_block(
+    content: &str,
+    result: &mut NetworkInterfacesResult,
+    iface_name: &str,
+    source_path: &str,
+) {
+    let bootproto_re = crate::cached_regex!(r#"(?m)^BOOTPROTO\s*=\s*['"]?([^'"\n]+)"#);
+    let ipaddr_re = crate::cached_regex!(r#"(?m)^IPADDR\s*=\s*['"]?([^'"\n]+)"#);
+    let prefix_re = crate::cached_regex!(r#"(?m)^(?:PREFIX|PREFIXLEN)\s*=\s*['"]?([^'"\n]+)"#);
+    let netmask_re = crate::cached_regex!(r#"(?m)^NETMASK\s*=\s*['"]?([^'"\n]+)"#);
+    let iface = ensure_iface(result, iface_name, source_path, None);
+    if let Some(boot) = bootproto_re
+        .captures(content)
+        .and_then(|c| c.get(1).map(|m| m.as_str().trim().to_ascii_lowercase()))
+    {
+        iface.bootproto = Some(boot);
+    }
+    if let Some(ip) = ipaddr_re
+        .captures(content)
+        .and_then(|c| c.get(1).map(|m| m.as_str().trim().to_string()))
+    {
+        let prefix = prefix_re
+            .captures(content)
+            .and_then(|c| c.get(1).map(|m| m.as_str().trim().to_string()));
+        let addr = if let Some(prefix) = prefix {
+            format!("{}/{}", ip, prefix)
+        } else if netmask_re.captures(content).is_some() {
+            ip
+        } else {
+            ip
+        };
+        add_ipv4(iface, addr, "global".to_string());
+    }
+    result.found = true;
+}
+
+fn iface_from_filename(source_path: &str) -> Option<(String, &'static str)> {
+    // Returns (iface_name, kind) where kind is one of "ethtool" | "ifcfg".
+    let name = source_path.rsplit('/').next().unwrap_or(source_path);
+    if let Some(rest) = name.strip_prefix("ethtool_-i_") {
+        if !rest.is_empty() {
+            return Some((rest.to_string(), "ethtool"));
+        }
+    }
+    if let Some(rest) = name.strip_prefix("ifcfg-") {
+        if !rest.is_empty() {
+            return Some((rest.to_string(), "ifcfg"));
+        }
+    }
+    None
+}
+
+/// Convert a dotted IPv4 netmask (e.g. "255.255.254.0") into a CIDR prefix.
+/// Returns None if the input is not a valid mask.
+fn dotted_mask_to_cidr(mask: &str) -> Option<u8> {
+    let octets: Result<Vec<u8>, _> = mask.split('.').map(|o| o.parse::<u8>()).collect();
+    let octets = octets.ok()?;
+    if octets.len() != 4 {
+        return None;
+    }
+    let bits: u8 = octets.iter().map(|o| o.count_ones() as u8).sum();
+    Some(bits)
+}
+
+/// Parse cloud-init `ci-info` Net device info tables from log files
+/// (`/var/log/messages` or `/var/log/cloud-init-output.log`). If multiple
+/// boot cycles are present, only the LAST block is applied.
+fn parse_cloud_init_ci_info(
+    content: &str,
+    result: &mut NetworkInterfacesResult,
+    source_path: &str,
+) {
+    let net_dev_re = crate::cached_regex!(r"(?i)ci-info:.*Net device info");
+    let pipe_re = crate::cached_regex!(r"ci-info:.*\|");
+    let route_re = crate::cached_regex!(r"(?i)ci-info:.*Route\s+IPv[46]\s+info");
+    let separator_re = crate::cached_regex!(r"ci-info:.*\+[-+]+\+");
+    let row_re = crate::cached_regex!(r"ci-info:\s*\|(.+)\|");
+
+    let mut blocks: Vec<Vec<(String, usize)>> = Vec::new();
+    let mut in_block = false;
+    let mut current: Vec<(String, usize)> = Vec::new();
+
+    for (idx, line) in content.lines().enumerate() {
+        let line_no = idx + 1;
+        if net_dev_re.is_match(line) {
+            in_block = true;
+            current.clear();
+            continue;
+        }
+        if in_block {
+            if pipe_re.is_match(line) {
+                current.push((line.to_string(), line_no));
+            } else if route_re.is_match(line) {
+                if !current.is_empty() {
+                    blocks.push(std::mem::take(&mut current));
+                }
+                in_block = false;
+            } else if separator_re.is_match(line) {
+                continue;
+            } else {
+                if !current.is_empty() {
+                    blocks.push(std::mem::take(&mut current));
+                }
+                in_block = false;
+            }
+        }
+    }
+    if in_block && !current.is_empty() {
+        blocks.push(current);
+    }
+    if blocks.is_empty() {
+        return;
+    }
+
+    let last = blocks.last().unwrap();
+    // Find header row containing "Device".
+    let header_entry = match last.iter().find(|(t, _)| t.contains("Device")) {
+        Some(h) => h,
+        None => return,
+    };
+    let extract = |line: &str| -> Option<Vec<String>> {
+        row_re.captures(line).map(|c| {
+            c.get(1)
+                .map(|m| {
+                    m.as_str()
+                        .split('|')
+                        .map(|s| s.trim().to_string())
+                        .collect()
+                })
+                .unwrap_or_default()
+        })
+    };
+    let header_cols = match extract(&header_entry.0) {
+        Some(c) => c,
+        None => return,
+    };
+
+    let mut col_device: Option<usize> = None;
+    let mut col_up: Option<usize> = None;
+    let mut col_address: Option<usize> = None;
+    let mut col_mask: Option<usize> = None;
+    let mut col_scope: Option<usize> = None;
+    let mut col_hw: Option<usize> = None;
+    for (i, name) in header_cols.iter().enumerate() {
+        let lc = name
+            .to_ascii_lowercase()
+            .chars()
+            .filter(|c| !matches!(c, '-' | '_' | ' '))
+            .collect::<String>();
+        match lc.as_str() {
+            "device" => col_device = Some(i),
+            "up" => col_up = Some(i),
+            "address" => col_address = Some(i),
+            "mask" => col_mask = Some(i),
+            "scope" => col_scope = Some(i),
+            "hwaddress" => col_hw = Some(i),
+            _ => {}
+        }
+    }
+    let (Some(d_idx), Some(a_idx)) = (col_device, col_address) else {
+        return;
+    };
+
+    for (line, line_no) in last {
+        if line.contains("Device") {
+            continue;
+        }
+        let cols = match extract(line) {
+            Some(c) => c,
+            None => continue,
+        };
+        let device = cols.get(d_idx).cloned().unwrap_or_default();
+        if device.is_empty() || device == "." || device == "lo" {
+            continue;
+        }
+        let address = cols.get(a_idx).cloned().unwrap_or_else(|| ".".to_string());
+        if address.is_empty() || address == "." {
+            continue;
+        }
+        let mask = col_mask
+            .and_then(|i| cols.get(i).cloned())
+            .unwrap_or_else(|| ".".to_string());
+        let scope = col_scope
+            .and_then(|i| cols.get(i).cloned())
+            .unwrap_or_else(|| ".".to_string());
+        let hw = col_hw
+            .and_then(|i| cols.get(i).cloned())
+            .unwrap_or_else(|| ".".to_string());
+
+        let iface = ensure_iface(result, &device, source_path, None);
+        if hw != "." && !hw.is_empty() && iface.mac.is_none() {
+            iface.mac = Some(hw);
+        }
+        if let Some(up_idx) = col_up {
+            if let Some(up) = cols.get(up_idx) {
+                if up.eq_ignore_ascii_case("true") {
+                    iface.state = Some("UP".to_string());
+                }
+            }
+        }
+
+        let is_ipv6 = address.contains(':') && !address.starts_with("127.");
+        if is_ipv6 {
+            let scope_val = if scope != "." {
+                scope.clone()
+            } else {
+                "link".to_string()
+            };
+            if !iface.ipv6.iter().any(|a| a.address == address) {
+                iface.ipv6.push(IpAddressInfo {
+                    address: address.clone(),
+                    scope: scope_val,
+                    source: Some("cloud-init".to_string()),
+                    source_file: Some(source_path.to_string()),
+                    line_number: Some(*line_no),
+                });
+            }
+        } else {
+            let addr = if mask != "." && !mask.is_empty() {
+                if let Some(cidr) = dotted_mask_to_cidr(&mask) {
+                    format!("{}/{}", address, cidr)
+                } else {
+                    address.clone()
+                }
+            } else {
+                address.clone()
+            };
+            let scope_val = if scope != "." {
+                scope.clone()
+            } else {
+                "global".to_string()
+            };
+            if !iface.ipv4.iter().any(|a| a.address.starts_with(&address)) {
+                iface.ipv4.push(IpAddressInfo {
+                    address: addr,
+                    scope: scope_val,
+                    source: Some("cloud-init".to_string()),
+                    source_file: Some(source_path.to_string()),
+                    line_number: Some(*line_no),
+                });
+            }
+        }
+    }
+    result.found = true;
+}
+
+pub fn parse_network_interfaces(content: &str, source_path: &str) -> NetworkInterfacesResult {
+    let mut result = NetworkInterfacesResult {
+        found: false,
+        interfaces: BTreeMap::new(),
+        source_path: source_path.to_string(),
+    };
+
+    if content.trim().is_empty() {
+        return result;
+    }
+
+    // Per-file dispatch by filename: ethtool_-i_<iface>, ifcfg-<iface>.
+    if let Some((iface_name, kind)) = iface_from_filename(source_path) {
+        match kind {
+            "ethtool" => {
+                parse_ethtool_block(content, &mut result, &iface_name, source_path);
+                return result;
+            }
+            "ifcfg" => {
+                parse_ifcfg_block(content, &mut result, &iface_name, source_path);
+                return result;
+            }
+            _ => {}
+        }
+    }
+
+    // SOS `ip -o addr` and `ip addr show` standalone files.
+    let basename = source_path.rsplit('/').next().unwrap_or(source_path);
+    if basename == "ip_-o_addr" || basename == "ip_addr" || basename == "ip_-s_-d_link" {
+        parse_ip_addr_block(content, &mut result, source_path);
+        return result;
+    }
+
+    // Log files containing cloud-init `ci-info` Net device tables.
+    if basename == "messages" || basename == "cloud-init-output.log" {
+        if crate::cached_regex!(r"(?i)ci-info:.*Net device info").is_match(content) {
+            parse_cloud_init_ci_info(content, &mut result, source_path);
+        }
+        return result;
+    }
+
+    // SCC supportconfig network.txt: dispatch by section heading.
+    if content.contains("#==[") {
+        for (heading, body) in extract_scc_sections(content) {
+            let h = heading.as_str();
+            let body_trimmed = body.trim();
+            if body_trimmed.is_empty() {
+                continue;
+            }
+            // ip addr (but not 'ip addr show type ...')
+            let ip_addr_re = crate::cached_regex!(r"\bip\s+addr\b");
+            let ip_addr_show_type_re = crate::cached_regex!(r"ip\s+addr\s+show\s+type");
+            if ip_addr_re.is_match(h) && !ip_addr_show_type_re.is_match(h) {
+                parse_ip_addr_block(&body, &mut result, source_path);
+                continue;
+            }
+            // ethtool -i <iface>
+            if let Some(caps) = crate::cached_regex!(r"ethtool\s+-i\s+(\w+)").captures(h) {
+                let iface_name = caps
+                    .get(1)
+                    .map(|m| m.as_str().to_string())
+                    .unwrap_or_default();
+                if !iface_name.is_empty() {
+                    parse_ethtool_block(&body, &mut result, &iface_name, source_path);
+                }
+                continue;
+            }
+            // ifcfg-<iface>
+            if let Some(caps) = crate::cached_regex!(r"ifcfg-(\S+)").captures(h) {
+                let iface_name = caps
+                    .get(1)
+                    .map(|m| m.as_str().to_string())
+                    .unwrap_or_default();
+                if !iface_name.is_empty() {
+                    parse_ifcfg_block(&body, &mut result, &iface_name, source_path);
+                }
+                continue;
+            }
+        }
+        // After SCC dispatch, fall through to also try generic line-by-line parsing
+        // for any remaining content (e.g., nmcli/wicked/netplan blocks not covered above).
+    }
+
+    // Generic line-by-line parsing (handles ip addr standalone files, nmcli, wicked, netplan).
+    let iface_re = crate::cached_regex!(r"^\d+:\s+(\S+?):\s+<([^>]*)>\s*(.*)");
+    let mac_re = crate::cached_regex!(r"link/ether\s+([0-9a-f:]+)");
+    let inet_re = crate::cached_regex!(r"inet\s+(\S+)\s+(?:brd\s+\S+\s+)?scope\s+(\S+)");
+    let inet6_re = crate::cached_regex!(r"inet6\s+(\S+)\s+scope\s+(\S+)");
+    let driver_re = crate::cached_regex!(r"(?m)^driver:\s*(\S+)");
+    let firmware_re = crate::cached_regex!(r"(?m)^firmware-version:\s*(.+)$");
+    let bus_re = crate::cached_regex!(r"(?m)^bus-info:\s*(\S+)");
+    let device_re = crate::cached_regex!(r#"(?m)^DEVICE\s*=\s*['\"]?([^'\"\n]+)"#);
+    let bootproto_re = crate::cached_regex!(r#"(?m)^BOOTPROTO\s*=\s*['\"]?([^'\"\n]+)"#);
+    let ipaddr_re = crate::cached_regex!(r#"(?m)^IPADDR\s*=\s*['\"]?([^'\"\n]+)"#);
+    let prefix_re = crate::cached_regex!(r#"(?m)^(?:PREFIX|PREFIXLEN)\s*=\s*['\"]?([^'\"\n]+)"#);
+    let nmcli_iface_re = crate::cached_regex!(r"(?m)^connection\.interface-name:\s+(\S+)");
+    let nmcli_method_re = crate::cached_regex!(r"(?m)^ipv4\.method:\s+(\S+)");
+    let wicked_iface_re = crate::cached_regex!(r"^(\S+)\s+(up|down|setup-in-progress|enslaved)");
+    let wicked_lease_re = crate::cached_regex!(r"leases:\s+ipv4\s+(\S+)");
+    let netplan_iface_re = crate::cached_regex!(r"^\s{4}(\w+):");
+
+    let mut current_iface_name: Option<String> = None;
+    for (line_idx, line) in content.lines().enumerate() {
+        let line_no = line_idx + 1;
+        if let Some(caps) = iface_re.captures(line) {
+            let name = caps
+                .get(1)
+                .map(|m| {
+                    m.as_str()
+                        .split('@')
+                        .next()
+                        .unwrap_or(m.as_str())
+                        .to_string()
+                })
+                .unwrap_or_default();
+            let flags = caps.get(2).map(|m| m.as_str()).unwrap_or_default();
+            let rest = caps.get(3).map(|m| m.as_str()).unwrap_or_default();
+            let iface = ensure_iface(&mut result, &name, source_path, Some(line_no));
+            iface.state =
+                if let Some(state_caps) = crate::cached_regex!(r"state\s+(\S+)").captures(rest) {
+                    state_caps.get(1).map(|m| m.as_str().to_string())
+                } else if flags.contains("UP") {
+                    Some("UP".to_string())
+                } else {
+                    Some("DOWN".to_string())
+                };
+            iface.mtu = crate::cached_regex!(r"mtu\s+(\d+)")
+                .captures(rest)
+                .and_then(|c| c.get(1).and_then(|m| m.as_str().parse::<i64>().ok()));
+            iface.iface_type = if flags.contains("LOOPBACK") {
+                Some("loopback".to_string())
+            } else if flags.contains("SLAVE") {
+                Some("linked".to_string())
+            } else {
+                Some("ethernet".to_string())
+            };
+            iface.master = crate::cached_regex!(r"master\s+(\S+)")
+                .captures(rest)
+                .and_then(|c| c.get(1).map(|m| m.as_str().to_string()));
+            current_iface_name = Some(name);
+            result.found = true;
+            continue;
+        }
+
+        if let Some(iface_name) = current_iface_name.clone() {
+            let iface = ensure_iface(&mut result, &iface_name, source_path, None);
+            if let Some(caps) = mac_re.captures(line) {
+                iface.mac = caps.get(1).map(|m| m.as_str().to_string());
+                continue;
+            }
+            if let Some(caps) = inet_re.captures(line) {
+                add_ipv4(
+                    iface,
+                    caps.get(1)
+                        .map(|m| m.as_str().to_string())
+                        .unwrap_or_default(),
+                    caps.get(2)
+                        .map(|m| m.as_str().to_string())
+                        .unwrap_or_else(|| "global".to_string()),
+                );
+                continue;
+            }
+            if let Some(caps) = inet6_re.captures(line) {
+                add_ipv6(
+                    iface,
+                    caps.get(1)
+                        .map(|m| m.as_str().to_string())
+                        .unwrap_or_default(),
+                    caps.get(2)
+                        .map(|m| m.as_str().to_string())
+                        .unwrap_or_else(|| "link".to_string()),
+                );
+                continue;
+            }
+            if let Some(caps) = driver_re.captures(line) {
+                let driver = caps
+                    .get(1)
+                    .map(|m| m.as_str().to_string())
+                    .unwrap_or_default();
+                let (label, accel) = classify_driver(&driver);
+                iface.driver = Some(driver);
+                iface.driver_info = Some(label);
+                iface.accel_net = accel;
+                continue;
+            }
+            if let Some(caps) = firmware_re.captures(line) {
+                iface.firmware_version = caps.get(1).map(|m| m.as_str().trim().to_string());
+                continue;
+            }
+            if let Some(caps) = bus_re.captures(line) {
+                iface.bus_info = caps.get(1).map(|m| m.as_str().trim().to_string());
+                continue;
+            }
+        }
+    }
+
+    if let Some(caps) = device_re.captures(content) {
+        let iface_name = caps.get(1).map(|m| m.as_str()).unwrap_or_default();
+        if iface_name != "lo" && iface_name != "template" {
+            let iface = ensure_iface(&mut result, iface_name, source_path, None);
+            if let Some(boot) = bootproto_re
+                .captures(content)
+                .and_then(|c| c.get(1).map(|m| m.as_str().to_ascii_lowercase()))
+            {
+                iface.bootproto = Some(boot);
+            }
+            if let Some(ip) = ipaddr_re
+                .captures(content)
+                .and_then(|c| c.get(1).map(|m| m.as_str().to_string()))
+            {
+                let prefix = prefix_re
+                    .captures(content)
+                    .and_then(|c| c.get(1).map(|m| m.as_str().to_string()));
+                let addr = if let Some(prefix) = prefix {
+                    format!("{}/{}", ip, prefix)
+                } else {
+                    ip
+                };
+                add_ipv4(iface, addr, "global".to_string());
+            }
+            result.found = true;
+        }
+    }
+
+    if let Some(caps) = nmcli_iface_re.captures(content) {
+        let iface_name = caps.get(1).map(|m| m.as_str()).unwrap_or_default();
+        let iface = ensure_iface(&mut result, iface_name, source_path, None);
+        if let Some(method) = nmcli_method_re
+            .captures(content)
+            .and_then(|c| c.get(1).map(|m| m.as_str().to_ascii_lowercase()))
+        {
+            iface.bootproto = Some(match method.as_str() {
+                "auto" => "dhcp".to_string(),
+                "manual" => "static".to_string(),
+                _ => method,
+            });
+        }
+        result.found = true;
+    }
+
+    let mut wicked_current: Option<String> = None;
+    for line in content.lines() {
+        if let Some(caps) = wicked_iface_re.captures(line) {
+            let name = caps.get(1).map(|m| m.as_str()).unwrap_or_default();
+            if name != "lo" {
+                let iface = ensure_iface(&mut result, name, source_path, None);
+                iface.state = Some(
+                    caps.get(2)
+                        .map(|m| m.as_str())
+                        .unwrap_or_default()
+                        .to_ascii_uppercase(),
+                );
+                wicked_current = Some(name.to_string());
+                result.found = true;
+            }
+            continue;
+        }
+        if let Some(name) = wicked_current.clone() {
+            if let Some(caps) = wicked_lease_re.captures(line) {
+                let lease = caps
+                    .get(1)
+                    .map(|m| m.as_str().to_ascii_lowercase())
+                    .unwrap_or_default();
+                let iface = ensure_iface(&mut result, &name, source_path, None);
+                iface.bootproto = Some(if lease == "dhcp" {
+                    "dhcp".to_string()
+                } else {
+                    "static".to_string()
+                });
+            }
+        }
+    }
+
+    let mut netplan_iface: Option<String> = None;
+    let mut in_ethernets = false;
+    for line in content.lines() {
+        if line.trim_start().starts_with("ethernets:") {
+            in_ethernets = true;
+            continue;
+        }
+        if in_ethernets {
+            if let Some(caps) = netplan_iface_re.captures(line) {
+                let name = caps.get(1).map(|m| m.as_str()).unwrap_or_default();
+                ensure_iface(&mut result, name, source_path, None);
+                netplan_iface = Some(name.to_string());
+                result.found = true;
+                continue;
+            }
+            if let Some(name) = netplan_iface.clone() {
+                let iface = ensure_iface(&mut result, &name, source_path, None);
+                if crate::cached_regex!(r"(?i)^\s*dhcp4:\s*(true|yes)").is_match(line) {
+                    iface.bootproto = Some("dhcp".to_string());
+                } else if crate::cached_regex!(r"(?i)^\s*dhcp4:\s*(false|no)").is_match(line) {
+                    iface.bootproto = Some("static".to_string());
+                }
+            }
+            if !line.starts_with(' ')
+                && !line.trim().is_empty()
+                && !line.trim_start().starts_with('#')
+            {
+                in_ethernets = false;
+                netplan_iface = None;
+            }
+        }
+    }
+
+    result
+}
+
+pub fn parse_network_interfaces_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_network_interfaces(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parses_ip_addr_and_driver_info() {
+        let input = concat!(
+            "2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP\n",
+            "    link/ether 00:11:22:33:44:55 brd ff:ff:ff:ff:ff:ff\n",
+            "    inet 10.0.0.4/24 brd 10.0.0.255 scope global eth0\n",
+            "    inet6 fe80::1/64 scope link\n",
+            "driver: mana\n",
+            "firmware-version: 1.2.3\n",
+            "bus-info: VMBUS:01\n"
+        );
+        let result = parse_network_interfaces(input, "sos_commands/networking/ip_-d_address");
+        assert!(result.found);
+        assert_eq!(result.source_path, "sos_commands/networking/ip_-d_address");
+        let eth0 = result.interfaces.get("eth0").expect("eth0 exists");
+        assert_eq!(eth0.state.as_deref(), Some("UP"));
+        assert_eq!(eth0.driver.as_deref(), Some("mana"));
+        assert!(eth0.accel_net);
+        assert_eq!(eth0.ipv4.len(), 1);
+        assert_eq!(eth0.source_path, "sos_commands/networking/ip_-d_address");
+        assert_eq!(eth0.source_line, Some(1));
+    }
+
+    #[test]
+    fn parses_bootproto_from_config() {
+        let input = concat!(
+            "DEVICE=eth1\n",
+            "BOOTPROTO=dhcp\n",
+            "IPADDR=192.168.1.10\n",
+            "PREFIX=24\n"
+        );
+        let result = parse_network_interfaces(input, "etc/sysconfig/network-scripts/ifcfg-eth1");
+        assert!(result.found);
+        let eth1 = result.interfaces.get("eth1").expect("eth1 exists");
+        assert_eq!(eth1.bootproto.as_deref(), Some("dhcp"));
+        assert_eq!(eth1.source_path, "etc/sysconfig/network-scripts/ifcfg-eth1");
+    }
+}
diff --git a/rca-tool/lib/supportfile_core/src/parsers/networking.rs b/rca-tool/lib/supportfile_core/src/parsers/networking.rs
new file mode 100644
index 0000000..042d0cd
--- /dev/null
+++ b/rca-tool/lib/supportfile_core/src/parsers/networking.rs
@@ -0,0 +1,1136 @@
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeMap;
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct FirewallWarning {
+    pub kind: String,
+    pub severity: String,
+    pub message: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct FirewalldInfo {
+    pub detected: bool,
+    pub running: bool,
+    pub backend: Option<String>,
+    pub zones: Option<String>,
+    pub direct_rules: Option<String>,
+    pub passthroughs: Option<String>,
+    pub chains: Option<String>,
+    pub log_denied: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct TableRulesInfo {
+    pub detected: bool,
+    pub rules: Vec<String>,
+    pub modules: Vec<String>,
+    pub config: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct NftablesInfo {
+    pub detected: bool,
+    pub ruleset: Option<String>,
+    pub tables: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct EbtablesInfo {
+    pub detected: bool,
+    pub config: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct FirewallRulesResult {
+    pub found: bool,
+    pub firewalld: FirewalldInfo,
+    pub iptables: TableRulesInfo,
+    pub ip6tables: TableRulesInfo,
+    pub ebtables: EbtablesInfo,
+    pub nftables: NftablesInfo,
+    pub active_firewall: String,
+    pub warnings: Vec<FirewallWarning>,
+    pub raw_sections: BTreeMap<String, String>,
+    pub source_path: String,
+}
+
+/// Find the 1-based line number of the first line whose contents satisfy the
+/// predicate. Returns None if no match.
+fn find_line<F: Fn(&str) -> bool>(content: &str, predicate: F) -> Option<usize> {
+    content
+        .lines()
+        .enumerate()
+        .find(|(_, line)| predicate(line))
+        .map(|(i, _)| i + 1)
+}
+
+pub fn parse_firewall_rules(content: &str, source_path: &str) -> FirewallRulesResult {
+    let mut result = FirewallRulesResult {
+        found: false,
+        firewalld: FirewalldInfo {
+            detected: false,
+            running: false,
+            backend: None,
+            zones: None,
+            direct_rules: None,
+            passthroughs: None,
+            chains: None,
+            log_denied: None,
+        },
+        iptables: TableRulesInfo {
+            detected: false,
+            rules: Vec::new(),
+            modules: Vec::new(),
+            config: None,
+        },
+        ip6tables: TableRulesInfo {
+            detected: false,
+            rules: Vec::new(),
+            modules: Vec::new(),
+            config: None,
+        },
+        ebtables: EbtablesInfo {
+            detected: false,
+            config: None,
+        },
+        nftables: NftablesInfo {
+            detected: false,
+            ruleset: None,
+            tables: None,
+        },
+        active_firewall: "none".to_string(),
+        warnings: Vec::new(),
+        raw_sections: BTreeMap::new(),
+        source_path: source_path.to_string(),
+    };
+
+    let trimmed = content.trim();
+    if trimmed.is_empty() {
+        return result;
+    }
+
+    if trimmed.contains("firewalld")
+        || trimmed.contains("firewall-cmd")
+        || trimmed.contains("FirewallBackend")
+    {
+        // Avoid false positives where the only mention is in a comment header
+        // (e.g. SCC `# rpm -V nftables-...` lines or rpm name strings).
+        let has_real_firewalld_signal = crate::cached_regex!(r"(?im)^[^#].*\bfirewalld\b|firewall-cmd|^FirewallBackend\s*=|FirewallD is not running|Active:\s*(active|inactive)").is_match(trimmed);
+        if has_real_firewalld_signal {
+            result.firewalld.detected = true;
+            result.found = true;
+        }
+
+        let active_re = crate::cached_regex!(r"(?im)Active:\s+active\s+\(running\)");
+        let running_only_re = crate::cached_regex!(r"(?im)^running$");
+        if active_re.is_match(trimmed) || running_only_re.is_match(trimmed) {
+            result.firewalld.running = true;
+        }
+        let inactive_re = crate::cached_regex!(r"(?i)Active:\s+inactive|FirewallD is not running");
+        if inactive_re.is_match(trimmed) {
+            result.firewalld.running = false;
+            let inactive_line = find_line(content, |line| inactive_re.is_match(line));
+            result.warnings.push(FirewallWarning {
+                kind: "firewalld_not_running".to_string(),
+                severity: "warning".to_string(),
+                message: "firewalld is not running".to_string(),
+                source_path: source_path.to_string(),
+                source_line: inactive_line,
+                source_line_end: inactive_line,
+            });
+        }
+
+        if let Some(caps) =
+            crate::cached_regex!(r"(?m)^FirewallBackend\s*=\s*(.+)$").captures(trimmed)
+        {
+            result.firewalld.backend = caps.get(1).map(|m| m.as_str().trim().to_string());
+        }
+        if trimmed.contains("(active)") || trimmed.contains("services:") {
+            result.firewalld.zones = Some(trimmed.to_string());
+        }
+        if trimmed.contains("--get-log-denied") {
+            result.firewalld.log_denied = Some(trimmed.to_string());
+        }
+    }
+
+    // Detect a real nftables ruleset – require an actual `table <fam> NAME {`
+    // declaration, not just a stray substring (avoids false positives from
+    // comment lines like `# /usr/sbin/nft list tables` or rpm names).
+    let nft_table_re =
+        crate::cached_regex!(r"(?m)^\s*table\s+(?:inet|ip|ip6|arp|bridge|netdev)\s+\S+\s*\{");
+    let has_nft_table = nft_table_re.is_match(trimmed);
+    if has_nft_table {
+        result.nftables.detected = true;
+        result.nftables.ruleset = Some(trimmed.to_string());
+        result
+            .raw_sections
+            .insert("nft -a list ruleset".to_string(), trimmed.to_string());
+        result.found = true;
+    }
+
+    if trimmed.contains("Chain INPUT") {
+        result.iptables.detected = true;
+        result.iptables.rules.push(trimmed.to_string());
+        result.found = true;
+    }
+    // Capture missing-module notices regardless of whether rules were found.
+    if let Some(caps) =
+        crate::cached_regex!(r"The\s+(\S+)\s+module is not loaded").captures(trimmed)
+    {
+        if let Some(module) = caps.get(1).map(|m| m.as_str().to_string()) {
+            result.iptables.modules.push(module);
+        }
+    }
+
+    if trimmed.contains("ip6tables") || trimmed.contains("Chain FORWARD") && trimmed.contains("v6")
+    {
+        // Only mark detected if there are actual chains/rules, not just a comment header.
+        if trimmed.contains("Chain ") {
+            result.ip6tables.detected = true;
+            result.ip6tables.rules.push(trimmed.to_string());
+            result.found = true;
+        }
+    }
+
+    if trimmed.contains("ebtables") {
+        result.ebtables.detected = true;
+        result.ebtables.config = Some(trimmed.to_string());
+        result.found = true;
+    }
+
+    result.active_firewall = if result.firewalld.running {
+        "firewalld".to_string()
+    } else if result
+        .nftables
+        .ruleset
+        .as_ref()
+        .map(|s| !s.is_empty() && s != "(empty)")
+        .unwrap_or(false)
+    {
+        "nftables".to_string()
+    } else if !result.iptables.rules.is_empty() {
+        "iptables".to_string()
+    } else if !result.ip6tables.rules.is_empty() {
+        "ip6tables".to_string()
+    } else {
+        "none".to_string()
+    };
+
+    result
+}
+
+pub fn parse_firewall_rules_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_firewall_rules(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+// =====================================================================
+// Packet loss parser
+//
+// Extracts per-interface RX/TX byte/packet/error/dropped counters from
+// `ip -stats link` (a.k.a. `ip -s link`) output that SCC supportconfigs
+// capture in `network.txt`. Emits warnings when any error/dropped counter
+// is non-zero so operators can spot lossy paths quickly.
+// =====================================================================
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct PacketLossWarning {
+    pub kind: String,
+    pub severity: String,
+    pub interface: String,
+    pub message: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct InterfaceCounters {
+    pub interface: String,
+    pub rx_bytes: u64,
+    pub rx_packets: u64,
+    pub rx_errors: u64,
+    pub rx_dropped: u64,
+    pub rx_missed: u64,
+    pub rx_mcast: u64,
+    pub tx_bytes: u64,
+    pub tx_packets: u64,
+    pub tx_errors: u64,
+    pub tx_dropped: u64,
+    pub tx_carrier: u64,
+    pub tx_collisions: u64,
+    pub rx_drop_pct: f64,
+    pub tx_drop_pct: f64,
+    pub source_line: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct PacketLossResult {
+    pub found: bool,
+    pub interfaces: Vec<InterfaceCounters>,
+    pub warnings: Vec<PacketLossWarning>,
+    pub source_path: String,
+}
+
+/// Parse seven non-negative integers separated by whitespace from `line`.
+fn parse_counter_row(line: &str) -> Option<[u64; 7]> {
+    let mut nums = [0u64; 7];
+    let mut idx = 0usize;
+    for tok in line.split_whitespace() {
+        if let Ok(v) = tok.parse::<u64>() {
+            if idx >= 7 {
+                return None;
+            }
+            nums[idx] = v;
+            idx += 1;
+        } else {
+            return None;
+        }
+    }
+    // The `ip -s link` rows expose 6 columns under each header; some
+    // newer iproute2 builds add a 7th totals column. Accept 6 or 7.
+    if idx == 6 || idx == 7 {
+        Some(nums)
+    } else {
+        None
+    }
+}
+
+pub fn parse_packet_loss(content: &str, source_path: &str) -> PacketLossResult {
+    let mut result = PacketLossResult {
+        found: false,
+        interfaces: Vec::new(),
+        warnings: Vec::new(),
+        source_path: source_path.to_string(),
+    };
+
+    if content.trim().is_empty() {
+        return result;
+    }
+
+    // Match interface header lines like `2: eth0: <BROADCAST,...> mtu 1500 ...`
+    let header_re = crate::cached_regex!(r"^\s*\d+:\s+([A-Za-z0-9._@-]+?):\s+<");
+    let rx_hdr_re = crate::cached_regex!(r"^\s*RX:\s+bytes");
+    let tx_hdr_re = crate::cached_regex!(r"^\s*TX:\s+bytes");
+
+    let lines: Vec<&str> = content.lines().collect();
+    let mut i = 0usize;
+    while i < lines.len() {
+        let line = lines[i];
+        if let Some(caps) = header_re.captures(line) {
+            let iface_name = caps
+                .get(1)
+                .map(|m| m.as_str().to_string())
+                .unwrap_or_default();
+            let header_line = i + 1;
+            let mut rx: Option<[u64; 7]> = None;
+            let mut tx: Option<[u64; 7]> = None;
+
+            // Look ahead a few lines for RX:/TX: header + data row pairs.
+            let mut j = i + 1;
+            let mut steps = 0usize;
+            while j < lines.len() && steps < 12 {
+                if header_re.is_match(lines[j]) {
+                    break;
+                }
+                if rx_hdr_re.is_match(lines[j]) && j + 1 < lines.len() {
+                    if let Some(nums) = parse_counter_row(lines[j + 1]) {
+                        rx = Some(nums);
+                        j += 1;
+                    }
+                } else if tx_hdr_re.is_match(lines[j]) && j + 1 < lines.len() {
+                    if let Some(nums) = parse_counter_row(lines[j + 1]) {
+                        tx = Some(nums);
+                        j += 1;
+                    }
+                }
+                j += 1;
+                steps += 1;
+            }
+
+            if rx.is_some() || tx.is_some() {
+                let rx = rx.unwrap_or([0; 7]);
+                let tx = tx.unwrap_or([0; 7]);
+                let rx_pct = if rx[1] > 0 {
+                    (rx[3] as f64) * 100.0 / (rx[1] as f64)
+                } else {
+                    0.0
+                };
+                let tx_pct = if tx[1] > 0 {
+                    (tx[3] as f64) * 100.0 / (tx[1] as f64)
+                } else {
+                    0.0
+                };
+
+                let counters = InterfaceCounters {
+                    interface: iface_name.clone(),
+                    rx_bytes: rx[0],
+                    rx_packets: rx[1],
+                    rx_errors: rx[2],
+                    rx_dropped: rx[3],
+                    rx_missed: rx[4],
+                    rx_mcast: rx[5],
+                    tx_bytes: tx[0],
+                    tx_packets: tx[1],
+                    tx_errors: tx[2],
+                    tx_dropped: tx[3],
+                    tx_carrier: tx[4],
+                    tx_collisions: tx[5],
+                    rx_drop_pct: rx_pct,
+                    tx_drop_pct: tx_pct,
+                    source_line: Some(header_line),
+                };
+
+                // Skip loopback: noisy and rarely actionable.
+                if iface_name != "lo" {
+                    if counters.rx_errors > 0 {
+                        result.warnings.push(PacketLossWarning {
+                            kind: "rx_errors".to_string(),
+                            severity: "warning".to_string(),
+                            interface: iface_name.clone(),
+                            message: format!(
+                                "{}: {} RX errors detected (ip -s link)",
+                                iface_name, counters.rx_errors
+                            ),
+                            source_path: source_path.to_string(),
+                            source_line: Some(header_line),
+                        });
+                    }
+                    if counters.tx_errors > 0 {
+                        result.warnings.push(PacketLossWarning {
+                            kind: "tx_errors".to_string(),
+                            severity: "warning".to_string(),
+                            interface: iface_name.clone(),
+                            message: format!(
+                                "{}: {} TX errors detected (ip -s link)",
+                                iface_name, counters.tx_errors
+                            ),
+                            source_path: source_path.to_string(),
+                            source_line: Some(header_line),
+                        });
+                    }
+                    if counters.rx_dropped > 0 {
+                        let sev = if rx_pct >= 0.1 { "warning" } else { "info" };
+                        result.warnings.push(PacketLossWarning {
+                            kind: "rx_dropped".to_string(),
+                            severity: sev.to_string(),
+                            interface: iface_name.clone(),
+                            message: format!(
+                                "{}: {} RX packets dropped ({:.4}% of {} received) — possible undersized RX ring buffer, busy NAPI, or qdisc backpressure",
+                                iface_name, counters.rx_dropped, rx_pct, counters.rx_packets
+                            ),
+                            source_path: source_path.to_string(),
+                            source_line: Some(header_line),
+                        });
+                    }
+                    if counters.tx_dropped > 0 {
+                        let sev = if tx_pct >= 0.1 { "warning" } else { "info" };
+                        result.warnings.push(PacketLossWarning {
+                            kind: "tx_dropped".to_string(),
+                            severity: sev.to_string(),
+                            interface: iface_name.clone(),
+                            message: format!(
+                                "{}: {} TX packets dropped ({:.4}% of {} sent) — possible undersized TX ring buffer or qdisc drops",
+                                iface_name, counters.tx_dropped, tx_pct, counters.tx_packets
+                            ),
+                            source_path: source_path.to_string(),
+                            source_line: Some(header_line),
+                        });
+                    }
+                    if counters.rx_missed > 0 {
+                        result.warnings.push(PacketLossWarning {
+                            kind: "rx_missed".to_string(),
+                            severity: "warning".to_string(),
+                            interface: iface_name.clone(),
+                            message: format!(
+                                "{}: {} RX missed frames — NIC overran its FIFO; increase RX ring or interrupt coalescing",
+                                iface_name, counters.rx_missed
+                            ),
+                            source_path: source_path.to_string(),
+                            source_line: Some(header_line),
+                        });
+                    }
+                }
+
+                result.interfaces.push(counters);
+                result.found = true;
+                i = j;
+                continue;
+            }
+        }
+        i += 1;
+    }
+
+    result
+}
+
+pub fn parse_packet_loss_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_packet_loss(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+// =====================================================================
+// Ring buffer (ethtool -g) parser
+//
+// Reads the `ethtool -g <iface>` output blocks present in SCC's
+// `network.txt`. Warns when the current TX or RX ring is smaller than
+// the hardware pre-set maximum because that ceiling is a common cause
+// of TX/RX drops on busy Azure VMs.
+// =====================================================================
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct RingBufferWarning {
+    pub kind: String,
+    pub severity: String,
+    pub interface: String,
+    pub message: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct RingBufferEntry {
+    pub interface: String,
+    pub rx_max: Option<u64>,
+    pub rx_current: Option<u64>,
+    pub tx_max: Option<u64>,
+    pub tx_current: Option<u64>,
+    pub source_line: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct RingBufferResult {
+    pub found: bool,
+    pub entries: Vec<RingBufferEntry>,
+    pub warnings: Vec<RingBufferWarning>,
+    pub source_path: String,
+}
+
+fn parse_ring_value(line: &str) -> Option<u64> {
+    let val = line.split(':').nth(1)?.trim();
+    if val.eq_ignore_ascii_case("n/a") {
+        return None;
+    }
+    val.split_whitespace().next()?.parse::<u64>().ok()
+}
+
+pub fn parse_ring_buffer(content: &str, source_path: &str) -> RingBufferResult {
+    let mut result = RingBufferResult {
+        found: false,
+        entries: Vec::new(),
+        warnings: Vec::new(),
+        source_path: source_path.to_string(),
+    };
+
+    if content.trim().is_empty() {
+        return result;
+    }
+
+    let header_re = crate::cached_regex!(r"^Ring parameters for (\S+):");
+    let preset_re = crate::cached_regex!(r"(?i)^Pre-set maximums:");
+    let current_re = crate::cached_regex!(r"(?i)^Current hardware settings:");
+    let rx_re = crate::cached_regex!(r"^RX:\s");
+    let tx_re = crate::cached_regex!(r"^TX:\s");
+
+    let lines: Vec<&str> = content.lines().collect();
+    let mut i = 0usize;
+    while i < lines.len() {
+        let line = lines[i].trim_end();
+        if let Some(caps) = header_re.captures(line.trim_start()) {
+            let iface = caps
+                .get(1)
+                .map(|m| m.as_str().to_string())
+                .unwrap_or_default();
+            let header_line = i + 1;
+            let mut rx_max: Option<u64> = None;
+            let mut tx_max: Option<u64> = None;
+            let mut rx_cur: Option<u64> = None;
+            let mut tx_cur: Option<u64> = None;
+            let mut mode_current = false;
+
+            let mut j = i + 1;
+            // Inspect up to 20 lines or until we hit another command block.
+            let mut steps = 0usize;
+            while j < lines.len() && steps < 20 {
+                let l = lines[j].trim_end();
+                if l.starts_with("#==[") || header_re.is_match(l.trim_start()) {
+                    break;
+                }
+                if preset_re.is_match(l) {
+                    mode_current = false;
+                } else if current_re.is_match(l) {
+                    mode_current = true;
+                } else if rx_re.is_match(l) {
+                    let v = parse_ring_value(l);
+                    if mode_current {
+                        rx_cur = v;
+                    } else {
+                        rx_max = v;
+                    }
+                } else if tx_re.is_match(l) {
+                    let v = parse_ring_value(l);
+                    if mode_current {
+                        tx_cur = v;
+                    } else {
+                        tx_max = v;
+                    }
+                }
+                j += 1;
+                steps += 1;
+            }
+
+            let entry = RingBufferEntry {
+                interface: iface.clone(),
+                rx_max,
+                rx_current: rx_cur,
+                tx_max,
+                tx_current: tx_cur,
+                source_line: Some(header_line),
+            };
+
+            if iface != "lo" {
+                if let (Some(cur), Some(max)) = (tx_cur, tx_max) {
+                    if cur < max {
+                        let pct = (cur as f64) * 100.0 / (max as f64);
+                        let sev = if pct < 50.0 { "warning" } else { "info" };
+                        result.warnings.push(RingBufferWarning {
+                            kind: "tx_ring_below_max".to_string(),
+                            severity: sev.to_string(),
+                            interface: iface.clone(),
+                            message: format!(
+                                "{}: TX ring buffer is {} (hardware max {}, {:.1}% of max) — increase with `ethtool -G {} tx {}` to reduce TX drops under load",
+                                iface, cur, max, pct, iface, max
+                            ),
+                            source_path: source_path.to_string(),
+                            source_line: Some(header_line),
+                        });
+                    }
+                }
+                if let (Some(cur), Some(max)) = (rx_cur, rx_max) {
+                    if cur < max {
+                        let pct = (cur as f64) * 100.0 / (max as f64);
+                        let sev = if pct < 50.0 { "warning" } else { "info" };
+                        result.warnings.push(RingBufferWarning {
+                            kind: "rx_ring_below_max".to_string(),
+                            severity: sev.to_string(),
+                            interface: iface.clone(),
+                            message: format!(
+                                "{}: RX ring buffer is {} (hardware max {}, {:.1}% of max) — increase with `ethtool -G {} rx {}` to reduce RX drops",
+                                iface, cur, max, pct, iface, max
+                            ),
+                            source_path: source_path.to_string(),
+                            source_line: Some(header_line),
+                        });
+                    }
+                }
+            }
+
+            result.entries.push(entry);
+            result.found = true;
+            i = j;
+            continue;
+        }
+        i += 1;
+    }
+
+    result
+}
+
+pub fn parse_ring_buffer_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_ring_buffer(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+// =====================================================================
+// Network sysctl tuning parser
+//
+// Scans sysctl key=value content (env.txt / sysctl-a.txt / sysctl.conf)
+// for tuning knobs that affect networking performance. Today it
+// specifically flags `net.ipv4.conf.<scope>.rp_filter` values other
+// than 0 because strict reverse-path filtering causes the kernel to
+// drop packets on Azure VMs with asymmetric routing or multi-NIC
+// configurations, which the user reported as a hot point.
+// =====================================================================
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct SysctlWarning {
+    pub kind: String,
+    pub severity: String,
+    pub key: String,
+    pub value: String,
+    pub message: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct SysctlEntry {
+    pub key: String,
+    pub value: String,
+    pub source_line: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct NetworkSysctlResult {
+    pub found: bool,
+    /// Captured rp_filter values keyed by sysctl name (preserved verbatim).
+    pub rp_filter: Vec<SysctlEntry>,
+    pub warnings: Vec<SysctlWarning>,
+    pub source_path: String,
+}
+
+pub fn parse_network_sysctl(content: &str, source_path: &str) -> NetworkSysctlResult {
+    let mut result = NetworkSysctlResult {
+        found: false,
+        rp_filter: Vec::new(),
+        warnings: Vec::new(),
+        source_path: source_path.to_string(),
+    };
+
+    if content.trim().is_empty() {
+        return result;
+    }
+
+    // Matches both `sysctl -a` style (`net.ipv4.conf.all.rp_filter = 2`)
+    // and `/etc/sysctl.conf` entries. Ignores commented-out lines.
+    let kv_re =
+        crate::cached_regex!(r"^\s*(net\.ipv4\.conf\.[A-Za-z0-9._-]+\.rp_filter)\s*=\s*(\S+)");
+
+    for (idx, raw) in content.lines().enumerate() {
+        let line = raw;
+        // Skip comments.
+        let trimmed = line.trim_start();
+        if trimmed.starts_with('#') || trimmed.starts_with(';') {
+            continue;
+        }
+        if let Some(caps) = kv_re.captures(line) {
+            let key = caps
+                .get(1)
+                .map(|m| m.as_str().to_string())
+                .unwrap_or_default();
+            let value = caps
+                .get(2)
+                .map(|m| m.as_str().to_string())
+                .unwrap_or_default();
+            let lineno = Some(idx + 1);
+            result.found = true;
+
+            // De-duplicate (sysctl -a + sysctl.conf can both appear).
+            let already_seen = result
+                .rp_filter
+                .iter()
+                .any(|e| e.key == key && e.value == value);
+            if !already_seen {
+                result.rp_filter.push(SysctlEntry {
+                    key: key.clone(),
+                    value: value.clone(),
+                    source_line: lineno,
+                });
+            }
+
+            // Only emit one warning per key — avoids duplicates when the
+            // same setting is captured by both sysctl.conf and `sysctl -a`.
+            if already_seen {
+                continue;
+            }
+
+            // Only `all` and per-interface scopes actually take effect on
+            // received packets. `default` only seeds new interfaces, so
+            // its value matters less; still surface it as info.
+            let is_default_scope = key.contains(".default.");
+
+            let v: i64 = value.parse().unwrap_or(-1);
+            if v == 1 {
+                let sev = if is_default_scope { "info" } else { "warning" };
+                result.warnings.push(SysctlWarning {
+                    kind: "rp_filter_strict".to_string(),
+                    severity: sev.to_string(),
+                    key: key.clone(),
+                    value: value.clone(),
+                    message: format!(
+                        "{} = 1 (strict reverse-path filter) — drops asymmetrically-routed packets, hurting throughput on multi-NIC/accelerated-networking Azure VMs. Consider setting to 0 or 2 (loose).",
+                        key
+                    ),
+                    source_path: source_path.to_string(),
+                    source_line: lineno,
+                });
+            } else if v == 2 {
+                let sev = if is_default_scope { "info" } else { "warning" };
+                result.warnings.push(SysctlWarning {
+                    kind: "rp_filter_loose".to_string(),
+                    severity: sev.to_string(),
+                    key: key.clone(),
+                    value: value.clone(),
+                    message: format!(
+                        "{} = 2 (loose reverse-path filter) — still performs an extra route lookup per ingress packet and can drop legitimate traffic with multi-NIC or BGP. Set to 0 for maximum performance unless you specifically need anti-spoof filtering.",
+                        key
+                    ),
+                    source_path: source_path.to_string(),
+                    source_line: lineno,
+                });
+            }
+        }
+    }
+
+    result
+}
+
+pub fn parse_network_sysctl_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_network_sysctl(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const PATH: &str = "sos_commands/firewalld/firewall-cmd_--list-all-zones";
+
+    #[test]
+    fn detects_running_firewalld_and_backend() {
+        let input = concat!(
+            "# /usr/bin/systemctl status firewalld\n",
+            "Active: active (running)\n",
+            "# /usr/bin/firewall-cmd --list-all\n",
+            "public (active)\n  services: ssh dhcpv6-client\n",
+            "FirewallBackend=nftables\n"
+        );
+        let result = parse_firewall_rules(input, PATH);
+        assert!(result.found);
+        assert!(result.firewalld.detected);
+        assert!(result.firewalld.running);
+        assert_eq!(result.active_firewall, "firewalld");
+    }
+
+    #[test]
+    fn detects_nftables_when_ruleset_present() {
+        let input = "table inet filter { chain input { type filter hook input priority 0; policy accept; } }";
+        let result = parse_firewall_rules(input, PATH);
+        assert!(result.found);
+        assert!(result.nftables.detected);
+        assert_eq!(result.active_firewall, "nftables");
+    }
+
+    #[test]
+    fn firewall_warnings_carry_source_provenance() {
+        let input = concat!(
+            "# /usr/bin/systemctl status firewalld\n",
+            "Loaded: loaded\n",
+            "Active: inactive (dead)\n",
+            "FirewallBackend=nftables\n"
+        );
+        let result = parse_firewall_rules(input, PATH);
+        assert_eq!(result.source_path, PATH);
+        assert!(!result.warnings.is_empty());
+        let w = result
+            .warnings
+            .iter()
+            .find(|w| w.kind == "firewalld_not_running")
+            .expect("warn");
+        assert_eq!(w.source_path, PATH);
+        assert_eq!(w.source_line, Some(3));
+    }
+
+    #[test]
+    fn firewall_json_wrapper_includes_source_path() {
+        let input = "FirewallD is not running\n";
+        let json = parse_firewall_rules_json(input, PATH);
+        assert!(json
+            .contains("\"source_path\":\"sos_commands/firewalld/firewall-cmd_--list-all-zones\""));
+    }
+
+    // ---- packet loss ----
+
+    const NET_PATH: &str = "network.txt";
+
+    #[test]
+    fn parses_ip_s_link_counters_and_drops() {
+        let input = concat!(
+            "2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000\n",
+            "    link/ether 00:0d:3a:b8:55:bc brd ff:ff:ff:ff:ff:ff\n",
+            "    RX:       bytes      packets errors dropped  missed   mcast\n",
+            "    576576306456948 432918471203      0       0       0       0\n",
+            "    TX:       bytes      packets errors dropped carrier collsns\n",
+            "     29491879217412  81596197830      0     177       0       0\n",
+            "4: eth1: <BROADCAST,MULTICAST,SLAVE,UP,LOWER_UP> mtu 1500 qdisc mq master eth0 state UP\n",
+            "    link/ether 00:0d:3a:b8:55:bc brd ff:ff:ff:ff:ff:ff\n",
+            "    RX:       bytes      packets errors  dropped  missed   mcast\n",
+            "    362585752455288 273876533041      0 85686896       0       0\n",
+            "    TX:       bytes      packets errors  dropped carrier collsns\n",
+            "     25742405933943  68373850463      0        0       0       0\n",
+        );
+        let r = parse_packet_loss(input, NET_PATH);
+        assert!(r.found);
+        assert_eq!(r.interfaces.len(), 2);
+        let eth0 = r.interfaces.iter().find(|i| i.interface == "eth0").unwrap();
+        assert_eq!(eth0.tx_dropped, 177);
+        assert_eq!(eth0.rx_dropped, 0);
+        let eth1 = r.interfaces.iter().find(|i| i.interface == "eth1").unwrap();
+        assert_eq!(eth1.rx_dropped, 85_686_896);
+        assert!(r
+            .warnings
+            .iter()
+            .any(|w| w.kind == "rx_dropped" && w.interface == "eth1"));
+        assert!(r
+            .warnings
+            .iter()
+            .any(|w| w.kind == "tx_dropped" && w.interface == "eth0"));
+    }
+
+    #[test]
+    fn packet_loss_ignores_loopback_warnings() {
+        let input = concat!(
+            "1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN\n",
+            "    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00\n",
+            "    RX:    bytes    packets errors dropped  missed   mcast\n",
+            "    100 10 0 5 0 0\n",
+            "    TX:    bytes    packets errors dropped carrier collsns\n",
+            "    100 10 0 0 0 0\n",
+        );
+        let r = parse_packet_loss(input, NET_PATH);
+        assert_eq!(r.interfaces.len(), 1);
+        assert!(r.warnings.is_empty(), "loopback drops should not warn");
+    }
+
+    // ---- ring buffer ----
+
+    #[test]
+    fn parses_ethtool_g_blocks_and_flags_undersize() {
+        let input = concat!(
+            "Ring parameters for eth0:\n",
+            "Pre-set maximums:\n",
+            "RX:             18139\n",
+            "RX Mini:        n/a\n",
+            "RX Jumbo:       n/a\n",
+            "TX:             2560\n",
+            "Current hardware settings:\n",
+            "RX:             9362\n",
+            "RX Mini:        n/a\n",
+            "RX Jumbo:       n/a\n",
+            "TX:             170\n",
+            "\n",
+            "Ring parameters for eth1:\n",
+            "Pre-set maximums:\n",
+            "RX:             8192\n",
+            "TX:             8192\n",
+            "Current hardware settings:\n",
+            "RX:             8192\n",
+            "TX:             8192\n",
+        );
+        let r = parse_ring_buffer(input, NET_PATH);
+        assert!(r.found);
+        assert_eq!(r.entries.len(), 2);
+        let eth0 = r.entries.iter().find(|e| e.interface == "eth0").unwrap();
+        assert_eq!(eth0.tx_max, Some(2560));
+        assert_eq!(eth0.tx_current, Some(170));
+        // eth0 should produce both rx and tx undersize warnings
+        assert!(r
+            .warnings
+            .iter()
+            .any(|w| w.kind == "tx_ring_below_max" && w.interface == "eth0"));
+        assert!(r
+            .warnings
+            .iter()
+            .any(|w| w.kind == "rx_ring_below_max" && w.interface == "eth0"));
+        // eth1 is at max → no warnings
+        assert!(!r.warnings.iter().any(|w| w.interface == "eth1"));
+    }
+
+    // ---- rp_filter ----
+
+    #[test]
+    fn flags_rp_filter_strict_and_loose() {
+        let input = concat!(
+            "net.ipv4.conf.all.rp_filter = 2\n",
+            "net.ipv4.conf.default.rp_filter = 0\n",
+            "net.ipv4.conf.eth0.rp_filter = 1\n",
+            "net.ipv4.conf.eth1.rp_filter = 0\n",
+            "# net.ipv4.conf.lo.rp_filter = 9\n",
+        );
+        let r = parse_network_sysctl(input, "env.txt");
+        assert!(r.found);
+        assert_eq!(r.rp_filter.len(), 4, "comment line must be ignored");
+        let loose = r
+            .warnings
+            .iter()
+            .find(|w| w.key == "net.ipv4.conf.all.rp_filter")
+            .unwrap();
+        assert_eq!(loose.kind, "rp_filter_loose");
+        assert_eq!(loose.severity, "warning");
+        let strict = r
+            .warnings
+            .iter()
+            .find(|w| w.key == "net.ipv4.conf.eth0.rp_filter")
+            .unwrap();
+        assert_eq!(strict.kind, "rp_filter_strict");
+        // zero values must not warn
+        assert!(!r
+            .warnings
+            .iter()
+            .any(|w| w.key == "net.ipv4.conf.eth1.rp_filter"));
+        assert!(!r
+            .warnings
+            .iter()
+            .any(|w| w.key == "net.ipv4.conf.default.rp_filter"));
+    }
+
+    // ---------------------------------------------------------------
+    // Negative / false-positive coverage
+    //
+    // Each parser may be dispatched against any `network.txt` (and
+    // sometimes adjacent files) by the worker.  These tests prove that
+    // when the input does NOT contain the signals the parser is
+    // looking for, the parser returns `found = false` and emits no
+    // warnings — so the UI never renders a section with bogus data.
+    // ---------------------------------------------------------------
+
+    #[test]
+    fn packet_loss_returns_empty_on_unrelated_content() {
+        // ethtool / ip route / random text — no `ip -s link` stat block.
+        let input = concat!(
+            "default via 10.0.0.1 dev eth0\n",
+            "10.0.0.0/24 dev eth0 proto kernel scope link src 10.0.0.4\n",
+            "ring parameters discussion in the documentation\n",
+            "RX: this is a sentence about RX, not a counter row\n",
+        );
+        let r = parse_packet_loss(input, NET_PATH);
+        assert!(!r.found, "no ip -s link blocks → not found");
+        assert!(r.interfaces.is_empty());
+        assert!(r.warnings.is_empty());
+    }
+
+    #[test]
+    fn packet_loss_returns_empty_on_ring_buffer_content() {
+        // Confirm that cross-feeding `ethtool -g` output does not
+        // trigger the packet-loss parser.
+        let input = concat!(
+            "Ring parameters for eth0:\n",
+            "Pre-set maximums:\n",
+            "RX:             2560\n",
+            "TX:             2560\n",
+            "Current hardware settings:\n",
+            "RX:             1024\n",
+            "TX:             170\n",
+        );
+        let r = parse_packet_loss(input, NET_PATH);
+        assert!(!r.found);
+        assert!(r.interfaces.is_empty());
+    }
+
+    #[test]
+    fn packet_loss_ignores_zero_drop_interfaces() {
+        // Has valid counters but every error/dropped is 0 — `found`
+        // is true (we did parse data) but NO warnings must fire.
+        let input = concat!(
+            "2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500\n",
+            "    link/ether 00:0d:3a:b8:55:bc brd ff:ff:ff:ff:ff:ff\n",
+            "    RX:       bytes      packets errors dropped  missed   mcast\n",
+            "             12345           67      0       0       0       0\n",
+            "    TX:       bytes      packets errors dropped carrier collsns\n",
+            "             54321           89      0       0       0       0\n",
+        );
+        let r = parse_packet_loss(input, NET_PATH);
+        assert!(r.found);
+        assert_eq!(r.interfaces.len(), 1);
+        assert!(
+            r.warnings.is_empty(),
+            "zero error/drop counters must not emit warnings: {:?}",
+            r.warnings
+        );
+    }
+
+    #[test]
+    fn ring_buffer_returns_empty_on_unrelated_content() {
+        // ip link output + ethtool -i / -k — no `Ring parameters for`.
+        let input = concat!(
+            "2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500\n",
+            "    link/ether 00:0d:3a:b8:55:bc brd ff:ff:ff:ff:ff:ff\n",
+            "driver: hv_netvsc\n",
+            "version: 5.14.21\n",
+            "Features for eth0:\n",
+            "rx-checksumming: on\n",
+            "tx-checksumming: on\n",
+        );
+        let r = parse_ring_buffer(input, NET_PATH);
+        assert!(!r.found, "no ethtool -g blocks → not found");
+        assert!(r.entries.is_empty());
+        assert!(r.warnings.is_empty());
+    }
+
+    #[test]
+    fn ring_buffer_no_warning_when_current_equals_preset() {
+        // Ring buffers maxed out — `found` true, but no undersize warning.
+        let input = concat!(
+            "Ring parameters for eth0:\n",
+            "Pre-set maximums:\n",
+            "RX:             2048\n",
+            "TX:             2048\n",
+            "Current hardware settings:\n",
+            "RX:             2048\n",
+            "TX:             2048\n",
+        );
+        let r = parse_ring_buffer(input, NET_PATH);
+        assert!(r.found);
+        assert_eq!(r.entries.len(), 1);
+        assert!(
+            r.warnings.is_empty(),
+            "current == preset must not warn: {:?}",
+            r.warnings
+        );
+    }
+
+    #[test]
+    fn network_sysctl_returns_empty_on_unrelated_content() {
+        // Contains other sysctl keys, plus an `arp_filter` red-herring,
+        // plus a commented rp_filter line — none must match.
+        let input = concat!(
+            "# /usr/bin/sysctl -a\n",
+            "net.ipv4.conf.all.arp_filter = 1\n",
+            "net.ipv4.conf.all.accept_source_route = 0\n",
+            "net.core.rmem_max = 212992\n",
+            "# net.ipv4.conf.all.rp_filter = 2 (commented out)\n",
+            "kernel.hostname = host01\n",
+        );
+        let r = parse_network_sysctl(input, "etc/sysctl.conf");
+        assert!(!r.found, "no live rp_filter key → not found");
+        assert!(r.rp_filter.is_empty());
+        assert!(r.warnings.is_empty());
+    }
+
+    #[test]
+    fn network_sysctl_no_warning_when_rp_filter_disabled() {
+        // rp_filter=0 is neither strict (1) nor loose (2) → no warning.
+        let input = concat!(
+            "net.ipv4.conf.all.rp_filter = 0\n",
+            "net.ipv4.conf.default.rp_filter = 0\n",
+            "net.ipv4.conf.eth0.rp_filter = 0\n",
+        );
+        let r = parse_network_sysctl(input, "etc/sysctl.conf");
+        assert!(r.found);
+        assert_eq!(r.rp_filter.len(), 3);
+        assert!(
+            r.warnings.is_empty(),
+            "rp_filter=0 must not warn: {:?}",
+            r.warnings
+        );
+    }
+
+    #[test]
+    fn parsers_return_empty_on_empty_input() {
+        assert!(!parse_packet_loss("", NET_PATH).found);
+        assert!(!parse_ring_buffer("", NET_PATH).found);
+        assert!(!parse_network_sysctl("", "etc/sysctl.conf").found);
+    }
+
+    #[test]
+    fn firewall_returns_empty_on_unrelated_content() {
+        // Existing firewall parser should also reject random text.
+        let r = parse_firewall_rules("this is not a firewall configuration\njust prose\n", PATH);
+        assert!(!r.found);
+        assert_eq!(r.active_firewall, "none");
+        assert!(r.warnings.is_empty());
+    }
+}
diff --git a/rca-tool/lib/supportfile_core/src/parsers/packages.rs b/rca-tool/lib/supportfile_core/src/parsers/packages.rs
new file mode 100644
index 0000000..5617acd
--- /dev/null
+++ b/rca-tool/lib/supportfile_core/src/parsers/packages.rs
@@ -0,0 +1,1001 @@
+use regex::Regex;
+use serde::{Deserialize, Serialize};
+use std::cmp::Ordering;
+use std::collections::BTreeMap;
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct PackageWarning {
+    pub package: String,
+    pub expected: String,
+    pub actual: String,
+    pub severity: String,
+    pub message: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct FipsPackage {
+    pub name: String,
+    pub version: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct DistroPackagesResult {
+    pub found: bool,
+    pub is_dpkg: bool,
+    pub is_rpm_raw: bool,
+    pub is_zypper_history: bool,
+    pub is_dnf_yum_log: bool,
+    pub raw_content: Option<String>,
+    pub package_count: usize,
+    pub packages: BTreeMap<String, String>,
+    pub warnings: Vec<PackageWarning>,
+    pub fips_packages: Vec<FipsPackage>,
+    pub has_dracut_fips: bool,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct PackageDistroMismatch {
+    pub package: String,
+    pub package_version: String,
+    pub detected_distro: String,
+    pub detected_major_version: Option<u32>,
+    pub issue: String,
+    pub message: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct PackageDistroMismatchResult {
+    pub found: bool,
+    pub running_distro_id: String,
+    pub running_version_id: String,
+    pub count: usize,
+    pub mismatches: Vec<PackageDistroMismatch>,
+    pub source_path: String,
+}
+
+#[derive(Clone, Copy)]
+enum PackageRule {
+    Gte(&'static str),
+    ProblemRange(&'static str, &'static str),
+}
+
+const REQUIRED_PACKAGES: &[(&str, PackageRule)] = &[
+    ("fence-agents", PackageRule::Gte("4.4")),
+    ("python3-azure-mgmt-compute", PackageRule::Gte("17.0")),
+    ("python3-azure-identity", PackageRule::Gte("1.0")),
+    ("cloud-netconfig-azure", PackageRule::Gte("1.3")),
+    ("resource-agents", PackageRule::Gte("4.3")),
+    (
+        "python3-azure-core",
+        PackageRule::ProblemRange("1.9", "1.22"),
+    ),
+];
+
+/// Per-package metadata captured during parsing: version + source line in the
+/// original file. Tracked as (name, version, line_no).
+type PackageEntry = (String, String, usize);
+
+fn extract_numeric_version(input: &str) -> Option<String> {
+    crate::cached_regex!(r"(\d+\.\d+(?:\.\d+)?)")
+        .captures(input)
+        .and_then(|c| c.get(1).map(|m| m.as_str().to_string()))
+}
+
+fn compare_versions(a: &str, b: &str) -> Ordering {
+    let parse_parts = |v: &str| {
+        v.split('.')
+            .map(|p| p.parse::<i64>().unwrap_or(0))
+            .collect::<Vec<_>>()
+    };
+
+    let mut left = parse_parts(a);
+    let mut right = parse_parts(b);
+    let max_len = left.len().max(right.len());
+    left.resize(max_len, 0);
+    right.resize(max_len, 0);
+
+    for (l, r) in left.into_iter().zip(right.into_iter()) {
+        match l.cmp(&r) {
+            Ordering::Equal => continue,
+            other => return other,
+        }
+    }
+    Ordering::Equal
+}
+
+fn split_rpm_name_version(token: &str) -> Option<(String, String)> {
+    let trimmed = token.trim();
+    if trimmed.is_empty() {
+        return None;
+    }
+
+    let without_arch = if let Some(idx) = trimmed.rfind('.') {
+        let suffix = &trimmed[idx + 1..];
+        if suffix
+            .chars()
+            .all(|c| c.is_ascii_alphanumeric() || c == '_')
+        {
+            &trimmed[..idx]
+        } else {
+            trimmed
+        }
+    } else {
+        trimmed
+    };
+
+    let bytes = without_arch.as_bytes();
+    for i in 1..without_arch.len() {
+        if bytes[i - 1] == b'-' && bytes[i].is_ascii_digit() {
+            let name = without_arch[..i - 1].to_string();
+            let version = without_arch[i..].to_string();
+            if !name.is_empty() && !version.is_empty() {
+                return Some((name, version));
+            }
+        }
+    }
+    None
+}
+
+fn build_lookup(entries: &[PackageEntry]) -> BTreeMap<String, (String, usize)> {
+    let mut map = BTreeMap::new();
+    for (name, version, line_no) in entries {
+        map.entry(name.clone())
+            .or_insert_with(|| (version.clone(), *line_no));
+    }
+    map
+}
+
+fn validate_packages(
+    entries: &[PackageEntry],
+    source_path: &str,
+) -> (BTreeMap<String, String>, Vec<PackageWarning>) {
+    let lookup = build_lookup(entries);
+    let mut found = BTreeMap::new();
+    let mut warnings = Vec::new();
+
+    for (req_name, rule) in REQUIRED_PACKAGES {
+        let matched = lookup
+            .iter()
+            .find(|(name, _)| *name == req_name || name.starts_with(&format!("{}-", req_name)));
+
+        let Some((matched_name, (matched_version_raw, matched_line))) = matched else {
+            let expected = match rule {
+                PackageRule::Gte(v) => format!(">= {}", v),
+                PackageRule::ProblemRange(min, max) => format!("< {} or > {}", min, max),
+            };
+            warnings.push(PackageWarning {
+                package: req_name.to_string(),
+                expected,
+                actual: "not found".to_string(),
+                severity: "error".to_string(),
+                message: format!("Required package {} not found in package list", req_name),
+                source_path: source_path.to_string(),
+                source_line: None,
+                source_line_end: None,
+            });
+            continue;
+        };
+
+        let version = extract_numeric_version(matched_version_raw)
+            .unwrap_or_else(|| matched_version_raw.clone());
+        found.insert(matched_name.clone(), version.clone());
+        let line = Some(*matched_line);
+
+        match rule {
+            PackageRule::Gte(min) => {
+                if compare_versions(&version, min) == Ordering::Less {
+                    warnings.push(PackageWarning {
+                        package: req_name.to_string(),
+                        expected: format!(">= {}", min),
+                        actual: version.clone(),
+                        severity: "error".to_string(),
+                        message: format!(
+                            "Package {} version is {}, but should be >= {} for Azure environments",
+                            req_name, version, min
+                        ),
+                        source_path: source_path.to_string(),
+                        source_line: line,
+                        source_line_end: line,
+                    });
+                }
+            }
+            PackageRule::ProblemRange(min, max) => {
+                if compare_versions(&version, min) != Ordering::Less
+                    && compare_versions(&version, max) != Ordering::Greater
+                {
+                    warnings.push(PackageWarning {
+                        package: req_name.to_string(),
+                        expected: format!("< {} or > {}", min, max),
+                        actual: version.clone(),
+                        severity: "error".to_string(),
+                        message: format!(
+                            "Package {} version is {}, but should be lower than {} or higher than {} for Azure environments",
+                            req_name, version, min, max
+                        ),
+                        source_path: source_path.to_string(),
+                        source_line: line,
+                        source_line_end: line,
+                    });
+                }
+            }
+        }
+    }
+
+    (found, warnings)
+}
+
+fn detect_dnf_yum_excludes(content: &str, source_path: &str) -> (Vec<PackageWarning>, Option<String>) {
+    let lower = source_path.to_ascii_lowercase();
+    let is_config_file = lower.ends_with("dnf.conf")
+        || lower.ends_with("yum.conf")
+        || lower.contains("/dnf.repos.d/")
+        || lower.contains("/yum.repos.d/")
+        || lower.ends_with(".repo");
+
+    if !is_config_file {
+        return (Vec::new(), None);
+    }
+
+    let mut warnings = Vec::new();
+    let mut raw_lines = Vec::new();
+
+    for (idx, line) in content.lines().enumerate() {
+        let trimmed = line.trim();
+        if trimmed.is_empty() || trimmed.starts_with('#') {
+            continue;
+        }
+
+        if let Some(caps) = crate::cached_regex!(r"(?i)^exclude\s*=\s*(.+)$")
+            .captures(trimmed)
+        {
+            let value = caps.get(1).map(|m| m.as_str().trim()).unwrap_or_default();
+            if value.is_empty() {
+                continue;
+            }
+
+            raw_lines.push(format!("{}: {}", idx + 1, trimmed));
+            warnings.push(PackageWarning {
+                package: "dnf_exclude".to_string(),
+                expected: "No package exclusions".to_string(),
+                actual: value.to_string(),
+                severity: "warning".to_string(),
+                message: format!(
+                    "DNF/YUM customizes updates with '{}' (line {}). This can block a minor-version upgrade if the excluded package is required by the distribution or Azure tooling.",
+                    trimmed, idx + 1
+                ),
+                source_path: source_path.to_string(),
+                source_line: Some(idx + 1),
+                source_line_end: Some(idx + 1),
+            });
+        }
+    }
+
+    let raw_content = if raw_lines.is_empty() {
+        None
+    } else {
+        Some(raw_lines.join("\n"))
+    };
+
+    (warnings, raw_content)
+}
+
+fn collect_fips_packages(entries: &[PackageEntry], source_path: &str) -> Vec<FipsPackage> {
+    let fips_prefixes = [
+        "dracut-fips",
+        "fipscheck",
+        "fips-mode-setup",
+        "crypto-policies",
+    ];
+    entries
+        .iter()
+        .filter(|(name, _, _)| {
+            fips_prefixes
+                .iter()
+                .any(|prefix| name == prefix || name.starts_with(&format!("{}-", prefix)))
+        })
+        .map(|(name, version, line_no)| FipsPackage {
+            name: name.clone(),
+            version: version.clone(),
+            source_path: source_path.to_string(),
+            source_line: Some(*line_no),
+            source_line_end: Some(*line_no),
+        })
+        .collect()
+}
+
+fn parse_package_entries_from_raw_listing(content: &str) -> Vec<PackageEntry> {
+    let mut entries = Vec::new();
+    for (i, line) in content.lines().enumerate() {
+        let trimmed = line.trim();
+        if trimmed.is_empty()
+            || trimmed.starts_with("Desired")
+            || trimmed.starts_with('|')
+            || trimmed.starts_with("+++")
+            || trimmed.starts_with("Installed Packages")
+            || trimmed.starts_with("Last metadata")
+            || trimmed.starts_with("Loaded plugins")
+        {
+            continue;
+        }
+
+        let token = trimmed.split_whitespace().next().unwrap_or(trimmed);
+        if let Some((name, version)) = split_rpm_name_version(token) {
+            entries.push((name, version, i + 1));
+        }
+    }
+    entries
+}
+
+fn normalize_distro_id(input: &str) -> String {
+    let s = input.trim().to_ascii_lowercase();
+    match s.as_str() {
+        "rhel"
+        | "redhat"
+        | "red_hat"
+        | "redhatenterpriselinux"
+        | "centos"
+        | "rocky"
+        | "almalinux"
+        | "oracle"
+        | "ol" => "rhel".to_string(),
+        "sles" | "suse" | "opensuse" | "opensuse-leap" => "suse".to_string(),
+        "ubuntu" => "ubuntu".to_string(),
+        "debian" => "debian".to_string(),
+        "amazon" | "amzn" | "amznlinux" => "amazon".to_string(),
+        "fedora" => "fedora".to_string(),
+        _ => s,
+    }
+}
+
+fn parse_major_version(version: &str) -> Option<u32> {
+    crate::cached_regex!(r"^(\d+)")
+        .captures(version.trim())
+        .and_then(|c| c.get(1).and_then(|m| m.as_str().parse::<u32>().ok()))
+}
+
+fn detect_package_origin(version: &str) -> Option<(String, Option<u32>)> {
+    let lower = version.to_ascii_lowercase();
+
+    if let Some(c) = crate::cached_regex!(r"\.el(\d+)(?:\D|$)").captures(&lower) {
+        let major = c.get(1).and_then(|m| m.as_str().parse::<u32>().ok());
+        return Some(("rhel".to_string(), major));
+    }
+    if let Some(c) = crate::cached_regex!(r"\.sles(\d+)(?:\D|$)").captures(&lower) {
+        let major = c.get(1).and_then(|m| m.as_str().parse::<u32>().ok());
+        return Some(("suse".to_string(), major));
+    }
+    if let Some(c) = crate::cached_regex!(r"\.amzn(\d+)(?:\D|$)").captures(&lower) {
+        let major = c.get(1).and_then(|m| m.as_str().parse::<u32>().ok());
+        return Some(("amazon".to_string(), major));
+    }
+    if let Some(c) = crate::cached_regex!(r"\.fc(\d+)(?:\D|$)").captures(&lower) {
+        let major = c.get(1).and_then(|m| m.as_str().parse::<u32>().ok());
+        return Some(("fedora".to_string(), major));
+    }
+
+    None
+}
+
+fn collect_entries_for_distro_analysis(content: &str, source_path: &str) -> Vec<PackageEntry> {
+    let trimmed = content.trim();
+    if trimmed.is_empty() {
+        return Vec::new();
+    }
+
+    if trimmed.contains("Desired=Unknown/Install/Remove/Purge/Hold") {
+        return Vec::new();
+    }
+
+    let lower_path = source_path.to_lowercase();
+    let is_yum_dnf_listing = lower_path.contains("dnf_list_installed")
+        || lower_path.contains("dnf-list-installed")
+        || lower_path.contains("dnf_list-installed")
+        || lower_path.contains("yum_list_installed")
+        || lower_path.contains("yum-list-installed")
+        || lower_path.contains("yum_list-installed");
+    let is_supportconfig_rpm_txt = lower_path.ends_with("/rpm.txt") || lower_path == "rpm.txt";
+
+    if is_yum_dnf_listing {
+        let kept: Vec<&str> = trimmed
+            .lines()
+            .filter(|l| {
+                let t = l.trim();
+                if t.is_empty() {
+                    return true;
+                }
+                if l.starts_with("Installed Packages")
+                    || l.starts_with("Last metadata")
+                    || l.starts_with("Loaded plugins")
+                {
+                    return false;
+                }
+                if t.starts_with(": manager") || t.starts_with(": plugins") {
+                    return false;
+                }
+                if l.starts_with("Repository") && l.contains("is listed more than once") {
+                    return false;
+                }
+                true
+            })
+            .collect();
+        return parse_package_entries_from_raw_listing(&kept.join("\n"));
+    }
+
+    if is_supportconfig_rpm_txt {
+        let queryformat_start =
+            Regex::new(r"(?i)^# rpm -qa --queryformat.*NAME.*DISTRIBUTION.*VERSION").unwrap();
+        let queryformat_sigpgp = crate::cached_regex!(r"(?i)^# rpm -qa --queryformat.*SIGPGP");
+        let mut kept: Vec<&str> = Vec::new();
+        let mut in_pkg_list = false;
+        for line in trimmed.lines() {
+            if queryformat_start.is_match(line) {
+                in_pkg_list = true;
+                continue;
+            }
+            if line.starts_with("#==[ Command ]======") || queryformat_sigpgp.is_match(line) {
+                in_pkg_list = false;
+            }
+            if in_pkg_list {
+                kept.push(line);
+            }
+        }
+
+        let mut entries: Vec<PackageEntry> = Vec::new();
+        for (i, line) in kept.iter().enumerate() {
+            let t = line.trim();
+            if t.is_empty() || t.starts_with("NAME") || t.starts_with("DISTRIBUTION") {
+                continue;
+            }
+            let toks: Vec<&str> = t.split_whitespace().collect();
+            if toks.len() < 2 {
+                continue;
+            }
+            entries.push((toks[0].to_string(), toks[toks.len() - 1].to_string(), i + 1));
+        }
+        return entries;
+    }
+
+    if trimmed.lines().any(|l| l.contains("|install|")) {
+        return parse_zypper_history(trimmed).0;
+    }
+    if trimmed.lines().any(|l| l.contains("Installed:")) {
+        return parse_dnf_yum_log(trimmed).0;
+    }
+
+    parse_package_entries_from_raw_listing(trimmed)
+}
+
+pub fn parse_package_distro_mismatch(
+    content: &str,
+    source_path: &str,
+    running_distro_id: &str,
+    running_version_id: &str,
+) -> PackageDistroMismatchResult {
+    let running_distro_norm = normalize_distro_id(running_distro_id);
+    let running_major = parse_major_version(running_version_id);
+    let entries = collect_entries_for_distro_analysis(content, source_path);
+
+    let mut mismatches = Vec::new();
+
+    for (name, version, line_no) in entries {
+        let Some((pkg_distro, pkg_major)) = detect_package_origin(&version) else {
+            continue;
+        };
+
+        if pkg_distro != running_distro_norm {
+            mismatches.push(PackageDistroMismatch {
+                package: name,
+                package_version: version,
+                detected_distro: pkg_distro.clone(),
+                detected_major_version: pkg_major,
+                issue: "cross_distro".to_string(),
+                message: format!(
+                    "Package appears to target distro '{}' but host distro is '{}'.",
+                    pkg_distro, running_distro_norm
+                ),
+                source_path: source_path.to_string(),
+                source_line: Some(line_no),
+                source_line_end: Some(line_no),
+            });
+            continue;
+        }
+
+        if let (Some(pkg_m), Some(host_m)) = (pkg_major, running_major) {
+            if pkg_m != host_m {
+                mismatches.push(PackageDistroMismatch {
+                    package: name,
+                    package_version: version,
+                    detected_distro: pkg_distro,
+                    detected_major_version: Some(pkg_m),
+                    issue: "major_version_mismatch".to_string(),
+                    message: format!(
+                        "Package targets major version {} but host major version is {}.",
+                        pkg_m, host_m
+                    ),
+                    source_path: source_path.to_string(),
+                    source_line: Some(line_no),
+                    source_line_end: Some(line_no),
+                });
+            }
+        }
+    }
+
+    PackageDistroMismatchResult {
+        found: !mismatches.is_empty(),
+        running_distro_id: running_distro_norm,
+        running_version_id: running_version_id.to_string(),
+        count: mismatches.len(),
+        mismatches,
+        source_path: source_path.to_string(),
+    }
+}
+
+fn parse_zypper_history(content: &str) -> (Vec<PackageEntry>, Vec<String>) {
+    let mut entries = Vec::new();
+    let mut raw_lines = Vec::new();
+    for (i, line) in content.lines().enumerate() {
+        if line.starts_with('#') || !line.contains('|') {
+            continue;
+        }
+        let parts = line.split('|').map(|s| s.trim()).collect::<Vec<_>>();
+        if parts.len() < 4 || parts[1] != "install" {
+            continue;
+        }
+        let name = parts[2].to_string();
+        let version = parts[3].to_string();
+        entries.push((name.clone(), version.clone(), i + 1));
+        raw_lines.push(format!("{}|{}|{}", name, version, parts[0]));
+    }
+    (entries, raw_lines)
+}
+
+fn parse_dnf_yum_log(content: &str) -> (Vec<PackageEntry>, Vec<String>) {
+    let installed_re =
+        crate::cached_regex!(r"(?:^\d{4}-\d{2}-\d{2}|^[A-Z][a-z]{2}\s+\d+).*?Installed:\s*(.+)");
+    let mut entries = Vec::new();
+    let mut raw_lines = Vec::new();
+
+    for (i, line) in content.lines().enumerate() {
+        let trimmed = line.trim();
+        if let Some(caps) = installed_re.captures(trimmed) {
+            let pkg_str = caps.get(1).map(|m| m.as_str().trim()).unwrap_or_default();
+            if let Some((name, version)) = split_rpm_name_version(pkg_str) {
+                entries.push((name.clone(), version.clone(), i + 1));
+                let date = trimmed.chars().take(19).collect::<String>();
+                raw_lines.push(format!("{}|{}|{}", name, version, date));
+            }
+        }
+    }
+
+    (entries, raw_lines)
+}
+
+pub fn parse_distro_packages(content: &str, source_path: &str) -> DistroPackagesResult {
+    let trimmed = content.trim();
+    let lower_path = source_path.to_lowercase();
+    let (config_warnings, config_raw) = detect_dnf_yum_excludes(trimmed, source_path);
+    if !config_warnings.is_empty() {
+        return DistroPackagesResult {
+            found: true,
+            is_dpkg: false,
+            is_rpm_raw: false,
+            is_zypper_history: false,
+            is_dnf_yum_log: false,
+            raw_content: config_raw.or(Some(trimmed.to_string())),
+            package_count: config_warnings.len(),
+            packages: BTreeMap::new(),
+            warnings: config_warnings,
+            fips_packages: Vec::new(),
+            has_dracut_fips: false,
+            source_path: source_path.to_string(),
+        };
+    }
+
+    let empty = DistroPackagesResult {
+        found: false,
+        is_dpkg: false,
+        is_rpm_raw: false,
+        is_zypper_history: false,
+        is_dnf_yum_log: false,
+        raw_content: None,
+        package_count: 0,
+        packages: BTreeMap::new(),
+        warnings: Vec::new(),
+        fips_packages: Vec::new(),
+        has_dracut_fips: false,
+        source_path: source_path.to_string(),
+    };
+    if trimmed.is_empty() {
+        return empty;
+    }
+
+    // Special-case file types by filename, mirroring the legacy JS parser.
+    let is_yum_dnf_listing = lower_path.contains("dnf_list_installed")
+        || lower_path.contains("dnf-list-installed")
+        || lower_path.contains("dnf_list-installed")
+        || lower_path.contains("yum_list_installed")
+        || lower_path.contains("yum-list-installed")
+        || lower_path.contains("yum_list-installed");
+    let is_supportconfig_rpm_txt = lower_path.ends_with("/rpm.txt") || lower_path == "rpm.txt";
+
+    if is_yum_dnf_listing {
+        let kept: Vec<&str> = trimmed
+            .lines()
+            .filter(|l| {
+                let t = l.trim();
+                if t.is_empty() {
+                    return true;
+                }
+                if l.starts_with("Installed Packages")
+                    || l.starts_with("Last metadata")
+                    || l.starts_with("Loaded plugins")
+                {
+                    return false;
+                }
+                if t.starts_with(": manager") || t.starts_with(": plugins") {
+                    return false;
+                }
+                if l.starts_with("Repository") && l.contains("is listed more than once") {
+                    return false;
+                }
+                true
+            })
+            .collect();
+        let filtered = kept.join("\n");
+        let entries = parse_package_entries_from_raw_listing(&filtered);
+        let pkg_count = trimmed
+            .lines()
+            .filter(|l| {
+                let t = l.trim();
+                !t.is_empty()
+                    && !l.starts_with("Installed")
+                    && !l.starts_with("Last metadata")
+                    && !l.starts_with("Loaded plugins")
+            })
+            .count();
+        let fips_packages = collect_fips_packages(&entries, source_path);
+        let has_dracut_fips = fips_packages
+            .iter()
+            .any(|p| p.name == "dracut-fips" || p.name.starts_with("dracut-fips-"));
+        let (packages, warnings) = validate_packages(&entries, source_path);
+        return DistroPackagesResult {
+            found: true,
+            is_dpkg: false,
+            is_rpm_raw: true,
+            is_zypper_history: false,
+            is_dnf_yum_log: false,
+            raw_content: Some(filtered),
+            package_count: pkg_count,
+            packages,
+            warnings,
+            fips_packages,
+            has_dracut_fips,
+            source_path: source_path.to_string(),
+        };
+    }
+
+    if is_supportconfig_rpm_txt {
+        let queryformat_start =
+            Regex::new(r"(?i)^# rpm -qa --queryformat.*NAME.*DISTRIBUTION.*VERSION").unwrap();
+        let queryformat_sigpgp = crate::cached_regex!(r"(?i)^# rpm -qa --queryformat.*SIGPGP");
+        let mut kept: Vec<&str> = Vec::new();
+        let mut in_pkg_list = false;
+        for line in trimmed.lines() {
+            if queryformat_start.is_match(line) {
+                in_pkg_list = true;
+                continue;
+            }
+            if line.starts_with("#==[ Command ]======") || queryformat_sigpgp.is_match(line) {
+                in_pkg_list = false;
+            }
+            if in_pkg_list {
+                kept.push(line);
+            }
+        }
+        let filtered = kept.join("\n");
+        // Lines look like: "name  DISTRIBUTION  version" — name is first token, version is last.
+        let mut entries: Vec<PackageEntry> = Vec::new();
+        for (i, line) in filtered.lines().enumerate() {
+            let t = line.trim();
+            if t.is_empty() || t.starts_with("NAME") || t.starts_with("DISTRIBUTION") {
+                continue;
+            }
+            let toks: Vec<&str> = t.split_whitespace().collect();
+            if toks.len() < 2 {
+                continue;
+            }
+            let name = toks[0].to_string();
+            let version = toks[toks.len() - 1].to_string();
+            entries.push((name, version, i + 1));
+        }
+        let pkg_count = filtered
+            .lines()
+            .filter(|l| {
+                let t = l.trim();
+                !t.is_empty() && !t.starts_with("NAME") && !t.starts_with("DISTRIBUTION")
+            })
+            .count();
+        let fips_packages = collect_fips_packages(&entries, source_path);
+        let has_dracut_fips = fips_packages
+            .iter()
+            .any(|p| p.name == "dracut-fips" || p.name.starts_with("dracut-fips-"));
+        let (packages, warnings) = validate_packages(&entries, source_path);
+        return DistroPackagesResult {
+            found: true,
+            is_dpkg: false,
+            is_rpm_raw: true,
+            is_zypper_history: false,
+            is_dnf_yum_log: false,
+            raw_content: Some(filtered),
+            package_count: pkg_count,
+            packages,
+            warnings,
+            fips_packages,
+            has_dracut_fips,
+            source_path: source_path.to_string(),
+        };
+    }
+
+    if trimmed.contains("Desired=Unknown/Install/Remove/Purge/Hold") {
+        let package_count = trimmed
+            .lines()
+            .filter(|l| {
+                let t = l.trim();
+                !t.is_empty()
+                    && !t.starts_with("Desired")
+                    && !t.starts_with('|')
+                    && !t.starts_with("+++")
+            })
+            .count();
+        return DistroPackagesResult {
+            found: true,
+            is_dpkg: true,
+            is_rpm_raw: false,
+            is_zypper_history: false,
+            is_dnf_yum_log: false,
+            raw_content: Some(trimmed.to_string()),
+            package_count,
+            packages: BTreeMap::new(),
+            warnings: Vec::new(),
+            fips_packages: Vec::new(),
+            has_dracut_fips: false,
+            source_path: source_path.to_string(),
+        };
+    }
+
+    let (entries, raw_content, is_zypper_history, is_dnf_yum_log, is_rpm_raw) =
+        if trimmed.lines().any(|l| l.contains("|install|")) {
+            let (entries, raw_lines) = parse_zypper_history(trimmed);
+            (entries, Some(raw_lines.join("\n")), true, false, true)
+        } else if trimmed.lines().any(|l| l.contains("Installed:")) {
+            let (entries, raw_lines) = parse_dnf_yum_log(trimmed);
+            (entries, Some(raw_lines.join("\n")), false, true, true)
+        } else {
+            let entries = parse_package_entries_from_raw_listing(trimmed);
+            let count = trimmed
+                .lines()
+                .filter(|l| {
+                    let t = l.trim();
+                    !t.is_empty()
+                        && !t.starts_with("Installed Packages")
+                        && !t.starts_with("Last metadata")
+                        && !t.starts_with("Loaded plugins")
+                })
+                .count();
+            let raw = if count > 0 {
+                Some(trimmed.to_string())
+            } else {
+                None
+            };
+            (entries, raw, false, false, true)
+        };
+
+    if entries.is_empty() && raw_content.is_none() {
+        return empty;
+    }
+
+    let package_count = entries.len();
+    let fips_packages = collect_fips_packages(&entries, source_path);
+    let has_dracut_fips = fips_packages
+        .iter()
+        .any(|p| p.name == "dracut-fips" || p.name.starts_with("dracut-fips-"));
+    let (packages, warnings) = validate_packages(&entries, source_path);
+
+    DistroPackagesResult {
+        found: true,
+        is_dpkg: false,
+        is_rpm_raw,
+        is_zypper_history,
+        is_dnf_yum_log,
+        raw_content,
+        package_count,
+        packages,
+        warnings,
+        fips_packages,
+        has_dracut_fips,
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_distro_packages_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_distro_packages(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_package_distro_mismatch_json(
+    content: &str,
+    source_path: &str,
+    running_distro_id: &str,
+    running_version_id: &str,
+) -> String {
+    let mut value = serde_json::to_value(parse_package_distro_mismatch(
+        content,
+        source_path,
+        running_distro_id,
+        running_version_id,
+    ))
+    .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const PATH: &str = "sos_commands/rpm/package-data";
+
+    #[test]
+    fn validates_rpm_packages_and_fips() {
+        let input = concat!(
+            "fence-agents-4.12.1-1.noarch\n",
+            "python3-azure-mgmt-compute-18.0-1.noarch\n",
+            "python3-azure-identity-1.12.0-1.noarch\n",
+            "cloud-netconfig-azure-1.5-1.noarch\n",
+            "resource-agents-4.3.0-1.noarch\n",
+            "python3-azure-core-1.10.0-1.noarch\n",
+            "dracut-fips-049-1.noarch\n"
+        );
+
+        let result = parse_distro_packages(input, PATH);
+        assert!(result.found);
+        assert!(result.has_dracut_fips);
+        assert!(result
+            .warnings
+            .iter()
+            .any(|w| w.package == "python3-azure-core"));
+    }
+
+    #[test]
+    fn parses_zypper_history() {
+        let input = concat!(
+            "2024-01-15 10:00:00|install|fence-agents|4.12.1|x86_64|root|repo\n",
+            "2024-01-15 10:00:01|install|resource-agents|4.4.0|x86_64|root|repo\n"
+        );
+        let result = parse_distro_packages(input, PATH);
+        assert!(result.found);
+        assert!(result.is_zypper_history);
+        assert_eq!(result.package_count, 2);
+    }
+
+    #[test]
+    fn detects_dpkg_raw_listing() {
+        let input = concat!(
+            "Desired=Unknown/Install/Remove/Purge/Hold\n",
+            "ii  openssh-server  1:9.6p1 amd64\n"
+        );
+        let result = parse_distro_packages(input, PATH);
+        assert!(result.found);
+        assert!(result.is_dpkg);
+    }
+
+    #[test]
+    fn detects_dnf_exclude_customizations_with_source_lines() {
+        let input = concat!(
+            "[main]\n",
+            "gpgcheck=1\n",
+            "exclude=openssl* openssl-libs*\n",
+            "installonly_limit=3\n",
+        );
+
+        let result = parse_distro_packages(input, "etc/dnf/dnf.conf");
+
+        assert!(result.found);
+        assert!(result.warnings.iter().any(|w| w.package == "dnf_exclude"));
+        let warning = result
+            .warnings
+            .iter()
+            .find(|w| w.package == "dnf_exclude")
+            .expect("exclude customization warning");
+        assert_eq!(warning.source_line, Some(3));
+        assert!(warning.message.contains("exclude=openssl* openssl-libs*"));
+        assert!(result.raw_content.as_deref().unwrap_or_default().contains("exclude=openssl* openssl-libs*"));
+    }
+
+    #[test]
+    fn package_warnings_carry_source_provenance() {
+        // python3-azure-core 1.10.0 falls in the problem range -> warning.
+        // fence-agents not present -> "not found" warning with source_line=None.
+        // Layout makes line numbers predictable.
+        let input = concat!(
+            "resource-agents-4.3.0-1.noarch\n",
+            "python3-azure-mgmt-compute-18.0-1.noarch\n",
+            "python3-azure-identity-1.12.0-1.noarch\n",
+            "cloud-netconfig-azure-1.5-1.noarch\n",
+            "python3-azure-core-1.10.0-1.noarch\n",
+            "dracut-fips-049-1.noarch\n"
+        );
+
+        let result = parse_distro_packages(input, PATH);
+        assert_eq!(result.source_path, PATH);
+
+        let core_warn = result
+            .warnings
+            .iter()
+            .find(|w| w.package == "python3-azure-core")
+            .expect("python3-azure-core warning");
+        assert_eq!(core_warn.source_path, PATH);
+        assert_eq!(core_warn.source_line, Some(5));
+
+        let missing = result
+            .warnings
+            .iter()
+            .find(|w| w.package == "fence-agents")
+            .expect("fence-agents missing warning");
+        assert_eq!(missing.actual, "not found");
+        assert_eq!(missing.source_line, None);
+
+        let fips = result
+            .fips_packages
+            .iter()
+            .find(|p| p.name.starts_with("dracut-fips"))
+            .expect("fips entry");
+        assert_eq!(fips.source_line, Some(6));
+        assert_eq!(fips.source_path, PATH);
+    }
+
+    #[test]
+    fn packages_json_wrapper_includes_source_path() {
+        let input = "fence-agents-4.12.1-1.noarch\n";
+        let json = parse_distro_packages_json(input, PATH);
+        assert!(json.contains("\"source_path\":\"sos_commands/rpm/package-data\""));
+    }
+
+    #[test]
+    fn detects_package_distro_and_major_version_drift() {
+        let input = concat!(
+            "bash-5.1.8-6.el7.x86_64\n",
+            "coreutils-9.1-6.sles15.x86_64\n",
+            "util-linux-2.37-10.el9.x86_64\n"
+        );
+
+        let result = parse_package_distro_mismatch(input, PATH, "rhel", "9.4");
+        assert!(result.found);
+        assert_eq!(result.count, 2);
+        assert!(result
+            .mismatches
+            .iter()
+            .any(|m| m.issue == "major_version_mismatch" && m.package == "bash"));
+        assert!(result
+            .mismatches
+            .iter()
+            .any(|m| m.issue == "cross_distro" && m.package == "coreutils"));
+    }
+
+    #[test]
+    fn package_distro_mismatch_json_wrapper_includes_source_path() {
+        let input = "bash-5.1.8-6.el7.x86_64\n";
+        let json = parse_package_distro_mismatch_json(input, PATH, "rhel", "9.4");
+        assert!(json.contains("\"source_path\":\"sos_commands/rpm/package-data\""));
+    }
+}
diff --git a/rca-tool/lib/supportfile_core/src/parsers/services.rs b/rca-tool/lib/supportfile_core/src/parsers/services.rs
new file mode 100644
index 0000000..d72fff8
--- /dev/null
+++ b/rca-tool/lib/supportfile_core/src/parsers/services.rs
@@ -0,0 +1,792 @@
+use regex::Regex;
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+
+fn extract_timestamp(line: &str) -> Option<String> {
+    let iso_re = crate::cached_regex!(
+        r"^(\d{4}-\d{2}-\d{2}[T\s]\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:[+-]\d{2}:\d{2})?)"
+    );
+    let syslog_re = crate::cached_regex!(r"^(\w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}(?:\.\d+)?)");
+    iso_re
+        .captures(line)
+        .and_then(|c| c.get(1).map(|m| m.as_str().to_string()))
+        .or_else(|| {
+            syslog_re
+                .captures(line)
+                .and_then(|c| c.get(1).map(|m| m.as_str().to_string()))
+        })
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct ServiceEvent {
+    pub timestamp: String,
+    pub line_number: usize,
+    pub issue_type: String,
+    pub message: String,
+    pub raw_line: String,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct ServiceEventsResult {
+    pub found: bool,
+    pub count: usize,
+    pub events: Vec<ServiceEvent>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct ServiceDetectionResult {
+    pub found: bool,
+    pub service_name: String,
+    pub severity: String,
+    pub message: String,
+    pub documentation_url: Option<String>,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct SecuritySoftwareResult {
+    pub found: bool,
+    pub software_name: String,
+    pub message: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct FstrimResult {
+    pub found: bool,
+    pub timer_enabled: bool,
+    pub timer_state: Option<String>,
+    pub warnings: Vec<crate::parsers::unix::UnixWarning>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct ConfigCheckResult {
+    pub found: bool,
+    pub has_exclusions: bool,
+    pub message: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct InvolfltVersionResult {
+    pub found: bool,
+    pub loaded: bool,
+    pub version: Option<String>,
+    pub build_date: Option<String>,
+    pub filename: Option<String>,
+    pub description: Option<String>,
+    pub source: String,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct InvolfltKernelVersionResult {
+    pub found: bool,
+    pub version: Option<String>,
+    pub source: Option<String>,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct AzureExtensionEvent {
+    pub name: String,
+    pub label: String,
+    pub version: String,
+    pub status: String,
+    pub code: i64,
+    pub message: String,
+    pub healthy: bool,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct AzureExtensionsResult {
+    pub found: bool,
+    pub count: usize,
+    pub events: Vec<AzureExtensionEvent>,
+    pub source_path: String,
+}
+
+fn detect_systemd_service(
+    content: &str,
+    service_name: &str,
+    severity: &str,
+    message: &str,
+    documentation_url: Option<&str>,
+    source_path: &str,
+) -> ServiceDetectionResult {
+    let re = Regex::new(&format!(
+        r"(?im)\b{}(?:\.service)?\b",
+        regex::escape(service_name)
+    ))
+    .unwrap();
+    let mut source_line: Option<usize> = None;
+    let mut found = false;
+    for (i, line) in content.lines().enumerate() {
+        if re.is_match(line) {
+            found = true;
+            source_line = Some(i + 1);
+            break;
+        }
+    }
+
+    ServiceDetectionResult {
+        found,
+        service_name: service_name.to_string(),
+        severity: severity.to_string(),
+        message: if found {
+            message.to_string()
+        } else {
+            String::new()
+        },
+        documentation_url: if found {
+            documentation_url.map(|s| s.to_string())
+        } else {
+            None
+        },
+        source_path: source_path.to_string(),
+        source_line,
+    }
+}
+
+fn detect_security_software(
+    content: &str,
+    markers: &[&str],
+    software_name: &str,
+    message: &str,
+    source_path: &str,
+) -> SecuritySoftwareResult {
+    let lowered = content.to_ascii_lowercase();
+    let mut source_line: Option<usize> = None;
+    let mut found = false;
+    'outer: for (i, line) in content.lines().enumerate() {
+        let line_lower = line.to_ascii_lowercase();
+        for m in markers {
+            if line_lower.contains(&m.to_ascii_lowercase()) {
+                found = true;
+                source_line = Some(i + 1);
+                break 'outer;
+            }
+        }
+    }
+    if !found {
+        // Fallback: detect across the full content even if line iter missed it.
+        found = markers
+            .iter()
+            .any(|m| lowered.contains(&m.to_ascii_lowercase()));
+    }
+    SecuritySoftwareResult {
+        found,
+        software_name: software_name.to_string(),
+        message: if found {
+            message.to_string()
+        } else {
+            String::new()
+        },
+        source_path: source_path.to_string(),
+        source_line,
+    }
+}
+
+fn check_exclusions(
+    content: &str,
+    keywords: &[&str],
+    software_name: &str,
+    source_path: &str,
+) -> ConfigCheckResult {
+    let lowered = content.to_ascii_lowercase();
+    let mut source_line: Option<usize> = None;
+    for (i, line) in content.lines().enumerate() {
+        let line_lower = line.to_ascii_lowercase();
+        if keywords
+            .iter()
+            .any(|k| line_lower.contains(&k.to_ascii_lowercase()))
+        {
+            source_line = Some(i + 1);
+            break;
+        }
+    }
+    let has_exclusions = keywords
+        .iter()
+        .any(|k| lowered.contains(&k.to_ascii_lowercase()));
+    ConfigCheckResult {
+        found: has_exclusions,
+        has_exclusions,
+        message: if has_exclusions {
+            format!("{} exclusion or exception settings detected", software_name)
+        } else {
+            format!("{} exclusions were not detected", software_name)
+        },
+        source_path: source_path.to_string(),
+        source_line,
+    }
+}
+
+pub fn parse_ssh_service_issues(content: &str, source_path: &str) -> ServiceEventsResult {
+    let mut events = Vec::new();
+    for (i, line) in content.lines().enumerate() {
+        if !(line.contains("OpenSSH")
+            || line.contains("/var/empty/sshd")
+            || line.contains("Missing privilege separation directory"))
+        {
+            continue;
+        }
+        if let Some(caps) = crate::cached_regex!(
+            r"(?i)Missing privilege separation directory:\s*(\S+)"
+        )
+        .captures(line)
+        {
+            let dir = caps
+                .get(1)
+                .map(|m| m.as_str())
+                .unwrap_or("(unknown)");
+            events.push(ServiceEvent {
+                timestamp: extract_timestamp(line)
+                    .unwrap_or_else(|| "Date not detected".to_string()),
+                line_number: i + 1,
+                issue_type: "ssh_missing_privsep_dir".to_string(),
+                message: format!("Missing privilege separation directory: {dir}"),
+                raw_line: line.trim().to_string(),
+                source_path: source_path.to_string(),
+            });
+        }
+        if crate::cached_regex!(r"(?i)Failed to start OpenSSH server daemon").is_match(line) {
+            events.push(ServiceEvent {
+                timestamp: extract_timestamp(line)
+                    .unwrap_or_else(|| "Date not detected".to_string()),
+                line_number: i + 1,
+                issue_type: "ssh_start_failed".to_string(),
+                message: "Failed to start OpenSSH server daemon".to_string(),
+                raw_line: line.trim().to_string(),
+                source_path: source_path.to_string(),
+            });
+        }
+        if crate::cached_regex!(
+            r"(?i)/var/empty/sshd must be owned by root and not group or world-writable"
+        )
+        .is_match(line)
+        {
+            events.push(ServiceEvent {
+                timestamp: extract_timestamp(line)
+                    .unwrap_or_else(|| "Date not detected".to_string()),
+                line_number: i + 1,
+                issue_type: "ssh_permission_error".to_string(),
+                message: "/var/empty/sshd must be owned by root and not group or world-writable"
+                    .to_string(),
+                raw_line: line.trim().to_string(),
+                source_path: source_path.to_string(),
+            });
+        }
+    }
+    ServiceEventsResult {
+        found: !events.is_empty(),
+        count: events.len(),
+        events,
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_dlm_service(content: &str, source_path: &str) -> ServiceDetectionResult {
+    detect_systemd_service(
+        content,
+        "dlm",
+        "error",
+        "DLM service is enabled in systemd and should be managed as a cluster resource.",
+        Some("https://access.redhat.com/solutions/878023"),
+        source_path,
+    )
+}
+
+pub fn parse_azure_site_recovery(content: &str, source_path: &str) -> ServiceDetectionResult {
+    detect_systemd_service(
+        content,
+        "involflt_start",
+        "info",
+        "Azure Site Recovery is enabled on this system.",
+        None,
+        source_path,
+    )
+}
+
+pub fn parse_guardicore_agent(content: &str, source_path: &str) -> ServiceDetectionResult {
+    detect_systemd_service(
+        content,
+        "gc-agent",
+        "warning",
+        "Guardicore agent is enabled on this system.",
+        None,
+        source_path,
+    )
+}
+
+pub fn parse_puppet_agent(content: &str, source_path: &str) -> ServiceDetectionResult {
+    detect_systemd_service(
+        content,
+        "puppet",
+        "info",
+        "Puppet agent is enabled on this system. This configuration management tool automates system configuration and management.",
+        None,
+        source_path,
+    )
+}
+
+pub fn parse_chef_client(content: &str, source_path: &str) -> ServiceDetectionResult {
+    detect_systemd_service(
+        content,
+        "chef-client",
+        "info",
+        "Chef client is enabled on this system. This configuration management tool automates infrastructure deployment and management.",
+        None,
+        source_path,
+    )
+}
+
+pub fn parse_illumio(content: &str, source_path: &str) -> SecuritySoftwareResult {
+    detect_security_software(
+        content,
+        &["illumio"],
+        "Illumio",
+        "Illumio detected. SAP exclusions should be verified in Illumio policy configuration.",
+        source_path,
+    )
+}
+
+pub fn parse_trend_micro(content: &str, source_path: &str) -> SecuritySoftwareResult {
+    detect_security_software(
+        content,
+        &["ds_agent.service", "trend micro"],
+        "Trend Micro Deep Security",
+        "Trend Micro Deep Security detected. SAP exclusions should be verified in Deep Security Manager.",
+        source_path,
+    )
+}
+
+pub fn parse_falcon_sensor(content: &str, source_path: &str) -> SecuritySoftwareResult {
+    detect_security_software(
+        content,
+        &["falcon-sensor", "/opt/CrowdStrike"],
+        "Falcon Sensor",
+        "Falcon Sensor detected. SAP exclusions should be verified manually in CrowdStrike configuration.",
+        source_path,
+    )
+}
+
+pub fn parse_falcon_sensor_config(content: &str, source_path: &str) -> ConfigCheckResult {
+    check_exclusions(
+        content,
+        &["exclude", "exception"],
+        "Falcon Sensor",
+        source_path,
+    )
+}
+
+pub fn parse_ms_defender(content: &str, source_path: &str) -> SecuritySoftwareResult {
+    detect_security_software(
+        content,
+        &["mdatp", "wdavdaemon", "/opt/microsoft/mdatp"],
+        "MS Defender",
+        "Microsoft Defender detected. SAP exclusions should be verified with mdatp exclusion list.",
+        source_path,
+    )
+}
+
+pub fn parse_ms_defender_config(content: &str, source_path: &str) -> ConfigCheckResult {
+    check_exclusions(
+        content,
+        &["exclusion", "exclude"],
+        "Microsoft Defender",
+        source_path,
+    )
+}
+
+pub fn parse_involflt_version(content: &str, source_path: &str) -> InvolfltVersionResult {
+    let mut result = InvolfltVersionResult {
+        found: false,
+        loaded: crate::cached_regex!(r"(?m)^involflt\s+\d+").is_match(content),
+        version: None,
+        build_date: None,
+        filename: None,
+        description: None,
+        source: "modinfo".to_string(),
+        source_path: source_path.to_string(),
+    };
+
+    if let Some(caps) = crate::cached_regex!(r"(?m)^version:\s*(.+)$").captures(content) {
+        result.version = caps.get(1).map(|m| m.as_str().trim().to_string());
+        result.build_date = result
+            .version
+            .as_ref()
+            .and_then(|v| crate::cached_regex!(r"([A-Za-z]+\s+\d+\s+\d{4})").captures(v))
+            .and_then(|c| c.get(1).map(|m| m.as_str().to_string()));
+        result.found = true;
+    }
+    if let Some(caps) = crate::cached_regex!(r"(?m)^filename:\s*(.+)$").captures(content) {
+        result.filename = caps.get(1).map(|m| m.as_str().trim().to_string());
+        result.found = true;
+    }
+    if let Some(caps) = crate::cached_regex!(r"(?m)^description:\s*(.+)$").captures(content) {
+        result.description = caps.get(1).map(|m| m.as_str().trim().to_string());
+        result.found = true;
+    }
+    if result.loaded {
+        result.found = true;
+    }
+    result
+}
+
+pub fn parse_involflt_kernel_version(
+    content: &str,
+    source_path: &str,
+) -> InvolfltKernelVersionResult {
+    let re = crate::cached_regex!(r"(?i)involflt\[involflt_init[^\]]*\]:\s*Version\s*-\s*([\d.]+)");
+    let mut version = None;
+    let mut source_line = None;
+    for (i, line) in content.lines().enumerate() {
+        if let Some(c) = re.captures(line) {
+            version = c.get(1).map(|m| m.as_str().trim().to_string());
+            source_line = Some(i + 1);
+            break;
+        }
+    }
+
+    InvolfltKernelVersionResult {
+        found: version.is_some(),
+        version,
+        source: Some("kernel_log".to_string()),
+        source_path: source_path.to_string(),
+        source_line,
+    }
+}
+
+pub fn parse_azure_extensions(content: &str, source_path: &str) -> AzureExtensionsResult {
+    let Ok(status) = serde_json::from_str::<Value>(content.trim()) else {
+        return AzureExtensionsResult {
+            found: false,
+            count: 0,
+            events: Vec::new(),
+            source_path: source_path.to_string(),
+        };
+    };
+
+    let name = status
+        .get("name")
+        .and_then(Value::as_str)
+        .unwrap_or_default()
+        .to_string();
+    if name.is_empty() {
+        return AzureExtensionsResult {
+            found: false,
+            count: 0,
+            events: Vec::new(),
+            source_path: source_path.to_string(),
+        };
+    }
+
+    let label = match name.as_str() {
+        "Microsoft.Azure.AzureDefenderForServers.MDE.Linux" => "Microsoft Defender for Endpoint",
+        "Microsoft.Azure.RecoveryServices.VMSnapshotLinux" => "Azure Backup – VM Snapshot",
+        "Microsoft.Azure.RecoveryServices.WorkloadBackup.AzureBackupLinuxWorkload" => {
+            "Azure Backup – Workload"
+        }
+        "Microsoft.CPlat.Core.LinuxPatchExtension" => "Azure Update Manager",
+        "Microsoft.CPlat.Core.RunCommandLinux" => "Run Command",
+        "Microsoft.Azure.RecoveryServices.SiteRecovery.Linux" => "Azure Site Recovery",
+        "Microsoft.OSTCExtensions.VMAccessForLinux" => "VM Access (Password Reset)",
+        "Microsoft.Azure.Monitor.AzureMonitorLinuxAgent" => "Azure Monitor Agent",
+        "Microsoft.Azure.Extensions.CustomScript" => "Custom Script Extension",
+        "Microsoft.EnterpriseCloud.Monitoring.OmsAgentForLinux" => "Log Analytics Agent",
+        _ => name.as_str(),
+    }
+    .to_string();
+
+    let version = status
+        .get("version")
+        .and_then(Value::as_str)
+        .unwrap_or("unknown")
+        .to_string();
+    let runtime_status = status
+        .get("status")
+        .and_then(Value::as_str)
+        .unwrap_or("unknown")
+        .to_string();
+    let code = status.get("code").and_then(Value::as_i64).unwrap_or(-1);
+    let message = status
+        .get("message")
+        .and_then(Value::as_str)
+        .unwrap_or("")
+        .to_string();
+    let healthy = runtime_status == "Ready" && code == 0;
+
+    AzureExtensionsResult {
+        found: true,
+        count: 1,
+        events: vec![AzureExtensionEvent {
+            name,
+            label,
+            version,
+            status: runtime_status,
+            code,
+            message,
+            healthy,
+            source_path: source_path.to_string(),
+        }],
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_ssh_service_issues_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_ssh_service_issues(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_dlm_service_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_dlm_service(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_azure_site_recovery_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_azure_site_recovery(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_guardicore_agent_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_guardicore_agent(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_puppet_agent_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_puppet_agent(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_chef_client_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_chef_client(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_illumio_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_illumio(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_trend_micro_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_trend_micro(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_falcon_sensor_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_falcon_sensor(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_falcon_sensor_config_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_falcon_sensor_config(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_ms_defender_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_ms_defender(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_ms_defender_config_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_ms_defender_config(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_involflt_version_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_involflt_version(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_involflt_kernel_version_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_involflt_kernel_version(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_azure_extensions_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_azure_extensions(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+/// Parse the state of the `fstrim.timer` systemd unit.
+///
+/// Accepts either the single-word output of `systemctl is-enabled fstrim.timer`
+/// (e.g. `enabled`, `disabled`, `masked`) or a `systemctl list-unit-files`
+/// listing containing a `fstrim.timer <state>` row.
+pub fn parse_fstrim(content: &str, source_path: &str) -> FstrimResult {
+    let mut timer_state: Option<String> = None;
+    for line in content.lines() {
+        let trimmed = line.trim();
+        if let Some(c) =
+            crate::cached_regex!(r"(?i)^fstrim\.timer\s+(\w+)").captures(trimmed)
+        {
+            timer_state = Some(c[1].to_ascii_lowercase());
+            break;
+        }
+    }
+    if timer_state.is_none() {
+        let single = content.trim();
+        if matches!(
+            single.to_ascii_lowercase().as_str(),
+            "enabled" | "disabled" | "masked" | "static" | "indirect"
+        ) {
+            timer_state = Some(single.to_ascii_lowercase());
+        }
+    }
+    let timer_enabled = timer_state.as_deref() == Some("enabled");
+    let mut warnings = Vec::new();
+    if timer_enabled {
+        warnings.push(crate::parsers::unix::UnixWarning {
+            r#type: "fstrim_timer_enabled".to_string(),
+            severity: "warning".to_string(),
+            message: "The periodic fstrim.timer is enabled.".to_string(),
+            recommendation: Some(
+                "SAP guidance recommends disabling periodic fstrim on SAP hosts to avoid I/O impact; run systemctl disable --now fstrim.timer."
+                    .to_string(),
+            ),
+            documentation_url: None,
+            source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+        });
+    }
+    FstrimResult {
+        found: timer_state.is_some(),
+        timer_enabled,
+        timer_state,
+        warnings,
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_fstrim_json(content: &str, source_path: &str) -> String {
+    let mut value =
+        serde_json::to_value(parse_fstrim(content, source_path)).unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn detects_ssh_issues() {
+        let input = concat!(
+            "Jan 10 12:00:00 node1 systemd[1]: Failed to start OpenSSH server daemon.\n",
+            "Jan 10 12:00:01 node1 sshd[123]: /var/empty/sshd must be owned by root and not group or world-writable\n"
+        );
+        let result = parse_ssh_service_issues(input, "");
+        assert!(result.found);
+        assert_eq!(result.count, 2);
+    }
+
+    #[test]
+    fn detects_ssh_missing_privsep_dir() {
+        let input =
+            "Jan 10 12:00:00 node1 sshd[634020]: fatal: Missing privilege separation directory: /run/sshd";
+        let result = parse_ssh_service_issues(input, "");
+        assert!(result.found);
+        assert_eq!(result.count, 1);
+        assert_eq!(result.events[0].issue_type, "ssh_missing_privsep_dir");
+        assert_eq!(
+            result.events[0].message,
+            "Missing privilege separation directory: /run/sshd"
+        );
+    }
+
+    #[test]
+    fn detects_systemd_and_security_software() {
+        let dlm = parse_dlm_service("dlm.service enabled", "");
+        let puppet = parse_puppet_agent("puppet.service enabled", "");
+        let chef = parse_chef_client("chef-client.service enabled", "");
+        let falcon = parse_falcon_sensor("falcon-sensor running from /opt/CrowdStrike", "");
+        assert!(dlm.found);
+        assert!(puppet.found);
+        assert!(chef.found);
+        assert!(falcon.found);
+    }
+
+    #[test]
+    fn parses_involflt_version_data() {
+        let input = concat!(
+            "involflt              897024  14\n",
+            "version:        Oct 23 2024 [ 02:41:25 ]\n",
+            "filename:       /lib/modules/involflt.ko\n",
+            "description:    Azure Site Recovery filter driver\n"
+        );
+        let result = parse_involflt_version(input, "");
+        assert!(result.found);
+        assert!(result.loaded);
+        assert!(result.version.is_some());
+    }
+
+    #[test]
+    fn parses_azure_extension_status() {
+        let input = r#"{
+          "name": "Microsoft.Azure.Extensions.CustomScript",
+          "version": "2.1.10",
+          "status": "Ready",
+          "code": 0,
+          "message": "success"
+        }"#;
+        let result = parse_azure_extensions(input, "");
+        assert!(result.found);
+        assert_eq!(result.count, 1);
+        assert!(result.events[0].healthy);
+    }
+
+    #[test]
+    fn parses_fstrim_timer_state() {
+        let enabled = parse_fstrim("fstrim.timer                               enabled\n", "");
+        assert!(enabled.found);
+        assert!(enabled.timer_enabled);
+        assert!(!enabled.warnings.is_empty());
+
+        let disabled = parse_fstrim("disabled\n", "");
+        assert!(disabled.found);
+        assert!(!disabled.timer_enabled);
+        assert!(disabled.warnings.is_empty());
+
+        let absent = parse_fstrim("some-other-unit.service enabled\n", "");
+        assert!(!absent.found);
+    }
+}
diff --git a/rca-tool/lib/supportfile_core/src/parsers/storage.rs b/rca-tool/lib/supportfile_core/src/parsers/storage.rs
new file mode 100644
index 0000000..d2f2bcf
--- /dev/null
+++ b/rca-tool/lib/supportfile_core/src/parsers/storage.rs
@@ -0,0 +1,1683 @@
+use regex::Regex;
+use serde::{Deserialize, Serialize};
+use std::collections::{BTreeMap, BTreeSet};
+
+// ---------------------------------------------------------------------------
+// Provenance
+// ---------------------------------------------------------------------------
+//
+// Every leaf record produced by the storage parsers carries flat
+// `source_path` / `source_line` / `source_line_end` fields so consumers can
+// trace each detection back to the original file inside a support archive
+// (sosreport / supportconfig). When a parser is invoked without a known
+// source path the caller may pass an empty string; line numbers are 1-based
+// and refer to the supplied `content`.
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct StorageWarning {
+    #[serde(rename = "type")]
+    pub r#type: String,
+    pub message: String,
+    pub details: Option<String>,
+    pub severity: Option<String>,
+    pub recommendation: Option<String>,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct LvmPv {
+    pub device: String,
+    pub vg: String,
+    pub attr: String,
+    pub size: String,
+    pub free: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct LvmVg {
+    pub name: String,
+    pub pv_count: String,
+    pub lv_count: String,
+    pub attr: String,
+    pub size: String,
+    pub free: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct LvmLv {
+    pub name: String,
+    pub vg: String,
+    pub attr: String,
+    pub size: String,
+    pub pool: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct LvmConfigResult {
+    pub found: bool,
+    pub pvs: Vec<LvmPv>,
+    pub vgs: Vec<LvmVg>,
+    pub lvs: Vec<LvmLv>,
+    pub warnings: Vec<StorageWarning>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct RaidDevice {
+    pub device: String,
+    pub state: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct RaidSyncStatus {
+    pub operation: String,
+    pub percentage: String,
+    pub finish: Option<String>,
+    pub speed: Option<String>,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct RaidArray {
+    pub device: String,
+    pub state: String,
+    pub level: String,
+    pub devices: Vec<RaidDevice>,
+    pub sync_status: Option<RaidSyncStatus>,
+    pub size: Option<String>,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct RaidConfigResult {
+    pub found: bool,
+    pub arrays: Vec<RaidArray>,
+    pub warnings: Vec<StorageWarning>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct BtrfsFilesystem {
+    pub label: Option<String>,
+    pub uuid: Option<String>,
+    pub devices: Vec<String>,
+    pub total_size: Option<String>,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct BtrfsSubvolume {
+    pub id: String,
+    pub path: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct BtrfsConfigResult {
+    pub found: bool,
+    pub filesystems: Vec<BtrfsFilesystem>,
+    pub subvolumes: Vec<BtrfsSubvolume>,
+    pub warnings: Vec<StorageWarning>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct BlockDeviceInfo {
+    pub name: String,
+    pub device: String,
+    pub r#type: String,
+    pub mountpoint: Option<String>,
+    pub fstype: Option<String>,
+    pub uuid: Option<String>,
+    pub size: Option<String>,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct BlockDevicesResult {
+    pub found: bool,
+    pub disks: Vec<BlockDeviceInfo>,
+    pub partitions: Vec<BlockDeviceInfo>,
+    pub uuid_map: BTreeMap<String, String>,
+    /// device path → device info, used by the storage-correlation pass
+    /// to look up fstype/uuid when fstab references a device path.
+    pub device_map: BTreeMap<String, BlockDeviceInfo>,
+    pub mount_points: BTreeMap<String, String>,
+    pub warnings: Vec<StorageWarning>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct FstabEntry {
+    pub source: String,
+    pub mountpoint: String,
+    pub fstype: String,
+    pub options: String,
+    pub dump: String,
+    pub pass: String,
+    pub source_type: String,
+    /// When `source_type == "uuid"`, the bare UUID (without the
+    /// `UUID=` prefix) so the storage-correlation step can look it up
+    /// against `blockDevices.uuidMap` directly.
+    pub uuid: Option<String>,
+    /// When `source_type == "device"`, the device path (same as
+    /// `source`) so the correlation step can look it up directly
+    /// against `blockDevices.deviceMap`.
+    pub device: Option<String>,
+    pub has_nofail: bool,
+    pub is_os_partition: bool,
+    pub is_virtual_fs: bool,
+    pub needs_nofail: bool,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct FstabAnalysisResult {
+    pub found: bool,
+    pub entries: Vec<FstabEntry>,
+    pub warnings: Vec<StorageWarning>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct DfEntry {
+    pub filesystem: String,
+    pub fstype: Option<String>,
+    pub size: String,
+    pub used: String,
+    pub available: String,
+    pub use_percent: i32,
+    pub mountpoint: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct DfOutputResult {
+    pub found: bool,
+    pub filesystems: Vec<DfEntry>,
+    pub mount_to_usage: BTreeMap<String, DfEntry>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct MtabEntry {
+    pub source: String,
+    pub mountpoint: String,
+    pub fstype: String,
+    pub options: String,
+    pub is_virtual_fs: bool,
+    pub source_type: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct MtabAnalysisResult {
+    pub found: bool,
+    pub entries: Vec<MtabEntry>,
+    pub extra_mounts: Vec<MtabEntry>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct NvmeListResult {
+    pub found: bool,
+    pub has_nvme: bool,
+    pub drive_count: usize,
+    pub content: Option<String>,
+    pub filename: Option<String>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct NfsMount {
+    pub source: String,
+    pub mountpoint: String,
+    pub fstype: String,
+    pub options: String,
+    /// Negotiated/configured protocol version (e.g. "3", "4.1") when present.
+    pub vers: Option<String>,
+    /// Read/write block sizes in bytes when present in the option list.
+    pub rsize: Option<i64>,
+    pub wsize: Option<i64>,
+    /// Mount timeout in deciseconds (NFS `timeo` option) when present.
+    pub timeo: Option<i64>,
+    /// Number of TCP connections (`nconnect`) when present.
+    pub nconnect: Option<i64>,
+    pub has_hard: bool,
+    pub has_soft: bool,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct NfsMountsResult {
+    pub found: bool,
+    pub mounts: Vec<NfsMount>,
+    pub warnings: Vec<StorageWarning>,
+    pub source_path: String,
+}
+
+// ---------------------------------------------------------------------------
+// LVM
+// ---------------------------------------------------------------------------
+
+fn is_lvm_noise(line: &str) -> bool {
+    let t = line.trim();
+    t.starts_with("#==")
+        || t.starts_with("WARNING:")
+        || t.starts_with("Reloading")
+        || t.starts_with("Loading config")
+        || t.starts_with("devices/")
+}
+
+fn validate_lvm(result: &mut LvmConfigResult, source_path: &str) {
+    let vg_names = result
+        .vgs
+        .iter()
+        .map(|vg| vg.name.clone())
+        .collect::<BTreeSet<_>>();
+    for pv in &result.pvs {
+        if !pv.vg.is_empty() && pv.vg != "-" && pv.vg != "--" && !vg_names.contains(&pv.vg) {
+            result.warnings.push(StorageWarning {
+                r#type: "Missing VG".to_string(),
+                message: format!(
+                    "Physical Volume {} references Volume Group '{}' which is not present",
+                    pv.device, pv.vg
+                ),
+                details: Some("This may indicate a missing or corrupted Volume Group".to_string()),
+                severity: None,
+                recommendation: None,
+                source_path: source_path.to_string(),
+                source_line: pv.source_line,
+                source_line_end: pv.source_line_end,
+            });
+        }
+    }
+    for vg in &result.vgs {
+        let actual = result.pvs.iter().filter(|pv| pv.vg == vg.name).count();
+        let expected = vg.pv_count.parse::<usize>().unwrap_or(actual);
+        if actual != expected {
+            result.warnings.push(StorageWarning {
+                r#type: "PV Count Mismatch".to_string(),
+                message: format!(
+                    "Volume Group '{}' expects {} PVs but only {} were found",
+                    vg.name, expected, actual
+                ),
+                details: Some(format!("Missing PVs: {}", expected.saturating_sub(actual))),
+                severity: None,
+                recommendation: None,
+                source_path: source_path.to_string(),
+                source_line: vg.source_line,
+                source_line_end: vg.source_line_end,
+            });
+        }
+    }
+}
+
+pub fn parse_lvm_config(content: &str, source_path: &str) -> LvmConfigResult {
+    let mut result = LvmConfigResult {
+        found: false,
+        pvs: Vec::new(),
+        vgs: Vec::new(),
+        lvs: Vec::new(),
+        warnings: Vec::new(),
+        source_path: source_path.to_string(),
+    };
+    // Accept both the compact `lvs` form (4 columns and end-of-line) and
+    // the verbose `lvs -v` / `lvs -a -o lv_tags,devices ...` form which
+    // appends extra columns after the size — so don't anchor at $.
+    let lv_re =
+        crate::cached_regex!(r"^(\S+)\s+(\S+)\s+([-a-zA-Z]{6,})\s+(<?\d+[\.\d]*[KMGTPmkgtp]?)\b");
+
+    for (idx, raw_line) in content.lines().enumerate() {
+        if is_lvm_noise(raw_line) {
+            continue;
+        }
+        let line_no = idx + 1;
+        let trimmed = raw_line.trim();
+        if trimmed.is_empty() || trimmed.starts_with('#') {
+            continue;
+        }
+
+        if trimmed.starts_with("/dev/") {
+            let parts = trimmed.split_whitespace().collect::<Vec<_>>();
+            if parts.len() >= 3 && parts[2] == "lvm2" {
+                result.pvs.push(LvmPv {
+                    device: parts[0].to_string(),
+                    vg: parts[1].to_string(),
+                    attr: parts.get(3).copied().unwrap_or("-").to_string(),
+                    size: parts.get(4).copied().unwrap_or("-").to_string(),
+                    free: parts.get(5).copied().unwrap_or("-").to_string(),
+                    source_path: source_path.to_string(),
+                    source_line: Some(line_no),
+                    source_line_end: Some(line_no),
+                });
+                continue;
+            }
+        }
+
+        let parts = trimmed.split_whitespace().collect::<Vec<_>>();
+        if parts.len() >= 7 && !parts[0].starts_with('/') {
+            if parts[1].chars().all(|c| c.is_ascii_digit()) {
+                result.vgs.push(LvmVg {
+                    name: parts[0].to_string(),
+                    pv_count: parts[1].to_string(),
+                    lv_count: parts[2].to_string(),
+                    attr: parts[4].to_string(),
+                    size: parts[5].to_string(),
+                    free: parts[6].to_string(),
+                    source_path: source_path.to_string(),
+                    source_line: Some(line_no),
+                    source_line_end: Some(line_no),
+                });
+                continue;
+            }
+            if parts.len() >= 8 && parts[3].chars().all(|c| c.is_ascii_digit()) {
+                result.vgs.push(LvmVg {
+                    name: parts[0].to_string(),
+                    attr: parts[1].to_string(),
+                    pv_count: parts[3].to_string(),
+                    lv_count: parts[4].to_string(),
+                    size: parts[6].to_string(),
+                    free: parts[7].to_string(),
+                    source_path: source_path.to_string(),
+                    source_line: Some(line_no),
+                    source_line_end: Some(line_no),
+                });
+                continue;
+            }
+        }
+
+        if let Some(caps) = lv_re.captures(trimmed) {
+            result.lvs.push(LvmLv {
+                name: caps[1].to_string(),
+                vg: caps[2].to_string(),
+                attr: caps[3].to_string(),
+                size: caps[4].to_string(),
+                pool: "-".to_string(),
+                source_path: source_path.to_string(),
+                source_line: Some(line_no),
+                source_line_end: Some(line_no),
+            });
+        }
+    }
+
+    if !result.pvs.is_empty() || !result.vgs.is_empty() || !result.lvs.is_empty() {
+        result.found = true;
+    }
+    if !result.pvs.is_empty() && !result.vgs.is_empty() {
+        validate_lvm(&mut result, source_path);
+    }
+    result
+}
+
+// ---------------------------------------------------------------------------
+// RAID
+// ---------------------------------------------------------------------------
+
+pub fn parse_raid_config(content: &str, source_path: &str) -> RaidConfigResult {
+    let mut result = RaidConfigResult {
+        found: false,
+        arrays: Vec::new(),
+        warnings: Vec::new(),
+        source_path: source_path.to_string(),
+    };
+
+    let header_re = crate::cached_regex!(r"^(md\d+)\s*:\s*(\w+)\s+(\w+)\s+(.+)$");
+    let dev_re = crate::cached_regex!(r"(\w+)\[\d+\](?:\((\w+)\))?");
+    let blocks_re = crate::cached_regex!(r"(\d+)\s+blocks");
+    let pct_re = crate::cached_regex!(r"([\d.]+)%");
+    let finish_re = crate::cached_regex!(r"finish=([^\s]+)");
+    let speed_re = crate::cached_regex!(r"speed=([^\s]+)");
+
+    let mut current: Option<RaidArray> = None;
+    for (idx, line) in content.lines().enumerate() {
+        let line_no = idx + 1;
+        if let Some(caps) = header_re.captures(line) {
+            if let Some(arr) = current.take() {
+                result.arrays.push(arr);
+            }
+            let devices_str = caps[4].to_string();
+            let mut devices = Vec::new();
+            for dev_caps in dev_re.captures_iter(&devices_str) {
+                let raw_state = dev_caps.get(2).map(|m| m.as_str()).unwrap_or("active");
+                let state = if raw_state == "S" { "spare" } else { raw_state }.to_string();
+                devices.push(RaidDevice {
+                    device: format!("/dev/{}", &dev_caps[1]),
+                    state,
+                    source_path: source_path.to_string(),
+                    source_line: Some(line_no),
+                    source_line_end: Some(line_no),
+                });
+            }
+            if devices_str.contains("(F)") {
+                result.warnings.push(StorageWarning {
+                    r#type: "Faulty Device".to_string(),
+                    message: format!("RAID array /dev/{} has faulty devices", &caps[1]),
+                    details: Some("Check device status with mdadm".to_string()),
+                    severity: None,
+                    recommendation: None,
+                    source_path: source_path.to_string(),
+                    source_line: Some(line_no),
+                    source_line_end: Some(line_no),
+                });
+            }
+            current = Some(RaidArray {
+                device: format!("/dev/{}", &caps[1]),
+                state: caps[2].to_string(),
+                level: caps[3].to_string(),
+                devices,
+                sync_status: None,
+                size: None,
+                source_path: source_path.to_string(),
+                source_line: Some(line_no),
+                source_line_end: Some(line_no),
+            });
+            continue;
+        }
+
+        if let Some(arr) = &mut current {
+            // extend array's line range as we consume continuation lines
+            arr.source_line_end = Some(line_no);
+            if line.contains("blocks") {
+                if let Some(caps) = blocks_re.captures(line) {
+                    let blocks = caps[1].parse::<f64>().unwrap_or(0.0);
+                    arr.size = Some(format!("{:.2} MB", blocks / 1024.0));
+                }
+                if line.contains("[_") {
+                    arr.state = "degraded".to_string();
+                    result.warnings.push(StorageWarning {
+                        r#type: "Degraded Array".to_string(),
+                        message: format!("RAID array {} is degraded", arr.device),
+                        details: Some("One or more devices are missing or failed".to_string()),
+                        severity: None,
+                        recommendation: None,
+                        source_path: source_path.to_string(),
+                        source_line: Some(line_no),
+                        source_line_end: Some(line_no),
+                    });
+                }
+            }
+            if (line.contains("recovery")
+                || line.contains("resync")
+                || line.contains("reshape")
+                || line.contains("check"))
+                && line.contains('%')
+            {
+                let op = if line.contains("recovery") {
+                    "recovery"
+                } else if line.contains("resync") {
+                    "resync"
+                } else if line.contains("reshape") {
+                    "reshape"
+                } else {
+                    "check"
+                };
+                let pct = pct_re
+                    .captures(line)
+                    .and_then(|c| c.get(1).map(|m| m.as_str().to_string()))
+                    .unwrap_or_else(|| "0".to_string());
+                arr.sync_status = Some(RaidSyncStatus {
+                    operation: op.to_string(),
+                    percentage: pct,
+                    finish: finish_re
+                        .captures(line)
+                        .and_then(|c| c.get(1).map(|m| m.as_str().to_string())),
+                    speed: speed_re
+                        .captures(line)
+                        .and_then(|c| c.get(1).map(|m| m.as_str().to_string())),
+                    source_path: source_path.to_string(),
+                    source_line: Some(line_no),
+                    source_line_end: Some(line_no),
+                });
+            }
+        }
+    }
+    if let Some(arr) = current.take() {
+        result.arrays.push(arr);
+    }
+    result.found = !result.arrays.is_empty();
+    result
+}
+
+// ---------------------------------------------------------------------------
+// BTRFS
+// ---------------------------------------------------------------------------
+
+pub fn parse_btrfs_config(content: &str, source_path: &str) -> BtrfsConfigResult {
+    let mut result = BtrfsConfigResult {
+        found: false,
+        filesystems: Vec::new(),
+        subvolumes: Vec::new(),
+        warnings: Vec::new(),
+        source_path: source_path.to_string(),
+    };
+
+    let label_re = crate::cached_regex!(r"Label:\s*(?:'([^']*)'|none)\s+uuid:\s*(\S+)");
+    let dev_re = crate::cached_regex!(r"devid\s+\d+\s+size\s+(\S+)\s+used\s+\S+\s+path\s+(\S+)");
+    let sub_re = crate::cached_regex!(r"ID\s+(\d+)\s+.*\s+path\s+(.+)$");
+
+    let mut current_fs: Option<BtrfsFilesystem> = None;
+    for (idx, line) in content.lines().enumerate() {
+        let line_no = idx + 1;
+        let trimmed = line.trim();
+        if let Some(caps) = label_re.captures(trimmed) {
+            if let Some(fs) = current_fs.take() {
+                result.filesystems.push(fs);
+            }
+            current_fs = Some(BtrfsFilesystem {
+                label: caps
+                    .get(1)
+                    .map(|m| m.as_str().to_string())
+                    .filter(|s| !s.is_empty()),
+                uuid: Some(caps[2].to_string()),
+                devices: Vec::new(),
+                total_size: None,
+                source_path: source_path.to_string(),
+                source_line: Some(line_no),
+                source_line_end: Some(line_no),
+            });
+            continue;
+        }
+        if let Some(fs) = &mut current_fs {
+            if let Some(caps) = dev_re.captures(trimmed) {
+                fs.total_size = Some(caps[1].to_string());
+                fs.devices.push(caps[2].to_string());
+                fs.source_line_end = Some(line_no);
+            }
+        }
+        if let Some(caps) = sub_re.captures(trimmed) {
+            result.subvolumes.push(BtrfsSubvolume {
+                id: caps[1].to_string(),
+                path: caps[2].trim().to_string(),
+                source_path: source_path.to_string(),
+                source_line: Some(line_no),
+                source_line_end: Some(line_no),
+            });
+        }
+    }
+    if let Some(fs) = current_fs.take() {
+        result.filesystems.push(fs);
+    }
+    result.found = !result.filesystems.is_empty() || !result.subvolumes.is_empty();
+    result
+}
+
+// ---------------------------------------------------------------------------
+// Block devices
+// ---------------------------------------------------------------------------
+
+pub fn parse_block_devices(content: &str, source_path: &str) -> BlockDevicesResult {
+    let mut uuid_map = BTreeMap::new();
+    let mut mount_points = BTreeMap::new();
+    let mut device_map = BTreeMap::<String, BlockDeviceInfo>::new();
+
+    let blkid_re = crate::cached_regex!(r"^(\/dev\/\S+):\s*(.*)$");
+    let type_re = crate::cached_regex!(r#"TYPE=\"([^\"]+)\""#);
+    let uuid_re = crate::cached_regex!(r#"UUID=\"([^\"]+)\""#);
+    let blkid_alt_re = crate::cached_regex!(r"^(\/dev\/\S+):\s+(\S+)\s+\[uuid=([^\]]*)\]");
+
+    for (idx, raw_line) in content.lines().enumerate() {
+        let line_no = idx + 1;
+        let trimmed = raw_line.trim();
+        if trimmed.is_empty() || trimmed.starts_with("NAME") {
+            continue;
+        }
+
+        if let Some(caps) = blkid_re.captures(trimmed) {
+            let device = caps[1].to_string();
+            let attrs = caps[2].to_string();
+            let name = device.trim_start_matches("/dev/").to_string();
+            let entry = device_map.entry(device.clone()).or_insert(BlockDeviceInfo {
+                name,
+                device: device.clone(),
+                r#type: "part".to_string(),
+                mountpoint: None,
+                fstype: None,
+                uuid: None,
+                size: None,
+                source_path: source_path.to_string(),
+                source_line: Some(line_no),
+                source_line_end: Some(line_no),
+            });
+            entry.source_line_end = Some(line_no);
+            if let Some(c) = type_re.captures(&attrs) {
+                entry.fstype = Some(c[1].to_string());
+            }
+            if let Some(c) = uuid_re.captures(&attrs) {
+                let uuid = c[1].to_string();
+                entry.uuid = Some(uuid.clone());
+                uuid_map.insert(uuid.clone(), device.clone());
+                uuid_map.insert(uuid.to_lowercase(), device.clone());
+                uuid_map.insert(uuid.to_uppercase(), device.clone());
+            }
+            continue;
+        }
+
+        if let Some(caps) = blkid_alt_re.captures(trimmed) {
+            let device = caps[1].to_string();
+            let name = device.trim_start_matches("/dev/").to_string();
+            let entry = device_map.entry(device.clone()).or_insert(BlockDeviceInfo {
+                name,
+                device: device.clone(),
+                r#type: if device.matches('/').count() > 2 {
+                    "lvm".to_string()
+                } else {
+                    "part".to_string()
+                },
+                mountpoint: None,
+                fstype: None,
+                uuid: None,
+                size: None,
+                source_path: source_path.to_string(),
+                source_line: Some(line_no),
+                source_line_end: Some(line_no),
+            });
+            entry.source_line_end = Some(line_no);
+            if &caps[2] != "unknown" {
+                entry.fstype = Some(caps[2].to_string());
+            }
+            if !caps[3].is_empty() {
+                let uuid = caps[3].to_string();
+                entry.uuid = Some(uuid.clone());
+                uuid_map.insert(uuid.clone(), device.clone());
+            }
+            continue;
+        }
+
+        let clean = trimmed
+            .replace(&['├', '└', '│', '`'][..], "")
+            .replace('─', "");
+        let parts = clean.split_whitespace().collect::<Vec<_>>();
+        if parts.len() >= 6 && !parts[0].starts_with('#') && !parts[0].starts_with("Filesystem") {
+            let name = parts[0].to_string();
+            if !name.starts_with("/dev/") && name.chars().all(|c| c.is_ascii_alphanumeric()) {
+                let kind = parts[5].to_string();
+                if ["disk", "part", "lvm", "rom", "loop", "crypt"]
+                    .iter()
+                    .any(|k| kind.starts_with(k))
+                {
+                    let device = format!("/dev/{}", name);
+                    let mountpoint = parts
+                        .get(6)
+                        .map(|s| s.to_string())
+                        .filter(|s| s.starts_with('/'));
+                    let entry = BlockDeviceInfo {
+                        name: name.clone(),
+                        device: device.clone(),
+                        r#type: kind.clone(),
+                        mountpoint: mountpoint.clone(),
+                        fstype: None,
+                        uuid: None,
+                        size: parts.get(3).map(|s| s.to_string()),
+                        source_path: source_path.to_string(),
+                        source_line: Some(line_no),
+                        source_line_end: Some(line_no),
+                    };
+                    if let Some(mp) = mountpoint {
+                        mount_points.insert(mp, device.clone());
+                    }
+                    device_map.entry(device.clone()).or_insert(entry);
+                }
+            }
+        }
+    }
+
+    let mut disks = Vec::new();
+    let mut partitions = Vec::new();
+    for info in device_map.values() {
+        if info.r#type == "disk" {
+            disks.push(info.clone());
+        } else {
+            partitions.push(info.clone());
+        }
+        if let Some(mp) = &info.mountpoint {
+            mount_points.insert(mp.clone(), info.device.clone());
+        }
+    }
+
+    BlockDevicesResult {
+        found: !disks.is_empty() || !partitions.is_empty() || !uuid_map.is_empty(),
+        disks,
+        partitions,
+        uuid_map,
+        device_map,
+        mount_points,
+        warnings: Vec::new(),
+        source_path: source_path.to_string(),
+    }
+}
+
+// ---------------------------------------------------------------------------
+// fstab
+// ---------------------------------------------------------------------------
+
+/// SCC's `fs-diskio.txt` bundles multiple files into one stream, with the
+/// `/etc/fstab` content introduced by a `# /etc/fstab` header line and
+/// terminated by the next `#==` section marker. Blank lines and commented
+/// fstab entries (e.g. `#/dev/system/swap`) are legitimate fstab content
+/// and must NOT terminate the section. Returns `None` if no header is found
+/// (i.e. the input already looks like a raw fstab).
+fn extract_fstab_from_scc(content: &str) -> Option<String> {
+    let header_re = crate::cached_regex!(r"^#\s*/etc/fstab\s*$");
+    if !content.lines().any(|l| header_re.is_match(l)) {
+        return None;
+    }
+    let mut lines: Vec<&str> = Vec::new();
+    let mut in_section = false;
+    for line in content.lines() {
+        if !in_section {
+            if header_re.is_match(line) {
+                in_section = true;
+            }
+            continue;
+        }
+        if line.starts_with("#==") {
+            break;
+        }
+        lines.push(line);
+    }
+    while lines.first().map_or(false, |l| l.trim().is_empty()) {
+        lines.remove(0);
+    }
+    while lines.last().map_or(false, |l| l.trim().is_empty()) {
+        lines.pop();
+    }
+    if lines.is_empty() {
+        None
+    } else {
+        Some(lines.join("\n"))
+    }
+}
+
+pub fn parse_fstab_analysis(content: &str, source_path: &str) -> FstabAnalysisResult {
+    // If we were given the SCC multipart file (fs-diskio.txt) instead of a
+    // raw fstab, extract just the `# /etc/fstab` section. Without this, we
+    // happily parse lsblk/df/blkid rows as fstab entries.
+    let extracted = extract_fstab_from_scc(content);
+    let effective_content: &str = extracted.as_deref().unwrap_or(content);
+
+    let mut entries = Vec::new();
+    let mut warnings = Vec::new();
+    let os_mounts = [
+        "/",
+        "/boot",
+        "/boot/efi",
+        "/usr",
+        "/var",
+        "/tmp",
+        "/home",
+        "/opt",
+    ];
+    let virtual_fs = [
+        "tmpfs",
+        "devtmpfs",
+        "sysfs",
+        "proc",
+        "cgroup",
+        "cgroup2",
+        "securityfs",
+        "devpts",
+        "hugetlbfs",
+        "mqueue",
+        "debugfs",
+        "tracefs",
+        "fusectl",
+        "configfs",
+        "pstore",
+        "efivarfs",
+        "bpf",
+        "binfmt_misc",
+        "autofs",
+        "sunrpc",
+    ];
+
+    for (idx, raw_line) in effective_content.lines().enumerate() {
+        let line_no = idx + 1;
+        let trimmed = raw_line.trim();
+        if trimmed.is_empty() || trimmed.starts_with('#') {
+            continue;
+        }
+        let parts = trimmed.split_whitespace().collect::<Vec<_>>();
+        if parts.len() < 4 {
+            continue;
+        }
+        let source = parts[0].to_string();
+        let mountpoint = parts[1].to_string();
+        let fstype = parts[2].to_string();
+        let options = parts[3].to_string();
+        let source_type = if source.starts_with("UUID=") {
+            "uuid"
+        } else if source.starts_with("LABEL=") {
+            "label"
+        } else if source.starts_with("/dev/") {
+            "device"
+        } else if source.starts_with("//") || source.contains(':') {
+            "network"
+        } else {
+            "unknown"
+        }
+        .to_string();
+        let has_nofail = options.contains("nofail");
+        let is_os_partition = os_mounts.contains(&mountpoint.as_str());
+        let is_virtual = virtual_fs.contains(&fstype.as_str()) || fstype == "none";
+        let needs_nofail = !is_os_partition && !is_virtual && !has_nofail;
+        if needs_nofail {
+            warnings.push(StorageWarning {
+                r#type: "missing_nofail".to_string(),
+                message: format!(
+                    "Mount point '{}' is missing the 'nofail' option",
+                    mountpoint
+                ),
+                details: None,
+                severity: Some("warning".to_string()),
+                recommendation: Some(
+                    "Add nofail option to prevent boot failures if this mount becomes unavailable"
+                        .to_string(),
+                ),
+                source_path: source_path.to_string(),
+                source_line: Some(line_no),
+                source_line_end: Some(line_no),
+            });
+        }
+        entries.push(FstabEntry {
+            uuid: if source_type == "uuid" {
+                Some(source.trim_start_matches("UUID=").to_string())
+            } else {
+                None
+            },
+            device: if source_type == "device" {
+                Some(source.clone())
+            } else {
+                None
+            },
+            source,
+            mountpoint,
+            fstype,
+            options,
+            dump: parts.get(4).copied().unwrap_or("0").to_string(),
+            pass: parts.get(5).copied().unwrap_or("0").to_string(),
+            source_type,
+            has_nofail,
+            is_os_partition,
+            is_virtual_fs: is_virtual,
+            needs_nofail,
+            source_path: source_path.to_string(),
+            source_line: Some(line_no),
+            source_line_end: Some(line_no),
+        });
+    }
+
+    FstabAnalysisResult {
+        found: !entries.is_empty(),
+        entries,
+        warnings,
+        source_path: source_path.to_string(),
+    }
+}
+
+// ---------------------------------------------------------------------------
+// df
+// ---------------------------------------------------------------------------
+
+pub fn parse_df_output(content: &str, source_path: &str) -> DfOutputResult {
+    let mut filesystems = Vec::new();
+    let mut mount_to_usage = BTreeMap::new();
+    let typed_fs = Regex::new(
+        r"^(xfs|ext[234]|vfat|btrfs|nfs[34]?|cifs|tmpfs|devtmpfs|sysfs|proc|overlay|zfs|swap)$",
+    )
+    .unwrap();
+
+    for (idx, raw_line) in content.lines().enumerate() {
+        let line_no = idx + 1;
+        let trimmed = raw_line.trim();
+        if trimmed.is_empty() || trimmed.starts_with("Filesystem") || trimmed.starts_with('#') {
+            continue;
+        }
+        let parts = trimmed.split_whitespace().collect::<Vec<_>>();
+        if parts.len() < 6 {
+            continue;
+        }
+        let entry = if parts.len() >= 7 && typed_fs.is_match(parts[1]) {
+            DfEntry {
+                filesystem: parts[0].to_string(),
+                fstype: Some(parts[1].to_string()),
+                size: parts[2].to_string(),
+                used: parts[3].to_string(),
+                available: parts[4].to_string(),
+                use_percent: parts[5].trim_end_matches('%').parse().unwrap_or(0),
+                mountpoint: parts[6].to_string(),
+                source_path: source_path.to_string(),
+                source_line: Some(line_no),
+                source_line_end: Some(line_no),
+            }
+        } else {
+            DfEntry {
+                filesystem: parts[0].to_string(),
+                fstype: None,
+                size: parts[1].to_string(),
+                used: parts[2].to_string(),
+                available: parts[3].to_string(),
+                use_percent: parts[4].trim_end_matches('%').parse().unwrap_or(0),
+                mountpoint: parts[5].to_string(),
+                source_path: source_path.to_string(),
+                source_line: Some(line_no),
+                source_line_end: Some(line_no),
+            }
+        };
+        mount_to_usage.insert(entry.mountpoint.clone(), entry.clone());
+        filesystems.push(entry);
+    }
+
+    DfOutputResult {
+        found: !filesystems.is_empty(),
+        filesystems,
+        mount_to_usage,
+        source_path: source_path.to_string(),
+    }
+}
+
+// ---------------------------------------------------------------------------
+// mtab / mount
+// ---------------------------------------------------------------------------
+
+pub fn parse_mtab_analysis(content: &str, source_path: &str) -> MtabAnalysisResult {
+    let mut entries = Vec::new();
+    let virtual_fs = [
+        "tmpfs",
+        "devtmpfs",
+        "sysfs",
+        "proc",
+        "cgroup",
+        "cgroup2",
+        "securityfs",
+        "devpts",
+        "hugetlbfs",
+        "mqueue",
+        "debugfs",
+        "tracefs",
+        "fusectl",
+        "configfs",
+        "pstore",
+        "efivarfs",
+        "bpf",
+        "binfmt_misc",
+        "autofs",
+        "sunrpc",
+        "rpc_pipefs",
+        "nfsd",
+        "overlay",
+        "nsfs",
+        "squashfs",
+        "rootfs",
+        "ramfs",
+    ];
+    let mount_re = crate::cached_regex!(r"^(\S+)\s+on\s+(\S+)\s+type\s+(\S+)\s+\(([^)]*)\)");
+
+    for (idx, raw_line) in content.lines().enumerate() {
+        let line_no = idx + 1;
+        let trimmed = raw_line.trim();
+        if trimmed.is_empty() || trimmed.starts_with('#') {
+            continue;
+        }
+        let normalized = if let Some(caps) = mount_re.captures(trimmed) {
+            format!("{} {} {} {}", &caps[1], &caps[2], &caps[3], &caps[4])
+        } else {
+            trimmed.to_string()
+        };
+        let parts = normalized.split_whitespace().collect::<Vec<_>>();
+        if parts.len() < 3 {
+            continue;
+        }
+        let source = parts[0].to_string();
+        let mountpoint = parts[1].to_string();
+        let fstype = parts[2].to_string();
+        let options = parts.get(3).copied().unwrap_or("defaults").to_string();
+        let source_type = if source.starts_with("UUID=") {
+            "uuid"
+        } else if source.starts_with("LABEL=") {
+            "label"
+        } else if source.starts_with("/dev/") {
+            "device"
+        } else if source.starts_with("//") || source.contains(':') {
+            "network"
+        } else {
+            "unknown"
+        }
+        .to_string();
+        entries.push(MtabEntry {
+            source,
+            mountpoint,
+            fstype: fstype.clone(),
+            options,
+            is_virtual_fs: virtual_fs.contains(&fstype.as_str()) || fstype == "none",
+            source_type,
+            source_path: source_path.to_string(),
+            source_line: Some(line_no),
+            source_line_end: Some(line_no),
+        });
+    }
+    let extra_mounts = entries
+        .iter()
+        .filter(|e| !e.is_virtual_fs)
+        .cloned()
+        .collect::<Vec<_>>();
+    MtabAnalysisResult {
+        found: !entries.is_empty(),
+        entries,
+        extra_mounts,
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_nvme_list(content: &str, source_path: &str) -> NvmeListResult {
+    let non_empty_count = content.lines().filter(|l| !l.trim().is_empty()).count();
+    let has_nvme = non_empty_count > 2;
+
+    NvmeListResult {
+        found: has_nvme,
+        has_nvme,
+        drive_count: non_empty_count.saturating_sub(2),
+        content: if has_nvme {
+            Some(content.to_string())
+        } else {
+            None
+        },
+        filename: if source_path.is_empty() {
+            None
+        } else {
+            Some(source_path.to_string())
+        },
+        source_path: source_path.to_string(),
+    }
+}
+
+// ---------------------------------------------------------------------------
+// NFS mount analysis
+// ---------------------------------------------------------------------------
+//
+// SAP-on-Azure workloads frequently place HANA data/log/shared and
+// /sapmnt/transport directories on NFS (Azure NetApp Files or Azure Files).
+// Misconfigured NFS mount options are a common, hard-to-spot root cause of
+// data-integrity issues and poor throughput. This detector identifies NFS
+// mounts in fstab or mount/mtab output and flags option problems against
+// Microsoft's published SAP-on-NFS guidance. Generic boot-resilience checks
+// (e.g. `nofail`) are handled by `parse_fstab_analysis`; this parser focuses
+// only on NFS-specific option quality.
+
+fn nfs_option_value(options: &str, key: &str) -> Option<String> {
+    options.split(',').find_map(|opt| {
+        let opt = opt.trim();
+        let (k, v) = opt.split_once('=')?;
+        if k.trim().eq_ignore_ascii_case(key) {
+            Some(v.trim().to_string())
+        } else {
+            None
+        }
+    })
+}
+
+fn nfs_has_flag(options: &str, flag: &str) -> bool {
+    options
+        .split(',')
+        .any(|opt| opt.trim().eq_ignore_ascii_case(flag))
+}
+
+/// Parse NFS mounts from either fstab (`src mnt nfs opts ...`) or mount /
+/// mtab output (`src on mnt type nfs (opts)`), then emit SAP-relevant
+/// option-quality warnings.
+pub fn parse_nfs_mounts(content: &str, source_path: &str) -> NfsMountsResult {
+    // Reuse the SCC fstab section if we were handed an aggregated file.
+    let extracted = extract_fstab_from_scc(content);
+    let effective: &str = extracted.as_deref().unwrap_or(content);
+
+    let mount_re = crate::cached_regex!(r"^(\S+)\s+on\s+(\S+)\s+type\s+(\S+)\s+\(([^)]*)\)");
+
+    let mut mounts: Vec<NfsMount> = Vec::new();
+    let mut warnings: Vec<StorageWarning> = Vec::new();
+
+    for (idx, raw_line) in effective.lines().enumerate() {
+        let line_no = idx + 1;
+        let trimmed = raw_line.trim();
+        if trimmed.is_empty() || trimmed.starts_with('#') {
+            continue;
+        }
+
+        // Normalise the two supported formats into: source mountpoint fstype options
+        let (source, mountpoint, fstype, options) = if let Some(caps) = mount_re.captures(trimmed) {
+            (
+                caps[1].to_string(),
+                caps[2].to_string(),
+                caps[3].to_string(),
+                caps[4].to_string(),
+            )
+        } else {
+            let parts = trimmed.split_whitespace().collect::<Vec<_>>();
+            if parts.len() < 4 {
+                continue;
+            }
+            (
+                parts[0].to_string(),
+                parts[1].to_string(),
+                parts[2].to_string(),
+                parts[3].to_string(),
+            )
+        };
+
+        // Recognise NFS by filesystem type. `host:/export` sources are only
+        // treated as NFS when the fstype confirms it, to avoid misclassifying
+        // other network filesystems.
+        let fstype_l = fstype.to_ascii_lowercase();
+        let is_nfs = fstype_l == "nfs" || fstype_l == "nfs4" || fstype_l == "nfs3";
+        if !is_nfs {
+            continue;
+        }
+
+        let vers = nfs_option_value(&options, "vers")
+            .or_else(|| nfs_option_value(&options, "nfsvers"));
+        let rsize = nfs_option_value(&options, "rsize").and_then(|v| v.parse::<i64>().ok());
+        let wsize = nfs_option_value(&options, "wsize").and_then(|v| v.parse::<i64>().ok());
+        let timeo = nfs_option_value(&options, "timeo").and_then(|v| v.parse::<i64>().ok());
+        let nconnect = nfs_option_value(&options, "nconnect").and_then(|v| v.parse::<i64>().ok());
+        let has_soft = nfs_has_flag(&options, "soft");
+        let has_hard = nfs_has_flag(&options, "hard");
+
+        // 1) soft mounts risk silent data corruption for SAP workloads.
+        if has_soft {
+            warnings.push(StorageWarning {
+                r#type: "nfs_soft_mount".to_string(),
+                message: format!(
+                    "NFS mount '{}' uses the 'soft' option",
+                    mountpoint
+                ),
+                details: Some(
+                    "Soft NFS mounts can silently drop I/O on timeout, risking data corruption for SAP/HANA volumes".to_string(),
+                ),
+                severity: Some("error".to_string()),
+                recommendation: Some(
+                    "Use the 'hard' option for SAP NFS volumes so I/O retries instead of failing".to_string(),
+                ),
+                source_path: source_path.to_string(),
+                source_line: Some(line_no),
+                source_line_end: Some(line_no),
+            });
+        }
+
+        // 2) rsize/wsize below 262144 (256 KiB) reduce NFS throughput.
+        let small_rsize = rsize.map(|v| v < 262144).unwrap_or(false);
+        let small_wsize = wsize.map(|v| v < 262144).unwrap_or(false);
+        if small_rsize || small_wsize {
+            warnings.push(StorageWarning {
+                r#type: "nfs_small_rsize_wsize".to_string(),
+                message: format!(
+                    "NFS mount '{}' uses small read/write sizes (rsize={}, wsize={})",
+                    mountpoint,
+                    rsize.map(|v| v.to_string()).unwrap_or_else(|| "default".to_string()),
+                    wsize.map(|v| v.to_string()).unwrap_or_else(|| "default".to_string()),
+                ),
+                details: None,
+                severity: Some("warning".to_string()),
+                recommendation: Some(
+                    "Set rsize=262144 and wsize=262144 for SAP NFS volumes on Azure NetApp Files".to_string(),
+                ),
+                source_path: source_path.to_string(),
+                source_line: Some(line_no),
+                source_line_end: Some(line_no),
+            });
+        }
+
+        // 3) Outdated protocol versions (NFSv2 / NFSv4.0) are not recommended.
+        if let Some(v) = &vers {
+            if v == "2" || v == "4.0" {
+                warnings.push(StorageWarning {
+                    r#type: "nfs_outdated_version".to_string(),
+                    message: format!(
+                        "NFS mount '{}' uses protocol version {}",
+                        mountpoint, v
+                    ),
+                    details: None,
+                    severity: Some("warning".to_string()),
+                    recommendation: Some(
+                        "Use NFSv3 or NFSv4.1 for SAP workloads on Azure".to_string(),
+                    ),
+                    source_path: source_path.to_string(),
+                    source_line: Some(line_no),
+                    source_line_end: Some(line_no),
+                });
+            }
+        }
+
+        // 4) Missing nconnect leaves throughput on the table for ANF.
+        if nconnect.is_none() {
+            warnings.push(StorageWarning {
+                r#type: "nfs_no_nconnect".to_string(),
+                message: format!(
+                    "NFS mount '{}' does not set the 'nconnect' option",
+                    mountpoint
+                ),
+                details: None,
+                severity: Some("info".to_string()),
+                recommendation: Some(
+                    "Consider nconnect (e.g. nconnect=8) to improve NFS throughput on Azure NetApp Files".to_string(),
+                ),
+                source_path: source_path.to_string(),
+                source_line: Some(line_no),
+                source_line_end: Some(line_no),
+            });
+        }
+
+        mounts.push(NfsMount {
+            source,
+            mountpoint,
+            fstype,
+            options,
+            vers,
+            rsize,
+            wsize,
+            timeo,
+            nconnect,
+            has_hard,
+            has_soft,
+            source_path: source_path.to_string(),
+            source_line: Some(line_no),
+            source_line_end: Some(line_no),
+        });
+    }
+
+    NfsMountsResult {
+        found: !mounts.is_empty(),
+        mounts,
+        warnings,
+        source_path: source_path.to_string(),
+    }
+}
+
+// ---------------------------------------------------------------------------
+// JSON wrappers
+// ---------------------------------------------------------------------------
+
+pub fn parse_lvm_config_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_lvm_config(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_raid_config_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_raid_config(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_btrfs_config_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_btrfs_config(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_block_devices_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_block_devices(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_fstab_analysis_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_fstab_analysis(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_df_output_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_df_output(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_mtab_analysis_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_mtab_analysis(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_nvme_list_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_nvme_list(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_nfs_mounts_json(content: &str, source_path: &str) -> String {
+    serde_json::to_string(&parse_nfs_mounts(content, source_path))
+        .unwrap_or_else(|_| "{}".to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const FSTAB_PATH: &str = "etc/fstab";
+    const MTAB_PATH: &str = "etc/mtab";
+    const DF_PATH: &str = "sos_commands/filesys/df_-al";
+    const LVM_PATH: &str = "sos_commands/lvm2/vgs_-v";
+    const RAID_PATH: &str = "proc/mdstat";
+    const BTRFS_PATH: &str = "sos_commands/btrfs/btrfs_filesystem_show";
+    const BLK_PATH: &str = "sos_commands/block/blkid";
+
+    // ---- LVM ----------------------------------------------------------------
+
+    #[test]
+    fn parses_lvm_and_warns_on_mismatch() {
+        let input = concat!(
+            "/dev/sda2 vg00 lvm2 a-- 100g 0\n",
+            "vg00 2 1 0 wz--n- 100g 0\n",
+            "root vg00 -wi-ao---- 50g\n"
+        );
+        let result = parse_lvm_config(input, LVM_PATH);
+        assert!(result.found);
+        assert_eq!(result.pvs.len(), 1);
+        assert_eq!(result.vgs.len(), 1);
+        assert!(!result.warnings.is_empty());
+    }
+
+    #[test]
+    fn lvm_records_carry_source_provenance() {
+        let input = concat!(
+            "/dev/sda2 vg_missing lvm2 a-- 100g 0\n",
+            "vg00 2 1 0 wz--n- 100g 0\n",
+            "root vg00 -wi-ao---- 50g\n"
+        );
+        let result = parse_lvm_config(input, LVM_PATH);
+        assert_eq!(result.source_path, LVM_PATH);
+        for pv in &result.pvs {
+            assert_eq!(pv.source_path, LVM_PATH);
+            assert!(pv.source_line.is_some());
+        }
+        for vg in &result.vgs {
+            assert_eq!(vg.source_path, LVM_PATH);
+            assert!(vg.source_line.is_some());
+        }
+        for lv in &result.lvs {
+            assert_eq!(lv.source_path, LVM_PATH);
+            assert!(lv.source_line.is_some());
+        }
+        for w in &result.warnings {
+            assert_eq!(w.source_path, LVM_PATH);
+            assert!(w.source_line.is_some(), "warning {:?} missing line", w);
+        }
+        assert_eq!(result.pvs[0].source_line, Some(1));
+        assert_eq!(result.vgs[0].source_line, Some(2));
+        assert_eq!(result.lvs[0].source_line, Some(3));
+    }
+
+    // ---- RAID ---------------------------------------------------------------
+
+    #[test]
+    fn parses_raid_and_degraded_state() {
+        let input = concat!(
+            "md0 : active raid1 sda1[0] sdb1[1](F)\n",
+            "      104320 blocks [_U]\n"
+        );
+        let result = parse_raid_config(input, RAID_PATH);
+        assert!(result.found);
+        assert_eq!(result.arrays[0].state, "degraded");
+    }
+
+    #[test]
+    fn raid_records_carry_source_provenance() {
+        let input = concat!(
+            "md0 : active raid1 sda1[0] sdb1[1](F)\n",
+            "      104320 blocks [_U]\n",
+            "      [>....................]  recovery =  3.1% (3000/104320) finish=10.0min speed=5000K/sec\n"
+        );
+        let result = parse_raid_config(input, RAID_PATH);
+        assert_eq!(result.source_path, RAID_PATH);
+        let arr = &result.arrays[0];
+        assert_eq!(arr.source_path, RAID_PATH);
+        assert_eq!(arr.source_line, Some(1));
+        assert!(arr.source_line_end.unwrap() >= 1);
+        for d in &arr.devices {
+            assert_eq!(d.source_path, RAID_PATH);
+            assert!(d.source_line.is_some());
+        }
+        let sync = arr.sync_status.as_ref().expect("sync_status");
+        assert_eq!(sync.source_path, RAID_PATH);
+        assert_eq!(sync.source_line, Some(3));
+        for w in &result.warnings {
+            assert_eq!(w.source_path, RAID_PATH);
+            assert!(w.source_line.is_some(), "warning {:?} missing line", w);
+        }
+    }
+
+    // ---- BTRFS --------------------------------------------------------------
+
+    #[test]
+    fn btrfs_records_carry_source_provenance() {
+        let input = concat!(
+            "Label: 'data'  uuid: abcd-1234\n",
+            "    devid 1 size 10G used 1G path /dev/sda1\n",
+            "ID 256 gen 7 top level 5 path subvol_data\n"
+        );
+        let result = parse_btrfs_config(input, BTRFS_PATH);
+        assert!(result.found);
+        assert_eq!(result.source_path, BTRFS_PATH);
+        for fs in &result.filesystems {
+            assert_eq!(fs.source_path, BTRFS_PATH);
+            assert!(fs.source_line.is_some());
+        }
+        for sv in &result.subvolumes {
+            assert_eq!(sv.source_path, BTRFS_PATH);
+            assert!(sv.source_line.is_some());
+        }
+        assert_eq!(result.filesystems[0].source_line, Some(1));
+        assert_eq!(result.subvolumes[0].source_line, Some(3));
+    }
+
+    // ---- Block devices ------------------------------------------------------
+
+    #[test]
+    fn parses_block_and_fstab_data() {
+        let blk = parse_block_devices("/dev/sda1: UUID=\"1234-ABCD\" TYPE=\"xfs\"\n", BLK_PATH);
+        let fstab = parse_fstab_analysis("UUID=1234-ABCD /data xfs defaults 0 0\n", FSTAB_PATH);
+        assert!(blk.found);
+        assert!(fstab.found);
+        assert!(fstab.entries[0].needs_nofail);
+    }
+
+    #[test]
+    fn block_records_carry_source_provenance() {
+        let input = "/dev/sda1: UUID=\"1234-ABCD\" TYPE=\"xfs\"\n";
+        let blk = parse_block_devices(input, BLK_PATH);
+        assert_eq!(blk.source_path, BLK_PATH);
+        for d in blk.disks.iter().chain(blk.partitions.iter()) {
+            assert_eq!(d.source_path, BLK_PATH);
+            assert!(d.source_line.is_some());
+        }
+        assert!(!blk.partitions.is_empty() || !blk.disks.is_empty());
+    }
+
+    // ---- NVMe list ---------------------------------------------------------
+
+    #[test]
+    fn parses_nvme_list_header_only() {
+        let input = "Node             SN                   Model\n-----------------------------------------------\n";
+        let result = parse_nvme_list(input, "sos_commands/nvme/nvme_list");
+        assert!(!result.found);
+        assert!(!result.has_nvme);
+        assert_eq!(result.drive_count, 0);
+    }
+
+    #[test]
+    fn parses_nvme_list_with_devices() {
+        let input = concat!(
+            "Node             SN                   Model\n",
+            "-----------------------------------------------\n",
+            "/dev/nvme0n1     deadbeef123         NVMeDisk\n",
+            "/dev/nvme1n1     cafe1234abcd         NVMeDisk\n"
+        );
+        let result = parse_nvme_list(input, "sos_commands/nvme/nvme_list");
+        assert!(result.found);
+        assert!(result.has_nvme);
+        assert_eq!(result.drive_count, 2);
+    }
+
+    // ---- fstab --------------------------------------------------------------
+
+    #[test]
+    fn fstab_records_carry_source_provenance() {
+        let input = concat!(
+            "# header\n",
+            "UUID=root-uuid / xfs defaults 0 0\n",
+            "UUID=data-uuid /data xfs defaults 0 0\n",
+        );
+        let result = parse_fstab_analysis(input, FSTAB_PATH);
+        assert!(result.found);
+        assert_eq!(result.source_path, FSTAB_PATH);
+        assert_eq!(result.entries.len(), 2);
+        assert_eq!(result.entries[0].source_line, Some(2));
+        assert_eq!(result.entries[1].source_line, Some(3));
+        for e in &result.entries {
+            assert_eq!(e.source_path, FSTAB_PATH);
+        }
+        // The /data entry is missing nofail; the warning must point at line 3.
+        let warn = result
+            .warnings
+            .iter()
+            .find(|w| w.r#type == "missing_nofail")
+            .expect("missing_nofail warning");
+        assert_eq!(warn.source_path, FSTAB_PATH);
+        assert_eq!(warn.source_line, Some(3));
+    }
+
+    // ---- df ----------------------------------------------------------------
+
+    #[test]
+    fn df_records_carry_source_provenance() {
+        let input = concat!(
+            "Filesystem 1K-blocks Used Available Use% Mounted on\n",
+            "/dev/sda1 1000 100 900 10% /\n",
+            "/dev/sdb1 xfs 2000 200 1800 10% /data\n",
+        );
+        let result = parse_df_output(input, DF_PATH);
+        assert!(result.found);
+        assert_eq!(result.source_path, DF_PATH);
+        assert_eq!(result.filesystems.len(), 2);
+        assert_eq!(result.filesystems[0].source_line, Some(2));
+        assert_eq!(result.filesystems[1].source_line, Some(3));
+        for e in &result.filesystems {
+            assert_eq!(e.source_path, DF_PATH);
+        }
+    }
+
+    // ---- mtab --------------------------------------------------------------
+
+    #[test]
+    fn mtab_records_carry_source_provenance() {
+        let input = concat!(
+            "/dev/sda1 / xfs defaults 0 0\n",
+            "tmpfs /run tmpfs rw,nosuid 0 0\n",
+        );
+        let result = parse_mtab_analysis(input, MTAB_PATH);
+        assert!(result.found);
+        assert_eq!(result.source_path, MTAB_PATH);
+        assert_eq!(result.entries[0].source_line, Some(1));
+        assert_eq!(result.entries[1].source_line, Some(2));
+        for e in &result.entries {
+            assert_eq!(e.source_path, MTAB_PATH);
+        }
+        for e in &result.extra_mounts {
+            assert_eq!(e.source_path, MTAB_PATH);
+            assert!(e.source_line.is_some());
+        }
+    }
+
+    // ---- JSON wrappers preserve the new fields -----------------------------
+
+    #[test]
+    fn json_wrappers_include_source_path_and_line() {
+        let json = parse_fstab_analysis_json("UUID=data-uuid /data xfs defaults 0 0\n", FSTAB_PATH);
+        assert!(json.contains("\"source_path\":\"etc/fstab\""));
+        assert!(json.contains("\"source_line\":1"));
+    }
+
+    // ---- NFS mounts --------------------------------------------------------
+
+    #[test]
+    fn nfs_flags_soft_small_size_and_missing_nconnect_from_fstab() {
+        let input = concat!(
+            "# /etc/fstab managed by admin\n",
+            "UUID=root-uuid / xfs defaults 0 0\n",
+            "10.0.0.4:/hana/data /hana/data nfs vers=4.1,soft,rsize=65536,wsize=65536,timeo=600 0 0\n",
+        );
+        let result = parse_nfs_mounts(input, FSTAB_PATH);
+        assert!(result.found);
+        assert_eq!(result.mounts.len(), 1);
+        let mount = &result.mounts[0];
+        assert_eq!(mount.mountpoint, "/hana/data");
+        assert_eq!(mount.fstype, "nfs");
+        assert_eq!(mount.vers.as_deref(), Some("4.1"));
+        assert_eq!(mount.rsize, Some(65536));
+        assert_eq!(mount.wsize, Some(65536));
+        assert_eq!(mount.timeo, Some(600));
+        assert!(mount.has_soft);
+        assert!(!mount.has_hard);
+        assert_eq!(mount.source_line, Some(3));
+
+        let types: Vec<&str> = result.warnings.iter().map(|w| w.r#type.as_str()).collect();
+        assert!(types.contains(&"nfs_soft_mount"));
+        assert!(types.contains(&"nfs_small_rsize_wsize"));
+        assert!(types.contains(&"nfs_no_nconnect"));
+        for w in &result.warnings {
+            assert_eq!(w.source_path, FSTAB_PATH);
+            assert_eq!(w.source_line, Some(3));
+        }
+    }
+
+    #[test]
+    fn nfs_parses_mount_output_and_keeps_good_mounts_clean() {
+        let input = concat!(
+            "/dev/sda1 on / type xfs (rw,relatime)\n",
+            "10.0.0.4:/sapmnt on /sapmnt type nfs4 (rw,hard,rsize=262144,wsize=262144,nconnect=8,vers=4.1)\n",
+        );
+        let result = parse_nfs_mounts(input, MTAB_PATH);
+        assert!(result.found);
+        assert_eq!(result.mounts.len(), 1);
+        let mount = &result.mounts[0];
+        assert_eq!(mount.mountpoint, "/sapmnt");
+        assert_eq!(mount.fstype, "nfs4");
+        assert!(mount.has_hard);
+        assert_eq!(mount.nconnect, Some(8));
+        assert!(result.warnings.is_empty());
+    }
+
+    #[test]
+    fn nfs_flags_outdated_version() {
+        let input =
+            "10.0.0.4:/export /export nfs vers=2,hard,rsize=262144,wsize=262144,nconnect=4 0 0\n";
+        let result = parse_nfs_mounts(input, FSTAB_PATH);
+        assert!(result.found);
+        let types: Vec<&str> = result.warnings.iter().map(|w| w.r#type.as_str()).collect();
+        assert!(types.contains(&"nfs_outdated_version"));
+        assert!(!types.contains(&"nfs_no_nconnect"));
+    }
+}
diff --git a/rca-tool/lib/supportfile_core/src/parsers/unix.rs b/rca-tool/lib/supportfile_core/src/parsers/unix.rs
new file mode 100644
index 0000000..391d250
--- /dev/null
+++ b/rca-tool/lib/supportfile_core/src/parsers/unix.rs
@@ -0,0 +1,2473 @@
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeMap;
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct UnixWarning {
+    #[serde(rename = "type")]
+    pub r#type: String,
+    pub severity: String,
+    pub message: String,
+    pub recommendation: Option<String>,
+    pub documentation_url: Option<String>,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct BasicEnvironmentResult {
+    pub found: bool,
+    pub pretty_name: Option<String>,
+    pub name: Option<String>,
+    pub distribution: Option<String>,
+    pub sap_product_detected: bool,
+    pub epic_product_detected: bool,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct OsReleaseResult {
+    pub found: bool,
+    pub name: Option<String>,
+    pub version: Option<String>,
+    pub version_id: Option<String>,
+    pub pretty_name: Option<String>,
+    pub major_version: Option<String>,
+    pub minor_version: Option<String>,
+    pub warnings: Vec<UnixWarning>,
+    pub has_warnings: bool,
+    pub is_eol: bool,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct RawFileResult {
+    pub found: bool,
+    pub content: Option<String>,
+    pub source: Option<String>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct InspectFilesystemStatus {
+    pub device: String,
+    pub r#type: String,
+    pub uuid: Option<String>,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct InspectMountResult {
+    pub device: String,
+    pub mount_point: String,
+    pub status: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct InspectDiskResultsResult {
+    pub found: bool,
+    pub is_inspect_disk: bool,
+    pub request_info: BTreeMap<String, String>,
+    pub filesystem_status: Vec<InspectFilesystemStatus>,
+    pub inspection_metadata: BTreeMap<String, String>,
+    pub mount_points: BTreeMap<String, String>,
+    pub mount_results: Vec<InspectMountResult>,
+    pub warnings: Vec<UnixWarning>,
+    pub has_warnings: bool,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct TuningDifference {
+    pub parameter: String,
+    pub expected: String,
+    pub actual: String,
+    pub documentation_url: Option<String>,
+    pub matches: Option<bool>,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct KernelTuningResult {
+    pub found: bool,
+    pub parameters: BTreeMap<String, String>,
+    pub warnings: Vec<TuningDifference>,
+    pub has_warnings: bool,
+    pub azure_network_warnings: Vec<TuningDifference>,
+    pub has_azure_network_warnings: bool,
+    pub azure_network_tuned: bool,
+    pub optional_network_info: Vec<TuningDifference>,
+    pub has_optional_network_info: bool,
+    pub fips_enabled: bool,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct HugePagesResult {
+    pub found: bool,
+    pub static_huge_pages: BTreeMap<String, i64>,
+    pub transparent_huge_pages: BTreeMap<String, i64>,
+    /// Sysctl-derived huge-page parameters, populated by the worker by
+    /// enriching `parse_huge_pages` output with values from kernel-tuning
+    /// parameters (`vm.nr_hugepages`, `vm.nr_overcommit_hugepages`,
+    /// `vm.hugetlb_shm_group`).  Always emitted (possibly empty) so the
+    /// JS bridge / Leptos UI can safely access `sysctlParams`.
+    pub sysctl_params: BTreeMap<String, i64>,
+    pub warnings: Vec<UnixWarning>,
+    pub recommendations: Vec<UnixWarning>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct TimeSyncResult {
+    pub found: bool,
+    pub has_hv_utils: bool,
+    pub has_ptp_clock: bool,
+    pub ptp_index: Option<String>,
+    pub warnings: Vec<UnixWarning>,
+    pub recommendations: Vec<UnixWarning>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct PtpClockSourceResult {
+    pub found: bool,
+    pub has_refclock: bool,
+    pub uses_hyperv_symlink: bool,
+    pub refclock_device: Option<String>,
+    pub warnings: Vec<UnixWarning>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct TimeSyncServiceResult {
+    pub found: bool,
+    pub service_name: Option<String>,
+    pub active: bool,
+    /// Per-service flags + status strings consumed by the Leptos
+    /// `Time Synchronization` panel.  Set when we can identify which
+    /// systemd unit was being inspected (e.g. `# /bin/systemctl status
+    /// 'chronyd.service'` header in supportconfig systemd-status.txt).
+    pub chrony_enabled: bool,
+    pub chrony_status: Option<String>,
+    pub ntpd_enabled: bool,
+    pub ntpd_status: Option<String>,
+    pub timesyncd_enabled: bool,
+    pub timesyncd_status: Option<String>,
+    pub detection_file: Option<String>,
+    pub warnings: Vec<UnixWarning>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct TimedatectlResult {
+    pub found: bool,
+    pub ntp_enabled: bool,
+    pub ntp_synchronized: bool,
+    pub ntp_service: Option<String>,
+    pub local_time: Option<String>,
+    pub timezone: Option<String>,
+    pub warnings: Vec<UnixWarning>,
+    pub recommendations: Vec<UnixWarning>,
+    pub has_warnings: bool,
+    pub has_errors: bool,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct PtpDeviceResult {
+    pub found: bool,
+    pub ptp_devices: Vec<String>,
+    pub has_ptp_hyperv_symlink: bool,
+    pub ptp_hyperv_target: Option<String>,
+    pub warnings: Vec<UnixWarning>,
+    pub recommendations: Vec<UnixWarning>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct ChronyTrackingResult {
+    pub found: bool,
+    pub reference_id: Option<String>,
+    pub reference_name: Option<String>,
+    pub stratum: Option<i32>,
+    pub system_time: Option<String>,
+    pub system_time_seconds: Option<f64>,
+    pub last_offset: Option<String>,
+    pub last_offset_seconds: Option<f64>,
+    pub rms_offset: Option<String>,
+    pub update_interval: Option<String>,
+    pub leap_status: Option<String>,
+    pub is_ptp_source: bool,
+    pub is_phc_source: bool,
+    pub warnings: Vec<UnixWarning>,
+    pub recommendations: Vec<UnixWarning>,
+    pub has_warnings: bool,
+    pub has_errors: bool,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct ChronyMakestepResult {
+    pub found: bool,
+    pub has_makestep: bool,
+    pub makestep_threshold: Option<f64>,
+    pub makestep_limit: Option<i32>,
+    pub has_refclock: bool,
+    pub refclock_device: Option<String>,
+    pub refclock_poll_interval: Option<i32>,
+    pub uses_hyperv_symlink: bool,
+    pub warnings: Vec<UnixWarning>,
+    pub recommendations: Vec<UnixWarning>,
+    pub has_warnings: bool,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct RepoEntry {
+    pub name: String,
+    pub enabled: bool,
+    pub is_microsoft: bool,
+    pub is_eus: bool,
+    pub baseurl: Option<String>,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct RhuiConfigResult {
+    pub found: bool,
+    pub repos: Vec<RepoEntry>,
+    pub has_eus_repos: bool,
+    pub has_microsoft_repo: bool,
+    pub warnings: Vec<UnixWarning>,
+    pub recommendations: Vec<UnixWarning>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct EusVersionLockResult {
+    pub found: bool,
+    pub has_releasever_file: bool,
+    pub releasever: Option<String>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct RhelRhuiCheckResult {
+    pub found: bool,
+    pub rhui_packages: Vec<String>,
+    pub has_rhui_package: bool,
+    pub rhui_type: Option<String>,
+    pub is_eus: bool,
+    pub is_sap: bool,
+    pub warnings: Vec<UnixWarning>,
+    pub recommendations: Vec<UnixWarning>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct CryptoPoliciesResult {
+    pub found: bool,
+    pub policy: Option<String>,
+    pub is_default: bool,
+    pub warnings: Vec<UnixWarning>,
+    pub recommendations: Vec<UnixWarning>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct FipsModeSetupResult {
+    pub found: bool,
+    pub fips_enabled: bool,
+    pub inconsistent_state: bool,
+    pub raw_output: String,
+    pub warnings: Vec<UnixWarning>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct TunedProfileResult {
+    pub found: bool,
+    pub active_profile: Option<String>,
+    pub warnings: Vec<UnixWarning>,
+    pub recommendations: Vec<UnixWarning>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct SelinuxResult {
+    pub found: bool,
+    /// Mode declared in /etc/selinux/config (SELINUX=...).
+    pub config_mode: Option<String>,
+    /// Mode currently in effect, as reported by sestatus.
+    pub current_mode: Option<String>,
+    pub warnings: Vec<UnixWarning>,
+    pub recommendations: Vec<UnixWarning>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct SwapSpaceResult {
+    pub found: bool,
+    pub swap_total_kb: i64,
+    pub swap_free_kb: i64,
+    pub warnings: Vec<UnixWarning>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct KernelCmdlineResult {
+    pub found: bool,
+    pub fips_enabled: bool,
+    pub crashkernel: Option<String>,
+    pub root_device: Option<String>,
+    pub raw_cmdline: String,
+    pub warnings: Vec<UnixWarning>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct ErrorItem {
+    pub r#type: String,
+    pub line: usize,
+    pub message: String,
+    pub sample: String,
+    pub repo: Option<String>,
+    pub eus_version: Option<String>,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct RhuiErrorsResult {
+    pub found: bool,
+    pub has_cert_expiration: bool,
+    pub has_http403: bool,
+    pub has_http400: bool,
+    pub has_connection_error: bool,
+    pub errors: Vec<ErrorItem>,
+    pub affected_repos: Vec<String>,
+    pub warnings: Vec<UnixWarning>,
+    pub recommendations: Vec<UnixWarning>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct LeappIssue {
+    pub risk_factor: Option<String>,
+    pub is_error: bool,
+    pub title: String,
+    pub summary: String,
+    pub remediation: Option<String>,
+    pub key: Option<String>,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+    pub source_line_end: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct LeappReportResult {
+    pub found: bool,
+    pub has_errors: bool,
+    pub has_high_risk: bool,
+    pub has_medium_risk: bool,
+    pub upgrade_blocked: bool,
+    pub total_issues: usize,
+    pub error_count: usize,
+    pub high_risk_count: usize,
+    pub medium_risk_count: usize,
+    pub low_risk_count: usize,
+    pub info_count: usize,
+    pub issues: Vec<LeappIssue>,
+    pub third_party_packages: Vec<String>,
+    pub warnings: Vec<UnixWarning>,
+    pub recommendations: Vec<UnixWarning>,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct LeappLogResult {
+    pub found: bool,
+    pub has_errors: bool,
+    pub has_curl_errors: bool,
+    pub has_dns_errors: bool,
+    pub has_rhui_errors: bool,
+    pub error_count: usize,
+    pub warning_count: usize,
+    pub critical_count: usize,
+    pub errors: Vec<ErrorItem>,
+    pub warnings: Vec<UnixWarning>,
+    pub recommendations: Vec<UnixWarning>,
+    pub source_path: String,
+}
+
+fn normalize_space(s: &str) -> String {
+    s.split_whitespace().collect::<Vec<_>>().join("\t")
+}
+
+fn check_eol_distribution(
+    name: Option<&str>,
+    major_version: Option<&str>,
+    pretty_name: Option<&str>,
+) -> Vec<UnixWarning> {
+    let mut warnings = Vec::new();
+    let name_lower = name.unwrap_or("").to_ascii_lowercase();
+    let pretty_lower = pretty_name.unwrap_or("").to_ascii_lowercase();
+    let major = major_version
+        .and_then(|v| v.parse::<i32>().ok())
+        .unwrap_or(0);
+    if (name_lower.contains("red hat")
+        || name_lower.contains("rhel")
+        || name_lower.contains("centos")
+        || name_lower.contains("oracle linux")
+        || pretty_lower.contains("red hat")
+        || pretty_lower.contains("centos")
+        || pretty_lower.contains("oracle linux"))
+        && major == 7
+    {
+        warnings.push(UnixWarning {
+            r#type: "eol_distribution".to_string(),
+            severity: "warning".to_string(),
+            message: "RHEL 7 / CentOS 7 is out of general support. Some RCA Tool detectors may be inaccurate for this distribution.".to_string(),
+            recommendation: Some("Consider upgrading to a supported distribution for better analysis accuracy.".to_string()),
+            documentation_url: Some("https://access.redhat.com/support/policy/updates/errata".to_string()),
+                    source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+});
+    }
+    if (name_lower.contains("suse")
+        || name_lower.contains("sles")
+        || pretty_lower.contains("suse")
+        || pretty_lower.contains("sles"))
+        && major == 12
+    {
+        warnings.push(UnixWarning {
+            r#type: "eol_distribution".to_string(),
+            severity: "warning".to_string(),
+            message: "SUSE Linux Enterprise 12 is out of general support. Some RCA Tool detectors may be inaccurate for this distribution.".to_string(),
+            recommendation: Some("Consider upgrading to SLES 15+ for better analysis accuracy.".to_string()),
+            documentation_url: Some("https://www.suse.com/lifecycle/".to_string()),
+                    source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+});
+    }
+    warnings
+}
+
+pub fn parse_basic_environment(content: &str, source_path: &str) -> BasicEnvironmentResult {
+    let mut pretty_name = None;
+    let mut name = None;
+    let mut product = None;
+    let mut skip_section = false;
+
+    for raw in content.lines() {
+        let trimmed = raw.trim();
+        if trimmed.starts_with('#') {
+            skip_section = trimmed.to_ascii_lowercase().contains(".rpmsave");
+            continue;
+        }
+        if skip_section || trimmed.is_empty() {
+            continue;
+        }
+        if let Some(c) =
+            crate::cached_regex!(r#"^PRETTY_NAME=(?:\"|')?([^\"']+)(?:\"|')?$"#).captures(trimmed)
+        {
+            pretty_name = Some(c[1].trim().to_string());
+            break;
+        }
+        if let Some(c) =
+            crate::cached_regex!(r#"^NAME=(?:\"|')?([^\"']+)(?:\"|')?$"#).captures(trimmed)
+        {
+            name = Some(c[1].trim().to_string());
+        }
+        if let Some(c) = crate::cached_regex!(r"^Product:\s*(.+)$").captures(trimmed) {
+            product = Some(c[1].trim().to_string());
+        }
+    }
+    let distribution = pretty_name.clone().or(product.clone()).or(name.clone());
+    let mut sap = false;
+    let mut epic = false;
+    for field in [pretty_name.as_ref(), product.as_ref(), name.as_ref()]
+        .into_iter()
+        .flatten()
+    {
+        if crate::cached_regex!(r"(?i)\bSAP\b|for\s+SAP|SAP\s+Applications").is_match(field) {
+            sap = true;
+        }
+        if crate::cached_regex!(r"(?i)\bEPIC\b|Enterprise\s+Portal\s+Integration|for\s+EPIC")
+            .is_match(field)
+        {
+            epic = true;
+        }
+    }
+    BasicEnvironmentResult {
+        found: distribution.is_some(),
+        pretty_name,
+        name,
+        distribution,
+        sap_product_detected: sap,
+        epic_product_detected: epic,
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_os_release(content: &str, source_path: &str) -> OsReleaseResult {
+    let mut name = None;
+    let mut version = None;
+    let mut version_id = None;
+    let mut pretty_name = None;
+
+    let first_line = content.lines().next().unwrap_or("").trim();
+    if !content.contains('=') && !first_line.is_empty() {
+        if let Some(c) = crate::cached_regex!(r"^(.+?)\s+release\s+([\d.]+)").captures(first_line) {
+            name = Some(c[1].trim().to_string());
+            version_id = Some(c[2].to_string());
+            pretty_name = Some(first_line.to_string());
+        } else if let Some(c) = crate::cached_regex!(r"^(SUSE.+?)\s+(\d+)").captures(first_line) {
+            name = Some(c[1].trim().to_string());
+            version_id = Some(c[2].to_string());
+            pretty_name = Some(first_line.to_string());
+        }
+    } else {
+        for line in content.lines() {
+            let trimmed = line.trim();
+            if trimmed.is_empty() || trimmed.starts_with('#') {
+                continue;
+            }
+            if let Some(c) =
+                crate::cached_regex!(r#"^NAME=[\"']?([^\"']+)[\"']?$"#).captures(trimmed)
+            {
+                name = Some(c[1].to_string());
+            }
+            if let Some(c) =
+                crate::cached_regex!(r#"^VERSION=[\"']?([^\"']+)[\"']?$"#).captures(trimmed)
+            {
+                version = Some(c[1].to_string());
+            }
+            if let Some(c) =
+                crate::cached_regex!(r#"^VERSION_ID=[\"']?([^\"']+)[\"']?$"#).captures(trimmed)
+            {
+                version_id = Some(c[1].to_string());
+            }
+            if let Some(c) =
+                crate::cached_regex!(r#"^PRETTY_NAME=[\"']?([^\"']+)[\"']?$"#).captures(trimmed)
+            {
+                pretty_name = Some(c[1].to_string());
+            }
+            if pretty_name.is_none() {
+                if let Some(c) = crate::cached_regex!(r"^Distribution:\s*(.+)$").captures(trimmed) {
+                    pretty_name = Some(c[1].trim().to_string());
+                }
+            }
+        }
+    }
+
+    // Fallback: scan all lines for a `Distribution:` header (multi-section
+    // files like crm_report's `sysinfo.txt` have no `=` signs and bury the
+    // distro on a non-first line).
+    if pretty_name.is_none() {
+        for line in content.lines() {
+            let trimmed = line.trim();
+            if let Some(c) = crate::cached_regex!(r"^Distribution:\s*(.+)$").captures(trimmed) {
+                pretty_name = Some(c[1].trim().to_string());
+                break;
+            }
+        }
+    }
+
+    let (major_version, minor_version) = if let Some(v) = &version_id {
+        let mut parts = v.split('.');
+        (
+            parts.next().map(|s| s.to_string()),
+            parts.next().map(|s| s.to_string()),
+        )
+    } else if let Some(pn) = &pretty_name {
+        let mv = crate::cached_regex!(r"\b(1[0-9]|[789])\b")
+            .captures(pn)
+            .and_then(|c| c.get(1).map(|m| m.as_str().to_string()));
+        (mv, None)
+    } else {
+        (None, None)
+    };
+    let warnings = check_eol_distribution(
+        name.as_deref(),
+        major_version.as_deref(),
+        pretty_name.as_deref(),
+    );
+    OsReleaseResult {
+        found: name.is_some() || pretty_name.is_some(),
+        name,
+        version,
+        version_id,
+        pretty_name,
+        major_version,
+        minor_version,
+        has_warnings: !warnings.is_empty(),
+        is_eol: !warnings.is_empty(),
+        warnings,
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_fstab(content: &str, source_path: &str) -> RawFileResult {
+    // SCC's `fs-diskio.txt` is a multipart file with sections delimited by
+    // lines starting with `#==[` (e.g. `#==[ Configuration File ]===#`).
+    // The fstab section is introduced by a `# /etc/fstab` header line.
+    // Blank lines and commented-out fstab entries (e.g. `#/dev/system/swap`)
+    // are legitimate fstab content and must NOT terminate the section.
+    let header_re = crate::cached_regex!(r"^#\s*/etc/fstab\s*$");
+    let has_header = content.lines().any(|l| header_re.is_match(l));
+    let extracted = if has_header {
+        let mut lines: Vec<&str> = Vec::new();
+        let mut in_section = false;
+        for line in content.lines() {
+            if !in_section {
+                if header_re.is_match(line) {
+                    in_section = true;
+                }
+                continue;
+            }
+            if line.starts_with("#==") {
+                break;
+            }
+            lines.push(line);
+        }
+        // Strip leading/trailing blank lines, keep interior blanks.
+        while lines.first().map_or(false, |l| l.trim().is_empty()) {
+            lines.remove(0);
+        }
+        while lines.last().map_or(false, |l| l.trim().is_empty()) {
+            lines.pop();
+        }
+        if lines.is_empty() {
+            None
+        } else {
+            Some(lines.join("\n"))
+        }
+    } else if content.trim().is_empty() {
+        None
+    } else {
+        Some(content.trim().to_string())
+    };
+    RawFileResult {
+        found: extracted.is_some(),
+        content: extracted,
+        source: Some("fstab".to_string()),
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_inspect_disk_results(content: &str, source_path: &str) -> InspectDiskResultsResult {
+    let mut result = InspectDiskResultsResult {
+        found: false,
+        is_inspect_disk: false,
+        request_info: BTreeMap::new(),
+        filesystem_status: Vec::new(),
+        inspection_metadata: BTreeMap::new(),
+        mount_points: BTreeMap::new(),
+        mount_results: Vec::new(),
+        warnings: Vec::new(),
+        has_warnings: false,
+        source_path: source_path.to_string(),
+    };
+
+    let mut section: Option<&str> = None;
+    let mut has_request = false;
+    let mut has_meta = false;
+    for line in content.lines() {
+        let trimmed = line.trim();
+        if trimmed == "========== Request Info ==========" {
+            section = Some("request");
+            has_request = true;
+            continue;
+        }
+        if trimmed == "========== End Request Info ==========" {
+            section = None;
+            continue;
+        }
+        if trimmed == "Filesystem Status:" {
+            section = Some("fs");
+            continue;
+        }
+        if trimmed.starts_with("Inspection Status:")
+            || trimmed.starts_with("Inspection Metadata for")
+        {
+            section = Some("meta");
+            has_meta = true;
+            continue;
+        }
+        if trimmed == "Mount Points:" {
+            section = Some("mount_points");
+            continue;
+        }
+
+        if let Some(c) =
+            crate::cached_regex!(r"^Mounting\s+(\/dev\/\S+)\s+on\s+(\S+)\s+(SUCCEEDED|FAILED)\.")
+                .captures(trimmed)
+        {
+            result.mount_results.push(InspectMountResult {
+                device: c[1].to_string(),
+                mount_point: c[2].to_string(),
+                status: c[3].to_string(),
+                source_path: String::new(),
+                source_line: None,
+                source_line_end: None,
+            });
+            if &c[3] == "FAILED" {
+                result.warnings.push(UnixWarning {
+                    r#type: "inspect_disk_mount_failure".to_string(),
+                    severity: "error".to_string(),
+                    message: format!("Mount failed: {} on {}", &c[1], &c[2]),
+                    recommendation: Some(
+                        "Check if the device exists and the filesystem is intact.".to_string(),
+                    ),
+                    documentation_url: None,
+                    source_path: String::new(),
+                    source_line: None,
+                    source_line_end: None,
+                });
+            }
+        }
+
+        match section {
+            Some("request") => {
+                if let Some(c) = crate::cached_regex!(r"^(.+?):\s+(.+)$").captures(trimmed) {
+                    // Normalise the heterogeneous label set from
+                    // InspectIaaSDisk into the camelCase keys the Leptos
+                    // `InspectDiskSection` reads.  Unknown labels fall
+                    // through verbatim so we don't lose information.
+                    let raw_label = c[1].trim();
+                    let value = c[2].trim().to_string();
+                    let key = match raw_label {
+                        "Storage Acct" | "Storage Account" => "storageAccount".to_string(),
+                        "Container/Vhd" | "Container/VHD" => "containerVhd".to_string(),
+                        "Manifest requested" | "Manifest" => "manifest".to_string(),
+                        "Inspect service Operational ID" | "Operational ID" => {
+                            "operationalId".to_string()
+                        }
+                        "Guestfish version" | "Guestfish" => "guestfishVersion".to_string(),
+                        other => other.to_string(),
+                    };
+                    result.request_info.insert(key, value);
+                }
+            }
+            Some("fs") => {
+                if let Some(c) = crate::cached_regex!(r"^(\/dev\/\S+):\s+(\S+)\s+\[uuid=([^\]]*)\]")
+                    .captures(trimmed)
+                {
+                    result.filesystem_status.push(InspectFilesystemStatus {
+                        device: c[1].to_string(),
+                        r#type: c[2].to_string(),
+                        uuid: if c[3].is_empty() {
+                            None
+                        } else {
+                            Some(c[3].to_string())
+                        },
+                        source_path: String::new(),
+                        source_line: None,
+                        source_line_end: None,
+                    });
+                }
+            }
+            Some("meta") => {
+                if let Some(c) = crate::cached_regex!(r"^(Type|Distribution|Product Name):\s+(.+)$")
+                    .captures(trimmed)
+                {
+                    // Normalise to the camelCase keys the Leptos
+                    // `Disk Inspection` panel reads.
+                    let key = match &c[1] {
+                        "Type" => "type".to_string(),
+                        "Distribution" => "distribution".to_string(),
+                        "Product Name" => "productName".to_string(),
+                        other => other.to_string(),
+                    };
+                    result
+                        .inspection_metadata
+                        .insert(key, c[2].trim().to_string());
+                }
+            }
+            Some("mount_points") => {
+                if let Some(c) =
+                    crate::cached_regex!(r"^(\/\S*)\s*:\s+(\/dev\/\S+)$").captures(trimmed)
+                {
+                    result
+                        .mount_points
+                        .insert(c[1].to_string(), c[2].to_string());
+                }
+            }
+            _ => {}
+        }
+    }
+
+    result.found = has_request || has_meta;
+    result.is_inspect_disk = result.found;
+    result.has_warnings = !result.warnings.is_empty();
+    result
+}
+
+pub fn parse_kernel_tuning(content: &str, source_path: &str) -> KernelTuningResult {
+    let mut parameters = BTreeMap::new();
+    for line in content.lines() {
+        if let Some(c) = crate::cached_regex!(r"^([^\s=]+)\s*=\s*(.+)$").captures(line.trim()) {
+            parameters.insert(c[1].to_string(), c[2].trim().to_string());
+        }
+    }
+
+    let expected_values = [
+        ("vm.dirty_bytes", "629145600"),
+        ("vm.dirty_background_bytes", "314572800"),
+        ("vm.swappiness", "10"),
+    ];
+    let mut warnings = Vec::new();
+    for (k, v) in expected_values {
+        if let Some(actual) = parameters.get(k) {
+            if actual != v {
+                warnings.push(TuningDifference {
+                    parameter: k.to_string(),
+                    expected: v.to_string(),
+                    actual: actual.clone(),
+                    documentation_url: Some("https://learn.microsoft.com/en-us/azure/sap/workloads/sap-hana-high-availability".to_string()),
+                    matches: None,
+                                    source_path: String::new(),
+                    source_line: None,
+                    source_line_end: None,
+});
+            }
+        }
+    }
+
+    let azure_network_params = [
+        ("net.ipv4.tcp_mem", "4096\t87380\t67108864"),
+        ("net.ipv4.udp_mem", "4096\t87380\t33554432"),
+        ("net.ipv4.tcp_rmem", "4096\t87380\t67108864"),
+        ("net.ipv4.tcp_wmem", "4096\t65536\t67108864"),
+        ("net.core.rmem_default", "33554432"),
+        ("net.core.wmem_default", "33554432"),
+        ("net.ipv4.udp_wmem_min", "16384"),
+        ("net.ipv4.udp_rmem_min", "16384"),
+        ("net.core.wmem_max", "134217728"),
+        ("net.core.rmem_max", "134217728"),
+        ("net.core.busy_poll", "50"),
+        ("net.core.busy_read", "50"),
+        ("net.ipv4.tcp_congestion_control", "bbr"),
+    ];
+    let mut azure_network_warnings = Vec::new();
+    for (k, v) in azure_network_params {
+        if let Some(actual) = parameters.get(k) {
+            if normalize_space(actual) != normalize_space(v) {
+                azure_network_warnings.push(TuningDifference {
+                    parameter: k.to_string(),
+                    expected: v.to_string(),
+                    actual: actual.clone(),
+                    documentation_url: Some("https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-optimize-network-bandwidth#linux-virtual-machines".to_string()),
+                    matches: None,
+                                    source_path: String::new(),
+                    source_line: None,
+                    source_line_end: None,
+});
+            }
+        }
+    }
+
+    let optional_network_params = [
+        ("net.ipv4.tcp_timestamps", "1"),
+        ("net.ipv4.tcp_tw_reuse", "1"),
+        ("net.ipv4.ip_local_port_range", "1024\t65535"),
+        ("net.core.netdev_budget", "1000"),
+        ("net.core.optmem_max", "65535"),
+        ("net.ipv4.tcp_frto", "0"),
+        ("net.core.somaxconn", "32768"),
+        ("net.core.netdev_max_backlog", "32768"),
+        ("net.core.dev_weight", "64"),
+        ("net.core.default_qdisc", "fq"),
+    ];
+    let mut optional_network_info = Vec::new();
+    for (k, v) in optional_network_params {
+        if let Some(actual) = parameters.get(k) {
+            optional_network_info.push(TuningDifference {
+                parameter: k.to_string(),
+                expected: v.to_string(),
+                actual: actual.clone(),
+                documentation_url: Some("https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-optimize-network-bandwidth#linux-virtual-machines".to_string()),
+                matches: Some(normalize_space(actual) == normalize_space(v)),
+                            source_path: String::new(),
+                source_line: None,
+                source_line_end: None,
+});
+        }
+    }
+
+    let azure_expected_keys = [
+        "net.ipv4.tcp_mem",
+        "net.ipv4.udp_mem",
+        "net.ipv4.tcp_rmem",
+        "net.ipv4.tcp_wmem",
+        "net.core.rmem_default",
+        "net.core.wmem_default",
+        "net.ipv4.udp_wmem_min",
+        "net.ipv4.udp_rmem_min",
+        "net.core.wmem_max",
+        "net.core.rmem_max",
+        "net.core.busy_poll",
+        "net.core.busy_read",
+        "net.ipv4.tcp_congestion_control",
+    ];
+    let azure_network_tuned = azure_network_warnings.is_empty()
+        && azure_expected_keys
+            .iter()
+            .all(|k| parameters.contains_key(*k));
+    let fips_enabled = parameters
+        .get("crypto.fips_enabled")
+        .map(|v| v == "1")
+        .unwrap_or(false);
+
+    KernelTuningResult {
+        found: !parameters.is_empty(),
+        parameters,
+        has_warnings: !warnings.is_empty(),
+        warnings,
+        has_azure_network_warnings: !azure_network_warnings.is_empty(),
+        azure_network_warnings,
+        azure_network_tuned,
+        has_optional_network_info: !optional_network_info.is_empty(),
+        optional_network_info,
+        fips_enabled,
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_huge_pages(content: &str, source_path: &str) -> HugePagesResult {
+    let mut static_hp = BTreeMap::new();
+    let mut thp = BTreeMap::new();
+    let mut warnings = Vec::new();
+    let mut recommendations = Vec::new();
+
+    for line in content.lines() {
+        let trimmed = line.trim();
+        if let Some(c) = crate::cached_regex!(r"^HugePages_(\w+):\s+(\d+)").captures(trimmed) {
+            static_hp.insert(c[1].to_ascii_lowercase(), c[2].parse::<i64>().unwrap_or(0));
+        }
+        if let Some(c) = crate::cached_regex!(r"^Hugepagesize:\s+(\d+)\s+kB").captures(trimmed) {
+            static_hp.insert("pagesize_kb".to_string(), c[1].parse::<i64>().unwrap_or(0));
+        }
+        if let Some(c) = crate::cached_regex!(r"^Hugetlb:\s+(\d+)\s+kB").captures(trimmed) {
+            static_hp.insert("hugetlb_kb".to_string(), c[1].parse::<i64>().unwrap_or(0));
+        }
+        if let Some(c) = crate::cached_regex!(r"^AnonHugePages:\s+(\d+)\s+kB").captures(trimmed) {
+            thp.insert("anon_kb".to_string(), c[1].parse::<i64>().unwrap_or(0));
+        }
+        if let Some(c) = crate::cached_regex!(r"^ShmemHugePages:\s+(\d+)\s+kB").captures(trimmed) {
+            thp.insert("shmem_kb".to_string(), c[1].parse::<i64>().unwrap_or(0));
+        }
+    }
+
+    if let (Some(total), Some(free)) = (static_hp.get("total"), static_hp.get("free")) {
+        if *total > 0 {
+            let used_percent = ((*total - *free) as f64 / *total as f64) * 100.0;
+            if used_percent < 10.0 {
+                warnings.push(UnixWarning {
+                    r#type: "unused_hugepages".to_string(),
+                    severity: "warning".to_string(),
+                    message: format!(
+                        "Static huge pages are configured but mostly unused ({:.1}% used)",
+                        used_percent
+                    ),
+                    recommendation: Some(
+                        "Consider reducing huge page allocation to free memory.".to_string(),
+                    ),
+                    documentation_url: None,
+                    source_path: String::new(),
+                    source_line: None,
+                    source_line_end: None,
+                });
+            }
+        }
+    }
+    if let Some(anon_kb) = thp.get("anon_kb") {
+        if *anon_kb > 0 {
+            recommendations.push(UnixWarning {
+                r#type: "thp_usage".to_string(),
+                severity: "info".to_string(),
+                message: format!("Transparent Huge Pages are in use ({} MB)", anon_kb / 1024),
+                recommendation: Some("For SAP HANA, THP should usually be disabled.".to_string()),
+                documentation_url: Some("https://learn.microsoft.com/en-us/azure/sap/large-instances/archived-hli-docs/hana-monitor-troubleshoot#operating-system-os".to_string()),
+                            source_path: String::new(),
+                source_line: None,
+                source_line_end: None,
+});
+        }
+    }
+
+    HugePagesResult {
+        found: !static_hp.is_empty() || !thp.is_empty(),
+        static_huge_pages: static_hp,
+        transparent_huge_pages: thp,
+        sysctl_params: BTreeMap::new(),
+        warnings,
+        recommendations,
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_time_sync(content: &str, source_path: &str) -> TimeSyncResult {
+    let has_hv_utils = crate::cached_regex!(r"(?i)hv_utils|hyperv").is_match(content);
+    let ptp_index = crate::cached_regex!(r"(?i)ptp(\d+)")
+        .captures(content)
+        .and_then(|c| c.get(1).map(|m| format!("ptp{}", m.as_str())));
+    let has_ptp_clock = ptp_index.is_some() || content.contains("ptp_hyperv");
+    let mut warnings = Vec::new();
+    let mut recommendations = Vec::new();
+    if has_hv_utils && !has_ptp_clock {
+        warnings.push(UnixWarning {
+            r#type: "ptp_missing".to_string(),
+            severity: "warning".to_string(),
+            message: "Hyper-V utilities are present but no PTP clock source was detected."
+                .to_string(),
+            recommendation: Some("Check hv_utils and Azure time sync configuration.".to_string()),
+            documentation_url: Some(
+                "https://learn.microsoft.com/en-us/azure/virtual-machines/linux/time-sync"
+                    .to_string(),
+            ),
+            source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+        });
+    }
+    if has_ptp_clock {
+        recommendations.push(UnixWarning {
+            r#type: "ptp_present".to_string(),
+            severity: "info".to_string(),
+            message: "PTP clock source detected.".to_string(),
+            recommendation: None,
+            documentation_url: None,
+            source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+        });
+    }
+    TimeSyncResult {
+        found: has_hv_utils || has_ptp_clock,
+        has_hv_utils,
+        has_ptp_clock,
+        ptp_index,
+        warnings,
+        recommendations,
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_ptp_clock_source(content: &str, source_path: &str) -> PtpClockSourceResult {
+    let refclock = crate::cached_regex!(r"(?im)^refclock\s+PHC\s+(\/dev\/[^\s]+)")
+        .captures(content)
+        .and_then(|c| c.get(1).map(|m| m.as_str().to_string()));
+    let uses_hyperv_symlink = refclock
+        .as_deref()
+        .map(|d| d.contains("ptp_hyperv"))
+        .unwrap_or(false);
+    let mut warnings = Vec::new();
+    if refclock.is_none() {
+        warnings.push(UnixWarning {
+            r#type: "no_ptp_refclock".to_string(),
+            severity: "warning".to_string(),
+            message: "No PTP refclock found in chrony or NTP configuration.".to_string(),
+            recommendation: Some("Configure refclock PHC /dev/ptp_hyperv.".to_string()),
+            documentation_url: Some(
+                "https://learn.microsoft.com/en-us/azure/virtual-machines/linux/time-sync#chrony"
+                    .to_string(),
+            ),
+            source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+        });
+    }
+    PtpClockSourceResult {
+        found: refclock.is_some(),
+        has_refclock: refclock.is_some(),
+        uses_hyperv_symlink,
+        refclock_device: refclock,
+        warnings,
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_time_sync_service(content: &str, source_path: &str) -> TimeSyncServiceResult {
+    let lowered = content.to_ascii_lowercase();
+    // Try to identify the service by the supportconfig systemd-status.txt
+    // section header (`# /bin/systemctl status 'chronyd.service'`) first,
+    // falling back to substring detection for plain `systemctl status`
+    // output.
+    let header_service = crate::cached_regex!(
+        r#"(?im)^\s*#?\s*/?(?:bin/|sbin/|usr/bin/|usr/sbin/)?systemctl\s+status\s+['"]?([a-z0-9._-]+?)(?:\.service)?['"]?\s*$"#
+    )
+    .captures(content)
+    .and_then(|c| c.get(1).map(|m| m.as_str().to_ascii_lowercase()));
+    let active = lowered.contains("active (running)")
+        || lowered.contains("active: active")
+        || (lowered.contains("active") && lowered.contains("running"));
+    let enabled_loaded = lowered.contains("loaded:") && lowered.contains("enabled");
+    let enabled = enabled_loaded || active;
+    let detected = header_service.clone().or_else(|| {
+        if lowered.contains("chronyd") || lowered.contains("chrony") {
+            Some("chronyd".to_string())
+        } else if lowered.contains("systemd-timesyncd") {
+            Some("systemd-timesyncd".to_string())
+        } else if lowered.contains("ntpd") || lowered.contains(" ntp") {
+            Some("ntpd".to_string())
+        } else {
+            None
+        }
+    });
+
+    let mut chrony_enabled = false;
+    let mut chrony_status = None;
+    let mut ntpd_enabled = false;
+    let mut ntpd_status = None;
+    let mut timesyncd_enabled = false;
+    let mut timesyncd_status = None;
+    let status_word = if active {
+        "enabled, active (running)".to_string()
+    } else if enabled {
+        "enabled".to_string()
+    } else {
+        "inactive".to_string()
+    };
+    let service_name = match detected.as_deref() {
+        Some("chronyd") | Some("chrony") => {
+            chrony_enabled = enabled;
+            chrony_status = Some(status_word.clone());
+            Some("chrony".to_string())
+        }
+        Some("ntpd") | Some("ntp") => {
+            ntpd_enabled = enabled;
+            ntpd_status = Some(status_word.clone());
+            Some("ntpd".to_string())
+        }
+        Some("systemd-timesyncd") => {
+            timesyncd_enabled = enabled;
+            timesyncd_status = Some(status_word.clone());
+            Some("systemd-timesyncd".to_string())
+        }
+        Some(other) => Some(other.to_string()),
+        None => None,
+    };
+    let mut warnings = Vec::new();
+    if let Some(name) = &service_name {
+        if !active && (chrony_enabled || ntpd_enabled || timesyncd_enabled) {
+            warnings.push(UnixWarning {
+                r#type: "time_service_inactive".to_string(),
+                severity: "warning".to_string(),
+                message: format!("{} is configured but not active.", name),
+                recommendation: Some(
+                    "Start and enable the configured time sync service.".to_string(),
+                ),
+                documentation_url: None,
+                source_path: String::new(),
+                source_line: None,
+                source_line_end: None,
+            });
+        }
+    }
+    // Surface the source file (e.g. `systemd-status.txt`) so the UI can
+    // attribute the detection.  Use just the basename to keep the table
+    // legible.
+    let detection_file = if !source_path.is_empty() {
+        Some(
+            source_path
+                .rsplit('/')
+                .next()
+                .unwrap_or(source_path)
+                .to_string(),
+        )
+    } else {
+        None
+    };
+    TimeSyncServiceResult {
+        found: service_name.is_some(),
+        service_name,
+        active,
+        chrony_enabled,
+        chrony_status,
+        ntpd_enabled,
+        ntpd_status,
+        timesyncd_enabled,
+        timesyncd_status,
+        detection_file,
+        warnings,
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_timedatectl(content: &str, source_path: &str) -> TimedatectlResult {
+    let mut result = TimedatectlResult {
+        found: false,
+        ntp_enabled: false,
+        ntp_synchronized: false,
+        ntp_service: None,
+        local_time: None,
+        timezone: None,
+        warnings: Vec::new(),
+        recommendations: Vec::new(),
+        has_warnings: false,
+        has_errors: false,
+        source_path: source_path.to_string(),
+    };
+
+    for line in content.lines() {
+        let trimmed = line.trim();
+        let Some(idx) = trimmed.find(':') else {
+            continue;
+        };
+        let key = trimmed[..idx].trim().to_ascii_lowercase();
+        let value = trimmed[idx + 1..].trim().to_ascii_lowercase();
+        match key.as_str() {
+            "ntp enabled" => {
+                result.ntp_enabled = value == "yes";
+                result.found = true;
+            }
+            "ntp synchronized" | "system clock synchronized" => {
+                result.ntp_synchronized = value == "yes";
+                result.found = true;
+            }
+            "ntp service" => {
+                result.ntp_service = Some(value.clone());
+                result.ntp_enabled = value == "active" || value == "running";
+                result.found = true;
+            }
+            "local time" => {
+                result.local_time = Some(trimmed[idx + 1..].trim().to_string());
+                result.found = true;
+            }
+            "time zone" => result.timezone = Some(trimmed[idx + 1..].trim().to_string()),
+            _ => {}
+        }
+    }
+    if result.found && !result.ntp_synchronized {
+        result.warnings.push(UnixWarning {
+            r#type: "not_synchronized".to_string(),
+            severity: "error".to_string(),
+            message: "System clock is not synchronized with NTP.".to_string(),
+            recommendation: Some(
+                "Check time service status and network connectivity to time sources.".to_string(),
+            ),
+            documentation_url: Some(
+                "https://learn.microsoft.com/en-us/azure/virtual-machines/linux/time-sync"
+                    .to_string(),
+            ),
+            source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+        });
+    }
+    if result.found && !result.ntp_enabled {
+        result.warnings.push(UnixWarning {
+            r#type: "ntp_disabled".to_string(),
+            severity: "error".to_string(),
+            message: "NTP service is not enabled.".to_string(),
+            recommendation: Some("Enable NTP with timedatectl set-ntp true".to_string()),
+            documentation_url: Some(
+                "https://learn.microsoft.com/en-us/azure/virtual-machines/linux/time-sync"
+                    .to_string(),
+            ),
+            source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+        });
+    }
+    result.has_warnings = !result.warnings.is_empty();
+    result.has_errors = result.warnings.iter().any(|w| w.severity == "error");
+    result
+}
+
+pub fn parse_ptp_device(content: &str, source_path: &str) -> PtpDeviceResult {
+    let mut devices = Vec::new();
+    let mut has_symlink = false;
+    let mut target = None;
+    for line in content.lines() {
+        let trimmed = line.trim();
+        if let Some(c) = crate::cached_regex!(r"\b(ptp\d+)\b").captures(trimmed) {
+            let dev = c[1].to_string();
+            if !devices.contains(&dev) {
+                devices.push(dev);
+            }
+        }
+        if let Some(c) = crate::cached_regex!(r"ptp_hyperv\s+->\s+(\S+)").captures(trimmed) {
+            has_symlink = true;
+            target = Some(c[1].to_string());
+        }
+        if trimmed.contains("DEVLINKS=") && trimmed.contains("ptp_hyperv") {
+            has_symlink = true;
+        }
+        if trimmed.starts_with("E: DEVNAME=/dev/ptp") && target.is_none() {
+            target = Some(trimmed.trim_start_matches("E: DEVNAME=/dev/").to_string());
+        }
+    }
+    let mut warnings = Vec::new();
+    let mut recommendations = Vec::new();
+    if !devices.is_empty() && !has_symlink {
+        warnings.push(UnixWarning {
+            r#type: "ptp_hyperv_symlink_missing".to_string(),
+            severity: "warning".to_string(),
+            message: "/dev/ptp_hyperv symlink is not present.".to_string(),
+            recommendation: Some("Create a udev rule to create the /dev/ptp_hyperv symlink.".to_string()),
+            documentation_url: Some("https://learn.microsoft.com/en-us/azure/virtual-machines/linux/time-sync#check-for-ptp-clock-source".to_string()),
+                    source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+});
+    }
+    if devices.is_empty() {
+        recommendations.push(UnixWarning {
+            r#type: "no_ptp_devices".to_string(),
+            severity: "info".to_string(),
+            message: "No PTP devices found.".to_string(),
+            recommendation: Some(
+                "Ensure the kernel supports PTP and hv_utils is loaded.".to_string(),
+            ),
+            documentation_url: None,
+            source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+        });
+    }
+    PtpDeviceResult {
+        found: !devices.is_empty() || has_symlink,
+        ptp_devices: devices,
+        has_ptp_hyperv_symlink: has_symlink,
+        ptp_hyperv_target: target,
+        warnings,
+        recommendations,
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_chrony_tracking(content: &str, source_path: &str) -> ChronyTrackingResult {
+    let mut result = ChronyTrackingResult {
+        found: false,
+        reference_id: None,
+        reference_name: None,
+        stratum: None,
+        system_time: None,
+        system_time_seconds: None,
+        last_offset: None,
+        last_offset_seconds: None,
+        rms_offset: None,
+        update_interval: None,
+        leap_status: None,
+        is_ptp_source: false,
+        is_phc_source: false,
+        warnings: Vec::new(),
+        recommendations: Vec::new(),
+        has_warnings: false,
+        has_errors: false,
+        source_path: source_path.to_string(),
+    };
+    for line in content.lines() {
+        let trimmed = line.trim();
+        let Some(idx) = trimmed.find(':') else {
+            continue;
+        };
+        let key = trimmed[..idx].trim().to_ascii_lowercase();
+        let value = trimmed[idx + 1..].trim().to_string();
+        match key.as_str() {
+            "reference id" => {
+                result.reference_id = Some(value.clone());
+                result.found = true;
+                if let Some(c) = crate::cached_regex!(r"\(PHC(\d+)\)").captures(&value) {
+                    result.reference_name = Some(format!("PHC{}", &c[1]));
+                    result.is_phc_source = true;
+                    result.is_ptp_source = true;
+                }
+            }
+            "stratum" => result.stratum = value.parse::<i32>().ok(),
+            "system time" => {
+                result.system_time = Some(value.clone());
+                if let Some(c) =
+                    crate::cached_regex!(r"([\d.]+)\s+seconds?\s+(slow|fast)").captures(&value)
+                {
+                    let mut v = c[1].parse::<f64>().unwrap_or(0.0);
+                    if &c[2].to_ascii_lowercase() == "slow" {
+                        v = -v;
+                    }
+                    result.system_time_seconds = Some(v);
+                }
+            }
+            "last offset" => {
+                result.last_offset = Some(value.clone());
+                if let Some(c) = crate::cached_regex!(r"([+-]?[\d.]+)\s+seconds?").captures(&value)
+                {
+                    result.last_offset_seconds = c[1].parse::<f64>().ok();
+                }
+            }
+            "rms offset" => result.rms_offset = Some(value),
+            "update interval" => result.update_interval = Some(value),
+            "leap status" => result.leap_status = Some(value),
+            _ => {}
+        }
+    }
+    if let Some(off) = result.last_offset_seconds {
+        let abs = off.abs();
+        if abs > 0.1 {
+            result.warnings.push(UnixWarning {
+                r#type: "high_time_offset".to_string(),
+                severity: if abs > 1.0 {
+                    "error".to_string()
+                } else {
+                    "warning".to_string()
+                },
+                message: format!("Time offset is {:.3} seconds.", abs),
+                recommendation: Some(
+                    "Check chrony and consider running chronyc makestep.".to_string(),
+                ),
+                documentation_url: Some(
+                    "https://learn.microsoft.com/en-us/azure/virtual-machines/linux/time-sync"
+                        .to_string(),
+                ),
+                source_path: String::new(),
+                source_line: None,
+                source_line_end: None,
+            });
+        }
+    }
+    if result.is_ptp_source {
+        result.recommendations.push(UnixWarning {
+            r#type: "using_ptp".to_string(),
+            severity: "info".to_string(),
+            message: "Time is synchronized from a PTP source.".to_string(),
+            recommendation: None,
+            documentation_url: None,
+            source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+        });
+    }
+    if let Some(leap) = &result.leap_status {
+        if leap.to_ascii_lowercase() != "normal" {
+            result.warnings.push(UnixWarning {
+                r#type: "leap_status_abnormal".to_string(),
+                severity: "warning".to_string(),
+                message: format!("Chrony leap status is '{}' instead of 'Normal'.", leap),
+                recommendation: Some("Check chrony and time source status.".to_string()),
+                documentation_url: None,
+                source_path: String::new(),
+                source_line: None,
+                source_line_end: None,
+            });
+        }
+    }
+    result.has_warnings = !result.warnings.is_empty();
+    result.has_errors = result.warnings.iter().any(|w| w.severity == "error");
+    result
+}
+
+pub fn parse_chrony_makestep(content: &str, source_path: &str) -> ChronyMakestepResult {
+    let makestep = crate::cached_regex!(r"(?im)^makestep\s+([\d.]+)\s+(\d+)").captures(content);
+    let refclock =
+        crate::cached_regex!(r"(?im)^refclock\s+PHC\s+(\/dev\/[^\s]+)(?:\s+poll\s+(\d+))?")
+            .captures(content);
+    let mut result = ChronyMakestepResult {
+        found: makestep.is_some() || refclock.is_some(),
+        has_makestep: makestep.is_some(),
+        makestep_threshold: makestep
+            .as_ref()
+            .and_then(|c| c.get(1).and_then(|m| m.as_str().parse::<f64>().ok())),
+        makestep_limit: makestep
+            .as_ref()
+            .and_then(|c| c.get(2).and_then(|m| m.as_str().parse::<i32>().ok())),
+        has_refclock: refclock.is_some(),
+        refclock_device: refclock
+            .as_ref()
+            .and_then(|c| c.get(1).map(|m| m.as_str().to_string())),
+        refclock_poll_interval: refclock
+            .as_ref()
+            .and_then(|c| c.get(2).and_then(|m| m.as_str().parse::<i32>().ok())),
+        uses_hyperv_symlink: refclock
+            .as_ref()
+            .and_then(|c| c.get(1))
+            .map(|m| m.as_str().contains("ptp_hyperv"))
+            .unwrap_or(false),
+        warnings: Vec::new(),
+        recommendations: Vec::new(),
+        has_warnings: false,
+        source_path: source_path.to_string(),
+    };
+    if !result.has_makestep {
+        result.recommendations.push(UnixWarning {
+            r#type: "no_makestep".to_string(),
+            severity: "info".to_string(),
+            message: "makestep directive not configured.".to_string(),
+            recommendation: Some("Consider adding makestep 1.0 3".to_string()),
+            documentation_url: None,
+            source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+        });
+    }
+    if result.has_refclock && !result.uses_hyperv_symlink {
+        result.warnings.push(UnixWarning {
+            r#type: "hardcoded_ptp_device".to_string(),
+            severity: "warning".to_string(),
+            message: "Chrony is using a hardcoded PTP device instead of /dev/ptp_hyperv."
+                .to_string(),
+            recommendation: Some("Use refclock PHC /dev/ptp_hyperv".to_string()),
+            documentation_url: Some(
+                "https://learn.microsoft.com/en-us/azure/virtual-machines/linux/time-sync#chrony"
+                    .to_string(),
+            ),
+            source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+        });
+    }
+    if !result.has_refclock {
+        result.warnings.push(UnixWarning {
+            r#type: "no_ptp_refclock".to_string(),
+            severity: "warning".to_string(),
+            message: "Chrony is not configured with a PTP refclock.".to_string(),
+            recommendation: Some(
+                "Add refclock PHC /dev/ptp_hyperv poll 3 dpoll -2 offset 0".to_string(),
+            ),
+            documentation_url: Some(
+                "https://learn.microsoft.com/en-us/azure/virtual-machines/linux/time-sync#chrony"
+                    .to_string(),
+            ),
+            source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+        });
+    }
+    result.has_warnings = !result.warnings.is_empty();
+    result
+}
+
+pub fn parse_rhui_config(content: &str, source_path: &str) -> RhuiConfigResult {
+    let mut repos = Vec::new();
+    let mut current: Option<RepoEntry> = None;
+    for line in content.lines() {
+        let trimmed = line.trim();
+        if trimmed.is_empty() || trimmed.starts_with('#') {
+            continue;
+        }
+        if let Some(c) = crate::cached_regex!(r"^\[([^\]]+)\]$").captures(trimmed) {
+            if let Some(repo) = current.take() {
+                repos.push(repo);
+            }
+            let name = c[1].to_string();
+            current = Some(RepoEntry {
+                enabled: true,
+                is_microsoft: crate::cached_regex!(r"(?i)^(rhui-)?microsoft").is_match(&name),
+                is_eus: crate::cached_regex!(r"(?i)-(eus|e4s)-").is_match(&name),
+                name,
+                baseurl: None,
+                source_path: String::new(),
+                source_line: None,
+                source_line_end: None,
+            });
+            continue;
+        }
+        if let Some(repo) = &mut current {
+            if let Some(c) = crate::cached_regex!(r"^enabled\s*=\s*(\d+)").captures(trimmed) {
+                repo.enabled = &c[1] == "1";
+            }
+            if let Some(c) = crate::cached_regex!(r"^baseurl\s*=\s*(.+)$").captures(trimmed) {
+                repo.baseurl = Some(c[1].trim().to_string());
+            }
+        }
+    }
+    if let Some(repo) = current.take() {
+        repos.push(repo);
+    }
+    let has_eus_repos = repos.iter().any(|r| r.is_eus && r.enabled);
+    let has_microsoft_repo = repos.iter().any(|r| r.is_microsoft && r.enabled);
+    let mut warnings = Vec::new();
+    if repos.iter().any(|r| r.is_microsoft) && !has_microsoft_repo {
+        warnings.push(UnixWarning {
+            r#type: "rhui_repo_disabled".to_string(),
+            severity: "warning".to_string(),
+            message: "Microsoft RHUI repository is installed but not enabled.".to_string(),
+            recommendation: Some(
+                "Enable the repository with yum-config-manager --enable <repo-name>".to_string(),
+            ),
+            documentation_url: Some(
+                "https://learn.microsoft.com/azure/virtual-machines/workloads/redhat/redhat-rhui"
+                    .to_string(),
+            ),
+            source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+        });
+    }
+    RhuiConfigResult {
+        found: !repos.is_empty(),
+        repos,
+        has_eus_repos,
+        has_microsoft_repo,
+        warnings,
+        recommendations: Vec::new(),
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_eus_version_lock(content: &str, source_path: &str) -> EusVersionLockResult {
+    let trimmed = content.trim();
+    let releasever = crate::cached_regex!(r"^(\d+(?:\.\d+)?)")
+        .captures(trimmed)
+        .and_then(|c| c.get(1).map(|m| m.as_str().to_string()));
+    EusVersionLockResult {
+        found: releasever.is_some(),
+        has_releasever_file: releasever.is_some(),
+        releasever,
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_rhel_rhui_check(content: &str, source_path: &str) -> RhelRhuiCheckResult {
+    let mut pkgs = Vec::new();
+    let mut is_eus = false;
+    let mut is_sap = false;
+    for line in content.lines() {
+        let trimmed = line.trim();
+        if let Some(c) = crate::cached_regex!(r"^(rhui-[a-zA-Z0-9\-.]+)").captures(trimmed) {
+            let pkg = c[1].to_string();
+            if crate::cached_regex!(r"(?i)-eus-|-e4s-").is_match(&pkg) {
+                is_eus = true;
+            }
+            if crate::cached_regex!(r"(?i)-sap-").is_match(&pkg) {
+                is_sap = true;
+            }
+            pkgs.push(pkg);
+        }
+    }
+    let rhui_type = if is_sap && is_eus {
+        Some("SAP-EUS".to_string())
+    } else if is_sap {
+        Some("SAP".to_string())
+    } else if is_eus {
+        Some("EUS".to_string())
+    } else if !pkgs.is_empty() {
+        Some("Standard".to_string())
+    } else {
+        None
+    };
+    let mut warnings = Vec::new();
+    if pkgs.is_empty() {
+        warnings.push(UnixWarning {
+            r#type: "rhui_package_missing".to_string(),
+            severity: "warning".to_string(),
+            message: "No RHUI package found. RHEL VMs on Azure require RHUI packages for updates.".to_string(),
+            recommendation: Some("Install the appropriate RHUI package for your subscription type.".to_string()),
+            documentation_url: Some("https://learn.microsoft.com/troubleshoot/azure/virtual-machines/troubleshoot-linux-rhui-certificate-issues#cause-3-rhui-package-is-missing".to_string()),
+                    source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+});
+    }
+    RhelRhuiCheckResult {
+        found: !pkgs.is_empty(),
+        rhui_packages: pkgs.clone(),
+        has_rhui_package: !pkgs.is_empty(),
+        rhui_type,
+        is_eus,
+        is_sap,
+        warnings,
+        recommendations: Vec::new(),
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_crypto_policies(content: &str, source_path: &str) -> CryptoPoliciesResult {
+    let policy = content
+        .lines()
+        .next()
+        .map(|l| l.trim().to_string())
+        .filter(|s| !s.is_empty());
+    let is_default = policy
+        .as_deref()
+        .map(|p| p == "DEFAULT" || p == "DEFAULT:SHA1")
+        .unwrap_or(true);
+    let mut warnings = Vec::new();
+    if let Some(pol) = &policy {
+        if !is_default {
+            warnings.push(UnixWarning {
+                r#type: "crypto_policy_non_default".to_string(),
+                severity: "warning".to_string(),
+                message: format!("Crypto policy is set to '{}' instead of 'DEFAULT'.", pol),
+                recommendation: Some("Set crypto policy to DEFAULT using update-crypto-policies --set DEFAULT".to_string()),
+                documentation_url: Some("https://learn.microsoft.com/troubleshoot/azure/virtual-machines/linux/troubleshoot-linux-rhui-certificate-issues#cause-5-verification-error-in-rhel-version-8-or-9-ca-certificate-key-too-weak".to_string()),
+                            source_path: String::new(),
+                source_line: None,
+                source_line_end: None,
+});
+        }
+    }
+    CryptoPoliciesResult {
+        found: policy.is_some(),
+        policy,
+        is_default,
+        warnings,
+        recommendations: Vec::new(),
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_fips_mode_setup(content: &str, source_path: &str) -> FipsModeSetupResult {
+    let trimmed = content.trim();
+    let found = !trimmed.is_empty();
+    let fips_enabled = crate::cached_regex!(r"(?i)FIPS mode is enabled").is_match(trimmed);
+    let inconsistent_state = crate::cached_regex!(r"(?i)inconsistent.*state").is_match(trimmed);
+    let mut warnings = Vec::new();
+    if inconsistent_state {
+        warnings.push(UnixWarning {
+            r#type: "fips_inconsistent_state".to_string(),
+            severity: "warning".to_string(),
+            message: "FIPS mode is in an inconsistent state.".to_string(),
+            recommendation: Some(
+                "Run fips-mode-setup --enable or --disable and reboot.".to_string(),
+            ),
+            documentation_url: Some(
+                "https://learn.microsoft.com/en-us/azure/virtual-machines/linux/fips-overview"
+                    .to_string(),
+            ),
+            source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+        });
+    }
+    FipsModeSetupResult {
+        found,
+        fips_enabled,
+        inconsistent_state,
+        raw_output: trimmed.chars().take(500).collect(),
+        warnings,
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_tuned_profile(content: &str, source_path: &str) -> TunedProfileResult {
+    let mut active_profile = None;
+    for line in content.lines() {
+        if let Some(c) =
+            crate::cached_regex!(r"(?i)Current active profile:\s*(.+?)\s*$").captures(line.trim())
+        {
+            let prof = c[1].trim().to_string();
+            if !prof.is_empty() {
+                active_profile = Some(prof);
+            }
+        }
+    }
+    let no_profile = crate::cached_regex!(r"(?i)No current active profile").is_match(content);
+    let found = active_profile.is_some() || no_profile;
+    let mut warnings = Vec::new();
+    let mut recommendations = Vec::new();
+    if found && active_profile.is_none() {
+        warnings.push(UnixWarning {
+            r#type: "tuned_no_active_profile".to_string(),
+            severity: "warning".to_string(),
+            message: "No tuned profile is currently active.".to_string(),
+            recommendation: Some(
+                "Activate a tuned profile (for SAP HANA on RHEL use 'sap-hana') with tuned-adm profile <name>."
+                    .to_string(),
+            ),
+            documentation_url: Some(
+                "https://launchpad.support.sap.com/#/notes/2777782".to_string(),
+            ),
+            source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+        });
+    } else if let Some(p) = &active_profile {
+        recommendations.push(UnixWarning {
+            r#type: "tuned_active_profile".to_string(),
+            severity: "info".to_string(),
+            message: format!("Active tuned profile is '{}'.", p),
+            recommendation: Some(
+                "For SAP HANA on RHEL the recommended tuned profile is 'sap-hana'.".to_string(),
+            ),
+            documentation_url: Some(
+                "https://launchpad.support.sap.com/#/notes/2777782".to_string(),
+            ),
+            source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+        });
+    }
+    TunedProfileResult {
+        found,
+        active_profile,
+        warnings,
+        recommendations,
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_selinux(content: &str, source_path: &str) -> SelinuxResult {
+    let mut config_mode = None;
+    let mut current_mode = None;
+    for line in content.lines() {
+        let trimmed = line.trim();
+        if let Some(c) = crate::cached_regex!(r"(?i)^\s*SELINUX=(\w+)").captures(trimmed) {
+            config_mode = Some(c[1].to_ascii_lowercase());
+        }
+        if let Some(c) = crate::cached_regex!(r"(?i)^Current mode:\s*(\w+)").captures(trimmed) {
+            current_mode = Some(c[1].to_ascii_lowercase());
+        }
+        if config_mode.is_none() {
+            if let Some(c) =
+                crate::cached_regex!(r"(?i)^Mode from config file:\s*(\w+)").captures(trimmed)
+            {
+                config_mode = Some(c[1].to_ascii_lowercase());
+            }
+        }
+    }
+    let found = config_mode.is_some() || current_mode.is_some();
+    let effective = current_mode.clone().or_else(|| config_mode.clone());
+    let mut warnings = Vec::new();
+    if effective.as_deref() == Some("enforcing") {
+        warnings.push(UnixWarning {
+            r#type: "selinux_enforcing".to_string(),
+            severity: "warning".to_string(),
+            message: "SELinux is in enforcing mode.".to_string(),
+            recommendation: Some(
+                "SAP recommends SELinux in Permissive mode on database hosts (SAP Note 2936683)."
+                    .to_string(),
+            ),
+            documentation_url: Some(
+                "https://launchpad.support.sap.com/#/notes/2936683".to_string(),
+            ),
+            source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+        });
+    }
+    SelinuxResult {
+        found,
+        config_mode,
+        current_mode,
+        warnings,
+        recommendations: Vec::new(),
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_swap_space(content: &str, source_path: &str) -> SwapSpaceResult {
+    let mut swap_total_kb = -1i64;
+    let mut swap_free_kb = -1i64;
+    for line in content.lines() {
+        let trimmed = line.trim();
+        if let Some(c) = crate::cached_regex!(r"^SwapTotal:\s+(\d+)\s+kB").captures(trimmed) {
+            swap_total_kb = c[1].parse::<i64>().unwrap_or(0);
+        }
+        if let Some(c) = crate::cached_regex!(r"^SwapFree:\s+(\d+)\s+kB").captures(trimmed) {
+            swap_free_kb = c[1].parse::<i64>().unwrap_or(0);
+        }
+    }
+    let found = swap_total_kb >= 0;
+    let mut warnings = Vec::new();
+    if found && swap_total_kb == 0 {
+        warnings.push(UnixWarning {
+            r#type: "no_swap_configured".to_string(),
+            severity: "warning".to_string(),
+            message: "No swap space is configured (SwapTotal is 0).".to_string(),
+            recommendation: Some(
+                "Configure swap space per SAP guidance (SAP Note 1999997 recommends at least 2 GB for SAP hosts)."
+                    .to_string(),
+            ),
+            documentation_url: Some(
+                "https://launchpad.support.sap.com/#/notes/1999997".to_string(),
+            ),
+            source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+        });
+    }
+    SwapSpaceResult {
+        found,
+        swap_total_kb,
+        swap_free_kb,
+        warnings,
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_kernel_cmdline(content: &str, source_path: &str) -> KernelCmdlineResult {
+    let cmdline = content.trim().lines().next().unwrap_or("").to_string();
+    let mut result = KernelCmdlineResult {
+        found: !cmdline.is_empty(),
+        fips_enabled: false,
+        crashkernel: None,
+        root_device: None,
+        raw_cmdline: cmdline.clone(),
+        warnings: Vec::new(),
+        source_path: source_path.to_string(),
+    };
+    for p in cmdline.split_whitespace() {
+        if p == "fips=1" {
+            result.fips_enabled = true;
+        }
+        if let Some(v) = p.strip_prefix("crashkernel=") {
+            result.crashkernel = Some(v.to_string());
+        }
+        if let Some(v) = p.strip_prefix("root=") {
+            result.root_device = Some(v.to_string());
+        }
+    }
+    result
+}
+
+pub fn parse_rhui_errors(content: &str, source_path: &str) -> RhuiErrorsResult {
+    let mut result = RhuiErrorsResult {
+        found: false,
+        has_cert_expiration: false,
+        has_http403: false,
+        has_http400: false,
+        has_connection_error: false,
+        errors: Vec::new(),
+        affected_repos: Vec::new(),
+        warnings: Vec::new(),
+        recommendations: Vec::new(),
+        source_path: source_path.to_string(),
+    };
+
+    for (idx, line) in content.lines().enumerate() {
+        let trimmed = line.trim();
+        if crate::cached_regex!(r"(?i)SSL certificate problem.*expired|certificate has expired|CERTIFICATE_VERIFY_FAILED|certificate verify failed|unable to get local issuer certificate")
+            .is_match(trimmed)
+        {
+            result.found = true;
+            result.has_cert_expiration = true;
+            result.errors.push(ErrorItem {
+                r#type: "certificate_expired".to_string(),
+                line: idx + 1,
+                message: "RHUI client certificate has expired or cannot be verified".to_string(),
+                sample: trimmed.chars().take(200).collect(),
+                repo: None,
+                eus_version: None,
+                            source_path: String::new(),
+                source_line: None,
+                source_line_end: None,
+});
+        }
+        if crate::cached_regex!(r"Status code: 403 .*microsoft\.com").is_match(trimmed) {
+            result.found = true;
+            result.has_http403 = true;
+            result.errors.push(ErrorItem {
+                r#type: "http_403".to_string(),
+                line: idx + 1,
+                message: "HTTP 403 from RHUI servers".to_string(),
+                sample: trimmed.chars().take(200).collect(),
+                repo: None,
+                eus_version: None,
+                source_path: String::new(),
+                source_line: None,
+                source_line_end: None,
+            });
+        }
+        if let Some(c) = crate::cached_regex!(r"Status code: 400 .*?/eus/rhel\d+/rhui/(\d+\.\d+)/")
+            .captures(trimmed)
+        {
+            result.found = true;
+            result.has_http400 = true;
+            result.errors.push(ErrorItem {
+                r#type: "http_400".to_string(),
+                line: idx + 1,
+                message: format!(
+                    "HTTP 400 Bad Request - EUS version {} may be unavailable",
+                    &c[1]
+                ),
+                sample: trimmed.chars().take(200).collect(),
+                repo: None,
+                eus_version: Some(c[1].to_string()),
+                source_path: String::new(),
+                source_line: None,
+                source_line_end: None,
+            });
+        }
+        if crate::cached_regex!(r"(?i)Curl error \(28\)|Curl error \(7\)|Could not resolve host|Connection timed out|Connection refused|Curl error \(6\)")
+            .is_match(trimmed)
+            && crate::cached_regex!(r"(?i)rhui|microsoft").is_match(trimmed)
+        {
+            result.found = true;
+            result.has_connection_error = true;
+            result.errors.push(ErrorItem {
+                r#type: "connection_error".to_string(),
+                line: idx + 1,
+                message: "Network connectivity issue to RHUI servers".to_string(),
+                sample: trimmed.chars().take(200).collect(),
+                repo: None,
+                eus_version: None,
+                            source_path: String::new(),
+                source_line: None,
+                source_line_end: None,
+});
+        }
+        if let Some(c) =
+            crate::cached_regex!(r#"Failed to download metadata for repo[:\s]+['\"]?([^'\":\s]+)"#)
+                .captures(trimmed)
+        {
+            let repo = c[1].to_string();
+            if !result.affected_repos.contains(&repo) {
+                result.affected_repos.push(repo);
+            }
+            result.found = true;
+        }
+    }
+    if result.has_cert_expiration || result.has_http403 {
+        result.warnings.push(UnixWarning {
+            r#type: "rhui_cert_expired".to_string(),
+            severity: "warning".to_string(),
+            message: "RHUI client certificate appears to be expired or invalid".to_string(),
+            recommendation: Some("Reinstall the RHUI package to renew certificates.".to_string()),
+            documentation_url: Some("https://learn.microsoft.com/troubleshoot/azure/virtual-machines/linux/troubleshoot-linux-rhui-certificate-issues".to_string()),
+                    source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+});
+    }
+    if result.has_http400 {
+        result.warnings.push(UnixWarning {
+            r#type: "eus_version_unavailable".to_string(),
+            severity: "warning".to_string(),
+            message: "HTTP 400 errors from RHUI indicate an unavailable EUS version or config issue.".to_string(),
+            recommendation: Some("Update the releasever lock or switch to a supported RHUI repo set.".to_string()),
+            documentation_url: Some("https://learn.microsoft.com/azure/virtual-machines/workloads/redhat/redhat-rhui#rhel-eus-and-version-locking-rhel-vms".to_string()),
+                    source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+});
+    }
+    if result.has_connection_error {
+        result.warnings.push(UnixWarning {
+            r#type: "rhui_connectivity".to_string(),
+            severity: "warning".to_string(),
+            message: "Network connectivity issues to RHUI servers detected".to_string(),
+            recommendation: Some("Check NSG rules, DNS, and outbound connectivity to rhui-*.microsoft.com on port 443.".to_string()),
+            documentation_url: Some("https://learn.microsoft.com/azure/virtual-machines/workloads/redhat/redhat-rhui#troubleshoot-connection-problems-to-azure-rhui".to_string()),
+                    source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+});
+    }
+    result
+}
+
+pub fn parse_leapp_report(content: &str, source_path: &str) -> LeappReportResult {
+    let mut result = LeappReportResult {
+        found: false,
+        has_errors: false,
+        has_high_risk: false,
+        has_medium_risk: false,
+        upgrade_blocked: false,
+        total_issues: 0,
+        error_count: 0,
+        high_risk_count: 0,
+        medium_risk_count: 0,
+        low_risk_count: 0,
+        info_count: 0,
+        issues: Vec::new(),
+        third_party_packages: Vec::new(),
+        warnings: Vec::new(),
+        recommendations: Vec::new(),
+        source_path: source_path.to_string(),
+    };
+
+    let entries = crate::cached_regex!(r"(?m)^-{30,}$")
+        .split(content)
+        .filter(|e| !e.trim().is_empty())
+        .collect::<Vec<_>>();
+
+    for entry in entries {
+        let mut risk_factor = None;
+        let mut is_error = false;
+        let mut title = None;
+        let mut summary = String::new();
+        let mut remediation = None;
+        let mut key = None;
+        let mut current = None::<&str>;
+        for line in entry.lines() {
+            if let Some(c) =
+                crate::cached_regex!(r"^Risk Factor:\s*(\w+)(?:\s*\(error\))?").captures(line)
+            {
+                risk_factor = Some(c[1].to_ascii_lowercase());
+                is_error = line.to_ascii_lowercase().contains("(error)");
+                current = None;
+                continue;
+            }
+            if let Some(c) = crate::cached_regex!(r"^Title:\s*(.+)$").captures(line) {
+                title = Some(c[1].trim().to_string());
+                current = None;
+                continue;
+            }
+            if let Some(c) = crate::cached_regex!(r"^Summary:\s*(.*)$").captures(line) {
+                summary = c[1].to_string();
+                current = Some("summary");
+                continue;
+            }
+            if let Some(c) = crate::cached_regex!(r"^Remediation:\s*(.*)$").captures(line) {
+                remediation = Some(c[1].to_string());
+                current = Some("remediation");
+                continue;
+            }
+            if let Some(c) = crate::cached_regex!(r"^Key:\s*(\w+)").captures(line) {
+                key = Some(c[1].to_string());
+                current = None;
+                continue;
+            }
+            if line.trim().starts_with("Related links:") {
+                current = None;
+                continue;
+            }
+            if let Some(field) = current {
+                if !line.trim().is_empty() {
+                    if field == "summary" {
+                        summary.push(' ');
+                        summary.push_str(line.trim());
+                    } else if field == "remediation" {
+                        remediation = Some(
+                            format!("{} {}", remediation.unwrap_or_default(), line.trim())
+                                .trim()
+                                .to_string(),
+                        );
+                    }
+                }
+            }
+        }
+        let Some(title) = title else {
+            continue;
+        };
+        result.found = true;
+        result.total_issues += 1;
+        let issue = LeappIssue {
+            risk_factor: risk_factor.clone(),
+            is_error,
+            title: title.clone(),
+            summary: summary.trim().to_string(),
+            remediation,
+            key,
+            source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+        };
+        if is_error {
+            result.error_count += 1;
+            result.has_errors = true;
+            result.upgrade_blocked = true;
+        } else if risk_factor.as_deref() == Some("high") {
+            result.high_risk_count += 1;
+            result.has_high_risk = true;
+        } else if risk_factor.as_deref() == Some("medium") {
+            result.medium_risk_count += 1;
+            result.has_medium_risk = true;
+        } else if risk_factor.as_deref() == Some("low") {
+            result.low_risk_count += 1;
+        } else if risk_factor.as_deref() == Some("info") {
+            result.info_count += 1;
+        }
+        if title.contains("not signed by the distribution vendor") {
+            for pkg in crate::cached_regex!(r"-\s*(\S+)")
+                .captures_iter(&summary)
+                .filter_map(|c| c.get(1).map(|m| m.as_str().to_string()))
+            {
+                result.third_party_packages.push(pkg);
+            }
+        }
+        result.issues.push(issue);
+    }
+
+    if result.upgrade_blocked {
+        result.warnings.push(UnixWarning {
+            r#type: "leapp_upgrade_blocked".to_string(),
+            severity: "error".to_string(),
+            message: format!("Leapp detected {} error(s) that will block the upgrade", result.error_count),
+            recommendation: Some("Resolve all reported errors before attempting the upgrade.".to_string()),
+            documentation_url: Some("https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/upgrading_from_rhel_8_to_rhel_9/index".to_string()),
+                    source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+});
+    }
+    if result.has_high_risk && !result.upgrade_blocked {
+        result.warnings.push(UnixWarning {
+            r#type: "leapp_high_risk".to_string(),
+            severity: "warning".to_string(),
+            message: format!(
+                "Leapp detected {} high-risk warning(s)",
+                result.high_risk_count
+            ),
+            recommendation: Some("Review all high-risk items before the upgrade.".to_string()),
+            documentation_url: None,
+            source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+        });
+    }
+    if !result.third_party_packages.is_empty() {
+        result.warnings.push(UnixWarning {
+            r#type: "leapp_third_party".to_string(),
+            severity: "warning".to_string(),
+            message: format!("{} third-party packages detected that may need manual handling", result.third_party_packages.len()),
+            recommendation: Some("Consider removing third-party packages before the upgrade and reinstalling afterward.".to_string()),
+            documentation_url: None,
+                    source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+});
+    }
+    result
+}
+
+pub fn parse_leapp_log(content: &str, source_path: &str) -> LeappLogResult {
+    let mut result = LeappLogResult {
+        found: false,
+        has_errors: false,
+        has_curl_errors: false,
+        has_dns_errors: false,
+        has_rhui_errors: false,
+        error_count: 0,
+        warning_count: 0,
+        critical_count: 0,
+        errors: Vec::new(),
+        warnings: Vec::new(),
+        recommendations: Vec::new(),
+        source_path: source_path.to_string(),
+    };
+    for (idx, line) in content.lines().enumerate() {
+        let trimmed = line.trim();
+        let lower = trimmed.to_ascii_lowercase();
+        if lower.contains(" curl error (") {
+            result.found = true;
+            result.has_errors = true;
+            result.has_curl_errors = true;
+            result.error_count += 1;
+            if lower.contains("resolve host") {
+                result.has_dns_errors = true;
+            }
+            if lower.contains("rhui") || lower.contains("microsoft") {
+                result.has_rhui_errors = true;
+            }
+            result.errors.push(ErrorItem {
+                r#type: "curl_error".to_string(),
+                line: idx + 1,
+                message: "Curl error detected in Leapp log".to_string(),
+                sample: trimmed.chars().take(400).collect(),
+                repo: None,
+                eus_version: None,
+                source_path: String::new(),
+                source_line: None,
+                source_line_end: None,
+            });
+        }
+        if crate::cached_regex!(r"^\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}[.\d]*\s+ERROR\s+")
+            .is_match(trimmed)
+        {
+            result.found = true;
+            result.has_errors = true;
+            result.error_count += 1;
+        }
+        if crate::cached_regex!(r"^\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}[.\d]*\s+CRITICAL\s+")
+            .is_match(trimmed)
+        {
+            result.found = true;
+            result.critical_count += 1;
+        }
+        if lower.contains("warning") {
+            result.warning_count += 1;
+        }
+    }
+    if result.has_dns_errors {
+        result.warnings.push(UnixWarning {
+            r#type: "leapp_dns_error".to_string(),
+            severity: "warning".to_string(),
+            message: "DNS resolution issues were detected during the Leapp workflow.".to_string(),
+            recommendation: Some(
+                "Verify RHUI and general outbound DNS resolution before re-running Leapp."
+                    .to_string(),
+            ),
+            documentation_url: None,
+            source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+        });
+    }
+    if result.has_rhui_errors {
+        result.warnings.push(UnixWarning {
+            r#type: "leapp_rhui_error".to_string(),
+            severity: "warning".to_string(),
+            message: "RHUI-related errors were detected in the Leapp log.".to_string(),
+            recommendation: Some(
+                "Check RHUI configuration, certificates, and connectivity.".to_string(),
+            ),
+            documentation_url: None,
+            source_path: String::new(),
+            source_line: None,
+            source_line_end: None,
+        });
+    }
+    result
+}
+
+macro_rules! json_wrap {
+    ($name:ident, $func:ident) => {
+        pub fn $name(content: &str, source_path: &str) -> String {
+            let result = $func(content, source_path);
+            let mut value = match serde_json::to_value(&result) {
+                Ok(v) => v,
+                Err(_) => return "{}".to_string(),
+            };
+            crate::parsers::fill_source_path(&mut value, source_path);
+            serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+        }
+    };
+}
+
+json_wrap!(parse_basic_environment_json, parse_basic_environment);
+json_wrap!(parse_os_release_json, parse_os_release);
+json_wrap!(parse_fstab_json, parse_fstab);
+json_wrap!(parse_inspect_disk_results_json, parse_inspect_disk_results);
+json_wrap!(parse_kernel_tuning_json, parse_kernel_tuning);
+json_wrap!(parse_huge_pages_json, parse_huge_pages);
+json_wrap!(parse_time_sync_json, parse_time_sync);
+json_wrap!(parse_ptp_clock_source_json, parse_ptp_clock_source);
+json_wrap!(parse_time_sync_service_json, parse_time_sync_service);
+json_wrap!(parse_timedatectl_json, parse_timedatectl);
+json_wrap!(parse_ptp_device_json, parse_ptp_device);
+json_wrap!(parse_chrony_tracking_json, parse_chrony_tracking);
+json_wrap!(parse_chrony_makestep_json, parse_chrony_makestep);
+json_wrap!(parse_rhui_config_json, parse_rhui_config);
+json_wrap!(parse_eus_version_lock_json, parse_eus_version_lock);
+json_wrap!(parse_rhel_rhui_check_json, parse_rhel_rhui_check);
+json_wrap!(parse_crypto_policies_json, parse_crypto_policies);
+json_wrap!(parse_fips_mode_setup_json, parse_fips_mode_setup);
+json_wrap!(parse_tuned_profile_json, parse_tuned_profile);
+json_wrap!(parse_selinux_json, parse_selinux);
+json_wrap!(parse_swap_space_json, parse_swap_space);
+json_wrap!(parse_kernel_cmdline_json, parse_kernel_cmdline);
+json_wrap!(parse_rhui_errors_json, parse_rhui_errors);
+json_wrap!(parse_leapp_report_json, parse_leapp_report);
+json_wrap!(parse_leapp_log_json, parse_leapp_log);
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parses_os_release_and_eol_warning() {
+        let input = "NAME=\"CentOS Linux\"\nVERSION_ID=\"7.9\"\nPRETTY_NAME=\"CentOS Linux 7\"\n";
+        let result = parse_os_release(input, "");
+        assert!(result.found);
+        assert!(result.is_eol);
+    }
+
+    #[test]
+    fn parses_kernel_tuning_and_fips() {
+        let input = concat!(
+            "vm.swappiness = 60\n",
+            "net.ipv4.tcp_congestion_control = cubic\n",
+            "crypto.fips_enabled = 1\n"
+        );
+        let result = parse_kernel_tuning(input, "");
+        assert!(result.found);
+        assert!(result.fips_enabled);
+        assert!(!result.warnings.is_empty());
+    }
+
+    #[test]
+    fn parses_tuned_profile() {
+        let active = parse_tuned_profile("Current active profile: sap-hana\n", "");
+        assert!(active.found);
+        assert_eq!(active.active_profile.as_deref(), Some("sap-hana"));
+        assert!(active.warnings.is_empty());
+        assert!(!active.recommendations.is_empty());
+
+        let none = parse_tuned_profile("No current active profile.\n", "");
+        assert!(none.found);
+        assert!(none.active_profile.is_none());
+        assert!(!none.warnings.is_empty());
+    }
+
+    #[test]
+    fn parses_selinux_modes() {
+        let enforcing = parse_selinux("SELINUX=enforcing\nSELINUXTYPE=targeted\n", "");
+        assert!(enforcing.found);
+        assert_eq!(enforcing.config_mode.as_deref(), Some("enforcing"));
+        assert!(!enforcing.warnings.is_empty());
+
+        let sestatus = parse_selinux(
+            "SELinux status: enabled\nCurrent mode: permissive\nMode from config file: enforcing\n",
+            "",
+        );
+        assert_eq!(sestatus.current_mode.as_deref(), Some("permissive"));
+        // Effective (current) mode is permissive, so no warning.
+        assert!(sestatus.warnings.is_empty());
+    }
+
+    #[test]
+    fn parses_swap_space() {
+        let with_swap = parse_swap_space("MemTotal:       16evil\nSwapTotal:       2097152 kB\nSwapFree:        2097152 kB\n", "");
+        assert!(with_swap.found);
+        assert_eq!(with_swap.swap_total_kb, 2097152);
+        assert!(with_swap.warnings.is_empty());
+
+        let no_swap = parse_swap_space("SwapTotal:             0 kB\nSwapFree:              0 kB\n", "");
+        assert!(no_swap.found);
+        assert_eq!(no_swap.swap_total_kb, 0);
+        assert!(!no_swap.warnings.is_empty());
+    }
+
+    #[test]
+    fn parses_timedatectl_and_chrony() {        let timed = parse_timedatectl(
+            "System clock synchronized: yes\nNTP service: active\nTime zone: UTC\n",
+            "",
+        );
+        let chrony = parse_chrony_tracking("Reference ID    : 50484330 (PHC0)\nLast offset     : +0.000000718 seconds\nLeap status     : Normal\n", "");
+        assert!(timed.found);
+        assert!(timed.ntp_enabled);
+        assert!(chrony.is_ptp_source);
+    }
+
+    #[test]
+    fn parses_rhui_and_leapp() {
+        let rhui = parse_rhel_rhui_check("rhui-microsoft-azure-rhel8-1.0-1\n", "");
+        let leapp = parse_leapp_report("Risk Factor: high\nTitle: Test issue\nSummary: Something important\n----------------------------------------\n", "");
+        assert!(rhui.found);
+        assert!(leapp.found);
+        assert_eq!(leapp.total_issues, 1);
+    }
+
+    #[test]
+    fn os_release_carries_source_path() {
+        let input = "NAME=\"Red Hat Enterprise Linux\"\nVERSION_ID=\"7.9\"\n";
+        let result = parse_os_release(input, "etc/os-release");
+        assert_eq!(result.source_path, "etc/os-release");
+        // EOL warning gets the source_path stamped via the json wrapper.
+        let json = parse_os_release_json(input, "etc/os-release");
+        assert!(json.contains("\"source_path\":\"etc/os-release\""));
+        // The warning object inside is also stamped (from the wrapper post-pass).
+        let v: serde_json::Value = serde_json::from_str(&json).unwrap();
+        let warnings = v["warnings"].as_array().expect("warnings array");
+        assert!(!warnings.is_empty());
+        assert_eq!(warnings[0]["source_path"], "etc/os-release");
+    }
+
+    #[test]
+    fn rhui_config_carries_source_path() {
+        let input = "[rhui-microsoft-azure-rhel8]\nname=Microsoft Azure RHUI\nenabled=1\n";
+        let json = parse_rhui_config_json(input, "etc/yum.repos.d/rh-cloud.repo");
+        let v: serde_json::Value = serde_json::from_str(&json).unwrap();
+        assert_eq!(v["source_path"], "etc/yum.repos.d/rh-cloud.repo");
+        let repos = v["repos"].as_array().expect("repos array");
+        if !repos.is_empty() {
+            assert_eq!(repos[0]["source_path"], "etc/yum.repos.d/rh-cloud.repo");
+        }
+    }
+}
diff --git a/rca-tool/lib/supportfile_core/src/parsers/vmcore.rs b/rca-tool/lib/supportfile_core/src/parsers/vmcore.rs
new file mode 100644
index 0000000..7179ea0
--- /dev/null
+++ b/rca-tool/lib/supportfile_core/src/parsers/vmcore.rs
@@ -0,0 +1,333 @@
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct VmcoreCrash {
+    pub date: Option<String>,
+    pub panic_reason: Option<String>,
+    pub kernel_version: Option<String>,
+    pub call_trace: Vec<String>,
+    pub hardware: Option<String>,
+    pub comm: Option<String>,
+    pub pid: Option<i32>,
+    pub cpu: Option<i32>,
+    pub tainted: Option<String>,
+    pub source_path: String,
+    pub panic_line: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct KdumpStatus {
+    pub raw: String,
+    pub operational: bool,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct CrashListingEntry {
+    pub directory: String,
+    pub crash_date: Option<String>,
+    pub size_bytes: i64,
+    pub size_mb: i64,
+    pub size_gb: String,
+    pub source_path: String,
+    pub source_line: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct CrashListing {
+    pub entries: Vec<CrashListingEntry>,
+    pub count: usize,
+    pub total_bytes: i64,
+    pub total_gb: String,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct KdumpConf {
+    pub path: String,
+    pub core_collector: Option<String>,
+    pub default_action: Option<String>,
+    pub raw: String,
+    pub source_path: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct VmcoreSummary {
+    pub found: bool,
+    pub crash: Option<VmcoreCrash>,
+    pub kdump_status: Option<KdumpStatus>,
+    pub crash_listing: Option<CrashListing>,
+    pub kdump_conf: Option<KdumpConf>,
+    pub source_path: String,
+}
+
+pub fn parse_vmcore_dmesg(content: &str, source_path: &str) -> VmcoreCrash {
+    let mut crash = VmcoreCrash {
+        date: None,
+        panic_reason: None,
+        kernel_version: None,
+        call_trace: Vec::new(),
+        hardware: None,
+        comm: None,
+        pid: None,
+        cpu: None,
+        tainted: None,
+        source_path: source_path.to_string(),
+        panic_line: None,
+    };
+
+    // The crash date is encoded in the dump directory path, e.g.
+    // `var/crash/127.0.0.1-2026-01-20-15:30:00/vmcore-dmesg.txt`. Use the same
+    // pattern as the crash-listing parser so the two correlate by date.
+    crash.date = crate::cached_regex!(r"(\d{4}-\d{2}-\d{2}[:-]\d{2}[:-]\d{2}[:-]\d{2})")
+        .captures(source_path)
+        .and_then(|m| m.get(1).map(|x| x.as_str().to_string()));
+
+    let mut in_call_trace = false;
+    for (line_idx, line) in content.lines().enumerate() {
+        let line_no = line_idx + 1;
+        if let Some(c) = crate::cached_regex!(r"Kernel panic - not syncing:\s*(.+)").captures(line)
+        {
+            crash.panic_reason = Some(c[1].trim().to_string());
+            crash.panic_line = Some(line_no);
+            in_call_trace = false;
+            crash.call_trace.clear();
+        }
+        if let Some(c) = crate::cached_regex!(r"Hardware name:\s*(.+)").captures(line) {
+            crash.hardware = Some(c[1].trim().replace(", BIOS", ""));
+        }
+        if let Some(c) = crate::cached_regex!(r"CPU:\s*(\d+)\s+PID:\s*(\d+)\s+Comm:\s*(\S+).*(Not tainted|Tainted:\s*\S*)\s+(\S+?)(?:\s+#\d+)?\s*$")
+            .captures(line)
+        {
+            crash.cpu = c[1].parse::<i32>().ok();
+            crash.pid = c[2].parse::<i32>().ok();
+            crash.comm = Some(c[3].to_string());
+            if !c[4].starts_with("Not") {
+                crash.tainted = Some(c[4].to_string());
+            }
+            crash.kernel_version = Some(c[5].to_string());
+        }
+        if line.contains("Call Trace:") {
+            in_call_trace = true;
+            continue;
+        }
+        if in_call_trace {
+            let frame = line.trim();
+            if frame.is_empty() || frame.starts_with("Kernel Offset") || frame.starts_with("---[") {
+                in_call_trace = false;
+            } else {
+                crash.call_trace.push(frame.to_string());
+            }
+        }
+    }
+
+    crash
+}
+
+pub fn parse_kdump_status(content: &str, source_path: &str) -> Option<KdumpStatus> {
+    let trimmed = content.trim();
+    if trimmed.is_empty() {
+        return None;
+    }
+    Some(KdumpStatus {
+        raw: trimmed.to_string(),
+        operational: trimmed.to_ascii_lowercase().contains("operational")
+            && !trimmed.to_ascii_lowercase().contains("not operational"),
+        source_path: source_path.to_string(),
+    })
+}
+
+pub fn parse_crash_listing(content: &str, source_path: &str) -> Option<CrashListing> {
+    let mut entries = Vec::new();
+    let mut current_dir: Option<String> = None;
+
+    for (line_idx, line) in content.lines().enumerate() {
+        let line_no = line_idx + 1;
+        if let Some(c) = crate::cached_regex!(r"^(\/var\/crash\/.+):$").captures(line.trim()) {
+            current_dir = Some(c[1].to_string());
+            continue;
+        }
+        let Some(dir) = &current_dir else {
+            continue;
+        };
+        if dir == "/var/crash" {
+            continue;
+        }
+        if let Some(c) =
+            crate::cached_regex!(r"\s+(\d+)\s+\w+\s+\d+\s+[\d:]+\s+(vmcore)$").captures(line)
+        {
+            let size_bytes = c[1].parse::<i64>().unwrap_or(0);
+            let crash_date =
+                crate::cached_regex!(r"(\d{4}-\d{2}-\d{2}[:-]\d{2}[:-]\d{2}[:-]\d{2})")
+                    .captures(dir)
+                    .and_then(|m| m.get(1).map(|x| x.as_str().to_string()));
+            entries.push(CrashListingEntry {
+                directory: dir.clone(),
+                crash_date,
+                size_bytes,
+                size_mb: size_bytes / (1024 * 1024),
+                size_gb: format!("{:.1}", size_bytes as f64 / (1024.0 * 1024.0 * 1024.0)),
+                source_path: source_path.to_string(),
+                source_line: Some(line_no),
+            });
+        }
+    }
+
+    if entries.is_empty() {
+        return None;
+    }
+    let total_bytes = entries.iter().map(|e| e.size_bytes).sum::<i64>();
+    Some(CrashListing {
+        count: entries.len(),
+        entries,
+        total_bytes,
+        total_gb: format!("{:.1}", total_bytes as f64 / (1024.0 * 1024.0 * 1024.0)),
+        source_path: source_path.to_string(),
+    })
+}
+
+pub fn parse_kdump_conf(content: &str, source_path: &str) -> KdumpConf {
+    let mut conf = KdumpConf {
+        path: "/var/crash".to_string(),
+        core_collector: None,
+        default_action: None,
+        raw: content.trim().to_string(),
+        source_path: source_path.to_string(),
+    };
+    for line in content.lines() {
+        let trimmed = line.trim();
+        if trimmed.is_empty() || trimmed.starts_with('#') {
+            continue;
+        }
+        if let Some(c) = crate::cached_regex!(r"^path\s+(.+)$").captures(trimmed) {
+            conf.path = c[1].trim().to_string();
+        }
+        if let Some(c) = crate::cached_regex!(r"^core_collector\s+(.+)$").captures(trimmed) {
+            conf.core_collector = Some(c[1].trim().to_string());
+        }
+        if let Some(c) =
+            crate::cached_regex!(r"^(?:default|failure_action)\s+(.+)$").captures(trimmed)
+        {
+            conf.default_action = Some(c[1].trim().to_string());
+        }
+    }
+    conf
+}
+
+pub fn parse_vmcore_summary(content: &str, source_path: &str) -> VmcoreSummary {
+    VmcoreSummary {
+        found: !content.trim().is_empty(),
+        crash: if content.contains("Kernel panic - not syncing") || content.contains("Call Trace:")
+        {
+            Some(parse_vmcore_dmesg(content, source_path))
+        } else {
+            None
+        },
+        kdump_status: if content.to_ascii_lowercase().contains("kdump") {
+            parse_kdump_status(content, source_path)
+        } else {
+            None
+        },
+        crash_listing: if content.contains("/var/crash/") && content.contains("vmcore") {
+            parse_crash_listing(content, source_path)
+        } else {
+            None
+        },
+        kdump_conf: if content.contains("core_collector")
+            || content.contains("failure_action")
+            || content.contains("path ")
+        {
+            Some(parse_kdump_conf(content, source_path))
+        } else {
+            None
+        },
+        source_path: source_path.to_string(),
+    }
+}
+
+pub fn parse_vmcore_dmesg_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_vmcore_dmesg(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_kdump_status_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_kdump_status(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_crash_listing_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_crash_listing(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_kdump_conf_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_kdump_conf(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+pub fn parse_vmcore_summary_json(content: &str, source_path: &str) -> String {
+    let mut value = serde_json::to_value(parse_vmcore_summary(content, source_path))
+        .unwrap_or(serde_json::Value::Null);
+    crate::parsers::fill_source_path(&mut value, source_path);
+    serde_json::to_string(&value).unwrap_or_else(|_| "{}".to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parses_vmcore_panic_and_trace() {
+        let input = concat!(
+            "Kernel panic - not syncing: hung_task: blocked tasks\n",
+            "CPU: 2 PID: 71 Comm: khungtaskd Kdump: loaded Not tainted 4.18.0-test\n",
+            "Call Trace:\n",
+            " dump_stack+0x85/0xc2\n",
+            " panic+0x101/0x2e3\n"
+        );
+        let crash = parse_vmcore_dmesg(input, "var/crash/vmcore-dmesg.txt");
+        assert_eq!(crash.comm.as_deref(), Some("khungtaskd"));
+        assert_eq!(crash.call_trace.len(), 2);
+        assert_eq!(crash.source_path, "var/crash/vmcore-dmesg.txt");
+        assert_eq!(crash.panic_line, Some(1));
+    }
+
+    #[test]
+    fn crash_date_is_derived_from_dump_directory_path() {
+        let input = "Kernel panic - not syncing: Fatal exception in interrupt\n";
+        let dated = parse_vmcore_dmesg(
+            input,
+            "var/crash/127.0.0.1-2026-01-20-15:30:00/vmcore-dmesg.txt",
+        );
+        assert_eq!(dated.date.as_deref(), Some("2026-01-20-15:30:00"));
+
+        // No date in the directory path leaves the field empty.
+        let undated = parse_vmcore_dmesg(input, "var/crash/nodate-crash/vmcore-dmesg.txt");
+        assert_eq!(undated.date, None);
+    }
+
+    #[test]
+    fn parses_crash_listing_and_kdump_conf() {
+        let listing = "/var/crash/host-2026-02-13-03:48:00:\n-rw-------. 1 root root 1351110790 Feb 13 03:48 vmcore\n";
+        let parsed = parse_crash_listing(listing, "var/crash/listing.txt").unwrap();
+        assert_eq!(parsed.count, 1);
+        assert_eq!(parsed.source_path, "var/crash/listing.txt");
+        assert_eq!(parsed.entries[0].source_line, Some(2));
+
+        let conf = parse_kdump_conf(
+            "path /var/crash\ncore_collector makedumpfile -c\nfailure_action reboot\n",
+            "etc/kdump.conf",
+        );
+        assert_eq!(conf.path, "/var/crash");
+        assert_eq!(conf.default_action.as_deref(), Some("reboot"));
+        assert_eq!(conf.source_path, "etc/kdump.conf");
+    }
+}
diff --git a/rca-tool/lib/supportfile_mcp/Cargo.lock b/rca-tool/lib/supportfile_mcp/Cargo.lock
new file mode 100644
index 0000000..aafa4b5
--- /dev/null
+++ b/rca-tool/lib/supportfile_mcp/Cargo.lock
@@ -0,0 +1,765 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.102"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+
+[[package]]
+name = "async-trait"
+version = "0.1.89"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "bytes"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
+
+[[package]]
+name = "cc"
+version = "1.2.63"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "556e016178bb5662a08681bbe0f00f8e17631781a4dfc8c45e466e4b185ec27f"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "chrono"
+version = "0.4.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
+dependencies = [
+ "iana-time-zone",
+ "num-traits",
+ "serde",
+ "windows-link",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "darling"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0"
+dependencies = [
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "dyn-clone"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys",
+]
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "futures"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
+
+[[package]]
+name = "futures-task"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+
+[[package]]
+name = "futures-util"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "js-sys"
+version = "0.3.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2025f20d7a4fa7785846e7b63d10a76d3f1cee98ee5cb79ea59703f95e42162"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.186"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+
+[[package]]
+name = "log"
+version = "0.4.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "953f07c43838f8e6f9758cab68bf5bed85465e7587ebe0b823f1bcd81978ad3a"
+
+[[package]]
+name = "memchr"
+version = "2.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b947ae49db0d222b1dbc6b113ce7248a3fc3a6ca21b696717bfc000ba4484d8"
+
+[[package]]
+name = "mio"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02bd0af71c67b473010cbbc60715ee815645a4dc942899111f494b4b737d6fda"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "pastey"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ee67f1008b1ba2321834326597b8e186293b049a023cdef258527550b9935b4"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "ref-cast"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f354300ae66f76f1c85c5f84693f0ce81d747e2c3f21a45fef496d89c960bf7d"
+dependencies = [
+ "ref-cast-impl",
+]
+
+[[package]]
+name = "ref-cast-impl"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "rmcp"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0810a9f717d9828f475fe1f629f4c305c8464b7f496c3a854b58d29e65f4058e"
+dependencies = [
+ "async-trait",
+ "base64",
+ "chrono",
+ "futures",
+ "pastey",
+ "pin-project-lite",
+ "rmcp-macros",
+ "schemars",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "rmcp-macros"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6aefac48c364756e97f04c0401ba3231e8607882c7c1d92da0437dc16307904d"
+dependencies = [
+ "darling",
+ "proc-macro2",
+ "quote",
+ "serde_json",
+ "syn",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+
+[[package]]
+name = "schemars"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2b42f36aa1cd011945615b92222f6bf73c599a102a300334cd7f8dbeec726cc"
+dependencies = [
+ "chrono",
+ "dyn-clone",
+ "ref-cast",
+ "schemars_derive",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "schemars_derive"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d115b50f4aaeea07e79c1912f645c7513d81715d0420f8bc77a18c6260b307f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "serde_derive_internals",
+ "syn",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_derive_internals"
+version = "0.29.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18d26a20a969b9e3fdf2fc2d9f21eda6c40e2de84c9408bb5d3b05d499aae711"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.150"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "supportfile_mcp"
+version = "0.0.0"
+dependencies = [
+ "anyhow",
+ "rmcp",
+ "schemars",
+ "serde",
+ "serde_json",
+ "tokio",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tokio"
+version = "1.52.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "tokio-macros",
+ "windows-sys",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.123"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a254a4b10c19a76f09a27640e7ffbf9bc30bf67e16a3bf28aaefa4920fe81563"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.123"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24a40fc75b0ec6f3746ceb10d36f53a93dcd68a93b11b6445983945d79eba0dc"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.123"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "908f34bd9b9ce3d4caf07b72dfab63d61504d156856c6bd3cd87fa350cf3985b"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.123"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7acbf7616c27b194bbb550bf77ed0c2c3e5b7fd1260a93082b95fb7f47959b92"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
diff --git a/rca-tool/lib/supportfile_mcp/Cargo.toml b/rca-tool/lib/supportfile_mcp/Cargo.toml
new file mode 100644
index 0000000..4a2c347
--- /dev/null
+++ b/rca-tool/lib/supportfile_mcp/Cargo.toml
@@ -0,0 +1,21 @@
+[package]
+name = "supportfile_mcp"
+version = "0.0.0"
+edition = "2021"
+description = "MCP server exposing the rca_cli support-file analyzer as Model Context Protocol tools"
+license = "MIT"
+
+[[bin]]
+name = "supportfile_mcp"
+path = "src/main.rs"
+
+[dependencies]
+# Official Rust MCP SDK. `transport-io` provides the server-side stdio
+# transport; `macros` provides the #[tool]/#[tool_router]/#[tool_handler]
+# attribute macros; `schemars` enables JSON Schema generation for tool params.
+rmcp = { version = "1", features = ["server", "macros", "transport-io", "schemars"] }
+tokio = { version = "1", features = ["macros", "rt-multi-thread", "process", "io-std"] }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+schemars = "1"
+anyhow = "1"
diff --git a/rca-tool/lib/supportfile_mcp/src/main.rs b/rca-tool/lib/supportfile_mcp/src/main.rs
new file mode 100644
index 0000000..afe8cc8
--- /dev/null
+++ b/rca-tool/lib/supportfile_mcp/src/main.rs
@@ -0,0 +1,204 @@
+//! `supportfile_mcp` — a Model Context Protocol (MCP) server that exposes the
+//! rca-tool support-file analyzer to MCP clients (e.g. Agency / Copilot custom
+//! agents).
+//!
+//! Design (Direction B1): this server is a thin adapter that shells out to the
+//! pure-Rust `rca_cli` binary (built from `lib/supportfile_core` with the
+//! `cli` feature). It does not link the parser library directly, so the
+//! already-tested archive walk, parallel parser dispatch, and multi-file merge
+//! logic are reused as-is.
+//!
+//! Binary resolution: the `rca_cli` executable is located via the
+//! `RCA_CLI_BIN` environment variable, falling back to `rca_cli` on `PATH`.
+//!
+//! Tools exposed:
+//!   - `list_parsers`        -> `rca_cli --list-parsers` (parsed into JSON)
+//!   - `analyze_archive`     -> `rca_cli <path> --json [--parser NAME]`
+//!   - `summarize_findings`  -> `rca_cli <path> --json`, filtered to detectors
+//!                              that fired (found=true or count>0)
+
+use std::process::Stdio;
+
+use rmcp::{
+    handler::server::wrapper::Parameters,
+    model::{Implementation, ServerCapabilities, ServerInfo},
+    schemars, tool, tool_handler, tool_router,
+    transport::stdio,
+    ErrorData as McpError, ServerHandler, ServiceExt,
+};
+use serde::Deserialize;
+use serde_json::{Map, Value};
+use tokio::process::Command;
+
+const DEFAULT_BIN: &str = "rca_cli";
+
+/// Resolve the `rca_cli` binary path: `RCA_CLI_BIN` env var, else `rca_cli`.
+fn rca_cli_bin() -> String {
+    std::env::var("RCA_CLI_BIN").unwrap_or_else(|_| DEFAULT_BIN.to_string())
+}
+
+#[derive(Clone)]
+struct RcaServer;
+
+#[derive(Debug, Deserialize, schemars::JsonSchema)]
+struct AnalyzeParams {
+    /// Path to the support archive (.tar.xz / .tar.gz / .tar / .zip) or a bare
+    /// plaintext log file to analyze.
+    archive_path: String,
+    /// Optional: run only the parser with this name (see `list_parsers`).
+    #[serde(default)]
+    parser: Option<String>,
+}
+
+#[derive(Debug, Deserialize, schemars::JsonSchema)]
+struct SummarizeParams {
+    /// Path to the support archive or plaintext log file to analyze.
+    archive_path: String,
+}
+
+/// Spawn `rca_cli` with the given arguments and capture stdout.
+async fn run_cli(args: &[String]) -> Result<String, McpError> {
+    let bin = rca_cli_bin();
+    let output = Command::new(&bin)
+        .args(args)
+        .stdin(Stdio::null())
+        .output()
+        .await
+        .map_err(|e| {
+            McpError::internal_error(
+                format!(
+                    "failed to spawn rca_cli ('{bin}'): {e}. \
+                     Set RCA_CLI_BIN to the compiled binary path."
+                ),
+                None,
+            )
+        })?;
+
+    if !output.status.success() {
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        return Err(McpError::internal_error(
+            format!("rca_cli exited with {}: {}", output.status, stderr.trim()),
+            None,
+        ));
+    }
+    Ok(String::from_utf8_lossy(&output.stdout).into_owned())
+}
+
+/// Whether a parser result value represents a detector that "fired".
+fn fired(value: &Value) -> bool {
+    match value {
+        Value::Object(o) => {
+            o.get("found").and_then(Value::as_bool).unwrap_or(false)
+                || o.get("count")
+                    .and_then(Value::as_i64)
+                    .map(|c| c > 0)
+                    .unwrap_or(false)
+        }
+        Value::Array(a) => !a.is_empty(),
+        _ => false,
+    }
+}
+
+#[tool_router]
+impl RcaServer {
+    #[tool(
+        description = "List all available RCA detectors (parser name + the file-path regex each runs on)."
+    )]
+    async fn list_parsers(&self) -> Result<String, McpError> {
+        let text = run_cli(&["--list-parsers".to_string()]).await?;
+        let mut parsers = Vec::new();
+        for line in text.lines() {
+            if let Some((name, pattern)) = line.split_once(" -> ") {
+                parsers.push(serde_json::json!({
+                    "name": name.trim(),
+                    "pattern": pattern.trim(),
+                }));
+            }
+        }
+        serde_json::to_string_pretty(&Value::Array(parsers))
+            .map_err(|e| McpError::internal_error(format!("encode error: {e}"), None))
+    }
+
+    #[tool(
+        description = "Analyze a support archive (sosreport/supportconfig) and return the full structured findings as JSON. Optionally restrict the run to a single parser by name."
+    )]
+    async fn analyze_archive(
+        &self,
+        Parameters(AnalyzeParams {
+            archive_path,
+            parser,
+        }): Parameters<AnalyzeParams>,
+    ) -> Result<String, McpError> {
+        let mut args = vec![archive_path, "--json".to_string()];
+        if let Some(p) = parser {
+            args.push("--parser".to_string());
+            args.push(p);
+        }
+        run_cli(&args).await
+    }
+
+    #[tool(
+        description = "Analyze a support archive and return only the detectors that fired (found=true or count>0), as a compact JSON summary suitable for grounding an agent."
+    )]
+    async fn summarize_findings(
+        &self,
+        Parameters(SummarizeParams { archive_path }): Parameters<SummarizeParams>,
+    ) -> Result<String, McpError> {
+        let raw = run_cli(&[archive_path, "--json".to_string()]).await?;
+        let parsed: Value = serde_json::from_str(&raw).map_err(|e| {
+            McpError::internal_error(format!("rca_cli did not return valid JSON: {e}"), None)
+        })?;
+        let obj = parsed
+            .as_object()
+            .ok_or_else(|| McpError::internal_error("expected a JSON object from rca_cli", None))?;
+
+        let mut findings = Map::new();
+        for (k, v) in obj {
+            if matches!(k.as_str(), "fileCount" | "matchedFiles" | "fileTypes") {
+                continue;
+            }
+            if fired(v) {
+                findings.insert(k.clone(), v.clone());
+            }
+        }
+
+        let summary = serde_json::json!({
+            "fileCount": obj.get("fileCount").cloned().unwrap_or(Value::Null),
+            "matchedFiles": obj.get("matchedFiles").cloned().unwrap_or(Value::Null),
+            "firedCount": findings.len(),
+            "findings": Value::Object(findings),
+        });
+        serde_json::to_string_pretty(&summary)
+            .map_err(|e| McpError::internal_error(format!("encode error: {e}"), None))
+    }
+}
+
+#[tool_handler]
+impl ServerHandler for RcaServer {
+    fn get_info(&self) -> ServerInfo {
+        let mut info = ServerInfo::default();
+        // Advertise this crate's own name/version (driven by Cargo.toml, which
+        // the release tag script bumps) instead of rmcp's build-env identity
+        // that `ServerInfo::default()` would otherwise report.
+        info.server_info = Implementation::new(
+            env!("CARGO_PKG_NAME"),
+            env!("CARGO_PKG_VERSION"),
+        );
+        info.instructions = Some(
+            "RCA tool MCP server. Use list_parsers to discover detectors, \
+             analyze_archive for the full JSON findings of a support archive, \
+             and summarize_findings for a compact view of only the detectors \
+             that fired."
+                .to_string(),
+        );
+        info.capabilities = ServerCapabilities::builder().enable_tools().build();
+        info
+    }
+}
+
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+    let service = RcaServer.serve(stdio()).await?;
+    service.waiting().await?;
+    Ok(())
+}
diff --git a/rca-tool/lib/supportfile_py/Cargo.lock b/rca-tool/lib/supportfile_py/Cargo.lock
new file mode 100644
index 0000000..6cbad06
--- /dev/null
+++ b/rca-tool/lib/supportfile_py/Cargo.lock
@@ -0,0 +1,289 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "indoc"
+version = "2.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79cf5c93f93228cf8efb3ba362535fb11199ac548a09ce117c9b1adc3030d706"
+dependencies = [
+ "rustversion",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "libc"
+version = "0.2.185"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ff2c0fe9bc6cb6b14a0592c2ff4fa9ceb83eea9db979b0487cd054946a2b8f"
+
+[[package]]
+name = "memchr"
+version = "2.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
+
+[[package]]
+name = "memoffset"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "portable-atomic"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "pyo3"
+version = "0.22.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f402062616ab18202ae8319da13fa4279883a2b8a9d9f83f20dbade813ce1884"
+dependencies = [
+ "cfg-if",
+ "indoc",
+ "libc",
+ "memoffset",
+ "once_cell",
+ "portable-atomic",
+ "pyo3-build-config",
+ "pyo3-ffi",
+ "pyo3-macros",
+ "unindent",
+]
+
+[[package]]
+name = "pyo3-build-config"
+version = "0.22.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b14b5775b5ff446dd1056212d778012cbe8a0fbffd368029fd9e25b514479c38"
+dependencies = [
+ "once_cell",
+ "target-lexicon",
+]
+
+[[package]]
+name = "pyo3-ffi"
+version = "0.22.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ab5bcf04a2cdcbb50c7d6105de943f543f9ed92af55818fd17b660390fc8636"
+dependencies = [
+ "libc",
+ "pyo3-build-config",
+]
+
+[[package]]
+name = "pyo3-macros"
+version = "0.22.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fd24d897903a9e6d80b968368a34e1525aeb719d568dba8b3d4bfa5dc67d453"
+dependencies = [
+ "proc-macro2",
+ "pyo3-macros-backend",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "pyo3-macros-backend"
+version = "0.22.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36c011a03ba1e50152b4b394b479826cad97e7a21eb52df179cd91ac411cbfbe"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "pyo3-build-config",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "regex"
+version = "1.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
+
+[[package]]
+name = "rustversion"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.149"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "supportfile"
+version = "0.0.0"
+dependencies = [
+ "regex",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "supportfile_py"
+version = "0.0.0"
+dependencies = [
+ "pyo3",
+ "supportfile",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "target-lexicon"
+version = "0.12.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unindent"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7264e107f553ccae879d21fbea1d6724ac785e8c3bfc762137959b5802826ef3"
+
+[[package]]
+name = "zmij"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
diff --git a/rca-tool/lib/supportfile_py/Cargo.toml b/rca-tool/lib/supportfile_py/Cargo.toml
new file mode 100644
index 0000000..3495123
--- /dev/null
+++ b/rca-tool/lib/supportfile_py/Cargo.toml
@@ -0,0 +1,14 @@
+[package]
+name = "supportfile_py"
+version = "0.0.0"
+edition = "2021"
+description = "PyO3 wrapper for the Supportfile library core"
+license = "MIT"
+
+[lib]
+name = "supportfile"
+crate-type = ["cdylib"]
+
+[dependencies]
+pyo3 = { version = "0.22", features = ["extension-module", "abi3-py39"] }
+supportfile_core = { package = "supportfile", path = "../supportfile_core" }
diff --git a/rca-tool/lib/supportfile_py/README.md b/rca-tool/lib/supportfile_py/README.md
new file mode 100644
index 0000000..0c5fc23
--- /dev/null
+++ b/rca-tool/lib/supportfile_py/README.md
@@ -0,0 +1,102 @@
+# Supportfile Python wrapper
+
+This crate exposes the Supportfile library core as a native Python extension.
+
+## Install for local development
+
+From the lib folder:
+
+- python3 -m venv .venv
+- . .venv/bin/activate
+- python -m pip install -e ./supportfile_py
+
+## Build a wheel for distribution
+
+From the wrapper folder:
+
+- ./build-wheel.sh
+
+The script creates a local build virtual environment automatically and writes the built wheel under the dist folder.
+
+## GitHub publishing
+
+The repository CI now builds the Rust crate and Python wheels for both amd64 and arm64, and publishes them on release tags.
+
+Then import it normally in Python:
+
+```python
+import supportfile
+
+result_json = supportfile.parse_high_cpu_events(log_text)
+```
+
+Current exported functions:
+
+- parse_high_cpu_events
+- parse_cluster_events
+- parse_cluster_status
+- parse_corosync_config
+- parse_cluster_maintenance_mode
+- parse_automation_events
+- parse_azure_vm_properties
+- parse_suse_cloud_register
+- parse_waagent_config
+- parse_waagent_log
+- parse_hv_balloon
+- parse_extfrag
+- parse_emergency_mode
+- parse_kernel_reboots
+- parse_oom_killer
+- parse_xfs_errors
+- parse_firewall_rules
+- parse_network_interfaces
+- parse_distro_packages
+- parse_ssh_service_issues
+- parse_dlm_service
+- parse_azure_site_recovery
+- parse_guardicore_agent
+- parse_illumio
+- parse_trend_micro
+- parse_falcon_sensor
+- parse_falcon_sensor_config
+- parse_ms_defender
+- parse_ms_defender_config
+- parse_involflt_version
+- parse_involflt_kernel_version
+- parse_azure_extensions
+- parse_lvm_config
+- parse_raid_config
+- parse_btrfs_config
+- parse_block_devices
+- parse_fstab_analysis
+- parse_df_output
+- parse_mtab_analysis
+- parse_basic_environment
+- parse_os_release
+- parse_fstab
+- parse_inspect_disk_results
+- parse_kernel_tuning
+- parse_huge_pages
+- parse_time_sync
+- parse_ptp_clock_source
+- parse_time_sync_service
+- parse_timedatectl
+- parse_ptp_device
+- parse_chrony_tracking
+- parse_chrony_makestep
+- parse_rhui_config
+- parse_eus_version_lock
+- parse_rhel_rhui_check
+- parse_crypto_policies
+- parse_fips_mode_setup
+- parse_kernel_cmdline
+- parse_rhui_errors
+- parse_leapp_report
+- parse_leapp_log
+- parse_vmcore_dmesg
+- parse_kdump_status
+- parse_crash_listing
+- parse_kdump_conf
+- parse_vmcore_summary
+
+It depends on the shared parser implementation in the sibling supportfile_core crate.
diff --git a/rca-tool/lib/supportfile_py/build-wheel.sh b/rca-tool/lib/supportfile_py/build-wheel.sh
new file mode 100755
index 0000000..6bc3e44
--- /dev/null
+++ b/rca-tool/lib/supportfile_py/build-wheel.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+cd "$SCRIPT_DIR"
+
+VENV_DIR="$SCRIPT_DIR/.build-venv"
+if [[ ! -d "$VENV_DIR" ]]; then
+  python3 -m venv "$VENV_DIR"
+fi
+
+. "$VENV_DIR/bin/activate"
+python -m pip install -q --upgrade pip maturin
+rm -rf "$SCRIPT_DIR/dist"
+maturin build --release --out dist
+
+echo
+find "$SCRIPT_DIR/dist" -maxdepth 1 -name '*.whl' -print | sort
diff --git a/rca-tool/lib/supportfile_py/examples/rca_cli.py b/rca-tool/lib/supportfile_py/examples/rca_cli.py
new file mode 100644
index 0000000..9db07a2
--- /dev/null
+++ b/rca-tool/lib/supportfile_py/examples/rca_cli.py
@@ -0,0 +1,1102 @@
+#!/usr/bin/env python3
+"""rca_cli.py - Python port of the RCA Tool CLI.
+
+Analyses ``.tar.xz`` / ``.tar.gz`` / ``.tar`` support bundles (the same
+fixtures the JavaScript CLI consumes, including those produced by
+``rca-tool/tests/create-fixtures.sh``) by streaming them through the
+``supportfile`` Rust extension exposed by ``rca-tool/lib/supportfile_py``.
+
+Usage:
+    python rca_cli.py <archive> [--json] [--parser NAME] [--list-parsers]
+                                [--extract DIR] [--debug]
+"""
+
+from __future__ import annotations
+
+import argparse
+import gzip
+import json
+import lzma
+import os
+import re
+import sys
+import tarfile
+import zipfile
+from dataclasses import dataclass, field
+from typing import Any, Callable, Dict, List, Optional, Pattern, Tuple
+
+try:
+    import supportfile
+except ImportError as exc:  # pragma: no cover
+    sys.stderr.write(
+        "ERROR: the 'supportfile' native module is not installed.\n"
+        "       From rca-tool/lib, run:\n"
+        "         python3 -m venv .venv && . .venv/bin/activate\n"
+        "         pip install ./supportfile_py\n"
+    )
+    raise SystemExit(1) from exc
+
+
+# ---------------------------------------------------------------------------
+# Parser registry
+# ---------------------------------------------------------------------------
+#
+# Each entry maps a Python parser callable to:
+#   - file_pattern: regex applied to the (full) archive member path. A parser
+#     runs on every file whose path matches.
+#   - multi_file: when True, results from successive files are merged. When
+#     False, the last successful (``found`` truthy) result wins.
+#
+# The patterns mirror the JS parsers in rca-tool/lib/parsers/*.js so that the
+# same fixtures yield equivalent coverage.
+
+@dataclass
+class ParserSpec:
+    name: str                            # output key in the results dict
+    func: Callable[[str], str]           # supportfile.parse_* function
+    file_pattern: Pattern[str]
+    multi_file: bool = False             # if True, merge results across files
+
+
+def _re(pattern: str) -> Pattern[str]:
+    return re.compile(pattern)
+
+
+PARSERS: List[ParserSpec] = [
+    # ----- Cluster ---------------------------------------------------------
+    ParserSpec(
+        "highCpuEvents", supportfile.parse_high_cpu_events,
+        _re(r"/(pacemaker\.log|corosync\.log|cluster\.log|ha-log|messages|localmessages|journalctl[^/]*)"
+            r"(?:[.-]\d+)?(?:\.txt)?(?:\.gz)?$|/ha\.txt$"),
+        multi_file=True,
+    ),
+    ParserSpec(
+        "clusterEvents", supportfile.parse_cluster_events,
+        _re(r"/(pacemaker\.log|corosync\.log|cluster\.log|ha-log|messages|journalctl[^/]*)"
+            r"(?:[.-]\d+)?(?:\.txt)?(?:\.gz)?$|/ha\.txt$"),
+        multi_file=True,
+    ),
+    ParserSpec(
+        "clusterStatus", supportfile.parse_cluster_status,
+        _re(r"cib\.xml$|/crm_mon.*\.txt$|/crm_mon.*\.xml$|/ha\.txt$|/pcs_status"),
+    ),
+    ParserSpec(
+        "corosyncConfig", supportfile.parse_corosync_config,
+        _re(r"/(ha\.txt|corosync\.conf)$"),
+    ),
+    ParserSpec(
+        "clusterMaintenanceMode", supportfile.parse_cluster_maintenance_mode,
+        _re(r"cib\.xml$|/crm_mon.*\.txt$|/ha\.txt$"),
+    ),
+
+    # ----- Automation ------------------------------------------------------
+    ParserSpec(
+        "automationEvents", supportfile.parse_automation_events,
+        _re(r"/(messages|localmessages|syslog|journalctl[^/]*)(?:[.-]\d+)?(?:\.txt)?$"),
+        multi_file=True,
+    ),
+
+    # ----- Azure -----------------------------------------------------------
+    ParserSpec(
+        "azureVMProperties", supportfile.parse_azure_vm_properties,
+        _re(r"(?:instance_metadata\.json|public_cloud/metadata\.txt)$"),
+    ),
+    ParserSpec(
+        "suseCloudRegister", supportfile.parse_suse_cloud_register,
+        _re(r"public_cloud/cloudregister\.txt$"),
+    ),
+    ParserSpec(
+        "waagentConfig", supportfile.parse_waagent_config,
+        _re(r"/etc/waagent\.conf$"),
+    ),
+    ParserSpec(
+        "waagentLog", supportfile.parse_waagent_log,
+        _re(r"/waagent\.log$"),
+    ),
+    ParserSpec(
+        "azureExtensions", supportfile.parse_azure_extensions,
+        _re(r"var/lib/waagent/[^/]+/config/HandlerStatus$"),
+        multi_file=True,
+    ),
+
+    # ----- Debugfs ---------------------------------------------------------
+    ParserSpec(
+        "hvBalloon", supportfile.parse_hv_balloon,
+        _re(r"sys/kernel/debug/hv[-_]balloon$"),
+    ),
+    ParserSpec(
+        "extfrag", supportfile.parse_extfrag,
+        _re(r"sys/kernel/debug/extfrag/(extfrag_index|unusable_index)$"),
+        multi_file=True,
+    ),
+
+    # ----- System events ---------------------------------------------------
+    ParserSpec(
+        "emergencyMode", supportfile.parse_emergency_mode,
+        _re(r"/(messages|localmessages|journalctl[^/]*|console.*\.log)(?:[.-]\d+)?(?:\.txt)?$"),
+        multi_file=True,
+    ),
+    ParserSpec(
+        "kernelReboots", supportfile.parse_kernel_reboots,
+        _re(r"/(messages|localmessages|ha-log|journalctl[^/]*)(?:[.-]\d+)?(?:\.txt)?$"),
+        multi_file=True,
+    ),
+    ParserSpec(
+        "oomKiller", supportfile.parse_oom_killer,
+        _re(r"/(messages|localmessages|journalctl[^/]*)(?:[.-]\d+)?(?:\.txt)?$"),
+        multi_file=True,
+    ),
+    ParserSpec(
+        "xfsErrors", supportfile.parse_xfs_errors,
+        _re(r"/(messages|localmessages|journalctl[^/]*)(?:[.-]\d+)?(?:\.txt)?$"),
+        multi_file=True,
+    ),
+
+    # ----- Networking ------------------------------------------------------
+    ParserSpec(
+        "firewallRules", supportfile.parse_firewall_rules,
+        _re(r"network\.txt$|sos_commands/firewalld/|sos_commands/firewall_tables/|"
+            r"etc/sysconfig/(?:iptables-config|ebtables-config|nftables\.conf|firewalld)$|"
+            r"etc/firewalld/firewalld\.conf$"),
+        multi_file=True,
+    ),
+    ParserSpec(
+        "networkInterfaces", supportfile.parse_network_interfaces,
+        _re(r"network\.txt$|sos_commands/networking/ip_-o_addr$|"
+            r"sos_commands/networking/ip_-s_-d_link$|"
+            r"sos_commands/networking/ethtool_-i_\w+|"
+            r"sos_commands/networkmanager/nmcli_con_show_id_|"
+            r"etc/sysconfig/network-scripts/ifcfg-|"
+            r"etc/sysconfig/network/(?:network/)?ifcfg-|"
+            r"etc/netplan/|var/log/cloud-init-output\.log$|(?:^|/)messages$"),
+        multi_file=True,
+    ),
+
+    # ----- Packages --------------------------------------------------------
+    ParserSpec(
+        "distroPackages", supportfile.parse_distro_packages,
+        _re(r"/(rpm\.txt|installed-rpms|package-data|dpkg_-l|"
+            r"dnf[_-]list[_-]installed|yum[_-]list[_-]installed|"
+            r"var/log/zypp/history|var/log/(?:dnf|yum)\.log)$"),
+    ),
+
+    # ----- Services --------------------------------------------------------
+    ParserSpec(
+        "sshServiceIssues", supportfile.parse_ssh_service_issues,
+        _re(r"/(messages|localmessages|syslog|journalctl[^/]*|console.*\.log)"
+            r"(?:[.-]\d+)?(?:\.txt)?$"),
+        multi_file=True,
+    ),
+    ParserSpec(
+        "dlmService", supportfile.parse_dlm_service,
+        _re(r"sos_commands/systemd/systemctl_list-unit-files$"),
+    ),
+    ParserSpec(
+        "azureSiteRecovery", supportfile.parse_azure_site_recovery,
+        _re(r"(?:sos_commands/systemd/systemctl_list-unit-files|systemd-status\.txt)$"),
+    ),
+    ParserSpec(
+        "guardicoreAgent", supportfile.parse_guardicore_agent,
+        _re(r"(?:sos_commands/systemd/systemctl_list-unit-files|systemd-status\.txt)$"),
+    ),
+    ParserSpec(
+        "illumio", supportfile.parse_illumio,
+        _re(r"sos_commands/systemd/systemctl_list-units_--all$"),
+    ),
+    ParserSpec(
+        "trendMicro", supportfile.parse_trend_micro,
+        _re(r"sos_commands/systemd/systemctl_list-units_--all$"),
+    ),
+    ParserSpec(
+        "falconSensor", supportfile.parse_falcon_sensor,
+        _re(r"/(rpm\.txt|installed-rpms|package-data|ps\.txt|ps_.*\.txt)$"),
+    ),
+    ParserSpec(
+        "falconSensorConfig", supportfile.parse_falcon_sensor_config,
+        _re(r"/(falconctl|CrowdStrike.*config|falcon.*conf)$", ),
+    ),
+    ParserSpec(
+        "msDefender", supportfile.parse_ms_defender,
+        _re(r"/(rpm\.txt|installed-rpms|package-data|ps\.txt|ps_.*\.txt)$"),
+    ),
+    ParserSpec(
+        "msDefenderConfig", supportfile.parse_ms_defender_config,
+        _re(r"/(mdatp.*|defender.*config)$"),
+    ),
+    ParserSpec(
+        "involfltVersion", supportfile.parse_involflt_version,
+        _re(r"modules\.txt$"),
+    ),
+    ParserSpec(
+        "involfltKernelVersion", supportfile.parse_involflt_kernel_version,
+        _re(r"/(messages|boot)(?:[.-]\d+)?(?:\.txt)?$"),
+    ),
+
+    # ----- Storage ---------------------------------------------------------
+    ParserSpec(
+        "lvmConfig", supportfile.parse_lvm_config,
+        _re(r"/(lvm\.txt|pvs\.txt|vgs\.txt|lvs\.txt|pvdisplay|vgdisplay|lvdisplay)$|"
+            r"/lvm2/pvs_|/lvm2/vgs_|/lvm2/lvs_"),
+    ),
+    ParserSpec(
+        "raidConfig", supportfile.parse_raid_config,
+        _re(r"/(mdstat|md-arrays\.txt|mdadm\.txt|proc/mdstat)$"),
+    ),
+    ParserSpec(
+        "btrfsConfig", supportfile.parse_btrfs_config,
+        _re(r"/(btrfs\.txt|fs-btrfs\.txt|btrfs-filesystem-show\.txt|btrfs-subvolume-list\.txt)$"),
+    ),
+    ParserSpec(
+        "blockDevices", supportfile.parse_block_devices,
+        _re(r"/sos_commands/block/(lsblk|lsblk_-f_-a_-l|blkid_-c_\.dev\.null)$|(?:^|/)results\.txt$"),
+        multi_file=True,
+    ),
+    ParserSpec(
+        "fstabAnalysis", supportfile.parse_fstab_analysis,
+        _re(r"/etc/fstab$|/fs-diskio\.txt$"),
+    ),
+    ParserSpec(
+        "dfOutput", supportfile.parse_df_output,
+        _re(r"/df$|/df_-aliT|/df_-al_|/fs-diskio\.txt$"),
+    ),
+    ParserSpec(
+        "mtabAnalysis", supportfile.parse_mtab_analysis,
+        _re(r"/etc/mtab$|/proc/mounts$|/proc/self/mounts$|/fs-diskio\.txt$|/mount_-l$|/mount$"),
+    ),
+
+    # ----- OS / filesystem -------------------------------------------------
+    ParserSpec(
+        "basicEnvironment", supportfile.parse_basic_environment,
+        _re(r"basic-environment\.txt$"),
+    ),
+    ParserSpec(
+        "osRelease", supportfile.parse_os_release,
+        _re(r"/usr/lib/os-release$|/etc/os-release$|/sysinfo\.txt$|"
+            r"/basic-environment\.txt$|/etc/(redhat|centos|SuSE|system)-release$"),
+    ),
+    ParserSpec(
+        "fstab", supportfile.parse_fstab,
+        _re(r"/etc/fstab$|/fs-diskio\.txt$"),
+    ),
+    ParserSpec(
+        "inspectDiskResults", supportfile.parse_inspect_disk_results,
+        _re(r"(?:^|/)results\.txt$"),
+    ),
+
+    # ----- Kernel tuning ---------------------------------------------------
+    ParserSpec(
+        "kernelTuning", supportfile.parse_kernel_tuning,
+        _re(r"sos_commands/kernel/sysctl_-a$|/env\.txt$|/etc/sysctl\.conf$|"
+            r"/sysctl\.d/[^/]*\.conf$"),
+    ),
+    ParserSpec(
+        "hugePages", supportfile.parse_huge_pages,
+        _re(r"/proc/meminfo$"),
+    ),
+
+    # ----- Time sync (Azure PTP) -------------------------------------------
+    ParserSpec(
+        "timeSync", supportfile.parse_time_sync,
+        _re(r"sos_commands/kernel/lsmod$|/modules\.txt$"),
+    ),
+    ParserSpec(
+        "ptpClockSource", supportfile.parse_ptp_clock_source,
+        _re(r"sos_commands/chrony/chronyc_sources$|/etc/chrony\.conf$|"
+            r"/etc/chrony/chrony\.conf$|/ntp\.txt$"),
+    ),
+    ParserSpec(
+        "timeSyncService", supportfile.parse_time_sync_service,
+        _re(r"sos_commands/systemd/systemctl_list-unit-files$|"
+            r"/systemd-status\.txt$|/ntp\.txt$"),
+    ),
+    ParserSpec(
+        "timedatectl", supportfile.parse_timedatectl,
+        _re(r"sos_commands/systemd/timedatectl$|/ntp\.txt$"),
+    ),
+    ParserSpec(
+        "ptpDevice", supportfile.parse_ptp_device,
+        _re(r"sos_commands/block/ls_-lanR_\.dev$|/udev\.txt$"),
+    ),
+    ParserSpec(
+        "chronyTracking", supportfile.parse_chrony_tracking,
+        _re(r"sos_commands/chrony/chronyc_tracking$|/ntp\.txt$"),
+    ),
+    ParserSpec(
+        "chronyMakestep", supportfile.parse_chrony_makestep,
+        _re(r"/etc/chrony\.conf$|/etc/chrony/chrony\.conf$|/ntp\.txt$"),
+    ),
+
+    # ----- RHUI ------------------------------------------------------------
+    ParserSpec(
+        "rhuiConfig", supportfile.parse_rhui_config,
+        _re(r"/(rh-cloud.*\.repo|rhui-.*\.repo|yum\.repos\.d\.txt|"
+            r"dnf\.repos\.d\.txt|yum\.repos\.d/.*\.repo)$"),
+    ),
+    ParserSpec(
+        "eusVersionLock", supportfile.parse_eus_version_lock,
+        _re(r"/(releasever|yum-vars\.txt|dnf-vars\.txt|etc/yum/vars|"
+            r"etc/dnf/vars|dnf/vars/releasever|yum/vars/releasever)$"),
+    ),
+    ParserSpec(
+        "rhelRhuiCheck", supportfile.parse_rhel_rhui_check,
+        _re(r"/(installed-rpms|rpm-qa\.txt|rpm_-qa|package-data)$"),
+    ),
+    ParserSpec(
+        "rhuiErrors", supportfile.parse_rhui_errors,
+        _re(r"/(dnf\.log|yum\.log|rhsm\.log)(\.\d+)?$"),
+        multi_file=True,
+    ),
+
+    # ----- Security --------------------------------------------------------
+    ParserSpec(
+        "cryptoPolicies", supportfile.parse_crypto_policies,
+        _re(r"/crypto-policies/(config|state/current)$"),
+    ),
+    ParserSpec(
+        "fipsModeSetup", supportfile.parse_fips_mode_setup,
+        _re(r"sos_commands/crypto/fips-mode-setup"),
+    ),
+    ParserSpec(
+        "kernelCmdline", supportfile.parse_kernel_cmdline,
+        _re(r"/proc/cmdline$|/boot\.txt$"),
+    ),
+
+    # ----- Leapp -----------------------------------------------------------
+    ParserSpec(
+        "leappReport", supportfile.parse_leapp_report,
+        _re(r"var/log/leapp/leapp-report\.(txt|json)$"),
+    ),
+    ParserSpec(
+        "leappLog", supportfile.parse_leapp_log,
+        _re(r"var/log/leapp/leapp-(preupgrade|upgrade)\.log$"),
+    ),
+
+    # ----- vmcore / kdump --------------------------------------------------
+    ParserSpec(
+        "vmcoreDmesg", supportfile.parse_vmcore_dmesg,
+        _re(r"var/crash/[^/]+/vmcore-dmesg\.txt$"),
+        multi_file=True,
+    ),
+    ParserSpec(
+        "kdumpStatus", supportfile.parse_kdump_status,
+        _re(r"sos_commands/kdump/kdumpctl_status$"),
+    ),
+    ParserSpec(
+        "crashListing", supportfile.parse_crash_listing,
+        _re(r"sos_commands/kdump/ls_-alZR_\.var\.crash$"),
+    ),
+    ParserSpec(
+        "kdumpConf", supportfile.parse_kdump_conf,
+        _re(r"etc/kdump\.conf$"),
+    ),
+]
+
+
+# ---------------------------------------------------------------------------
+# Result merging
+# ---------------------------------------------------------------------------
+
+def _merge(existing: Any, new: Any) -> Any:
+    """Best-effort recursive merge for multi-file parser results.
+
+    Lists are concatenated, dicts are merged key-by-key, ``found``-style
+    booleans are OR'ed, ``count``-style integers are summed, scalars take
+    the last non-empty value. This mirrors what the JS CLI does for its
+    multi-file parsers without having to special-case every parser shape.
+    """
+    if existing is None:
+        return new
+    if new is None:
+        return existing
+    if isinstance(existing, dict) and isinstance(new, dict):
+        merged = dict(existing)
+        for key, val in new.items():
+            if key in merged:
+                if key == "found":
+                    merged[key] = bool(merged[key]) or bool(val)
+                elif key == "count" and isinstance(merged[key], int) and isinstance(val, int):
+                    merged[key] = merged[key] + val
+                else:
+                    merged[key] = _merge(merged[key], val)
+            else:
+                merged[key] = val
+        return merged
+    if isinstance(existing, list) and isinstance(new, list):
+        return existing + new
+    # Scalars: keep the existing value unless it's empty/falsy.
+    return existing if existing not in (None, "", 0, False) else new
+
+
+# ---------------------------------------------------------------------------
+# Archive processing
+# ---------------------------------------------------------------------------
+
+@dataclass
+class ArchiveResults:
+    file_count: int = 0
+    matched_files: int = 0
+    parser_results: Dict[str, Any] = field(default_factory=dict)
+    file_types: Dict[str, int] = field(default_factory=dict)
+
+
+def _open_archive(path: str) -> tarfile.TarFile:
+    # tarfile auto-detects gz/xz/bz2 from "r:*"
+    return tarfile.open(path, mode="r:*")
+
+
+def _is_zip(path: str) -> bool:
+    return path.lower().endswith(".zip") and zipfile.is_zipfile(path)
+
+
+_PLAINTEXT_EXTS = (".log", ".txt", ".out")
+_GZIP_MAGIC = b"\x1f\x8b"
+_XZ_MAGIC = b"\xfd7zXZ\x00"
+
+
+def _is_plaintext(path: str) -> bool:
+    """Detect a plaintext log file (no archive container).
+
+    Recognises common log extensions and falls back to magic-byte sniffing:
+    if the file is not gzip/xz/zip and not a tar, treat it as plaintext.
+    """
+    lower = path.lower()
+    # Strip a trailing ".log" duplication like ".log.log"
+    if lower.endswith(_PLAINTEXT_EXTS):
+        return True
+    try:
+        with open(path, "rb") as fobj:
+            head = fobj.read(512)
+    except OSError:
+        return False
+    if head.startswith(_GZIP_MAGIC) or head.startswith(_XZ_MAGIC):
+        return False
+    if head.startswith(b"PK\x03\x04"):
+        return False
+    if tarfile.is_tarfile(path):
+        return False
+    # Heuristic: mostly printable ASCII / UTF-8 in the first chunk.
+    if not head:
+        return False
+    printable = sum(1 for b in head if b == 9 or b == 10 or b == 13 or 32 <= b < 127)
+    return printable / len(head) > 0.85
+
+
+def _maybe_decompress_inner(name: str, data: bytes, debug: bool) -> Tuple[str, bytes]:
+    """Decompress an archive member that is itself gzip/xz compressed.
+
+    Mirrors ``maybe_decompress_inner`` in the Rust CLI: SOS reports often
+    contain ``syslog-*.gz`` / ``kern.log-*.gz`` inside an outer ``.tar.xz``,
+    which would otherwise be passed as binary garbage to text parsers.
+    """
+    try:
+        if data.startswith(_GZIP_MAGIC):
+            decoded = gzip.decompress(data)
+            new_name = name[:-3] if name.lower().endswith(".gz") else name
+            if debug:
+                sys.stderr.write(
+                    f"[debug] inner gzip: {name} -> {new_name} "
+                    f"({len(data)} -> {len(decoded)} bytes)\n"
+                )
+            return new_name, decoded
+        if data.startswith(_XZ_MAGIC):
+            decoded = lzma.decompress(data)
+            new_name = name[:-3] if name.lower().endswith(".xz") else name
+            if debug:
+                sys.stderr.write(
+                    f"[debug] inner xz: {name} -> {new_name} "
+                    f"({len(data)} -> {len(decoded)} bytes)\n"
+                )
+            return new_name, decoded
+    except (OSError, EOFError, lzma.LZMAError) as exc:
+        if debug:
+            sys.stderr.write(f"[debug] inner decompress failed for {name}: {exc}\n")
+    return name, data
+
+
+def _process_one(
+    member_path: str,
+    content: str,
+    active: List[ParserSpec],
+    results: "ArchiveResults",
+    debug: bool,
+) -> None:
+    results.file_count += 1
+    ext = os.path.splitext(member_path)[1] or "(none)"
+    results.file_types[ext] = results.file_types.get(ext, 0) + 1
+
+    matching = [p for p in active if p.file_pattern.search("/" + member_path)]
+    if not matching:
+        return
+
+    results.matched_files += 1
+    if debug:
+        sys.stderr.write(
+            f"[debug] {member_path} ({len(content)} chars) -> "
+            f"{', '.join(p.name for p in matching)}\n"
+        )
+
+    for spec in matching:
+        try:
+            raw = spec.func(content)
+            parsed = json.loads(raw)
+        except (ValueError, OSError) as exc:
+            if debug:
+                sys.stderr.write(
+                    f"[debug] parser '{spec.name}' failed on "
+                    f"{member_path}: {exc}\n"
+                )
+            continue
+
+        prev = results.parser_results.get(spec.name)
+        if spec.multi_file:
+            results.parser_results[spec.name] = _merge(prev, parsed)
+        else:
+            is_empty = (
+                isinstance(parsed, dict) and not parsed.get("found")
+            ) or (isinstance(parsed, list) and not parsed)
+            if prev is None or not is_empty:
+                results.parser_results[spec.name] = parsed
+
+
+def process_archive(
+    path: str,
+    *,
+    parser_filter: Optional[str] = None,
+    debug: bool = False,
+) -> ArchiveResults:
+    """Stream every file in *path* through any matching parser.
+
+    Supports tar (`.tar`, `.tar.gz`, `.tar.xz`, `.tgz`) and `.zip` archives.
+    """
+    if parser_filter:
+        active = [p for p in PARSERS if p.name == parser_filter]
+        if not active:
+            raise ValueError(
+                f"Unknown parser '{parser_filter}'. "
+                f"Use --list-parsers to see available names."
+            )
+    else:
+        active = list(PARSERS)
+
+    results = ArchiveResults()
+
+    if _is_plaintext(path):
+        try:
+            with open(path, "rb") as fobj:
+                data = fobj.read()
+        except OSError as exc:
+            if debug:
+                sys.stderr.write(f"[debug] read error {path}: {exc}\n")
+            return results
+        # Use a synthetic path so message-style parsers (which match on
+        # /messages, /syslog, etc.) actually fire on a bare .log file.
+        synthetic = os.path.basename(path) + "/messages"
+        content = data.decode("utf-8", errors="replace")
+        _process_one(synthetic, content, active, results, debug)
+        return results
+
+    if _is_zip(path):
+        with zipfile.ZipFile(path) as zf:
+            for info in zf.infolist():
+                if info.is_dir():
+                    continue
+                try:
+                    with zf.open(info) as fobj:
+                        data = fobj.read()
+                except (OSError, RuntimeError) as exc:
+                    if debug:
+                        sys.stderr.write(f"[debug] read error {info.filename}: {exc}\n")
+                    continue
+                name, data = _maybe_decompress_inner(info.filename, data, debug)
+                content = data.decode("utf-8", errors="replace")
+                _process_one(name, content, active, results, debug)
+        return results
+
+    with _open_archive(path) as archive:
+        for member in archive:
+            if not member.isfile():
+                continue
+            try:
+                fobj = archive.extractfile(member)
+                if fobj is None:
+                    continue
+                data = fobj.read()
+            except (OSError, KeyError) as exc:
+                if debug:
+                    sys.stderr.write(f"[debug] read error {member.name}: {exc}\n")
+                continue
+            name, data = _maybe_decompress_inner(member.name, data, debug)
+            content = data.decode("utf-8", errors="replace")
+            _process_one(name, content, active, results, debug)
+
+    return results
+
+
+# ---------------------------------------------------------------------------
+# Output formatting
+# ---------------------------------------------------------------------------
+
+SEP = "=" * 70
+SUB = "-" * 70
+
+
+def _section(title: str) -> str:
+    return f"\n{SUB}\n{title}\n{SUB}\n"
+
+
+def _list_warnings(items: Any, indent: str = "    ") -> str:
+    out = ""
+    if not isinstance(items, list):
+        return out
+    for w in items:
+        if isinstance(w, dict):
+            severity = (w.get("severity") or "warn").upper()
+            msg = w.get("message") or w.get("type") or json.dumps(w)
+            out += f"{indent}[{severity}] {msg}\n"
+            if w.get("recommendation"):
+                out += f"{indent}        Recommendation: {w['recommendation']}\n"
+        else:
+            out += f"{indent}[WARN] {w}\n"
+    return out
+
+
+def _has_data(value: Any) -> bool:
+    """A parser result counts as having data if it explicitly says so via
+    ``found``/``count`` or carries any non-default scalar / non-empty
+    container value. Used to decide whether to print a section.
+    """
+    if value is None:
+        return False
+    if isinstance(value, list):
+        return len(value) > 0
+    if not isinstance(value, dict):
+        return bool(value)
+    if value.get("found"):
+        return True
+    if isinstance(value.get("count"), int) and value["count"] > 0:
+        return True
+    # No explicit found; treat as data if any non-trivial field is set.
+    for k, v in value.items():
+        if k in ("found", "count", "warnings", "errors"):
+            continue
+        if v in (None, "", 0, False, [], {}):
+            continue
+        return True
+    return False
+
+
+def format_text(results: ArchiveResults) -> str:  # noqa: C901 - long but linear
+    r = results.parser_results
+    out = f"\n{SEP}\n  RCA Analysis Results (python)\n{SEP}\n\n"
+    out += f"Files processed: {results.file_count}\n"
+    out += f"Files matched by parsers: {results.matched_files}\n\n"
+
+    # ---- Azure VM properties / OS -----
+    vm = r.get("azureVMProperties") or {}
+    osrel = r.get("osRelease") or {}
+    if _has_data(vm) or _has_data(osrel):
+        out += _section("AZURE VM PROPERTIES")
+        for label, key in (("VM Size", "vm_size"), ("Publisher", "publisher"),
+                           ("Offer", "offer"), ("SKU", "sku"),
+                           ("License Type", "license_type"),
+                           ("Billing Model", "billing_model"),
+                           ("Detection Method", "detection_method"),
+                           ("OS Disk Type", "os_disk_type")):
+            if vm.get(key):
+                out += f"  {label}: {vm[key]}\n"
+        if vm.get("data_disks"):
+            out += f"  Data Disks: {len(vm['data_disks'])}\n"
+        if _has_data(osrel):
+            out += "  Operating System:\n"
+            name = osrel.get("pretty_name") or osrel.get("name")
+            if name:
+                out += f"    Distribution: {name}\n"
+            if osrel.get("version_id"):
+                out += f"    Version: {osrel['version_id']}\n"
+        out += "\n"
+
+    # ---- Cluster -----
+    cluster_keys = ("corosyncConfig", "clusterStatus", "clusterMaintenanceMode")
+    if any(_has_data(r.get(k)) for k in cluster_keys):
+        out += _section("CLUSTER")
+        cc = r.get("corosyncConfig") or {}
+        if _has_data(cc):
+            out += "  Corosync:\n"
+            for label, key in (("Token", "totem_token"),
+                               ("Consensus", "totem_consensus"),
+                               ("Transport", "totem_transport"),
+                               ("Quorum provider", "quorum_provider"),
+                               ("Expected votes", "quorum_expected_votes"),
+                               ("Two-node mode", "quorum_two_node")):
+                if cc.get(key) is not None:
+                    out += f"    {label}: {cc[key]}\n"
+            out += _list_warnings(cc.get("warnings"))
+        cs = r.get("clusterStatus") or {}
+        if _has_data(cs):
+            out += "  Status:\n"
+            for label, key in (("Cluster name", "cluster_name"),
+                               ("DC node", "dc_node"),
+                               ("Nodes configured", "nodes_configured"),
+                               ("Resources configured", "resources_configured"),
+                               ("Quorum status", "quorum_status")):
+                if cs.get(key) is not None:
+                    out += f"    {label}: {cs[key]}\n"
+            for ns in cs.get("node_statuses", []):
+                state = "online" if ns.get("online") else "offline"
+                out += f"    - {ns.get('name')}: {state}\n"
+        mm = r.get("clusterMaintenanceMode") or {}
+        if _has_data(mm):
+            mm_on = mm.get("maintenance_mode")
+            out += f"  Maintenance Mode: {'YES' if mm_on else 'no'}\n"
+            res = mm.get("resources_in_maintenance") or []
+            if res:
+                out += f"    Resources in maintenance: {len(res)}\n"
+        out += "\n"
+
+    # ---- Storage -----
+    storage_keys = ("lvmConfig", "raidConfig", "btrfsConfig", "blockDevices",
+                    "fstabAnalysis", "dfOutput", "mtabAnalysis")
+    if any(_has_data(r.get(k)) for k in storage_keys):
+        out += _section("STORAGE")
+        bd = r.get("blockDevices") or {}
+        if _has_data(bd):
+            out += (f"  Block Devices: {len(bd.get('disks') or [])} disk(s), "
+                    f"{len(bd.get('partitions') or [])} partition(s)\n")
+        lvm = r.get("lvmConfig") or {}
+        if _has_data(lvm):
+            out += (f"  LVM: {len(lvm.get('pvs') or [])} PV(s), "
+                    f"{len(lvm.get('vgs') or [])} VG(s), "
+                    f"{len(lvm.get('lvs') or [])} LV(s)\n")
+            out += _list_warnings(lvm.get("warnings"))
+        raid = r.get("raidConfig") or {}
+        if _has_data(raid) and raid.get("arrays"):
+            out += f"  RAID Arrays: {len(raid['arrays'])}\n"
+            out += _list_warnings(raid.get("warnings"))
+        btrfs = r.get("btrfsConfig") or {}
+        if _has_data(btrfs):
+            out += (f"  BTRFS: {len(btrfs.get('filesystems') or [])} fs, "
+                    f"{len(btrfs.get('subvolumes') or [])} subvol(s)\n")
+        fa = r.get("fstabAnalysis") or {}
+        if _has_data(fa):
+            out += f"  Fstab entries: {len(fa.get('entries') or [])}\n"
+            out += _list_warnings(fa.get("warnings"))
+        df = r.get("dfOutput") or {}
+        if _has_data(df):
+            out += f"  df entries: {len(df.get('filesystems') or [])}\n"
+        mt = r.get("mtabAnalysis") or {}
+        if _has_data(mt):
+            extras = mt.get("extra_mounts") or []
+            out += f"  Mtab entries: {len(mt.get('entries') or [])}"
+            if extras:
+                out += f" ({len(extras)} not in fstab)"
+            out += "\n"
+        out += "\n"
+
+    # ---- Networking -----
+    net_keys = ("networkInterfaces", "firewallRules", "sshServiceIssues")
+    if any(_has_data(r.get(k)) for k in net_keys):
+        out += _section("NETWORKING")
+        ni = r.get("networkInterfaces") or {}
+        if _has_data(ni):
+            ifaces = ni.get("interfaces") or {}
+            real = [i for n, i in ifaces.items() if n != "lo"]
+            accelnet = any(i.get("accel_net") for i in real)
+            out += (f"  Network Interfaces: {len(real)} interface(s)"
+                    f"{' [Accelerated Networking]' if accelnet else ''}\n")
+            for i in real:
+                ipv4 = ", ".join(
+                    (a.get("address") or "") for a in (i.get("ipv4") or [])
+                ) or "-"
+                out += (f"    {i.get('name')}: {i.get('state') or '-'} | "
+                        f"{ipv4} | MAC {i.get('mac') or '-'} | "
+                        f"driver {i.get('driver') or '-'}\n")
+        fw = r.get("firewallRules") or {}
+        if _has_data(fw):
+            out += f"  Firewall: active = {fw.get('active_firewall') or 'none'}\n"
+            out += _list_warnings(fw.get("warnings"))
+        ssh = r.get("sshServiceIssues") or {}
+        if _has_data(ssh):
+            out += f"  SSH issues: {ssh.get('count', 0)} event(s)\n"
+        out += "\n"
+
+    # ---- Events -----
+    def _count(name: str) -> int:
+        v = r.get(name)
+        if isinstance(v, dict):
+            return v.get("count") or len(v.get("events") or [])
+        if isinstance(v, list):
+            return len(v)
+        return 0
+
+    event_counts = {
+        "High CPU": _count("highCpuEvents"),
+        "Cluster": _count("clusterEvents"),
+        "Kernel reboots": _count("kernelReboots"),
+        "OOM killer": _count("oomKiller"),
+        "XFS errors": _count("xfsErrors"),
+        "Automation": _count("automationEvents"),
+        "Emergency mode": _count("emergencyMode"),
+    }
+    if any(event_counts.values()):
+        out += _section("EVENTS")
+        for label, count in event_counts.items():
+            if count:
+                out += f"  {label}: {count} event(s)\n"
+        out += "\n"
+
+    # ---- Packages / RHUI -----
+    pkg_keys = ("distroPackages", "rhuiConfig", "rhelRhuiCheck",
+                "eusVersionLock", "rhuiErrors", "cryptoPolicies",
+                "fipsModeSetup", "kernelCmdline", "kernelTuning",
+                "hugePages")
+    if any(_has_data(r.get(k)) for k in pkg_keys):
+        out += _section("PACKAGES / DISTRIBUTION")
+        dp = r.get("distroPackages") or {}
+        if _has_data(dp):
+            count = dp.get("package_count") or len(dp.get("packages") or {})
+            out += f"  Packages: {count}\n"
+            out += _list_warnings(dp.get("warnings"))
+        rc = r.get("rhuiConfig") or {}
+        if _has_data(rc) and rc.get("repos"):
+            enabled = [x for x in rc["repos"] if x.get("enabled")]
+            out += f"  RHUI Repositories: {len(enabled)} enabled\n"
+        ev = r.get("eusVersionLock") or {}
+        if _has_data(ev):
+            out += f"  EUS releasever: {ev.get('releasever') or 'not locked'}\n"
+        cp = r.get("cryptoPolicies") or {}
+        if _has_data(cp):
+            out += f"  Crypto Policy: {cp.get('policy')}\n"
+        fp = r.get("fipsModeSetup") or {}
+        if _has_data(fp):
+            out += f"  FIPS Mode: {'enabled' if fp.get('fips_enabled') else 'disabled'}\n"
+        kc = r.get("kernelCmdline") or {}
+        if _has_data(kc) and kc.get("cmdline"):
+            out += f"  Kernel cmdline: {kc['cmdline']}\n"
+        re_ = r.get("rhuiErrors") or {}
+        if _has_data(re_):
+            out += f"  RHUI errors: {re_.get('count', 0)}\n"
+        kt = r.get("kernelTuning") or {}
+        if _has_data(kt):
+            out += "  Kernel tuning:\n"
+            for k in ("vm.swappiness", "vm.nr_hugepages",
+                      "net.core.rmem_max", "net.core.wmem_max"):
+                params = kt.get("parameters") or {}
+                if k in params:
+                    out += f"    {k} = {params[k]}\n"
+            out += _list_warnings(kt.get("azure_network_warnings"))
+        hp = r.get("hugePages") or {}
+        if _has_data(hp):
+            total = hp.get("total") or hp.get("nr_hugepages") or 0
+            free = hp.get("free") or hp.get("free_hugepages")
+            size = hp.get("size_kb") or hp.get("hugepagesize_kb")
+            out += f"  HugePages: total={total}"
+            if free is not None:
+                out += f" free={free}"
+            if size:
+                out += f" size={size}KB"
+            out += "\n"
+        out += "\n"
+
+    # ---- Azure agent / extensions -----
+    az_keys = ("waagentConfig", "waagentLog", "azureExtensions",
+               "suseCloudRegister")
+    if any(_has_data(r.get(k)) for k in az_keys):
+        out += _section("AZURE AGENT / EXTENSIONS")
+        wc = r.get("waagentConfig") or {}
+        if _has_data(wc):
+            out += "  waagent.conf: parsed\n"
+            out += _list_warnings(wc.get("warnings"))
+        wl = r.get("waagentLog") or {}
+        if _has_data(wl):
+            out += f"  waagent.log: agent {wl.get('agent_version') or 'unknown'}\n"
+            if wl.get("has_errors"):
+                out += "    [WARN] errors detected\n"
+        ax = r.get("azureExtensions") or {}
+        if _has_data(ax) and ax.get("events"):
+            out += f"  Extensions: {len(ax['events'])}\n"
+            for ev in ax["events"]:
+                marker = "OK " if ev.get("healthy") else "BAD"
+                out += (f"    [{marker}] {ev.get('label')}"
+                        f" v{ev.get('version')} -> {ev.get('status')}\n")
+        sc = r.get("suseCloudRegister") or {}
+        if _has_data(sc):
+            out += (f"  SUSE Cloud Register: "
+                    f"{sc.get('billing_model') or 'n/a'} via "
+                    f"{sc.get('registration_server') or '-'}\n")
+        out += "\n"
+
+    # ---- Security software -----
+    sec_keys = ("falconSensor", "msDefender", "trendMicro", "illumio",
+                "guardicoreAgent")
+    if any(_has_data(r.get(k)) for k in sec_keys):
+        out += _section("SECURITY SOFTWARE")
+        for key, label in (("falconSensor", "CrowdStrike Falcon"),
+                           ("msDefender", "Microsoft Defender"),
+                           ("trendMicro", "Trend Micro"),
+                           ("illumio", "Illumio"),
+                           ("guardicoreAgent", "Guardicore")):
+            v = r.get(key) or {}
+            if _has_data(v):
+                msg = v.get("message") or ""
+                out += f"  {label}: detected"
+                if msg:
+                    out += f" ({msg})"
+                out += "\n"
+        out += "\n"
+
+    # ---- vmcore / kdump -----
+    vm_keys = ("vmcoreDmesg", "kdumpStatus", "crashListing", "kdumpConf")
+    if any(_has_data(r.get(k)) for k in vm_keys):
+        out += _section("KERNEL CRASH DUMPS")
+        ks = r.get("kdumpStatus") or {}
+        if _has_data(ks):
+            out += (f"  Kdump operational: "
+                    f"{'yes' if ks.get('operational') else 'no'}\n")
+        cl = r.get("crashListing") or {}
+        if _has_data(cl):
+            out += (f"  Crash entries: {cl.get('count', 0)}, "
+                    f"{cl.get('total_gb', 0)} GB total\n")
+            for entry in (cl.get("entries") or [])[:5]:
+                out += (f"    - {entry.get('crash_date')}: "
+                        f"{entry.get('size_mb')} MB\n")
+        vd = r.get("vmcoreDmesg") or {}
+        if _has_data(vd):
+            # vmcoreDmesg is per-file; if multi-file merged, fields are scalars.
+            out += "  Latest vmcore-dmesg:\n"
+            if vd.get("panic_reason"):
+                out += f"    Panic: {vd['panic_reason']}\n"
+            if vd.get("kernel_version"):
+                out += f"    Kernel: {vd['kernel_version']}\n"
+            if vd.get("hardware"):
+                out += f"    Hardware: {vd['hardware']}\n"
+            ct = vd.get("call_trace") or []
+            if ct:
+                out += f"    Call trace ({len(ct)} frames, top 5):\n"
+                for frame in ct[:5]:
+                    out += f"      {frame}\n"
+        kdc = r.get("kdumpConf") or {}
+        if _has_data(kdc):
+            out += "  /etc/kdump.conf:\n"
+            for k in ("path", "core_collector", "default_action",
+                      "failure_action"):
+                if kdc.get(k):
+                    out += f"    {k} = {kdc[k]}\n"
+        out += "\n"
+
+    # ---- Debugfs -----
+    if _has_data(r.get("hvBalloon")) or _has_data(r.get("extfrag")):
+        out += _section("DEBUGFS")
+        hv = r.get("hvBalloon") or {}
+        if _has_data(hv):
+            out += (f"  Hyper-V balloon: committed "
+                    f"{hv.get('committed_memory_gb')} GB / max "
+                    f"{hv.get('max_dynamic_memory_gb')} GB\n")
+            out += _list_warnings(hv.get("warnings"))
+        ef = r.get("extfrag") or {}
+        if _has_data(ef):
+            out += (f"  Memory fragmentation zones: "
+                    f"{len(ef.get('zones') or [])}\n")
+            out += _list_warnings(ef.get("warnings"))
+        out += "\n"
+
+    out += SEP + "\n"
+    return out
+
+
+def extract_results(results: ArchiveResults, out_dir: str) -> int:
+    os.makedirs(out_dir, exist_ok=True)
+    count = 0
+    index: Dict[str, str] = {}
+    for name, value in results.parser_results.items():
+        path = os.path.join(out_dir, f"{name}.json")
+        with open(path, "w", encoding="utf-8") as fh:
+            json.dump(value, fh, indent=2)
+        index[name] = f"{name}.json"
+        count += 1
+    summary = {
+        "fileCount": results.file_count,
+        "matchedFiles": results.matched_files,
+        "fileTypes": results.file_types,
+    }
+    with open(os.path.join(out_dir, "summary.json"), "w", encoding="utf-8") as fh:
+        json.dump(summary, fh, indent=2)
+    with open(os.path.join(out_dir, "index.json"), "w", encoding="utf-8") as fh:
+        json.dump({"files": index}, fh, indent=2)
+    return count
+
+
+# ---------------------------------------------------------------------------
+# CLI
+# ---------------------------------------------------------------------------
+
+def list_parsers() -> None:
+    print("\nAvailable parsers:\n")
+    for spec in sorted(PARSERS, key=lambda s: s.name):
+        flag = "  [multi-file]" if spec.multi_file else ""
+        print(f"  {spec.name}{flag}")
+        print(f"    Pattern: {spec.file_pattern.pattern}")
+    print(f"\nTotal: {len(PARSERS)} parsers\n")
+
+
+def main(argv: Optional[List[str]] = None) -> int:
+    parser = argparse.ArgumentParser(
+        prog="rca_cli.py",
+        description=(
+            "RCA CLI (Python). Analyses .tar.xz / .tar.gz / .tar support "
+            "bundles using the supportfile native parser library."
+        ),
+    )
+    parser.add_argument("file", nargs="?",
+                        help="Path to .tar.xz, .tar.gz, or .tar archive")
+    parser.add_argument("-j", "--json", action="store_true",
+                        help="Emit results as JSON instead of text summary")
+    parser.add_argument("-d", "--debug", action="store_true",
+                        help="Enable verbose debug logging on stderr")
+    parser.add_argument("-l", "--list-parsers", action="store_true",
+                        help="List available parsers and exit")
+    parser.add_argument("-p", "--parser", metavar="NAME",
+                        help="Run only the named parser")
+    parser.add_argument("-e", "--extract", metavar="DIR",
+                        help="Write per-parser JSON files to DIR")
+    args = parser.parse_args(argv)
+
+    if args.list_parsers:
+        list_parsers()
+        return 0
+
+    if not args.file:
+        parser.error("missing archive path (or pass --list-parsers)")
+
+    if not os.path.exists(args.file):
+        sys.stderr.write(f"Error: file not found: {args.file}\n")
+        return 2
+
+    sys.stderr.write(f"\nAnalyzing: {args.file}\n")
+    try:
+        results = process_archive(args.file,
+                                  parser_filter=args.parser,
+                                  debug=args.debug)
+    except (tarfile.TarError, ValueError, OSError) as exc:
+        sys.stderr.write(f"Error processing {args.file}: {exc}\n")
+        return 1
+
+    if args.extract:
+        n = extract_results(results, args.extract)
+        sys.stderr.write(f"Extracted {n} parser result files to {args.extract}\n")
+
+    if args.json:
+        payload = {
+            "fileCount": results.file_count,
+            "matchedFiles": results.matched_files,
+            "fileTypes": results.file_types,
+            **results.parser_results,
+        }
+        json.dump(payload, sys.stdout, indent=2)
+        sys.stdout.write("\n")
+    else:
+        sys.stdout.write(format_text(results))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/rca-tool/lib/supportfile_py/pyproject.toml b/rca-tool/lib/supportfile_py/pyproject.toml
new file mode 100644
index 0000000..6860dac
--- /dev/null
+++ b/rca-tool/lib/supportfile_py/pyproject.toml
@@ -0,0 +1,25 @@
+[build-system]
+requires = ["maturin>=1.5,<2.0"]
+build-backend = "maturin"
+
+[project]
+name = "supportfile"
+# Version is sourced dynamically from Cargo.toml (see [tool.maturin] below).
+# In CI, the version in Cargo.toml is overwritten from the pushed git tag by
+# .github/scripts/set-crate-version-from-tag.sh, so the wheel always matches
+# the tag.
+dynamic = ["version"]
+description = "Supportfile library for support file analysis"
+readme = "README.md"
+license = { text = "MIT" }
+requires-python = ">=3.9"
+classifiers = [
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Programming Language :: Python :: Implementation :: CPython",
+    "Programming Language :: Rust",
+    "Operating System :: POSIX :: Linux",
+]
+
+[tool.maturin]
+bindings = "pyo3"
diff --git a/rca-tool/lib/supportfile_py/src/lib.rs b/rca-tool/lib/supportfile_py/src/lib.rs
new file mode 100644
index 0000000..241a206
--- /dev/null
+++ b/rca-tool/lib/supportfile_py/src/lib.rs
@@ -0,0 +1,1572 @@
+//! Python bindings for the Supportfile parser library.
+
+use pyo3::prelude::*;
+use supportfile_core::{
+    parse_automation_events_json, parse_azure_extensions_json, parse_azure_site_recovery_json,
+    parse_azure_vm_generation_json, parse_azure_vm_properties_json,
+    parse_basic_environment_json, parse_block_devices_json,
+    parse_btrfs_config_json, parse_chrony_makestep_json, parse_chrony_tracking_json,
+    parse_cluster_events_json, parse_cluster_maintenance_mode_json, parse_cluster_status_json,
+    parse_corosync_config_json, parse_crash_listing_json, parse_crypto_policies_json,
+    parse_df_output_json, parse_distro_packages_json, parse_dlm_service_json,
+    parse_emergency_mode_json, parse_eus_version_lock_json, parse_extfrag_json,
+    parse_falcon_sensor_config_json, parse_falcon_sensor_json, parse_firewall_rules_json,
+    parse_fips_mode_setup_json, parse_fstab_analysis_json, parse_fstab_json,
+    parse_fstrim_json,
+    parse_guardicore_agent_json, parse_hana_deadlocks_json, parse_hana_merge_errors_json,
+    parse_hana_oom_json, parse_hana_savepoints_json, parse_huge_pages_json, parse_hv_balloon_json,
+    parse_illumio_json, parse_inspect_disk_results_json, parse_involflt_kernel_version_json,
+    parse_involflt_version_json, parse_kdump_conf_json,
+    parse_kdump_status_json, parse_kernel_cmdline_json, parse_kernel_reboots_json,
+    parse_kernel_tuning_json, parse_leapp_log_json, parse_leapp_report_json,
+    parse_lvm_config_json, parse_ms_defender_config_json, parse_ms_defender_json,
+    parse_mtab_analysis_json, parse_network_interfaces_json, parse_nfs_mounts_json,
+    parse_oom_killer_json,
+    parse_os_release_json, parse_pacemaker_high_cpu_json, parse_ptp_clock_source_json,
+    parse_ptp_device_json, parse_raid_config_json, parse_package_distro_mismatch_json,
+    parse_rhel_rhui_check_json,
+    parse_rhui_config_json, parse_rhui_errors_json, parse_secure_boot_json,
+    parse_ssh_service_issues_json,
+    parse_selinux_json, parse_swap_space_json, parse_tuned_profile_json,
+    parse_suse_cloud_register_json, parse_time_sync_json, parse_time_sync_service_json,
+    parse_timedatectl_json, parse_trend_micro_json, parse_vmcore_dmesg_json,
+    parse_vmcore_summary_json, parse_waagent_config_json, parse_waagent_log_json,
+    parse_xfs_errors_json,
+};
+
+// ============================================================================
+// Cluster (Pacemaker / Corosync)
+// ============================================================================
+
+/// Detect Pacemaker high CPU load events.
+///
+/// Scans Pacemaker controld log lines for ``notice: High CPU load detected: <value>``
+/// messages and returns one record per occurrence.
+///
+/// Args:
+///     content (str): Raw log text. Typical sources are ``pacemaker.log``,
+///         ``messages``, ``localmessages``, or ``journalctl*`` outputs from a
+///         supportconfig (SCC) or sosreport (SOS) archive.
+///
+/// Returns:
+///     str: A JSON-encoded list. Each element has the shape
+///     ``{"timestamp": str, "sourceNode": str, "cpuLoad": float,
+///     "lineNumber": int, "rawLine": str}``. Returns ``"[]"`` when no
+///     events are found.
+///
+/// Example:
+///     >>> import json, supportfile
+///     >>> log = "Jan 10 12:23:45 node01 pacemaker-controld[2404]: notice: High CPU load detected: 23.27\n"
+///     >>> events = json.loads(supportfile.parse_high_cpu_events(log))
+///     >>> events[0]["sourceNode"]
+///     'node01'
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_high_cpu_events(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_pacemaker_high_cpu_json(content, source_path))
+}
+
+/// Detect Pacemaker / Corosync cluster lifecycle events.
+///
+/// Multi-file capable: when called repeatedly with rotated log content, the
+/// caller can merge the resulting event lists. Detects node join / leave,
+/// resource start / stop / failover, and fencing (STONITH) actions.
+///
+/// Args:
+///     content (str): Raw text from ``pacemaker.log``, ``corosync.log``,
+///         ``messages``, ``localmessages``, or ``journalctl*`` files
+///         (including rotated ``.1``, ``.2.gz`` siblings).
+///
+/// Returns:
+///     str: JSON-encoded object
+///     ``{"found": bool, "count": int, "events": [{"timestamp", "type",
+///     "node", "resource", "rawLine", ...}]}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_cluster_events(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_cluster_events_json(content, source_path))
+}
+
+/// Parse Pacemaker cluster status (DC, quorum, online/offline nodes).
+///
+/// Args:
+///     content (str): Contents of ``cib.xml``, ``crm_mon*.txt``, ``ha.txt``,
+///         or ``pcs_status``.
+///
+/// Returns:
+///     str: JSON-encoded object
+///     ``{"found": bool, "clusterName": str|None, "dcNode": str|None,
+///     "nodesConfigured": int|None, "resourcesConfigured": int|None,
+///     "nodeStatuses": [{"name": str, "online": bool}], ...}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_cluster_status(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_cluster_status_json(content, source_path))
+}
+
+/// Parse ``corosync.conf`` totem and quorum settings.
+///
+/// Validates token / retransmit / consensus / transport values and quorum
+/// configuration (``two_node``, ``expected_votes``, ``provider``). Emits
+/// warnings for known-bad combinations.
+///
+/// Args:
+///     content (str): Contents of ``corosync.conf`` (or the corosync section
+///         of an aggregated ``ha.txt``).
+///
+/// Returns:
+///     str: JSON-encoded object
+///     ``{"found": bool, "totem": {...}, "quorum": {...}, "warnings": [...]}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_corosync_config(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_corosync_config_json(content, source_path))
+}
+
+/// Detect cluster-wide or per-resource maintenance mode.
+///
+/// Args:
+///     content (str): Contents of ``cib.xml``, ``crm_mon*.txt``, or ``ha.txt``.
+///
+/// Returns:
+///     str: JSON-encoded object
+///     ``{"found": bool, "clusterMaintenanceMode": bool,
+///     "resourcesInMaintenance": [str], "warnings": [...]}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_cluster_maintenance_mode(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_cluster_maintenance_mode_json(content, source_path))
+}
+
+// ============================================================================
+// Automation (Ansible / Puppet / Chef)
+// ============================================================================
+
+/// Detect configuration-management tool executions in system logs.
+///
+/// Scans for Ansible (``ansible-command:``, ``ansible-setup:``), Puppet
+/// (``puppet-agent:``, ``puppet apply``, ``puppet-run:``), and Chef
+/// (``chef-client``, ``chef-solo``, ``chef-apply``) activity. Chef events
+/// include up to 5 lines of context for key phases (Starting Chef,
+/// Converging, FATAL, ERROR, ...).
+///
+/// Args:
+///     content (str): Raw text from ``messages``, ``localmessages``,
+///         ``syslog``, or ``journalctl*`` files.
+///
+/// Returns:
+///     str: JSON-encoded object
+///     ``{"found": bool, "count": int, "events": [{"timestamp", "lineNumber",
+///     "toolType", "patternType", "command", "rawLine", "sourceFile"}]}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_automation_events(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_automation_events_json(content, source_path))
+}
+
+// ============================================================================
+// Azure VM metadata and agent
+// ============================================================================
+
+/// Extract Azure VM properties and infer billing model (PAYG vs BYOS).
+///
+/// Reads the IMDS (Instance Metadata Service) snapshot captured by the
+/// support tooling. The billing model is determined by a two-rule cascade:
+/// ``licenseType`` takes precedence (e.g. ``RHEL_BYOS``, ``SLES``,
+/// ``UBUNTU_PRO``); ``billingCode`` is used as fallback (e.g.
+/// ``Linux_IaaS_SUSE``, ``Linux_IaaS``).
+///
+/// Args:
+///     content (str): Either JSON content from ``instance_metadata.json``
+///         (sosreport) or the key-value text of ``public_cloud/metadata.txt``
+///         (supportconfig).
+///
+/// Returns:
+///     str: JSON-encoded object
+///     ``{"found", "vmSize", "publisher", "offer", "sku", "billingCode",
+///     "licenseType", "billingModel", "detectionMethod", "osDiskType",
+///     "dataDisks", "hasUltraDisk", "hasPremiumV2"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_azure_vm_properties(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_azure_vm_properties_json(content, source_path))
+}
+
+/// Classify Azure VM generation from ``vmSize`` and flag legacy generations.
+///
+/// Args:
+///     content (str): IMDS JSON content or key-value metadata text.
+///
+/// Returns:
+///     str: JSON object ``{"found", "vmSize", "vmGeneration",
+///     "isLegacyGeneration", "recommendation"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_azure_vm_generation(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_azure_vm_generation_json(content, source_path))
+}
+
+/// Detect SUSE cloud registration server and infer billing model.
+///
+/// PAYG indicators: ``smt-azure``, ``susecloud.net``, ``update.suse.com``.
+/// BYOS indicators: ``scc.suse.com`` and custom RMT servers.
+///
+/// Args:
+///     content (str): Contents of ``public_cloud/cloudregister.txt``.
+///
+/// Returns:
+///     str: JSON-encoded object
+///     ``{"found", "billingModel", "detectionMethod",
+///     "registrationServer", "registrationType"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_suse_cloud_register(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_suse_cloud_register_json(content, source_path))
+}
+
+/// Detect UEFI Secure Boot state from the sosreport ``mokutil --sb-state``
+/// capture (``sos_commands/boot/mokutil_--sb-state``).
+///
+/// Args:
+///     content (str): Output of ``mokutil --sb-state``.
+///     source_path (str): Optional source path for provenance.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "enabled", "supported",
+///     "stateText", "sourcePath", "sourceLine"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_secure_boot(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_secure_boot_json(content, source_path))
+}
+
+/// Parse the Azure Linux Agent (waagent) configuration file.
+///
+/// Extracts settings from groups Extensions, Provisioning, ResourceDisk,
+/// Firewall, FIPS, SCSI timeout, Logging, and AutoUpdate. Warnings are
+/// raised when extensions are disabled, swap is enabled on the resource
+/// disk, the OS firewall is disabled, or FIPS mode is enabled.
+///
+/// Args:
+///     content (str): Contents of ``/etc/waagent.conf`` (INI-like
+///         ``key=value``, no sections).
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "config": {...}, "warnings": [...]}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_waagent_config(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_waagent_config_json(content, source_path))
+}
+
+/// Parse the Azure Linux Agent runtime log (``waagent.log``).
+///
+/// Extracts the agent version (and history of versions seen), goal-state
+/// errors, extension enable/operation failures, resource disk errors, IMDS
+/// connectivity errors, and a summary of extension status reports.
+///
+/// Args:
+///     content (str): Contents of ``waagent.log`` (timestamped lines).
+///
+/// Returns:
+///     str: JSON-encoded object
+///     ``{"found", "agentVersion", "agentVersionHistory", "errors",
+///     "warnings", "goalStateErrors", "extensionErrors",
+///     "resourceDiskErrors", "imdsErrors", "extensionStatusSummary",
+///     "hasErrors", "hasWarnings"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_waagent_log(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_waagent_log_json(content, source_path))
+}
+
+/// Parse a single Azure VM extension status JSON document.
+///
+/// Reads one extension status file (such as those under
+/// ``/var/lib/waagent/.../status/*.status``), maps the publisher/extension
+/// name to a friendly label (Microsoft Defender for Endpoint, Azure Backup,
+/// Azure Update Manager, Azure Monitor Agent, Run Command, ...), and reports
+/// whether the extension is healthy (``status == "Ready"`` and ``code == 0``).
+///
+/// Args:
+///     content (str): JSON content of a single ``*.status`` document.
+///
+/// Returns:
+///     str: JSON-encoded object
+///     ``{"found", "count", "events": [{"name", "label", "version",
+///     "status", "code", "message", "healthy"}]}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_azure_extensions(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_azure_extensions_json(content, source_path))
+}
+
+// ============================================================================
+// Debugfs (Hyper-V balloon, memory fragmentation)
+// ============================================================================
+
+/// Parse the Hyper-V Dynamic Memory balloon driver status.
+///
+/// Computes committed and maximum memory from page counts and emits warnings
+/// when ballooning is active (``pages_ballooned > 0``) or memory is near
+/// capacity (``committed > 90% of max``).
+///
+/// Args:
+///     content (str): Contents of ``sys/kernel/debug/hv-balloon`` (or
+///         ``hv_balloon``).
+///
+/// Returns:
+///     str: JSON-encoded object
+///     ``{"found", "hostVersion", "capabilities", "state", "stateText",
+///     "pageSize", "pagesAdded", "pagesOnlined", "pagesBallooned",
+///     "totalPagesCommitted", "maxDynamicPageCount", "committedMemoryGB",
+///     "maxDynamicMemoryGB", "balloonedMemoryMB", "warnings", "rawContent"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_hv_balloon(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_hv_balloon_json(content, source_path))
+}
+
+/// Parse memory fragmentation indices per NUMA node and zone.
+///
+/// Reads ``extfrag_index`` / ``unusable_index`` values for orders 0-10
+/// (4KiB through 4MiB page sizes) and flags high fragmentation at huge-page
+/// orders (9+).
+///
+/// Args:
+///     content (str): Contents of ``sys/kernel/debug/extfrag/extfrag_index``
+///         or ``sys/kernel/debug/extfrag/unusable_index``.
+///
+/// Returns:
+///     str: JSON-encoded object
+///     ``{"found", "zones": [{"node", "zone", "extfragIndex": [...],
+///     "unusableIndex": [...]}], "warnings": [...], "rawContent"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_extfrag(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_extfrag_json(content, source_path))
+}
+
+// ============================================================================
+// Kernel and system events
+// ============================================================================
+
+/// Detect ``You are in emergency mode`` events.
+///
+/// Args:
+///     content (str): Raw text from ``messages``, ``localmessages``, or
+///         ``journalctl*``.
+///
+/// Returns:
+///     str: JSON-encoded object
+///     ``{"found", "count", "events": [{"timestamp", "lineNumber",
+///     "rawLine", "sourceFile"}]}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_emergency_mode(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_emergency_mode_json(content, source_path))
+}
+
+/// Detect kernel boot and reboot events.
+///
+/// Matches ``Linux version X.Y.Z`` boots, ``systemd ... Shutting down`` /
+/// ``Starting Reboot`` events, and ``kernel: reboot:`` messages.
+///
+/// Args:
+///     content (str): Raw log text.
+///
+/// Returns:
+///     str: JSON-encoded object
+///     ``{"count", "events": [{"timestamp", "lineNumber", "kernelVersion",
+///     "type", "rawLine"}]}`` where ``type`` is ``kernel_boot``,
+///     ``systemd_shutdown``, or ``reboot_message``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_kernel_reboots(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_kernel_reboots_json(content, source_path))
+}
+
+/// Detect Out-of-Memory killer activity.
+///
+/// Finds actual OOM kills (``Out of memory: Kill process PID (name)``),
+/// OOM invocations (``invoked oom-killer:``), post-kill cleanup
+/// (``oom_reaper:``), and allocation failures (``Cannot allocate memory``).
+///
+/// Args:
+///     content (str): Raw log text.
+///
+/// Returns:
+///     str: JSON-encoded object
+///     ``{"count", "events": [{"timestamp", "lineNumber", "pid",
+///     "processName", "score", "totalVM", "type", "rawLine"}]}`` where
+///     ``type`` is ``oom_kill``, ``oom_invoked``, ``oom_reaper``, or
+///     ``alloc_failure``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_oom_killer(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_oom_killer_json(content, source_path))
+}
+
+/// Detect critical XFS filesystem errors that require manual repair.
+///
+/// Matches ``Please unmount the filesystem and rectify the problem(s)``,
+/// metadata/corruption detection, and filesystem shutdown messages.
+///
+/// Args:
+///     content (str): Raw log text.
+///
+/// Returns:
+///     str: JSON-encoded object
+///     ``{"count", "events": [{"timestamp", "lineNumber", "device",
+///     "message", "rawLine"}]}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_xfs_errors(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_xfs_errors_json(content, source_path))
+}
+
+// ============================================================================
+// Networking
+// ============================================================================
+
+/// Parse firewall configuration (firewalld, nftables, iptables, ip6tables, ebtables).
+///
+/// Classifies the active firewall technology. Resolution priority:
+/// firewalld running > nftables with non-empty ruleset > iptables with
+/// parsed rules > ip6tables with parsed rules > none.
+///
+/// Args:
+///     content (str): Contents of an SCC ``network.txt`` (aggregated,
+///         section-delimited with ``#==[ Command ]===``) or any of the SOS
+///         per-command files under ``sos_commands/firewalld/``,
+///         ``sos_commands/firewall_tables/``, or sysconfig files such as
+///         ``etc/sysconfig/iptables-config`` and ``etc/firewalld/firewalld.conf``.
+///
+/// Returns:
+///     str: JSON-encoded object
+///     ``{"found", "firewalld": {...}, "iptables": {...}, "ip6tables": {...},
+///     "ebtables": {...}, "nftables": {...}, "activeFirewall",
+///     "warnings", "rawSections"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_firewall_rules(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_firewall_rules_json(content, source_path))
+}
+
+/// Build a unified view of network interfaces from IP / driver / config data.
+///
+/// Correlates ``ip addr``, ``ip -s -d link``, ``ethtool -i``, ``ifcfg-*``,
+/// ``nmcli con show``, ``wicked ifstatus``, netplan YAML, and cloud-init
+/// ``ci-info`` tables. Detects Azure Accelerated Networking via known
+/// driver names (``mlx4_*``, ``mlx5_core``, ``mana``).
+///
+/// Args:
+///     content (str): One file's content. Typical sources include SCC
+///         ``network.txt``, SOS ``sos_commands/networking/*``, and config
+///         files under ``etc/sysconfig/network-scripts/`` or ``etc/netplan/``.
+///
+/// Returns:
+///     str: JSON-encoded object
+///     ``{"found", "interfaces": {<name>: {"name", "state", "mac", "mtu",
+///     "ipv4": [...], "ipv6": [...], "driver", "driverInfo", "accelNet",
+///     "bootproto", "master", "type"}}, "raw": {...}}``.
+///
+/// Note:
+///     This is a multi-file parser; merge per-file outputs in the caller for
+///     a full system view.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_network_interfaces(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_network_interfaces_json(content, source_path))
+}
+
+// ============================================================================
+// Packages
+// ============================================================================
+
+/// Parse installed-package listings and validate Azure-critical versions.
+///
+/// Supports dpkg (``dpkg_-l``), dnf/yum installed lists, RPM listings
+/// (``rpm.txt``, ``installed-rpms``, ``package-data``), zypper history, and
+/// dnf/yum logs. For RPM-style sources it validates Azure-critical packages
+/// against minimum version rules:
+///
+/// * ``fence-agents`` >= 4.4
+/// * ``python3-azure-mgmt-compute`` >= 17.0
+/// * ``python3-azure-identity`` >= 1.0
+/// * ``cloud-netconfig-azure`` >= 1.3
+/// * ``resource-agents`` >= 4.3
+/// * ``python3-azure-core`` < 1.9 or > 1.22 (problematic range)
+///
+/// Args:
+///     content (str): Package listing content.
+///
+/// Returns:
+///     str: JSON-encoded object. RPM-validated:
+///     ``{"found", "packages", "warnings"}``. Raw listings:
+///     ``{"found", "isDpkg" | "isRpmRaw", "rawContent", "filename",
+///     "packageCount"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_distro_packages(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_distro_packages_json(content, source_path))
+}
+
+/// Detect cross-distro and major-version package drift.
+///
+/// Examples:
+/// * SUSE packages on a RHEL host
+/// * ``.el7`` packages on a RHEL 9 host
+///
+/// Args:
+///     content (str): Package listing content.
+///     running_distro_id (str): Host distro ID (e.g. ``rhel``, ``sles``).
+///     running_version_id (str): Host distro version (e.g. ``9.4``, ``15.6``).
+///     source_path (str): Optional source path.
+///
+/// Returns:
+///     str: JSON object ``{"found", "count", "mismatches": [...],
+///     "runningDistroId", "runningVersionId"}``.
+#[pyfunction]
+#[pyo3(signature = (content, running_distro_id, running_version_id, source_path=""))]
+fn parse_package_distro_mismatch(
+    content: &str,
+    running_distro_id: &str,
+    running_version_id: &str,
+    source_path: &str,
+) -> PyResult<String> {
+    Ok(parse_package_distro_mismatch_json(
+        content,
+        source_path,
+        running_distro_id,
+        running_version_id,
+    ))
+}
+
+// ============================================================================
+// System services
+// ============================================================================
+
+/// Detect SSH daemon start failures and ``/var/empty/sshd`` permission errors.
+///
+/// Args:
+///     content (str): Raw log text (``messages``, ``journalctl*``).
+///
+/// Returns:
+///     str: JSON-encoded object
+///     ``{"found", "count", "events": [{"timestamp", "lineNumber",
+///     "rawLine"}]}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_ssh_service_issues(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_ssh_service_issues_json(content, source_path))
+}
+
+/// Detect the DLM (Distributed Lock Manager) service enabled in systemd.
+///
+/// DLM enabled outside of Pacemaker control conflicts with cluster-managed
+/// lock resources. Severity: ``error``.
+///
+/// Args:
+///     content (str): Contents of systemd unit listings (``systemctl
+///         list-unit-files``, ``systemd.txt``).
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "enabled", "warnings"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_dlm_service(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_dlm_service_json(content, source_path))
+}
+
+/// Detect the Azure Site Recovery ``involflt_start`` service.
+///
+/// Args:
+///     content (str): Contents of systemd unit listings.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "enabled"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_azure_site_recovery(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_azure_site_recovery_json(content, source_path))
+}
+
+/// Detect the Guardicore micro-segmentation agent (``gc-agent``).
+///
+/// Args:
+///     content (str): Contents of systemd unit listings.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "running", "details"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_guardicore_agent(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_guardicore_agent_json(content, source_path))
+}
+
+/// Detect Illumio security platform installation.
+///
+/// Args:
+///     content (str): Contents of systemd unit listings.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "running", "details"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_illumio(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_illumio_json(content, source_path))
+}
+
+/// Detect Trend Micro Deep Security (``ds_agent.service``).
+///
+/// Args:
+///     content (str): Contents of systemd unit listings.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "running", "details"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_trend_micro(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_trend_micro_json(content, source_path))
+}
+
+/// Detect CrowdStrike Falcon Sensor (``falcon-sensor`` RPM, ``/opt/CrowdStrike`` process).
+///
+/// Args:
+///     content (str): RPM listing or process table content.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "installed", "running",
+///     "version"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_falcon_sensor(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_falcon_sensor_json(content, source_path))
+}
+
+/// Inspect CrowdStrike Falcon Sensor configuration for SAP exclusions.
+///
+/// Returns warnings when SAP workload exclusions are not configured.
+///
+/// Args:
+///     content (str): Contents of CrowdStrike / falcon configuration files.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "exclusions", "warnings"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_falcon_sensor_config(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_falcon_sensor_config_json(content, source_path))
+}
+
+/// Detect Microsoft Defender for Endpoint (``mdatp`` RPM, ``wdavdaemon``).
+///
+/// Args:
+///     content (str): RPM listing or process table content.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "installed", "running",
+///     "version"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_ms_defender(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_ms_defender_json(content, source_path))
+}
+
+/// Inspect Microsoft Defender configuration for SAP exclusions.
+///
+/// Args:
+///     content (str): Contents of mdatp / defender configuration files.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "exclusions", "warnings"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_ms_defender_config(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_ms_defender_config_json(content, source_path))
+}
+
+/// Read the Azure Site Recovery ``involflt`` driver version from ``modinfo``.
+///
+/// Args:
+///     content (str): Contents of ``modules.txt`` (modinfo section).
+///
+/// Returns:
+///     str: JSON-encoded object ``{"version", "buildDate", "loaded",
+///     "filename"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_involflt_version(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_involflt_version_json(content, source_path))
+}
+
+/// Read the Azure Site Recovery ``involflt`` driver version from kernel logs.
+///
+/// Args:
+///     content (str): Contents of ``messages*.txt`` or ``boot.txt``.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"version", "source": "kernel_log"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_involflt_kernel_version(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_involflt_kernel_version_json(content, source_path))
+}
+
+// ============================================================================
+// Storage
+// ============================================================================
+
+/// Parse LVM physical volumes, volume groups, and logical volumes.
+///
+/// Cross-validates each PV's VG reference against the VG list and flags
+/// "Missing VG" and "PV Count Mismatch" warnings.
+///
+/// Args:
+///     content (str): Contents of ``lvm.txt``, ``pvs.txt``, ``vgs.txt``,
+///         ``lvs.txt``, or ``pv|vg|lvdisplay`` outputs.
+///
+/// Returns:
+///     str: JSON-encoded object
+///     ``{"found", "pvs": [...], "vgs": [...], "lvs": [...],
+///     "warnings": [...], "rawOutput"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_lvm_config(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_lvm_config_json(content, source_path))
+}
+
+/// Parse ``/proc/mdstat`` RAID arrays.
+///
+/// Detects degraded state, faulty devices, and rebuild progress; emits
+/// "Faulty Device" and "Degraded Array" warnings.
+///
+/// Args:
+///     content (str): Contents of ``mdstat``, ``md-arrays.txt``,
+///         ``mdadm.txt``, or ``proc/mdstat``.
+///
+/// Returns:
+///     str: JSON-encoded object
+///     ``{"found", "arrays": [{"device", "state", "level", "devices",
+///     "syncStatus"}], "warnings": [...], "rawOutput"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_raid_config(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_raid_config_json(content, source_path))
+}
+
+/// Parse BTRFS filesystem inventory and subvolume list.
+///
+/// Args:
+///     content (str): Contents of ``btrfs.txt``, ``fs-btrfs.txt``,
+///         ``btrfs-filesystem-show.txt``, or ``btrfs-subvolume-list.txt``.
+///
+/// Returns:
+///     str: JSON-encoded object
+///     ``{"found", "filesystems": [{"label", "uuid", "devices",
+///     "totalSize"}], "subvolumes": [...], "warnings": [...], "rawOutput"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_btrfs_config(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_btrfs_config_json(content, source_path))
+}
+
+/// Build a disk and partition inventory with UUID, filesystem type, and mounts.
+///
+/// Args:
+///     content (str): Contents of ``lsblk``, ``lsblk_-f_-a_-l``,
+///         ``blkid_-c_.dev.null``, or InspectIaaSDisk ``results.txt``.
+///
+/// Returns:
+///     str: JSON-encoded object
+///     ``{"found", "disks", "partitions", "uuidMap", "deviceMap",
+///     "mountPoints", "warnings", "rawOutput"}``.
+///
+/// Note:
+///     Multi-file parser; merge results across input files in the caller.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_block_devices(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_block_devices_json(content, source_path))
+}
+
+/// Analyse ``/etc/fstab`` entries with mount-option classification.
+///
+/// Each entry is classified by ``sourceType`` (``uuid``, ``device``,
+/// ``label``, ``network``) and flagged for ``hasNofail``,
+/// ``isOsPartition``, ``isVirtualFs``, and ``needsNofail``. Missing-nofail
+/// warnings include a link to the Azure fstab best-practices doc.
+///
+/// Args:
+///     content (str): Contents of ``/etc/fstab`` or the fstab section of
+///         ``fs-diskio.txt``.
+///
+/// Returns:
+///     str: JSON-encoded object
+///     ``{"found", "entries", "uuidEntries", "deviceEntries",
+///     "labelEntries", "warnings"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_fstab_analysis(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_fstab_analysis_json(content, source_path))
+}
+
+/// Parse ``df`` filesystem usage output.
+///
+/// Args:
+///     content (str): Contents of ``df``, ``df_-aliT``, ``df_-al_``, or
+///         the df section of ``fs-diskio.txt``.
+///
+/// Returns:
+///     str: JSON-encoded object
+///     ``{"found", "filesystems": [...], "mountToUsage": {...}}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_df_output(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_df_output_json(content, source_path))
+}
+
+/// Compare mounted filesystems against fstab to find unmanaged mounts.
+///
+/// ``extraMounts`` lists mounts present in mtab but absent from fstab
+/// (excluding virtual filesystems), indicating hand-mounted or
+/// cluster-managed partitions.
+///
+/// Args:
+///     content (str): Contents of ``/etc/mtab``, ``proc/mounts``,
+///         ``proc/self/mounts``, ``mount_-l``, or the mount section of
+///         ``fs-diskio.txt``.
+///
+/// Returns:
+///     str: JSON-encoded object
+///     ``{"found", "entries", "extraMounts", "rawContent"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_mtab_analysis(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_mtab_analysis_json(content, source_path))
+}
+
+/// Parse NFS mount entries from ``fstab`` or ``mount``/``mtab`` output and flag
+/// suboptimal mount options (soft mounts, small ``rsize``/``wsize``, outdated
+/// protocol versions, missing ``nconnect``).
+///
+/// Args:
+///     content (str): Raw text of an ``fstab`` file or ``mount`` output, or an
+///         SCC bundle that embeds either.
+///     source_path (str): Optional path of the source file used for provenance.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "mounts", "warnings",
+///     "source_path"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_nfs_mounts(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_nfs_mounts_json(content, source_path))
+}
+
+/// Detect SAP HANA savepoint activity in indexserver/nameserver trace files.
+///
+/// Args:
+///     content (str): Contents of a HANA ``*.trc`` trace file.
+///     source_path (str): Optional path of the source file used for provenance.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "count", "snapshot_count",
+///     "savepoints", "warnings", "source_path"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_hana_savepoints(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_hana_savepoints_json(content, source_path))
+}
+
+/// Detect SAP HANA deadlock cycles in indexserver/nameserver trace files.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_hana_deadlocks(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_hana_deadlocks_json(content, source_path))
+}
+
+/// Detect SAP HANA out-of-memory events in indexserver/nameserver trace files.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_hana_oom(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_hana_oom_json(content, source_path))
+}
+
+/// Detect SAP HANA delta-merge / optimize-compression failures.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_hana_merge_errors(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_hana_merge_errors_json(content, source_path))
+}
+
+// ============================================================================
+// OS identity
+// ============================================================================
+
+/// Fallback OS identification from supportconfig basic-environment.
+///
+/// Also detects SAP and EPIC product markers.
+///
+/// Args:
+///     content (str): Contents of ``basic-environment.txt``.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "osName", "osVersion",
+///     "kernel", "hasSAP", "hasEPIC", ...}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_basic_environment(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_basic_environment_json(content, source_path))
+}
+
+/// Primary OS identification via ``/etc/os-release`` or distro release files.
+///
+/// Detects SLES, RHEL, Ubuntu, Oracle, Alma, and Rocky.
+///
+/// Args:
+///     content (str): Contents of ``os-release``, ``sysinfo.txt``,
+///         ``redhat-release``, ``centos-release``, ``SuSE-release``, or
+///         ``system-release``.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "id", "name", "version",
+///     "versionId", "prettyName", ...}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_os_release(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_os_release_json(content, source_path))
+}
+
+/// Extract ``/etc/fstab`` entries with mount options.
+///
+/// Companion to :func:`parse_fstab_analysis` for callers that just need the
+/// raw entries without classification.
+///
+/// Args:
+///     content (str): Contents of ``/etc/fstab`` or the fstab section of
+///         ``fs-diskio.txt``.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "entries": [{"device",
+///     "mountPoint", "fsType", "options", "dump", "pass"}]}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_fstab(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_fstab_json(content, source_path))
+}
+
+// ============================================================================
+// InspectIaaSDisk
+// ============================================================================
+
+/// Parse InspectIaaSDisk diagnostic output.
+///
+/// Extracts request info, filesystem status, OS metadata, mount points, and
+/// mount failures.
+///
+/// Args:
+///     content (str): Contents of an InspectIaaSDisk ``results.txt``.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "requestInfo", "filesystem",
+///     "osMetadata", "mountPoints", "mountFailures"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_inspect_disk_results(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_inspect_disk_results_json(content, source_path))
+}
+
+// ============================================================================
+// Kernel tuning
+// ============================================================================
+
+/// Parse sysctl parameters from runtime output or static config files.
+///
+/// Flags SAP HANA and Azure network tuning settings.
+///
+/// Args:
+///     content (str): Contents of ``env.txt``, ``sysctl.conf``,
+///         ``sysctl.d/*.conf``, or ``sysctl_-a``.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "params": {...},
+///     "warnings": [...]}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_kernel_tuning(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_kernel_tuning_json(content, source_path))
+}
+
+/// Report HugePages allocation (total, free, size).
+///
+/// Args:
+///     content (str): Contents of ``proc/meminfo``,
+///         ``basic-environment.txt``, or ``memory.txt``.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "hugePagesTotal", "hugePagesFree",
+///     "hugePageSize", ...}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_huge_pages(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_huge_pages_json(content, source_path))
+}
+
+// ============================================================================
+// Time synchronisation (Azure PTP)
+// ============================================================================
+
+/// Detect ``hv_utils`` and PTP clock-source modules; check PHC index assignment.
+///
+/// Args:
+///     content (str): Contents of ``env.txt``, ``boot.txt``, or relevant
+///         ``proc/`` files.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "hvUtilsLoaded", "ptpDevices",
+///     "phcIndex", ...}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_time_sync(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_time_sync_json(content, source_path))
+}
+
+/// Verify chrony / NTP is configured with ``refclock PHC /dev/ptp_hyperv``.
+///
+/// Args:
+///     content (str): Contents of ``chrony.conf``, ``ntp.conf``, or files
+///         under ``etc/chrony*`` / ``etc/ntp*``.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "azurePtpConfigured",
+///     "refclock", "warnings"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_ptp_clock_source(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_ptp_clock_source_json(content, source_path))
+}
+
+/// Detect which time-sync service (chrony, ntpd, systemd-timesyncd) is active.
+///
+/// Args:
+///     content (str): Contents of ``ntp.txt``, ``chrony*``,
+///         ``timekeeping.txt``, or systemd unit files.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "activeService",
+///     "serviceState", "configFiles"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_time_sync_service(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_time_sync_service_json(content, source_path))
+}
+
+/// Parse ``timedatectl`` output (NTP enabled / synchronised, source).
+///
+/// Args:
+///     content (str): Contents of ``ntp.txt``, ``timekeeping.txt``, or
+///         ``timedatectl``.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "ntpEnabled", "ntpSynchronized",
+///     "ntpService", "timezone", ...}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_timedatectl(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_timedatectl_json(content, source_path))
+}
+
+/// Enumerate PTP devices and check for ``/dev/ptp_hyperv`` symlink.
+///
+/// Args:
+///     content (str): Contents of ``env.txt``, ``boot.txt``, or relevant
+///         ``proc/`` / ``dev/`` listings.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "devices": [...],
+///     "hasHypervSymlink"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_ptp_device(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_ptp_device_json(content, source_path))
+}
+
+/// Parse ``chronyc tracking`` output (stratum, system time offset, leap status).
+///
+/// Args:
+///     content (str): Contents of ``ntp.txt``, ``timekeeping.txt``, or
+///         ``chronyc_tracking``.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "stratum", "systemTimeOffset",
+///     "leapStatus", "referenceId", ...}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_chrony_tracking(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_chrony_tracking_json(content, source_path))
+}
+
+/// Check whether ``makestep`` is configured in chrony for initial corrections.
+///
+/// Args:
+///     content (str): Contents of ``chrony.conf`` or files under
+///         ``etc/chrony*``.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "makestepConfigured",
+///     "makestepValue"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_chrony_makestep(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_chrony_makestep_json(content, source_path))
+}
+
+// ============================================================================
+// RHUI (Red Hat Update Infrastructure)
+// ============================================================================
+
+/// Detect Azure RHUI repositories (EUS, non-EUS, E4S, SAP) and dnf plugins.
+///
+/// Args:
+///     content (str): Contents of ``updates.txt`` or files under
+///         ``yum.repos.d/`` and ``plugin.conf.d/``.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "rhuiType", "repos": [...],
+///     "plugins": [...]}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_rhui_config(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_rhui_config_json(content, source_path))
+}
+
+/// Read the ``releasever`` lock value used for EUS pinning.
+///
+/// Args:
+///     content (str): Contents of ``updates.txt``, ``yum.conf``,
+///         ``dnf.conf``, or ``releasever``.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "releasever", "source"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_eus_version_lock(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_eus_version_lock_json(content, source_path))
+}
+
+/// Check RHUI client install, TLS certificates, and content set entitlements.
+///
+/// Args:
+///     content (str): Contents of ``updates.txt``, files under ``rhui/``,
+///         or ``rpm_-qa``.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "clientInstalled",
+///     "certificateValid", "entitlements", "warnings"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_rhel_rhui_check(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_rhel_rhui_check_json(content, source_path))
+}
+
+/// Detect RHUI connectivity errors from package-manager logs.
+///
+/// Categories: TLS, DNS, 404, repo metadata.
+///
+/// Args:
+///     content (str): Contents of ``updates.txt``, ``dnf.log``,
+///         ``yum.log``, or ``messages``.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "count", "errors": [{"timestamp",
+///     "category", "rawLine"}]}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_rhui_errors(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_rhui_errors_json(content, source_path))
+}
+
+// ============================================================================
+// Security (FIPS / crypto policies)
+// ============================================================================
+
+/// Report the active crypto policy on RHEL 8+ (DEFAULT, LEGACY, FUTURE, FIPS).
+///
+/// Args:
+///     content (str): Contents of ``crypto-policies/config`` or ``updates.txt``.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "policy", "subPolicies"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_crypto_policies(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_crypto_policies_json(content, source_path))
+}
+
+/// Parse ``fips-mode-setup --check`` output.
+///
+/// Detects FIPS enabled / disabled and inconsistent state.
+///
+/// Args:
+///     content (str): Contents of
+///         ``sos_commands/crypto/fips-mode-setup_--check``.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "fipsEnabled", "consistent",
+///     "rawOutput"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_fips_mode_setup(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_fips_mode_setup_json(content, source_path))
+}
+
+/// Parse ``tuned-adm active`` output to report the active tuned profile.
+///
+/// Args:
+///     content (str): Contents of
+///         ``sos_commands/tuned/tuned-adm_active`` or similar.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "activeProfile", "warnings",
+///     "recommendations"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_tuned_profile(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_tuned_profile_json(content, source_path))
+}
+
+/// Parse SELinux mode from ``/etc/selinux/config`` or ``sestatus`` output.
+///
+/// Args:
+///     content (str): Contents of ``etc/selinux/config`` or
+///         ``sos_commands/selinux/sestatus``.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "configMode", "currentMode",
+///     "warnings", "recommendations"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_selinux(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_selinux_json(content, source_path))
+}
+
+/// Parse swap space totals from ``/proc/meminfo`` (or ``free`` output).
+///
+/// Args:
+///     content (str): Contents of ``proc/meminfo``.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "swapTotalKb", "swapFreeKb",
+///     "warnings"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_swap_space(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_swap_space_json(content, source_path))
+}
+
+/// Parse the state of the ``fstrim.timer`` systemd unit.
+///
+/// Args:
+///     content (str): Output of ``systemctl is-enabled fstrim.timer`` or a
+///         ``systemctl list-unit-files`` listing.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "timerEnabled", "timerState",
+///     "warnings"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_fstrim(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_fstrim_json(content, source_path))
+}
+
+/// Parse the kernel command line; detect ``fips=1`` and other notable params.
+///
+/// Args:
+///     content (str): Contents of ``proc/cmdline`` or ``boot.txt``.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "cmdline", "fips",
+///     "params": {...}}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_kernel_cmdline(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_kernel_cmdline_json(content, source_path))
+}
+
+// ============================================================================
+// Leapp in-place upgrade
+// ============================================================================
+
+/// Parse the Leapp pre-upgrade / upgrade report.
+///
+/// Categorises findings by severity (high, medium, low, info) with
+/// remediation hints.
+///
+/// Args:
+///     content (str): Contents of ``leapp-report.txt`` or ``leapp-report.json``.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "findings": [{"severity",
+///     "title", "summary", "remediation"}], "summary": {...}}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_leapp_report(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_leapp_report_json(content, source_path))
+}
+
+/// Scan the Leapp upgrade log for errors, inhibitors, and phase failures.
+///
+/// Args:
+///     content (str): Contents of ``leapp-upgrade.log`` or ``leapp.log``.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "errors": [...],
+///     "inhibitors": [...], "phaseFailures": [...]}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_leapp_log(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_leapp_log_json(content, source_path))
+}
+
+// ============================================================================
+// vmcore / kdump
+// ============================================================================
+
+/// Parse the kernel dmesg captured at the time of a crash.
+///
+/// Args:
+///     content (str): Contents of ``var/crash/<dir>/vmcore-dmesg.txt``.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "crashes": [{"date",
+///     "panicReason", "kernelVersion", "callTrace", "comm", "pid",
+///     "tainted", ...}]}``. Each crash carries the date parsed from the
+///     directory name (e.g. ``127.0.0.1-2026-02-13-03:48:00``).
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_vmcore_dmesg(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_vmcore_dmesg_json(content, source_path))
+}
+
+/// Parse ``kdumpctl status`` to check whether kdump is operational.
+///
+/// Args:
+///     content (str): Contents of ``sos_commands/kdump/kdumpctl_status``.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "operational", "raw"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_kdump_status(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_kdump_status_json(content, source_path))
+}
+
+/// Parse a directory listing of ``/var/crash`` to obtain vmcore file sizes.
+///
+/// Args:
+///     content (str): Contents of ``sos_commands/kdump/ls_-alZR_.var.crash``.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "entries": [{"directory",
+///     "crashDate", "sizeBytes", "sizeMB", "sizeGB"}], "count",
+///     "totalBytes", "totalGB"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_crash_listing(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_crash_listing_json(content, source_path))
+}
+
+/// Parse ``/etc/kdump.conf`` (dump path, core_collector, failure_action).
+///
+/// Args:
+///     content (str): Contents of ``etc/kdump.conf``.
+///
+/// Returns:
+///     str: JSON-encoded object ``{"found", "path", "coreCollector",
+///     "defaultAction", "raw"}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_kdump_conf(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_kdump_conf_json(content, source_path))
+}
+
+/// Build a consolidated vmcore summary from the dmesg / status / listing / conf inputs.
+///
+/// Use this when you have already concatenated or wish to summarise a single
+/// vmcore-related document. For full multi-file analysis, call the four
+/// per-file parsers (:func:`parse_vmcore_dmesg`, :func:`parse_kdump_status`,
+/// :func:`parse_crash_listing`, :func:`parse_kdump_conf`) and merge the
+/// results in the caller.
+///
+/// Args:
+///     content (str): Combined or single-file vmcore-related content.
+///
+/// Returns:
+///     str: JSON-encoded object
+///     ``{"found", "crashes": [...], "kdumpStatus": {...},
+///     "crashListing": {...}, "kdumpConf": {...}}``.
+#[pyfunction]
+#[pyo3(signature = (content, source_path=""))]
+fn parse_vmcore_summary(content: &str, source_path: &str) -> PyResult<String> {
+    Ok(parse_vmcore_summary_json(content, source_path))
+}
+
+// ============================================================================
+// Module
+// ============================================================================
+
+/// Native parsers from the Supportfile (RCA Tool) Rust core.
+///
+/// This module exposes a flat set of ``parse_*`` functions that turn raw
+/// text content (typically a single file from a Linux supportconfig (SCC)
+/// or sosreport (SOS) archive) into a JSON document describing what was
+/// found.
+///
+/// Conventions
+/// -----------
+/// * Every function takes a single ``content: str`` argument: the raw text
+///   of one file. The Python wrapper does not read files for you.
+/// * Every function returns a ``str`` containing JSON. Use ``json.loads()``
+///   to obtain a Python object.
+/// * Output objects always include a ``"found"`` boolean (or, for purely
+///   list-shaped outputs, an empty list / ``"count": 0``) so callers can
+///   skip empty results without exception handling.
+/// * Parsers never raise on malformed input; they return an empty result
+///   structure instead.
+///
+/// Quick start
+/// -----------
+///     >>> import json, supportfile
+///     >>> log = "Jan 10 12:23:45 node01 pacemaker-controld[2404]: notice: High CPU load detected: 23.27\n"
+///     >>> result = json.loads(supportfile.parse_high_cpu_events(log))
+///     >>> result[0]["sourceNode"]
+///     'node01'
+///
+/// Function groups
+/// ---------------
+/// * Cluster: :func:`parse_high_cpu_events`, :func:`parse_cluster_events`,
+///   :func:`parse_cluster_status`, :func:`parse_corosync_config`,
+///   :func:`parse_cluster_maintenance_mode`
+/// * Automation: :func:`parse_automation_events`
+/// * Azure: :func:`parse_azure_vm_properties`,
+///   :func:`parse_azure_vm_generation`,
+///   :func:`parse_suse_cloud_register`, :func:`parse_waagent_config`,
+///   :func:`parse_waagent_log`, :func:`parse_azure_extensions`
+/// * Debugfs: :func:`parse_hv_balloon`, :func:`parse_extfrag`
+/// * System events: :func:`parse_emergency_mode`,
+///   :func:`parse_kernel_reboots`, :func:`parse_oom_killer`,
+///   :func:`parse_xfs_errors`
+/// * Networking: :func:`parse_firewall_rules`,
+///   :func:`parse_network_interfaces`
+/// * Packages: :func:`parse_distro_packages`,
+///   :func:`parse_package_distro_mismatch`
+/// * Services: :func:`parse_ssh_service_issues`, :func:`parse_dlm_service`,
+///   :func:`parse_azure_site_recovery`, :func:`parse_guardicore_agent`,
+///   :func:`parse_illumio`, :func:`parse_trend_micro`,
+///   :func:`parse_falcon_sensor`, :func:`parse_falcon_sensor_config`,
+///   :func:`parse_ms_defender`, :func:`parse_ms_defender_config`,
+///   :func:`parse_involflt_version`, :func:`parse_involflt_kernel_version`
+/// * Storage: :func:`parse_lvm_config`, :func:`parse_raid_config`,
+///   :func:`parse_btrfs_config`, :func:`parse_block_devices`,
+///   :func:`parse_fstab_analysis`, :func:`parse_df_output`,
+///   :func:`parse_mtab_analysis`
+/// * OS / filesystem: :func:`parse_basic_environment`,
+///   :func:`parse_os_release`, :func:`parse_fstab`,
+///   :func:`parse_inspect_disk_results`
+/// * Kernel tuning: :func:`parse_kernel_tuning`, :func:`parse_huge_pages`
+/// * Time sync (Azure PTP): :func:`parse_time_sync`,
+///   :func:`parse_ptp_clock_source`, :func:`parse_time_sync_service`,
+///   :func:`parse_timedatectl`, :func:`parse_ptp_device`,
+///   :func:`parse_chrony_tracking`, :func:`parse_chrony_makestep`
+/// * RHUI: :func:`parse_rhui_config`, :func:`parse_eus_version_lock`,
+///   :func:`parse_rhel_rhui_check`, :func:`parse_rhui_errors`
+/// * Security: :func:`parse_crypto_policies`,
+///   :func:`parse_fips_mode_setup`, :func:`parse_kernel_cmdline`
+/// * Leapp: :func:`parse_leapp_report`, :func:`parse_leapp_log`
+/// * vmcore / kdump: :func:`parse_vmcore_dmesg`, :func:`parse_kdump_status`,
+///   :func:`parse_crash_listing`, :func:`parse_kdump_conf`,
+///   :func:`parse_vmcore_summary`
+#[pymodule]
+fn supportfile(m: &Bound<'_, PyModule>) -> PyResult<()> {
+    m.add_function(wrap_pyfunction!(parse_high_cpu_events, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_cluster_events, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_cluster_status, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_corosync_config, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_cluster_maintenance_mode, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_automation_events, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_azure_vm_properties, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_azure_vm_generation, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_suse_cloud_register, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_secure_boot, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_waagent_config, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_waagent_log, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_hv_balloon, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_extfrag, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_emergency_mode, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_kernel_reboots, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_oom_killer, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_xfs_errors, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_firewall_rules, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_network_interfaces, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_distro_packages, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_package_distro_mismatch, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_ssh_service_issues, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_dlm_service, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_azure_site_recovery, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_guardicore_agent, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_illumio, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_trend_micro, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_falcon_sensor, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_falcon_sensor_config, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_ms_defender, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_ms_defender_config, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_involflt_version, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_involflt_kernel_version, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_azure_extensions, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_lvm_config, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_raid_config, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_btrfs_config, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_block_devices, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_fstab_analysis, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_df_output, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_mtab_analysis, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_nfs_mounts, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_hana_savepoints, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_hana_deadlocks, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_hana_oom, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_hana_merge_errors, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_basic_environment, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_os_release, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_fstab, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_inspect_disk_results, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_kernel_tuning, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_huge_pages, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_time_sync, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_ptp_clock_source, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_time_sync_service, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_timedatectl, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_ptp_device, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_chrony_tracking, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_chrony_makestep, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_rhui_config, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_eus_version_lock, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_rhel_rhui_check, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_crypto_policies, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_fips_mode_setup, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_tuned_profile, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_selinux, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_swap_space, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_fstrim, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_kernel_cmdline, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_rhui_errors, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_leapp_report, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_leapp_log, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_vmcore_dmesg, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_kdump_status, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_crash_listing, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_kdump_conf, m)?)?;
+    m.add_function(wrap_pyfunction!(parse_vmcore_summary, m)?)?;
+    Ok(())
+}
diff --git a/rca-tool/lib/supportfile_wasm/Cargo.lock b/rca-tool/lib/supportfile_wasm/Cargo.lock
new file mode 100644
index 0000000..c4f7f30
--- /dev/null
+++ b/rca-tool/lib/supportfile_wasm/Cargo.lock
@@ -0,0 +1,235 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "console_error_panic_hook"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a06aeb73f470f66dcdbf7223caeebb85984942f22f1adb2a088cf9668146bbbc"
+dependencies = [
+ "cfg-if",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "memchr"
+version = "2.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "regex"
+version = "1.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
+
+[[package]]
+name = "rustversion"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.149"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "supportfile"
+version = "0.0.0"
+dependencies = [
+ "regex",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "supportfile-wasm"
+version = "0.0.0"
+dependencies = [
+ "console_error_panic_hook",
+ "serde_json",
+ "supportfile",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.121"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49ace1d07c165b0864824eee619580c4689389afa9dc9ed3a4c75040d82e6790"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.121"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e68e6f4afd367a562002c05637acb8578ff2dea1943df76afb9e83d177c8578"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.121"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d95a9ec35c64b2a7cb35d3fead40c4238d0940c86d107136999567a4703259f2"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.121"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4e0100b01e9f0d03189a92b96772a1fb998639d981193d7dbab487302513441"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
diff --git a/rca-tool/lib/supportfile_wasm/Cargo.toml b/rca-tool/lib/supportfile_wasm/Cargo.toml
new file mode 100644
index 0000000..16c9949
--- /dev/null
+++ b/rca-tool/lib/supportfile_wasm/Cargo.toml
@@ -0,0 +1,23 @@
+[package]
+name = "supportfile-wasm"
+version = "0.0.0"
+edition = "2021"
+description = "WASM bindings for the supportfile parser library, consumed by the Leptos web UI worker."
+license = "MIT"
+
+[lib]
+crate-type = ["cdylib", "rlib"]
+
+[dependencies]
+supportfile = { path = "../supportfile_core" }
+wasm-bindgen = "0.2"
+serde_json = "1"
+console_error_panic_hook = { version = "0.1", optional = true }
+
+[features]
+default = ["console_error_panic_hook"]
+
+[profile.release]
+opt-level = "z"
+lto = true
+codegen-units = 1
diff --git a/rca-tool/lib/supportfile_wasm/src/lib.rs b/rca-tool/lib/supportfile_wasm/src/lib.rs
new file mode 100644
index 0000000..a683465
--- /dev/null
+++ b/rca-tool/lib/supportfile_wasm/src/lib.rs
@@ -0,0 +1,486 @@
+//! WASM bindings for the supportfile parser library.
+//!
+//! Exposes every `parse_*_json` function from `supportfile` as a wasm-bindgen
+//! export with a camelCase `js_name`. Each export returns a JSON string that
+//! the JS layer can `JSON.parse` and pass through a snake_case → camelCase
+//! converter to match the legacy JS parser output shape.
+//!
+//! Generated mechanically from the parser fns in `supportfile_core/src/parsers/`.
+
+use supportfile as sf;
+use wasm_bindgen::prelude::*;
+
+/// Initialize panic-to-console hook so Rust panics surface as readable
+/// browser console errors instead of opaque "unreachable" traps.
+#[wasm_bindgen(start)]
+pub fn start() {
+    #[cfg(feature = "console_error_panic_hook")]
+    console_error_panic_hook::set_once();
+}
+
+/// Returns the supportfile crate version compiled into this WASM module.
+#[wasm_bindgen(js_name = supportfileVersion)]
+pub fn supportfile_version() -> String {
+    env!("CARGO_PKG_VERSION").to_string()
+}
+
+#[wasm_bindgen(js_name = parseAutomationEvents)]
+pub fn parse_automation_events_json(content: &str, source_path: &str) -> String {
+    sf::parse_automation_events_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseAzureExtensions)]
+pub fn parse_azure_extensions_json(content: &str, source_path: &str) -> String {
+    sf::parse_azure_extensions_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseAzureSiteRecovery)]
+pub fn parse_azure_site_recovery_json(content: &str, source_path: &str) -> String {
+    sf::parse_azure_site_recovery_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseAzureVmProperties)]
+pub fn parse_azure_vm_properties_json(content: &str, source_path: &str) -> String {
+    sf::parse_azure_vm_properties_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseBasicEnvironment)]
+pub fn parse_basic_environment_json(content: &str, source_path: &str) -> String {
+    sf::parse_basic_environment_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseBlockDevices)]
+pub fn parse_block_devices_json(content: &str, source_path: &str) -> String {
+    sf::parse_block_devices_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseBtrfsConfig)]
+pub fn parse_btrfs_config_json(content: &str, source_path: &str) -> String {
+    sf::parse_btrfs_config_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseChronyMakestep)]
+pub fn parse_chrony_makestep_json(content: &str, source_path: &str) -> String {
+    sf::parse_chrony_makestep_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseChronyTracking)]
+pub fn parse_chrony_tracking_json(content: &str, source_path: &str) -> String {
+    sf::parse_chrony_tracking_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseClusterEvents)]
+pub fn parse_cluster_events_json(content: &str, source_path: &str) -> String {
+    sf::parse_cluster_events_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseClusterMaintenanceMode)]
+pub fn parse_cluster_maintenance_mode_json(content: &str, source_path: &str) -> String {
+    sf::parse_cluster_maintenance_mode_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseClusterStatus)]
+pub fn parse_cluster_status_json(content: &str, source_path: &str) -> String {
+    sf::parse_cluster_status_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseCorosyncConfig)]
+pub fn parse_corosync_config_json(content: &str, source_path: &str) -> String {
+    sf::parse_corosync_config_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseClusterDaemonStatus)]
+pub fn parse_cluster_daemon_status_json(content: &str, source_path: &str) -> String {
+    sf::parse_cluster_daemon_status_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseCorosyncStatus)]
+pub fn parse_corosync_status_json(content: &str, source_path: &str) -> String {
+    sf::parse_corosync_status_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseHostsFile)]
+pub fn parse_hosts_file_json(content: &str, source_path: &str) -> String {
+    sf::parse_hosts_file_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseSbdConfig)]
+pub fn parse_sbd_config_json(content: &str, source_path: &str) -> String {
+    sf::parse_sbd_config_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseAzureFenceAuth)]
+pub fn parse_azure_fence_auth_json(content: &str, source_path: &str) -> String {
+    sf::parse_azure_fence_auth_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseIscsiConfig)]
+pub fn parse_iscsi_config_json(content: &str, source_path: &str) -> String {
+    sf::parse_iscsi_config_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseLiveMigration)]
+pub fn parse_live_migration_json(content: &str, source_path: &str) -> String {
+    sf::parse_live_migration_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseSapInstanceErrors)]
+pub fn parse_sap_instance_errors_json(content: &str, source_path: &str) -> String {
+    sf::parse_sap_instance_errors_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseClusterNodes)]
+pub fn parse_cluster_nodes_json(content: &str, source_path: &str) -> String {
+    sf::parse_cluster_nodes_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseFencingConfig)]
+pub fn parse_fencing_config_json(content: &str, source_path: &str) -> String {
+    sf::parse_fencing_config_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseAzureScheduledEvents)]
+pub fn parse_azure_scheduled_events_json(content: &str, source_path: &str) -> String {
+    sf::parse_azure_scheduled_events_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseSapInstanceConfig)]
+pub fn parse_sap_instance_config_json(content: &str, source_path: &str) -> String {
+    sf::parse_sap_instance_config_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parsePacemakerResources)]
+pub fn parse_pacemaker_resources_json(content: &str, source_path: &str) -> String {
+    sf::parse_pacemaker_resources_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseCrashListing)]
+pub fn parse_crash_listing_json(content: &str, source_path: &str) -> String {
+    sf::parse_crash_listing_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseCryptoPolicies)]
+pub fn parse_crypto_policies_json(content: &str, source_path: &str) -> String {
+    sf::parse_crypto_policies_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseDfOutput)]
+pub fn parse_df_output_json(content: &str, source_path: &str) -> String {
+    sf::parse_df_output_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseDistroPackages)]
+pub fn parse_distro_packages_json(content: &str, source_path: &str) -> String {
+    sf::parse_distro_packages_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseDlmService)]
+pub fn parse_dlm_service_json(content: &str, source_path: &str) -> String {
+    sf::parse_dlm_service_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseEmergencyMode)]
+pub fn parse_emergency_mode_json(content: &str, source_path: &str) -> String {
+    sf::parse_emergency_mode_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseEusVersionLock)]
+pub fn parse_eus_version_lock_json(content: &str, source_path: &str) -> String {
+    sf::parse_eus_version_lock_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseExtfrag)]
+pub fn parse_extfrag_json(content: &str, source_path: &str) -> String {
+    sf::parse_extfrag_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseFalconSensorConfig)]
+pub fn parse_falcon_sensor_config_json(content: &str, source_path: &str) -> String {
+    sf::parse_falcon_sensor_config_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseFalconSensor)]
+pub fn parse_falcon_sensor_json(content: &str, source_path: &str) -> String {
+    sf::parse_falcon_sensor_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseFipsModeSetup)]
+pub fn parse_fips_mode_setup_json(content: &str, source_path: &str) -> String {
+    sf::parse_fips_mode_setup_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseFirewallRules)]
+pub fn parse_firewall_rules_json(content: &str, source_path: &str) -> String {
+    sf::parse_firewall_rules_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseFstrim)]
+pub fn parse_fstrim_json(content: &str, source_path: &str) -> String {
+    sf::parse_fstrim_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parsePacketLoss)]
+pub fn parse_packet_loss_json(content: &str, source_path: &str) -> String {
+    sf::parse_packet_loss_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseRingBuffer)]
+pub fn parse_ring_buffer_json(content: &str, source_path: &str) -> String {
+    sf::parse_ring_buffer_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseNetworkSysctl)]
+pub fn parse_network_sysctl_json(content: &str, source_path: &str) -> String {
+    sf::parse_network_sysctl_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseNfsMounts)]
+pub fn parse_nfs_mounts_json(content: &str, source_path: &str) -> String {
+    sf::parse_nfs_mounts_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseHanaSavepoints)]
+pub fn parse_hana_savepoints_json(content: &str, source_path: &str) -> String {
+    sf::parse_hana_savepoints_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseHanaDeadlocks)]
+pub fn parse_hana_deadlocks_json(content: &str, source_path: &str) -> String {
+    sf::parse_hana_deadlocks_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseHanaOom)]
+pub fn parse_hana_oom_json(content: &str, source_path: &str) -> String {
+    sf::parse_hana_oom_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseHanaMergeErrors)]
+pub fn parse_hana_merge_errors_json(content: &str, source_path: &str) -> String {
+    sf::parse_hana_merge_errors_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseFstabAnalysis)]
+pub fn parse_fstab_analysis_json(content: &str, source_path: &str) -> String {
+    sf::parse_fstab_analysis_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseFstab)]
+pub fn parse_fstab_json(content: &str, source_path: &str) -> String {
+    sf::parse_fstab_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseGuardicoreAgent)]
+pub fn parse_guardicore_agent_json(content: &str, source_path: &str) -> String {
+    sf::parse_guardicore_agent_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseHugePages)]
+pub fn parse_huge_pages_json(content: &str, source_path: &str) -> String {
+    sf::parse_huge_pages_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseHvBalloon)]
+pub fn parse_hv_balloon_json(content: &str, source_path: &str) -> String {
+    sf::parse_hv_balloon_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseIllumio)]
+pub fn parse_illumio_json(content: &str, source_path: &str) -> String {
+    sf::parse_illumio_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseInspectDiskResults)]
+pub fn parse_inspect_disk_results_json(content: &str, source_path: &str) -> String {
+    sf::parse_inspect_disk_results_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseInvolfltKernelVersion)]
+pub fn parse_involflt_kernel_version_json(content: &str, source_path: &str) -> String {
+    sf::parse_involflt_kernel_version_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseInvolfltVersion)]
+pub fn parse_involflt_version_json(content: &str, source_path: &str) -> String {
+    sf::parse_involflt_version_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseKdumpConf)]
+pub fn parse_kdump_conf_json(content: &str, source_path: &str) -> String {
+    sf::parse_kdump_conf_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseKdumpStatus)]
+pub fn parse_kdump_status_json(content: &str, source_path: &str) -> String {
+    sf::parse_kdump_status_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseKernelCmdline)]
+pub fn parse_kernel_cmdline_json(content: &str, source_path: &str) -> String {
+    sf::parse_kernel_cmdline_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseKernelReboots)]
+pub fn parse_kernel_reboots_json(content: &str, source_path: &str) -> String {
+    sf::parse_kernel_reboots_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseKernelTuning)]
+pub fn parse_kernel_tuning_json(content: &str, source_path: &str) -> String {
+    sf::parse_kernel_tuning_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseLeappLog)]
+pub fn parse_leapp_log_json(content: &str, source_path: &str) -> String {
+    sf::parse_leapp_log_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseLeappReport)]
+pub fn parse_leapp_report_json(content: &str, source_path: &str) -> String {
+    sf::parse_leapp_report_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseLvmConfig)]
+pub fn parse_lvm_config_json(content: &str, source_path: &str) -> String {
+    sf::parse_lvm_config_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseMsDefenderConfig)]
+pub fn parse_ms_defender_config_json(content: &str, source_path: &str) -> String {
+    sf::parse_ms_defender_config_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseMsDefender)]
+pub fn parse_ms_defender_json(content: &str, source_path: &str) -> String {
+    sf::parse_ms_defender_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseMtabAnalysis)]
+pub fn parse_mtab_analysis_json(content: &str, source_path: &str) -> String {
+    sf::parse_mtab_analysis_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseNetworkInterfaces)]
+pub fn parse_network_interfaces_json(content: &str, source_path: &str) -> String {
+    sf::parse_network_interfaces_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseOomKiller)]
+pub fn parse_oom_killer_json(content: &str, source_path: &str) -> String {
+    sf::parse_oom_killer_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseOsRelease)]
+pub fn parse_os_release_json(content: &str, source_path: &str) -> String {
+    sf::parse_os_release_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parsePacemakerHighCpu)]
+pub fn parse_pacemaker_high_cpu_json(content: &str, source_path: &str) -> String {
+    sf::parse_pacemaker_high_cpu_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parsePtpClockSource)]
+pub fn parse_ptp_clock_source_json(content: &str, source_path: &str) -> String {
+    sf::parse_ptp_clock_source_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parsePtpDevice)]
+pub fn parse_ptp_device_json(content: &str, source_path: &str) -> String {
+    sf::parse_ptp_device_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseRaidConfig)]
+pub fn parse_raid_config_json(content: &str, source_path: &str) -> String {
+    sf::parse_raid_config_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseRhelRhuiCheck)]
+pub fn parse_rhel_rhui_check_json(content: &str, source_path: &str) -> String {
+    sf::parse_rhel_rhui_check_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseRhuiConfig)]
+pub fn parse_rhui_config_json(content: &str, source_path: &str) -> String {
+    sf::parse_rhui_config_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseRhuiErrors)]
+pub fn parse_rhui_errors_json(content: &str, source_path: &str) -> String {
+    sf::parse_rhui_errors_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseSshServiceIssues)]
+pub fn parse_ssh_service_issues_json(content: &str, source_path: &str) -> String {
+    sf::parse_ssh_service_issues_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseSecureBoot)]
+pub fn parse_secure_boot_json(content: &str, source_path: &str) -> String {
+    sf::parse_secure_boot_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseSuseCloudRegister)]
+pub fn parse_suse_cloud_register_json(content: &str, source_path: &str) -> String {
+    sf::parse_suse_cloud_register_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseSelinux)]
+pub fn parse_selinux_json(content: &str, source_path: &str) -> String {
+    sf::parse_selinux_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseSwapSpace)]
+pub fn parse_swap_space_json(content: &str, source_path: &str) -> String {
+    sf::parse_swap_space_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseTimeSync)]
+pub fn parse_time_sync_json(content: &str, source_path: &str) -> String {
+    sf::parse_time_sync_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseTimeSyncService)]
+pub fn parse_time_sync_service_json(content: &str, source_path: &str) -> String {
+    sf::parse_time_sync_service_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseTimedatectl)]
+pub fn parse_timedatectl_json(content: &str, source_path: &str) -> String {
+    sf::parse_timedatectl_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseTunedProfile)]
+pub fn parse_tuned_profile_json(content: &str, source_path: &str) -> String {
+    sf::parse_tuned_profile_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseTrendMicro)]
+pub fn parse_trend_micro_json(content: &str, source_path: &str) -> String {
+    sf::parse_trend_micro_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseVmcoreDmesg)]
+pub fn parse_vmcore_dmesg_json(content: &str, source_path: &str) -> String {
+    sf::parse_vmcore_dmesg_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseVmcoreSummary)]
+pub fn parse_vmcore_summary_json(content: &str, source_path: &str) -> String {
+    sf::parse_vmcore_summary_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseWaagentConfig)]
+pub fn parse_waagent_config_json(content: &str, source_path: &str) -> String {
+    sf::parse_waagent_config_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseWaagentLog)]
+pub fn parse_waagent_log_json(content: &str, source_path: &str) -> String {
+    sf::parse_waagent_log_json(content, source_path)
+}
+
+#[wasm_bindgen(js_name = parseXfsErrors)]
+pub fn parse_xfs_errors_json(content: &str, source_path: &str) -> String {
+    sf::parse_xfs_errors_json(content, source_path)
+}
+
diff --git a/rca-tool/package-lock.json b/rca-tool/package-lock.json
new file mode 100644
index 0000000..ba7fcae
--- /dev/null
+++ b/rca-tool/package-lock.json
@@ -0,0 +1,344 @@
+{
+  "name": "rca-tool",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "rca-tool",
+      "version": "1.0.0",
+      "license": "ISC",
+      "devDependencies": {
+        "jsdoc": "^4.0.5"
+      }
+    },
+    "node_modules/@babel/helper-string-parser": {
+      "version": "7.27.1",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.27.1.tgz",
+      "integrity": "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-validator-identifier": {
+      "version": "7.28.5",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.28.5.tgz",
+      "integrity": "sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/parser": {
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.0.tgz",
+      "integrity": "sha512-IyDgFV5GeDUVX4YdF/3CPULtVGSXXMLh1xVIgdCgxApktqnQV0r7/8Nqthg+8YLGaAtdyIlo2qIdZrbCv4+7ww==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^7.29.0"
+      },
+      "bin": {
+        "parser": "bin/babel-parser.js"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@babel/types": {
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
+      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-string-parser": "^7.27.1",
+        "@babel/helper-validator-identifier": "^7.28.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@jsdoc/salty": {
+      "version": "0.2.9",
+      "resolved": "https://registry.npmjs.org/@jsdoc/salty/-/salty-0.2.9.tgz",
+      "integrity": "sha512-yYxMVH7Dqw6nO0d5NIV8OQWnitU8k6vXH8NtgqAfIa/IUqRMxRv/NUJJ08VEKbAakwxlgBl5PJdrU0dMPStsnw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "lodash": "^4.17.21"
+      },
+      "engines": {
+        "node": ">=v12.0.0"
+      }
+    },
+    "node_modules/@types/linkify-it": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/@types/linkify-it/-/linkify-it-5.0.0.tgz",
+      "integrity": "sha512-sVDA58zAw4eWAffKOaQH5/5j3XeayukzDk+ewSsnv3p4yJEZHCCzMDiZM8e0OUrRvmpGZ85jf4yDHkHsgBNr9Q==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/markdown-it": {
+      "version": "14.1.2",
+      "resolved": "https://registry.npmjs.org/@types/markdown-it/-/markdown-it-14.1.2.tgz",
+      "integrity": "sha512-promo4eFwuiW+TfGxhi+0x3czqTYJkG8qB17ZUJiVF10Xm7NLVRSLUsfRTU/6h1e24VvRnXCx+hG7li58lkzog==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/linkify-it": "^5",
+        "@types/mdurl": "^2"
+      }
+    },
+    "node_modules/@types/mdurl": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@types/mdurl/-/mdurl-2.0.0.tgz",
+      "integrity": "sha512-RGdgjQUZba5p6QEFAVx2OGb8rQDL/cPRG7GiedRzMcJ1tYnUANBncjbSB1NRGwbvjcPeikRABz2nshyPk1bhWg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/argparse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
+      "dev": true,
+      "license": "Python-2.0"
+    },
+    "node_modules/bluebird": {
+      "version": "3.7.2",
+      "resolved": "https://registry.npmjs.org/bluebird/-/bluebird-3.7.2.tgz",
+      "integrity": "sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/catharsis": {
+      "version": "0.9.0",
+      "resolved": "https://registry.npmjs.org/catharsis/-/catharsis-0.9.0.tgz",
+      "integrity": "sha512-prMTQVpcns/tzFgFVkVp6ak6RykZyWb3gu8ckUpd6YkTlacOd3DXGJjIpD4Q6zJirizvaiAjSSHlOsA+6sNh2A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "lodash": "^4.17.15"
+      },
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/entities": {
+      "version": "4.5.0",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-4.5.0.tgz",
+      "integrity": "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=0.12"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/entities?sponsor=1"
+      }
+    },
+    "node_modules/escape-string-regexp": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-2.0.0.tgz",
+      "integrity": "sha512-UpzcLCXolUWcNu5HtVMHYdXJjArjsF9C0aNnquZYY4uW/Vu0miy5YoWvbV345HauVvcAUnpRuhMMcqTcGOY2+w==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/graceful-fs": {
+      "version": "4.2.11",
+      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
+      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/js2xmlparser": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/js2xmlparser/-/js2xmlparser-4.0.2.tgz",
+      "integrity": "sha512-6n4D8gLlLf1n5mNLQPRfViYzu9RATblzPEtm1SthMX1Pjao0r9YI9nw7ZIfRxQMERS87mcswrg+r/OYrPRX6jA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "xmlcreate": "^2.0.4"
+      }
+    },
+    "node_modules/jsdoc": {
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/jsdoc/-/jsdoc-4.0.5.tgz",
+      "integrity": "sha512-P4C6MWP9yIlMiK8nwoZvxN84vb6MsnXcHuy7XzVOvQoCizWX5JFCBsWIIWKXBltpoRZXddUOVQmCTOZt9yDj9g==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@babel/parser": "^7.20.15",
+        "@jsdoc/salty": "^0.2.1",
+        "@types/markdown-it": "^14.1.1",
+        "bluebird": "^3.7.2",
+        "catharsis": "^0.9.0",
+        "escape-string-regexp": "^2.0.0",
+        "js2xmlparser": "^4.0.2",
+        "klaw": "^3.0.0",
+        "markdown-it": "^14.1.0",
+        "markdown-it-anchor": "^8.6.7",
+        "marked": "^4.0.10",
+        "mkdirp": "^1.0.4",
+        "requizzle": "^0.2.3",
+        "strip-json-comments": "^3.1.0",
+        "underscore": "~1.13.2"
+      },
+      "bin": {
+        "jsdoc": "jsdoc.js"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
+    "node_modules/klaw": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/klaw/-/klaw-3.0.0.tgz",
+      "integrity": "sha512-0Fo5oir+O9jnXu5EefYbVK+mHMBeEVEy2cmctR1O1NECcCkPRreJKrS6Qt/j3KC2C148Dfo9i3pCmCMsdqGr0g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "graceful-fs": "^4.1.9"
+      }
+    },
+    "node_modules/linkify-it": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/linkify-it/-/linkify-it-5.0.0.tgz",
+      "integrity": "sha512-5aHCbzQRADcdP+ATqnDuhhJ/MRIqDkZX5pyjFHRRysS8vZ5AbqGEoFIb6pYHPZ+L/OC2Lc+xT8uHVVR5CAK/wQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "uc.micro": "^2.0.0"
+      }
+    },
+    "node_modules/lodash": {
+      "version": "4.17.23",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
+      "integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/markdown-it": {
+      "version": "14.1.1",
+      "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.1.1.tgz",
+      "integrity": "sha512-BuU2qnTti9YKgK5N+IeMubp14ZUKUUw7yeJbkjtosvHiP0AZ5c8IAgEMk79D0eC8F23r4Ac/q8cAIFdm2FtyoA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "argparse": "^2.0.1",
+        "entities": "^4.4.0",
+        "linkify-it": "^5.0.0",
+        "mdurl": "^2.0.0",
+        "punycode.js": "^2.3.1",
+        "uc.micro": "^2.1.0"
+      },
+      "bin": {
+        "markdown-it": "bin/markdown-it.mjs"
+      }
+    },
+    "node_modules/markdown-it-anchor": {
+      "version": "8.6.7",
+      "resolved": "https://registry.npmjs.org/markdown-it-anchor/-/markdown-it-anchor-8.6.7.tgz",
+      "integrity": "sha512-FlCHFwNnutLgVTflOYHPW2pPcl2AACqVzExlkGQNsi4CJgqOHN7YTgDd4LuhgN1BFO3TS0vLAruV1Td6dwWPJA==",
+      "dev": true,
+      "license": "Unlicense",
+      "peerDependencies": {
+        "@types/markdown-it": "*",
+        "markdown-it": "*"
+      }
+    },
+    "node_modules/marked": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/marked/-/marked-4.3.0.tgz",
+      "integrity": "sha512-PRsaiG84bK+AMvxziE/lCFss8juXjNaWzVbN5tXAm4XjeaS9NAHhop+PjQxz2A9h8Q4M/xGmzP8vqNwy6JeK0A==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "marked": "bin/marked.js"
+      },
+      "engines": {
+        "node": ">= 12"
+      }
+    },
+    "node_modules/mdurl": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/mdurl/-/mdurl-2.0.0.tgz",
+      "integrity": "sha512-Lf+9+2r+Tdp5wXDXC4PcIBjTDtq4UKjCPMQhKIuzpJNW0b96kVqSwW0bT7FhRSfmAiFYgP+SCRvdrDozfh0U5w==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/mkdirp": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-1.0.4.tgz",
+      "integrity": "sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "mkdirp": "bin/cmd.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/punycode.js": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/punycode.js/-/punycode.js-2.3.1.tgz",
+      "integrity": "sha512-uxFIHU0YlHYhDQtV4R9J6a52SLx28BCjT+4ieh7IGbgwVJWO+km431c4yRlREUAsAmt/uMjQUyQHNEPf0M39CA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/requizzle": {
+      "version": "0.2.4",
+      "resolved": "https://registry.npmjs.org/requizzle/-/requizzle-0.2.4.tgz",
+      "integrity": "sha512-JRrFk1D4OQ4SqovXOgdav+K8EAhSB/LJZqCz8tbX0KObcdeM15Ss59ozWMBWmmINMagCwmqn4ZNryUGpBsl6Jw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "lodash": "^4.17.21"
+      }
+    },
+    "node_modules/strip-json-comments": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
+      "integrity": "sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/uc.micro": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/uc.micro/-/uc.micro-2.1.0.tgz",
+      "integrity": "sha512-ARDJmphmdvUk6Glw7y9DQ2bFkKBHwQHLi2lsaH6PPmz/Ka9sFOBsBluozhDltWmnv9u/cF6Rt87znRTPV+yp/A==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/underscore": {
+      "version": "1.13.7",
+      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.13.7.tgz",
+      "integrity": "sha512-GMXzWtsc57XAtguZgaQViUOzs0KTkk8ojr3/xAxXLITqf/3EMwxC0inyETfDFjH/Krbhuep0HNbbjI9i/q3F3g==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/xmlcreate": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/xmlcreate/-/xmlcreate-2.0.4.tgz",
+      "integrity": "sha512-nquOebG4sngPmGPICTS5EnxqhKbCmz5Ox5hsszI2T6U5qdrJizBc+0ilYSEjTSzU0yZcmvppztXe/5Al5fUwdg==",
+      "dev": true,
+      "license": "Apache-2.0"
+    }
+  }
+}
diff --git a/rca-tool/package.json b/rca-tool/package.json
new file mode 100644
index 0000000..c63f691
--- /dev/null
+++ b/rca-tool/package.json
@@ -0,0 +1,28 @@
+{
+  "name": "rca-tool",
+  "version": "1.0.0",
+  "description": "RCA Tool - SAP HANA Cluster Analyzer for supportconfig/sosreport analysis",
+  "type": "module",
+  "scripts": {
+    "dev": "cd web-leptos && trunk serve --open",
+    "build": "cd web-leptos && bash build.sh",
+    "build:web": "cd web-leptos && bash build.sh",
+    "build:cli": "cd lib/supportfile_core && cargo build --locked --release --features cli --bin rca_cli",
+    "build:all": "npm run build:web && npm run build:cli",
+    "preview": "cd web-leptos && trunk serve",
+    "docs": "rm -rf docs && npx jsdoc -c jsdoc.json"
+  },
+  "keywords": [
+    "sap",
+    "hana",
+    "cluster",
+    "analyzer",
+    "supportconfig",
+    "sosreport"
+  ],
+  "author": "",
+  "license": "ISC",
+  "devDependencies": {
+    "jsdoc": "^4.0.5"
+  }
+}
diff --git a/rca-tool/src/parsers/azure.js b/rca-tool/src/parsers/azure.js
new file mode 100644
index 0000000..36fc61d
--- /dev/null
+++ b/rca-tool/src/parsers/azure.js
@@ -0,0 +1,141 @@
+/**
+ * @module parsers/azure
+ * @description Thin shims for Azure-related parsers. The real implementation
+ * lives in `rca-tool/lib/supportfile_core/src/parsers/azure.rs` and is
+ * exposed via `wasm_bindgen.parseAzureVmProperties / parseSuseCloudRegister
+ * / parseWaagentConfig / parseWaagentLog`.
+ *
+ * Each shim:
+ *   1. Calls `WASM_BRIDGE.parseJson(...)` (which JSON-parses the Rust
+ *      output and recursively snake_case→camelCase transforms keys).
+ *   2. Patches a small set of fields whose mechanical camelCase form does
+ *      not match the legacy JS schema that Leptos consumes (i.e. fields
+ *      that contain all-caps acronyms like FIPS, GAFamily, MB, GB).
+ *
+ * Note: `azureExtensionsParser` and `azureSiteRecoveryParser` already live
+ * in `parsers/services.js` as thin shims and are NOT re-defined here.
+ *
+ * Fallback: if WASM is not loaded, every parser returns `{ found: false }`.
+ *
+ * @see {@link module:worker} for registration in SCC_RULES (azureVMProperties,
+ *      suseCloudRegister, waagentConfig, waagentLog).
+ */
+
+function _wasmCall(fnName, content, filename, fallback) {
+    if (typeof WASM_BRIDGE === 'undefined' || !WASM_BRIDGE.isReady()) {
+        return fallback;
+    }
+    try {
+        return WASM_BRIDGE.parseJson(fnName, content, filename || '');
+    } catch (err) {
+        console.error('[azure.js]', fnName, 'WASM call failed:', err);
+        return fallback;
+    }
+}
+
+// ---------------------------------------------------------------------------
+// azureVMProperties
+// ---------------------------------------------------------------------------
+//
+// Patches: dataDisks[].diskSizeGb -> diskSizeGB (Azure uses the all-caps
+// "GB" form; mechanical conversion produces "Gb" which Leptos already
+// tolerates as a fallback but the canonical name is the all-caps one).
+
+const azureVMPropertiesParser = {
+    filePattern: /(?:instance_metadata\.json|public_cloud\/metadata\.txt)$/,
+
+    parse: function(content, filename, _lines) {
+        const result = _wasmCall('parseAzureVmProperties', content, filename, { found: false });
+        if (result && Array.isArray(result.dataDisks)) {
+            for (const disk of result.dataDisks) {
+                if (disk && disk.diskSizeGb != null && disk.diskSizeGB == null) {
+                    disk.diskSizeGB = disk.diskSizeGb;
+                }
+            }
+        }
+        return result;
+    }
+};
+
+// ---------------------------------------------------------------------------
+// suseCloudRegister
+// ---------------------------------------------------------------------------
+//
+// No alias patching needed — every Rust field maps cleanly to the legacy
+// camelCase shape (registrationServer, registrationType, billingModel,
+// detectionMethod).
+
+const suseCloudRegisterParser = {
+    filePattern: /public_cloud\/cloudregister\.txt$/,
+
+    parse: function(content, filename, _lines) {
+        const result = _wasmCall('parseSuseCloudRegister', content, filename, { found: false });
+        return result;
+    }
+};
+
+// ---------------------------------------------------------------------------
+// waagentConfig
+// ---------------------------------------------------------------------------
+//
+// Patches in `summary`:
+//   enable_fips             -> enableFIPS              (acronym)
+//   auto_update_ga_family   -> autoUpdateGAFamily      (acronym)
+//   resource_disk_swap_size_mb -> resourceDiskSwapSizeMB  (acronym)
+
+const WAAGENT_CONFIG_SUMMARY_ALIASES = {
+    enableFips: 'enableFIPS',
+    autoUpdateGaFamily: 'autoUpdateGAFamily',
+    resourceDiskSwapSizeMb: 'resourceDiskSwapSizeMB',
+};
+
+const waagentConfigParser = {
+    filePattern: /\/etc\/waagent\.conf$/,
+
+    parse: function(content, filename, _lines) {
+        const result = _wasmCall('parseWaagentConfig', content, filename, { found: false });
+        if (result && result.summary) {
+            for (const oldKey of Object.keys(WAAGENT_CONFIG_SUMMARY_ALIASES)) {
+                const newKey = WAAGENT_CONFIG_SUMMARY_ALIASES[oldKey];
+                if (result.summary[oldKey] !== undefined && result.summary[newKey] === undefined) {
+                    result.summary[newKey] = result.summary[oldKey];
+                }
+            }
+        }
+        return result;
+    }
+};
+
+// ---------------------------------------------------------------------------
+// waagentLog
+// ---------------------------------------------------------------------------
+//
+// No alias patching: extensionStatusSummary, imdsErrors, goalStateErrors,
+// resourceDiskErrors, agentVersionHistory, etc. all map cleanly via
+// mechanical snake→camel.
+
+const waagentLogParser = {
+    filePattern: /\/waagent\.log$/,
+
+    parse: function(content, filename, _lines) {
+        const result = _wasmCall('parseWaagentLog', content, filename, { found: false });
+        return result;
+    }
+};
+
+// ---------------------------------------------------------------------------
+// secureBoot
+// ---------------------------------------------------------------------------
+//
+// Only available in sosreport archives (file:
+// `sos_commands/boot/mokutil_--sb-state`). supportconfig has no equivalent.
+// No alias patching needed — all fields map cleanly via snake→camel.
+
+const secureBootParser = {
+    filePattern: /sos_commands\/boot\/mokutil_--sb-state$/,
+
+    parse: function(content, filename, _lines) {
+        const result = _wasmCall('parseSecureBoot', content, filename, { found: false });
+        return result;
+    }
+};
diff --git a/rca-tool/src/parsers/cluster.js b/rca-tool/src/parsers/cluster.js
new file mode 100644
index 0000000..d69c755
--- /dev/null
+++ b/rca-tool/src/parsers/cluster.js
@@ -0,0 +1,234 @@
+/**
+ * @module parsers/cluster
+ * @description Thin shims for cluster (Pacemaker / Corosync / SAP HA / SBD /
+ * iSCSI / Azure fence agent) parsers. The real implementation lives in
+ * `rca-tool/lib/supportfile_core/src/parsers/cluster.rs` and is exposed via
+ * `wasm_bindgen.parse*` exports (see `supportfile_wasm/src/lib.rs`).
+ *
+ * Each shim:
+ *   1. Calls `WASM_BRIDGE.parseJson(...)` (which JSON-parses the Rust output
+ *      and recursively snake_case → camelCase transforms keys).
+ *   2. Optionally projects/aliases fields where the JS bridge would corrupt
+ *      a value or where the original JS shape used keys that contain dots,
+ *      mixed case, or other characters that the camelCase transform mangles.
+ *
+ * Special projections:
+ *   - `iscsiConfig`: `iscsidConfig` is emitted as `[{name, value}]` from Rust
+ *     to dodge the bridge's mangling of dotted keys; this shim rebuilds the
+ *     legacy `{ "node.startup": "manual", ... }` object shape.
+ *   - `clusterNodes`: `nodeToIpMap` is emitted as `[{host, ip}]` for the same
+ *     reason; this shim rebuilds the legacy `{ "node1": "10.0.0.1", ... }`
+ *     hostname → IP object.
+ *
+ * The factory `createClusterParsers()` is preserved for worker.js wiring.
+ * XML extraction is handled in Rust.
+ *
+ * Fallback: if WASM is not loaded, every parser returns `{ found: false }`.
+ *
+ * @see {@link module:worker} for registration in SCC_RULES.
+ */
+
+function _wasmCall(fnName, content, filename, fallback) {
+    if (typeof WASM_BRIDGE === 'undefined' || !WASM_BRIDGE.isReady()) {
+        return fallback;
+    }
+    try {
+        return WASM_BRIDGE.parseJson(fnName, content, filename || '');
+    } catch (err) {
+        console.error('[cluster.js]', fnName, 'WASM call failed:', err);
+        return fallback;
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Core cluster
+// ---------------------------------------------------------------------------
+
+const corosyncConfigParser = {
+    filePattern: /\/(ha\.txt|corosync\.conf)$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseCorosyncConfig', content, filename, { found: false, warnings: [] });
+    }
+};
+
+const clusterNodesParser = {
+    filePattern: /\/(ha\.txt|pacemaker\.log|corosync\.conf|cib\.xml|crm_mon.*\.txt)$/,
+    parse: function(content, filename, _lines) {
+        const result = _wasmCall('parseClusterNodes', content, filename,
+            { nodes: [], nodeToIpMap: {} });
+        // Rust emits nodeToIpMap as [{host, ip}, ...] to dodge bridge key mangling.
+        // Project back to legacy { hostname: ip } object shape.
+        if (result && Array.isArray(result.nodeToIpMap)) {
+            const obj = {};
+            for (const entry of result.nodeToIpMap) {
+                if (entry && entry.host) obj[entry.host] = entry.ip;
+            }
+            result.nodeToIpMap = obj;
+        }
+        return result;
+    }
+};
+
+const hostsFileParser = {
+    filePattern: /\/(network\.txt|etc\/hosts|etc_hosts)$|\/[^\/]+\/(hosts)$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseHostsFile', content, filename, { found: false });
+    }
+};
+
+const corosyncStatusParser = {
+    filePattern: /corosync-cfgtool.*-s$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseCorosyncStatus', content, filename, { found: false });
+    }
+};
+
+const clusterStatusParser = {
+    filePattern: /cib\.xml$|\/crm_mon.*\.txt$|\/crm_mon.*\.xml$|\/ha\.txt$|\/pcs_status/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseClusterStatus', content, filename, { found: false });
+    }
+};
+
+const clusterDaemonStatusParser = {
+    filePattern: /\/pcs_status|\/ha\.txt$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseClusterDaemonStatus', content, filename, { found: false });
+    }
+};
+
+const clusterMaintenanceModeParser = {
+    filePattern: /cib\.xml$|\/crm_mon.*\.txt$|\/ha\.txt$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseClusterMaintenanceMode', content, filename, { found: false });
+    }
+};
+
+// ---------------------------------------------------------------------------
+// Resources and constraints
+// ---------------------------------------------------------------------------
+
+const pacemakerResourcesParser = {
+    filePattern: /cib\.xml$|\/crm_mon.*\.txt$|\/crm.*config$|pacemaker\.log$|\/ha\.txt$|\/pcs_config$|\/pcs_status/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parsePacemakerResources', content, filename, { found: false });
+    }
+};
+
+const azureScheduledEventsParser = {
+    filePattern: /\/pcs_status.*|\/crm_mon.*|cib\.xml$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseAzureScheduledEvents', content, filename, { found: false });
+    }
+};
+
+// ---------------------------------------------------------------------------
+// Fencing and SBD
+// ---------------------------------------------------------------------------
+
+const fencingConfigParser = {
+    filePattern: /cib\.xml$|\/crm_mon.*\.txt$|\/crm.*config$|stonith|\/ha\.txt$|\/pcs_config$|\/pcs_property/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseFencingConfig', content, filename, { found: false });
+    }
+};
+
+const sbdConfigParser = {
+    filePattern: /\/sbd$|\/sysconfig\/sbd|\/ha\.txt$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseSbdConfig', content, filename, { found: false });
+    }
+};
+
+const azureFenceAuthParser = {
+    filePattern: /cib\.xml$|\/ha\.txt$|\/crm.*config$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseAzureFenceAuth', content, filename, { found: false });
+    }
+};
+
+// ---------------------------------------------------------------------------
+// Events and live migration
+// ---------------------------------------------------------------------------
+
+const clusterEventsParser = {
+    multiFile: true,
+    processAllRotations: true,
+    filePattern: /\/(pacemaker\.log|corosync\.log|cluster\.log|ha-log|messages|journalctl[^\/]*)(?:[.-]\d+)?(?:\.txt)?(?:\.gz)?$|\/ha\.txt$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseClusterEvents', content, filename, { found: false });
+    }
+};
+
+const liveMigrationParser = {
+    filePattern: /\/(pacemaker\.log|corosync\.log|cluster\.log|ha-log|messages|localmessages|journalctl[^\/]*)(?:[.-]\d+)?(?:\.txt)?$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseLiveMigration', content, filename, { found: false });
+    }
+};
+
+// ---------------------------------------------------------------------------
+// SAP
+// ---------------------------------------------------------------------------
+
+const sapInstanceConfigParser = {
+    filePattern: /\/pcs_config|\/cib\.xml$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseSapInstanceConfig', content, filename, { found: false });
+    }
+};
+
+const sapInstanceErrorsParser = {
+    filePattern: /\/analysis\.txt$|\/cluster-log\.txt$|\/messages|\/var\/log\/messages/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseSapInstanceErrors', content, filename, { found: false });
+    }
+};
+
+// ---------------------------------------------------------------------------
+// iSCSI
+// ---------------------------------------------------------------------------
+
+const iscsiConfigParser = {
+    filePattern: /fs-iscsi\.txt$|\/iscsi\/|\/iscsiadm|\/ha\.txt$|initiatorname\.iscsi$/,
+    parse: function(content, filename, _lines) {
+        const result = _wasmCall('parseIscsiConfig', content, filename, { found: false });
+        // Rust emits iscsidConfig as [{name, value}, ...] to dodge bridge key
+        // mangling of dotted/underscored setting names like
+        // "node.session.timeo.replacement_timeout". Project to legacy object.
+        if (result && Array.isArray(result.iscsidConfig)) {
+            const obj = {};
+            for (const setting of result.iscsidConfig) {
+                if (setting && setting.name) obj[setting.name] = setting.value;
+            }
+            result.iscsidConfig = obj;
+        }
+        return result;
+    }
+};
+
+// ---------------------------------------------------------------------------
+// Factory used by worker.js to register cluster parser shims.
+// ---------------------------------------------------------------------------
+
+const createClusterParsers = function() {
+    return {
+        corosyncConfig: corosyncConfigParser,
+        clusterNodes: clusterNodesParser,
+        hostsFile: hostsFileParser,
+        pacemakerResources: pacemakerResourcesParser,
+        corosyncStatus: corosyncStatusParser,
+        clusterStatus: clusterStatusParser,
+        clusterDaemonStatus: clusterDaemonStatusParser,
+        azureScheduledEvents: azureScheduledEventsParser,
+        fencingConfig: fencingConfigParser,
+        clusterEvents: clusterEventsParser,
+        liveMigration: liveMigrationParser,
+        sapInstanceConfig: sapInstanceConfigParser,
+        sapInstanceErrors: sapInstanceErrorsParser,
+        clusterMaintenanceMode: clusterMaintenanceModeParser,
+        sbdConfig: sbdConfigParser,
+        azureFenceAuth: azureFenceAuthParser,
+        iscsiConfig: iscsiConfigParser
+    };
+};
diff --git a/rca-tool/src/parsers/debugfs.js b/rca-tool/src/parsers/debugfs.js
new file mode 100644
index 0000000..59a565b
--- /dev/null
+++ b/rca-tool/src/parsers/debugfs.js
@@ -0,0 +1,74 @@
+/**
+ * @module parsers/debugfs
+ * @description WASM-shim parsers for `/sys/kernel/debug/` files —
+ * Hyper-V balloon driver (`hv_balloon`) and external/unusable
+ * fragmentation indices (`extfrag/extfrag_index`,
+ * `extfrag/unusable_index`).
+ *
+ * Both parsers delegate to `supportfile_core::parsers::debugfs`.  The
+ * extfrag parser is multi-file: it accumulates the raw text of each
+ * file it sees with the labelled separator the Rust parser
+ * understands (`=== extfrag_index ===` / `=== unusable_index ===`)
+ * and re-invokes the Rust parser on the combined buffer each call.
+ * That mirrors the original JS accumulator semantics without needing
+ * an end-of-batch hook.
+ */
+
+function emptyHvBalloon() {
+    return {
+        found: false, warnings: [], rawContent: '',
+        hostVersion: null, capabilities: null, state: null, stateText: null,
+        pageSize: 4096, pagesAdded: 0, pagesOnlined: 0, pagesBallooned: 0,
+        totalPagesCommitted: 0, maxDynamicPageCount: 0,
+        committedMemoryGB: 0, maxDynamicMemoryGB: 0, balloonedMemoryMB: 0
+    };
+}
+
+function emptyExtfrag() {
+    return { found: false, zones: [], warnings: [], rawContent: '' };
+}
+
+const hvBalloonParser = {
+    filePattern: /sys\/kernel\/debug\/hv[-_]balloon$/,
+    parse: function(content, filename, _lines) {
+        if (typeof WASM_BRIDGE === 'undefined' || !WASM_BRIDGE.isReady()) {
+            return emptyHvBalloon();
+        }
+        try {
+            return WASM_BRIDGE.parseJson('parseHvBalloon', content, filename || '');
+        } catch (err) {
+            console.error('[debugfs.js] parseHvBalloon WASM call failed:', err);
+            return emptyHvBalloon();
+        }
+    }
+};
+
+const extfragParser = {
+    filePattern: /sys\/kernel\/debug\/extfrag\/(extfrag_index|unusable_index)$/,
+    multiFile: true,
+
+    parse: function(content, filename) {
+        if (!this._buffer) this._buffer = '';
+        if (typeof WASM_BRIDGE === 'undefined' || !WASM_BRIDGE.isReady()) {
+            return emptyExtfrag();
+        }
+        if (!content || typeof content !== 'string') return emptyExtfrag();
+        var trimmed = content.trim();
+        if (!trimmed) return emptyExtfrag();
+
+        var label = (filename && filename.indexOf('extfrag_index') !== -1) ? 'extfrag_index'
+                   : (filename && filename.indexOf('unusable_index') !== -1) ? 'unusable_index'
+                   : null;
+        if (!label) return emptyExtfrag();
+
+        if (this._buffer) this._buffer += '\n\n';
+        this._buffer += '=== ' + label + ' ===\n' + trimmed;
+
+        try {
+            return WASM_BRIDGE.parseJson('parseExtfrag', this._buffer, filename || '');
+        } catch (err) {
+            console.error('[debugfs.js] parseExtfrag WASM call failed:', err);
+            return emptyExtfrag();
+        }
+    }
+};
diff --git a/rca-tool/src/parsers/events.js b/rca-tool/src/parsers/events.js
new file mode 100644
index 0000000..4be9030
--- /dev/null
+++ b/rca-tool/src/parsers/events.js
@@ -0,0 +1,59 @@
+/**
+ * @module parsers/events
+ * @description Kernel and system event parsers (emergency-mode, kernel
+ * reboots, OOM-killer, XFS errors).  All four are WASM-backed shims
+ * delegating to `supportfile_core::parsers::events`.
+ *
+ * Rust-native field names are now consumed directly by the Leptos UI
+ * helper fallbacks, so this shim only delegates to WASM.
+ */
+
+function emptyEventsResult() {
+    return { found: false, count: 0, events: [] };
+}
+
+function callWasmEvents(fnName, content, filename) {
+    if (typeof WASM_BRIDGE === 'undefined' || !WASM_BRIDGE.isReady()) {
+        return emptyEventsResult();
+    }
+    let result;
+    try {
+        result = WASM_BRIDGE.parseJson(fnName, content, filename || '');
+    } catch (err) {
+        console.error('[events.js]', fnName, 'WASM call failed:', err);
+        return emptyEventsResult();
+    }
+    if (result == null) return emptyEventsResult();
+    if (typeof result.found === 'undefined') {
+        result.found = (result.count || (result.events && result.events.length) || 0) > 0;
+    }
+    return result;
+}
+
+const emergencyModeParser = {
+    filePattern: /\/(messages|localmessages|journalctl[^\/]*|console.*\.log)(?:[.-]\d+)?(?:\.txt)?$/,
+    parse: function(content, filename, _lines) {
+        return callWasmEvents('parseEmergencyMode', content, filename);
+    }
+};
+
+const kernelRebootsParser = {
+    filePattern: /\/(messages|localmessages|ha-log|journalctl[^\/]*)(?:[.-]\d+)?(?:\.txt)?$/,
+    parse: function(content, filename, _lines) {
+        return callWasmEvents('parseKernelReboots', content, filename);
+    }
+};
+
+const oomKillerParser = {
+    filePattern: /\/(messages|localmessages|journalctl[^\/]*)(?:[.-]\d+)?(?:\.txt)?$/,
+    parse: function(content, filename, _lines) {
+        return callWasmEvents('parseOomKiller', content, filename);
+    }
+};
+
+const xfsErrorsParser = {
+    filePattern: /\/(messages|localmessages|journalctl[^\/]*)(?:[.-]\d+)?(?:\.txt)?$/,
+    parse: function(content, filename, _lines) {
+        return callWasmEvents('parseXfsErrors', content, filename);
+    }
+};
diff --git a/rca-tool/src/parsers/hana.js b/rca-tool/src/parsers/hana.js
new file mode 100644
index 0000000..1392d97
--- /dev/null
+++ b/rca-tool/src/parsers/hana.js
@@ -0,0 +1,301 @@
+/**
+ * @module parsers/hana
+ * @description SAP HANA trace-file parser shims delegated to
+ * `supportfile_core` Rust.
+ *
+ * Currently exposes a single detector, `hanaSavepointsParser`, which scans
+ * HANA `indexserver_*.trc` / `nameserver_*.trc` trace files for savepoint
+ * activity (periodic flushes of changed pages to the data volume) and flags
+ * slow savepoint callbacks and abnormal savepoint cadence.
+ *
+ * These traces are NOT part of a standard sosreport / supportconfig bundle —
+ * they are collected separately (e.g. a HANA log ZIP). The parser is
+ * content-driven, so feeding it unrelated `.trc` files is harmless.
+ *
+ * Rust-backed entrypoint: `parseHanaSavepoints`.
+ */
+
+function _hanaWasmCall(fnName, content, filename) {
+    if (typeof WASM_BRIDGE === 'undefined' || !WASM_BRIDGE.isReady()) {
+        return null;
+    }
+    try {
+        return WASM_BRIDGE.parseJson(fnName, content, filename || '');
+    } catch (err) {
+        console.error('[hana.js]', fnName, 'WASM call failed:', err);
+        return null;
+    }
+}
+
+const hanaSavepointsParser = {
+    // indexserver_*.trc / nameserver_*.trc HANA trace files.
+    filePattern: /\/(indexserver|nameserver)[^/]*\.trc$/,
+
+    parse: function(content, filename, _lines) {
+        const result = _hanaWasmCall('parseHanaSavepoints', content, filename);
+        if (!result) {
+            return { found: false, count: 0, snapshotCount: 0, savepoints: [], warnings: [] };
+        }
+        return result;
+    },
+
+    // Multi-file: HANA spreads savepoint lines across several trace files.
+    // Concatenate savepoint/warning records, sum the counts, and keep the
+    // most recent timestamp plus the widest observed interval.
+    mergeResults: function(existing, newResult) {
+        if (!existing || !existing.found) return newResult;
+        if (!newResult || !newResult.found) return existing;
+
+        const spKey = (s) => `${(s && s.sourcePath) || ''}|${(s && s.sourceLine) || ''}|${(s && s.savepointVersion) || ''}`;
+        const warnKey = (w) => `${(w && w.type) || ''}|${(w && w.sourcePath) || ''}|${(w && w.sourceLine) || ''}`;
+
+        const seenSp = new Set((existing.savepoints || []).map(spKey));
+        const mergedSp = (existing.savepoints || []).slice();
+        for (const s of newResult.savepoints || []) {
+            const key = spKey(s);
+            if (!seenSp.has(key)) {
+                seenSp.add(key);
+                mergedSp.push(s);
+            }
+        }
+
+        const seenWarn = new Set((existing.warnings || []).map(warnKey));
+        const mergedWarn = (existing.warnings || []).slice();
+        for (const w of newResult.warnings || []) {
+            const key = warnKey(w);
+            if (!seenWarn.has(key)) {
+                seenWarn.add(key);
+                mergedWarn.push(w);
+            }
+        }
+
+        const count = (existing.count || 0) + (newResult.count || 0);
+        const snapshotCount = (existing.snapshotCount || 0) + (newResult.snapshotCount || 0);
+
+        // Count-weighted average interval; widest max interval.
+        const ea = existing.avgIntervalS, na = newResult.avgIntervalS;
+        const ec = existing.count || 0, nc = newResult.count || 0;
+        let avg = null;
+        if (ea != null && na != null && (ec + nc) > 0) {
+            avg = (ea * ec + na * nc) / (ec + nc);
+        } else {
+            avg = ea != null ? ea : na;
+        }
+        const maxInterval = Math.max(existing.maxIntervalS || 0, newResult.maxIntervalS || 0) || null;
+
+        const lastA = existing.lastSavepoint || '';
+        const lastB = newResult.lastSavepoint || '';
+        const last = lastB > lastA ? lastB : lastA;
+
+        return {
+            found: true,
+            count: count,
+            snapshotCount: snapshotCount,
+            lastSavepoint: last || null,
+            avgIntervalS: avg,
+            maxIntervalS: maxInterval,
+            savepoints: mergedSp,
+            warnings: mergedWarn,
+            sourcePath: existing.sourcePath || newResult.sourcePath,
+        };
+    },
+};
+
+// ---------------------------------------------------------------------------
+// Shared merge helpers for the aggregate HANA detectors (deadlocks, OOM,
+// merge errors). The WASM bridge has already converted snake_case keys to
+// camelCase by the time `mergeResults` runs.
+// ---------------------------------------------------------------------------
+
+const _HANA_TOP_N = 10;
+const _HANA_MAX_RECORDS = 1000;
+
+// Match `indexserver_*.trc` / `nameserver_*.trc` HANA trace files.
+const _HANA_TRC_PATTERN = /\/(indexserver|nameserver)[^/]*\.trc$/;
+
+// Merge two `[{name, count}]` tallies by summing counts per name, then keep
+// the top-N (count desc, name asc) — mirrors the Rust `top_counts`.
+function _hanaMergeTopCounts(a, b) {
+    const m = new Map();
+    for (const list of [a || [], b || []]) {
+        for (const c of list) {
+            if (!c || !c.name) continue;
+            m.set(c.name, (m.get(c.name) || 0) + (c.count || 0));
+        }
+    }
+    return [...m.entries()]
+        .map(([name, count]) => ({ name, count }))
+        .sort((x, y) => y.count - x.count || (x.name < y.name ? -1 : x.name > y.name ? 1 : 0))
+        .slice(0, _HANA_TOP_N);
+}
+
+function _hanaCapConcat(a, b, cap) {
+    const out = (a || []).slice();
+    for (const x of b || []) {
+        if (out.length >= cap) break;
+        out.push(x);
+    }
+    return out;
+}
+
+function _hanaMaxTs(a, b) {
+    a = a || '';
+    b = b || '';
+    return (b > a ? b : a) || null;
+}
+
+const hanaDeadlocksParser = {
+    filePattern: _HANA_TRC_PATTERN,
+
+    parse: function(content, filename, _lines) {
+        const result = _hanaWasmCall('parseHanaDeadlocks', content, filename);
+        if (!result) {
+            return { found: false, count: 0, topObjects: [], topStatements: [], deadlocks: [], warnings: [] };
+        }
+        return result;
+    },
+
+    mergeResults: function(existing, newResult) {
+        if (!existing || !existing.found) return newResult;
+        if (!newResult || !newResult.found) return existing;
+
+        const count = (existing.count || 0) + (newResult.count || 0);
+        const topObjects = _hanaMergeTopCounts(existing.topObjects, newResult.topObjects);
+        const topStatements = _hanaMergeTopCounts(existing.topStatements, newResult.topStatements);
+        const deadlocks = _hanaCapConcat(existing.deadlocks, newResult.deadlocks, _HANA_MAX_RECORDS);
+        const last = _hanaMaxTs(existing.lastDeadlock, newResult.lastDeadlock);
+
+        const severity = count >= 25 ? 'error' : 'warning';
+        const topObj = topObjects.length
+            ? `${topObjects[0].name} (${topObjects[0].count} deadlocks)`
+            : 'unknown';
+        const first = deadlocks[0] || {};
+        const lastD = deadlocks[deadlocks.length - 1] || {};
+        const warning = {
+            type: 'hana_deadlocks_detected',
+            message: `${count} deadlock(s) detected; HANA rolled back a victim transaction each time`,
+            details: `Most contended object: ${topObj}`,
+            severity: severity,
+            recommendation: "Recurring deadlocks usually mean concurrent transactions update the same rows in different orders. Review the contended table/statement and the application's update ordering, batch size, and commit frequency.",
+            sourcePath: existing.sourcePath || newResult.sourcePath,
+            sourceLine: first.sourceLine,
+            sourceLineEnd: lastD.sourceLineEnd,
+        };
+
+        return {
+            found: true,
+            count: count,
+            lastDeadlock: last,
+            topObjects: topObjects,
+            topStatements: topStatements,
+            deadlocks: deadlocks,
+            warnings: [warning],
+            sourcePath: existing.sourcePath || newResult.sourcePath,
+        };
+    },
+};
+
+const hanaOomParser = {
+    filePattern: _HANA_TRC_PATTERN,
+
+    parse: function(content, filename, _lines) {
+        const result = _hanaWasmCall('parseHanaOom', content, filename);
+        if (!result) {
+            return { found: false, count: 0, events: [], warnings: [] };
+        }
+        return result;
+    },
+
+    mergeResults: function(existing, newResult) {
+        if (!existing || !existing.found) return newResult;
+        if (!newResult || !newResult.found) return existing;
+
+        const count = (existing.count || 0) + (newResult.count || 0);
+        const events = _hanaCapConcat(existing.events, newResult.events, _HANA_MAX_RECORDS);
+        const last = _hanaMaxTs(existing.lastOom, newResult.lastOom);
+
+        const e0 = events[0] || {};
+        const eLast = events[events.length - 1] || {};
+        const ft = e0.failureType || 'unknown';
+        const host = e0.host || '?';
+        const warning = {
+            type: 'hana_out_of_memory',
+            message: `${count} HANA out-of-memory event(s) — an allocation hit the global allocation limit`,
+            details: `First OOM on ${host}: allocation failure type ${ft}`,
+            severity: 'error',
+            recommendation: 'OOM means HANA could not allocate within its global allocation limit. Check the largest memory consumers (column-store tables, statement memory, heap allocators), reduce statement_memory_limit offenders, and verify the host has enough physical RAM for the configured limit.',
+            sourcePath: existing.sourcePath || newResult.sourcePath,
+            sourceLine: e0.sourceLine,
+            sourceLineEnd: eLast.sourceLineEnd,
+        };
+
+        return {
+            found: true,
+            count: count,
+            lastOom: last,
+            events: events,
+            warnings: [warning],
+            sourcePath: existing.sourcePath || newResult.sourcePath,
+        };
+    },
+};
+
+const hanaMergeErrorsParser = {
+    filePattern: _HANA_TRC_PATTERN,
+
+    parse: function(content, filename, _lines) {
+        const result = _hanaWasmCall('parseHanaMergeErrors', content, filename);
+        if (!result) {
+            return { found: false, count: 0, mergeErrorCount: 0, compressionErrorCount: 0, tokenExhaustionCount: 0, topTables: [], errors: [], warnings: [] };
+        }
+        return result;
+    },
+
+    mergeResults: function(existing, newResult) {
+        if (!existing || !existing.found) return newResult;
+        if (!newResult || !newResult.found) return existing;
+
+        const count = (existing.count || 0) + (newResult.count || 0);
+        const mergeErrorCount = (existing.mergeErrorCount || 0) + (newResult.mergeErrorCount || 0);
+        const compressionErrorCount = (existing.compressionErrorCount || 0) + (newResult.compressionErrorCount || 0);
+        const tokenExhaustionCount = (existing.tokenExhaustionCount || 0) + (newResult.tokenExhaustionCount || 0);
+        const topTables = _hanaMergeTopCounts(existing.topTables, newResult.topTables);
+        const errors = _hanaCapConcat(existing.errors, newResult.errors, _HANA_MAX_RECORDS);
+        const last = _hanaMaxTs(existing.lastError, newResult.lastError);
+
+        const severity = count >= 50 ? 'error' : 'warning';
+        let message, recommendation;
+        if (tokenExhaustionCount > 0) {
+            message = `${count} delta-merge / compression failure(s); ${tokenExhaustionCount} due to merge-token exhaustion (rc=2465)`;
+            recommendation = 'Merge-token exhaustion (rc=2465) means too many merges were requested at once, often a symptom of memory pressure or a merge backlog. Check for concurrent OOM events, the mergedog configuration, and whether large tables need manual / smart merge tuning.';
+        } else {
+            message = `${count} delta-merge / optimize-compression failure(s) in HANA`;
+            recommendation = 'Failed merges leave tables with an oversized delta storage, hurting query performance and memory. Review the affected tables and the indexserver alert trace for the underlying cause.';
+        }
+        const e0 = errors[0] || {};
+        const eLast = errors[errors.length - 1] || {};
+        const warning = {
+            type: 'hana_merge_failures',
+            message: message,
+            details: topTables.length ? `Most affected table: ${topTables[0].name} (${topTables[0].count} failures)` : null,
+            severity: severity,
+            recommendation: recommendation,
+            sourcePath: existing.sourcePath || newResult.sourcePath,
+            sourceLine: e0.sourceLine,
+            sourceLineEnd: eLast.sourceLineEnd,
+        };
+
+        return {
+            found: true,
+            count: count,
+            mergeErrorCount: mergeErrorCount,
+            compressionErrorCount: compressionErrorCount,
+            tokenExhaustionCount: tokenExhaustionCount,
+            lastError: last,
+            topTables: topTables,
+            errors: errors,
+            warnings: [warning],
+            sourcePath: existing.sourcePath || newResult.sourcePath,
+        };
+    },
+};
diff --git a/rca-tool/src/parsers/network-interfaces.js b/rca-tool/src/parsers/network-interfaces.js
new file mode 100644
index 0000000..71036bf
--- /dev/null
+++ b/rca-tool/src/parsers/network-interfaces.js
@@ -0,0 +1,98 @@
+/**
+ * @module parsers/network-interfaces
+ * @description WASM-shim parser delegating to
+ * `supportfile_core::parsers::network_interfaces::parse_network_interfaces`.
+ *
+ * Per-file dispatch is handled inside the Rust port (it auto-detects
+ * `ip addr`, `ifcfg`, `nmcli`, `wicked`, `netplan` formats from the
+ * file content).  This shim invokes the Rust parser once per matching
+ * file and exposes a `mergeResults` helper for the worker to fold
+ * results across many files (see worker.js's `networkInterfaces`
+ * branch).  The merge helper tolerates both legacy `type` and
+ * Rust-native camelCase `ifaceType`.
+ */
+
+function emptyNetIfResult() {
+    return { found: false, interfaces: {}, raw: {} };
+}
+
+const networkInterfacesParser = {
+    filePattern: /(?:network\.txt$|sos_commands\/networking\/ip_-o_addr$|sos_commands\/networking\/ip_-s_-d_link$|sos_commands\/networking\/ethtool_-i_\w+|sos_commands\/networkmanager\/nmcli_con_show_id_|etc\/sysconfig\/network-scripts\/ifcfg-|etc\/sysconfig\/network\/(?:network\/)?ifcfg-|etc\/netplan\/|var\/log\/cloud-init-output\.log$|(?:^|\/)messages$)/,
+    multiFile: true,
+
+    parse: function(content, filename, _lines) {
+        if (typeof WASM_BRIDGE === 'undefined' || !WASM_BRIDGE.isReady()) {
+            return emptyNetIfResult();
+        }
+        let result;
+        try {
+            result = WASM_BRIDGE.parseJson('parseNetworkInterfaces', content, filename || '');
+        } catch (err) {
+            console.error('[network-interfaces.js] parseNetworkInterfaces WASM call failed:', err);
+            return emptyNetIfResult();
+        }
+        if (result == null) return emptyNetIfResult();
+        if (!result.raw) result.raw = {};
+        return result;
+    },
+
+    /**
+     * Helper used by the cluster section to find the accelerated-network
+     * "linked" interface bound to a primary master interface.
+     */
+    getAccelNetLinked: function(result, masterName) {
+        if (!result || !result.interfaces) return undefined;
+        return Object.values(result.interfaces).find(
+            i => i.master === masterName && i.accelNet
+        );
+    },
+
+    /**
+     * Merge two single-file results.  Mirrors the original JS merge:
+     * keep first non-null scalar fields per interface and dedupe IP
+     * lists by address.
+     */
+    mergeResults: function(existing, incoming) {
+        if (!existing || !incoming) return;
+        existing.found = existing.found || incoming.found;
+        if (!existing.interfaces) existing.interfaces = {};
+
+        for (const name of Object.keys(incoming.interfaces || {})) {
+            const iface = incoming.interfaces[name];
+            if (!existing.interfaces[name]) {
+                existing.interfaces[name] = iface;
+                continue;
+            }
+            const e = existing.interfaces[name];
+            if (iface.state && !e.state) e.state = iface.state;
+            if (iface.mac && !e.mac) e.mac = iface.mac;
+            if (iface.mtu && !e.mtu) e.mtu = iface.mtu;
+            if (iface.driver && !e.driver) e.driver = iface.driver;
+            if (iface.driverInfo && !e.driverInfo) e.driverInfo = iface.driverInfo;
+            if (iface.accelNet) e.accelNet = true;
+            if (iface.bootproto && !e.bootproto) e.bootproto = iface.bootproto;
+            if (iface.master && !e.master) e.master = iface.master;
+            const ifaceType = iface.type || iface.ifaceType;
+            if (ifaceType && !e.type) e.type = ifaceType;
+            if (iface.firmwareVersion && !e.firmwareVersion) e.firmwareVersion = iface.firmwareVersion;
+            if (iface.busInfo && !e.busInfo) e.busInfo = iface.busInfo;
+            if (Array.isArray(iface.ipv4)) {
+                if (!Array.isArray(e.ipv4)) e.ipv4 = [];
+                for (const ip of iface.ipv4) {
+                    if (!e.ipv4.some(a => a.address === ip.address)) e.ipv4.push(ip);
+                }
+            }
+            if (Array.isArray(iface.ipv6)) {
+                if (!Array.isArray(e.ipv6)) e.ipv6 = [];
+                for (const ip of iface.ipv6) {
+                    if (!e.ipv6.some(a => a.address === ip.address)) e.ipv6.push(ip);
+                }
+            }
+        }
+
+        if (incoming.raw) {
+            if (!existing.raw) existing.raw = {};
+            Object.assign(existing.raw, incoming.raw);
+        }
+    }
+};
diff --git a/rca-tool/src/parsers/networking.js b/rca-tool/src/parsers/networking.js
new file mode 100644
index 0000000..b505816
--- /dev/null
+++ b/rca-tool/src/parsers/networking.js
@@ -0,0 +1,128 @@
+/**
+ * @module parsers/networking
+ * @description WASM-shim firewall-rules parser delegating to
+ * `supportfile_core::parsers::networking::parse_firewall_rules`.
+ *
+ * The worker invokes this parser once per matching file and uses its
+ * own merge logic (see `worker.js`'s `firewallRules` branch) to fold
+ * results across many files.  After merging, the worker calls
+ * `firewallRulesParser.determineActiveFirewall(existing)` — so we keep
+ * that helper here on the parser object.
+ */
+
+function emptyFirewallResult() {
+    return {
+        found: false,
+        firewalld: { detected: false, running: false, config: null, zones: null, directRules: null, passthroughs: null, chains: null, logDenied: null, backend: null },
+        iptables: { detected: false, rules: [], modules: [] },
+        ip6tables: { detected: false, rules: [], modules: [] },
+        ebtables: { detected: false, config: null },
+        nftables: { detected: false, ruleset: null, tables: null },
+        activeFirewall: 'none',
+        warnings: [],
+        rawSections: {}
+    };
+}
+
+const firewallRulesParser = {
+    filePattern: /(?:network\.txt$|sos_commands\/firewalld\/|sos_commands\/firewall_tables\/|etc\/sysconfig\/(?:iptables-config|ebtables-config|nftables\.conf|firewalld)$|etc\/firewalld\/firewalld\.conf$)/,
+    multiFile: true,
+
+    parse: function(content, filename, _lines) {
+        if (typeof WASM_BRIDGE === 'undefined' || !WASM_BRIDGE.isReady()) {
+            return emptyFirewallResult();
+        }
+        let result;
+        try {
+            result = WASM_BRIDGE.parseJson('parseFirewallRules', content, filename || '');
+        } catch (err) {
+            console.error('[networking.js] parseFirewallRules WASM call failed:', err);
+            return emptyFirewallResult();
+        }
+        if (result == null) return emptyFirewallResult();
+        if (!result.rawSections) result.rawSections = {};
+        return result;
+    },
+
+    /**
+     * Re-run the active-firewall priority check after the worker has
+     * merged contributions from multiple files.  Mirrors the priority
+     * order in the Rust parser: firewalld(running) > nftables(non-empty)
+     * > iptables > ip6tables > none.
+     */
+    determineActiveFirewall: function(result) {
+        if (result.firewalld && result.firewalld.running) return 'firewalld';
+        if (result.nftables && result.nftables.ruleset
+            && result.nftables.ruleset !== '(empty)'
+            && result.nftables.ruleset.trim() !== '') return 'nftables';
+        if (result.iptables && result.iptables.rules && result.iptables.rules.length > 0) return 'iptables';
+        if (result.ip6tables && result.ip6tables.rules && result.ip6tables.rules.length > 0) return 'ip6tables';
+        return 'none';
+    }
+};
+
+/**
+ * Packet-loss / RX-TX counter parser. Delegates to
+ * `supportfile_core::parsers::networking::parse_packet_loss` which
+ * reads `ip -stats link` output from SCC `network.txt` (or SOS
+ * `sos_commands/networking/ip_-s_-d_link`).
+ */
+function emptyPacketLossResult() {
+    return { found: false, interfaces: [], warnings: [], sourcePath: '' };
+}
+const packetLossParser = {
+    filePattern: /(?:network\.txt$|sos_commands\/networking\/ip_-s_-d_link$|sos_commands\/networking\/ip_-s_link$)/,
+    multiFile: false,
+    parse: function(content, filename) {
+        if (typeof WASM_BRIDGE === 'undefined' || !WASM_BRIDGE.isReady()) return emptyPacketLossResult();
+        try {
+            return WASM_BRIDGE.parseJson('parsePacketLoss', content, filename || '') || emptyPacketLossResult();
+        } catch (err) {
+            console.error('[networking.js] parsePacketLoss WASM call failed:', err);
+            return emptyPacketLossResult();
+        }
+    }
+};
+
+/**
+ * NIC ring-buffer parser (ethtool -g). Delegates to
+ * `supportfile_core::parsers::networking::parse_ring_buffer`.
+ */
+function emptyRingBufferResult() {
+    return { found: false, entries: [], warnings: [], sourcePath: '' };
+}
+const ringBufferParser = {
+    filePattern: /(?:network\.txt$|sos_commands\/networking\/ethtool_-g_\w+)/,
+    multiFile: false,
+    parse: function(content, filename) {
+        if (typeof WASM_BRIDGE === 'undefined' || !WASM_BRIDGE.isReady()) return emptyRingBufferResult();
+        try {
+            return WASM_BRIDGE.parseJson('parseRingBuffer', content, filename || '') || emptyRingBufferResult();
+        } catch (err) {
+            console.error('[networking.js] parseRingBuffer WASM call failed:', err);
+            return emptyRingBufferResult();
+        }
+    }
+};
+
+/**
+ * Network-tuning sysctl parser. Currently surfaces
+ * `net.ipv4.conf.*.rp_filter` values; warns on non-zero settings
+ * because they cause asymmetric-routing drops on multi-NIC Azure VMs.
+ */
+function emptyNetworkSysctlResult() {
+    return { found: false, rpFilter: [], warnings: [], sourcePath: '' };
+}
+const networkSysctlParser = {
+    filePattern: /(?:\/env\.txt$|\/sysctl\.conf$|sos_commands\/kernel\/sysctl_-a$|etc\/sysctl\.d\/)/,
+    multiFile: false,
+    parse: function(content, filename) {
+        if (typeof WASM_BRIDGE === 'undefined' || !WASM_BRIDGE.isReady()) return emptyNetworkSysctlResult();
+        try {
+            return WASM_BRIDGE.parseJson('parseNetworkSysctl', content, filename || '') || emptyNetworkSysctlResult();
+        } catch (err) {
+            console.error('[networking.js] parseNetworkSysctl WASM call failed:', err);
+            return emptyNetworkSysctlResult();
+        }
+    }
+};
diff --git a/rca-tool/src/parsers/services.js b/rca-tool/src/parsers/services.js
new file mode 100644
index 0000000..35b87d9
--- /dev/null
+++ b/rca-tool/src/parsers/services.js
@@ -0,0 +1,199 @@
+/**
+ * @module parsers/services
+ * @description WASM-shim parsers for distro/cluster service detection.
+ * All parsers delegate to `supportfile_core::parsers::services`.
+ *
+ * Per-parser field aliases bring the WASM result back in line with the
+ * legacy schema the Leptos sections consume:
+ *   - `sourcePath` → `sourceFile` (event records)
+ *   - `sourcePath` → `detectionFile` (systemd-service detections)
+ *   - `issueType` (already snake→camelCase'd, no further alias needed)
+ *
+ * For systemd-service detections the legacy JS helper also surfaced a
+ * `detectionContent` snippet (the matched line text).  The Rust port
+ * stores `source_line` only; the shim resolves the snippet by indexing
+ * the raw content with that line number.
+ */
+
+function emptyEvents() { return { found: false, count: 0, events: [] }; }
+function emptyDetect() { return { found: false }; }
+
+function callServicesWasm(fnName, content, filename, fallback) {
+    if (typeof WASM_BRIDGE === 'undefined' || !WASM_BRIDGE.isReady()) return fallback;
+    try {
+        const result = WASM_BRIDGE.parseJson(fnName, content, filename || '');
+        return result == null ? fallback : result;
+    } catch (err) {
+        console.error('[services.js]', fnName, err);
+        return fallback;
+    }
+}
+
+function lineSnippet(content, lineNo) {
+    if (!content || !lineNo || typeof lineNo !== 'number') return null;
+    const lines = content.split('\n');
+    if (lineNo < 1 || lineNo > lines.length) return null;
+    return lines[lineNo - 1].trim();
+}
+
+function callServiceEvents(fnName, content, filename) {
+    return callServicesWasm(fnName, content, filename, emptyEvents());
+}
+
+/**
+ * Wrap a systemd-service detection result so legacy consumers see
+ * `enabled`, `detectionFile`, `detectionLine`, `detectionContent`.
+ */
+function decorateDetection(rawResult, content, filename, opts) {
+    if (!rawResult || !rawResult.found) return { found: false };
+    const out = {
+        found: true,
+        enabled: true,
+        severity: rawResult.severity,
+        message: rawResult.message,
+        detectionFile: filename,
+        detectionLine: rawResult.sourceLine || null,
+        detectionContent: lineSnippet(content, rawResult.sourceLine)
+    };
+    if (rawResult.documentationUrl) out.documentationUrl = rawResult.documentationUrl;
+    if (opts && opts.documentationUrl && !out.documentationUrl) {
+        out.documentationUrl = opts.documentationUrl;
+    }
+    return out;
+}
+
+function callDetection(fnName, content, filename, opts) {
+    const r = callServicesWasm(fnName, content, filename, emptyDetect());
+    return decorateDetection(r, content, filename, opts);
+}
+
+function callSecurityDetection(fnName, content) {
+    const r = callServicesWasm(fnName, content, '', emptyDetect());
+    if (!r || !r.found) return { found: false };
+    return { found: true, message: r.message };
+}
+
+function callConfigCheck(fnName, content) {
+    return callServicesWasm(fnName, content, '', emptyDetect());
+}
+
+const sshServiceParser = {
+    filePattern: /\/(messages|localmessages|syslog|journalctl[^\/]*|console.*\.log)(?:[.-]\d+)?(?:\.txt)?$/,
+    parse: function(content, filename, _lines) {
+        return callServiceEvents('parseSshServiceIssues', content, filename);
+    }
+};
+
+const dlmServiceParser = {
+    filePattern: /sos_commands\/systemd\/systemctl_list-unit-files$/,
+    parse: function(content, filename, _lines) {
+        return callDetection('parseDlmService', content, filename,
+            { documentationUrl: 'https://access.redhat.com/solutions/878023' });
+    }
+};
+
+const azureSiteRecoveryParser = {
+    filePattern: /(?:sos_commands\/systemd\/systemctl_list-unit-files|systemd-status\.txt)$/,
+    parse: function(content, filename, _lines) {
+        return callDetection('parseAzureSiteRecovery', content, filename);
+    }
+};
+
+const guardicoreAgentParser = {
+    filePattern: /(?:sos_commands\/systemd\/systemctl_list-unit-files|systemd-status\.txt)$/,
+    parse: function(content, filename, _lines) {
+        return callDetection('parseGuardicoreAgent', content, filename);
+    }
+};
+
+const puppetAgentParser = {
+    filePattern: /(?:sos_commands\/systemd\/systemctl_list-unit-files|systemd-status\.txt)$/,
+    parse: function(content, filename, _lines) {
+        return callDetection('parsePuppetAgent', content, filename);
+    }
+};
+
+const chefClientParser = {
+    filePattern: /(?:sos_commands\/systemd\/systemctl_list-unit-files|systemd-status\.txt)$/,
+    parse: function(content, filename, _lines) {
+        return callDetection('parseChefClient', content, filename);
+    }
+};
+
+const illumioParser = {
+    filePattern: /sos_commands\/systemd\/systemctl_list-units_--all$/,
+    parse: function(content, _filename, _lines) {
+        return callSecurityDetection('parseIllumio', content);
+    }
+};
+
+const trendMicroParser = {
+    filePattern: /sos_commands\/systemd\/systemctl_list-units_--all$/,
+    parse: function(content, _filename, _lines) {
+        return callSecurityDetection('parseTrendMicro', content);
+    }
+};
+
+const falconSensorParser = {
+    filePattern: /\/(rpm\.txt|installed-rpms|package-data|ps\.txt|ps_.*\.txt)$/,
+    parse: function(content, _filename, _lines) {
+        return callSecurityDetection('parseFalconSensor', content);
+    }
+};
+
+const falconSensorConfigParser = {
+    filePattern: /\/(falconctl|CrowdStrike.*config|falcon.*conf)$/i,
+    parse: function(content, _filename, _lines) {
+        return callConfigCheck('parseFalconSensorConfig', content);
+    }
+};
+
+const msDefenderParser = {
+    filePattern: /\/(rpm\.txt|installed-rpms|package-data|ps\.txt|ps_.*\.txt)$/,
+    parse: function(content, _filename, _lines) {
+        return callSecurityDetection('parseMsDefender', content);
+    }
+};
+
+const msDefenderConfigParser = {
+    filePattern: /\/(mdatp.*|defender.*config)$/i,
+    parse: function(content, _filename, _lines) {
+        return callConfigCheck('parseMsDefenderConfig', content);
+    }
+};
+
+const involfltVersionParser = {
+    filePattern: /modules\.txt$/,
+    parse: function(content, filename, _lines) {
+        const r = callServicesWasm('parseInvolfltVersion', content, filename, emptyDetect());
+        if (!r || !r.found) return { found: false };
+        return r;
+    }
+};
+
+const involfltKernelVersionParser = {
+    filePattern: /\/(messages|boot)(?:[.-]\d+)?(?:\.txt)?$/,
+    parse: function(content, filename, _lines) {
+        const r = callServicesWasm('parseInvolfltKernelVersion', content, filename, null);
+        if (!r || !r.found) return null;
+        return r;
+    }
+};
+
+const azureExtensionsParser = {
+    filePattern: /var\/lib\/waagent\/[^\/]+\/config\/HandlerStatus$/,
+    parse: function(content, filename, _lines) {
+        const r = callServicesWasm('parseAzureExtensions', content, filename, null);
+        if (!r || !r.found) return null;
+        return r;
+    }
+};
+
+const fstrimParser = {
+    filePattern: /sos_commands\/systemd\/systemctl_list-unit-files$|\/systemd-status\.txt$|sos_commands\/.*fstrim.*$/,
+    parse: function(content, filename, _lines) {
+        const r = callServicesWasm('parseFstrim', content, filename, null);
+        if (!r || !r.found) return null;
+        return r;
+    }
+};
diff --git a/rca-tool/src/parsers/storage.js b/rca-tool/src/parsers/storage.js
new file mode 100644
index 0000000..a876bef
--- /dev/null
+++ b/rca-tool/src/parsers/storage.js
@@ -0,0 +1,478 @@
+/**
+ * @module parsers/storage
+ * @description Storage parser shims delegated to `supportfile_core` Rust.
+ *
+ * This file intentionally does not implement storage parsing logic in JS.
+ * Each parser calls `WASM_BRIDGE.parseJson(...)` and only performs minimal
+ * compatibility shaping for current Leptos consumers (raw panes, field aliases,
+ * and multi-file result merges).
+ *
+ * Rust-backed parser entrypoints used here:
+ *   - `parseLvmConfig`
+ *   - `parseRaidConfig`
+ *   - `parseFstabAnalysis`
+ *   - `parseDfOutput`
+ *   - `parseMtabAnalysis`
+ *   - `parseBtrfsConfig`
+ *   - `parseBlockDevices`
+ *
+ * SCC `fs-diskio.txt` extraction (fstab / df / mount sections) remains as
+ * lightweight pre-processing in JS before invoking Rust.
+ */
+
+function _storageWasmCall(fnName, content, filename, fallback) {
+    if (typeof WASM_BRIDGE === 'undefined' || !WASM_BRIDGE.isReady()) {
+        return fallback;
+    }
+    try {
+        return WASM_BRIDGE.parseJson(fnName, content, filename || '');
+    } catch (err) {
+        console.error('[storage.js]', fnName, 'WASM call failed:', err);
+        return fallback;
+    }
+}
+
+// ===========================================================================
+// lvmConfig — thin shim
+// ===========================================================================
+//
+// The Rust `parseLvmConfig` parses any LVM content (aggregated lvm.txt,
+// individual pvs/vgs/lvs/pvdisplay/etc.) line-by-line and emits the same
+// PV/VG/LV columns as the legacy JS.  The shim is responsible for:
+//   1. Filtering supportconfig markers / lvm preamble (so that the
+//      `rawOutput.{pvs,vgs,lvs}` panes shown by the Leptos UI stay clean).
+//   2. Routing the cleaned content into the right `rawOutput` slot based
+//      on the filename.
+//   3. Keeping raw panes mapped by filename so the Leptos LVM
+//      table and diagnostics stay coherent across split files.
+//
+// `mergeResults` is preserved so the worker can accumulate sosreport's
+// separate `pvs.txt`, `vgs.txt`, and `lvs.txt` files into one result.
+
+function _cleanLvmOutput(content) {
+    return content
+        .split('\n')
+        .filter(line => {
+            const t = line.trim();
+            return !t.startsWith('#==')
+                && !t.startsWith('WARNING:')
+                && !t.startsWith('Reloading')
+                && !t.startsWith('Loading config')
+                && !t.startsWith('devices/');
+        })
+        .join('\n');
+}
+
+const lvmConfigParser = {
+    filePattern: /\/(lvm\.txt|pvs\.txt|vgs\.txt|lvs\.txt|pvdisplay|vgdisplay|lvdisplay)$|\/lvm2\/pvs_|\/lvm2\/vgs_|\/lvm2\/lvs_/,
+
+    parse: function(content, filename, _lines) {
+        const result = _storageWasmCall('parseLvmConfig', content, filename, null);
+        if (!result) {
+            return { found: false, pvs: [], vgs: [], lvs: [], warnings: [], rawOutput: {} };
+        }
+        if (!result.rawOutput || typeof result.rawOutput !== 'object') {
+            result.rawOutput = {};
+        }
+
+        // Route raw content into the right pane.  For aggregated lvm.txt,
+        // we don't try to split here — Leptos shows whatever section keys
+        // are present, and the structured pvs/vgs/lvs arrays already carry
+        // the parsed data.
+        const basename = (filename || '').split('/').pop();
+        const cleanContent = _cleanLvmOutput(content);
+        if (basename === 'lvm.txt') {
+            result.rawOutput.pvs = cleanContent;
+            result.rawOutput.vgs = cleanContent;
+            result.rawOutput.lvs = cleanContent;
+        } else if (basename.startsWith('pvs') || basename === 'pvdisplay') {
+            result.rawOutput.pvs = cleanContent;
+        } else if (basename.startsWith('vgs') || basename === 'vgdisplay') {
+            result.rawOutput.vgs = cleanContent;
+        } else if (basename.startsWith('lvs') || basename === 'lvdisplay') {
+            result.rawOutput.lvs = cleanContent;
+        }
+        return result;
+    },
+
+    /**
+     * Merge results from multiple LVM files (sosreport ships pvs/vgs/lvs as
+     * separate files).  Same contract as the legacy JS implementation:
+     * push arrays, OR `found` flags, and shallow-merge `rawOutput`.
+     */
+    mergeResults: function(existing, newResult) {
+        if (newResult.pvs && newResult.pvs.length > 0) existing.pvs.push(...newResult.pvs);
+        if (newResult.vgs && newResult.vgs.length > 0) existing.vgs.push(...newResult.vgs);
+        if (newResult.lvs && newResult.lvs.length > 0) existing.lvs.push(...newResult.lvs);
+        if (newResult.warnings && newResult.warnings.length > 0) {
+            existing.warnings.push(...newResult.warnings);
+        }
+        if (newResult.rawOutput) {
+            if (!existing.rawOutput) existing.rawOutput = {};
+            Object.assign(existing.rawOutput, newResult.rawOutput);
+        }
+        if ((newResult.pvs?.length || 0) > 0
+            || (newResult.vgs?.length || 0) > 0
+            || (newResult.lvs?.length || 0) > 0) {
+            existing.found = true;
+        }
+    },
+};
+
+// ===========================================================================
+// raidConfig — thin shim
+// ===========================================================================
+
+const raidConfigParser = {
+    filePattern: /\/(mdstat|md-arrays\.txt|mdadm\.txt|proc\/mdstat)$/,
+
+    parse: function(content, filename, _lines) {
+        const result = _storageWasmCall('parseRaidConfig', content, filename, null);
+        if (!result) {
+            return { found: false, arrays: [], warnings: [], rawOutput: { mdstat: content } };
+        }
+        if (!result.rawOutput || typeof result.rawOutput !== 'object') {
+            result.rawOutput = {};
+        }
+        result.rawOutput.mdstat = content;
+        return result;
+    },
+};
+
+// ===========================================================================
+// fstabAnalysis — thin shim (with SCC section extraction kept in JS)
+// ===========================================================================
+
+function _extractFstabFromSCC(content) {
+    // SCC's `fs-diskio.txt` is a multipart file with sections delimited by
+    // lines starting with `#==[` (e.g. `#==[ Configuration File ]==`).
+    // The fstab section begins with a `# /etc/fstab` header line and ends
+    // at the next `#==` marker.  Blank lines and commented-out fstab entries
+    // (e.g. `#/dev/system/swap` on SUSE12) are legitimate fstab content and
+    // must NOT terminate the section.
+    const headerRe = /^#\s*\/etc\/fstab\s*$/;
+    const out = [];
+    let inSection = false;
+    for (const line of content.split('\n')) {
+        if (!inSection) {
+            if (headerRe.test(line)) inSection = true;
+            continue;
+        }
+        if (line.startsWith('#==')) break;
+        out.push(line);
+    }
+    // Strip leading/trailing blanks; preserve interior blanks (some fstabs
+    // use blank lines as visual separators between mount groups).
+    while (out.length && out[0].trim() === '') out.shift();
+    while (out.length && out[out.length - 1].trim() === '') out.pop();
+    return out.length > 0 ? out.join('\n') : null;
+}
+
+const fstabAnalysisParser = {
+    filePattern: /\/etc\/fstab$|\/fs-diskio\.txt$/,
+
+    parse: function(content, filename, _lines) {
+        let fstabContent = content;
+        if ((filename || '').includes('fs-diskio.txt')) {
+            fstabContent = _extractFstabFromSCC(content);
+            if (!fstabContent) {
+                return { found: false, entries: [], warnings: [] };
+            }
+        }
+
+        const result = _storageWasmCall('parseFstabAnalysis', fstabContent, filename, null);
+        if (!result) {
+            return { found: false, entries: [], warnings: [], rawContent: fstabContent };
+        }
+        result.rawContent = fstabContent;
+        return result;
+    },
+};
+
+// ===========================================================================
+// dfOutput — thin shim (with SCC section extraction kept in JS)
+// ===========================================================================
+
+function _extractDfFromSCC(content) {
+    const lines = content.split('\n');
+    const out = [];
+    let inSection = false;
+    for (const line of lines) {
+        if (line.includes('# /bin/df') || line.includes('# df ')) {
+            inSection = true;
+            continue;
+        }
+        if (inSection && (line.startsWith('#==') || (line.startsWith('# /') && !line.includes('df')))) {
+            break;
+        }
+        if (inSection && line.trim()) out.push(line);
+    }
+    return out.length > 0 ? out.join('\n') : null;
+}
+
+const dfOutputParser = {
+    filePattern: /\/df$|\/df_-aliT|\/df_-al_|\/fs-diskio\.txt$/,
+
+    parse: function(content, filename, _lines) {
+        let dfContent = content;
+        if ((filename || '').includes('fs-diskio.txt')) {
+            dfContent = _extractDfFromSCC(content);
+            if (!dfContent) {
+                return { found: false, filesystems: [], mountToUsage: {} };
+            }
+        }
+
+        const result = _storageWasmCall('parseDfOutput', dfContent, filename, null);
+        if (!result) {
+            return { found: false, filesystems: [], mountToUsage: {} };
+        }
+        return result;
+    },
+};
+
+// ===========================================================================
+// mtabAnalysis — thin shim (with SCC section extraction kept in JS)
+// ===========================================================================
+//
+// The Rust `parseMtabAnalysis` already handles the `device on mp type fs
+// (opts)` mount-command format internally, so we don't need the legacy
+// `convertMountToMtab` helper.  We still extract the mount section from
+// SCC's `fs-diskio.txt` here in JS.
+//
+// Note: Rust pre-populates `extra_mounts` with all non-virtual entries.
+// The worker's `compareMtabWithFstab()` re-derives `extraMounts` later by
+// diffing against fstab, so the Rust default is harmless (it gets
+// overwritten).
+
+function _extractMountFromSCC(content) {
+    const lines = content.split('\n');
+    const out = [];
+    let inSection = false;
+    for (const line of lines) {
+        if (/^#\s*\/bin\/mount\b/.test(line) || /^#\s*mount\s*$/.test(line)) {
+            inSection = true;
+            continue;
+        }
+        if (inSection && (line.startsWith('#==') || /^#\s*\//.test(line))) break;
+        if (inSection && line.trim()) out.push(line);
+    }
+    return out.length > 0 ? out.join('\n') : null;
+}
+
+const mtabAnalysisParser = {
+    filePattern: /\/etc\/mtab$|\/proc\/mounts$|\/proc\/self\/mounts$|\/fs-diskio\.txt$|\/mount_-l$|\/mount$/,
+
+    parse: function(content, filename, _lines) {
+        let mtabContent = content;
+        if ((filename || '').includes('fs-diskio.txt')) {
+            mtabContent = _extractMountFromSCC(content);
+            if (!mtabContent) {
+                return { found: false, entries: [], extraMounts: [], rawContent: '' };
+            }
+        }
+
+        const result = _storageWasmCall('parseMtabAnalysis', mtabContent, filename, null);
+        if (!result) {
+            return { found: false, entries: [], extraMounts: [], rawContent: mtabContent };
+        }
+        result.rawContent = mtabContent;
+        return result;
+    },
+};
+
+// ===========================================================================
+// btrfsConfig — thin shim
+// ===========================================================================
+// Rust now provides the parser. Keep a tiny compatibility projection so the
+// Leptos renderer can keep reading legacy fields while we finish UI cleanup.
+
+const btrfsConfigParser = {
+    filePattern: /\/(btrfs\.txt|fs-btrfs\.txt|btrfs-filesystem-show\.txt|btrfs-subvolume-list\.txt)$/,
+
+    parse: function(content, filename, _lines) {
+        const result = _storageWasmCall('parseBtrfsConfig', content, filename, null);
+        if (!result) {
+            return { found: false, filesystems: [], subvolumes: [], warnings: [], rawOutput: {} };
+        }
+
+        if (!Array.isArray(result.filesystems)) result.filesystems = [];
+        if (!Array.isArray(result.subvolumes)) result.subvolumes = [];
+        if (!Array.isArray(result.warnings)) result.warnings = [];
+        if (!result.rawOutput || typeof result.rawOutput !== 'object') {
+            result.rawOutput = {};
+        }
+
+        // Compatibility projection for legacy Leptos rendering.
+        for (const fs of result.filesystems) {
+            if (!Array.isArray(fs.devices)) fs.devices = [];
+            if (fs.deviceCount == null) fs.deviceCount = String(fs.devices.length);
+            fs.devices = fs.devices.map((dev, idx) => {
+                if (typeof dev === 'string') {
+                    return {
+                        devid: String(idx + 1),
+                        size: '-',
+                        used: '-',
+                        path: dev,
+                    };
+                }
+                return dev;
+            });
+        }
+
+        for (const subvol of result.subvolumes) {
+            if (subvol.parent == null) subvol.parent = '-';
+            if (subvol.topLevel == null) subvol.topLevel = '-';
+        }
+
+        const basename = (filename || '').split('/').pop() || '';
+        if (basename.includes('filesystem-show')) result.rawOutput.filesystems = content;
+        if (basename.includes('subvolume-list')) result.rawOutput.subvolumes = content;
+        if (basename === 'btrfs.txt') {
+            result.rawOutput.filesystems = result.rawOutput.filesystems || content;
+            result.rawOutput.subvolumes = result.rawOutput.subvolumes || content;
+        }
+
+        return result;
+    }
+};
+
+// ===========================================================================
+// blockDevices — thin shim
+// ===========================================================================
+
+const blockDevicesParser = {
+    filePattern: /\/sos_commands\/block\/(lsblk|lsblk_-f_-a_-l|blkid_-c_.dev.null)$|^results\.txt$/,
+    multiFile: true,
+
+    parse: function(content, filename, _lines) {
+        const result = _storageWasmCall('parseBlockDevices', content, filename, null);
+        if (!result) {
+            return {
+                found: false,
+                disks: [],
+                partitions: [],
+                uuidMap: {},
+                deviceMap: {},
+                mountPoints: {},
+                warnings: [],
+                rawOutput: {},
+            };
+        }
+
+        if (!result.uuidMap || typeof result.uuidMap !== 'object') result.uuidMap = {};
+        if (!result.deviceMap || typeof result.deviceMap !== 'object') result.deviceMap = {};
+        if (!result.mountPoints || typeof result.mountPoints !== 'object') result.mountPoints = {};
+        if (!Array.isArray(result.disks)) result.disks = [];
+        if (!Array.isArray(result.partitions)) result.partitions = [];
+        if (!Array.isArray(result.warnings)) result.warnings = [];
+        if (!result.rawOutput || typeof result.rawOutput !== 'object') result.rawOutput = {};
+
+        // Preserve raw panes for troubleshooting/debug UI.
+        const basename = (filename || '').split('/').pop() || '';
+        if (basename === 'lsblk') result.rawOutput.lsblk = content;
+        else if (basename.includes('lsblk_-f_-a_-l')) result.rawOutput.lsblkFull = content;
+        else if (basename.includes('blkid')) result.rawOutput.blkid = content;
+        else if (basename === 'results.txt') result.rawOutput.inspectDisk = content;
+
+        return result;
+    }
+};
+
+const nvmeListParser = {
+    filePattern: /sos_commands\/nvme\/nvme_list$/,
+
+    parse: function(content, filename, _lines) {
+        const result = _storageWasmCall('parseNvmeList', content, filename, null);
+        if (!result) {
+            return {
+                found: false,
+                hasNVMe: false,
+                driveCount: 0,
+                content: null,
+                filename: filename,
+            };
+        }
+
+        // Rust emits snake_case; normalize keys expected by the UI.
+        if (typeof result.hasNVMe === 'undefined' && typeof result.hasNvme !== 'undefined') {
+            result.hasNVMe = result.hasNvme;
+        }
+        if (typeof result.driveCount !== 'number') {
+            result.driveCount = 0;
+        }
+        return result;
+    }
+};
+
+// ===========================================================================
+// nfsMounts — thin shim (NFS mount-option quality analysis)
+// ===========================================================================
+//
+// Recognises NFS mounts in `/etc/fstab`, `/etc/mtab`, `/proc/mounts`, the
+// `mount` command output, and SCC's `fs-diskio.txt` (which embeds both an
+// fstab and a mount section).  The Rust `parseNfsMounts` understands both the
+// fstab columnar format and the `src on mp type fs (opts)` mount format, so we
+// just feed it the relevant text.  Multi-file: the worker accumulates mounts
+// from fstab + mount sources and `mergeResults` de-duplicates by mountpoint.
+
+const nfsMountsParser = {
+    filePattern: /\/etc\/fstab$|\/etc\/mtab$|\/proc\/mounts$|\/proc\/self\/mounts$|\/fs-diskio\.txt$|\/mount_-l$|\/mount$/,
+
+    parse: function(content, filename, _lines) {
+        let nfsContent = content;
+        if ((filename || '').includes('fs-diskio.txt')) {
+            const sections = [];
+            const fstabSection = _extractFstabFromSCC(content);
+            if (fstabSection) sections.push(fstabSection);
+            const mountSection = _extractMountFromSCC(content);
+            if (mountSection) sections.push(mountSection);
+            if (sections.length === 0) {
+                return { found: false, mounts: [], warnings: [] };
+            }
+            nfsContent = sections.join('\n');
+        }
+
+        const result = _storageWasmCall('parseNfsMounts', nfsContent, filename, null);
+        if (!result) {
+            return { found: false, mounts: [], warnings: [] };
+        }
+        return result;
+    },
+
+    // De-duplicate NFS mounts and warnings across fstab/mtab/mount sources so a
+    // mount listed in both fstab and the live mount table is only reported once.
+    mergeResults: function(existing, newResult) {
+        if (!existing || !existing.found) return newResult;
+        if (!newResult || !newResult.found) return existing;
+
+        const mountKey = (m) => `${(m && m.source) || ''}|${(m && m.mountpoint) || ''}`;
+        const warnKey = (w) => `${(w && w.type) || ''}|${(w && w.mountpoint) || ''}|${(w && w.message) || ''}`;
+
+        const seenMounts = new Set((existing.mounts || []).map(mountKey));
+        const mergedMounts = (existing.mounts || []).slice();
+        for (const m of newResult.mounts || []) {
+            const key = mountKey(m);
+            if (!seenMounts.has(key)) {
+                seenMounts.add(key);
+                mergedMounts.push(m);
+            }
+        }
+
+        const seenWarnings = new Set((existing.warnings || []).map(warnKey));
+        const mergedWarnings = (existing.warnings || []).slice();
+        for (const w of newResult.warnings || []) {
+            const key = warnKey(w);
+            if (!seenWarnings.has(key)) {
+                seenWarnings.add(key);
+                mergedWarnings.push(w);
+            }
+        }
+
+        return {
+            found: true,
+            mounts: mergedMounts,
+            warnings: mergedWarnings,
+            source_path: existing.source_path || newResult.source_path,
+        };
+    },
+};
diff --git a/rca-tool/src/parsers/unix.js b/rca-tool/src/parsers/unix.js
new file mode 100644
index 0000000..0109825
--- /dev/null
+++ b/rca-tool/src/parsers/unix.js
@@ -0,0 +1,354 @@
+/**
+ * @module parsers/unix
+ * @description Thin shims for Unix system parsers. The real implementation
+ * lives in `rca-tool/lib/supportfile_core/src/parsers/unix.rs` and is
+ * exposed via `wasm_bindgen.parse*` exports (see `supportfile_wasm/src/lib.rs`).
+ *
+ * Each shim:
+ *   1. Calls `WASM_BRIDGE.parseJson(...)` (which JSON-parses the Rust output
+ *      and recursively snake_case → camelCase transforms keys).
+ *   2. Returns the result unchanged. A Leptos audit confirmed every consumer
+ *      reads the mechanical camelCase form for these 22 parsers — no
+ *      acronym-aware aliasing is required.
+ *
+ * Special cases:
+ *   - `kernelTuningParser` keeps its `mergeResults` method because worker.js
+ *     accumulates `parameters{}` across multiple sysctl files and recomputes
+ *     warnings/Azure-network/optional-network info from the merged set.
+ *
+ * Fallback: if WASM is not loaded, every parser returns `{ found: false }`.
+ *
+ * @see {@link module:worker} for registration in SCC_RULES.
+ */
+
+function _wasmCall(fnName, content, filename, fallback) {
+    if (typeof WASM_BRIDGE === 'undefined' || !WASM_BRIDGE.isReady()) {
+        return fallback;
+    }
+    try {
+        return WASM_BRIDGE.parseJson(fnName, content, filename || '');
+    } catch (err) {
+        console.error('[unix.js]', fnName, 'WASM call failed:', err);
+        return fallback;
+    }
+}
+
+// ---------------------------------------------------------------------------
+// OS Identity
+// ---------------------------------------------------------------------------
+
+const basicEnvironmentParser = {
+    filePattern: /basic-environment\.txt$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseBasicEnvironment', content, filename, { found: false });
+    }
+};
+
+const osReleaseParser = {
+    // Match os-release files from various report types:
+    // - /usr/lib/os-release (sosreport - real file, not the /etc symlink)
+    // - /etc/os-release (crm_report)
+    // - sysinfo.txt (supportconfig SUSE - older format)
+    // - basic-environment.txt (supportconfig SUSE - newer format)
+    // - /etc/redhat-release, /etc/centos-release, /etc/SuSE-release, /etc/system-release
+    filePattern: /\/usr\/lib\/os-release$|\/etc\/os-release$|\/sysinfo\.txt$|\/basic-environment\.txt$|\/etc\/(redhat|centos|SuSE|system)-release$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseOsRelease', content, filename, { found: false });
+    }
+};
+
+// ---------------------------------------------------------------------------
+// Filesystem
+// ---------------------------------------------------------------------------
+
+const fstabParser = {
+    filePattern: /\/etc\/fstab$|\/fs-diskio\.txt$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseFstab', content, filename, { found: false });
+    }
+};
+
+// ---------------------------------------------------------------------------
+// InspectIaaSDisk
+// ---------------------------------------------------------------------------
+
+const inspectDiskResultsParser = {
+    filePattern: /^results\.txt$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseInspectDiskResults', content, filename, { found: false });
+    }
+};
+
+// ---------------------------------------------------------------------------
+// Kernel Tuning
+// ---------------------------------------------------------------------------
+
+const kernelTuningParser = {
+    filePattern: /sos_commands\/kernel\/sysctl_-a$|\/env\.txt$|\/etc\/sysctl\.conf$|\/sysctl\.d\/[^\/]*\.conf$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseKernelTuning', content, filename, { found: false });
+    },
+
+    /**
+     * Merge a per-file kernelTuning result into the accumulated state.
+     * Worker invokes this for every matching sysctl file so we accumulate
+     * `parameters{}` across env.txt + sysctl.conf + sysctl.d/*.conf, then
+     * recompute SAP-HANA / Azure-network / optional-network warnings from
+     * the merged set (the per-file warnings from Rust are discarded).
+     */
+    mergeResults: function(accumulated, newResult) {
+        if (!newResult || !newResult.found) return;
+        accumulated.found = true;
+
+        // Merge parameters — later values override earlier ones
+        Object.assign(accumulated.parameters, newResult.parameters || {});
+
+        const parameters = accumulated.parameters;
+
+        // SAP HANA / high-performance warnings
+        const expectedValues = {
+            'vm.dirty_bytes': '629145600',
+            'vm.dirty_background_bytes': '314572800',
+            'vm.swappiness': '10'
+        };
+        const documentation = {
+            'vm.dirty_bytes': 'https://learn.microsoft.com/en-us/azure/sap/workloads/sap-hana-high-availability',
+            'vm.dirty_background_bytes': 'https://learn.microsoft.com/en-us/azure/sap/workloads/sap-hana-high-availability',
+            'vm.swappiness': 'https://learn.microsoft.com/en-us/azure/sap/workloads/sap-hana-high-availability'
+        };
+        const warnings = [];
+        for (const [param, expectedValue] of Object.entries(expectedValues)) {
+            if (parameters[param] && parameters[param] !== expectedValue) {
+                warnings.push({ parameter: param, expected: expectedValue, actual: parameters[param], documentationUrl: documentation[param] });
+            }
+        }
+
+        // Azure Network optimization warnings
+        const azureNetworkParams = {
+            'net.ipv4.tcp_mem': '4096\t87380\t67108864',
+            'net.ipv4.udp_mem': '4096\t87380\t33554432',
+            'net.ipv4.tcp_rmem': '4096\t87380\t67108864',
+            'net.ipv4.tcp_wmem': '4096\t65536\t67108864',
+            'net.core.rmem_default': '33554432',
+            'net.core.wmem_default': '33554432',
+            'net.ipv4.udp_wmem_min': '16384',
+            'net.ipv4.udp_rmem_min': '16384',
+            'net.core.wmem_max': '134217728',
+            'net.core.rmem_max': '134217728',
+            'net.core.busy_poll': '50',
+            'net.core.busy_read': '50',
+            'net.ipv4.tcp_congestion_control': 'bbr'
+        };
+        const azureNetworkDocUrl = 'https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-optimize-network-bandwidth#linux-virtual-machines';
+        const azureNetworkWarnings = [];
+        for (const [param, expectedValue] of Object.entries(azureNetworkParams)) {
+            if (parameters[param]) {
+                const normalizedActual = parameters[param].replace(/\s+/g, '\t');
+                const normalizedExpected = expectedValue.replace(/\s+/g, '\t');
+                if (normalizedActual !== normalizedExpected) {
+                    azureNetworkWarnings.push({ parameter: param, expected: expectedValue, actual: parameters[param], documentationUrl: azureNetworkDocUrl });
+                }
+            }
+        }
+
+        accumulated.warnings = warnings;
+        accumulated.hasWarnings = warnings.length > 0;
+        accumulated.azureNetworkWarnings = azureNetworkWarnings;
+        accumulated.hasAzureNetworkWarnings = azureNetworkWarnings.length > 0;
+        accumulated.azureNetworkTuned = azureNetworkWarnings.length === 0 && Object.keys(azureNetworkParams).every(p => parameters[p]);
+
+        // Optional network parameters (informational)
+        const optionalNetworkParams = {
+            'net.ipv4.tcp_timestamps': '1',
+            'net.ipv4.tcp_tw_reuse': '1',
+            'net.ipv4.ip_local_port_range': '1024\t65535',
+            'net.core.netdev_budget': '1000',
+            'net.core.optmem_max': '65535',
+            'net.ipv4.tcp_frto': '0',
+            'net.core.somaxconn': '32768',
+            'net.core.netdev_max_backlog': '32768',
+            'net.core.dev_weight': '64',
+            'net.core.default_qdisc': 'fq'
+        };
+        const optionalNetworkInfo = [];
+        for (const [param, expectedValue] of Object.entries(optionalNetworkParams)) {
+            if (parameters[param]) {
+                const normalizedActual = parameters[param].replace(/\s+/g, '\t');
+                const normalizedExpected = expectedValue.replace(/\s+/g, '\t');
+                optionalNetworkInfo.push({
+                    parameter: param,
+                    expected: expectedValue,
+                    actual: parameters[param],
+                    matches: normalizedActual === normalizedExpected,
+                    documentationUrl: azureNetworkDocUrl
+                });
+            }
+        }
+        accumulated.optionalNetworkInfo = optionalNetworkInfo;
+        accumulated.hasOptionalNetworkInfo = optionalNetworkInfo.length > 0;
+
+        // Recompute FIPS detection from merged parameters
+        accumulated.fipsEnabled = parameters['crypto.fips_enabled'] === '1';
+
+    }
+};
+
+const hugePagesParser = {
+    filePattern: /\/proc\/meminfo$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseHugePages', content, filename, { found: false });
+    }
+};
+
+// ---------------------------------------------------------------------------
+// Time Synchronisation (Azure PTP)
+// ---------------------------------------------------------------------------
+
+const timeSyncParser = {
+    filePattern: /sos_commands\/kernel\/lsmod$|\/modules\.txt$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseTimeSync', content, filename, { found: false });
+    }
+};
+
+const ptpClockSourceParser = {
+    filePattern: /sos_commands\/chrony\/chronyc_sources$|\/etc\/chrony\.conf$|\/etc\/chrony\/chrony\.conf$|\/ntp\.txt$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parsePtpClockSource', content, filename, { found: false });
+    }
+};
+
+const timeSyncServiceParser = {
+    filePattern: /sos_commands\/systemd\/systemctl_list-unit-files$|\/systemd-status\.txt$|\/ntp\.txt$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseTimeSyncService', content, filename, { found: false });
+    }
+};
+
+const timedatectlParser = {
+    filePattern: /sos_commands\/systemd\/timedatectl$|\/ntp\.txt$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseTimedatectl', content, filename, { found: false });
+    }
+};
+
+const ptpDeviceParser = {
+    filePattern: /sos_commands\/block\/ls_-lanR_\.dev$|\/udev\.txt$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parsePtpDevice', content, filename, { found: false });
+    }
+};
+
+const chronyTrackingParser = {
+    filePattern: /sos_commands\/chrony\/chronyc_tracking$|\/ntp\.txt$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseChronyTracking', content, filename, { found: false });
+    }
+};
+
+const chronyMakestepParser = {
+    filePattern: /\/etc\/chrony\.conf$|\/etc\/chrony\/chrony\.conf$|\/ntp\.txt$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseChronyMakestep', content, filename, { found: false });
+    }
+};
+
+// ---------------------------------------------------------------------------
+// RHUI (Red Hat Update Infrastructure)
+// ---------------------------------------------------------------------------
+
+const rhuiConfigParser = {
+    filePattern: /\/(rh-cloud.*\.repo|rhui-.*\.repo|yum\.repos\.d\.txt|dnf\.repos\.d\.txt|yum\.repos\.d\/.*\.repo)$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseRhuiConfig', content, filename, { found: false });
+    }
+};
+
+const eusVersionLockParser = {
+    filePattern: /\/(releasever|yum-vars\.txt|dnf-vars\.txt|etc\/yum\/vars|etc\/dnf\/vars|dnf\/vars\/releasever|yum\/vars\/releasever)$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseEusVersionLock', content, filename, { found: false });
+    }
+};
+
+const rhelRhuiCheckParser = {
+    filePattern: /\/(installed-rpms|rpm-qa\.txt|rpm_-qa|package-data)$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseRhelRhuiCheck', content, filename, { found: false });
+    }
+};
+
+const rhuiErrorsParser = {
+    filePattern: /\/(dnf\.log|yum\.log|rhsm\.log)(\.\d+)?$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseRhuiErrors', content, filename, { found: false });
+    }
+};
+
+// ---------------------------------------------------------------------------
+// Security
+// ---------------------------------------------------------------------------
+
+const cryptoPoliciesParser = {
+    filePattern: /\/crypto-policies\/(config|state\/current)$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseCryptoPolicies', content, filename, { found: false });
+    }
+};
+
+const fipsModeSetupParser = {
+    filePattern: /sos_commands\/crypto\/fips-mode-setup/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseFipsModeSetup', content, filename, { found: false });
+    }
+};
+
+// ---------------------------------------------------------------------------
+// OS tuning (SAP-on-Azure QualityCheck ports)
+// ---------------------------------------------------------------------------
+
+const tunedProfileParser = {
+    filePattern: /sos_commands\/tuned\/tuned-adm_active$|\/tuned-adm.*\.txt$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseTunedProfile', content, filename, { found: false });
+    }
+};
+
+const selinuxParser = {
+    filePattern: /\/etc\/selinux\/config$|sos_commands\/selinux\/sestatus$|\/selinux\.txt$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseSelinux', content, filename, { found: false });
+    }
+};
+
+const swapSpaceParser = {
+    filePattern: /\/proc\/meminfo$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseSwapSpace', content, filename, { found: false });
+    }
+};
+
+const kernelCmdlineParser = {
+    filePattern: /\/proc\/cmdline$|\/boot\.txt$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseKernelCmdline', content, filename, { found: false });
+    }
+};
+
+// ---------------------------------------------------------------------------
+// Leapp In-Place Upgrade
+// ---------------------------------------------------------------------------
+
+const leappReportParser = {
+    filePattern: /var\/log\/leapp\/leapp-report\.txt$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseLeappReport', content, filename, { found: false });
+    }
+};
+
+const leappLogParser = {
+    filePattern: /var\/log\/leapp\/leapp-(preupgrade|upgrade)\.log$/,
+    parse: function(content, filename, _lines) {
+        return _wasmCall('parseLeappLog', content, filename, { found: false });
+    }
+};
diff --git a/rca-tool/src/parsers/vmcore.js b/rca-tool/src/parsers/vmcore.js
new file mode 100644
index 0000000..c3f19ae
--- /dev/null
+++ b/rca-tool/src/parsers/vmcore.js
@@ -0,0 +1,84 @@
+/**
+ * @module parsers/vmcore
+ * @description Multi-file kernel-crash-dump parser — WASM shim
+ * delegating to `supportfile_core::parsers::vmcore`.  Each call
+ * dispatches to one of `parseVmcoreDmesg`, `parseKdumpStatus`,
+ * `parseCrashListing`, or `parseKdumpConf` based on the filename, and
+ * the worker's `mergeResults` accumulator merges the per-file results
+ * into the final consolidated view (same shape as the legacy parser).
+ */
+
+function emptyResult() {
+    return { found: false, type: null, crash: null, kdumpStatus: null, crashListing: null, kdumpConf: null };
+}
+
+function callWasm(fnName, content, filename) {
+    if (typeof WASM_BRIDGE === 'undefined' || !WASM_BRIDGE.isReady()) {
+        return null;
+    }
+    try {
+        return WASM_BRIDGE.parseJson(fnName, content, filename || '');
+    } catch (err) {
+        console.error('[vmcore.js]', fnName, 'WASM call failed:', err);
+        return null;
+    }
+}
+
+var vmcoreParser = {
+    filePattern: /(?:var\/crash\/[^/]+\/vmcore-dmesg\.txt|sos_commands\/kdump\/kdumpctl_status|sos_commands\/kdump\/ls_-alZR_\.var\.crash|etc\/kdump\.conf)$/,
+
+    parse: function(content, filename, _lines) {
+        const result = emptyResult();
+
+        if (filename.indexOf('vmcore-dmesg.txt') !== -1) {
+            const crash = callWasm('parseVmcoreDmesg', content, filename);
+            if (crash) {
+                result.type = 'vmcore-dmesg';
+                result.crash = crash;
+                result.found = true;
+            }
+        } else if (filename.indexOf('kdumpctl_status') !== -1) {
+            const status = callWasm('parseKdumpStatus', content, filename);
+            // Rust returns Option<KdumpStatus>: null becomes JSON null.
+            if (status) {
+                result.type = 'kdump-status';
+                result.kdumpStatus = status;
+                result.found = true;
+            }
+        } else if (filename.indexOf('ls_-alZR_') !== -1) {
+            const listing = callWasm('parseCrashListing', content, filename);
+            if (listing) {
+                result.type = 'crash-listing';
+                result.crashListing = listing;
+                result.found = true;
+            }
+        } else if (filename.indexOf('kdump.conf') !== -1) {
+            const conf = callWasm('parseKdumpConf', content, filename);
+            if (conf) {
+                result.type = 'kdump-conf';
+                result.kdumpConf = conf;
+                result.found = true;
+            }
+        }
+
+        return result;
+    },
+
+    mergeResults: function(existing, newResult) {
+        existing.found = existing.found || newResult.found;
+
+        if (newResult.crash) {
+            if (!Array.isArray(existing.crashes)) existing.crashes = [];
+            existing.crashes.push(newResult.crash);
+            existing.crashes.sort(function(a, b) {
+                if (!a.date) return 1;
+                if (!b.date) return -1;
+                return b.date.localeCompare(a.date);
+            });
+        }
+
+        if (newResult.kdumpStatus) existing.kdumpStatus = newResult.kdumpStatus;
+        if (newResult.crashListing) existing.crashListing = newResult.crashListing;
+        if (newResult.kdumpConf) existing.kdumpConf = newResult.kdumpConf;
+    }
+};
diff --git a/rca-tool/src/wasm-bridge.js b/rca-tool/src/wasm-bridge.js
new file mode 100644
index 0000000..f45547a
--- /dev/null
+++ b/rca-tool/src/wasm-bridge.js
@@ -0,0 +1,105 @@
+/**
+ * @module assets/supportfile-wasm/wasm-bridge
+ * @description Helper utilities for parser .js shims that delegate to the
+ * supportfile WASM module.  Loaded by `worker.js` after `importScripts` of
+ * `supportfile_wasm.js` and before any parser .js files.
+ *
+ * Exposed globals:
+ *   - `WASM_BRIDGE.snakeToCamel(obj)`  — recursive key transformer
+ *   - `WASM_BRIDGE.parseJson(name, content, sourcePath)` — invoke a
+ *     `parse*` export on `wasm_bindgen`, JSON.parse + snake→camel transform.
+ *   - `WASM_BRIDGE.isReady()` — true after worker init resolves the
+ *     supportfile WASM promise (mirrors `self.SUPPORTFILE_WASM_READY`).
+ *
+ * Each individual parser shim layers its own field-rename / alias logic on
+ * top of `parseJson`.  The legacy JS parsers used camelCase keys with some
+ * non-1:1 names (e.g. event `sourceFile` vs. Rust `source_path`); shims
+ * patch those over the generic transform.
+ */
+(function (root) {
+    'use strict';
+
+    function snakeToCamelKey(key) {
+        if (typeof key !== 'string' || key.indexOf('_') === -1) return key;
+        // Keys containing '.' are data keys (e.g. sysctl parameter names
+        // like `net.ipv4.tcp_congestion_control`), not Rust struct fields.
+        // Leave them verbatim so we don't mangle the underlying data.
+        if (key.indexOf('.') !== -1) return key;
+        return key.replace(/_([a-z0-9])/g, function (_, ch) {
+            return ch.toUpperCase();
+        });
+    }
+
+    function transform(value) {
+        if (Array.isArray(value)) {
+            return value.map(transform);
+        }
+        if (value !== null && typeof value === 'object') {
+            const out = {};
+            for (const k of Object.keys(value)) {
+                out[snakeToCamelKey(k)] = transform(value[k]);
+            }
+            return out;
+        }
+        return value;
+    }
+
+    function isReady() {
+        // `wasm_bindgen` from the wasm-pack `target=no-modules` bundle is a
+        // top-level `let` binding, which lives in the script-global lexical
+        // environment but is NOT a property of `self`/`globalThis`.  We must
+        // reference it lexically here rather than via `root.wasm_bindgen`.
+        return Boolean(root.SUPPORTFILE_WASM_READY)
+            && typeof wasm_bindgen !== 'undefined';
+    }
+
+    function parseJson(fnName, content, sourcePath) {
+        if (!isReady()) {
+            throw new Error(
+                '[wasm-bridge] supportfile WASM not initialized yet (calling ' +
+                fnName + ')'
+            );
+        }
+        const fn = wasm_bindgen[fnName];
+        if (typeof fn !== 'function') {
+            throw new Error(
+                '[wasm-bridge] wasm_bindgen.' + fnName + ' is not a function'
+            );
+        }
+        const json = fn(content || '', sourcePath || '');
+        return transform(JSON.parse(json));
+    }
+
+    /**
+     * Recursively rename keys in `obj` according to `aliases` (a plain
+     * object whose keys are the OLD field name and values are the NEW
+     * name).  Mutates `obj` in place and returns it for chaining.
+     *
+     * Example: `aliasKeys(result, { eventType: 'type', totalVm: 'totalVM' })`
+     * will copy the value at each old key to the new key (preserving the
+     * old key as well, so consumers that read either name still work).
+     */
+    function aliasKeys(obj, aliases) {
+        if (Array.isArray(obj)) {
+            for (const item of obj) aliasKeys(item, aliases);
+            return obj;
+        }
+        if (obj !== null && typeof obj === 'object') {
+            for (const oldName of Object.keys(aliases)) {
+                if (Object.prototype.hasOwnProperty.call(obj, oldName)
+                    && !Object.prototype.hasOwnProperty.call(obj, aliases[oldName])) {
+                    obj[aliases[oldName]] = obj[oldName];
+                }
+            }
+            for (const k of Object.keys(obj)) aliasKeys(obj[k], aliases);
+        }
+        return obj;
+    }
+
+    root.WASM_BRIDGE = {
+        snakeToCamel: transform,
+        parseJson: parseJson,
+        aliasKeys: aliasKeys,
+        isReady: isReady,
+    };
+})(typeof self !== 'undefined' ? self : globalThis);
diff --git a/rca-tool/src/worker.js b/rca-tool/src/worker.js
new file mode 100644
index 0000000..1d69422
--- /dev/null
+++ b/rca-tool/src/worker.js
@@ -0,0 +1,3789 @@
+/**
+ * @module worker
+ * @description Streaming XZ decompression worker using liblzma.
+ *
+ * This Web Worker orchestrates the entire analysis pipeline:
+ * 1. Receives compressed `.tar.xz` archives from the UI thread.
+ * 2. Decompresses via liblzma WASM in configurable-size chunks.
+ * 3. Extracts individual files from the tar stream.
+ * 4. Matches each file against all registered parser `filePattern` regexes.
+ * 5. Calls `parse(content, filename)` on matching parsers.
+ * 6. Accumulates results in `analysisResults` and posts them back to the UI.
+ *
+ * Parser registration happens in the `SCC_RULES` object. Multi-file parsers
+ * (e.g. firewallRules, networkInterfaces, vmcore) use `mergeResults()` for
+ * cross-file accumulation.
+ *
+ * @see {@link module:utils} for shared helper functions
+ */
+
+// Version is only logged when debug mode is enabled\nconst WORKER_VERSION = '2025-12-23-nested-gzip';
+
+// Reuse the worker URL query string for all relative assets.
+// This prevents GitHub Pages/CDN caches from serving a mixed set of worker
+// files from different deployments during the post-deploy test window.
+const WORKER_ASSET_QUERY = (() => {
+    try {
+        const url = new URL(self.location.href);
+        return url.search || '';
+    } catch (_e) {
+        return '';
+    }
+})();
+
+function versionedAsset(path) {
+    if (!WORKER_ASSET_QUERY || /^https?:\/\//i.test(path)) {
+        return path;
+    }
+    return path.includes('?')
+        ? `${path}&${WORKER_ASSET_QUERY.slice(1)}`
+        : `${path}${WORKER_ASSET_QUERY}`;
+}
+
+// Global error handler to catch uncaught exceptions
+self.onerror = function(message, source, lineno, colno, error) {
+    console.error('[Worker] Uncaught error:', message);
+    console.error('[Worker] Source:', source, 'Line:', lineno, 'Column:', colno);
+    console.error('[Worker] Error object:', error);
+    if (error && error.stack) {
+        console.error('[Worker] Stack trace:', error.stack);
+    }
+    // Try to send error message to main thread
+    try {
+        self.postMessage({
+            error: 'Worker uncaught error: ' + message + ' at ' + source + ':' + lineno
+        });
+    } catch (e) {
+        console.error('[Worker] Failed to send error message:', e);
+    }
+    return true; // Prevent default error handling
+};
+
+// Debug flag - will be set from main thread via message
+// Debug configuration - set specific parsers to true to enable their debug logging
+const DEBUG_CONFIG = {
+    automation: false,
+    azure: false,
+    cluster: false,
+    events: false,
+    networking: false,
+    packages: false,
+    performance: false,
+    services: false,
+    storage: false,
+    unix: false,
+    vmcore: false,
+    worker: false
+};
+
+// Debug logging wrapper - only logs if the specific debug flag is enabled
+function debugLog(...args) {
+    // Check if this is a parser-specific log by looking at the first argument
+    const firstArg = args[0];
+    if (typeof firstArg === 'string') {
+        // Extract parser name from log message like "[parserName parser]"
+        const parserMatch = firstArg.match(/\[(\w+)(?:\s+parser|\s+worker)?\]/);
+        if (parserMatch) {
+            const parserName = parserMatch[1].toLowerCase();
+            if (DEBUG_CONFIG[parserName]) {
+                console.log(...args);
+            }
+        } else if (DEBUG_CONFIG.worker) {
+            // General worker logs
+            console.log(...args);
+        }
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Performance tracking/reporting runtime (inlined from performance.js)
+// ---------------------------------------------------------------------------
+
+class PerformanceTracker {
+    constructor() {
+        this.fileEntries = [];
+        this.parserEntries = [];
+        this.startTime = performance.now();
+        this.totalBytes = 0;
+        this.totalFiles = 0;
+        this._fileStart = 0;
+        this._decodeMs = 0;
+    }
+
+    startFile() {
+        this._fileStart = performance.now();
+        this._decodeMs = 0;
+    }
+
+    recordDecode(ms) {
+        this._decodeMs = ms;
+    }
+
+    recordParser(file, parser, parseMs, result, accumulatedResult) {
+        this.parserEntries.push({
+            file,
+            parser,
+            parseMs,
+            events: countEvents(result),
+            accumulated: accumulatedResult ? countEvents(accumulatedResult) : 0
+        });
+    }
+
+    endFile(file, contentLen, parserCount) {
+        this.totalBytes += contentLen;
+        this.totalFiles++;
+        this.fileEntries.push({
+            file,
+            size: contentLen,
+            parsers: parserCount,
+            totalMs: performance.now() - this._fileStart,
+            decodeMs: this._decodeMs
+        });
+    }
+
+    getReport() {
+        return {
+            fileEntries: this.fileEntries,
+            parserEntries: this.parserEntries,
+            totalTimeMs: performance.now() - this.startTime,
+            totalFiles: this.totalFiles,
+            totalBytes: this.totalBytes
+        };
+    }
+}
+
+function countEvents(result) {
+    if (!result) return 0;
+    if (typeof result.count === 'number') return result.count;
+    if (Array.isArray(result.events)) return result.events.length;
+    const migrations = result.resourceMigrations?.length || 0;
+    const fencing = result.fencingEvents?.length || 0;
+    if (migrations || fencing) return migrations + fencing;
+    if (Array.isArray(result.errors)) return result.errors.length;
+    return 0;
+}
+
+function formatPerformanceReport(perfData, memoryMB) {
+    const { fileEntries, parserEntries, totalTimeMs, totalFiles, totalBytes } = perfData;
+    const lines = [];
+    const push = (s) => lines.push(s);
+
+    push('');
+    push('='.repeat(70));
+    push('  PERFORMANCE REPORT');
+    push('='.repeat(70));
+    push(`  Total time: ${(totalTimeMs / 1000).toFixed(2)}s`);
+    push(`  Files processed: ${totalFiles}`);
+    push(`  Files parsed: ${fileEntries.length}`);
+    push(`  Total content size: ${(totalBytes / (1024 * 1024)).toFixed(1)} MB`);
+    if (memoryMB != null) {
+        push(`  Memory peak: ${memoryMB.toFixed(1)} MB`);
+    }
+    push('');
+
+    const sortedFiles = [...fileEntries].sort((a, b) => b.totalMs - a.totalMs);
+    push('  Top 20 slowest files:');
+    push(`  ${'File'.padEnd(60)} ${'Size'.padStart(10)} ${'Parsers'.padStart(8)} ${'Time(ms)'.padStart(10)} ${'Decode(ms)'.padStart(11)}`);
+    push(`  ${'-'.repeat(60)} ${'-'.repeat(10)} ${'-'.repeat(8)} ${'-'.repeat(10)} ${'-'.repeat(11)}`);
+    for (const f of sortedFiles.slice(0, 20)) {
+        const shortName = f.file.length > 58 ? '...' + f.file.slice(-55) : f.file;
+        const sizeStr = f.size >= 1024 * 1024
+            ? `${(f.size / (1024 * 1024)).toFixed(1)}MB`
+            : `${(f.size / 1024).toFixed(1)}KB`;
+        push(`  ${shortName.padEnd(60)} ${sizeStr.padStart(10)} ${String(f.parsers).padStart(8)} ${f.totalMs.toFixed(1).padStart(10)} ${f.decodeMs.toFixed(1).padStart(11)}`);
+    }
+
+    const sortedParsers = [...parserEntries].sort((a, b) => b.parseMs - a.parseMs);
+    push('');
+    push('  Top 20 slowest parser calls:');
+    push(`  ${'Parser'.padEnd(25)} ${'File'.padEnd(40)} ${'Time(ms)'.padStart(10)} ${'Events'.padStart(8)} ${'Accum'.padStart(8)}`);
+    push(`  ${'-'.repeat(25)} ${'-'.repeat(40)} ${'-'.repeat(10)} ${'-'.repeat(8)} ${'-'.repeat(8)}`);
+    for (const p of sortedParsers.slice(0, 20)) {
+        const shortFile = p.file.length > 38 ? '...' + p.file.slice(-35) : p.file;
+        push(`  ${p.parser.padEnd(25)} ${shortFile.padEnd(40)} ${p.parseMs.toFixed(1).padStart(10)} ${String(p.events).padStart(8)} ${String(p.accumulated).padStart(8)}`);
+    }
+
+    const parserAgg = {};
+    for (const p of parserEntries) {
+        if (!parserAgg[p.parser]) parserAgg[p.parser] = { calls: 0, totalMs: 0, totalEvents: 0 };
+        parserAgg[p.parser].calls++;
+        parserAgg[p.parser].totalMs += p.parseMs;
+        parserAgg[p.parser].totalEvents += p.events;
+    }
+    const sortedAgg = Object.entries(parserAgg).sort((a, b) => b[1].totalMs - a[1].totalMs);
+    push('');
+    push('  Parser aggregate (all files):');
+    push(`  ${'Parser'.padEnd(30)} ${'Calls'.padStart(6)} ${'Total(ms)'.padStart(10)} ${'Avg(ms)'.padStart(10)} ${'Events'.padStart(8)}`);
+    push(`  ${'-'.repeat(30)} ${'-'.repeat(6)} ${'-'.repeat(10)} ${'-'.repeat(10)} ${'-'.repeat(8)}`);
+    for (const [name, agg] of sortedAgg) {
+        push(`  ${name.padEnd(30)} ${String(agg.calls).padStart(6)} ${agg.totalMs.toFixed(1).padStart(10)} ${(agg.totalMs / agg.calls).toFixed(1).padStart(10)} ${String(agg.totalEvents).padStart(8)}`);
+    }
+
+    push('');
+    push('  --- TSV DATA (pipe stderr to file for processing) ---');
+    push('FILE\tsize\tparsers\ttotal_ms\tdecode_ms');
+    for (const f of sortedFiles) {
+        push(`FILE\t${f.file}\t${f.size}\t${f.parsers}\t${f.totalMs.toFixed(1)}\t${f.decodeMs.toFixed(1)}`);
+    }
+    push('PARSER\tfile\tparser\tparse_ms\tevents\taccumulated');
+    for (const p of parserEntries) {
+        push(`PARSER\t${p.file}\t${p.parser}\t${p.parseMs.toFixed(1)}\t${p.events}\t${p.accumulated}`);
+    }
+    push('');
+
+    return lines.join('\n');
+}
+
+// ---------------------------------------------------------------------------
+// Utility runtime
+// ---------------------------------------------------------------------------
+
+function deduplicateEvents(existingEvents, newEvents, comparisonFields, logFn) {
+    const keySet = new Set();
+    for (let i = 0; i < existingEvents.length; i++) {
+        const evt = existingEvents[i];
+        let key = '';
+        for (let f = 0; f < comparisonFields.length; f++) {
+            if (f > 0) key += '\0';
+            key += evt[comparisonFields[f]];
+        }
+        keySet.add(key);
+    }
+
+    const addedEvents = [];
+    let duplicateCount = 0;
+
+    for (let i = 0; i < newEvents.length; i++) {
+        const newEvent = newEvents[i];
+        let key = '';
+        for (let f = 0; f < comparisonFields.length; f++) {
+            if (f > 0) key += '\0';
+            key += newEvent[comparisonFields[f]];
+        }
+        if (keySet.has(key)) {
+            duplicateCount++;
+        } else {
+            keySet.add(key);
+            addedEvents.push(newEvent);
+        }
+    }
+
+    if (logFn) {
+        logFn(`[deduplicateEvents] Added ${addedEvents.length} new events, skipped ${duplicateCount} duplicates`);
+    }
+
+    return {
+        addedEvents,
+        duplicateCount
+    };
+}
+
+// Runtime imports
+if (typeof importScripts === 'function') {
+    // Import pako for gzip decompression of nested .gz files
+    try {
+        importScripts('https://cdn.jsdelivr.net/npm/pako@2.1.0/dist/pako.min.js');
+        debugLog('[Worker] pako library loaded for nested .gz decompression');
+    } catch (e) {
+        // Non-critical: nested .gz decompression will not be available
+        // Only log in debug mode to avoid console noise
+        debugLog('[Worker] Failed to load pako library:', e);
+    }
+    
+    // Import fflate for ZIP archive decompression
+    try {
+        importScripts('https://cdn.jsdelivr.net/npm/fflate@0.8.2/umd/index.js');
+        debugLog('[Worker] fflate library loaded for ZIP decompression');
+    } catch (e) {
+        // Non-critical: ZIP decompression will not be available
+        debugLog('[Worker] Failed to load fflate library:', e);
+    }
+    
+    // Import the supportfile WASM module (compiled from supportfile_core via
+    // wasm-pack, target=no-modules).  After importScripts, `wasm_bindgen` is
+    // a global initializer; we await it inside the Module init promise below
+    // before sending `ready` to the main thread.  Individual parser .js shims
+    // call into `wasm_bindgen.parse*` functions once initialization completes.
+    try {
+        importScripts(versionedAsset('supportfile-wasm/supportfile_wasm.js'));
+        if (typeof WASM_BRIDGE === 'undefined') {
+            importScripts(versionedAsset('wasm-bridge.js'));
+        }
+        debugLog('[Worker] supportfile WASM glue + bridge loaded');
+    } catch (e) {
+        console.error('[Worker] Failed to load supportfile WASM glue:', e);
+    }
+
+    // Fallback path for standalone worker.js execution (without the build-time
+    // bundled asset that inlines parsers).
+    if (typeof basicEnvironmentParser === 'undefined') {
+        importScripts(versionedAsset('parsers/unix.js'));
+        importScripts(versionedAsset('parsers/services.js'));
+        importScripts(versionedAsset('parsers/events.js'));
+        importScripts(versionedAsset('parsers/azure.js'));
+        importScripts(versionedAsset('parsers/cluster.js'));
+        importScripts(versionedAsset('parsers/storage.js'));
+        importScripts(versionedAsset('parsers/hana.js'));
+        importScripts(versionedAsset('parsers/networking.js'));
+        importScripts(versionedAsset('parsers/network-interfaces.js'));
+        importScripts(versionedAsset('parsers/vmcore.js'));
+        importScripts(versionedAsset('parsers/debugfs.js'));
+    }
+    debugLog('[Worker] Running in Web Worker context');
+    debugLog('[Worker] Browser:', typeof navigator !== 'undefined' ? navigator.userAgent : 'unknown');
+}
+
+function emptyPackagesResult() {
+    return {
+        found: false,
+        packages: {},
+        warnings: [],
+        fipsPackages: [],
+        hasDracutFips: false,
+    };
+}
+
+function emptyAutomationResult() {
+    return {
+        found: false,
+        count: 0,
+        events: []
+    };
+}
+
+// Inlined distro packages parser.
+const distroPackagesParser = {
+    filePattern: /\/(rpm\.txt|installed-rpms|package-data|dpkg_-l|dnf[_-]list[_-]installed|yum[_-]list[_-]installed|var\/log\/zypp\/history|var\/log\/(?:dnf|yum)\.log|etc\/dnf\/dnf\.conf|etc\/yum\.conf|etc\/dnf\.repo|etc\/yum\.repos\.d\/.*\.repo|etc\/dnf\/repos\.d\/.*\.repo|dnf\.conf|yum\.conf|.*\.repo)$/,
+
+    parse: function(content, filename, _lines) {
+        if (typeof WASM_BRIDGE === 'undefined' || !WASM_BRIDGE.isReady()) {
+            return emptyPackagesResult();
+        }
+        let result;
+        try {
+            result = WASM_BRIDGE.parseJson('parseDistroPackages', content, filename || '');
+        } catch (err) {
+            console.error('[worker.js] parseDistroPackages WASM call failed:', err);
+            return emptyPackagesResult();
+        }
+        if (result == null) return emptyPackagesResult();
+        if (result.isDpkg || result.isRpmRaw || result.isZypperHistory || result.isDnfYumLog) {
+            result.filename = filename;
+        }
+        return result;
+    }
+};
+
+// ============================================================================
+// SCC REPORT ANALYSIS RULES
+// ============================================================================
+// Add new rules here to extract information from SCC/supportconfig reports
+// Each rule defines which file to extract and how to parse it
+
+const SCC_RULES = {
+    // Utility function for merging multi-file event streams.
+    deduplicateEvents: function(existingEvents, newEvents, comparisonFields) {
+        return deduplicateEvents(existingEvents, newEvents, comparisonFields, debugLog);
+    },
+    
+    // ========================================================================
+    // DETECTION RULES
+    // ========================================================================
+    
+    // Rule: Detect if archive is an SCC report, hb_report, crm_report, sosreport, or InspectIaaSDisk
+    detection: {
+        // Patterns to identify reports by filename
+        filenamePatterns: [
+            /^scc_/,           // SCC/supportconfig reports
+            /^nts_/,           // NTS reports
+            /^hb_report/,      // hb_report archives (older Pacemaker)
+            /^crm_report/,     // crm_report archives (newer Pacemaker)
+            /^sosreport-/,     // sosreport archives
+            /^device_\d+\//    // InspectIaaSDisk reports
+        ],
+        
+        // Check if filename matches any report pattern
+        isSCCReport: function(filename) {
+            return this.filenamePatterns.some(pattern => pattern.test(filename));
+        },
+
+        // HANA trace files (indexserver_*.trc / nameserver_*.trc) can be
+        // collected on their own (e.g. a HANA log ZIP) outside any SCC /
+        // sosreport bundle. Detect them so their parsers still run.
+        hanaTracePattern: /\/(indexserver|nameserver)[^/]*\.trc$/,
+        isHanaLog: function(filename) {
+            return this.hanaTracePattern.test('/' + filename);
+        }
+    },
+    
+    // Cluster parsers are imported from parsers/cluster.js after SCC_RULES is defined
+
+    // Rule: Detect automation tool usage (Ansible, Puppet, Chef, etc.)
+    automation: {
+        // Target file path patterns - messages, syslog, journalctl
+        filePattern: /\/(messages|localmessages|syslog|journalctl[^\/]*)(?:[.-]\d+)?(?:\.txt)?$/,
+
+        // Rust-native parser bridge.
+        parse: function(content, filename, _lines) {
+            if (typeof WASM_BRIDGE === 'undefined' || !WASM_BRIDGE.isReady()) {
+                return emptyAutomationResult();
+            }
+
+            try {
+                const result = WASM_BRIDGE.parseJson('parseAutomationEvents', content, filename || '');
+                if (result == null) return emptyAutomationResult();
+                if (typeof result.found === 'undefined') {
+                    result.found = (result.count || (result.events && result.events.length) || 0) > 0;
+                }
+                return result;
+            } catch (err) {
+                console.error('[worker.js] parseAutomationEvents WASM call failed:', err);
+                return emptyAutomationResult();
+            }
+        }
+    },
+    
+    // distroPackages and azureSiteRecovery are provided by Rust-backed parser
+    // shims (`distroPackagesParser` and `azureSiteRecoveryParser`) and
+    // assigned after SCC_RULES initialization.
+    
+    // puppetAgent, chefClient and nvmeList are provided by Rust-backed
+    // parser shims and assigned after SCC_RULES initialization.
+    
+    // ADD MORE RULES HERE
+    // Example:
+    // systemInfo: {
+    //     filePattern: /\/basic-environment\.txt$/,
+    //     parse: function(content) {
+    //         // Extract system information
+    //         return { /* parsed data */ };
+    //     }
+    // }
+};
+
+// ============================================================================
+// END SCC RULES
+// ============================================================================
+
+// Manual parser assignments - Load external parsers after SCC_RULES is fully defined
+// This avoids "SCC_RULES is not defined" errors during module loading
+
+// Distro packages parser
+if (typeof distroPackagesParser !== 'undefined') {
+    SCC_RULES.distroPackages = distroPackagesParser;
+}
+
+// From parsers/unix.js
+if (typeof basicEnvironmentParser !== 'undefined') {
+    SCC_RULES.basicEnvironment = basicEnvironmentParser;
+}
+if (typeof osReleaseParser !== 'undefined') {
+    SCC_RULES.osRelease = osReleaseParser;
+}
+if (typeof fstabParser !== 'undefined') {
+    SCC_RULES.fstab = fstabParser;
+}
+if (typeof inspectDiskResultsParser !== 'undefined') {
+    SCC_RULES.inspectDiskResults = inspectDiskResultsParser;
+}
+if (typeof kernelTuningParser !== 'undefined') {
+    SCC_RULES.kernelTuning = kernelTuningParser;
+}
+if (typeof hugePagesParser !== 'undefined') {
+    SCC_RULES.hugePages = hugePagesParser;
+}
+if (typeof timeSyncParser !== 'undefined') {
+    SCC_RULES.timeSync = timeSyncParser;
+}
+if (typeof ptpClockSourceParser !== 'undefined') {
+    SCC_RULES.ptpClockSource = ptpClockSourceParser;
+}
+if (typeof timeSyncServiceParser !== 'undefined') {
+    SCC_RULES.timeSyncService = timeSyncServiceParser;
+}
+if (typeof timedatectlParser !== 'undefined') {
+    SCC_RULES.timedatectl = timedatectlParser;
+}
+if (typeof ptpDeviceParser !== 'undefined') {
+    SCC_RULES.ptpDevice = ptpDeviceParser;
+}
+if (typeof chronyTrackingParser !== 'undefined') {
+    SCC_RULES.chronyTracking = chronyTrackingParser;
+}
+if (typeof chronyMakestepParser !== 'undefined') {
+    SCC_RULES.chronyMakestep = chronyMakestepParser;
+}
+
+// From parsers/services.js
+if (typeof sshServiceParser !== 'undefined') {
+    SCC_RULES.sshService = sshServiceParser;
+}
+if (typeof dlmServiceParser !== 'undefined') {
+    SCC_RULES.dlmService = dlmServiceParser;
+}
+if (typeof azureSiteRecoveryParser !== 'undefined') {
+    SCC_RULES.azureSiteRecovery = azureSiteRecoveryParser;
+}
+if (typeof guardicoreAgentParser !== 'undefined') {
+    SCC_RULES.guardicoreAgent = guardicoreAgentParser;
+}
+if (typeof puppetAgentParser !== 'undefined') {
+    SCC_RULES.puppetAgent = puppetAgentParser;
+}
+if (typeof chefClientParser !== 'undefined') {
+    SCC_RULES.chefClient = chefClientParser;
+}
+if (typeof illumioParser !== 'undefined') {
+    SCC_RULES.illumio = illumioParser;
+}
+if (typeof trendMicroParser !== 'undefined') {
+    SCC_RULES.trendMicro = trendMicroParser;
+}
+if (typeof falconSensorParser !== 'undefined') {
+    SCC_RULES.falconSensor = falconSensorParser;
+}
+if (typeof falconSensorConfigParser !== 'undefined') {
+    SCC_RULES.falconSensorConfig = falconSensorConfigParser;
+}
+if (typeof msDefenderParser !== 'undefined') {
+    SCC_RULES.msDefender = msDefenderParser;
+}
+if (typeof msDefenderConfigParser !== 'undefined') {
+    SCC_RULES.msDefenderConfig = msDefenderConfigParser;
+}
+if (typeof involfltVersionParser !== 'undefined') {
+    SCC_RULES.involfltVersion = involfltVersionParser;
+}
+if (typeof involfltKernelVersionParser !== 'undefined') {
+    SCC_RULES.involfltKernelVersion = involfltKernelVersionParser;
+}
+if (typeof azureExtensionsParser !== 'undefined') {
+    SCC_RULES.azureExtensions = azureExtensionsParser;
+}
+if (typeof fstrimParser !== 'undefined') {
+    SCC_RULES.fstrim = fstrimParser;
+}
+
+// From parsers/events.js  
+if (typeof emergencyModeParser !== 'undefined') {
+    SCC_RULES.emergencyMode = emergencyModeParser;
+}
+if (typeof kernelRebootsParser !== 'undefined') {
+    SCC_RULES.kernelReboots = kernelRebootsParser;
+}
+if (typeof oomKillerParser !== 'undefined') {
+    SCC_RULES.oomKiller = oomKillerParser;
+}
+if (typeof xfsErrorsParser !== 'undefined') {
+    SCC_RULES.xfsErrors = xfsErrorsParser;
+}
+
+// From parsers/azure.js
+if (typeof azureVMPropertiesParser !== 'undefined') {
+    SCC_RULES.azureVMProperties = azureVMPropertiesParser;
+}
+if (typeof suseCloudRegisterParser !== 'undefined') {
+    SCC_RULES.suseCloudRegister = suseCloudRegisterParser;
+}
+if (typeof waagentConfigParser !== 'undefined') {
+    SCC_RULES.waagentConfig = waagentConfigParser;
+}
+if (typeof waagentLogParser !== 'undefined') {
+    SCC_RULES.waagentLog = waagentLogParser;
+}
+if (typeof secureBootParser !== 'undefined') {
+    SCC_RULES.secureBoot = secureBootParser;
+}
+
+// From parsers/cluster.js
+// Initialize cluster parsers
+if (typeof createClusterParsers !== 'undefined') {
+    const clusterParsers = createClusterParsers();
+    SCC_RULES.clusterNodes = clusterParsers.clusterNodes;
+    SCC_RULES.hostsFile = clusterParsers.hostsFile;
+    SCC_RULES.corosyncConfig = clusterParsers.corosyncConfig;
+    SCC_RULES.pacemakerResources = clusterParsers.pacemakerResources;
+    SCC_RULES.corosyncStatus = clusterParsers.corosyncStatus;
+    SCC_RULES.clusterStatus = clusterParsers.clusterStatus;
+    SCC_RULES.clusterDaemonStatus = clusterParsers.clusterDaemonStatus;
+    SCC_RULES.azureScheduledEvents = clusterParsers.azureScheduledEvents;
+    SCC_RULES.fencingConfig = clusterParsers.fencingConfig;
+    SCC_RULES.clusterEvents = clusterParsers.clusterEvents;
+    SCC_RULES.liveMigration = clusterParsers.liveMigration;
+    SCC_RULES.sapInstanceConfig = clusterParsers.sapInstanceConfig;
+    SCC_RULES.sapInstanceErrors = clusterParsers.sapInstanceErrors;
+    SCC_RULES.clusterMaintenanceMode = clusterParsers.clusterMaintenanceMode;
+    SCC_RULES.sbdConfig = clusterParsers.sbdConfig;
+    SCC_RULES.azureFenceAuth = clusterParsers.azureFenceAuth;
+    SCC_RULES.iscsiConfig = clusterParsers.iscsiConfig;
+}
+
+// From parsers/storage.js
+if (typeof lvmConfigParser !== 'undefined') {
+    SCC_RULES.lvmConfig = lvmConfigParser;
+}
+if (typeof raidConfigParser !== 'undefined') {
+    SCC_RULES.raidConfig = raidConfigParser;
+}
+if (typeof btrfsConfigParser !== 'undefined') {
+    SCC_RULES.btrfsConfig = btrfsConfigParser;
+}
+if (typeof blockDevicesParser !== 'undefined') {
+    SCC_RULES.blockDevices = blockDevicesParser;
+}
+if (typeof fstabAnalysisParser !== 'undefined') {
+    SCC_RULES.fstabAnalysis = fstabAnalysisParser;
+}
+if (typeof dfOutputParser !== 'undefined') {
+    SCC_RULES.dfOutput = dfOutputParser;
+}
+if (typeof mtabAnalysisParser !== 'undefined') {
+    SCC_RULES.mtabAnalysis = mtabAnalysisParser;
+}
+if (typeof nvmeListParser !== 'undefined') {
+    SCC_RULES.nvmeList = nvmeListParser;
+}
+if (typeof nfsMountsParser !== 'undefined') {
+    SCC_RULES.nfsMounts = nfsMountsParser;
+}
+
+// From parsers/hana.js
+if (typeof hanaSavepointsParser !== 'undefined') {
+    SCC_RULES.hanaSavepoints = hanaSavepointsParser;
+}
+if (typeof hanaDeadlocksParser !== 'undefined') {
+    SCC_RULES.hanaDeadlocks = hanaDeadlocksParser;
+}
+if (typeof hanaOomParser !== 'undefined') {
+    SCC_RULES.hanaOom = hanaOomParser;
+}
+if (typeof hanaMergeErrorsParser !== 'undefined') {
+    SCC_RULES.hanaMergeErrors = hanaMergeErrorsParser;
+}
+
+// From parsers/unix.js - RHUI/EUS parsers
+if (typeof rhuiConfigParser !== 'undefined') {
+    SCC_RULES.rhuiConfig = rhuiConfigParser;
+}
+if (typeof eusVersionLockParser !== 'undefined') {
+    SCC_RULES.eusVersionLock = eusVersionLockParser;
+}
+if (typeof rhelRhuiCheckParser !== 'undefined') {
+    SCC_RULES.rhelRhuiCheck = rhelRhuiCheckParser;
+}
+if (typeof cryptoPoliciesParser !== 'undefined') {
+    SCC_RULES.cryptoPolicies = cryptoPoliciesParser;
+}
+if (typeof fipsModeSetupParser !== 'undefined') {
+    SCC_RULES.fipsModeSetup = fipsModeSetupParser;
+}
+if (typeof tunedProfileParser !== 'undefined') {
+    SCC_RULES.tunedProfile = tunedProfileParser;
+}
+if (typeof selinuxParser !== 'undefined') {
+    SCC_RULES.selinux = selinuxParser;
+}
+if (typeof swapSpaceParser !== 'undefined') {
+    SCC_RULES.swapSpace = swapSpaceParser;
+}
+if (typeof kernelCmdlineParser !== 'undefined') {
+    SCC_RULES.kernelCmdline = kernelCmdlineParser;
+}
+if (typeof rhuiErrorsParser !== 'undefined') {
+    SCC_RULES.rhuiErrors = rhuiErrorsParser;
+}
+if (typeof leappReportParser !== 'undefined') {
+    SCC_RULES.leappReport = leappReportParser;
+}
+if (typeof leappLogParser !== 'undefined') {
+    SCC_RULES.leappLog = leappLogParser;
+}
+
+// From parsers/networking.js
+if (typeof firewallRulesParser !== 'undefined') {
+    SCC_RULES.firewallRules = firewallRulesParser;
+    debugLog('[Worker] firewallRulesParser registered successfully, filePattern:', firewallRulesParser.filePattern);
+} else {
+    console.warn('[Worker] firewallRulesParser is NOT defined - networking.js may have failed to load');
+}
+if (typeof packetLossParser !== 'undefined') {
+    SCC_RULES.packetLoss = packetLossParser;
+}
+if (typeof ringBufferParser !== 'undefined') {
+    SCC_RULES.ringBuffer = ringBufferParser;
+}
+if (typeof networkSysctlParser !== 'undefined') {
+    SCC_RULES.networkSysctl = networkSysctlParser;
+}
+
+// From parsers/network-interfaces.js
+if (typeof networkInterfacesParser !== 'undefined') {
+    SCC_RULES.networkInterfaces = networkInterfacesParser;
+    debugLog('[Worker] networkInterfacesParser registered successfully, filePattern:', networkInterfacesParser.filePattern);
+} else {
+    console.warn('[Worker] networkInterfacesParser is NOT defined - network-interfaces.js may have failed to load');
+}
+
+// From parsers/vmcore.js
+if (typeof vmcoreParser !== 'undefined') {
+    SCC_RULES.vmcore = vmcoreParser;
+    debugLog('[Worker] vmcoreParser registered successfully, filePattern:', vmcoreParser.filePattern);
+} else {
+    console.warn('[Worker] vmcoreParser is NOT defined - vmcore.js may have failed to load');
+}
+
+// From parsers/debugfs.js
+if (typeof hvBalloonParser !== 'undefined') {
+    SCC_RULES.hvBalloon = hvBalloonParser;
+    debugLog('[Worker] hvBalloonParser registered successfully, filePattern:', hvBalloonParser.filePattern);
+} else {
+    console.warn('[Worker] hvBalloonParser is NOT defined - debugfs.js may have failed to load');
+}
+if (typeof extfragParser !== 'undefined') {
+    SCC_RULES.extfrag = extfragParser;
+    debugLog('[Worker] extfragParser registered successfully, filePattern:', extfragParser.filePattern);
+} else {
+    console.warn('[Worker] extfragParser is NOT defined - debugfs.js may have failed to load');
+}
+// ============================================================================
+
+// Load the Rust streaming WASM module.
+//
+// The build step renames the LZMA module's top-level global from
+// `wasm_bindgen` to `lzma_bindgen` so it can co-exist with the
+// supportfile_wasm module (also target=no-modules) without redeclaring
+// the same identifier.
+importScripts(versionedAsset('./lzma-stream-wasm/lzma_stream_wasm.js'));
+const rustLzmaInit = lzma_bindgen;
+const rustLzmaModule = lzma_bindgen;
+
+let moduleReady = false;
+let LzmaModule = null;
+let Module = {};
+
+(async () => {
+    try {
+        debugLog('[XZ Streaming Worker] Initializing Rust LZMA wasm...');
+        await rustLzmaInit(
+            versionedAsset('./lzma-stream-wasm/lzma_stream_wasm_bg.wasm'));
+        LzmaModule = rustLzmaModule;
+        if (typeof LzmaModule.xzStreamInit !== 'function' ||
+            typeof LzmaModule.xzStreamProcess !== 'function' ||
+            typeof LzmaModule.xzStreamError !== 'function' ||
+            typeof LzmaModule.xzStreamFree !== 'function') {
+            throw new Error('Rust XZ wasm module is missing expected exports');
+        }
+
+        moduleReady = true;
+        debugLog('[XZ Streaming Worker] Rust LZMA module initialized successfully');
+
+        if (typeof wasm_bindgen === 'function') {
+            await wasm_bindgen(
+                versionedAsset('supportfile-wasm/supportfile_wasm_bg.wasm'));
+            self.SUPPORTFILE_WASM_READY = true;
+            debugLog('[Worker] supportfile WASM initialized');
+        } else {
+            self.SUPPORTFILE_WASM_READY = false;
+            console.warn('[Worker] supportfile wasm-bindgen init was not available');
+        }
+
+        self.postMessage({ ready: true });
+        debugLog('[XZ Streaming Worker] Ready message sent to main thread');
+    } catch (err) {
+        console.error('[XZ Streaming Worker] Module initialization failed:', err);
+        self.postMessage({ error: 'WASM module initialization failed: ' + err.message });
+    }
+})();
+
+// Parse TAR headers incrementally as data arrives
+class IncrementalTARParser {
+    constructor() {
+        this.buffer = new Uint8Array(0);
+        this.pendingChunks = [];   // Chunks waiting to be merged into buffer
+        this.pendingLength = 0;    // Total bytes in pendingChunks
+        // When the previous entry was a non-matching file whose data section
+        // exceeded what was already buffered at parse time, this holds the
+        // number of bytes that should be discarded from incoming chunks
+        // before any further data is queued. Keeps worker memory bounded
+        // even when the archive contains very large files we don't parse.
+        this.pendingSkip = 0;
+        this.files = [];
+        // Cap the file inventory to bound worker memory on archives with
+        // hundreds of thousands of entries. getAnalysis() only returns the
+        // first 50 anyway; we still maintain an accurate `fileCount` via
+        // `totalFileCount` which is incremented for every file regardless of
+        // whether it's stored.
+        this.MAX_FILES_RETAINED = 5000;
+        this.totalFileCount = 0;
+        this.directories = new Set();
+        this.MAX_DIRECTORIES_RETAINED = 5000;
+        this.fileTypes = {};
+        this.offset = 0;
+        this.totalParsed = 0;
+        this.foundEndMarker = false;
+        
+        // SCC report analysis state
+        this.isSCCReport = false;
+        this.isHanaLog = false;
+        this.sccReportName = null;
+        this.analysisResults = {}; // Stores parsed results by rule name (no raw file content)
+        this.perfTracker = null; // Lazy-init when performance debug is enabled
+        this.nextLongFilename = null; // For GNU TAR long filename extension
+        this.paxExtendedHeaders = {};  // For PAX extended attributes
+        this.usedPaxFormat = false;  // Track if PAX extended headers were used
+        this.processedLogFiles = {}; // Track processed log files to limit rotations (performance optimization)
+        
+        // Current file being processed (for progress reporting)
+        this.currentFile = '';
+        
+        // Nested compression statistics
+        this.nestedGzipTotalCount = 0; // Total .gz files found in archive
+        this.nestedGzipTotalCompressedBytes = 0; // Total compressed size of all .gz files
+        this.nestedGzipCount = 0; // .gz files actually decompressed
+        this.nestedGzipCompressedBytes = 0; // Compressed size of decompressed files
+        this.nestedGzipDecompressedBytes = 0; // Decompressed size
+    }
+
+    /**
+     * Bounded inventory append. We always count every file (so fileCount and
+     * the file-type histogram stay accurate), but only retain the first
+     * MAX_FILES_RETAINED entries in the `files` array. The UI shows at most
+     * the first 50, so retaining more would just waste memory on archives
+     * with hundreds of thousands of entries.
+     */
+    recordFile(filename, size, typeflag) {
+        this.totalFileCount++;
+        if (this.files.length < this.MAX_FILES_RETAINED) {
+            this.files.push({
+                name: filename,
+                size: size,
+                type: typeflag === 53 ? 'dir' : 'file'
+            });
+        }
+    }
+
+    /**
+     * Bounded directory tracking. Same rationale as recordFile: directory
+     * sets in deeply-nested archives can grow unbounded.
+     */
+    addDirectory(path) {
+        if (this.directories.size < this.MAX_DIRECTORIES_RETAINED) {
+            this.directories.add(path);
+        }
+    }
+
+    // Add decompressed chunk to buffer and parse what we can
+    addChunk(chunk) {
+        // Memory-efficiency: when the previous entry was a non-matching file
+        // larger than what was buffered at parse time, we mark its remaining
+        // data bytes for discard. Consume that many bytes from the front of
+        // this chunk before queueing anything. This prevents multi-GB archives
+        // from being held in worker memory just to be ignored later.
+        if (this.pendingSkip > 0) {
+            if (chunk.length <= this.pendingSkip) {
+                this.pendingSkip -= chunk.length;
+                return;
+            }
+            chunk = chunk.subarray(this.pendingSkip);
+            this.pendingSkip = 0;
+        }
+
+        // Defer buffer concatenation: just queue the chunk
+        this.pendingChunks.push(chunk);
+        this.pendingLength += chunk.length;
+
+        // Only flatten when we might have a complete TAR entry to process.
+        // A TAR header is 512 bytes; we need at least header + data to proceed.
+        // Flatten when total available data (buffer remainder + pending) could
+        // contain a new entry or when pending data exceeds 4 MB (avoid unbounded queue).
+        const available = (this.buffer.length - this.offset) + this.pendingLength;
+        if (available >= 512 || this.pendingLength >= 4 * 1024 * 1024) {
+            this.flushPendingChunks();
+        }
+
+        // Parse complete TAR entries
+        this.parseAvailableEntries();
+    }
+
+    // Merge pending chunks into the main buffer in one copy.
+    //
+    // Memory-efficiency: when a single TAR entry is large (e.g. a multi-100 MB
+    // log), naive growth (allocate exactly remaining + pending each call) is
+    // O(N²) total bytes copied because every flush re-copies the whole prefix.
+    // We grow geometrically (at least double the previous capacity) so the
+    // total work is O(N) and peak memory stays close to 2× the entry size.
+    flushPendingChunks() {
+        if (this.pendingChunks.length === 0) return;
+
+        const remaining = this.buffer.length - this.offset;
+        const newDataLen = remaining + this.pendingLength;
+
+        // Reuse the existing backing buffer's tail capacity if there's room
+        // beyond the current view. We append at `byteOffset + length`, so the
+        // available room is measured from there — NOT from `offset`, which
+        // would over-count the bytes we have already consumed and lead to a
+        // RangeError ("Invalid typed array length") when the new view is
+        // constructed past the backing buffer's end.
+        const backing = this.buffer.buffer;
+        const tailStart = this.buffer.byteOffset + this.buffer.length;
+        const tailRoom = backing.byteLength - tailStart;
+        if (tailRoom >= this.pendingLength) {
+            // Append in place — no allocation, no copy of the prefix.
+            const view = new Uint8Array(backing, tailStart, this.pendingLength);
+            let pos = 0;
+            for (const c of this.pendingChunks) {
+                view.set(c, pos);
+                pos += c.length;
+            }
+            // Extend logical view to include the new data.
+            this.buffer = new Uint8Array(
+                backing,
+                this.buffer.byteOffset,
+                this.buffer.length + this.pendingLength
+            );
+            this.pendingChunks = [];
+            this.pendingLength = 0;
+            return;
+        }
+
+        // Need to reallocate. Grow geometrically to avoid quadratic copy.
+        const capacity = Math.max(newDataLen, this.buffer.length * 2, 64 * 1024);
+        const mergedBacking = new ArrayBuffer(capacity);
+        const merged = new Uint8Array(mergedBacking, 0, newDataLen);
+
+        // Copy unprocessed portion of old buffer
+        if (remaining > 0) {
+            merged.set(this.buffer.subarray(this.offset), 0);
+        }
+
+        // Append all pending chunks
+        let pos = remaining;
+        for (const c of this.pendingChunks) {
+            merged.set(c, pos);
+            pos += c.length;
+        }
+
+        this.buffer = merged;
+        this.offset = 0;
+        this.pendingChunks = [];
+        this.pendingLength = 0;
+    }
+
+    parseAvailableEntries() {
+        while (true) {
+            // Ensure pending data is merged before checking available bytes
+            const available = (this.buffer.length - this.offset) + this.pendingLength;
+            if (available < 512) break;
+
+            // Flush pending chunks if buffer doesn't have enough for header check
+            if (this.buffer.length - this.offset < 512 && this.pendingLength > 0) {
+                this.flushPendingChunks();
+            }
+
+            // Check for end marker (two consecutive zero blocks)
+            if (this.isEndMarker(this.offset)) {
+                this.foundEndMarker = true;
+                debugLog('[TAR Parser] Found TAR end marker');
+                break;
+            }
+
+            // Need full header + potential data
+            const header = this.parseHeader(this.offset);
+            if (!header) {
+                break; // Invalid or incomplete header
+            }
+
+            const entrySize = 512 + Math.ceil(header.size / 512) * 512;
+
+            // Memory-efficiency prefilter: if no parser will read the data
+            // section of this entry, advance past the header + data without
+            // ever buffering the data. We still record the file's metadata
+            // (filename, size, type) for the inventory.
+            if (!this.entryNeedsContent(header)) {
+                // Record lightweight metadata; never touch the (possibly huge)
+                // data section.
+                this.recordEntryMetadataOnly(header);
+
+                // Advance over the header (which IS in the buffer).
+                this.offset += 512;
+
+                // Discard data bytes that are already in the buffer …
+                const dataInBuffer = Math.min(
+                    this.buffer.length - this.offset,
+                    entrySize - 512
+                );
+                if (dataInBuffer > 0) {
+                    this.offset += dataInBuffer;
+                }
+
+                // … and discard the rest from incoming chunks via pendingSkip.
+                const dataNotYetSeen = (entrySize - 512) - dataInBuffer;
+                if (dataNotYetSeen > 0) {
+                    this.pendingSkip = dataNotYetSeen;
+                }
+
+                this.totalParsed++;
+
+                // Trim and continue. If we set pendingSkip we may not have
+                // any more parseable data right now; loop will exit.
+                if (this.offset > 512 * 1024) {
+                    this.buffer = this.buffer.subarray(this.offset);
+                    this.offset = 0;
+                }
+                if (this.pendingSkip > 0) break;
+                continue;
+            }
+
+            // Check if we have the complete entry (including pending data)
+            const buffered = this.buffer.length - this.offset;
+            if (buffered < entrySize) {
+                if (buffered + this.pendingLength >= entrySize) {
+                    // We have enough in pending chunks — flush and retry
+                    this.flushPendingChunks();
+                } else {
+                    break; // Wait for more data
+                }
+            }
+
+            // Process entry
+            this.processEntry(header);
+
+            // Move to next entry
+            this.offset += entrySize;
+            this.totalParsed++;
+        }
+
+        // Trim processed data from buffer to keep memory low
+        if (this.offset > 512 * 1024) {
+            this.buffer = this.buffer.subarray(this.offset);
+            this.offset = 0;
+        }
+    }
+
+    /**
+     * Decide whether the data section of a TAR entry must be buffered.
+     *
+     * Returns true for:
+     *   - GNU long-name and PAX extended-header entries (their data IS the
+     *     metadata for the next entry)
+     *   - A file whose name triggers SCC-report detection
+     *   - Any file whose name matches a parser's filePattern (when we already
+     *     know we are in an SCC report)
+     *
+     * Returns false for everything else (directories, empty files, files in
+     * `/proc/`, `/sys/`, large binaries, etc.). Their bytes are dropped on the
+     * floor — never copied into worker memory.
+     */
+    entryNeedsContent(header) {
+        const { filename, size, typeflag } = header;
+
+        // GNU long filename and PAX extended-header entries: the data section
+        // contains metadata for the *next* entry, so we must read it.
+        if (
+            typeflag === 76 || typeflag === 'L'.charCodeAt(0) ||
+            typeflag === 120 || typeflag === 103 ||
+            typeflag === 'x'.charCodeAt(0) || typeflag === 'g'.charCodeAt(0)
+        ) {
+            return true;
+        }
+
+        // Empty entries and directories carry no parseable content.
+        if (size === 0) return false;
+        if (typeflag === 53 || typeflag === '5'.charCodeAt(0)) return false;
+
+        // SCC detection runs on filename only — but we'll need to extract
+        // content immediately on the very first detection file as well.
+        if (!this.isSCCReport && SCC_RULES.detection.isSCCReport(filename)) {
+            return true;
+        }
+
+        // HANA trace files may appear in a standalone (non-SCC) log archive.
+        if (SCC_RULES.detection.isHanaLog(filename)) {
+            return true;
+        }
+
+        // Files outside an SCC report are inventoried but never parsed.
+        if (!this.isSCCReport) return false;
+
+        // Inside an SCC report, only files matching at least one parser
+        // pattern are worth buffering.
+        for (const ruleName in SCC_RULES) {
+            const rule = SCC_RULES[ruleName];
+            if (ruleName === 'detection' || !rule || !rule.filePattern) continue;
+            if (rule.filePattern.test(filename)) return true;
+        }
+
+        return false;
+    }
+
+    /**
+     * Lightweight bookkeeping for entries whose data was discarded.
+     * Mirrors the bookkeeping side of processEntry() without touching the
+     * (already-discarded) data bytes.
+     */
+    recordEntryMetadataOnly(header) {
+        const { filename, size, typeflag } = header;
+
+        // Track current file for progress reporting
+        this.currentFile = filename;
+
+        // Clear PAX headers after a regular file (matches processEntry behavior)
+        if (typeflag === 48 || typeflag === 0 || typeflag === '0'.charCodeAt(0)) {
+            this.paxExtendedHeaders = {};
+        }
+
+        // Track directories
+        if (filename.includes('/')) {
+            const parts = filename.split('/');
+            let path = '';
+            for (let i = 0; i < parts.length - 1; i++) {
+                path += parts[i] + '/';
+                this.addDirectory(path);
+            }
+        }
+
+        // Track file-type histogram
+        const ext = filename.includes('.') ? filename.split('.').pop().toLowerCase() : 'none';
+        this.fileTypes[ext] = (this.fileTypes[ext] || 0) + 1;
+
+        // Inventory the file (bounded; counts all, retains first N)
+        this.recordFile(filename, size, typeflag);
+
+        // Track *all* .gz entries (not just the ones we actually decompress)
+        if (filename.toLowerCase().endsWith('.gz') &&
+            (typeflag === 48 || typeflag === 0 || typeflag === '0'.charCodeAt(0))) {
+            this.nestedGzipTotalCount++;
+            this.nestedGzipTotalCompressedBytes += size;
+        }
+    }
+
+    isEndMarker(offset) {
+        if (this.buffer.length - offset < 1024) return false;
+        for (let i = 0; i < 1024; i++) {
+            if (this.buffer[offset + i] !== 0) return false;
+        }
+        return true;
+    }
+
+    parseHeader(offset) {
+        if (this.buffer.length - offset < 512) return null;
+
+        // Read type flag first (offset 156)
+        const typeflag = this.buffer[offset + 156];
+
+        // Read filename (null-terminated, first 100 bytes)
+        let filename = '';
+        for (let i = 0; i < 100; i++) {
+            if (this.buffer[offset + i] === 0) break;
+            filename += String.fromCharCode(this.buffer[offset + i]);
+        }
+
+        // Read prefix field (offset 345, 155 bytes) for POSIX ustar format
+        let prefix = '';
+        for (let i = 345; i < 500; i++) {
+            if (this.buffer[offset + i] === 0) break;
+            prefix += String.fromCharCode(this.buffer[offset + i]);
+        }
+
+        // Combine prefix and filename if prefix exists
+        if (prefix) {
+            filename = prefix + '/' + filename;
+        }
+
+        // Use long filename from previous GNU extension if available
+        if (this.nextLongFilename) {
+            filename = this.nextLongFilename;
+            this.nextLongFilename = null;
+        }
+
+        // Use path from PAX extended headers if available
+        if (this.paxExtendedHeaders.path) {
+            filename = this.paxExtendedHeaders.path;
+        }
+
+        if (!filename) return null;
+
+        // Read size (octal string at offset 124, 12 bytes)
+        let sizeStr = '';
+        for (let i = 124; i < 136; i++) {
+            const c = this.buffer[offset + i];
+            if (c === 0 || c === 32) break;
+            sizeStr += String.fromCharCode(c);
+        }
+
+        const size = parseInt(sizeStr.trim(), 8) || 0;
+
+        // Debug: Log when parsing headers for key files
+        if (filename.includes('dpkg') || filename.includes('usr/lib/os-release')) {
+            debugLog(`[TAR Parser] parseHeader:`, filename, `size=${size}, prefix='${prefix}', name_len=${filename.length}, typeflag=${typeflag}`);
+        }
+
+        return { filename, size, typeflag, offset };
+    }
+
+    processEntry(header) {
+        const { filename, size, typeflag, offset } = header;
+        
+        // Track current file for progress reporting
+        this.currentFile = filename;
+
+        // Handle GNU TAR long filename extension (typeflag='L' or 76)
+        if (typeflag === 76 || typeflag === 'L'.charCodeAt(0)) {
+            // This entry contains a long filename for the NEXT entry
+            // Extract the long filename from the data section
+            const dataOffset = offset + 512;
+            let longName = '';
+            const maxRead = Math.min(size, this.buffer.length - dataOffset);
+            for (let i = 0; i < maxRead; i++) {
+                const c = this.buffer[dataOffset + i];
+                if (c === 0) break;
+                longName += String.fromCharCode(c);
+            }
+            this.nextLongFilename = longName;
+            debugLog(`[TAR Parser] Found long filename:`, longName);
+            return; // Don't process this as a regular file
+        }
+
+        // Handle PAX extended headers (typeflag='x' (120) or 'g' (103))
+        if (typeflag === 120 || typeflag === 103 || typeflag === 'x'.charCodeAt(0) || typeflag === 'g'.charCodeAt(0)) {
+            this.usedPaxFormat = true;  // Mark that this archive uses PAX format
+            const dataOffset = offset + 512;
+            let paxData = '';
+            const maxRead = Math.min(size, this.buffer.length - dataOffset);
+            for (let i = 0; i < maxRead; i++) {
+                const c = this.buffer[dataOffset + i];
+                if (c === 0) break;
+                paxData += String.fromCharCode(c);
+            }
+            
+            // Parse PAX extended headers (format: "length key=value\n")
+            const lines = paxData.split('\n');
+            for (const line of lines) {
+                if (!line.trim()) continue;
+                // PAX format: "111 path=sosreport-..." or "111 path = sosreport-..."
+                const match = line.match(/^\d+\s+(\S+)\s*=\s*(.*)$/);
+                if (match) {
+                    const key = match[1];
+                    const value = match[2];
+                    this.paxExtendedHeaders[key] = value;
+                    if (key === 'path' || key === 'linkpath') {
+                        debugLog(`[TAR Parser] Found PAX ${key}:`, value);
+                    }
+                }
+            }
+            return; // Don't process PAX headers as regular files
+        }
+
+        // Debug: Log when we see key files
+        if (filename.endsWith('dpkg_-l') || filename.endsWith('os-release')) {
+            debugLog(`[TAR Parser] processEntry:`, filename, `size=${size}, typeflag=${typeflag}`);
+        }
+
+        // Detect SCC report using rules
+        if (!this.isSCCReport && SCC_RULES.detection.isSCCReport(filename)) {
+            this.isSCCReport = true;
+            this.sccReportName = filename.split('/')[0];
+            debugLog('[TAR Parser] Detected SCC report:', this.sccReportName);
+        }
+
+        // Detect standalone HANA log archive (no SCC wrapper).
+        if (!this.isHanaLog && SCC_RULES.detection.isHanaLog(filename)) {
+            this.isHanaLog = true;
+            debugLog('[TAR Parser] Detected HANA trace file:', filename);
+        }
+
+        // Process SCC rules if this is an SCC report
+        if ((this.isSCCReport || this.isHanaLog) && size > 0) {
+            this.processSCCRules(filename, size, offset);
+        }
+
+        // Clear PAX headers after processing regular file (typeflag '0' or 48)
+        if (typeflag === 48 || typeflag === 0 || typeflag === '0'.charCodeAt(0)) {
+            this.paxExtendedHeaders = {};
+        }
+
+        // Track directories
+        if (filename.includes('/')) {
+            const parts = filename.split('/');
+            let path = '';
+            for (let i = 0; i < parts.length - 1; i++) {
+                path += parts[i] + '/';
+                this.addDirectory(path);
+            }
+        }
+
+        // Track file types
+        const ext = filename.includes('.') ? filename.split('.').pop().toLowerCase() : 'none';
+        this.fileTypes[ext] = (this.fileTypes[ext] || 0) + 1;
+
+        // Store file entry (bounded; counts all, retains first N)
+        this.recordFile(filename, size, typeflag);
+        
+        // Track ALL .gz files in the archive (not just the ones we decompress)
+        if (filename.toLowerCase().endsWith('.gz') && (typeflag === 48 || typeflag === 0 || typeflag === '0'.charCodeAt(0))) {
+            this.nestedGzipTotalCount++;
+            this.nestedGzipTotalCompressedBytes += size;
+        }
+    }
+
+    // Process all SCC rules against current file
+    processSCCRules(filename, size, offset) {
+        // Skip PaxHeaders - they are TAR extended headers, not actual file content
+        if (filename.includes('/PaxHeaders/') || filename.endsWith('/PaxHeaders')) {
+            return;
+        }
+        
+        // Normalize sos_strings tailed file paths back to their original paths
+        // sosreport stores large log files in sos_strings/<plugin>/var.log.<path>.<file>.tailed
+        // and creates symlinks from the original paths (which appear as 0-byte entries in tar)
+        // Example: sos_strings/pacemaker/var.log.pacemaker.pacemaker.log.tailed -> var/log/pacemaker/pacemaker.log
+        // Example: sos_strings/logs/var.log.messages.tailed -> var/log/messages
+        // Example: sos_strings/logs/var.log.secure-20260125.tailed -> var/log/secure-20260125
+        const tailedMatch = filename.match(/sos_strings\/[^\/]+\/(.+)\.tailed$/);
+        if (tailedMatch) {
+            // The dotted path encodes the original filesystem path with dots as separators
+            // We need to reconstruct: var.log.pacemaker.pacemaker.log -> var/log/pacemaker/pacemaker.log
+            // Strategy: known log file extensions (.log, .conf) mark where filename starts
+            const dottedPath = tailedMatch[1];
+            let originalPath;
+            
+            // Match known file extensions to find filename boundary
+            // e.g., "var.log.pacemaker.pacemaker.log" -> split at last known ext keeping it as extension
+            const extMatch = dottedPath.match(/^(.+)\.((log|conf|txt|xml)(?:[.-].+)?)$/);
+            if (extMatch) {
+                // extMatch[1] = "var.log.pacemaker.pacemaker", extMatch[2] = "log" or "log-20260127"
+                const pathPart = extMatch[1];
+                const filePart = extMatch[2];
+                // Find the last dot-separated segment before the extension as the filename base
+                const segments = pathPart.split('.');
+                const fileBase = segments.pop();
+                const dirPath = segments.join('/');
+                originalPath = dirPath + '/' + fileBase + '.' + filePart;
+            } else {
+                // No known extension (e.g., "var.log.messages", "var.log.secure-20260125")
+                const segments = dottedPath.split('.');
+                const fileName = segments.pop();
+                const dirPath = segments.join('/');
+                originalPath = dirPath + '/' + fileName;
+            }
+            
+            // Reconstruct full path with the report prefix
+            const reportPrefix = filename.substring(0, filename.indexOf('sos_strings'));
+            filename = reportPrefix + originalPath;
+            debugLog('[TAR Parser] Normalized sos_strings tailed path to:', filename);
+        }
+        
+        // Performance optimization: Limit processing of compressed rotated log files
+        // Track which base log files we've seen and limit compressed rotations to 3 most recent
+        // Uncompressed rotated logs are processed without limit
+        if (!this.processedLogFiles) {
+            this.processedLogFiles = {}; // Track: baseFileName -> [rotation numbers for compressed files]
+        }
+        
+        // Check if this is a compressed rotated log file (messages.1.gz, messages-20241215.bz2, etc.)
+        const compressedRotationMatch = filename.match(/\/(messages|localmessages|journalctl[^/]*|pacemaker\.log|corosync\.log)([.-]\d+)?(?:\.gz|\.bz2|\.xz)$/);
+        if (compressedRotationMatch) {
+            const baseFile = compressedRotationMatch[1];
+            const rotation = compressedRotationMatch[2] || '.current';
+            
+            if (!this.processedLogFiles[baseFile]) {
+                this.processedLogFiles[baseFile] = [];
+            }
+            
+            // Check if any rule needs all rotations for this file
+            const needsAllRotations = Object.values(SCC_RULES).some(rule => 
+                rule.processAllRotations && rule.filePattern && rule.filePattern.test(filename)
+            );
+            
+            if (!needsAllRotations) {
+                // Limit to 3 versions of compressed log files (current + 2 rotations)
+                // This prevents processing dozens of old compressed rotated logs
+                if (this.processedLogFiles[baseFile].length >= 3) {
+                    debugLog(`[TAR Parser] Skipping compressed rotated log (limit reached):`, filename);
+                    return;
+                }
+            }
+            
+            this.processedLogFiles[baseFile].push(rotation);
+            const limitInfo = needsAllRotations ? 'no limit' : `${this.processedLogFiles[baseFile].length}/3`;
+            debugLog(`[TAR Parser] Processing compressed log file ${baseFile} rotation ${rotation} (${limitInfo})`);
+        }
+        
+        // Debug: Log when we see key files
+        if (filename.endsWith('dpkg_-l') || filename.endsWith('os-release')) {
+            debugLog(`[TAR Parser] Processing file:`, filename, `size=${size}`);
+        }
+        
+        // Iterate through all rules (except detection)
+        // Performance: extract file content ONCE and reuse across all matching parsers
+        // instead of re-slicing and re-decoding the buffer for each parser
+        const dataOffset = offset + 512;
+        let cachedContent = null;          // Full content (decoded once, reused)
+        let cachedLines = null;            // Pre-split lines (shared across all parsers for same file)
+        let cachedContentSmall = null;     // Truncated content for suseCloudRegister
+
+        // Lazy-init performance tracker on first file if performance debug is on
+        const perfMode = DEBUG_CONFIG.performance;
+        if (perfMode && !this.perfTracker && typeof PerformanceTracker !== 'undefined') {
+            this.perfTracker = new PerformanceTracker();
+        }
+        const pt = this.perfTracker;
+        let fileParserCount = 0;
+        
+        for (const [ruleName, rule] of Object.entries(SCC_RULES)) {
+            if (ruleName === 'detection' || !rule.filePattern) continue;
+            
+            // Debug: Log pattern testing for key files
+            if (filename.includes('os-release') || filename.includes('dpkg') || filename.includes('installed-rpms') || filename.includes('package-data') || filename.includes('dnf.log') || filename.includes('/block/') || filename.includes('/fstab') || filename.includes('fs-iscsi') || filename.includes('iscsi')) {
+                debugLog(`[TAR Parser] Testing rule '${ruleName}' pattern ${rule.filePattern} against:`, filename);
+            }
+            // Check if filename matches rule pattern
+            if (rule.filePattern.test(filename)) {
+                debugLog(`[TAR Parser] Matched rule '${ruleName}' for file:`, filename);
+
+                // Start per-file timing on first matching rule
+                if (pt && fileParserCount === 0) {
+                    pt.startFile();
+                }
+                fileParserCount++;
+                
+                // Special case: cloudregister.txt can be huge (1GB+), only extract first 100KB
+                let content;
+                if (ruleName === 'suseCloudRegister') {
+                    const maxSize = 100 * 1024; // 100 KB
+                    const extractSize = Math.min(size, maxSize);
+                    debugLog(`[TAR Parser] cloudregister.txt size ${size} bytes, extracting first ${extractSize} bytes`);
+                    if (this.buffer.length >= dataOffset + extractSize) {
+                        if (!cachedContentSmall) {
+                            cachedContentSmall = this.extractFileContent(dataOffset, extractSize, filename);
+                        }
+                        content = cachedContentSmall;
+                    }
+                } else {
+                    if (this.buffer.length >= dataOffset + size) {
+                        if (!cachedContent) {
+                            cachedContent = this.extractFileContent(dataOffset, size, filename);
+                        }
+                        content = cachedContent;
+                    }
+                }
+                
+                if (content) {
+                        // Split lines ONCE and share across all matching parsers
+                        // Avoids each parser re-splitting the same content (e.g. 10 parsers × 44MB = 10 redundant splits)
+                        if (!cachedLines) {
+                            cachedLines = content.split('\n');
+                        }
+                        
+                        // For rules that process multiple files (like liveMigration, kernelReboots, oomKiller, xfsErrors, emergencyMode, sshService, automation, clusterEvents, rhuiErrors, blockDevices, sapInstanceErrors, firewallRules, azureExtensions, and kernelTuning)
+                        // we need to accumulate results instead of replacing
+                        const isMultiFileRule = ruleName === 'liveMigration' || ruleName === 'kernelReboots' || ruleName === 'oomKiller' || ruleName === 'xfsErrors' || ruleName === 'emergencyMode' || ruleName === 'sshService' || ruleName === 'automation' || ruleName === 'clusterEvents' || ruleName === 'rhuiErrors' || ruleName === 'blockDevices' || ruleName === 'sapInstanceErrors' || ruleName === 'firewallRules' || ruleName === 'networkInterfaces' || ruleName === 'vmcore' || ruleName === 'azureExtensions' || ruleName === 'lvmConfig' || ruleName === 'kernelTuning' || ruleName === 'nfsMounts' || ruleName === 'hanaSavepoints' || ruleName === 'hanaDeadlocks' || ruleName === 'hanaOom' || ruleName === 'hanaMergeErrors';
+                        
+                        // NOTE: We don't store file content in extractedFiles anymore to save memory
+                        // Content is parsed immediately and discarded
+                        
+                        // Parse using rule's parse function (pass filename for format detection)
+                        try {
+                            const parseStart = pt ? performance.now() : 0;
+                            const result = rule.parse(content, filename, cachedLines);
+                            if (pt) {
+                                pt.recordParser(filename, ruleName, performance.now() - parseStart, result, this.analysisResults[ruleName]);
+                            }
+                            
+                            if (isMultiFileRule) {
+                                // Accumulate results for multi-file rules
+                                // rhuiErrors, blockDevices, sapInstanceErrors, firewallRules, lvmConfig, and kernelTuning have different structures, so initialize separately
+                                if (!this.analysisResults[ruleName] && ruleName !== 'rhuiErrors' && ruleName !== 'blockDevices' && ruleName !== 'sapInstanceErrors' && ruleName !== 'firewallRules' && ruleName !== 'networkInterfaces' && ruleName !== 'vmcore' && ruleName !== 'lvmConfig' && ruleName !== 'kernelTuning' && ruleName !== 'nfsMounts' && ruleName !== 'hanaSavepoints' && ruleName !== 'hanaDeadlocks' && ruleName !== 'hanaOom' && ruleName !== 'hanaMergeErrors') {
+                                    this.analysisResults[ruleName] = {
+                                        count: 0,
+                                        events: []
+                                    };
+                                }
+                                
+                                // Handle kernelTuning accumulation - merges sysctl parameters across sysctl.conf + sysctl.d/*.conf files
+                                if (ruleName === 'kernelTuning') {
+                                    if (!this.analysisResults[ruleName]) {
+                                        this.analysisResults[ruleName] = { found: false, parameters: {}, warnings: [], hasWarnings: false, azureNetworkWarnings: [], hasAzureNetworkWarnings: false, optionalNetworkInfo: [], hasOptionalNetworkInfo: false };
+                                    }
+                                    kernelTuningParser.mergeResults(this.analysisResults[ruleName], result);
+                                    debugLog(`[TAR Parser] Rule 'kernelTuning' accumulated from ${filename} (parameters: ${Object.keys(this.analysisResults[ruleName].parameters).length})`);
+                                }
+                                // Handle lvmConfig accumulation - merges PVs, VGs, LVs across separate files
+                                else if (ruleName === 'lvmConfig') {
+                                    if (!this.analysisResults[ruleName]) {
+                                        this.analysisResults[ruleName] = { found: false, pvs: [], vgs: [], lvs: [], warnings: [], rawOutput: {} };
+                                    }
+                                    lvmConfigParser.mergeResults(this.analysisResults[ruleName], result);
+                                    debugLog(`[TAR Parser] Rule 'lvmConfig' accumulated from ${filename} (pvs: ${this.analysisResults[ruleName].pvs.length}, vgs: ${this.analysisResults[ruleName].vgs.length}, lvs: ${this.analysisResults[ruleName].lvs.length})`);
+                                }
+                                // Handle nfsMounts accumulation - merges NFS mounts and warnings across fstab + mount sources
+                                else if (ruleName === 'nfsMounts') {
+                                    if (!this.analysisResults[ruleName]) {
+                                        this.analysisResults[ruleName] = result;
+                                    } else {
+                                        this.analysisResults[ruleName] = nfsMountsParser.mergeResults(this.analysisResults[ruleName], result);
+                                    }
+                                    debugLog(`[TAR Parser] Rule 'nfsMounts' accumulated from ${filename} (mounts: ${(this.analysisResults[ruleName].mounts || []).length}, warnings: ${(this.analysisResults[ruleName].warnings || []).length})`);
+                                }
+                                // Handle hanaSavepoints accumulation - merges HANA savepoint events and warnings across trace files
+                                else if (ruleName === 'hanaSavepoints') {
+                                    if (!this.analysisResults[ruleName]) {
+                                        this.analysisResults[ruleName] = result;
+                                    } else {
+                                        this.analysisResults[ruleName] = hanaSavepointsParser.mergeResults(this.analysisResults[ruleName], result);
+                                    }
+                                    debugLog(`[TAR Parser] Rule 'hanaSavepoints' accumulated from ${filename} (savepoints: ${(this.analysisResults[ruleName].savepoints || []).length}, warnings: ${(this.analysisResults[ruleName].warnings || []).length})`);
+                                }
+                                // Handle hanaDeadlocks accumulation - merges HANA deadlock events across trace files
+                                else if (ruleName === 'hanaDeadlocks') {
+                                    if (!this.analysisResults[ruleName]) {
+                                        this.analysisResults[ruleName] = result;
+                                    } else {
+                                        this.analysisResults[ruleName] = hanaDeadlocksParser.mergeResults(this.analysisResults[ruleName], result);
+                                    }
+                                    debugLog(`[TAR Parser] Rule 'hanaDeadlocks' accumulated from ${filename} (deadlocks: ${(this.analysisResults[ruleName].deadlocks || []).length}, warnings: ${(this.analysisResults[ruleName].warnings || []).length})`);
+                                }
+                                // Handle hanaOom accumulation - merges HANA out-of-memory events across trace files
+                                else if (ruleName === 'hanaOom') {
+                                    if (!this.analysisResults[ruleName]) {
+                                        this.analysisResults[ruleName] = result;
+                                    } else {
+                                        this.analysisResults[ruleName] = hanaOomParser.mergeResults(this.analysisResults[ruleName], result);
+                                    }
+                                    debugLog(`[TAR Parser] Rule 'hanaOom' accumulated from ${filename} (events: ${(this.analysisResults[ruleName].events || []).length}, warnings: ${(this.analysisResults[ruleName].warnings || []).length})`);
+                                }
+                                // Handle hanaMergeErrors accumulation - merges HANA delta-merge/compression errors across trace files
+                                else if (ruleName === 'hanaMergeErrors') {
+                                    if (!this.analysisResults[ruleName]) {
+                                        this.analysisResults[ruleName] = result;
+                                    } else {
+                                        this.analysisResults[ruleName] = hanaMergeErrorsParser.mergeResults(this.analysisResults[ruleName], result);
+                                    }
+                                    debugLog(`[TAR Parser] Rule 'hanaMergeErrors' accumulated from ${filename} (errors: ${(this.analysisResults[ruleName].errors || []).length}, warnings: ${(this.analysisResults[ruleName].warnings || []).length})`);
+                                }
+                                // Handle blockDevices accumulation - merges disks, partitions, and UUID maps
+                                else if (ruleName === 'blockDevices') {
+                                    if (!this.analysisResults[ruleName]) {
+                                        this.analysisResults[ruleName] = result;
+                                    } else {
+                                        // Merge result into existing
+                                        this.mergeBlockDevicesResult(this.analysisResults[ruleName], result);
+                                    }
+                                    debugLog(`[TAR Parser] Rule 'blockDevices' accumulated from ${filename} (disks: ${this.analysisResults[ruleName].disks?.length || 0}, partitions: ${this.analysisResults[ruleName].partitions?.length || 0})`);
+                                }
+                                // Handle vmcore accumulation - merges crash dumps, kdump config/status
+                                else if (ruleName === 'vmcore') {
+                                    if (!this.analysisResults[ruleName]) {
+                                        this.analysisResults[ruleName] = {
+                                            found: false,
+                                            crashes: [],
+                                            kdumpStatus: null,
+                                            crashListing: null,
+                                            kdumpConf: null
+                                        };
+                                    }
+                                    vmcoreParser.mergeResults(this.analysisResults[ruleName], result);
+                                    debugLog(`[TAR Parser] Rule 'vmcore' accumulated from ${filename} (crashes: ${this.analysisResults[ruleName].crashes.length})`);
+                                }
+                                // For kernelReboots, xfsErrors, emergencyMode, sshService, automation, clusterEvents, rhuiErrors, sapInstanceErrors, firewallRules, networkInterfaces, and azureExtensions, deduplicate events based on timestamp and relevant fields
+                                else if (ruleName === 'kernelReboots' || ruleName === 'xfsErrors' || ruleName === 'emergencyMode' || ruleName === 'sshService' || ruleName === 'automation' || ruleName === 'clusterEvents' || ruleName === 'rhuiErrors' || ruleName === 'sapInstanceErrors' || ruleName === 'firewallRules' || ruleName === 'networkInterfaces' || ruleName === 'azureExtensions') {
+                                    // Define comparison fields for each rule type
+                                    const comparisonFields = ruleName === 'kernelReboots' 
+                                        ? ['timestamp', 'type', 'kernelVersion']
+                                        : ruleName === 'xfsErrors'
+                                        ? ['timestamp', 'device', 'message']
+                                        : ruleName === 'emergencyMode'
+                                        ? ['timestamp', 'lineNumber']
+                                        : ruleName === 'sshService'
+                                        ? ['timestamp', 'issueType', 'message']
+                                        : ruleName === 'automation'
+                                        ? ['timestamp', 'toolType', 'command']
+                                        : ruleName === 'azureExtensions'
+                                        ? ['name']
+                                        : null; // clusterEvents handled separately below
+                                    
+                                    if (ruleName === 'clusterEvents') {
+                                        // clusterEvents has two arrays: resourceMigrations and fencingEvents
+                                        if (!this.analysisResults[ruleName].resourceMigrations) {
+                                            this.analysisResults[ruleName].resourceMigrations = [];
+                                        }
+                                        if (!this.analysisResults[ruleName].fencingEvents) {
+                                            this.analysisResults[ruleName].fencingEvents = [];
+                                        }
+                                        // Initialize total counters (track all events even if arrays are capped)
+                                        if (this.analysisResults[ruleName].totalResourceMigrations === undefined) {
+                                            this.analysisResults[ruleName].totalResourceMigrations = 0;
+                                        }
+                                        if (this.analysisResults[ruleName].totalFencingEvents === undefined) {
+                                            this.analysisResults[ruleName].totalFencingEvents = 0;
+                                        }
+                                        
+                                        // Cap stored events to prevent OOM while keeping accurate counts
+                                        const MAX_STORED_EVENTS = 5000;
+                                        
+                                        // Deduplicate resource migrations
+                                        const migrationFields = ['timestamp', 'resource', 'fromNode', 'toNode', 'action'];
+                                        const migrationResult = SCC_RULES.deduplicateEvents(
+                                            this.analysisResults[ruleName].resourceMigrations,
+                                            result.resourceMigrations || [],
+                                            migrationFields
+                                        );
+                                        // Count all unique events
+                                        this.analysisResults[ruleName].totalResourceMigrations += migrationResult.addedEvents.length;
+                                        // Only store up to the cap
+                                        const migrationRoom = MAX_STORED_EVENTS - this.analysisResults[ruleName].resourceMigrations.length;
+                                        if (migrationRoom > 0) {
+                                            this.analysisResults[ruleName].resourceMigrations.push(
+                                                ...migrationResult.addedEvents.slice(0, migrationRoom)
+                                            );
+                                        }
+                                        
+                                        // Deduplicate fencing events
+                                        const fencingFields = ['timestamp', 'targetNode', 'action', 'status'];
+                                        const fencingResult = SCC_RULES.deduplicateEvents(
+                                            this.analysisResults[ruleName].fencingEvents,
+                                            result.fencingEvents || [],
+                                            fencingFields
+                                        );
+                                        // Count all unique events
+                                        this.analysisResults[ruleName].totalFencingEvents += fencingResult.addedEvents.length;
+                                        // Only store up to the cap
+                                        const fencingRoom = MAX_STORED_EVENTS - this.analysisResults[ruleName].fencingEvents.length;
+                                        if (fencingRoom > 0) {
+                                            this.analysisResults[ruleName].fencingEvents.push(
+                                                ...fencingResult.addedEvents.slice(0, fencingRoom)
+                                            );
+                                        }
+                                        
+                                        this.analysisResults[ruleName].count = this.analysisResults[ruleName].totalResourceMigrations + this.analysisResults[ruleName].totalFencingEvents;
+                                        
+                                        debugLog(`[TAR Parser] Rule 'clusterEvents' accumulated ${migrationResult.addedEvents.length} migrations, ${fencingResult.addedEvents.length} fencing events (${migrationResult.duplicateCount + fencingResult.duplicateCount} duplicates skipped, total: ${this.analysisResults[ruleName].count}, stored: ${this.analysisResults[ruleName].resourceMigrations.length}+${this.analysisResults[ruleName].fencingEvents.length})`);
+                                    } else if (ruleName === 'rhuiErrors') {
+                                        // RHUI errors rule has special structure - merge boolean flags and arrays
+                                        if (!this.analysisResults[ruleName]) {
+                                            this.analysisResults[ruleName] = {
+                                                found: false,
+                                                hasCertExpiration: false,
+                                                hasHttp403: false,
+                                                hasHttp400: false,
+                                                hasConnectionError: false,
+                                                errors: [],
+                                                affectedRepos: [],
+                                                warnings: [],
+                                                recommendations: []
+                                            };
+                                        }
+                                        
+                                        // Merge boolean flags (OR them together)
+                                        this.analysisResults[ruleName].found = this.analysisResults[ruleName].found || result.found;
+                                        this.analysisResults[ruleName].hasCertExpiration = this.analysisResults[ruleName].hasCertExpiration || result.hasCertExpiration;
+                                        this.analysisResults[ruleName].hasHttp403 = this.analysisResults[ruleName].hasHttp403 || result.hasHttp403;
+                                        this.analysisResults[ruleName].hasHttp400 = this.analysisResults[ruleName].hasHttp400 || result.hasHttp400;
+                                        this.analysisResults[ruleName].hasConnectionError = this.analysisResults[ruleName].hasConnectionError || result.hasConnectionError;
+                                        
+                                        // Add errors (with source file)
+                                        result.errors.forEach(err => {
+                                            this.analysisResults[ruleName].errors.push({
+                                                ...err,
+                                                sourceFile: filename
+                                            });
+                                        });
+                                        
+                                        // Add unique affected repos
+                                        result.affectedRepos.forEach(repo => {
+                                            if (!this.analysisResults[ruleName].affectedRepos.includes(repo)) {
+                                                this.analysisResults[ruleName].affectedRepos.push(repo);
+                                            }
+                                        });
+                                        
+                                        // Add unique warnings (by type)
+                                        result.warnings.forEach(warning => {
+                                            if (!this.analysisResults[ruleName].warnings.find(w => w.type === warning.type)) {
+                                                this.analysisResults[ruleName].warnings.push(warning);
+                                            }
+                                        });
+                                        
+                                        debugLog(`[TAR Parser] Rule 'rhuiErrors' accumulated from ${filename} (found: ${result.found}, errors: ${result.errors.length}, total errors: ${this.analysisResults[ruleName].errors.length})`);
+                                    } else if (ruleName === 'sapInstanceErrors') {
+                                        // sapInstanceErrors: merge errors from multiple log files (analysis.txt, cluster-log.txt, messages)
+                                        if (!this.analysisResults[ruleName]) {
+                                            this.analysisResults[ruleName] = {
+                                                found: false,
+                                                errors: [],
+                                                startProfileErrors: [],
+                                                grayStatusErrors: [],
+                                                filesystemErrors: []
+                                            };
+                                        }
+                                        
+                                        // Only process if errors were found in this file
+                                        if (result.found && result.errors && result.errors.length > 0) {
+                                            // Merge found flag
+                                            this.analysisResults[ruleName].found = true;
+                                            
+                                            // Add errors with deduplication (by type, resourceName, message)
+                                            result.errors.forEach(err => {
+                                                const key = `${err.type}:${err.resourceName}:${err.message}`;
+                                                const exists = this.analysisResults[ruleName].errors.some(e => 
+                                                    `${e.type}:${e.resourceName}:${e.message}` === key
+                                                );
+                                                if (!exists) {
+                                                    this.analysisResults[ruleName].errors.push({
+                                                        ...err,
+                                                        sourceFile: filename
+                                                    });
+                                                }
+                                            });
+                                            
+                                            // Update categorized arrays
+                                            this.analysisResults[ruleName].startProfileErrors = this.analysisResults[ruleName].errors.filter(e => e.type === 'start_profile_not_found');
+                                            this.analysisResults[ruleName].grayStatusErrors = this.analysisResults[ruleName].errors.filter(e => e.type === 'sap_service_gray_status');
+                                            this.analysisResults[ruleName].filesystemErrors = this.analysisResults[ruleName].errors.filter(e => e.type === 'filesystem_unmount_error');
+                                            
+                                            debugLog(`[TAR Parser] Rule 'sapInstanceErrors' accumulated from ${filename} (errors: ${result.errors.length}, total errors: ${this.analysisResults[ruleName].errors.length})`);
+                                        }
+                                    } else if (ruleName === 'firewallRules') {
+                                        // firewallRules: merge results from multiple files (SOS has many)
+                                        if (!this.analysisResults[ruleName]) {
+                                            this.analysisResults[ruleName] = result;
+                                        } else {
+                                            const existing = this.analysisResults[ruleName];
+                                            existing.found = existing.found || result.found;
+                                            // Merge firewalld
+                                            existing.firewalld.detected = existing.firewalld.detected || result.firewalld.detected;
+                                            existing.firewalld.running = existing.firewalld.running || result.firewalld.running;
+                                            if (result.firewalld.config) existing.firewalld.config = result.firewalld.config;
+                                            if (result.firewalld.zones) existing.firewalld.zones = result.firewalld.zones;
+                                            if (result.firewalld.directRules) existing.firewalld.directRules = (existing.firewalld.directRules || '') + result.firewalld.directRules;
+                                            if (result.firewalld.passthroughs) existing.firewalld.passthroughs = (existing.firewalld.passthroughs || '') + result.firewalld.passthroughs;
+                                            if (result.firewalld.chains) existing.firewalld.chains = (existing.firewalld.chains || '') + result.firewalld.chains;
+                                            if (result.firewalld.logDenied) existing.firewalld.logDenied = result.firewalld.logDenied;
+                                            if (result.firewalld.backend) existing.firewalld.backend = result.firewalld.backend;
+                                            // Merge iptables / ip6tables
+                                            existing.iptables.detected = existing.iptables.detected || result.iptables.detected;
+                                            existing.iptables.rules.push(...result.iptables.rules);
+                                            existing.iptables.modules.push(...result.iptables.modules);
+                                            existing.ip6tables.detected = existing.ip6tables.detected || result.ip6tables.detected;
+                                            existing.ip6tables.rules.push(...result.ip6tables.rules);
+                                            existing.ip6tables.modules.push(...result.ip6tables.modules);
+                                            // Merge ebtables
+                                            existing.ebtables.detected = existing.ebtables.detected || result.ebtables.detected;
+                                            if (result.ebtables.config) existing.ebtables.config = result.ebtables.config;
+                                            // Merge nftables
+                                            existing.nftables.detected = existing.nftables.detected || result.nftables.detected;
+                                            if (result.nftables.ruleset) existing.nftables.ruleset = result.nftables.ruleset;
+                                            if (result.nftables.tables) existing.nftables.tables = result.nftables.tables;
+                                            // Merge warnings and raw sections
+                                            existing.warnings.push(...result.warnings.filter(w => {
+                                                const key = typeof w === 'string' ? w : JSON.stringify(w);
+                                                return !existing.warnings.some(e => (typeof e === 'string' ? e : JSON.stringify(e)) === key);
+                                            }));
+                                            if (!existing.rawSections) existing.rawSections = {};
+                                            if (result.rawSections) Object.assign(existing.rawSections, result.rawSections);
+                                            // Re-determine active firewall
+                                            existing.activeFirewall = firewallRulesParser.determineActiveFirewall(existing);
+                                        }
+                                        debugLog(`[TAR Parser] Rule 'firewallRules' accumulated from ${filename} (active: ${this.analysisResults[ruleName].activeFirewall})`);
+                                    } else if (ruleName === 'networkInterfaces') {
+                                        // networkInterfaces: merge results from multiple files (SOS has many)
+                                        if (!this.analysisResults[ruleName]) {
+                                            this.analysisResults[ruleName] = result;
+                                        } else {
+                                            networkInterfacesParser.mergeResults(this.analysisResults[ruleName], result);
+                                        }
+                                        const ifaceCount = Object.keys(this.analysisResults[ruleName].interfaces || {}).length;
+                                        debugLog(`[TAR Parser] Rule 'networkInterfaces' accumulated from ${filename} (interfaces: ${ifaceCount})`);
+                                    } else {
+                                        // Add sourceFile to new events
+                                        const newEventsWithSource = result.events.map(event => ({
+                                            ...event,
+                                            sourceFile: filename
+                                        }));
+                                        
+                                        // Use utility function for deduplication
+                                        const dedupeResult = SCC_RULES.deduplicateEvents(
+                                            this.analysisResults[ruleName].events,
+                                            newEventsWithSource,
+                                            comparisonFields
+                                        );
+                                        
+                                        // Add non-duplicate events
+                                        this.analysisResults[ruleName].events.push(...dedupeResult.addedEvents);
+                                        this.analysisResults[ruleName].count = this.analysisResults[ruleName].events.length;
+                                        
+                                        debugLog(`[TAR Parser] Rule '${ruleName}' accumulated ${dedupeResult.addedEvents.length} new events (${dedupeResult.duplicateCount} duplicates skipped, total: ${this.analysisResults[ruleName].count})`);
+                                    }
+                                } else {
+                                    // Merge results without deduplication for other multi-file rules
+                                    this.analysisResults[ruleName].count += result.count;
+                                    this.analysisResults[ruleName].events.push(...result.events.map(e => ({
+                                        ...e,
+                                        sourceFile: filename
+                                    })));
+                                    
+                                    debugLog(`[TAR Parser] Rule '${ruleName}' accumulated ${result.count} new events (total: ${this.analysisResults[ruleName].count})`);
+                                }
+                            } else {
+                                // Single file rule - for fencingConfig and pacemakerResources, merge/keep best result
+                                if (ruleName === 'fencingConfig') {
+                                    // Keep the result with the most information
+                                    const existing = this.analysisResults[ruleName];
+                                    
+                                    // If no existing result, use this one
+                                    if (!existing) {
+                                        this.analysisResults[ruleName] = result;
+                                        debugLog(`[TAR Parser] Rule '${ruleName}' parsed successfully (first):`, result);
+                                    } else {
+                                        // Merge: prefer explicit stonithEnabled over null, accumulate devices
+                                        const merged = {
+                                            found: existing.found || result.found,
+                                            stonithEnabled: result.stonithEnabled !== null ? result.stonithEnabled : existing.stonithEnabled,
+                                            stonithSourceFile: result.stonithEnabled !== null ? result.stonithSourceFile : existing.stonithSourceFile,
+                                            stonithSourcePattern: result.stonithEnabled !== null ? result.stonithSourcePattern : existing.stonithSourcePattern,
+                                            fencingDevices: [...existing.fencingDevices],
+                                            count: existing.count
+                                        };
+                                        
+                                        // Add new devices that don't already exist
+                                        result.fencingDevices.forEach(newDevice => {
+                                            if (!merged.fencingDevices.find(d => d.name === newDevice.name)) {
+                                                merged.fencingDevices.push(newDevice);
+                                                merged.count++;
+                                            }
+                                        });
+                                        
+                                        this.analysisResults[ruleName] = merged;
+                                        debugLog(`[TAR Parser] Rule '${ruleName}' merged with existing (${merged.count} devices, stonith: ${merged.stonithEnabled})`);
+                                    }
+                                } else if (ruleName === 'pacemakerResources') {
+                                    // Keep the result with resources, or merge resources
+                                    const existing = this.analysisResults[ruleName];
+                                    
+                                    if (!existing || !existing.found) {
+                                        this.analysisResults[ruleName] = result;
+                                        debugLog(`[TAR Parser] Rule '${ruleName}' parsed successfully (first):`, result);
+                                    } else if (result.found) {
+                                        // Merge resources and enrich with node information
+                                        let newResourcesAdded = 0;
+                                        let enrichedResources = 0;
+                                        
+                                        result.resources.forEach(newRes => {
+                                            const existingRes = existing.resources.find(r => r.name === newRes.name);
+                                            if (existingRes) {
+                                                // Enrich existing resource with new data (especially node info from crm_mon)
+                                                let wasEnriched = false;
+                                                if (newRes.node && !existingRes.node) {
+                                                    existingRes.node = newRes.node;
+                                                    existingRes.status = newRes.status;
+                                                    wasEnriched = true;
+                                                }
+                                                if (newRes.status && !existingRes.status) {
+                                                    existingRes.status = newRes.status;
+                                                    wasEnriched = true;
+                                                }
+                                                if (wasEnriched) {
+                                                    enrichedResources++;
+                                                    debugLog(`[TAR Parser] Enriched resource '${newRes.name}' with node/status info`);
+                                                }
+                                            } else {
+                                                // Add new resource only if it's truly new
+                                                existing.resources.push(newRes);
+                                                newResourcesAdded++;
+                                                debugLog(`[TAR Parser] Added new resource '${newRes.name}'`);
+                                            }
+                                        });
+                                        existing.count = existing.resources.length;
+                                        debugLog(`[TAR Parser] Rule '${ruleName}' merged: ${newResourcesAdded} new resources added, ${enrichedResources} enriched, ${result.resources.length - newResourcesAdded - enrichedResources} duplicates skipped (${existing.count} total)`);
+                                    }
+                                } else if (ruleName === 'clusterNodes') {
+                                    // Merge and deduplicate cluster nodes from multiple files
+                                    const existing = this.analysisResults[ruleName];
+                                    
+                                    if (!existing || !existing.nodes || existing.nodes.length === 0) {
+                                        this.analysisResults[ruleName] = result;
+                                        debugLog(`[TAR Parser] Rule '${ruleName}' parsed successfully (first): ${result.nodes.length} nodes`);
+                                    } else {
+                                        // Merge node lists and deduplicate
+                                        const nodeSet = new Set([...existing.nodes, ...result.nodes]);
+                                        // Merge node-to-IP mappings
+                                        const mergedMap = {...existing.nodeToIpMap, ...result.nodeToIpMap};
+                                        this.analysisResults[ruleName] = {
+                                            nodes: Array.from(nodeSet).sort(),
+                                            nodeToIpMap: mergedMap
+                                        };
+                                        debugLog(`[TAR Parser] Rule '${ruleName}' merged (${this.analysisResults[ruleName].nodes.length} unique nodes, ${Object.keys(mergedMap).length} mappings)`);
+                                    }
+                                } else if (ruleName === 'distroPackages') {
+                                    // distroPackages: prefer raw format over Azure validation format
+                                    const existing = this.analysisResults[ruleName];
+                                    
+                                    // Priority: raw content (isRpmRaw or isDpkg) > Azure validation (packages/warnings)
+                                    const isRawFormat = result.isRpmRaw || result.isDpkg;
+                                    const existingIsRaw = existing && (existing.isRpmRaw || existing.isDpkg);
+                                    
+                                    if (!existing || isRawFormat && !existingIsRaw) {
+                                        // No existing result, or this is raw and existing is validation
+                                        this.analysisResults[ruleName] = result;
+                                        debugLog(`[TAR Parser] Rule '${ruleName}' parsed successfully (${isRawFormat ? 'raw format' : 'validation format'}):`, result);
+                                    } else if (!isRawFormat && existingIsRaw) {
+                                        // This is validation but existing is raw - keep existing
+                                        debugLog(`[TAR Parser] Rule '${ruleName}' skipping validation format (already have raw format)`);
+                                    } else {
+                                        // Both same type, use newer
+                                        this.analysisResults[ruleName] = result;
+                                        debugLog(`[TAR Parser] Rule '${ruleName}' replaced with newer result`);
+                                    }
+                                } else if (ruleName === 'involfltKernelVersion') {
+                                    // involfltKernelVersion: preserve positive result (found: true) once found
+                                    const existing = this.analysisResults[ruleName];
+                                    
+                                    if (!existing || !existing.found) {
+                                        // No existing result or existing is negative - update if we have a result
+                                        if (result) {
+                                            this.analysisResults[ruleName] = result;
+                                            debugLog(`[TAR Parser] Rule '${ruleName}' parsed successfully:`, result);
+                                        }
+                                    } else {
+                                        // Already have a positive result - keep it
+                                        debugLog(`[TAR Parser] Rule '${ruleName}' already found, keeping existing result`);
+                                    }
+                                } else if (ruleName === 'azureScheduledEvents') {
+                                    // azureScheduledEvents: merge results from multiple files (pcs_status, crm_mon, cib.xml)
+                                    const existing = this.analysisResults[ruleName];
+                                    
+                                    if (!existing || !existing.found) {
+                                        this.analysisResults[ruleName] = result;
+                                        debugLog(`[TAR Parser] Rule '${ruleName}' parsed successfully (first):`, result);
+                                    } else if (result.found) {
+                                        // Merge results: accumulate nodes, resources, and warnings
+                                        // Keep healthAzureConfigured if either found it
+                                        existing.healthAzureConfigured = existing.healthAzureConfigured || result.healthAzureConfigured;
+                                        
+                                        // Keep healthAzureResource if either found it
+                                        if (result.healthAzureResource && !existing.healthAzureResource) {
+                                            existing.healthAzureResource = result.healthAzureResource;
+                                        }
+                                        
+                                        // Keep nodeHealthStrategy if either found it
+                                        if (result.nodeHealthStrategy && !existing.nodeHealthStrategy) {
+                                            existing.nodeHealthStrategy = result.nodeHealthStrategy;
+                                        }
+                                        
+                                        // Merge nodesWithHealthAzure (dedupe by node name)
+                                        result.nodesWithHealthAzure.forEach(newNode => {
+                                            if (!existing.nodesWithHealthAzure.find(n => n.node === newNode.node)) {
+                                                existing.nodesWithHealthAzure.push(newNode);
+                                            }
+                                        });
+                                        
+                                        // Merge onlineNodes (dedupe)
+                                        result.onlineNodes.forEach(node => {
+                                            if (!existing.onlineNodes.includes(node)) {
+                                                existing.onlineNodes.push(node);
+                                            }
+                                        });
+                                        
+                                        // Merge stoppedResources (dedupe)
+                                        result.stoppedResources.forEach(res => {
+                                            if (!existing.stoppedResources.includes(res)) {
+                                                existing.stoppedResources.push(res);
+                                            }
+                                        });
+                                        
+                                        debugLog(`[TAR Parser] Rule '${ruleName}' merged (onlineNodes: ${existing.onlineNodes.length}, stoppedResources: ${existing.stoppedResources.length})`);
+                                    }
+                                } else if (ruleName === 'iscsiConfig') {
+                                    // iscsiConfig: merge results from multiple files (fs-iscsi.txt, ha.txt)
+                                    // Don't overwrite a found result with not-found
+                                    const existing = this.analysisResults[ruleName];
+                                    
+                                    if (!existing || !existing.found) {
+                                        // No existing result or existing is not found - use new result
+                                        this.analysisResults[ruleName] = result;
+                                        debugLog(`[TAR Parser] Rule '${ruleName}' parsed (first or replacing not-found):`, result.found);
+                                    } else if (result.found) {
+                                        // Both found - merge by keeping all sessions and targets
+                                        // Merge sessions (dedupe by ip:port:iqn)
+                                        result.sessions.forEach(newSession => {
+                                            const key = `${newSession.ip}:${newSession.port}:${newSession.iqn}`;
+                                            const exists = existing.sessions.find(s => `${s.ip}:${s.port}:${s.iqn}` === key);
+                                            if (!exists) {
+                                                existing.sessions.push(newSession);
+                                            }
+                                        });
+                                        
+                                        // Merge discoveryServers (dedupe by ip:port)
+                                        result.discoveryServers.forEach(newServer => {
+                                            const key = `${newServer.ip}:${newServer.port}`;
+                                            const exists = existing.discoveryServers.find(s => `${s.ip}:${s.port}` === key);
+                                            if (!exists) {
+                                                existing.discoveryServers.push(newServer);
+                                            }
+                                        });
+                                        
+                                        // Merge targets (dedupe by iqn)
+                                        result.targets.forEach(newTarget => {
+                                            const exists = existing.targets.find(t => t.iqn === newTarget.iqn);
+                                            if (!exists) {
+                                                existing.targets.push(newTarget);
+                                            }
+                                        });
+                                        
+                                        // Keep warnings from both
+                                        result.warnings.forEach(w => {
+                                            if (!existing.warnings.find(ew => ew.type === w.type && ew.message === w.message)) {
+                                                existing.warnings.push(w);
+                                            }
+                                        });
+                                        
+                                        debugLog(`[TAR Parser] Rule '${ruleName}' merged results (sessions: ${existing.sessions.length})`);
+                                    } else {
+                                        // New result is not found but existing is - keep existing
+                                        debugLog(`[TAR Parser] Rule '${ruleName}' keeping existing found result, ignoring not-found from ${filename}`);
+                                    }
+                                } else {
+                                    // Other single file rules - replace result
+                                    this.analysisResults[ruleName] = result;
+                                    debugLog(`[TAR Parser] Rule '${ruleName}' parsed successfully:`, result);
+                                }
+                            }
+                        } catch (e) {
+                            debugLog(`[TAR Parser] Rule '${ruleName}' parse failed:`, e);
+                        }
+                    }
+                }
+            }
+
+            // End per-file timing if any parsers matched
+            if (pt && fileParserCount > 0) {
+                const contentLen = cachedContent ? cachedContent.length : (cachedContentSmall ? cachedContentSmall.length : 0);
+                pt.endFile(filename, contentLen, fileParserCount);
+            }
+        }
+
+    /**
+     * Process a pre-extracted file (e.g. from a ZIP archive) through all SCC parsers.
+     * This reuses the same parser matching and result accumulation logic as processSCCRules
+     * but accepts already-decoded string content instead of reading from the TAR buffer.
+     * @param {string} filename - The file path within the archive
+     * @param {Uint8Array} contentBytes - Raw file bytes
+     */
+    processExtractedFile(filename, contentBytes) {
+        // Track current file for progress reporting
+        this.currentFile = filename;
+
+        const size = contentBytes.length;
+
+        // Detect SCC report
+        if (!this.isSCCReport && SCC_RULES.detection.isSCCReport(filename)) {
+            this.isSCCReport = true;
+            this.sccReportName = filename.split('/')[0];
+            debugLog('[ZIP Parser] Detected SCC report:', this.sccReportName);
+        }
+
+        // Detect standalone HANA log archive (no SCC wrapper).
+        if (!this.isHanaLog && SCC_RULES.detection.isHanaLog(filename)) {
+            this.isHanaLog = true;
+            debugLog('[ZIP Parser] Detected HANA trace file:', filename);
+        }
+
+        // Track directories
+        if (filename.includes('/')) {
+            const parts = filename.split('/');
+            let path = '';
+            for (let i = 0; i < parts.length - 1; i++) {
+                path += parts[i] + '/';
+                this.addDirectory(path);
+            }
+        }
+
+        // Track file types
+        const ext = filename.includes('.') ? filename.split('.').pop().toLowerCase() : 'none';
+        this.fileTypes[ext] = (this.fileTypes[ext] || 0) + 1;
+
+        // Store file entry (bounded; counts all, retains first N)
+        this.recordFile(filename, size, filename.endsWith('/') ? 53 : 48);
+
+        // Skip directories and empty files
+        if (size === 0 || filename.endsWith('/')) return;
+
+        // Only process if this is an SCC/sosreport or a standalone HANA log
+        if (!this.isSCCReport && !this.isHanaLog) return;
+
+        // Normalize sos_strings tailed file paths (same logic as processSCCRules)
+        let matchFilename = filename;
+        const tailedMatch = filename.match(/sos_strings\/[^\/]+\/(.+)\.tailed$/);
+        if (tailedMatch) {
+            const dottedPath = tailedMatch[1];
+            let originalPath;
+            const extMatch = dottedPath.match(/^(.+)\.((log|conf|txt|xml)(?:[.-].+)?)$/);
+            if (extMatch) {
+                const segments = extMatch[1].split('.');
+                const fileBase = segments.pop();
+                const dirPath = segments.join('/');
+                originalPath = dirPath + '/' + fileBase + '.' + extMatch[2];
+            } else {
+                const segments = dottedPath.split('.');
+                const fileName = segments.pop();
+                const dirPath = segments.join('/');
+                originalPath = dirPath + '/' + fileName;
+            }
+            const reportPrefix = filename.substring(0, filename.indexOf('sos_strings'));
+            matchFilename = reportPrefix + originalPath;
+            debugLog('[ZIP Parser] Normalized sos_strings tailed path to:', matchFilename);
+        }
+
+        // Compressed log rotation limiter (same logic as processSCCRules)
+        if (!this.processedLogFiles) {
+            this.processedLogFiles = {};
+        }
+        const compressedRotationMatch = matchFilename.match(/\/(messages|localmessages|journalctl[^/]*|pacemaker\.log|corosync\.log)([.-]\d+)?(?:\.gz|\.bz2|\.xz)$/);
+        if (compressedRotationMatch) {
+            const baseFile = compressedRotationMatch[1];
+            const rotation = compressedRotationMatch[2] || '.current';
+            if (!this.processedLogFiles[baseFile]) this.processedLogFiles[baseFile] = [];
+            const needsAllRotations = Object.values(SCC_RULES).some(rule =>
+                rule.processAllRotations && rule.filePattern && rule.filePattern.test(matchFilename)
+            );
+            if (!needsAllRotations && this.processedLogFiles[baseFile].length >= 3) {
+                debugLog('[ZIP Parser] Skipping compressed rotated log (limit reached):', matchFilename);
+                return;
+            }
+            this.processedLogFiles[baseFile].push(rotation);
+        }
+
+        // Track .gz files
+        if (matchFilename.toLowerCase().endsWith('.gz')) {
+            this.nestedGzipTotalCount++;
+            this.nestedGzipTotalCompressedBytes += size;
+        }
+
+        // Decode content - handle nested gzip if applicable
+        let content;
+        const isGzipped = contentBytes.length >= 2 && contentBytes[0] === 0x1f && contentBytes[1] === 0x8b;
+        if (isGzipped && typeof pako !== 'undefined') {
+            try {
+                const decompressed = pako.ungzip(contentBytes);
+                content = new TextDecoder('utf-8').decode(decompressed);
+                this.nestedGzipCount++;
+                this.nestedGzipCompressedBytes += size;
+                this.nestedGzipDecompressedBytes += decompressed.length;
+                debugLog('[ZIP Parser] Decompressed nested .gz file:', matchFilename, size, '->', decompressed.length);
+            } catch (e) {
+                debugLog('[ZIP Parser] Failed to decompress .gz file:', matchFilename, e);
+                try { content = new TextDecoder('utf-8').decode(contentBytes); } catch (e2) { return; }
+            }
+        } else {
+            try {
+                content = new TextDecoder('utf-8').decode(contentBytes);
+            } catch (e) {
+                debugLog('[ZIP Parser] Failed to decode file:', matchFilename, e);
+                return;
+            }
+        }
+
+        if (!content) return;
+
+        // Performance tracking
+        const perfMode = DEBUG_CONFIG.performance;
+        if (perfMode && !this.perfTracker && typeof PerformanceTracker !== 'undefined') {
+            this.perfTracker = new PerformanceTracker();
+        }
+        const pt = this.perfTracker;
+        let fileParserCount = 0;
+        let cachedLines = null;
+
+        // Run all matching parsers (same accumulation logic as processSCCRules)
+        for (const [ruleName, rule] of Object.entries(SCC_RULES)) {
+            if (ruleName === 'detection' || !rule.filePattern) continue;
+            if (!rule.filePattern.test(matchFilename)) continue;
+
+            debugLog('[ZIP Parser] Matched rule', ruleName, 'for file:', matchFilename);
+
+            if (pt && fileParserCount === 0) pt.startFile();
+            fileParserCount++;
+
+            let fileContent = content;
+            // Special case: cloudregister.txt truncation
+            if (ruleName === 'suseCloudRegister') {
+                const maxSize = 100 * 1024;
+                if (content.length > maxSize) fileContent = content.substring(0, maxSize);
+            }
+
+            if (!cachedLines) cachedLines = content.split('\n');
+
+            const isMultiFileRule = ruleName === 'liveMigration' || ruleName === 'kernelReboots' || ruleName === 'oomKiller' || ruleName === 'xfsErrors' || ruleName === 'emergencyMode' || ruleName === 'sshService' || ruleName === 'automation' || ruleName === 'clusterEvents' || ruleName === 'rhuiErrors' || ruleName === 'blockDevices' || ruleName === 'sapInstanceErrors' || ruleName === 'firewallRules' || ruleName === 'networkInterfaces' || ruleName === 'vmcore' || ruleName === 'azureExtensions' || ruleName === 'lvmConfig' || ruleName === 'kernelTuning' || ruleName === 'nfsMounts' || ruleName === 'hanaSavepoints' || ruleName === 'hanaDeadlocks' || ruleName === 'hanaOom' || ruleName === 'hanaMergeErrors';
+
+            try {
+                const parseStart = pt ? performance.now() : 0;
+                const result = rule.parse(fileContent, matchFilename, cachedLines);
+                if (pt) pt.recordParser(matchFilename, ruleName, performance.now() - parseStart, result, this.analysisResults[ruleName]);
+
+                if (isMultiFileRule) {
+                    if (!this.analysisResults[ruleName] && ruleName !== 'rhuiErrors' && ruleName !== 'blockDevices' && ruleName !== 'sapInstanceErrors' && ruleName !== 'firewallRules' && ruleName !== 'networkInterfaces' && ruleName !== 'vmcore' && ruleName !== 'lvmConfig' && ruleName !== 'kernelTuning' && ruleName !== 'nfsMounts' && ruleName !== 'hanaSavepoints' && ruleName !== 'hanaDeadlocks' && ruleName !== 'hanaOom' && ruleName !== 'hanaMergeErrors') {
+                        this.analysisResults[ruleName] = { count: 0, events: [] };
+                    }
+
+                    if (ruleName === 'kernelTuning') {
+                        if (!this.analysisResults[ruleName]) {
+                            this.analysisResults[ruleName] = { found: false, parameters: {}, warnings: [], hasWarnings: false, azureNetworkWarnings: [], hasAzureNetworkWarnings: false, optionalNetworkInfo: [], hasOptionalNetworkInfo: false };
+                        }
+                        kernelTuningParser.mergeResults(this.analysisResults[ruleName], result);
+                    } else if (ruleName === 'lvmConfig') {
+                        if (!this.analysisResults[ruleName]) {
+                            this.analysisResults[ruleName] = { found: false, pvs: [], vgs: [], lvs: [], warnings: [], rawOutput: {} };
+                        }
+                        lvmConfigParser.mergeResults(this.analysisResults[ruleName], result);
+                    } else if (ruleName === 'nfsMounts') {
+                        if (!this.analysisResults[ruleName]) {
+                            this.analysisResults[ruleName] = result;
+                        } else {
+                            this.analysisResults[ruleName] = nfsMountsParser.mergeResults(this.analysisResults[ruleName], result);
+                        }
+                        debugLog(`[ZIP Parser] Rule 'nfsMounts' accumulated from ${matchFilename} (mounts: ${(this.analysisResults[ruleName].mounts || []).length})`);
+                    } else if (ruleName === 'hanaSavepoints') {
+                        if (!this.analysisResults[ruleName]) {
+                            this.analysisResults[ruleName] = result;
+                        } else {
+                            this.analysisResults[ruleName] = hanaSavepointsParser.mergeResults(this.analysisResults[ruleName], result);
+                        }
+                        debugLog(`[ZIP Parser] Rule 'hanaSavepoints' accumulated from ${matchFilename} (savepoints: ${(this.analysisResults[ruleName].savepoints || []).length})`);
+                    } else if (ruleName === 'hanaDeadlocks') {
+                        if (!this.analysisResults[ruleName]) {
+                            this.analysisResults[ruleName] = result;
+                        } else {
+                            this.analysisResults[ruleName] = hanaDeadlocksParser.mergeResults(this.analysisResults[ruleName], result);
+                        }
+                        debugLog(`[ZIP Parser] Rule 'hanaDeadlocks' accumulated from ${matchFilename} (deadlocks: ${(this.analysisResults[ruleName].deadlocks || []).length})`);
+                    } else if (ruleName === 'hanaOom') {
+                        if (!this.analysisResults[ruleName]) {
+                            this.analysisResults[ruleName] = result;
+                        } else {
+                            this.analysisResults[ruleName] = hanaOomParser.mergeResults(this.analysisResults[ruleName], result);
+                        }
+                        debugLog(`[ZIP Parser] Rule 'hanaOom' accumulated from ${matchFilename} (events: ${(this.analysisResults[ruleName].events || []).length})`);
+                    } else if (ruleName === 'hanaMergeErrors') {
+                        if (!this.analysisResults[ruleName]) {
+                            this.analysisResults[ruleName] = result;
+                        } else {
+                            this.analysisResults[ruleName] = hanaMergeErrorsParser.mergeResults(this.analysisResults[ruleName], result);
+                        }
+                        debugLog(`[ZIP Parser] Rule 'hanaMergeErrors' accumulated from ${matchFilename} (errors: ${(this.analysisResults[ruleName].errors || []).length})`);
+                    } else if (ruleName === 'blockDevices') {
+                        if (!this.analysisResults[ruleName]) {
+                            this.analysisResults[ruleName] = result;
+                        } else {
+                            this.mergeBlockDevicesResult(this.analysisResults[ruleName], result);
+                        }
+                    } else if (ruleName === 'vmcore') {
+                        if (!this.analysisResults[ruleName]) {
+                            this.analysisResults[ruleName] = { found: false, crashes: [], kdumpStatus: null, crashListing: null, kdumpConf: null };
+                        }
+                        vmcoreParser.mergeResults(this.analysisResults[ruleName], result);
+                    } else if (ruleName === 'clusterEvents') {
+                        if (!this.analysisResults[ruleName].resourceMigrations) this.analysisResults[ruleName].resourceMigrations = [];
+                        if (!this.analysisResults[ruleName].fencingEvents) this.analysisResults[ruleName].fencingEvents = [];
+                        if (result && result.resourceMigrations) {
+                            const dedup = SCC_RULES.deduplicateEvents(this.analysisResults[ruleName].resourceMigrations, result.resourceMigrations, ['timestamp', 'resource', 'action']);
+                            this.analysisResults[ruleName].resourceMigrations.push(...dedup.addedEvents);
+                        }
+                        if (result && result.fencingEvents) {
+                            const dedup = SCC_RULES.deduplicateEvents(this.analysisResults[ruleName].fencingEvents, result.fencingEvents, ['timestamp', 'node', 'action']);
+                            this.analysisResults[ruleName].fencingEvents.push(...dedup.addedEvents);
+                        }
+                        this.analysisResults[ruleName].count = (this.analysisResults[ruleName].resourceMigrations?.length || 0) + (this.analysisResults[ruleName].fencingEvents?.length || 0);
+                    } else if (ruleName === 'networkInterfaces') {
+                        // networkInterfaces: merge interfaces/raw using parser's mergeResults (same as TAR path)
+                        if (!this.analysisResults[ruleName]) {
+                            this.analysisResults[ruleName] = result;
+                        } else {
+                            networkInterfacesParser.mergeResults(this.analysisResults[ruleName], result);
+                        }
+                        debugLog(`[ZIP Parser] Rule 'networkInterfaces' accumulated from ${matchFilename} (interfaces: ${Object.keys(this.analysisResults[ruleName].interfaces || {}).length})`);
+                    } else if (ruleName === 'firewallRules') {
+                        // firewallRules: merge firewall config using same logic as TAR path
+                        if (!this.analysisResults[ruleName]) {
+                            this.analysisResults[ruleName] = result;
+                        } else {
+                            const existing = this.analysisResults[ruleName];
+                            existing.found = existing.found || result.found;
+                            existing.firewalld.detected = existing.firewalld.detected || result.firewalld.detected;
+                            existing.firewalld.running = existing.firewalld.running || result.firewalld.running;
+                            if (result.firewalld.config) existing.firewalld.config = result.firewalld.config;
+                            if (result.firewalld.zones) existing.firewalld.zones = result.firewalld.zones;
+                            if (result.firewalld.directRules) existing.firewalld.directRules = (existing.firewalld.directRules || '') + result.firewalld.directRules;
+                            if (result.firewalld.passthroughs) existing.firewalld.passthroughs = (existing.firewalld.passthroughs || '') + result.firewalld.passthroughs;
+                            if (result.firewalld.chains) existing.firewalld.chains = (existing.firewalld.chains || '') + result.firewalld.chains;
+                            if (result.firewalld.logDenied) existing.firewalld.logDenied = result.firewalld.logDenied;
+                            if (result.firewalld.backend) existing.firewalld.backend = result.firewalld.backend;
+                            existing.iptables.detected = existing.iptables.detected || result.iptables.detected;
+                            existing.iptables.rules.push(...result.iptables.rules);
+                            existing.iptables.modules.push(...result.iptables.modules);
+                            existing.ip6tables.detected = existing.ip6tables.detected || result.ip6tables.detected;
+                            existing.ip6tables.rules.push(...result.ip6tables.rules);
+                            existing.ip6tables.modules.push(...result.ip6tables.modules);
+                            existing.ebtables.detected = existing.ebtables.detected || result.ebtables.detected;
+                            if (result.ebtables.config) existing.ebtables.config = result.ebtables.config;
+                            existing.nftables.detected = existing.nftables.detected || result.nftables.detected;
+                            if (result.nftables.ruleset) existing.nftables.ruleset = result.nftables.ruleset;
+                            if (result.nftables.tables) existing.nftables.tables = result.nftables.tables;
+                            existing.warnings.push(...result.warnings.filter(w => {
+                                const key = typeof w === 'string' ? w : JSON.stringify(w);
+                                return !existing.warnings.some(e => (typeof e === 'string' ? e : JSON.stringify(e)) === key);
+                            }));
+                            if (!existing.rawSections) existing.rawSections = {};
+                            if (result.rawSections) Object.assign(existing.rawSections, result.rawSections);
+                            existing.activeFirewall = firewallRulesParser.determineActiveFirewall(existing);
+                        }
+                        debugLog(`[ZIP Parser] Rule 'firewallRules' accumulated from ${matchFilename} (active: ${this.analysisResults[ruleName].activeFirewall})`);
+                    } else if (['rhuiErrors', 'sapInstanceErrors'].includes(ruleName)) {
+                        if (!this.analysisResults[ruleName]) {
+                            this.analysisResults[ruleName] = result;
+                        } else if (result && result.found !== false) {
+                            // Merge events/data from result into existing
+                            if (result.events && Array.isArray(result.events)) {
+                                if (!this.analysisResults[ruleName].events) this.analysisResults[ruleName].events = [];
+                                const compFields = ['timestamp', 'message'];
+                                const dedup = SCC_RULES.deduplicateEvents(this.analysisResults[ruleName].events, result.events, compFields);
+                                this.analysisResults[ruleName].events.push(...dedup.addedEvents);
+                            }
+                            this.analysisResults[ruleName].found = this.analysisResults[ruleName].found || result.found;
+                            this.analysisResults[ruleName].count = this.analysisResults[ruleName].events?.length || 0;
+                        }
+                    } else {
+                        // Standard event accumulation (liveMigration, kernelReboots, oomKiller, etc.)
+                        if (result && result.events && Array.isArray(result.events) && result.events.length > 0) {
+                            const compFields = ruleName === 'kernelReboots' ? ['timestamp', 'type', 'kernelVersion']
+                                : ruleName === 'xfsErrors' ? ['timestamp', 'device', 'message']
+                                : ruleName === 'emergencyMode' ? ['timestamp', 'lineNumber']
+                                : ruleName === 'sshService' ? ['timestamp', 'issueType', 'message']
+                                : ruleName === 'automation' ? ['timestamp', 'toolType', 'command']
+                                : ruleName === 'azureExtensions' ? ['name']
+                                : ['timestamp', 'message'];
+                            const dedup = SCC_RULES.deduplicateEvents(this.analysisResults[ruleName].events, result.events, compFields);
+                            this.analysisResults[ruleName].events.push(...dedup.addedEvents);
+                            this.analysisResults[ruleName].count = this.analysisResults[ruleName].events.length;
+                            if (result.found) this.analysisResults[ruleName].found = true;
+                        }
+                    }
+                } else if (ruleName === 'iscsiConfig') {
+                    const existing = this.analysisResults[ruleName];
+                    if (!existing || !existing.found) {
+                        this.analysisResults[ruleName] = result;
+                    } else if (result.found) {
+                        result.sessions.forEach(ns => {
+                            const key = `${ns.ip}:${ns.port}:${ns.iqn}`;
+                            if (!existing.sessions.find(s => `${s.ip}:${s.port}:${s.iqn}` === key)) existing.sessions.push(ns);
+                        });
+                        result.discoveryServers.forEach(ns => {
+                            const key = `${ns.ip}:${ns.port}`;
+                            if (!existing.discoveryServers.find(s => `${s.ip}:${s.port}` === key)) existing.discoveryServers.push(ns);
+                        });
+                        result.targets.forEach(nt => { if (!existing.targets.find(t => t.iqn === nt.iqn)) existing.targets.push(nt); });
+                        result.warnings.forEach(w => { if (!existing.warnings.find(ew => ew.type === w.type && ew.message === w.message)) existing.warnings.push(w); });
+                    }
+                } else {
+                    this.analysisResults[ruleName] = result;
+                    debugLog('[ZIP Parser] Rule', ruleName, 'parsed successfully');
+                }
+            } catch (e) {
+                debugLog('[ZIP Parser] Rule', ruleName, 'parse failed:', e);
+            }
+        }
+
+        if (pt && fileParserCount > 0) {
+            pt.endFile(matchFilename, content.length, fileParserCount);
+        }
+    }
+
+    extractFileContent(offset, size, filename) {
+        const contentBytes = this.buffer.slice(offset, offset + size);
+        
+        // Check if content is gzipped (magic bytes: 0x1f 0x8b)
+        const isGzipped = contentBytes.length >= 2 && contentBytes[0] === 0x1f && contentBytes[1] === 0x8b;
+        
+        if (isGzipped) {
+            debugLog(`[TAR Parser] Detected gzipped file: ${filename} (${size} bytes)`);
+            try {
+                debugLog(`[TAR Parser] Decompressing nested .gz file: ${filename} (${size} bytes compressed)`);
+                
+                // Send progress update for nested decompression
+                debugLog(`[TAR Parser] Sending nested decompression progress message for: ${filename}`);
+                self.postMessage({
+                    progress: true,
+                    message: `Decompressing nested file: ${filename.split('/').pop()}`
+                });
+                
+                // Use native browser DecompressionStream if available (modern browsers)
+                if (typeof DecompressionStream !== 'undefined') {
+                    // DecompressionStream is async, we need to handle it differently
+                    // For now, fall back to synchronous pako-style decompression
+                    debugLog('[TAR Parser] DecompressionStream API available but async - using alternative method');
+                }
+                
+                // Use pako library for gzip decompression (synchronous)
+                // pako.inflate returns Uint8Array
+                if (typeof pako !== 'undefined' && pako.inflate) {
+                    debugLog(`[TAR Parser] Using pako to decompress ${filename}`);
+                    const decompressed = pako.inflate(contentBytes);
+                    const decodedText = new TextDecoder('utf-8').decode(decompressed);
+                    
+                    // Track nested decompression statistics
+                    this.nestedGzipCount++;
+                    this.nestedGzipCompressedBytes += size;
+                    this.nestedGzipDecompressedBytes += decompressed.length;
+                    
+                    debugLog(`[TAR Parser] Successfully decompressed ${filename}: ${size} → ${decompressed.length} bytes`);
+                    return decodedText;
+                } else {
+                    debugLog('[TAR Parser] pako library not available, cannot decompress .gz file:', filename);
+                    debugLog('[TAR Parser] Attempting to decode as-is (will likely fail)');
+                    // Fall through to regular decoding
+                }
+            } catch (e) {
+                debugLog('[TAR Parser] Failed to decompress gzipped file:', filename, e);
+                debugLog('[TAR Parser] Attempting to decode as-is (will likely fail)');
+                // Fall through to regular decoding attempt
+            }
+        }
+        
+        try {
+            return new TextDecoder('utf-8').decode(contentBytes);
+        } catch (e) {
+            debugLog('[TAR Parser] Failed to decode file content:', filename, e);
+            return null;
+        }
+    }
+    
+    mergeAzureVMProperties() {
+        const azureVMProps = this.analysisResults.azureVMProperties;
+        const suseCloudReg = this.analysisResults.suseCloudRegister;
+        
+        // If no Azure VM properties found, return null
+        if (!azureVMProps) {
+            // If we have SUSE cloud registration, create a minimal Azure VM properties object
+            if (suseCloudReg && suseCloudReg.found) {
+                return {
+                    billingModel: suseCloudReg.billingModel,
+                    detectionMethod: suseCloudReg.detectionMethod + ' (SUSE only)',
+                    registrationServer: suseCloudReg.registrationServer,
+                    registrationType: suseCloudReg.registrationType
+                };
+            }
+            return null;
+        }
+        
+        // If no SUSE cloud registration or it didn't find anything, return Azure VM properties as-is
+        if (!suseCloudReg || !suseCloudReg.found) {
+            return azureVMProps;
+        }
+        
+        // Both sources available - merge intelligently
+        const merged = { ...azureVMProps };
+        
+        // If azureVMProperties doesn't have billing model, use SUSE cloud registration
+        if (!merged.billingModel && suseCloudReg.billingModel) {
+            merged.billingModel = suseCloudReg.billingModel;
+            merged.detectionMethod = suseCloudReg.detectionMethod;
+            merged.registrationServer = suseCloudReg.registrationServer;
+            merged.registrationType = suseCloudReg.registrationType;
+            debugLog('[mergeAzureVMProperties] Using SUSE cloud registration for billing model');
+        }
+        // If both have billing models, prefer SUSE cloud registration for SUSE VMs
+        // (it's more reliable and specific to SUSE)
+        else if (merged.billingModel && suseCloudReg.billingModel) {
+            // Add SUSE registration as additional information
+            merged.suseRegistrationServer = suseCloudReg.registrationServer;
+            merged.suseRegistrationType = suseCloudReg.registrationType;
+            merged.suseDetectionMethod = suseCloudReg.detectionMethod;
+            
+            // If they disagree, log a warning and prefer SUSE cloud registration for SUSE systems
+            if (merged.billingModel !== suseCloudReg.billingModel) {
+                debugLog(`[mergeAzureVMProperties] Billing model mismatch: Azure metadata says ${merged.billingModel}, SUSE registration says ${suseCloudReg.billingModel}`);
+                // For SUSE systems, prefer the SUSE cloud registration (it's more accurate)
+                if (merged.publisher && merged.publisher.toLowerCase() === 'suse') {
+                    merged.billingModel = suseCloudReg.billingModel;
+                    merged.detectionMethod = suseCloudReg.detectionMethod + ' (preferred over Azure metadata)';
+                    debugLog('[mergeAzureVMProperties] Using SUSE cloud registration for SUSE VM');
+                } else {
+                    // For non-SUSE, add SUSE data as secondary source
+                    merged.alternativeBillingModel = suseCloudReg.billingModel;
+                    merged.alternativeDetectionMethod = suseCloudReg.detectionMethod;
+                }
+            } else {
+                debugLog('[mergeAzureVMProperties] Both sources agree on billing model:', merged.billingModel);
+            }
+        }
+        
+        return merged;
+    }
+
+    /**
+     * Merge results from blockDevices parser (multi-file parser)
+     * Accumulates disk, partition, and UUID data across multiple files
+     */
+    mergeBlockDevicesResult(existing, newResult) {
+        // Merge found flag
+        existing.found = existing.found || newResult.found;
+        
+        // Merge arrays (disks, partitions, warnings) avoiding duplicates
+        for (const key of ['disks', 'partitions', 'warnings']) {
+            if (Array.isArray(newResult[key])) {
+                if (!existing[key]) existing[key] = [];
+                for (const item of newResult[key]) {
+                    // Avoid duplicates by checking for unique identifier
+                    const isDupe = existing[key].some(e => 
+                        (e.name && e.name === item.name) || 
+                        (e.device && e.device === item.device)
+                    );
+                    if (!isDupe) {
+                        existing[key].push(item);
+                    }
+                }
+            }
+        }
+        
+        // Merge maps (uuidMap, deviceMap, mountPoints)
+        for (const key of ['uuidMap', 'deviceMap', 'mountPoints']) {
+            if (newResult[key] && typeof newResult[key] === 'object') {
+                if (!existing[key]) existing[key] = {};
+                Object.assign(existing[key], newResult[key]);
+            }
+        }
+        
+        // Merge raw output
+        if (newResult.rawOutput && typeof newResult.rawOutput === 'object') {
+            if (!existing.rawOutput) existing.rawOutput = {};
+            Object.assign(existing.rawOutput, newResult.rawOutput);
+        }
+    }
+
+    /**
+     * Compare mtab entries with fstab to find mounts not defined in fstab.
+     * These are typically hand-mounted filesystems or cluster-managed resources.
+     * Returns the mtab analysis enriched with extraMounts data.
+     */
+    compareMtabWithFstab() {
+        const mtab = this.analysisResults.mtabAnalysis;
+        if (!mtab?.found) {
+            debugLog('[Storage] No mtab data available for comparison');
+            return mtab || null;
+        }
+
+        const fstab = this.analysisResults.fstabAnalysis;
+
+        // Build a set of fstab mountpoints for fast lookup
+        const fstabMountpoints = new Set();
+        if (fstab?.found && fstab.entries) {
+            for (const entry of fstab.entries) {
+                fstabMountpoints.add(entry.mountpoint);
+            }
+        }
+
+        // Count real vs virtual mounts and build type breakdown
+        let realMounts = 0;
+        let virtualMounts = 0;
+        const typeBreakdown = {};
+        for (const entry of mtab.entries) {
+            if (entry.isVirtualFs) {
+                virtualMounts++;
+            } else {
+                realMounts++;
+            }
+            typeBreakdown[entry.fstype] = (typeBreakdown[entry.fstype] || 0) + 1;
+        }
+
+        // Find mounts in mtab that are NOT in fstab (excluding virtual filesystems)
+        const extraMounts = [];
+        for (const entry of mtab.entries) {
+            if (entry.isVirtualFs) continue;
+            if (!fstabMountpoints.has(entry.mountpoint)) {
+                extraMounts.push({
+                    source: entry.source,
+                    mountpoint: entry.mountpoint,
+                    fstype: entry.fstype,
+                    options: entry.options,
+                    sourceType: entry.sourceType,
+                    reason: 'Not found in /etc/fstab - possibly hand-mounted or cluster-managed'
+                });
+            }
+        }
+
+        // Collect autofs entries separately for visibility
+        const autofsMounts = mtab.entries.filter(e => e.fstype === 'autofs');
+
+        debugLog('[Storage] mtab vs fstab: found', extraMounts.length, 'extra mounts,', realMounts, 'real,', virtualMounts, 'virtual,', autofsMounts.length, 'autofs');
+
+        return {
+            found: mtab.found,
+            entries: mtab.entries,
+            realMounts: realMounts,
+            virtualMounts: virtualMounts,
+            typeBreakdown: typeBreakdown,
+            extraMounts: extraMounts,
+            autofsMounts: autofsMounts,
+            rawContent: mtab.rawContent
+        };
+    }
+
+    /**
+     * Correlate fstab entries with block device information
+     * Detects UUID mismatches, missing UUIDs, and filesystem type mismatches
+     */
+    correlateFstabWithBlockDevices() {
+        const fstab = this.analysisResults.fstabAnalysis;
+        const blockDevices = this.analysisResults.blockDevices;
+        
+        if (!fstab?.found || !blockDevices?.found) {
+            debugLog('[Storage] Cannot correlate: fstab or blockDevices not found');
+            return null;
+        }
+        
+        // Create a storage correlation result
+        const correlation = {
+            found: true,
+            mountedVolumes: [],
+            warnings: [],
+            errors: []
+        };
+        
+        for (const entry of (fstab.entries || [])) {
+            const mountInfo = {
+                mountpoint: entry.mountpoint,
+                source: entry.source,
+                fstabFstype: entry.fstype,
+                actualDevice: null,
+                actualUuid: null,
+                actualFstype: null,
+                status: 'unknown',
+                issues: []
+            };
+            
+            if (entry.sourceType === 'uuid' && entry.uuid) {
+                // Look up UUID in block devices
+                const device = blockDevices.uuidMap?.[entry.uuid] || 
+                              blockDevices.uuidMap?.[entry.uuid.toLowerCase()] ||
+                              blockDevices.uuidMap?.[entry.uuid.toUpperCase()];
+                
+                if (device) {
+                    const deviceInfo = blockDevices.deviceMap?.[device];
+                    mountInfo.actualDevice = device;
+                    mountInfo.actualUuid = deviceInfo?.uuid;
+                    mountInfo.actualFstype = deviceInfo?.fstype;
+                    mountInfo.status = 'found';
+                    
+                    // Check for filesystem type mismatch
+                    if (entry.fstype !== 'auto' && deviceInfo?.fstype && 
+                        entry.fstype.toLowerCase() !== deviceInfo.fstype.toLowerCase()) {
+                        mountInfo.status = 'warning';
+                        mountInfo.issues.push({
+                            type: 'fstype_mismatch',
+                            message: `Filesystem type mismatch: fstab expects '${entry.fstype}' but device has '${deviceInfo.fstype}'`,
+                            severity: 'warning'
+                        });
+                        correlation.warnings.push({
+                            mountpoint: entry.mountpoint,
+                            message: `Filesystem type mismatch for ${entry.mountpoint}: fstab='${entry.fstype}', actual='${deviceInfo.fstype}'`
+                        });
+                    }
+                } else {
+                    // UUID not found - this is a problem
+                    mountInfo.status = 'error';
+                    mountInfo.issues.push({
+                        type: 'uuid_not_found',
+                        message: `UUID '${entry.uuid}' referenced in fstab not found on any block device`,
+                        severity: 'error'
+                    });
+                    correlation.errors.push({
+                        mountpoint: entry.mountpoint,
+                        uuid: entry.uuid,
+                        message: `UUID ${entry.uuid} for ${entry.mountpoint} not found on any device. The disk may have been replaced or reformatted.`
+                    });
+                }
+            } else if (entry.sourceType === 'device' && entry.device) {
+                // Direct device reference
+                const deviceInfo = blockDevices.deviceMap?.[entry.device];
+                if (deviceInfo) {
+                    mountInfo.actualDevice = entry.device;
+                    mountInfo.actualUuid = deviceInfo.uuid;
+                    mountInfo.actualFstype = deviceInfo.fstype;
+                    mountInfo.status = 'found';
+                } else {
+                    // Might be a symlink path
+                    mountInfo.status = 'symlink';
+                }
+            }
+            
+            correlation.mountedVolumes.push(mountInfo);
+        }
+        
+        // Add summary
+        correlation.summary = {
+            totalEntries: fstab.entries?.length || 0,
+            foundDevices: correlation.mountedVolumes.filter(m => m.status === 'found').length,
+            warnings: correlation.warnings.length,
+            errors: correlation.errors.length
+        };
+        
+        debugLog('[Storage] Correlation complete:', correlation.summary);
+        return correlation;
+    }
+
+    getAnalysis() {
+        // Full analysis mode (always enabled)
+        // Get raw cluster nodes (may be IPs or hostnames)
+        const clusterNodesData = this.analysisResults.clusterNodes || { nodes: [], nodeToIpMap: {} };
+        let clusterNodes = clusterNodesData.nodes || [];
+        const nodeToIpMap = clusterNodesData.nodeToIpMap || {};
+        const hostsData = this.analysisResults.hostsFile || null;
+        const liveMigrationData = this.analysisResults.liveMigration || null;
+        const kernelRebootsData = this.analysisResults.kernelReboots || null;
+        const oomKillerData = this.analysisResults.oomKiller || null;
+        const xfsErrorsData = this.analysisResults.xfsErrors || null;
+        const corosyncData = this.analysisResults.corosyncConfig || null;
+        const distroPackagesData = this.analysisResults.distroPackages || null;
+        const pacemakerResourcesData = this.analysisResults.pacemakerResources || null;
+        const fencingConfigData = this.analysisResults.fencingConfig || null;
+        const clusterEventsData = this.analysisResults.clusterEvents || null;
+        
+        if (clusterEventsData && clusterEventsData.count > 0) {
+            debugLog('[Analysis] Cluster Events:', clusterEventsData.count, 'total -', (clusterEventsData.resourceMigrations || []).length, 'resource events,', (clusterEventsData.fencingEvents || []).length, 'fencing events');
+        }
+        
+        // Get OS information to filter distribution-specific checks
+        const osReleaseData = this.analysisResults.osRelease || this.analysisResults.sysinfo || this.analysisResults.basicEnvironment || null;
+        const isSUSE = osReleaseData && osReleaseData.name && 
+                      (osReleaseData.name.toLowerCase().includes('suse') || 
+                       (osReleaseData.prettyName && osReleaseData.prettyName.toLowerCase().includes('suse')));
+        const isRHEL = osReleaseData && osReleaseData.name &&
+                      (osReleaseData.name.toLowerCase().includes('red hat') ||
+                       osReleaseData.name.toLowerCase().includes('rhel') ||
+                       (osReleaseData.prettyName && (osReleaseData.prettyName.toLowerCase().includes('red hat') || osReleaseData.prettyName.toLowerCase().includes('rhel'))));
+        const distroFamily = isSUSE ? 'sles' : (isRHEL ? 'rhel' : 'unknown');
+        
+        // Add distro family to corosync data for distro-aware rendering
+        if (corosyncData) {
+            corosyncData.distroFamily = distroFamily;
+        }
+        
+        // Filter corosync warnings based on distro family
+        if (corosyncData && corosyncData.warnings) {
+            if (isRHEL) {
+                // RHEL guide recommends the same totem values as SUSE, except transport should be 'knet' instead of 'udpu'
+                // Reference: https://learn.microsoft.com/en-us/azure/sap/workloads/high-availability-guide-rhel-pacemaker
+                
+                // Remove the SUSE-specific transport warning (which expects 'udpu')
+                corosyncData.warnings = corosyncData.warnings.filter(warning => 
+                    warning.parameter !== 'totem.transport'
+                );
+                
+                // Add RHEL-specific transport check: should be 'knet' for RHEL 8+
+                if (corosyncData.totemTransport !== null && corosyncData.totemTransport !== 'knet') {
+                    corosyncData.warnings.push({
+                        parameter: 'totem.transport',
+                        expected: 'knet',
+                        actual: corosyncData.totemTransport,
+                        severity: 'warning',
+                        message: `Totem transport value is '${corosyncData.totemTransport}', but should be 'knet' for RHEL 8+ Azure environments`,
+                        documentationUrl: 'https://learn.microsoft.com/en-us/azure/sap/workloads/high-availability-guide-rhel-pacemaker'
+                    });
+                }
+                
+                // Update documentation URLs to RHEL guide for remaining warnings
+                corosyncData.warnings.forEach(warning => {
+                    warning.documentationUrl = 'https://learn.microsoft.com/en-us/azure/sap/workloads/high-availability-guide-rhel-pacemaker';
+                });
+                
+                debugLog('[TAR Parser] Applied RHEL-specific corosync validation (transport: knet)');
+            } else if (!isSUSE) {
+                // For unknown distros, only remove transport warning
+                corosyncData.warnings = corosyncData.warnings.filter(warning => 
+                    warning.parameter !== 'totem.transport'
+                );
+                debugLog('[TAR Parser] Filtered totem.transport warning for non-SUSE distribution');
+            }
+        }
+        
+        // Antivirus detection results
+        const falconSensorData = this.analysisResults.falconSensor || { found: false };
+        const falconConfigData = this.analysisResults.falconSensorConfig || { found: false };
+        const msDefenderData = this.analysisResults.msDefender || { found: false };
+        const msDefenderConfigData = this.analysisResults.msDefenderConfig || { found: false };
+        const illumioData = this.analysisResults.illumio || { found: false };
+        const trendMicroData = this.analysisResults.trendMicro || { found: false };
+        const azureSiteRecoveryData = this.analysisResults.azureSiteRecovery || { found: false };
+        const guardicoreAgentData = this.analysisResults.guardicoreAgent || { found: false };
+        const puppetAgentData = this.analysisResults.puppetAgent || { found: false };
+        const chefClientData = this.analysisResults.chefClient || { found: false };
+        
+        // Combine antivirus and Azure services results
+        const antivirusResults = {
+            falconSensor: {
+                detected: falconSensorData.found,
+                version: falconSensorData.version,
+                runningProcess: falconSensorData.runningProcess,
+                sapExceptions: falconConfigData.hasExclusions || false,
+                exclusionPaths: falconConfigData.exclusions || [],
+                message: falconSensorData.message
+            },
+            msDefender: {
+                detected: msDefenderData.found,
+                version: msDefenderData.version,
+                runningProcess: msDefenderData.runningProcess,
+                sapExceptions: msDefenderConfigData.hasExclusions || false,
+                exclusionPaths: msDefenderConfigData.exclusions || [],
+                message: msDefenderData.message
+            },
+            illumio: {
+                detected: illumioData.found,
+                message: illumioData.message
+            },
+            trendMicro: {
+                detected: trendMicroData.found,
+                message: trendMicroData.message
+            },
+            guardicoreAgent: {
+                detected: guardicoreAgentData.found,
+                enabled: guardicoreAgentData.enabled || false,
+                severity: guardicoreAgentData.severity,
+                message: guardicoreAgentData.message,
+                detectionFile: guardicoreAgentData.detectionFile,
+                detectionLine: guardicoreAgentData.detectionLine,
+                detectionContent: guardicoreAgentData.detectionContent
+            },
+            puppetAgent: {
+                detected: puppetAgentData.found,
+                enabled: puppetAgentData.enabled || false,
+                severity: puppetAgentData.severity,
+                message: puppetAgentData.message,
+                detectionFile: puppetAgentData.detectionFile,
+                detectionLine: puppetAgentData.detectionLine,
+                detectionContent: puppetAgentData.detectionContent
+            },
+            chefClient: {
+                detected: chefClientData.found,
+                enabled: chefClientData.enabled || false,
+                severity: chefClientData.severity,
+                message: chefClientData.message,
+                detectionFile: chefClientData.detectionFile,
+                detectionLine: chefClientData.detectionLine,
+                detectionContent: chefClientData.detectionContent
+            },
+            azureSiteRecovery: {
+                detected: azureSiteRecoveryData.found,
+                enabled: azureSiteRecoveryData.enabled || false,
+                severity: azureSiteRecoveryData.severity,
+                message: azureSiteRecoveryData.message,
+                detectionFile: azureSiteRecoveryData.detectionFile,
+                detectionLine: azureSiteRecoveryData.detectionLine,
+                detectionContent: azureSiteRecoveryData.detectionContent
+            },
+            // Overall status
+            anyDetected: falconSensorData.found || msDefenderData.found || illumioData.found || trendMicroData.found || azureSiteRecoveryData.found || guardicoreAgentData.found || puppetAgentData.found || chefClientData.found,
+            allHaveExceptions: (falconSensorData.found ? (falconConfigData.hasExclusions || false) : true) && 
+                              (msDefenderData.found ? (msDefenderConfigData.hasExclusions || false) : true)
+        };
+        
+        // Cluster services results (separate from antivirus and Azure services)
+        const dlmServiceData = this.analysisResults.dlmService || { found: false };
+        const clusterServicesResults = {
+            dlmService: {
+                detected: dlmServiceData.found,
+                enabled: dlmServiceData.enabled || false,
+                severity: dlmServiceData.severity,
+                message: dlmServiceData.message,
+                documentationUrl: dlmServiceData.documentationUrl,
+                detectionFile: dlmServiceData.detectionFile,
+                detectionLine: dlmServiceData.detectionLine,
+                detectionContent: dlmServiceData.detectionContent
+            }
+        };
+        
+        debugLog('[TAR Parser] getAnalysis() called');
+        debugLog('[TAR Parser] analysisResults:', this.analysisResults);
+        
+        // Resolve cluster nodes using multiple strategies:
+        // 1. If we have nodeToIpMap (from corosync.conf), use it to resolve IPs back to hostnames
+        // 2. Then use hosts file to resolve any remaining IPs to hostnames
+        // 3. Remove duplicates (IPs that have corresponding hostnames in the same list)
+        if (clusterNodes.length > 0) {
+            const resolvedNodes = [];
+            const ipToHostnameMap = {}; // Reverse mapping: IP -> hostname
+            
+            // Build reverse map from nodeToIpMap
+            for (const [hostname, ip] of Object.entries(nodeToIpMap)) {
+                ipToHostnameMap[ip] = hostname;
+            }
+            
+            clusterNodes.forEach(node => {
+                // Check if it's an IP address
+                if (node.match(/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/)) {
+                    // First, check if we have a hostname mapping from corosync.conf
+                    if (ipToHostnameMap[node]) {
+                        const hostname = ipToHostnameMap[node];
+                        resolvedNodes.push(hostname);
+                    }
+                    // If not, try to resolve using hosts file
+                    else if (hostsData) {
+                        const hostEntry = hostsData.entries.find(entry => entry.ip === node);
+                        if (hostEntry && hostEntry.hostnames.length > 0) {
+                            // Use the first hostname
+                            const hostname = hostEntry.hostnames[0];
+                            resolvedNodes.push(hostname);
+                        } else {
+                            // Keep the IP if we can't resolve it
+                            resolvedNodes.push(node);
+                        }
+                    } else {
+                        resolvedNodes.push(node);
+                    }
+                } else {
+                    // It's a hostname - check if we have an IP mapping for validation
+                    resolvedNodes.push(node);
+                }
+            });
+            
+            // Deduplicate resolved nodes (in case same hostname was added multiple times)
+            clusterNodes = Array.from(new Set(resolvedNodes)).sort();
+        }
+        
+        let nodesInHosts = [];
+        let nodesMissingFromHosts = [];
+        
+        if (hostsData && clusterNodes.length > 0) {
+            const hostsSet = new Set(hostsData.allHostnames);
+            const hostsIpSet = new Set(hostsData.entries.map(e => e.ip));
+            
+            clusterNodes.forEach(node => {
+                let foundInHosts = false;
+                
+                // Check if the node (hostname) is directly in hosts file
+                if (hostsSet.has(node)) {
+                    foundInHosts = true;
+                    debugLog(`[TAR Parser] Node ${node} found directly in hosts file`);
+                }
+                // Check if we have an IP mapping for this hostname and that IP is in hosts file
+                else if (nodeToIpMap[node] && hostsIpSet.has(nodeToIpMap[node])) {
+                    foundInHosts = true;
+                    debugLog(`[TAR Parser] Node ${node} found in hosts file via IP ${nodeToIpMap[node]}`);
+                }
+                
+                if (foundInHosts) {
+                    nodesInHosts.push(node);
+                } else {
+                    nodesMissingFromHosts.push(node);
+                }
+            });
+            
+            debugLog('[TAR Parser] Nodes found in hosts file:', nodesInHosts);
+            debugLog('[TAR Parser] Nodes missing from hosts file:', nodesMissingFromHosts);
+        }
+        
+        const analysisData = {
+            fileCount: this.totalFileCount || this.files.length,
+            directories: Array.from(this.directories).sort(),
+            fileTypes: this.fileTypes,
+            files: this.files.slice(0, 50), // Return first 50 files
+            totalParsed: this.totalParsed,
+            // Nested compression statistics
+            nestedGzipTotalCount: this.nestedGzipTotalCount,
+            nestedGzipTotalCompressedBytes: this.nestedGzipTotalCompressedBytes,
+            nestedGzipCount: this.nestedGzipCount,
+            nestedGzipCompressedBytes: this.nestedGzipCompressedBytes,
+            nestedGzipDecompressedBytes: this.nestedGzipDecompressedBytes,
+            // SCC report information
+            isSCCReport: this.isSCCReport,
+            sccReportName: this.sccReportName,
+            // Rule-based analysis results
+            azureVMProperties: this.mergeAzureVMProperties(),
+            osRelease: this.analysisResults.osRelease || this.analysisResults.sysinfo || this.analysisResults.basicEnvironment || null,
+            clusterNodes: clusterNodes,
+            nodeToIpMap: nodeToIpMap,
+            hostsFile: hostsData,
+            liveMigration: liveMigrationData,
+            kernelReboots: kernelRebootsData,
+            oomKiller: oomKillerData,
+            xfsErrors: xfsErrorsData,
+            corosyncConfig: corosyncData,
+            corosyncStatus: this.analysisResults.corosyncStatus || null,
+            clusterStatus: this.analysisResults.clusterStatus || null,
+            clusterDaemonStatus: this.analysisResults.clusterDaemonStatus || null,
+            azureScheduledEvents: this.analysisResults.azureScheduledEvents || null,
+            distroPackages: distroPackagesData,
+            pacemakerResources: pacemakerResourcesData,
+            fencingConfig: fencingConfigData,
+            clusterEvents: clusterEventsData,
+            antivirus: antivirusResults,
+            clusterServices: clusterServicesResults,
+            kernelTuning: this.analysisResults.kernelTuning || null,
+            hugePages: this.analysisResults.hugePages || null,
+            timeSync: this.analysisResults.timeSync || null,
+            ptpClockSource: this.analysisResults.ptpClockSource || null,
+            timeSyncService: this.analysisResults.timeSyncService || null,
+            timedatectl: this.analysisResults.timedatectl || null,
+            ptpDevice: this.analysisResults.ptpDevice || null,
+            chronyTracking: this.analysisResults.chronyTracking || null,
+            chronyMakestep: this.analysisResults.chronyMakestep || null,
+            lvmConfig: this.analysisResults.lvmConfig || null,
+            raidConfig: this.analysisResults.raidConfig || null,
+            btrfsConfig: this.analysisResults.btrfsConfig || null,
+            fstab: this.analysisResults.fstab || null,
+            blockDevices: this.analysisResults.blockDevices || null,
+            fstabAnalysis: this.analysisResults.fstabAnalysis || null,
+            inspectDiskResults: this.analysisResults.inspectDiskResults || null,
+            dfOutput: this.analysisResults.dfOutput || null,
+            mtabAnalysis: this.compareMtabWithFstab(),
+            storageCorrelation: this.correlateFstabWithBlockDevices(),
+            nvmeList: this.analysisResults.nvmeList || null,
+            nfsMounts: this.analysisResults.nfsMounts || null,
+            hanaSavepoints: this.analysisResults.hanaSavepoints || null,
+            hanaDeadlocks: this.analysisResults.hanaDeadlocks || null,
+            hanaOom: this.analysisResults.hanaOom || null,
+            hanaMergeErrors: this.analysisResults.hanaMergeErrors || null,
+            involfltVersion: this.analysisResults.involfltVersion || null,
+            involfltKernelVersion: this.analysisResults.involfltKernelVersion || null,
+            azureExtensions: this.analysisResults.azureExtensions || null,
+            emergencyMode: this.analysisResults.emergencyMode || null,
+            sshService: this.analysisResults.sshService || null,
+            automation: this.analysisResults.automation || null,
+            rhuiConfig: this.analysisResults.rhuiConfig || null,
+            eusVersionLock: this.analysisResults.eusVersionLock || null,
+            rhelRhuiCheck: this.analysisResults.rhelRhuiCheck || null,
+            cryptoPolicies: this.analysisResults.cryptoPolicies || null,
+            fipsModeSetup: this.analysisResults.fipsModeSetup || null,
+            tunedProfile: this.analysisResults.tunedProfile || null,
+            selinux: this.analysisResults.selinux || null,
+            swapSpace: this.analysisResults.swapSpace || null,
+            fstrim: this.analysisResults.fstrim || null,
+            kernelCmdline: this.analysisResults.kernelCmdline || null,
+            rhuiErrors: this.analysisResults.rhuiErrors || null,
+            leappReport: this.analysisResults.leappReport || null,
+            leappLog: this.analysisResults.leappLog || null,
+            sapInstanceConfig: this.analysisResults.sapInstanceConfig || null,
+            sapInstanceErrors: this.analysisResults.sapInstanceErrors || null,
+            clusterMaintenanceMode: this.analysisResults.clusterMaintenanceMode || null,
+            sbdConfig: this.analysisResults.sbdConfig || null,
+            azureFenceAuth: this.analysisResults.azureFenceAuth || null,
+            iscsiConfig: this.analysisResults.iscsiConfig || null,
+            firewallRules: this.analysisResults.firewallRules || null,
+            networkInterfaces: this.analysisResults.networkInterfaces || null,
+            packetLoss: this.analysisResults.packetLoss || null,
+            ringBuffer: this.analysisResults.ringBuffer || null,
+            networkSysctl: this.analysisResults.networkSysctl || null,
+            vmcore: this.analysisResults.vmcore || null,
+            waagentConfig: this.analysisResults.waagentConfig || null,
+            waagentLog: this.analysisResults.waagentLog || null,
+            secureBoot: this.analysisResults.secureBoot || null,
+            hvBalloon: this.analysisResults.hvBalloon || null,
+            extfrag: this.analysisResults.extfrag || null,
+            usedPaxFormat: this.usedPaxFormat || false,  // Flag if PAX format was detected
+            // Cross-validation results
+            nodesInHosts: nodesInHosts,
+            nodesMissingFromHosts: nodesMissingFromHosts
+        };
+        
+        // Enrich huge pages data with sysctl parameters from kernelTuning if available
+        // This avoids duplicate parsing of sysctl output
+        if (analysisData.hugePages && analysisData.kernelTuning && analysisData.kernelTuning.parameters) {
+            const params = analysisData.kernelTuning.parameters;
+            const hp = analysisData.hugePages;
+            // Extract huge pages sysctl parameters from already-parsed kernel tuning data
+            if (params['vm.nr_hugepages'] !== undefined && hp.sysctlParams.nr_hugepages === undefined) {
+                hp.sysctlParams.nr_hugepages = parseInt(params['vm.nr_hugepages'], 10);
+                hp.found = true;
+            }
+            if (params['vm.nr_overcommit_hugepages'] !== undefined && hp.sysctlParams.nr_overcommit_hugepages === undefined) {
+                hp.sysctlParams.nr_overcommit_hugepages = parseInt(params['vm.nr_overcommit_hugepages'], 10);
+                hp.found = true;
+            }
+            if (params['vm.hugetlb_shm_group'] !== undefined && hp.sysctlParams.hugetlb_shm_group === undefined) {
+                hp.sysctlParams.hugetlb_shm_group = parseInt(params['vm.hugetlb_shm_group'], 10);
+                hp.found = true;
+            }
+        }
+        // Add SAP HANA huge pages recommendation if huge pages are not configured
+        if (analysisData.hugePages && analysisData.hugePages.found) {
+            const hp = analysisData.hugePages;
+            // Check if static huge pages are configured (from sysctl or meminfo)
+            const nrHugepages = hp.sysctlParams.nr_hugepages !== undefined ? hp.sysctlParams.nr_hugepages : 
+                               (hp.staticHugePages.total !== undefined ? hp.staticHugePages.total : 0);
+            // For SAP HANA workloads, check if huge pages are configured
+            if (nrHugepages === 0 && !hp.recommendations.some(r => r.type === 'sap_hugepages')) {
+                hp.recommendations.push({
+                    type: 'sap_hugepages',
+                    message: 'No static huge pages configured. For SAP HANA workloads, huge pages should be configured to improve performance and prevent memory fragmentation.',
+                    documentationUrl: 'https://learn.microsoft.com/en-us/azure/sap/workloads/dbms-guide-general#linux-kernel-settings'
+                });
+                hp.hasRecommendations = true;
+            }
+        }
+        
+        // Post-processing: Regenerate azureScheduledEvents warnings after merging data from multiple files
+        if (analysisData.azureScheduledEvents && analysisData.azureScheduledEvents.found) {
+            const ase = analysisData.azureScheduledEvents;
+            // Clear existing warnings and regenerate based on merged data
+            ase.warnings = [];
+            
+            // Case 1: Resources are stopped while nodes are online AND health-azure is not configured
+            if (ase.stoppedResources.length > 0 && ase.onlineNodes.length > 0) {
+                if (!ase.healthAzureConfigured && !ase.healthAzureResource) {
+                    ase.warnings.push({
+                        severity: 'error',
+                        type: 'health_azure_not_configured',
+                        message: `${ase.stoppedResources.length} cluster resource(s) are stopped while ${ase.onlineNodes.length} node(s) are online. Azure Scheduled Events (health-azure) is NOT configured.`,
+                        recommendation: 'Configure Azure Scheduled Events by creating the health-azure-events resource and setting #health-azure attribute on all nodes. See: https://learn.microsoft.com/en-us/azure/sap/workloads/high-availability-guide-rhel-pacemaker#configure-pacemaker-for-azure-scheduled-events',
+                        stoppedResources: ase.stoppedResources,
+                        onlineNodes: ase.onlineNodes
+                    });
+                }
+                
+                // Case 2: node-health-strategy is set to custom but health-azure attribute is missing
+                if (ase.nodeHealthStrategy === 'custom' && !ase.healthAzureConfigured) {
+                    ase.warnings.push({
+                        severity: 'error',
+                        type: 'health_azure_attribute_missing',
+                        message: 'node-health-strategy is set to "custom" but #health-azure attribute is not configured on nodes. Resources cannot be scheduled.',
+                        recommendation: 'Initialize the #health-azure attribute on all nodes: sudo crm_attribute --node <node-name> --name \'#health-azure\' --update 0',
+                        onlineNodes: ase.onlineNodes
+                    });
+                }
+            }
+            
+            // Case 3: Some nodes have health-azure configured but not all
+            if (ase.nodesWithHealthAzure && ase.nodesWithHealthAzure.length > 0 && ase.onlineNodes.length > ase.nodesWithHealthAzure.length) {
+                const nodesWithAttr = ase.nodesWithHealthAzure.map(n => n.node);
+                const nodesMissing = ase.onlineNodes.filter(n => !nodesWithAttr.includes(n));
+                if (nodesMissing.length > 0) {
+                    ase.nodesWithoutHealthAzure = nodesMissing;
+                    ase.warnings.push({
+                        severity: 'warning',
+                        type: 'health_azure_partial',
+                        message: `#health-azure attribute is configured on some nodes but missing on: ${nodesMissing.join(', ')}`,
+                        recommendation: 'Set the #health-azure attribute on all cluster nodes for consistent behavior.',
+                        nodesMissing: nodesMissing
+                    });
+                }
+            }
+            
+            debugLog('[TAR Parser] azureScheduledEvents post-processing: warnings regenerated:', ase.warnings.length);
+        }
+        
+        return analysisData;
+    }
+
+    finish() {
+        // Parse any remaining complete entries
+        this.parseAvailableEntries();
+
+        // End-of-stream end-marker detection.
+        //
+        // The strict isEndMarker() requires 1024 contiguous zero bytes in the
+        // buffer. Once the underlying decompressor stops feeding chunks we may
+        // legitimately have <1024 bytes left (the trailing zero block(s) of the
+        // archive plus any padding). At that point we know no more data is
+        // coming, so any remaining zero-only tail of >= 512 bytes can safely be
+        // treated as the TAR end marker.
+        if (!this.foundEndMarker) {
+            // Drain any still-pending chunks into the buffer for inspection.
+            if (this.pendingLength > 0) {
+                this.flushPendingChunks();
+            }
+            const tailLen = this.buffer.length - this.offset;
+            if (tailLen >= 512) {
+                let allZero = true;
+                for (let i = this.offset; i < this.buffer.length; i++) {
+                    if (this.buffer[i] !== 0) { allZero = false; break; }
+                }
+                if (allZero) {
+                    this.foundEndMarker = true;
+                    debugLog(`[TAR Parser] Treating ${tailLen}-byte zero tail as end marker`);
+                }
+            } else if (tailLen === 0 && this.pendingSkip === 0 && this.totalParsed > 0) {
+                // Stream ended cleanly on an entry boundary with nothing left
+                // over: the archive's last entry padding effectively *is* the
+                // end marker for our purposes.
+                this.foundEndMarker = true;
+                debugLog('[TAR Parser] Stream ended on clean entry boundary; treating as end marker');
+            }
+        }
+
+        const analysis = this.getAnalysis();
+
+        // Output performance report once at the end
+        if (this.perfTracker && DEBUG_CONFIG.performance) {
+            const report = this.perfTracker.getReport();
+            // Get memory info if available (Chrome/Edge only)
+            let memoryMB = null;
+            if (typeof performance !== 'undefined' && performance.memory) {
+                memoryMB = performance.memory.usedJSHeapSize / (1024 * 1024);
+            }
+            const text = formatPerformanceReport(report, memoryMB);
+            console.log(text);
+        }
+
+        return analysis;
+    }
+}
+
+// Handle messages from main thread
+self.onmessage = async function(e) {
+    // Handle debug mode setting
+    if (e.data.command === 'set_debug') {
+        const mode = e.data.enabled;
+        // First disable all debug flags
+        Object.keys(DEBUG_CONFIG).forEach(key => DEBUG_CONFIG[key] = false);
+        
+        if (mode === true || mode === 'on' || mode === 'all') {
+            // Enable all debug flags
+            Object.keys(DEBUG_CONFIG).forEach(key => DEBUG_CONFIG[key] = true);
+            console.log('[Worker] All debug modes enabled');
+        } else if (mode && mode !== 'off' && mode !== false) {
+            // Accept comma-separated parser names: ?debug=cluster,worker
+            const names = String(mode).split(',').map(s => s.trim().toLowerCase());
+            names.forEach(name => {
+                if (name in DEBUG_CONFIG) {
+                    DEBUG_CONFIG[name] = true;
+                }
+            });
+            // Always enable worker debug when any parser debug is on
+            if (names.some(n => n !== 'worker' && DEBUG_CONFIG[n])) {
+                DEBUG_CONFIG.worker = true;
+            }
+            console.log('[Worker] Debug enabled for:', names.filter(n => DEBUG_CONFIG[n]).join(', '));
+        }
+        return;
+    }
+    
+    // Handle plain text console log analysis (no TAR, no compression)
+    if (e.data.cmd === 'analyze_plaintext') {
+        debugLog('[Worker] Received analyze_plaintext command');
+        try {
+            const { textData, filename } = e.data;
+            debugLog(`[Worker] Starting plain text analysis: ${filename}, ${textData.byteLength} bytes`);
+            
+            // Convert to text
+            debugLog('[Worker] Converting to text...');
+            const decoder = new TextDecoder('utf-8');
+            const textContent = decoder.decode(new Uint8Array(textData));
+            debugLog('[Worker] Text decoded, length:', textContent.length);
+            
+            // Create a synthetic analysis structure matching TAR analysis format
+            debugLog('[Worker] Creating analysis structure...');
+            const analysis = {
+                reportType: 'console-log',
+                reportName: filename,
+                fileCount: 1,
+                totalSize: textData.byteLength,
+                // Add empty arrays for formatter compatibility
+                directories: [],
+                files: [filename],
+                fileTypes: { 'log': 1 },
+                // Initialize event arrays to avoid undefined errors in formatter
+                oomKiller: { found: false, events: [] },
+                kernelReboots: { found: false, events: [] },
+                liveMigration: { found: false, events: [] },
+                xfsErrors: { found: false, events: [] },
+                emergencyMode: { found: false, events: [] },
+                sshService: { found: false, events: [] },
+                automation: { found: false, events: [] }
+            };
+            debugLog('[Worker] Analysis structure created');
+            
+            // Run event detection parsers that work on kernel logs
+            debugLog('[Worker] Preparing event parsers...');
+            const eventParsers = {
+                oomKiller: SCC_RULES.oomKiller,
+                kernelReboots: SCC_RULES.kernelReboots,
+                liveMigration: SCC_RULES.liveMigration,
+                xfsErrors: SCC_RULES.xfsErrors,
+                emergencyMode: SCC_RULES.emergencyMode,
+                sshService: SCC_RULES.sshService,
+                automation: SCC_RULES.automation
+            };
+            debugLog('[Worker] Event parsers ready, starting analysis...');
+            
+            let eventsFound = 0;
+            
+            for (const [parserName, parser] of Object.entries(eventParsers)) {
+                debugLog(`[Worker] Checking parser: ${parserName}`);
+                if (parser && parser.parse) {
+                    debugLog(`[Worker] Running parser: ${parserName}`);
+                    const result = parser.parse(textContent, filename);
+                    debugLog(`[Worker] Parser ${parserName} completed`);
+                    
+                    if (result) {
+                        // Ensure event provenance is set for plain-text logs.
+                        if (result.events && Array.isArray(result.events)) {
+                            result.events.forEach(event => {
+                                if (!event.sourcePath && !event.sourceFile) {
+                                    event.sourcePath = filename;
+                                }
+                            });
+                        }
+                        
+                        // Always store the result, even if found=false
+                        analysis[parserName] = result;
+                        
+                        if (result.found && result.events) {
+                            eventsFound += result.events.length;
+                            debugLog(`[Worker] ${parserName}: found ${result.events.length} events`);
+                        }
+                    }
+                }
+            }
+            
+            debugLog(`[Worker] Plain text analysis complete: ${eventsFound} total events`);
+            
+            // Validate analysis object before sending
+            debugLog(`[Worker] Analysis object keys:`, Object.keys(analysis));
+            
+            try {
+                // Test if the analysis object can be serialized
+                JSON.stringify(analysis);
+                debugLog(`[Worker] Analysis object successfully serialized`);
+            } catch (serErr) {
+                console.error('[Worker] Analysis serialization error:', serErr);
+                self.postMessage({ error: 'Failed to serialize analysis: ' + serErr.message });
+                return;
+            }
+            
+            self.postMessage({
+                success: true,
+                analysis: analysis,
+                progress: 100
+            });
+            
+        } catch (err) {
+            console.error('[Worker] Plain text analysis error:', err);
+            console.error('[Worker] Error stack:', err.stack);
+            self.postMessage({ error: 'Plain text analysis failed: ' + err.message + '\nStack: ' + err.stack });
+        }
+        return;
+    }
+    
+    // Handle ZIP archive analysis
+    if (e.data.cmd === 'analyze_zip') {
+        try {
+            const { zipData } = e.data;
+            debugLog(`[Worker] Starting ZIP analysis: ${zipData.byteLength} bytes`);
+
+            if (typeof fflate === 'undefined' || !fflate.unzipSync) {
+                self.postMessage({ error: 'fflate library not loaded - ZIP support unavailable' });
+                return;
+            }
+
+            // Extract all files from the ZIP archive
+            const zipBytes = new Uint8Array(zipData);
+            let extracted;
+            try {
+                extracted = fflate.unzipSync(zipBytes);
+            } catch (unzipErr) {
+                self.postMessage({ error: 'Failed to extract ZIP archive: ' + unzipErr.message });
+                return;
+            }
+
+            const filenames = Object.keys(extracted);
+            debugLog(`[Worker] ZIP extracted ${filenames.length} entries`);
+
+            // Use IncrementalTARParser for its analysis infrastructure
+            // (parser matching, result accumulation, getAnalysis)
+            const parser = new IncrementalTARParser();
+            // Mark the end marker as found since ZIP doesn't have one
+            parser.foundEndMarker = true;
+
+            // Pre-scan filenames to detect report type before processing.
+            // This is necessary because ZIP entries are unordered - detection
+            // entries (e.g. device_0/...) may appear after parseable top-level
+            // files (e.g. results.txt) that would otherwise be skipped.
+            for (const fname of filenames) {
+                if (SCC_RULES.detection.isSCCReport(fname)) {
+                    parser.isSCCReport = true;
+                    parser.sccReportName = fname.split('/')[0];
+                    debugLog('[Worker] ZIP pre-scan detected report type:', parser.sccReportName);
+                    break;
+                }
+            }
+
+            let processedCount = 0;
+            for (const fname of filenames) {
+                const data = extracted[fname];
+                parser.processExtractedFile(fname, data);
+                processedCount++;
+
+                // Send progress updates every 50 files
+                if (processedCount % 50 === 0) {
+                    self.postMessage({
+                        progress: Math.floor((processedCount / filenames.length) * 100),
+                        currentFile: fname,
+                        analysis: { fileCount: processedCount }
+                    });
+                }
+            }
+
+            // Build final analysis using the same getAnalysis() logic
+            const analysis = parser.getAnalysis();
+            debugLog(`[Worker] ZIP analysis complete: ${analysis.fileCount} files`);
+
+            try {
+                self.postMessage({
+                    success: true,
+                    analysis: analysis,
+                    progress: 100
+                });
+            } catch (postErr) {
+                console.error('[Worker] postMessage failed for ZIP analysis:', postErr.message);
+                // Trim large arrays and retry
+                if (analysis.clusterEvents) {
+                    const ce = analysis.clusterEvents;
+                    if (ce.resourceMigrations && ce.resourceMigrations.length > 1000) {
+                        ce.resourceMigrations = ce.resourceMigrations.slice(0, 1000);
+                        ce.resourceMigrationsTrimmed = true;
+                    }
+                    if (ce.fencingEvents && ce.fencingEvents.length > 1000) {
+                        ce.fencingEvents = ce.fencingEvents.slice(0, 1000);
+                        ce.fencingEventsTrimmed = true;
+                    }
+                }
+                self.postMessage({
+                    success: true,
+                    analysis: analysis,
+                    progress: 100
+                });
+            }
+
+            return;
+        } catch (err) {
+            console.error('[Worker] ZIP analysis error:', err);
+            self.postMessage({ error: 'ZIP analysis failed: ' + err.message });
+            return;
+        }
+    }
+
+    // Handle TAR-only analysis (for already decompressed data like from gzip)
+    if (e.data.cmd === 'analyze_tar') {
+        try {
+            const { tarData } = e.data;
+            debugLog(`[Worker] Starting TAR analysis: ${tarData.byteLength} bytes`);
+            
+            // Initialize TAR parser
+            const tarParser = new IncrementalTARParser();
+            
+            // Process the TAR data
+            const tarBytes = new Uint8Array(tarData);
+            tarParser.addChunk(tarBytes);
+            
+            // Get analysis results
+            const analysis = tarParser.getAnalysis();
+            
+            debugLog(`[Worker] TAR analysis complete: ${analysis.fileCount} files`);
+            
+            try {
+                self.postMessage({
+                    success: true,
+                    analysis: analysis,
+                    progress: 100
+                });
+                debugLog('[Worker] Success message sent to main thread');
+            } catch (err) {
+                console.error('[Worker] Error sending message:', err);
+                self.postMessage({ error: 'Failed to send results: ' + err.message });
+            }
+            
+            return;
+        } catch (err) {
+            console.error('[Worker] TAR analysis error:', err);
+            self.postMessage({ error: 'TAR analysis failed: ' + err.message });
+            return;
+        }
+    }
+    
+    // Handle streaming XZ decompression (existing code)
+    if (e.data.cmd === 'decompress_streaming') {
+        if (!moduleReady || !LzmaModule) {
+            self.postMessage({ error: 'WASM module not properly initialized' });
+            return;
+        }
+
+        // Declare outside try so catch block can access for partial results
+        let tarParser = null;
+        let inputOffset = 0;
+        let totalDecompressed = 0;
+        let chunkCount = 0;
+        let inputSize = 0;
+
+        try {
+            const { compressedData, chunkSize } = e.data;
+            inputSize = compressedData.byteLength;
+            const effectiveChunkSize = chunkSize || (256 * 1024); // 256KB default
+
+            debugLog(`[XZ Streaming Worker] Starting streaming decompression: ${inputSize} bytes input`);
+
+            const handle = LzmaModule.xzStreamInit();
+            if (!handle) {
+                throw new Error('Failed to initialize Rust XZ stream');
+            }
+
+            debugLog('[XZ Streaming Worker] Stream initialized');
+
+            // Initialize TAR parser
+            tarParser = new IncrementalTARParser();
+
+            // Process input in chunks
+            let streamComplete = false;
+            let lastStatus = 0;
+            // Throttle progress messages so the main thread is not flooded.
+            // For multi-GB archives the per-chunk loop produces tens of
+            // thousands of postMessage calls; the UI re-render cost on the
+            // main thread becomes the bottleneck and the tab eventually
+            // shows "page isn't responding". Cap to ~20 updates/sec.
+            let lastProgressPostMs = 0;
+            const PROGRESS_MIN_INTERVAL_MS = 50;
+
+            while (inputOffset < inputSize) {
+                // Get next chunk of input
+                const remainingInput = inputSize - inputOffset;
+                const currentChunkSize = Math.min(effectiveChunkSize, remainingInput);
+                const isLastChunk = (inputOffset + currentChunkSize >= inputSize);
+
+                const chunk = new Uint8Array(compressedData, inputOffset, currentChunkSize);
+                const result = LzmaModule.xzStreamProcess(handle, chunk);
+                const status = result.status;
+                const outputData = result.output;
+                const outLen = outputData ? outputData.length : 0;
+                lastStatus = status;
+
+                debugLog(`[XZ Streaming Worker] Chunk ${chunkCount}: input=${currentChunkSize}, output=${outLen}, status=${status}, isLast=${isLastChunk}`);
+
+                if (outLen > 0) {
+                    // Feed to TAR parser
+                    tarParser.addChunk(outputData);
+                    totalDecompressed += outLen;
+
+                    // Send lightweight progress update (avoid cloning full analysis).
+                    // Throttled: at most one message every PROGRESS_MIN_INTERVAL_MS
+                    // to keep the main thread responsive for very large archives.
+                    const nowMs = Date.now();
+                    if (nowMs - lastProgressPostMs >= PROGRESS_MIN_INTERVAL_MS) {
+                        lastProgressPostMs = nowMs;
+                        const progress = Math.floor((inputOffset / inputSize) * 100);
+                        self.postMessage({
+                            progress,
+                            decompressed: totalDecompressed,
+                            currentFile: tarParser.currentFile,
+                            analysis: { fileCount: tarParser.totalFileCount || tarParser.files.length }
+                        });
+                    }
+                    
+                }
+
+                // Check status
+                if (status < 0) {
+                    const errMsg = LzmaModule.xzStreamError(handle);
+                    LzmaModule.xzStreamFree(handle);
+                    throw new Error(`Decompression error: ${errMsg} (status=${status})`);
+                }
+
+                if (status === 1) {
+                    // Stream finished
+                    streamComplete = true;
+                    debugLog('[XZ Streaming Worker] Stream finished');
+                    break;
+                }
+
+                // Move to next chunk
+                inputOffset += currentChunkSize;
+                chunkCount++;
+
+                // Yield to prevent blocking and allow GC
+                if (chunkCount % 10 === 0) {
+                    await new Promise(resolve => setTimeout(resolve, 0));
+                }
+                
+                // More aggressive GC hint every 50 chunks (helps browser reclaim memory)
+                if (chunkCount % 50 === 0) {
+                    await new Promise(resolve => setTimeout(resolve, 10));
+                }
+            }
+
+            // Final finish flush: the Rust stream validates the footer once it
+            // receives an empty input chunk signaling end-of-stream.
+            if (!streamComplete && lastStatus >= 0) {
+                const emptyChunk = new Uint8Array(0);
+                for (let i = 0; i < 16; i++) {
+                    const flushResult = LzmaModule.xzStreamProcess(handle, emptyChunk);
+                    const flushStatus = flushResult.status;
+                    const flushData = flushResult.output;
+                    const flushOutLen = flushData ? flushData.length : 0;
+                    if (flushOutLen > 0) {
+                        tarParser.addChunk(flushData);
+                        totalDecompressed += flushOutLen;
+                    }
+                    lastStatus = flushStatus;
+                    if (flushStatus === 1) {
+                        streamComplete = true;
+                        debugLog('[XZ Streaming Worker] Stream finished during flush');
+                        break;
+                    }
+                    if (flushStatus < 0) {
+                        debugLog(`[XZ Streaming Worker] Flush returned error status=${flushStatus}`);
+                        break;
+                    }
+                    // status==0 means the decoder still wants more input but
+                    // none is available — bail after the bounded retries to
+                    // avoid livelock on a genuinely truncated stream.
+                }
+            }
+
+            LzmaModule.xzStreamFree(handle);
+
+            // Final analysis
+            const finalAnalysis = tarParser.finish();
+
+            // Check if TAR archive is complete (has end marker)
+            //
+            // We only flag "truncated" when XZ itself signaled corruption
+            // (throws a Decompression error above) OR when the consumer fed
+            // less than the full input. Reaching this code means every byte
+            // of the .txz was decompressed without error, so the *file* is
+            // intact. A missing TAR end marker at this point is a parse
+            // glitch (e.g. a non-standard PAX size attribute or a corrupt
+            // entry header in the inner tar) — not a download truncation —
+            // so we surface a successful analysis instead of misleading the
+            // user with a "truncated" warning.
+            const inputFullyConsumed = (inputOffset >= inputSize);
+            // The XZ stream itself is incomplete when liblzma never returned
+            // status==1 (LZMA_STREAM_END) before we ran out of input.  Treat
+            // that as a corrupt/truncated archive and surface progress so the
+            // UI can render a useful partial-analysis warning.
+            if (!streamComplete) {
+                debugLog('[XZ Streaming Worker] WARNING: XZ stream did not reach end marker - file may be truncated');
+                self.postMessage({
+                    success: true,
+                    partialSuccess: true,
+                    totalDecompressed,
+                    analysis: {
+                        ...finalAnalysis,
+                        corruptionDetected: true,
+                        corruptionMessage: `XZ stream is incomplete (no end marker) — processed ${chunkCount} block(s), ${totalDecompressed} byte(s) decompressed before input was exhausted.`,
+                        xzBlocksProcessed: chunkCount,
+                        bytesProcessed: inputOffset,
+                        totalInputBytes: inputSize,
+                        percentProcessed: Math.floor((inputOffset / Math.max(inputSize, 1)) * 100)
+                    }
+                });
+                return;
+            }
+            if (!tarParser.foundEndMarker && finalAnalysis.fileCount > 0 && !inputFullyConsumed) {
+                debugLog('[XZ Streaming Worker] WARNING: TAR archive missing end marker - file may be truncated');
+                
+                self.postMessage({
+                    success: true,
+                    partialSuccess: true,
+                    totalDecompressed,
+                    analysis: {
+                        ...finalAnalysis,
+                        corruptionDetected: true,
+                        corruptionMessage: 'TAR archive is incomplete - file appears to be truncated or corrupted',
+                        xzBlocksProcessed: chunkCount,
+                        bytesProcessed: inputOffset,
+                        totalInputBytes: inputSize,
+                        percentProcessed: Math.floor((inputOffset / inputSize) * 100)
+                    }
+                });
+                return;
+            }
+
+            debugLog(`[XZ Streaming Worker] Complete: ${totalDecompressed} bytes decompressed, ${finalAnalysis.fileCount} files`);
+
+            try {
+                self.postMessage({
+                    success: true,
+                    totalDecompressed,
+                    analysis: finalAnalysis
+                });
+            } catch (postErr) {
+                console.error('[XZ Streaming Worker] postMessage failed (analysis too large), retrying with trimmed data:', postErr.message);
+                // Trim large event arrays to fit in structured clone
+                if (finalAnalysis.clusterEvents) {
+                    const ce = finalAnalysis.clusterEvents;
+                    if (ce.resourceMigrations && ce.resourceMigrations.length > 1000) {
+                        ce.resourceMigrations = ce.resourceMigrations.slice(0, 1000);
+                        ce.resourceMigrationsTrimmed = true;
+                    }
+                    if (ce.fencingEvents && ce.fencingEvents.length > 1000) {
+                        ce.fencingEvents = ce.fencingEvents.slice(0, 1000);
+                        ce.fencingEventsTrimmed = true;
+                    }
+                }
+                self.postMessage({
+                    success: true,
+                    totalDecompressed,
+                    analysis: finalAnalysis
+                });
+            }
+
+        } catch (error) {
+            console.error('[XZ Streaming Worker] Error:', error);
+            
+            // Check if we got partial data before the error
+            let partialAnalysis = null;
+            try {
+                partialAnalysis = tarParser ? tarParser.getAnalysis() : null;
+            } catch (analysisErr) {
+                console.error('[XZ Streaming Worker] Failed to get partial analysis:', analysisErr.message);
+            }
+            
+            if (partialAnalysis && partialAnalysis.fileCount > 0) {
+                // We have partial data - report it along with the error
+                debugLog(`[XZ Streaming Worker] Partial success: ${totalDecompressed} bytes decompressed, ${partialAnalysis.fileCount} files before error`);
+                
+                // Trim large arrays to prevent OOM on postMessage
+                if (partialAnalysis.clusterEvents) {
+                    const ce = partialAnalysis.clusterEvents;
+                    if (ce.resourceMigrations && ce.resourceMigrations.length > 1000) {
+                        ce.resourceMigrations = ce.resourceMigrations.slice(0, 1000);
+                        ce.resourceMigrationsTrimmed = true;
+                    }
+                    if (ce.fencingEvents && ce.fencingEvents.length > 1000) {
+                        ce.fencingEvents = ce.fencingEvents.slice(0, 1000);
+                        ce.fencingEventsTrimmed = true;
+                    }
+                }
+                
+                try {
+                    self.postMessage({
+                        success: true,
+                        partialSuccess: true,
+                        totalDecompressed,
+                        analysis: {
+                            ...partialAnalysis,
+                            corruptionDetected: true,
+                            corruptionMessage: error.message || 'File appears to be corrupted or truncated',
+                            xzBlocksProcessed: chunkCount,
+                            bytesProcessed: inputOffset,
+                            totalInputBytes: inputSize
+                        }
+                    });
+                } catch (postErr) {
+                    console.error('[XZ Streaming Worker] Failed to send partial results:', postErr.message);
+                    self.postMessage({
+                        error: 'Analysis completed but results too large to transfer: ' + error.message
+                    });
+                }
+            } else {
+                // Complete failure — surface the partial progress (XZ blocks
+                // processed and bytes decompressed before the corruption was
+                // detected) so the UI can show the user *something* useful
+                // instead of a bare "Decompression error" line.  The
+                // ui.spec.js corruption test asserts that the rendered error
+                // contains at least one of "block", "byte" or "decompressed".
+                const progressSummary = `Processed ${chunkCount} XZ block(s) and ${totalDecompressed} byte(s) decompressed before failure.`;
+                self.postMessage({
+                    error: `${error.message || 'Unknown streaming decompression error'} — ${progressSummary}`
+                });
+            }
+        }
+    }
+};
+
+debugLog('[XZ Streaming Worker] Worker initialized, waiting for module...');
diff --git a/rca-tool/tests/accessibility-check.js b/rca-tool/tests/accessibility-check.js
new file mode 100644
index 0000000..3360116
--- /dev/null
+++ b/rca-tool/tests/accessibility-check.js
@@ -0,0 +1,98 @@
+/**
+ * Manual Accessibility Check using axe-core
+ * 
+ * To run this:
+ * 1. Install axe: npm install --save-dev @axe-core/playwright
+ * 2. Run: node accessibility-check.js
+ */
+
+import { chromium } from '@playwright/test';
+import AxeBuilder from '@axe-core/playwright';
+
+async function runAccessibilityTest() {
+  console.log('Starting accessibility scan...\n');
+  const targetUrl = process.env.ACCESSIBILITY_URL || 'http://localhost:8080/';
+  
+  const browser = await chromium.launch({
+    channel: 'msedge',
+    headless: true,
+  });
+  const context = await browser.newContext();
+  const page = await context.newPage();
+
+  try {
+    // Navigate to the target app
+    await page.goto(targetUrl);
+    
+    console.log('Page loaded. Running axe-core scan...\n');
+
+    // Run axe accessibility scan
+    const accessibilityScanResults = await new AxeBuilder({ page })
+      .withTags(['wcag2a', 'wcag2aa', 'wcag21a', 'wcag21aa'])
+      .analyze();
+
+    console.log('='.repeat(60));
+    console.log('ACCESSIBILITY SCAN RESULTS');
+    console.log('='.repeat(60));
+    console.log(`URL: ${accessibilityScanResults.url}`);
+    console.log(`Violations found: ${accessibilityScanResults.violations.length}`);
+    console.log(`Passes: ${accessibilityScanResults.passes.length}`);
+    console.log(`Incomplete: ${accessibilityScanResults.incomplete.length}`);
+    console.log('='.repeat(60));
+
+    if (accessibilityScanResults.violations.length > 0) {
+      console.log('\n[ERROR] VIOLATIONS FOUND:\n');
+      
+      accessibilityScanResults.violations.forEach((violation, index) => {
+        console.log(`\n${index + 1}. ${violation.id}`);
+        console.log(`   Impact: ${violation.impact?.toUpperCase() || 'N/A'}`);
+        console.log(`   Description: ${violation.description}`);
+        console.log(`   Help: ${violation.help}`);
+        console.log(`   Help URL: ${violation.helpUrl}`);
+        console.log(`   Affected elements: ${violation.nodes.length}`);
+        
+        violation.nodes.forEach((node, nodeIndex) => {
+          console.log(`\n   Element ${nodeIndex + 1}:`);
+          console.log(`     HTML: ${node.html.substring(0, 100)}${node.html.length > 100 ? '...' : ''}`);
+          console.log(`     Target: ${node.target.join(' ')}`);
+          
+          if (node.failureSummary) {
+            console.log(`     Issue: ${node.failureSummary}`);
+          }
+        });
+        
+        console.log('\n   ' + '-'.repeat(56));
+      });
+    } else {
+      console.log('\n[OK] No accessibility violations found!');
+    }
+
+    // Incomplete tests (need manual review)
+    if (accessibilityScanResults.incomplete.length > 0) {
+      console.log('\n\n[WARNING] INCOMPLETE TESTS (Manual Review Needed):\n');
+      
+      accessibilityScanResults.incomplete.forEach((incomplete, index) => {
+        console.log(`\n${index + 1}. ${incomplete.id}`);
+        console.log(`   Description: ${incomplete.description}`);
+        console.log(`   Help URL: ${incomplete.helpUrl}`);
+        console.log(`   Affected elements: ${incomplete.nodes.length}`);
+      });
+    }
+
+    console.log('\n' + '='.repeat(60));
+    console.log('Scan complete!');
+    console.log('='.repeat(60) + '\n');
+
+  } catch (error) {
+    console.error('Error during accessibility scan:', error);
+  } finally {
+    await browser.close();
+  }
+}
+
+// Check if server is running
+console.log('[WARNING] Make sure your dev server is running for the target URL.');
+console.log(`   Target URL: ${process.env.ACCESSIBILITY_URL || 'http://localhost:8080/'}`);
+console.log('   You can start it with: npx http-server rca-tool/web-leptos/dist -p 8080\n');
+
+runAccessibilityTest();
diff --git a/rca-tool/tests/accessibility.spec.js b/rca-tool/tests/accessibility.spec.js
new file mode 100644
index 0000000..9f8900a
--- /dev/null
+++ b/rca-tool/tests/accessibility.spec.js
@@ -0,0 +1,68 @@
+/**
+ * @module tests/accessibility
+ * @description Playwright accessibility tests using axe-core.
+ *
+ * Validates WCAG 2.1 AA compliance on both the empty state and
+ * after a file upload has been processed.  Uses `@axe-core/playwright`
+ * for automated checks.
+ */
+import { test, expect } from '@playwright/test';
+import AxeBuilder from '@axe-core/playwright';
+import { uploadAndWaitForAnalysis, navigateToApp, fixturePath } from './test-helpers.js';
+
+test.describe('Accessibility (WCAG 2.1 AA)', () => {
+
+  test.beforeEach(async ({ page }, testInfo) => {
+    await navigateToApp(page, testInfo);
+    await expect(page.locator('h1')).toContainText('RCA Tool');
+  });
+
+  test('empty state has no WCAG 2.1 AA violations', async ({ page }) => {
+    const results = await new AxeBuilder({ page })
+      .withTags(['wcag2a', 'wcag2aa', 'wcag21a', 'wcag21aa'])
+      .analyze();
+
+    expect(results.violations).toEqual([]);
+  });
+
+  test('post-analysis state has no WCAG 2.1 AA violations', async ({ page }) => {
+    await uploadAndWaitForAnalysis(page, 'scc_test-azure-vm.tar.xz');
+
+    const results = await new AxeBuilder({ page })
+      .withTags(['wcag2a', 'wcag2aa', 'wcag21a', 'wcag21aa'])
+      .analyze();
+
+    // Log detailed violation info for debugging
+    if (results.violations.length > 0) {
+      for (const v of results.violations) {
+        console.log(`[a11y] ${v.id} (${v.impact}): ${v.help}`);
+        for (const node of v.nodes) {
+          console.log(`  → ${node.target.join(' ')}`);
+        }
+      }
+    }
+
+    expect(results.violations).toEqual([]);
+  });
+
+  test('output region has correct ARIA attributes', async ({ page }) => {
+    const output = page.locator('#output');
+    await expect(output).toHaveAttribute('role', 'region');
+    await expect(output).toHaveAttribute('aria-live', 'polite');
+    await expect(output).toHaveAttribute('aria-label', 'Analysis results');
+  });
+
+  test('all external links have rel=noopener', async ({ page }) => {
+    await uploadAndWaitForAnalysis(page, 'scc_test-azure-vm.tar.xz');
+
+    const unsafeLinks = await page.locator('a[target="_blank"]:not([rel*="noopener"])').count();
+    expect(unsafeLinks).toBe(0);
+  });
+
+  test('all table headers have scope attribute', async ({ page }) => {
+    await uploadAndWaitForAnalysis(page, 'scc_test-azure-vm.tar.xz');
+
+    const thWithoutScope = await page.locator('th:not([scope])').count();
+    expect(thWithoutScope).toBe(0);
+  });
+});
diff --git a/rca-tool/tests/automation.spec.js b/rca-tool/tests/automation.spec.js
new file mode 100644
index 0000000..58d106b
--- /dev/null
+++ b/rca-tool/tests/automation.spec.js
@@ -0,0 +1,39 @@
+/**
+ * @module tests/automation
+ * @description Playwright tests for {@link module:parsers/automation}.
+ *
+ * Verifies detection of Ansible executions including command patterns,
+ * execution counts, and `yum install` invocations from SCC archives.
+ */
+import { test, expect } from './coverage-fixture.js';
+import { uploadAndWaitForAnalysis, navigateToApp } from './test-helpers.js';
+
+test.describe('Automation Parser', () => {
+
+  test.beforeEach(async ({ page }, testInfo) => {
+    await navigateToApp(page, testInfo);
+    await expect(page.locator('h1')).toContainText('RCA Tool');
+  });
+
+  test('detects automation tool usage (Ansible)', async ({ page }) => {
+    // Listen to console messages
+    page.on('console', msg => console.log('BROWSER:', msg.text()));
+    page.on('pageerror', err => console.error('PAGE ERROR:', err));
+    
+    const result = await uploadAndWaitForAnalysis(page, 'scc_test-automation.tar.xz');
+    
+    // Should detect automation tools
+    expect(result).toContain('Automation Tools Usage');
+    
+    // Should show Ansible executions
+    expect(result).toContain('Ansible');
+    expect(result).toMatch(/5 execution/i);
+    
+    // Should show ansible commands
+    expect(result).toContain('yum install -y httpd');
+    expect(result).toContain('Invoked with name=httpd');
+    
+    // Should show detection pattern
+    expect(result).toContain('ansible-command:');
+  });
+});
diff --git a/rca-tool/tests/azure.spec.js b/rca-tool/tests/azure.spec.js
new file mode 100644
index 0000000..d8aa4db
--- /dev/null
+++ b/rca-tool/tests/azure.spec.js
@@ -0,0 +1,258 @@
+/**
+ * @module tests/azure
+ * @description Playwright tests for {@link module:parsers/azure}.
+ *
+ * Covers Azure VM property detection, BYOS / PAYG billing-model
+ * classification across SLES, RHEL, and Ubuntu images, SCC
+ * `metadata.txt` format parsing, Azure storage-type display
+ * (Ultra Disk, Premium SSD v2), and waagent.conf parsing.
+ */
+import { test, expect } from './coverage-fixture.js';
+import { uploadAndWaitForAnalysis, getResultText, navigateToApp, fixturePath } from './test-helpers.js';
+
+test.describe('Azure Parser', () => {
+
+  test.beforeEach(async ({ page }, testInfo) => {
+    await navigateToApp(page, testInfo);
+    await expect(page.locator('h1')).toContainText('RCA Tool');
+  });
+
+  test('detects Azure VM properties correctly', async ({ page }) => {
+    const result = await uploadAndWaitForAnalysis(page, 'scc_test-azure-vm.tar.xz');
+    
+    expect(result).toContain('Azure VM Properties');
+    expect(result).toMatch(/VM Size:|Publisher:|Offer:/);
+  });
+
+  test('detects BYOS billing model via license type (SLES)', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('scc_test-azure-vm.tar.xz'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('Azure VM Properties');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+    
+    // Should detect BYOS
+    expect(content).toContain('BYOS');
+    expect(content).toContain('License Type: SLES_BYOS');
+  });
+
+  test('detects PAYG billing model via license type (RHEL SAP HA)', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('scc_test-azure-vm-rhel-payg.tar.xz'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('Azure VM Properties');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+    
+    // Should detect PAYG
+    expect(content).toContain('PAYG');
+    expect(content).toContain('License Type: RHEL_SAPHA');
+    expect(content).toMatch(/Billing Code:.*Linux_IaaS_Software_RedHat_SAP_HA/);
+  });
+
+  test('detects BYOS via billing code when license type is N/A (RHEL)', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('scc_test-azure-vm-rhel-byos.tar.xz'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('Azure VM Properties');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+    
+    // Should detect BYOS via billing code
+    expect(content).toContain('BYOS');
+    expect(content).toContain('Billing Code: Linux_IaaS');
+  });
+
+  test('detects PAYG via billing code when license type is NONE (SLES SAP)', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('scc_test-azure-vm-sles-payg.tar.xz'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('Azure VM Properties');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+    
+    // Should detect PAYG via billing code
+    expect(content).toContain('PAYG');
+    expect(content).toContain('Billing Code: Linux_IaaS_Software_SLES_for_SAP');
+  });
+
+  test('detects BYOS for Canonical Ubuntu via billing code', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('scc_test-azure-vm-ubuntu-byos.tar.xz'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('Azure VM Properties');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+    
+    // Should detect BYOS
+    expect(content).toContain('BYOS');
+    expect(content).toContain('Billing Code: Linux_IaaS_Canonical');
+  });
+
+  test('detects PAYG for Ubuntu Pro via license type', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('scc_test-azure-vm-ubuntu-pro.tar.xz'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('Azure VM Properties');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+    
+    // Should detect PAYG
+    expect(content).toContain('PAYG');
+    expect(content).toContain('License Type: UBUNTU_PRO');
+  });
+
+  test('detects Azure VM from SCC metadata.txt format', async ({ page }) => {
+    await page.setInputFiles(
+      'input[type="file"]',
+      fixturePath('scc_test-azure-vm-scc-metadata.tar.xz')
+    );
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('Azure VM Properties');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+    
+    // Should detect VM size from SCC metadata.txt
+    expect(content).toContain('Standard_M64ds_v2');
+    // Should detect PAYG
+    expect(content).toContain('PAYG');
+    // Should detect SLES SAP
+    expect(content).toContain('SUSE');
+  });
+
+  test('detects and displays Azure storage types (Ultra Disk and Premium SSD v2)', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-azure-vm-storage.tar.xz');
+    
+    // Should show storage section
+    expect(resultHTML).toContain('Storage:');
+    
+    // Should show OS disk type
+    expect(resultHTML).toContain('OS Disk:');
+    expect(resultHTML).toContain('Premium SSD');
+    
+    // Should show data disks section
+    expect(resultHTML).toContain('Data Disks:');
+    expect(resultHTML).toContain('3 disk(s)');
+    
+    // Should detect Ultra Disk
+    expect(resultHTML).toContain('Ultra Disk');
+    expect(resultHTML).toContain('LUN 0');
+    expect(resultHTML).toContain('512 GB');
+    
+    // Should detect Premium SSD v2
+    expect(resultHTML).toContain('Premium SSD v2');
+    expect(resultHTML).toContain('LUN 1');
+    expect(resultHTML).toContain('256 GB');
+    
+    // Should show regular Premium SSD
+    expect(resultHTML).toContain('LUN 2');
+    expect(resultHTML).toContain('1024 GB');
+  });
+
+  test('parses waagent.conf from InspectIaaSDisk ZIP', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('test-inspect-iaas-disk.zip'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('Azure Linux Agent Configuration');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+
+    // Should display the waagent config subsection
+    expect(content).toContain('Azure Linux Agent Configuration');
+
+    // Key settings should be rendered
+    expect(content).toMatch(/Extensions.*Enabled/);
+    expect(content).toMatch(/OS Firewall.*Enabled/);
+    expect(content).toMatch(/Provisioning Agent.*auto/);
+    expect(content).toMatch(/Resource Disk Swap.*Disabled/);
+    expect(content).toMatch(/Auto-Update.*Enabled/);
+    expect(content).toContain('300s');  // SCSI timeout
+  });
+
+  test('waagent.conf shows no warnings for healthy config', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('test-inspect-iaas-disk.zip'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('Azure Linux Agent Configuration');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+
+    // The default fixture has a healthy config — no warning messages expected
+    expect(content).not.toContain('extensions are disabled');
+    expect(content).not.toContain('firewall (wire-server access control) is disabled');
+    expect(content).not.toContain('Swap is enabled on the resource');
+  });
+
+  test('detects SecureBoot disabled from sosreport mokutil --sb-state', async ({ page }) => {
+    const result = await uploadAndWaitForAnalysis(page, 'scc_test-secureboot-disabled.tar.xz');
+    expect(result).toContain('SecureBoot');
+    expect(result).toContain('Disabled');
+  });
+
+  test('detects SecureBoot enabled from sosreport mokutil --sb-state', async ({ page }) => {
+    const result = await uploadAndWaitForAnalysis(page, 'scc_test-secureboot-enabled.tar.xz');
+    expect(result).toContain('SecureBoot');
+    expect(result).toContain('Enabled');
+  });
+
+  test('detects SecureBoot unsupported from sosreport mokutil --sb-state', async ({ page }) => {
+    const result = await uploadAndWaitForAnalysis(page, 'scc_test-secureboot-unsupported.tar.xz');
+    expect(result).toContain('SecureBoot');
+    expect(result).toContain('Not supported');
+  });
+});
diff --git a/rca-tool/tests/cluster.spec.js b/rca-tool/tests/cluster.spec.js
new file mode 100644
index 0000000..446b610
--- /dev/null
+++ b/rca-tool/tests/cluster.spec.js
@@ -0,0 +1,259 @@
+/**
+ * @module tests/cluster
+ * @description Playwright tests for {@link module:parsers/cluster}.
+ *
+ * Validates systemd false-positive filtering, cluster-node discovery,
+ * Corosync configuration checks, Pacemaker resource parsing, SAP
+ * indicator detection, STONITH/SBD fencing, SAP instance
+ * configuration and error reporting, live-migration events, nested
+ * gzip decompression, Getty message filtering, and InspectIaaSDisk
+ * cluster file parsing (hosts, corosync.conf).
+ */
+import { test, expect } from './coverage-fixture.js';
+import { uploadAndWaitForAnalysis, getResultText, isSapDetectedFromResult, navigateToApp, fixturePath } from './test-helpers.js';
+
+test.describe('Cluster Parsers', () => {
+
+  test.beforeEach(async ({ page }, testInfo) => {
+    await navigateToApp(page, testInfo);
+    await expect(page.locator('h1')).toContainText('RCA Tool');
+  });
+
+  test('detects systemd false positives are filtered out', async ({ page }) => {
+    const result = await uploadAndWaitForAnalysis(page, 'scc_test-systemd-messages.tar.xz');
+    
+    // Should NOT contain systemd service messages
+    expect(result).not.toContain('Getty stopped on');
+    expect(result).not.toContain('PatrolAgent stopped on port');
+    
+    // But should still show actual cluster events if present
+    const resultText = await getResultText(page);
+    if (resultText.includes('Resource Migration Events')) {
+      // If there are migration events, verify they're not systemd services
+      expect(result).not.toMatch(/systemd\[\d+\]:/);
+    }
+  });
+
+  test('detects cluster nodes and validates /etc/hosts', async ({ page }) => {
+    const result = await uploadAndWaitForAnalysis(page, 'scc_test-cluster-nodes.tar.xz');
+    const sapDetected = isSapDetectedFromResult(result);
+    if (!sapDetected) {
+      console.log('Skipping cluster/hosts assertions: SAP not detected in fixture');
+      return;
+    }
+
+    expect(result).toContain('Cluster nodes in ha.txt and hosts file');
+    // Test should process the hosts file
+    expect(result).toContain('ha.txt');
+  });
+
+  test('detects Corosync configuration issues', async ({ page }) => {
+    const result = await uploadAndWaitForAnalysis(page, 'scc_test-corosync-config.tar.xz');
+    const sapDetected = isSapDetectedFromResult(result);
+    if (!sapDetected) {
+      console.log('Skipping Corosync assertions: SAP not detected in fixture');
+      return;
+    }
+
+    // Accept either legacy or updated header labels
+    expect(result).toMatch(/Corosync Configuration|Cluster Configuration/);
+    // Check for token timeout detection
+    expect(result).toMatch(/token.*\d+/i);
+  });
+
+  test('detects Pacemaker resources', async ({ page }) => {
+    const result = await uploadAndWaitForAnalysis(page, 'scc_test-pacemaker-resources.tar.xz');
+    
+    // The output should contain either resources or a message about them
+    expect(result).toContain('resource');
+    // Should process the ha.txt file
+    expect(result).toContain('ha.txt');
+  });
+
+  test('detects SAP application indicators (directories, HANA resources, services)', async ({ page }) => {
+    const result = await uploadAndWaitForAnalysis(page, 'scc_test-pacemaker-resources.tar.xz');
+
+    // New GUI section should be present
+    expect(result).toContain('[OK] Applications');
+    expect(result).toContain('SAP Applications Detected');
+
+    // Should list HANA / SAP resources discovered via pacemaker
+    expect(result).toMatch(/SAPHana|HDB|rsc_SAPHana/i);
+  });
+
+  test('detects fencing configuration', async ({ page }) => {
+    const result = await uploadAndWaitForAnalysis(page, 'scc_test-fencing.tar.xz');
+    const sapDetected = isSapDetectedFromResult(result);
+    if (!sapDetected) {
+      console.log('Skipping fencing assertions: SAP not detected in fixture');
+      return;
+    }
+
+    // Should process ha.txt and show cluster nodes section
+    expect(result).toContain('ha.txt');
+    expect(result).toContain('Cluster nodes');
+  });
+
+  test('detects fencing configuration in pcs_config format', async ({ page }) => {
+    const result = await uploadAndWaitForAnalysis(page, 'scc_test-fencing-pcs.tar.xz');
+    const sapDetected = isSapDetectedFromResult(result);
+    if (!sapDetected) {
+      console.log('Skipping pcs_config fencing assertions: SAP not detected in fixture');
+      return;
+    }
+
+    // Should detect stonith-enabled
+    expect(result).toMatch(/stonith.*enabled.*true/i);
+    
+    // Should detect Azure fencing agent
+    expect(result).toMatch(/rsc_st_azure|fence_azure_arm/i);
+  });
+
+  test('detects SAP instance configuration issues - START_PROFILE and hostname mismatches', async ({ page }) => {
+    const result = await uploadAndWaitForAnalysis(page, 'scc_test-sap-instance-config.tar.xz');
+    
+    // The fixture explicitly has SAPInstance resources, so we don't need SAP indicator check
+    // Should detect SAPInstance resources
+    expect(result).toMatch(/SAPInstance|rsc_sap_PJU/i);
+    
+    // Should detect START_PROFILE errors
+    expect(result).toMatch(/START_PROFILE/i);
+    
+    // Should detect hostname mismatch (InstanceName has different host than START_PROFILE)
+    expect(result).toMatch(/mismatch|hostname|ppu-scs|ppu-ers|awenwjeusscs/i);
+  });
+
+  test('detects SAP instance runtime errors - GRAY status and START_PROFILE issues', async ({ page }) => {
+    const result = await uploadAndWaitForAnalysis(page, 'scc_test-sap-instance-config.tar.xz');
+    
+    // The fixture explicitly has SAP-related pacemaker resources
+    // Should detect GRAY status errors - SAP services in GRAY status
+    expect(result).toMatch(/GRAY Status/i);
+    expect(result).toMatch(/msg_server/i);
+    expect(result).toMatch(/enserver/i);
+    
+    // Should detect filesystem unmount issues
+    expect(result).toMatch(/Filesystem Errors/i);
+    expect(result).toMatch(/unmount/i);
+    
+    // Should detect START_PROFILE errors
+    expect(result).toMatch(/START_PROFILE Errors/i);
+  });
+
+  test('detects live migration events', async ({ page }) => {
+    const result = await uploadAndWaitForAnalysis(page, 'scc_test-live-migration.tar.xz');
+    
+    if (result.includes('Live Migration Events')) {
+      expect(result).toMatch(/Hyper-V Live Migration/i);
+      // Should show migration timestamps
+      expect(result).toMatch(/\d{4}-\d{2}-\d{2}|\w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}/);
+    }
+  });
+
+  test('decompresses nested .gz files and processes all cluster log rotations', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-nested-gzip.tar.xz');
+    
+    // Should display nested compression statistics
+    expect(resultHTML).toContain('Nested Compression');
+    expect(resultHTML).toMatch(/5 \.gz files? found/);
+    expect(resultHTML).toMatch(/5 decompressed/);
+    
+    // Should show cluster events from all decompressed log files
+    expect(resultHTML).toContain('Cluster Events Detected');
+    expect(resultHTML).toMatch(/6 events found/);
+    
+    // Should detect resource events from multiple log files
+    expect(resultHTML).toContain('testip');
+    expect(resultHTML).toContain('sapdb');
+    expect(resultHTML).toContain('filesystem');
+    
+    // Verify all three resources show both stop and start events
+    expect(resultHTML).toContain('node01');
+    expect(resultHTML).toContain('node02');
+    
+    // Verify events are from the .gz files
+    expect(resultHTML).toContain('pacemaker.log-20250101.gz');
+    expect(resultHTML).toContain('pacemaker.log-20250102.gz');
+    expect(resultHTML).toContain('pacemaker.log-20250103.gz');
+  });
+
+  test('detects pacemaker high CPU events', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('scc_test-cluster-high-cpu.tar.xz'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && /Cluster Events Detected|pacemaker-controld|High CPU load detected/.test(output.textContent || '');
+      },
+      { timeout: 60000 }
+    );
+
+    const resultText = await page.locator('#output').textContent();
+    expect(resultText).toContain('Cluster Events Detected');
+    expect(resultText).toContain('pacemaker-controld');
+    expect(resultText).toMatch(/High CPU load detected|23\.270000/);
+    expect(resultText).toContain('node01');
+  });
+
+  test('confirms Getty/tty messages are not shown as cluster resource events', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-systemd-messages.tar.xz');
+    
+    // Should NOT show getty as a cluster resource
+    expect(resultHTML).not.toMatch(/getty.*resource|resource.*getty/i);
+    expect(resultHTML).not.toContain('tty1');
+    
+    // Should NOT show PatrolAgent or other systemd services as cluster events
+    expect(resultHTML).not.toContain('PatrolAgent');
+    
+    // Verify the Cluster Events section doesn't contain these false positives
+    const resultText = await getResultText(page);
+    if (resultText.includes('Cluster Events')) {
+      expect(resultText).not.toMatch(/Getty stopped|agetty|tty1 stop/i);
+    }
+  });
+
+  test('parses corosync.conf and detects cluster nodes from InspectIaaSDisk ZIP', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('test-inspect-iaas-disk-cluster.zip'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('InspectIaaSDisk Results');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+
+    // Should detect cluster nodes from corosync.conf nodelist
+    expect(content).toContain('hananode01');
+    expect(content).toContain('hananode02');
+
+    // Should detect corosync token value (30000)
+    expect(content).toMatch(/token.*30000|30000.*token/i);
+  });
+
+  test('validates hosts file against cluster nodes in InspectIaaSDisk ZIP', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('test-inspect-iaas-disk-cluster.zip'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('hananode01');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+
+    // Both cluster nodes should be found in hosts file
+    expect(content).toContain('hananode01');
+    expect(content).toContain('hananode02');
+
+    // Should show the corosync transport type
+    expect(content).toMatch(/udpu/i);
+  });
+});
diff --git a/rca-tool/tests/coverage-fixture.js b/rca-tool/tests/coverage-fixture.js
new file mode 100644
index 0000000..a4fc7f3
--- /dev/null
+++ b/rca-tool/tests/coverage-fixture.js
@@ -0,0 +1,187 @@
+/**
+ * @module tests/coverage-fixture
+ * @description Playwright auto-fixture that collects V8 code coverage for both
+ * the main thread and Web Worker threads.
+ *
+ * ### Main-thread coverage
+ *
+ * Uses Playwright's built-in `page.coverage` API (V8) to collect
+ * per-byte JS and CSS coverage for the bundled UI code.
+ *
+ * ### Worker / parser coverage
+ *
+ * Source files loaded by the Web Worker (`worker.js`, `utils.js`,
+ * `src/parsers/*.js`) are instrumented with Istanbul counters by
+ * `instrument-coverage.sh`.  A postMessage hook in the instrumented
+ * worker piggybacks the `__coverage__` object on every message sent
+ * to the main thread.  This fixture captures that data, converts it
+ * from Istanbul format to V8 `ScriptCoverage` entries, and feeds
+ * everything to monocart-reporter as a single V8 data set.
+ *
+ * ### Usage
+ *
+ * Import `{ test, expect }` from this module instead of
+ * `@playwright/test` in every spec file that exercises the web app.
+ *
+ * ```js
+ * import { test, expect } from './coverage-fixture.js';
+ * ```
+ */
+
+import { readFileSync } from 'fs';
+import { test as baseTest, expect } from '@playwright/test';
+import { addCoverageReport } from 'monocart-reporter';
+
+// ─── Istanbul → V8 converter ──────────────────────────────────────────────────
+/**
+ * Convert an Istanbul `__coverage__` object into an array of V8
+ * `ScriptCoverage` entries that monocart-reporter can process.
+ *
+ * For each file we read the original source from disk, translate
+ * Istanbul's line:column locations to byte offsets, and produce
+ * V8-style `functions` arrays with nested `ranges`.
+ *
+ * @param {Object} istanbulCoverage  The `__coverage__` global from the worker.
+ * @returns {Array} V8-compatible coverage entries.
+ */
+function istanbulToV8(istanbulCoverage) {
+  const entries = [];
+
+  for (const [filePath, fileCov] of Object.entries(istanbulCoverage)) {
+    let source;
+    try {
+      source = readFileSync(filePath, 'utf8');
+    } catch {
+      continue; // file not found (e.g. in CI with different absolute paths)
+    }
+
+    // Build a map of line number (1-based) → byte offset of line start.
+    const lineOffsets = [0];
+    for (let i = 0; i < source.length; i++) {
+      if (source[i] === '\n') lineOffsets.push(i + 1);
+    }
+
+    /** Convert Istanbul {line, column} (1-based line, 0-based col) to byte offset. */
+    const toOffset = (loc) => {
+      const lineStart = lineOffsets[loc.line - 1] ?? 0;
+      return Math.min(lineStart + loc.column, source.length);
+    };
+
+    // ── Build V8-style functions array ───────────────────────────────
+    // Each function maps to a V8 "FunctionCoverage" with isBlockCoverage=true,
+    // and nested ranges represent the function body blocks.
+    const functions = [];
+
+    // Top-level pseudo-function covering the entire file (required by V8 format)
+    const topRanges = [{ startOffset: 0, endOffset: source.length, count: 1 }];
+    // Add uncovered statements as count:0 ranges
+    for (const [idx, loc] of Object.entries(fileCov.statementMap)) {
+      const count = fileCov.s[idx] ?? 0;
+      if (count === 0) {
+        topRanges.push({
+          startOffset: toOffset(loc.start),
+          endOffset: toOffset(loc.end),
+          count: 0
+        });
+      }
+    }
+    functions.push({
+      functionName: '',
+      isBlockCoverage: true,
+      ranges: topRanges
+    });
+
+    // Named functions
+    for (const [idx, fn] of Object.entries(fileCov.fnMap)) {
+      const count = fileCov.f[idx] ?? 0;
+      functions.push({
+        functionName: fn.name || `(anonymous_${idx})`,
+        isBlockCoverage: true,
+        ranges: [{
+          startOffset: toOffset(fn.loc.start),
+          endOffset: toOffset(fn.loc.end),
+          count
+        }]
+      });
+    }
+
+    entries.push({
+      url: `file://${filePath}`,
+      scriptId: String(entries.length + 1),
+      source,
+      functions
+    });
+  }
+
+  return entries;
+}
+
+// ─── Test fixture ─────────────────────────────────────────────────────────────
+const test = baseTest.extend({
+  autoTestFixture: [async ({ page }, use) => {
+
+    // V8 coverage API is Chromium-only (works with msedge)
+    const isChromium = ['Desktop Edge', 'Desktop Chrome', 'Desktop Chromium']
+      .some(name => test.info().project.name === 'local' || test.info().project.name === 'deployed');
+
+    if (isChromium) {
+      await Promise.all([
+        page.coverage.startJSCoverage({ resetOnNavigation: false }),
+        page.coverage.startCSSCoverage({ resetOnNavigation: false })
+      ]);
+    }
+
+    // ── Istanbul Worker setup ──────────────────────────────────────────
+    // Override the Worker constructor so that any message carrying
+    // __istanbulCoverage (piggybacked by instrument-coverage.sh) is
+    // captured on the main thread before the worker is terminated.
+    await page.addInitScript(() => {
+      window.__workerCoverages = [];
+      const OrigWorker = window.Worker;
+      window.Worker = function Worker(url, opts) {
+        const w = new OrigWorker(url, opts);
+        w.addEventListener('message', function(e) {
+          if (e.data && e.data.__istanbulCoverage) {
+            window.__workerCoverages.push(e.data.__istanbulCoverage);
+          }
+        });
+        return w;
+      };
+      window.Worker.prototype = OrigWorker.prototype;
+    });
+
+    await use('autoTestFixture');
+
+    // ── V8 coverage (main thread) ──────────────────────────────────────
+    if (isChromium) {
+      const [jsCoverage, cssCoverage] = await Promise.all([
+        page.coverage.stopJSCoverage(),
+        page.coverage.stopCSSCoverage()
+      ]);
+      const coverageList = [...jsCoverage, ...cssCoverage];
+      await addCoverageReport(coverageList, test.info());
+    }
+
+    // ── Istanbul → V8 coverage (Web Workers) ───────────────────────────
+    // Retrieve Istanbul data captured from worker postMessage calls,
+    // convert to V8 ScriptCoverage format, and pass to monocart so
+    // both main-thread and worker coverage appear in one report.
+    const workerCoverages = await page.evaluate(
+      () => window.__workerCoverages || []
+    );
+    if (workerCoverages.length > 0) {
+      // Use the last snapshot — it has the most complete counters.
+      const latest = workerCoverages[workerCoverages.length - 1];
+      const v8Entries = istanbulToV8(latest);
+      if (v8Entries.length > 0) {
+        await addCoverageReport(v8Entries, test.info());
+      }
+    }
+
+  }, {
+    scope: 'test',
+    auto: true
+  }]
+});
+
+export { test, expect };
diff --git a/rca-tool/tests/create-fixtures.sh b/rca-tool/tests/create-fixtures.sh
new file mode 100755
index 0000000..4fbd8a1
--- /dev/null
+++ b/rca-tool/tests/create-fixtures.sh
@@ -0,0 +1,3926 @@
+#!/bin/bash
+# Script to generate test fixtures for SAP HANA Cluster Analyzer
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+FIXTURES_DIR="$SCRIPT_DIR/fixtures"
+
+echo "Creating test fixtures in $FIXTURES_DIR"
+mkdir -p "$FIXTURES_DIR"
+
+# Function to create and compress test data
+create_fixture() {
+    local name=$1
+    echo "Creating $name..."
+    # Create an scc-style directory structure
+    mkdir -p "scc_$name"
+    mv test-data/* "scc_$name/" 2>/dev/null || true
+    rmdir test-data 2>/dev/null || true
+    tar -cJf "$FIXTURES_DIR/scc_$name.tar.xz" "scc_$name"
+    rm -rf "scc_$name"
+    echo "[OK] Created scc_$name"
+}
+
+# 1. Test for systemd false positives
+echo ""
+echo "=== Creating test-systemd-messages.tar.xz ==="
+mkdir -p test-data/var/log
+cat > test-data/var/log/messages.txt << 'EOF'
+2025-11-13T07:39:23.000000+01:00 node01 kernel: Linux version 5.14.0
+2025-11-13T07:39:23.997956+01:00 node01 systemd[1]: Stopping Getty on tty1...
+2025-11-13T07:39:24.145728+01:00 node01 S50PatrolAgent.sh[1186580]: [LOG]Stopping PatrolAgent on port 3181.
+2025-11-13T07:39:24.350856+01:00 node01 systemd[1]: Stopped Getty on tty1.
+2025-11-13T07:39:25.000000+01:00 node01 systemd[1]: Started Session 123 of user root.
+EOF
+create_fixture "test-systemd-messages"
+
+# 2. Test for Azure VM properties - BYOS via License Type
+echo ""
+echo "=== Creating test-azure-vm.tar.xz ==="
+mkdir -p test-data
+cat > test-data/instance_metadata.json << 'EOF'
+{
+  "vmSize": "Standard_E4s_v3",
+  "publisher": "SUSE",
+  "offer": "sles-sap-15-sp4-byos",
+  "sku": "gen2",
+  "licenseType": "SLES_BYOS"
+}
+EOF
+mkdir -p test-data/etc
+cat > test-data/etc/os-release << 'EOF'
+NAME="SUSE Linux Enterprise Server"
+VERSION="15-SP4"
+ID="sles"
+ID_LIKE="suse"
+VERSION_ID="15.4"
+PRETTY_NAME="SUSE Linux Enterprise Server 15 SP4"
+EOF
+create_fixture "test-azure-vm"
+
+################################################################################
+# Test 2a: Azure VM PAYG - RHEL with License Type
+################################################################################
+echo ""
+echo "=== Creating test-azure-vm-rhel-payg.tar.xz ==="
+mkdir -p test-data
+cat > test-data/instance_metadata.json << 'EOF'
+{
+  "vmSize": "Standard_E16s_v3",
+  "publisher": "RedHat",
+  "offer": "RHEL-SAP-HA",
+  "sku": "8.2",
+  "billingCode": "Linux_IaaS_Software_RedHat_SAP_HA",
+  "licenseType": "RHEL_SAPHA"
+}
+EOF
+create_fixture "test-azure-vm-rhel-payg"
+
+################################################################################
+# Test 2b: Azure VM BYOS - RHEL with Billing Code
+################################################################################
+echo ""
+echo "=== Creating test-azure-vm-rhel-byos.tar.xz ==="
+mkdir -p test-data
+cat > test-data/instance_metadata.json << 'EOF'
+{
+  "vmSize": "Standard_E16s_v3",
+  "publisher": "RedHat",
+  "offer": "rhel-byos",
+  "sku": "rhel-lvm84",
+  "billingCode": "Linux_IaaS",
+  "licenseType": "N/A"
+}
+EOF
+create_fixture "test-azure-vm-rhel-byos"
+
+################################################################################
+# Test 2c: Azure VM PAYG - SLES with Billing Code
+################################################################################
+echo ""
+echo "=== Creating test-azure-vm-sles-payg.tar.xz ==="
+mkdir -p test-data
+cat > test-data/instance_metadata.json << 'EOF'
+{
+  "vmSize": "Standard_M32ts",
+  "publisher": "SUSE",
+  "offer": "sles-sap-15-sp3",
+  "sku": "gen2",
+  "billingCode": "Linux_IaaS_Software_SLES_for_SAP",
+  "licenseType": "NONE"
+}
+EOF
+create_fixture "test-azure-vm-sles-payg"
+
+################################################################################
+# Test 2d: Azure VM BYOS - Canonical Ubuntu
+################################################################################
+echo ""
+echo "=== Creating test-azure-vm-ubuntu-byos.tar.xz ==="
+mkdir -p test-data
+cat > test-data/instance_metadata.json << 'EOF'
+{
+  "vmSize": "Standard_D4s_v3",
+  "publisher": "Canonical",
+  "offer": "0001-com-ubuntu-server-focal",
+  "sku": "20_04-lts",
+  "billingCode": "Linux_IaaS_Canonical"
+}
+EOF
+create_fixture "test-azure-vm-ubuntu-byos"
+
+################################################################################
+# Test 2e: Azure VM PAYG - Ubuntu Pro
+################################################################################
+echo ""
+echo "=== Creating test-azure-vm-ubuntu-pro.tar.xz ==="
+mkdir -p test-data
+cat > test-data/instance_metadata.json << 'EOF'
+{
+  "vmSize": "Standard_D4s_v3",
+  "publisher": "Canonical",
+  "offer": "0001-com-ubuntu-pro-focal",
+  "sku": "pro-20_04-lts",
+  "licenseType": "UBUNTU_PRO"
+}
+EOF
+create_fixture "test-azure-vm-ubuntu-pro"
+
+################################################################################
+# Test 2f: Azure VM from SCC metadata.txt format (SLES SAP)
+################################################################################
+echo ""
+echo "=== Creating test-azure-vm-scc-metadata.tar.xz ==="
+mkdir -p test-data/public_cloud
+cat > test-data/public_cloud/metadata.txt << 'EOF'
+vmSize: Standard_M64ds_v2
+publisher: SUSE
+offer: sles-sap-15-sp5
+sku: gen2
+billingCode: Linux_IaaS_Software_SLES_for_SAP
+licenseType: SLES_SAP
+EOF
+create_fixture "test-azure-vm-scc-metadata"
+
+################################################################################
+# Test 2g: Distribution detection from crm_report sysinfo.txt
+################################################################################
+echo ""
+echo "=== Creating test-crm-report-sysinfo.tar.xz ==="
+mkdir -p test-data
+cat > test-data/sysinfo.txt << 'EOF'
+#####Cluster info:
+Corosync Cluster Engine, version '2.4.6'
+Copyright (c) 2006-2009 Red Hat, Inc.
+resource-agents: UNKnown
+
+#####Cluster related packages:
+pacemaker 2.1.5+20221208.a3f44794f-150500.6.17.1 - SUSE Linux Enterprise 15 x86_64
+corosync 2.4.6-150300.12.10.1 - SUSE Linux Enterprise 15 x86_64
+resource-agents 4.12.0+git30.7fd7c8fa-150500.3.12.2 - SUSE Linux Enterprise 15 x86_64
+
+#####System info:
+Platform: Linux
+Kernel release: 5.14.21-150500.55.83-default
+Architecture: x86_64
+Distribution: SUSE Linux Enterprise Server 15 SP5
+EOF
+create_fixture "test-crm-report-sysinfo"
+
+# 3. Test for cluster nodes and /etc/hosts validation
+echo ""
+echo "=== Creating test-cluster-nodes.tar.xz ==="
+mkdir -p test-data/etc
+cat > test-data/etc/hosts << 'EOF'
+127.0.0.1   localhost
+10.0.1.10   node1
+10.0.1.11   node2
+EOF
+mkdir -p test-data
+cat > test-data/ha.txt << 'EOF'
+# /etc/hosts
+127.0.0.1   localhost
+10.0.1.10   node1
+10.0.1.11   node2
+10.0.1.12   node3
+#==[ Configuration File ]====
+EOF
+cat > test-data/corosync.conf << 'EOF'
+totem {
+    version: 2
+    cluster_name: hana-cluster
+    token: 30000
+}
+nodelist {
+    node {
+        ring0_addr: node1
+        nodeid: 1
+    }
+    node {
+        ring0_addr: node2
+        nodeid: 2
+    }
+    node {
+        ring0_addr: node3
+        nodeid: 3
+    }
+}
+quorum {
+    provider: corosync_votequorum
+    expected_votes: 3
+}
+EOF
+create_fixture "test-cluster-nodes"
+
+# 4. Test for Corosync configuration
+echo ""
+echo "=== Creating test-corosync-config.tar.xz ==="
+mkdir -p test-data
+cat > test-data/corosync.conf << 'EOF'
+totem {
+    version: 2
+    cluster_name: hana-cluster
+    token: 30000
+    consensus: 36000
+}
+quorum {
+    provider: corosync_votequorum
+    expected_votes: 2
+    two_node: 1
+}
+EOF
+create_fixture "test-corosync-config"
+
+# 5. Test for Pacemaker resources
+echo ""
+echo "=== Creating test-pacemaker-resources.tar.xz ==="
+mkdir -p test-data
+cat > test-data/ha.txt << 'EOF'
+#==[ Command ]====#
+# /usr/sbin/crm_mon -1 -r -f
+Stack: corosync
+Current DC: node1
+Last updated: Wed Nov 13 08:00:00 2025
+2 nodes configured
+3 resources configured
+
+Online: [ node1 node2 ]
+
+Full list of resources:
+
+ rsc_SAPHana_HDB_HDB00  (ocf::heartbeat:SAPHana):      Started node1
+ rsc_ip_HDB_HDB00       (ocf::heartbeat:IPaddr2):      Started node1
+ stonith-sbd            (stonith:external/sbd):        Started node2
+EOF
+create_fixture "test-pacemaker-resources"
+
+# 6. Test for fencing configuration
+echo ""
+echo "=== Creating test-fencing.tar.xz ==="
+mkdir -p test-data
+cat > test-data/ha.txt << 'EOF'
+#==[ Command ]====#
+# /usr/sbin/crm configure show
+property cib-bootstrap-options: \
+    stonith-enabled=true \
+    stonith-timeout=150s
+
+primitive stonith-fence_azure_arm stonith:fence_azure_arm \
+    op monitor interval=3600 timeout=120
+EOF
+create_fixture "test-fencing"
+
+# 6b. Test for fencing configuration (pcs_config format)
+echo ""
+echo "=== Creating test-fencing-pcs.tar.xz ==="
+mkdir -p test-data/sos_commands/pacemaker
+cat > test-data/sos_commands/pacemaker/pcs_config << 'EOF'
+Cluster Name: mycluster
+Corosync Nodes:
+ node1 node2
+Pacemaker Nodes:
+ node1 node2
+
+Resources:
+  Clone: hana_scale_clone
+    Resource: hana_scale (class=ocf provider=suse type=SAPHanaController)
+
+Stonith Devices:
+  Resource: rsc_st_azure (class=stonith type=fence_azure_arm)
+    Attributes: rsc_st_azure-instance_attributes
+      login=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+      pcmk_host_map=node1:vm-node1;node2:vm-node2
+      resourceGroup=myResourceGroup
+      subscriptionId=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+      tenantId=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+    Operations:
+      monitor: rsc_st_azure-monitor-interval-3600
+        interval=3600
+Fencing Levels:
+
+Cluster Properties:
+ cluster-infrastructure: corosync
+ cluster-name: mycluster
+ stonith-enabled: true
+ stonith-timeout: 900
+EOF
+create_fixture "test-fencing-pcs"
+
+# 7. Test for kernel reboot detection
+echo ""
+echo "=== Creating test-kernel-reboots.tar.xz ==="
+mkdir -p test-data
+cat > test-data/messages << 'EOF'
+2025-11-12T23:58:59.000000+01:00 node1 systemd[1]: Shutting down.
+2025-11-13T00:00:15.000000+01:00 node1 kernel: Linux version 5.14.0-284.30.1.el9_2.x86_64 (mockbuild@x86-64) (gcc version 11.3.0) #1 SMP PREEMPT_DYNAMIC
+2025-11-13T00:00:15.000000+01:00 node1 kernel: Command line: BOOT_IMAGE=(hd0,gpt2)/boot/vmlinuz-5.14.0-284.30.1.el9_2.x86_64 root=/dev/mapper/vg_root-lv_root
+2025-11-14T15:30:45.000000+01:00 node1 systemd[1]: Shutting down.
+2025-11-14T15:31:00.000000+01:00 node1 kernel: Linux version 5.14.0-284.30.1.el9_2.x86_64 (mockbuild@x86-64) (gcc version 11.3.0) #1 SMP PREEMPT_DYNAMIC
+2025-11-20T11:32:57.199160-05:00 azlsapzlwdb01 kernel: [    0.000000][    T0] Linux version 5.14.21-150400.24.103-default (geeko@buildhost) (gcc (SUSE Linux) 7.5.0, GNU ld (GNU Binutils; SUSE Linux Enterprise 15) 2.41.0.20230908-150100.7.46) #1 SMP PREEMPT_DYNAMIC Wed Jan 10 13:40:49 UTC 2024 (8afebed)
+EOF
+create_fixture "test-kernel-reboots"
+
+# 8. Test for OOM killer events
+echo ""
+echo "=== Creating test-oom-killer.tar.xz ==="
+mkdir -p test-data
+cat > test-data/messages << 'EOF'
+Nov 13 14:23:45 node1 kernel: hdbindexserver invoked oom-killer: gfp_mask=0x201da, order=0, oom_score_adj=0
+Nov 13 14:23:45 node1 kernel: Out of memory: Killed process 12345 (hdbindexserver) total-vm:32768000kB
+Nov 13 14:23:46 node1 kernel: oom_reaper: reaped process 12345 (hdbindexserver)
+EOF
+create_fixture "test-oom-killer"
+
+# 9. Test for antivirus detection
+echo ""
+echo "=== Creating test-antivirus.tar.xz ==="
+mkdir -p test-data
+cat > test-data/rpm.txt << 'EOF'
+falcon-sensor-7.10.16203.0-1.el8.x86_64
+gpg-pubkey-7f4f6f89-5e9a18de
+EOF
+cat > test-data/ps.txt << 'EOF'
+root      1234  0.0  0.1 123456  7890 ?        Ssl  10:00   0:00 /opt/CrowdStrike/falcon-sensor
+EOF
+mkdir -p test-data/opt/CrowdStrike
+cat > test-data/opt/CrowdStrike/falconctl << 'EOF'
+#!/bin/bash
+echo "CrowdStrike Falcon Sensor Control"
+echo "Version: 7.10.0"
+echo "exclusions: /usr/sap,/hana/shared,/hana/data"
+EOF
+chmod +x test-data/opt/CrowdStrike/falconctl
+create_fixture "test-antivirus"
+
+# 9a. Test for Illumio detection
+echo ""
+echo "=== Creating test-illumio.tar.xz ==="
+mkdir -p test-data/sos_commands/systemd
+cat > test-data/sos_commands/systemd/systemctl_list-units_--all << 'EOF'
+  proc-sys-fs-binfmt_misc.automount                                                                                                                          loaded    active   waiting   Arbitrary Executable File Formats File System Automount Point
+  sys-devices-pci0000:00-0000:00:03.0-virtio0-net-eth0.device                                                                                               loaded    active   plugged   Virtio network device
+  sys-devices-platform-serial8250-tty-ttyS0.device                                                                                                           loaded    active   plugged   /sys/devices/platform/serial8250/tty/ttyS0
+  -.mount                                                                                                                                                    loaded    active   mounted   Root Mount
+  boot-efi.mount                                                                                                                                             loaded    active   mounted   /boot/efi
+  illumio-ven.service                                                                                                                                        loaded    active   exited    Illumio VEN Agent top level startup
+  venAgentMgr.service                                                                                                                                        loaded    active   running   Illumio Agent Manager
+  venAgentMonitor.service                                                                                                                                    loaded    active   running   Illumio Agent Monitor
+  venPlatformHandler.service                                                                                                                                 loaded    active   running   Illumio Platform Handler
+  basic.target                                                                                                                                               loaded    active   active    Basic System
+  cryptsetup.target                                                                                                                                          loaded    active   active    Local Encrypted Volumes
+  getty.target                                                                                                                                               loaded    active   active    Login Prompts
+EOF
+mkdir -p test-data/usr/sap
+mkdir -p test-data/hana/shared
+create_fixture "test-illumio"
+
+# 9b. Test for Trend Micro Deep Security detection
+echo ""
+echo "=== Creating test-trendmicro.tar.xz ==="
+mkdir -p test-data/sos_commands/systemd
+cat > test-data/sos_commands/systemd/systemctl_list-units_--all << 'EOF'
+  proc-sys-fs-binfmt_misc.automount                                                                                                                          loaded    active   waiting   Arbitrary Executable File Formats File System Automount Point
+  sys-devices-pci0000:00-0000:00:03.0-virtio0-net-eth0.device                                                                                               loaded    active   plugged   Virtio network device
+  sys-devices-platform-serial8250-tty-ttyS0.device                                                                                                           loaded    active   plugged   /sys/devices/platform/serial8250/tty/ttyS0
+  -.mount                                                                                                                                                    loaded    active   mounted   Root Mount
+  boot-efi.mount                                                                                                                                             loaded    active   mounted   /boot/efi
+  ds_agent.service                                                                                                                                           loaded    active     running         Trend Micro Deep Security Agent
+  basic.target                                                                                                                                               loaded    active   active    Basic System
+  cryptsetup.target                                                                                                                                          loaded    active   active    Local Encrypted Volumes
+  getty.target                                                                                                                                               loaded    active   active    Login Prompts
+EOF
+mkdir -p test-data/usr/sap
+mkdir -p test-data/hana/shared
+create_fixture "test-trendmicro"
+
+# 9c. Test for DLM service detection
+echo ""
+echo "=== Creating test-dlm-service.tar.xz ==="
+mkdir -p test-data/sos_commands/systemd
+cat > test-data/sos_commands/systemd/systemctl_list-unit-files << 'EOF'
+UNIT FILE                                     STATE
+accounts-daemon.service                       enabled
+acpid.service                                 disabled
+alsa-restore.service                          static
+alsa-state.service                            static
+apparmor.service                              enabled
+auditd.service                                enabled
+autovt@.service                               enabled
+blk-availability.service                      disabled
+cgroup-init.service                           enabled
+chronyd.service                               enabled
+cloud-config.service                          enabled
+cloud-final.service                           enabled
+cloud-init-local.service                      enabled
+cloud-init.service                            enabled
+dlm.service                                   enabled
+getty@.service                                enabled
+grub2-once.service                            static
+haveged.service                               enabled
+EOF
+mkdir -p test-data/etc
+cat > test-data/etc/os-release << 'EOF'
+NAME="Red Hat Enterprise Linux"
+VERSION="8.6 (Ootpa)"
+ID="rhel"
+VERSION_ID="8.6"
+PRETTY_NAME="Red Hat Enterprise Linux 8.6 (Ootpa)"
+EOF
+create_fixture "test-dlm-service"
+
+# 10. Test for live migration events
+echo ""
+echo "=== Creating test-live-migration.tar.xz ==="
+mkdir -p test-data
+cat > test-data/messages << 'EOF'
+2025-11-13T12:15:30.000000+01:00 node1 kernel: hv_vmbus: Vmbus version:4.0
+2025-11-13T12:15:35.000000+01:00 node1 kernel: hv_utils: Heartbeat IC version 3.0
+2025-11-13T12:15:36.000000+01:00 node1 kernel: hv_balloon: Using dynamic memory protocol version 2.0
+2025-11-13T12:15:37.000000+01:00 node1 kernel: hv_netvsc: ring size: 2MB
+2025-11-13T13:45:10.000000+01:00 node1 kernel: hv_utils: Heartbeat IC version 3.0
+2025-11-13T13:45:11.000000+01:00 node1 kernel: hv_balloon: Max. dynamic memory size: 4096 MB
+2025-11-13T13:45:12.000000+01:00 node1 kernel: hv_netvsc: opened device VF
+EOF
+create_fixture "test-live-migration"
+
+################################################################################
+# Test 8: Kernel Tuning Analysis
+# Tests kernel parameter validation with both correct and incorrect values
+################################################################################
+echo ""
+echo "=== Creating test-kernel-tuning.tar.xz ==="
+mkdir -p test-data/sos_commands/kernel
+cat > test-data/sos_commands/kernel/sysctl_-a << 'EOF'
+debug.exception-trace = 1
+debug.kprobes-optimization = 1
+dev.cdrom.autoclose = 1
+dev.cdrom.autoeject = 0
+dev.cdrom.check_media = 0
+dev.cdrom.debug = 0
+dev.cdrom.info = CD-ROM information, Id: cdrom.c 3.20 2003/12/17
+dev.cdrom.info = 
+dev.cdrom.info = drive name:		
+dev.cdrom.info = drive speed:		
+dev.cdrom.info = drive # of slots:	
+dev.cdrom.info = Can close tray:		
+dev.cdrom.lock = 1
+fs.aio-max-nr = 1048576
+fs.aio-nr = 0
+fs.file-max = 9223372036854775807
+fs.file-nr = 1408	0	9223372036854775807
+fs.inode-nr = 48652	354
+fs.inode-state = 48652	354	0	0	0	0	0
+fs.leases-enable = 1
+fs.nr_open = 1048576
+kernel.acct = 4	2	30
+kernel.auto_msgmni = 0
+kernel.cap_last_cap = 37
+kernel.core_pattern = core
+kernel.core_pipe_limit = 0
+kernel.core_uses_pid = 0
+kernel.dmesg_restrict = 0
+kernel.hostname = test-host
+kernel.msgmax = 8192
+kernel.msgmnb = 16384
+kernel.msgmni = 32000
+kernel.osrelease = 4.18.0-425.3.1.el8.x86_64
+kernel.ostype = Linux
+kernel.panic = 0
+kernel.panic_on_oops = 1
+kernel.pid_max = 4194304
+kernel.randomize_va_space = 2
+kernel.real-root-dev = 0
+kernel.sem = 32000	1024000000	500	32000
+kernel.shmall = 1152921504606846720
+kernel.shmmax = 18446744073692774399
+kernel.shmmni = 4096
+kernel.threads-max = 4127428
+kernel.version = #1 SMP Thu Nov 10 15:21:08 UTC 2022
+net.core.netdev_max_backlog = 5000
+net.core.rmem_default = 262144
+net.core.rmem_max = 4194304
+net.core.somaxconn = 4096
+net.core.wmem_default = 262144
+net.core.wmem_max = 1048576
+net.ipv4.ip_local_port_range = 40000	61000
+net.ipv4.tcp_fin_timeout = 60
+net.ipv4.tcp_keepalive_intvl = 75
+net.ipv4.tcp_keepalive_probes = 9
+net.ipv4.tcp_keepalive_time = 7200
+net.ipv4.tcp_max_syn_backlog = 8192
+net.ipv4.tcp_rmem = 4096	87380	6291456
+net.ipv4.tcp_slow_start_after_idle = 1
+net.ipv4.tcp_syn_retries = 6
+net.ipv4.tcp_synack_retries = 5
+net.ipv4.tcp_timestamps = 1
+net.ipv4.tcp_tw_reuse = 2
+net.ipv4.tcp_wmem = 4096	16384	4194304
+sunrpc.tcp_slot_table_entries = 65536
+sunrpc.udp_slot_table_entries = 65536
+user.max_user_namespaces = 15076
+vm.admin_reserve_kbytes = 8192
+vm.dirty_background_bytes = 314572800
+vm.dirty_background_ratio = 10
+vm.dirty_bytes = 629145600
+vm.dirty_expire_centisecs = 3000
+vm.dirty_ratio = 20
+vm.dirty_writeback_centisecs = 500
+vm.max_map_count = 2147483647
+vm.min_free_kbytes = 4096000
+vm.nr_hugepages = 0
+vm.overcommit_memory = 0
+vm.overcommit_ratio = 50
+vm.swappiness = 10
+vm.vfs_cache_pressure = 100
+EOF
+create_fixture "test-kernel-tuning"
+
+################################################################################
+# Test 9: Kernel Tuning with Incorrect Values
+# Tests warning generation for non-optimal kernel parameters
+################################################################################
+echo ""
+echo "=== Creating test-kernel-tuning-warnings.tar.xz ==="
+mkdir -p test-data/sos_commands/kernel
+cat > test-data/sos_commands/kernel/sysctl_-a << 'EOF'
+debug.exception-trace = 1
+fs.file-max = 9223372036854775807
+kernel.hostname = test-host
+kernel.osrelease = 4.18.0-425.3.1.el8.x86_64
+kernel.ostype = Linux
+kernel.pid_max = 4194304
+kernel.sem = 32000	1024000000	500	32000
+kernel.shmall = 1152921504606846720
+kernel.shmmax = 18446744073692774399
+kernel.shmmni = 4096
+net.core.rmem_max = 4194304
+net.core.wmem_max = 1048576
+net.ipv4.ip_local_port_range = 40000	61000
+net.ipv4.tcp_rmem = 4096	87380	6291456
+net.ipv4.tcp_wmem = 4096	16384	4194304
+vm.admin_reserve_kbytes = 8192
+vm.dirty_background_bytes = 100000000
+vm.dirty_background_ratio = 10
+vm.dirty_bytes = 200000000
+vm.dirty_expire_centisecs = 3000
+vm.dirty_ratio = 20
+vm.dirty_writeback_centisecs = 500
+vm.max_map_count = 2147483647
+vm.min_free_kbytes = 4096000
+vm.swappiness = 60
+EOF
+
+create_fixture "test-kernel-tuning-warnings"
+
+################################################################################
+# Test 18b: Huge Pages Configuration
+# Tests detection and display of huge pages (static and transparent)
+################################################################################
+echo ""
+echo "=== Creating test-huge-pages.tar.xz ==="
+
+# Create proc/meminfo with huge pages information
+mkdir -p test-data/proc
+cat > test-data/proc/meminfo << 'EOF'
+MemTotal:       131941632 kB
+MemFree:        120345678 kB
+MemAvailable:   125678901 kB
+Buffers:          123456 kB
+Cached:          5432109 kB
+SwapCached:            0 kB
+Active:          6543210 kB
+Inactive:        2109876 kB
+Active(anon):    1234567 kB
+Inactive(anon):   234567 kB
+Active(file):    5308643 kB
+Inactive(file):  1875309 kB
+Unevictable:           0 kB
+Mlocked:               0 kB
+SwapTotal:       8388604 kB
+SwapFree:        8388604 kB
+Dirty:              1234 kB
+Writeback:             0 kB
+AnonPages:       1234567 kB
+Mapped:           345678 kB
+Shmem:            234567 kB
+KReclaimable:     456789 kB
+Slab:             789012 kB
+SReclaimable:     456789 kB
+SUnreclaim:       332223 kB
+KernelStack:       12345 kB
+PageTables:        45678 kB
+NFS_Unstable:          0 kB
+Bounce:                0 kB
+WritebackTmp:          0 kB
+CommitLimit:    74359420 kB
+Committed_AS:    3456789 kB
+VmallocTotal:   34359738367 kB
+VmallocUsed:       87654 kB
+VmallocChunk:          0 kB
+Percpu:            45678 kB
+HardwareCorrupted:     0 kB
+AnonHugePages:   2097152 kB
+ShmemHugePages:        0 kB
+ShmemPmdMapped:        0 kB
+FileHugePages:         0 kB
+FilePmdMapped:         0 kB
+HugePages_Total:    2048
+HugePages_Free:      512
+HugePages_Rsvd:      128
+HugePages_Surp:        0
+Hugepagesize:       2048 kB
+Hugetlb:         4194304 kB
+DirectMap4k:      524288 kB
+DirectMap2M:    10485760 kB
+DirectMap1G:   123731968 kB
+EOF
+
+# Create sysctl output with huge pages parameters
+mkdir -p test-data/sos_commands/kernel
+cat > test-data/sos_commands/kernel/sysctl_-a << 'EOF'
+debug.exception-trace = 1
+fs.file-max = 9223372036854775807
+kernel.hostname = test-huge-pages
+kernel.osrelease = 5.14.0-284.11.1.el9_2.x86_64
+kernel.ostype = Linux
+kernel.pid_max = 4194304
+kernel.sem = 32000	1024000000	500	32000
+kernel.shmall = 1152921504606846720
+kernel.shmmax = 18446744073692774399
+kernel.shmmni = 4096
+net.core.rmem_max = 4194304
+net.core.wmem_max = 1048576
+vm.admin_reserve_kbytes = 8192
+vm.dirty_background_bytes = 314572800
+vm.dirty_bytes = 629145600
+vm.hugetlb_shm_group = 0
+vm.max_map_count = 2147483647
+vm.min_free_kbytes = 4096000
+vm.nr_hugepages = 2048
+vm.nr_overcommit_hugepages = 512
+vm.swappiness = 10
+EOF
+
+# Create basic SAP indicator
+mkdir -p test-data/usr/sap
+touch test-data/usr/sap/sapservices
+
+create_fixture "test-huge-pages"
+
+################################################################################
+# Test 18c: Huge Pages - No Configuration
+# Tests detection when no huge pages are configured (should show recommendations for SAP)
+################################################################################
+echo ""
+echo "=== Creating test-huge-pages-none.tar.xz ==="
+
+mkdir -p test-data/proc
+cat > test-data/proc/meminfo << 'EOF'
+MemTotal:       65970816 kB
+MemFree:        60123456 kB
+MemAvailable:   62345678 kB
+HugePages_Total:       0
+HugePages_Free:        0
+HugePages_Rsvd:        0
+HugePages_Surp:        0
+Hugepagesize:       2048 kB
+Hugetlb:               0 kB
+AnonHugePages:         0 kB
+ShmemHugePages:        0 kB
+ShmemPmdMapped:        0 kB
+EOF
+
+mkdir -p test-data/sos_commands/kernel
+cat > test-data/sos_commands/kernel/sysctl_-a << 'EOF'
+kernel.hostname = test-no-hugepages
+kernel.osrelease = 5.14.0-284.11.1.el9_2.x86_64
+vm.nr_hugepages = 0
+vm.nr_overcommit_hugepages = 0
+vm.swappiness = 10
+EOF
+
+# Create SAP indicator
+mkdir -p test-data/usr/sap
+touch test-data/usr/sap/sapservices
+
+create_fixture "test-huge-pages-none"
+
+################################################################################
+# Test 19: fstab Display
+# Tests detection and display of /etc/fstab file
+################################################################################
+echo ""
+echo "=== Creating test-fstab.tar.xz ==="
+mkdir -p test-data/etc
+cat > test-data/etc/fstab << 'EOF'
+#
+# /etc/fstab
+# Created by anaconda on Wed Oct 12 14:23:45 2022
+#
+# Accessible filesystems, by reference, are maintained under '/dev/disk/'.
+# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info.
+#
+# After editing this file, run 'systemctl daemon-reload' to update systemd
+# units generated from this file.
+#
+UUID=12345678-1234-1234-1234-123456789abc /                       xfs     defaults        0 0
+UUID=87654321-4321-4321-4321-cba987654321 /boot                   xfs     defaults        0 0
+UUID=abcdef12-3456-7890-abcd-ef1234567890 /data                   xfs     defaults,noatime 0 0
+/dev/mapper/vg_data-lv_backup             /backup                 ext4    defaults        1 2
+tmpfs                                     /dev/shm                tmpfs   defaults        0 0
+EOF
+
+create_fixture "test-fstab"
+
+################################################################################
+# Test 20: Corrupted/Truncated Archive
+# Tests handling of corrupted tar.xz files (truncated at end)
+################################################################################
+echo ""
+echo "=== Creating test-corrupted.tar.xz ==="
+mkdir -p test-data/etc
+cat > test-data/etc/hostname << 'EOF'
+test-corrupted-host
+EOF
+
+mkdir -p test-data/var/log
+cat > test-data/var/log/messages << 'EOF'
+Nov 28 10:00:01 test-host kernel: Linux version 5.14.0
+Nov 28 10:00:02 test-host systemd[1]: Started Session 1 of user root.
+Nov 28 10:00:03 test-host sshd[1234]: Accepted publickey for root
+EOF
+
+# Create the archive normally first
+create_fixture "test-corrupted"
+
+# Now truncate it by removing some blocks from the end
+# Remove last 200 bytes to simulate corruption
+CORRUPTED_FILE="$FIXTURES_DIR/scc_test-corrupted.tar.xz"
+if [ -f "$CORRUPTED_FILE" ]; then
+    FILE_SIZE=$(stat -f%z "$CORRUPTED_FILE" 2>/dev/null || stat -c%s "$CORRUPTED_FILE" 2>/dev/null)
+    # Truncate to 60% of original size to ensure corruption in compressed data
+    TRUNCATE_SIZE=$((FILE_SIZE * 60 / 100))
+    
+    # Only truncate if file is large enough
+    if [ $FILE_SIZE -gt 200 ]; then
+        echo "  Truncating from $FILE_SIZE to $TRUNCATE_SIZE bytes (60%) to simulate corruption..."
+        dd if="$CORRUPTED_FILE" of="${CORRUPTED_FILE}.tmp" bs=1 count=$TRUNCATE_SIZE 2>/dev/null
+        mv "${CORRUPTED_FILE}.tmp" "$CORRUPTED_FILE"
+        echo "[OK] Created corrupted test fixture"
+    else
+        echo "  File too small to truncate, creating larger test data..."
+        # Add more content to make file larger
+        mkdir -p test-data/usr/share/doc
+        for i in {1..20}; do
+            cat > test-data/usr/share/doc/file$i.txt << EOF
+This is test file number $i
+It contains some dummy data to make the archive larger
+So we can properly test corruption handling
+Line 4
+Line 5
+EOF
+        done
+        # Recreate with more data
+        create_fixture "test-corrupted"
+        FILE_SIZE=$(stat -f%z "$CORRUPTED_FILE" 2>/dev/null || stat -c%s "$CORRUPTED_FILE" 2>/dev/null)
+        # Truncate to 60% of original size to ensure corruption in compressed data
+        TRUNCATE_SIZE=$((FILE_SIZE * 60 / 100))
+        echo "  Truncating from $FILE_SIZE to $TRUNCATE_SIZE bytes (60%) to simulate corruption..."
+        dd if="$CORRUPTED_FILE" of="${CORRUPTED_FILE}.tmp" bs=1 count=$TRUNCATE_SIZE 2>/dev/null
+        mv "${CORRUPTED_FILE}.tmp" "$CORRUPTED_FILE"
+        echo "[OK] Created corrupted test fixture"
+    fi
+fi
+
+################################################################################
+# Test for XFS errors with timestamp normalization and deduplication
+################################################################################
+echo ""
+echo "=== Creating test-xfs-errors.tar.xz ==="
+mkdir -p test-data
+cat > test-data/messages << 'EOF'
+Dec  2 15:07:09 testhost kernel: XFS (sda1): Metadata I/O Error: block 0x12345 ("xfs_trans_read_buf_map") error 5 numblks 8
+Dec  2 15:07:10 testhost kernel: XFS (sda1): xfs_do_force_shutdown(0x1) called from line 1234 of file fs/xfs/xfs_buf.c. Return address = 0xffffffffc0123456
+Dec  2 15:07:11 testhost kernel: XFS (sdb2): Internal error xfs_trans_cancel at line 987 of file fs/xfs/xfs_trans.c. Caller xfs_create+0x456/0x789
+Dec  3 08:45:23 testhost kernel: XFS (sdc3): Corruption detected. Unmount and run xfs_repair
+Dec  3 08:45:24 testhost kernel: XFS (sdc3): corrupt dinode 123456, extent total = 1, nblocks = 10
+Dec  4 12:33:07 testhost kernel: XFS (sdk4): Found unrecovered unlinked inode 0xb75 in AG 0x4.  Initiating recovery.
+EOF
+
+# Create rotated log with duplicate entries (different day format to test normalization)
+cat > test-data/messages-1 << 'EOF'
+Dec 02 15:07:09 testhost kernel: XFS (sda1): Metadata I/O Error: block 0x12345 ("xfs_trans_read_buf_map") error 5 numblks 8
+Dec 02 15:07:10 testhost kernel: XFS (sda1): xfs_do_force_shutdown(0x1) called from line 1234 of file fs/xfs/xfs_buf.c. Return address = 0xffffffffc0123456
+Dec 01 12:30:45 testhost kernel: XFS (sdd4): log I/O error -5
+EOF
+
+# Create another rotated log
+cat > test-data/messages-2 << 'EOF'
+Nov 30 18:22:11 testhost kernel: XFS (sde5): metadata I/O error in "xfs_btree_read_buf_block" at daddr 0xabcdef
+EOF
+
+create_fixture "test-xfs-errors"
+
+################################################################################
+# Test for XFS errors with single-digit vs zero-padded days
+################################################################################
+echo ""
+echo "=== Creating test-xfs-timestamp-normalization.tar.xz ==="
+mkdir -p test-data
+cat > test-data/messages << 'EOF'
+Dec  5 10:15:30 node1 kernel: XFS (nvme0n1p1): Corruption warning: inode 456789
+Dec  5 10:15:31 node1 kernel: XFS (nvme0n1p1): Internal error XFS_WANT_CORRUPTED_GOTO at line 2345
+EOF
+
+cat > test-data/messages-1 << 'EOF'
+Dec 05 10:15:30 node1 kernel: XFS (nvme0n1p1): Corruption warning: inode 456789
+Dec 05 10:15:31 node1 kernel: XFS (nvme0n1p1): Internal error XFS_WANT_CORRUPTED_GOTO at line 2345
+EOF
+
+create_fixture "test-xfs-timestamp-normalization"
+
+################################################################################
+# Test for XFS duplicate UUID errors
+################################################################################
+echo ""
+echo "=== Creating test-xfs-duplicate-uuid.tar.xz ==="
+mkdir -p test-data
+cat > test-data/messages << 'EOF'
+Dec  3 17:37:06 vmcdfaccdrmigoradbqa01 kernel: XFS (sde1): Filesystem has duplicate UUID ac560ede-78b1-4d66-b199-2c1284ad1aaf - can't mount
+Dec  3 17:37:07 vmcdfaccdrmigoradbqa01 kernel: XFS (sdf1): Filesystem has duplicate UUID f1234567-89ab-cdef-0123-456789abcdef - can't mount
+EOF
+
+create_fixture "test-xfs-duplicate-uuid"
+
+################################################################################
+# Test: Azure Network Tuning - Correctly Configured
+# Tests detection of properly configured Azure Network optimization parameters
+################################################################################
+echo ""
+echo "=== Creating test-azure-network-tuned.tar.xz ==="
+mkdir -p test-data/sos_commands/kernel
+cat > test-data/sos_commands/kernel/sysctl_-a << 'EOF'
+kernel.hostname = test-host
+kernel.osrelease = 5.14.0-362.8.1.el9_3.x86_64
+kernel.ostype = Linux
+net.core.busy_poll = 50
+net.core.busy_read = 50
+net.core.rmem_default = 33554432
+net.core.rmem_max = 134217728
+net.core.wmem_default = 33554432
+net.core.wmem_max = 134217728
+net.ipv4.tcp_congestion_control = bbr
+net.ipv4.tcp_mem = 4096	87380	67108864
+net.ipv4.tcp_rmem = 4096	87380	67108864
+net.ipv4.tcp_wmem = 4096	65536	67108864
+net.ipv4.udp_mem = 4096	87380	33554432
+net.ipv4.udp_rmem_min = 16384
+net.ipv4.udp_wmem_min = 16384
+vm.swappiness = 60
+EOF
+
+create_fixture "test-azure-network-tuned"
+
+################################################################################
+# Test: Azure Network Tuning - Needs Adjustment
+# Tests detection of Azure Network parameters that need adjustment
+################################################################################
+echo ""
+echo "=== Creating test-azure-network-warnings.tar.xz ==="
+mkdir -p test-data/sos_commands/kernel
+cat > test-data/sos_commands/kernel/sysctl_-a << 'EOF'
+kernel.hostname = test-host
+kernel.osrelease = 5.14.0-362.8.1.el9_3.x86_64
+kernel.ostype = Linux
+net.core.busy_poll = 0
+net.core.busy_read = 0
+net.core.rmem_default = 262144
+net.core.rmem_max = 4194304
+net.core.wmem_default = 262144
+net.core.wmem_max = 1048576
+net.ipv4.tcp_congestion_control = cubic
+net.ipv4.tcp_mem = 4096	87380	4194304
+net.ipv4.tcp_rmem = 4096	87380	6291456
+net.ipv4.tcp_wmem = 4096	16384	4194304
+net.ipv4.udp_mem = 4096	87380	4194304
+net.ipv4.udp_rmem_min = 4096
+net.ipv4.udp_wmem_min = 4096
+vm.swappiness = 60
+EOF
+
+create_fixture "test-azure-network-warnings"
+
+################################################################################
+# Test: Optional Network Tuning - Mixed Configuration
+# Tests detection of optional network parameters with mixed values
+################################################################################
+echo ""
+echo "=== Creating test-optional-network-tuning.tar.xz ==="
+mkdir -p test-data/sos_commands/kernel
+cat > test-data/sos_commands/kernel/sysctl_-a << 'EOF'
+kernel.hostname = test-host
+kernel.osrelease = 5.14.0-362.8.1.el9_3.x86_64
+kernel.ostype = Linux
+net.core.default_qdisc = fq
+net.core.dev_weight = 64
+net.core.netdev_budget = 1000
+net.core.netdev_max_backlog = 32768
+net.core.optmem_max = 65535
+net.core.somaxconn = 32768
+net.ipv4.ip_local_port_range = 1024	65535
+net.ipv4.tcp_frto = 0
+net.ipv4.tcp_timestamps = 0
+net.ipv4.tcp_tw_reuse = 1
+vm.swappiness = 60
+EOF
+
+create_fixture "test-optional-network-tuning"
+
+################################################################################
+# Test: Complete Network Tuning - All Parameters
+# Tests detection of all Azure and optional network parameters configured correctly
+################################################################################
+echo ""
+echo "=== Creating test-complete-network-tuning.tar.xz ==="
+mkdir -p test-data/sos_commands/kernel
+cat > test-data/sos_commands/kernel/sysctl_-a << 'EOF'
+kernel.hostname = test-host
+kernel.osrelease = 5.14.0-362.8.1.el9_3.x86_64
+kernel.ostype = Linux
+net.core.busy_poll = 50
+net.core.busy_read = 50
+net.core.default_qdisc = fq
+net.core.dev_weight = 64
+net.core.netdev_budget = 1000
+net.core.netdev_max_backlog = 32768
+net.core.optmem_max = 65535
+net.core.rmem_default = 33554432
+net.core.rmem_max = 134217728
+net.core.somaxconn = 32768
+net.core.wmem_default = 33554432
+net.core.wmem_max = 134217728
+net.ipv4.ip_local_port_range = 1024	65535
+net.ipv4.tcp_congestion_control = bbr
+net.ipv4.tcp_frto = 0
+net.ipv4.tcp_mem = 4096	87380	67108864
+net.ipv4.tcp_rmem = 4096	87380	67108864
+net.ipv4.tcp_timestamps = 1
+net.ipv4.tcp_tw_reuse = 1
+net.ipv4.tcp_wmem = 4096	65536	67108864
+net.ipv4.udp_mem = 4096	87380	33554432
+net.ipv4.udp_rmem_min = 16384
+net.ipv4.udp_wmem_min = 16384
+vm.swappiness = 60
+EOF
+
+create_fixture "test-complete-network-tuning"
+
+# Test for raw RPM package list display
+echo ""
+echo "=== Creating sosreport-rpm-raw.tar.xz ==="
+mkdir -p sosreport-rpm-raw/sos_commands/dnf
+cat > sosreport-rpm-raw/sos_commands/dnf/dnf_list_installed << 'EOF'
+Updating Subscription Management repositories.
+Unable to read consumer identity
+Installed Packages
+GConf2.x86_64                          3.2.6-22.el8                           @rhel-8-for-x86_64-appstream-rpms
+LibRaw.x86_64                          0.19.5-3.el8                           @rhui-rhel-8-for-x86_64-appstream-rhui-rpms
+ModemManager-glib.x86_64               1.10.8-4.el8                           @rhel-8-for-x86_64-baseos-rpms
+NetworkManager.x86_64                  1:1.40.16-4.el8_9                      @rhui-rhel-8-for-x86_64-baseos-rhui-rpms
+NetworkManager-libnm.x86_64            1:1.40.16-4.el8_9                      @rhui-rhel-8-for-x86_64-baseos-rhui-rpms
+PackageKit.x86_64                      1.1.12-6.el8                           @rhel-8-for-x86_64-appstream-rpms
+PackageKit-glib.x86_64                 1.1.12-6.el8                           @rhel-8-for-x86_64-appstream-rpms
+acl.x86_64                             2.2.53-1.el8                           @rhel-8-for-x86_64-baseos-rpms
+bash.x86_64                            4.4.20-4.el8_6                         @rhui-rhel-8-for-x86_64-baseos-rhui-rpms
+bash-completion.noarch                 1:2.7-5.el8                            @rhel-8-for-x86_64-baseos-rpms
+bind-export-libs.x86_64                32:9.11.36-8.el8_8.2                   @rhui-rhel-8-for-x86_64-baseos-rhui-rpms
+binutils.x86_64                        2.30-119.el8                           @rhui-rhel-8-for-x86_64-baseos-rhui-rpms
+bzip2.x86_64                           1.0.6-26.el8                           @rhel-8-for-x86_64-baseos-rpms
+ca-certificates.noarch                 2023.2.60_v7.0.306-80.0.el8_8          @rhui-rhel-8-for-x86_64-baseos-rhui-rpms
+EOF
+tar -cJf "$FIXTURES_DIR/sosreport-rpm-raw.tar.xz" sosreport-rpm-raw
+rm -rf sosreport-rpm-raw
+echo "[OK] Created sosreport-rpm-raw (14 packages)"
+
+# Test for raw YUM package list display (RHEL 7 style)
+echo ""
+echo "=== Creating sosreport-yum-raw.tar.xz ==="
+mkdir -p sosreport-yum-raw/sos_commands/yum
+cat > sosreport-yum-raw/sos_commands/yum/yum_list_installed << 'EOF'
+Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-
+              : manager
+Repository packages-microsoft-com-prod is listed more than once in the configuration
+Installed Packages
+BladeLogic_RSCD_Agent.x86_64        24.4.01-59               installed          
+GConf2.x86_64                       3.2.6-8.el7              @DVD               
+GeoIP.x86_64                        1.5.0-14.el7             @DVD               
+ModemManager.x86_64                 1.6.10-4.el7             @DVD               
+NetworkManager.x86_64               1:1.18.8-2.el7_9         @repo/$releasever  
+NetworkManager-glib.x86_64          1:1.18.8-2.el7_9         @repo/$releasever  
+PackageKit.x86_64                   1.1.10-2.el7             @DVD               
+PackageKit-glib.x86_64              1.1.10-2.el7             @DVD               
+PyYAML.x86_64                       3.10-11.el7              @DVD               
+acl.x86_64                          2.2.51-15.el7            @DVD               
+bash.x86_64                         4.2.46-35.el7_9          @repo/$releasever  
+bind-export-libs.x86_64             32:9.11.4-26.P2.el7_9.15 @repo/$releasever  
+binutils.x86_64                     2.27-44.base.el7_9.1     @repo/$releasever  
+bzip2.x86_64                        1.0.6-13.el7             @DVD               
+ca-certificates.noarch              2022.2.54-74.el7_9       @repo/$releasever  
+EOF
+tar -cJf "$FIXTURES_DIR/sosreport-yum-raw.tar.xz" sosreport-yum-raw
+rm -rf sosreport-yum-raw
+echo "[OK] Created sosreport-yum-raw (15 packages)"
+
+# Test for raw DEB package list display
+echo ""
+echo "=== Creating sosreport-deb-raw.tar.xz ==="
+mkdir -p sosreport-deb-raw/sos_commands/dpkg
+cat > sosreport-deb-raw/sos_commands/dpkg/dpkg_-l << 'EOF'
+Desired=Unknown/Install/Remove/Purge/Hold
+| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
+|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
+||/ Name                          Version                      Architecture Description
++++-=============================-============================-============-===============================================================================
+ii  accountsservice               0.6.55-0ubuntu12~20.04.7     amd64        query and manipulate user account information
+ii  acl                           2.2.53-6                     amd64        access control list - utilities
+ii  adduser                       3.118ubuntu2                 all          add and remove users and groups
+ii  apparmor                      2.13.3-7ubuntu5.3            amd64        user-space parser utility for AppArmor
+ii  apt                           2.0.10                       amd64        commandline package manager
+ii  apt-utils                     2.0.10                       amd64        package management related utility programs
+ii  base-files                    11ubuntu5.8                  amd64        Debian base system miscellaneous files
+ii  base-passwd                   3.5.47                       amd64        Debian base system master password and group files
+ii  bash                          5.0-6ubuntu1.2               amd64        GNU Bourne Again SHell
+ii  bash-completion               1:2.10-1ubuntu1              all          programmable completion for the bash shell
+ii  bind9-dnsutils                1:9.16.1-0ubuntu2.16         amd64        Clients provided with BIND 9
+ii  bsdutils                      1:2.34-0.1ubuntu9.6          amd64        basic utilities from 4.4BSD-Lite
+ii  busybox-initramfs             1:1.30.1-4ubuntu6.5          amd64        Standalone shell setup for initramfs
+ii  bzip2                         1.0.8-2                      amd64        high-quality block-sorting file compressor - utilities
+ii  ca-certificates               20230311ubuntu0.20.04.1      all          Common CA certificates
+ii  cloud-init                    24.1.3-0ubuntu1~20.04.4      all          Init scripts for cloud instances
+ii  coreutils                     8.30-3ubuntu2                amd64        GNU core utilities
+ii  cpio                          2.13+dfsg-2ubuntu0.4         amd64        GNU cpio -- a program to manage archives of files
+ii  cron                          3.0pl1-136ubuntu1            amd64        process scheduling daemon
+ii  curl                          7.68.0-1ubuntu2.22           amd64        command line tool for transferring data with URL syntax
+ii  dbus                          1.12.16-2ubuntu2.3           amd64        simple interprocess messaging system (daemon and utilities)
+ii  systemd                       245.4-4ubuntu3.23            amd64        system and service manager
+EOF
+tar -cJf "$FIXTURES_DIR/sosreport-deb-raw.tar.xz" sosreport-deb-raw
+rm -rf sosreport-deb-raw
+echo "[OK] Created sosreport-deb-raw (22 packages)"
+
+################################################################################
+# RPM.txt (SUSE supportconfig format) – exercises rpm.txt parsing with
+# section headers (# rpm -qa --queryformat) and section terminators
+################################################################################
+echo ""
+echo "=== Creating sosreport-rpm-txt-scc.tar.xz ==="
+mkdir -p sosreport-rpm-txt-scc
+cat > sosreport-rpm-txt-scc/rpm.txt << 'RPMSCC'
+#==[ Command ]======================================#
+# rpm -qa --queryformat '%{NAME} - %{DISTRIBUTION} - %{VERSION}\n'
+NAME                                   DISTRIBUTION                       VERSION
+SUSE_SLE-15-SP5_Update                 (none)                             15.5
+aaa_base                               SUSE Linux Enterprise 15           84.87+git20180409
+bash                                   SUSE Linux Enterprise 15           4.4
+glibc                                  SUSE Linux Enterprise 15           2.31
+kernel-default                         SUSE Linux Enterprise 15           5.14.21
+cloud-netconfig-azure                  SUSE Linux Enterprise 15           1.5
+resource-agents                        SUSE Linux Enterprise 15           4.8.0
+fence-agents                           SUSE Linux Enterprise 15           4.10.0
+#==[ Command ]======================================#
+# rpm -qa --queryformat '%{NAME} %{SIGPGP:pgpsig}\n'
+some-other-section-data
+RPMSCC
+tar -cJf "$FIXTURES_DIR/sosreport-rpm-txt-scc.tar.xz" sosreport-rpm-txt-scc
+rm -rf sosreport-rpm-txt-scc
+echo "[OK] Created sosreport-rpm-txt-scc (7 packages)"
+
+################################################################################
+# installed-rpms (RHEL sosreport format) – exercises RPM version validation:
+# version too old (fence-agents), problematic range (python3-azure-core),
+# valid packages, and missing packages
+################################################################################
+echo ""
+echo "=== Creating sosreport-installed-rpms.tar.xz ==="
+mkdir -p sosreport-installed-rpms/sos_commands/rpm
+cat > sosreport-installed-rpms/installed-rpms << 'RPMINST'
+fence-agents-4.2.1-30.el8.x86_64
+python3-azure-mgmt-compute-21.0.0-1.el8.noarch
+python3-azure-identity-1.5.0-2.el8.noarch
+python3-azure-core-1.15.0-1.el8.noarch
+resource-agents-4.9.0-12.el8.x86_64
+bash-4.4.20-4.el8.x86_64
+glibc-2.28-236.el8.x86_64
+kernel-4.18.0-553.89.1.el8_10.x86_64
+RPMINST
+# Include corosync.conf so the UI renders Azure package validation results
+mkdir -p sosreport-installed-rpms/etc/corosync
+cat > sosreport-installed-rpms/etc/corosync/corosync.conf << 'COROCONF'
+totem {
+    version: 2
+    transport: udpu
+}
+nodelist {
+    node {
+        ring0_addr: 10.0.0.4
+        name: node1
+        nodeid: 1
+    }
+}
+COROCONF
+tar -cJf "$FIXTURES_DIR/sosreport-installed-rpms.tar.xz" sosreport-installed-rpms
+rm -rf sosreport-installed-rpms
+echo "[OK] Created sosreport-installed-rpms (8 packages)"
+
+# Test for Azure VM with Ultra Disk and Premium SSD v2
+echo ""
+echo "=== Creating test-azure-vm-storage.tar.xz ==="
+mkdir -p test-data
+cat > test-data/instance_metadata.json << 'EOF'
+{
+  "compute": {
+    "vmSize": "Standard_E32s_v3",
+    "publisher": "SUSE",
+    "offer": "sles-sap-15-sp5",
+    "sku": "gen2",
+    "licenseType": "SLES",
+    "storageProfile": {
+      "osDisk": {
+        "name": "osdisk",
+        "managedDisk": {
+          "storageAccountType": "Premium_LRS"
+        }
+      },
+      "dataDisks": [
+        {
+          "lun": 0,
+          "name": "hana-data",
+          "diskSizeGB": 512,
+          "managedDisk": {
+            "storageAccountType": "UltraSSD_LRS"
+          }
+        },
+        {
+          "lun": 1,
+          "name": "hana-log",
+          "diskSizeGB": 256,
+          "managedDisk": {
+            "storageAccountType": "PremiumV2_LRS"
+          }
+        },
+        {
+          "lun": 2,
+          "name": "hana-shared",
+          "diskSizeGB": 1024,
+          "managedDisk": {
+            "storageAccountType": "Premium_LRS"
+          }
+        }
+      ]
+    }
+  }
+}
+EOF
+create_fixture "test-azure-vm-storage"
+
+################################################################################
+# Test: Azure Site Recovery (involflt) detection
+################################################################################
+echo ""
+echo "=== Creating test-asr.tar.xz ==="
+mkdir -p test-data
+
+# Create systemd-status.txt with involflt_start service
+cat > test-data/systemd-status.txt << 'EOF'
+#==[ Command ]======================================#
+# /bin/systemctl status --all
+● involflt_start.service - InMage Filter Driver Start Service
+   Loaded: loaded (/etc/systemd/system/involflt_start.service; enabled; vendor preset: disabled)
+   Active: active (exited) since Sun 2025-10-12 05:15:04 UTC; 3 months ago
+  Process: 497 ExecStart=/sbin/involflt_init.sh start (code=exited, status=0/SUCCESS)
+ Main PID: 497 (code=exited, status=0/SUCCESS)
+    Tasks: 0
+   Memory: 0B
+   CGroup: /system.slice/involflt_start.service
+
+Oct 12 05:15:02 p1laasspcr005 systemd[1]: Starting InMage Filter Driver Start Service...
+Oct 12 05:15:04 p1laasspcr005 systemd[1]: Started InMage Filter Driver Start Service.
+
+● systemd-journald.service - Journal Service
+   Loaded: loaded (/usr/lib/systemd/system/systemd-journald.service; static; vendor preset: disabled)
+   Active: active (running) since Sun 2025-10-12 05:15:02 UTC; 3 months ago
+     Docs: man:systemd-journald.service(8)
+           man:journald.conf(5)
+ Main PID: 265 (systemd-journal)
+   Status: "Processing requests..."
+    Tasks: 1
+   Memory: 43.8M
+   CGroup: /system.slice/systemd-journald.service
+           └─265 /usr/lib/systemd/systemd-journald
+EOF
+
+# Create modules.txt with involflt module information
+cat > test-data/modules.txt << 'EOF'
+#==[ Command ]======================================#
+# /sbin/lsmod
+Module                  Size  Used by
+involflt              897024  14
+xt_CHECKSUM            16384  1
+ipt_MASQUERADE         16384  3
+xt_conntrack           16384  1
+ipt_REJECT             16384  2
+nf_reject_ipv4         16384  1 ipt_REJECT
+
+#==[ Command ]======================================#
+# /sbin/modinfo involflt
+filename:       /lib/modules/5.14.21-150400.24.173-default/kernel/drivers/char/involflt.ko
+version:        Oct 23 2024 [ 02:41:25 ]
+license:        GPL v2
+description:    Microsoft Filter Driver
+author:         Microsoft Corporation
+srcversion:     E4F8D9C3A1B2F0E5A6D7C89
+alias:          char-major-10-237
+depends:        
+retpoline:      Y
+name:           involflt
+vermagic:       5.14.21-150400.24.173-default SMP mod_unload modversions 
+
+#==[ Command ]======================================#
+# /sbin/modprobe -c
+EOF
+
+# Create messages.txt with involflt kernel log version
+cat > test-data/messages-20251013.txt << 'EOF'
+Oct 12 05:15:01 p1laasspcr005 kernel: Linux version 5.14.21-150400.24.173-default (geeko@buildhost) (gcc (SUSE Linux) 7.5.0, GNU ld (GNU Binutils; SUSE Linux Enterprise 15) 2.37) #1 SMP PREEMPT_DYNAMIC Tue Aug 13 09:20:16 UTC 2024 (c6c0d6b)
+Oct 12 05:15:02 p1laasspcr005 kernel: Command line: BOOT_IMAGE=/boot/vmlinuz-5.14.21-150400.24.173-default root=UUID=a1b2c3d4-e5f6-7890-abcd-ef1234567890 console=ttyS0,115200n8 earlyprintk=ttyS0,115200 rootdelay=300
+Oct 12 05:15:02 p1laasspcr005 kernel: involflt: loading out-of-tree module taints kernel.
+Oct 12 05:15:02 p1laasspcr005 kernel: involflt: module verification failed: signature and/or required key missing - tainting kernel
+Oct 12 05:15:02 p1laasspcr005 kernel: involflt[involflt_init:3458 (INFO)]: Version - 9.63.1.7235
+Oct 12 05:15:02 p1laasspcr005 kernel: involflt[alloc_data_pages:687 (INFO)]: Data Mode Init: Allocated pages 16384 Page size 4096
+Oct 12 05:15:02 p1laasspcr005 kernel: involflt[alloc_data_pages:687 (INFO)]: Data Mode Init: Allocated pages 2044160 Page size 4096
+Oct 12 05:15:02 p1laasspcr005 kernel: involflt[init_work_queue:151 (INFO)]: worker thread with pid = 507  has created
+Oct 12 05:15:02 p1laasspcr005 kernel: involflt[init_work_queue:151 (INFO)]: worker thread with pid = 508  has created
+Oct 12 05:15:02 p1laasspcr005 kernel: involflt[create_service_thread:65 (INFO)]: kernel thread with pid = 509 has created
+Oct 12 05:15:02 p1laasspcr005 kernel: involflt[create_alloc_thread:1859 (INFO)]: inmallocd thread with pid = 510 has created
+Oct 12 05:15:02 p1laasspcr005 kernel: involflt[involflt_init:3527 (INFO)]: Mirror capability is not supported by involflt driver
+Oct 12 05:15:02 p1laasspcr005 kernel: involflt[involflt_init:3548 (INFO)]: Successfully loaded involflt target module from initrd
+Oct 12 05:15:04 p1laasspcr005 systemd[1]: Started InMage Filter Driver Start Service.
+EOF
+
+create_fixture "test-asr"
+
+# Test for automation detection (Ansible)
+echo ""
+echo "=== Creating test-automation.tar.xz ==="
+mkdir -p test-data
+cat > test-data/messages.txt << 'EOF'
+Dec 18 10:15:23 testhost kernel: Linux version 5.14.0-427.13.1.el9_4.x86_64 (mockbuild@x86-64-01.build.eng.rdu2.redhat.com)
+Dec 18 10:20:45 testhost ansible-command: Invoked with creates=None executable=None chdir=/tmp warn=True stdin_add_newline=True strip_empty_ends=True argv=None removes=None
+Dec 18 10:20:46 testhost ansible-command: /usr/bin/python3 /tmp/ansible-playbook-test.py
+Dec 18 10:25:30 testhost systemd[1]: Started Session 123 of user root.
+Dec 18 10:30:15 testhost ansible-command: Running command: yum install -y httpd
+Dec 18 10:35:22 testhost ansible-command: Invoked with name=httpd state=started enabled=yes
+Dec 18 10:40:10 testhost ansible-command: Invoked with path=/etc/httpd/conf/httpd.conf regexp=^Listen line=Listen 8080
+Dec 18 11:00:00 testhost systemd[1]: Stopping firewalld - dynamic firewall daemon...
+EOF
+
+create_fixture "test-automation"
+
+################################################################################
+# Test: Nested gzip decompression with multiple rotated cluster logs
+################################################################################
+echo ""
+echo "=== Creating test-nested-gzip.tar.xz ==="
+mkdir -p test-data/var/log/pacemaker
+mkdir -p test-data/var/log/cluster
+
+# Create pacemaker log files with cluster events and compress them
+cat > test-data/var/log/pacemaker/pacemaker.log-20250101 << 'EOF'
+Jan 01 10:15:30 node01 pacemaker-controld[12345] (do_state_transition) notice: State transition S_IDLE -> S_POLICY_ENGINE
+Jan 01 10:15:31 node01 pacemaker-controld[12345] (do_lrm_rsc_op) notice: Operation testip_stop_0: ok (node=node01)
+Jan 01 10:15:32 node01 pacemaker-controld[12345] (do_lrm_rsc_op) notice: Operation testip_start_0: ok (node=node02)
+EOF
+gzip test-data/var/log/pacemaker/pacemaker.log-20250101
+
+cat > test-data/var/log/pacemaker/pacemaker.log-20250102 << 'EOF'
+Jan 02 14:22:10 node02 pacemaker-controld[12346] (do_state_transition) notice: State transition S_IDLE -> S_POLICY_ENGINE
+Jan 02 14:22:11 node02 pacemaker-controld[12346] (do_lrm_rsc_op) notice: Operation sapdb_stop_0: ok (node=node02)
+Jan 02 14:22:12 node02 pacemaker-controld[12346] (do_lrm_rsc_op) notice: Operation sapdb_start_0: ok (node=node01)
+EOF
+gzip test-data/var/log/pacemaker/pacemaker.log-20250102
+
+cat > test-data/var/log/pacemaker/pacemaker.log-20250103 << 'EOF'
+Jan 03 08:45:20 node01 pacemaker-controld[12347] (do_state_transition) notice: State transition S_IDLE -> S_POLICY_ENGINE
+Jan 03 08:45:21 node01 pacemaker-controld[12347] (do_lrm_rsc_op) notice: Operation filesystem_stop_0: ok (node=node01)
+Jan 03 08:45:22 node01 pacemaker-controld[12347] (do_lrm_rsc_op) notice: Operation filesystem_start_0: ok (node=node02)
+EOF
+gzip test-data/var/log/pacemaker/pacemaker.log-20250103
+
+# Create corosync log files with cluster events and compress them
+cat > test-data/var/log/cluster/corosync.log-20250101 << 'EOF'
+Jan 01 10:15:28 [QUORUM] Members[2]: 1 2
+Jan 01 10:15:29 [TOTEM ] A processor joined or left the membership and a new membership was formed.
+Jan 01 10:15:30 [CPG   ] Process 12345 joined group pacemaker
+EOF
+gzip test-data/var/log/cluster/corosync.log-20250101
+
+cat > test-data/var/log/cluster/corosync.log-20250102 << 'EOF'
+Jan 02 14:22:08 [QUORUM] Members[2]: 1 2
+Jan 02 14:22:09 [TOTEM ] A processor joined or left the membership and a new membership was formed.
+Jan 02 14:22:10 [CPG   ] Process 12346 joined group pacemaker
+EOF
+gzip test-data/var/log/cluster/corosync.log-20250102
+
+# Create archive content statistics file
+cat > test-data/archive-info.txt << 'EOF'
+This archive contains 5 compressed log files (.gz):
+- 3 pacemaker.log files
+- 2 corosync.log files
+All files should be decompressed and analyzed for cluster events.
+EOF
+
+create_fixture "test-nested-gzip"
+
+# 31. Test for LVM configuration
+echo ""
+echo "=== Creating test-lvm.tar.xz ==="
+mkdir -p test-data/lvm
+
+cat > test-data/lvm/pvs.txt << 'EOF'
+  PV         VG        Fmt  Attr PSize   PFree 
+  /dev/sda2  rootvg    lvm2 a--  <19.00g 12.00g
+  /dev/sdb1  datavg    lvm2 a--  100.00g 40.00g
+  /dev/sdc1            lvm2 ---  50.00g  50.00g
+EOF
+
+cat > test-data/lvm/vgs.txt << 'EOF'
+  VG     #PV #LV #SN Attr   VSize    VFree 
+  rootvg   1   2   0 wz--n- <19.00g  12.00g
+  datavg   1   3   0 wz--n- 100.00g  40.00g
+  missingvg 2  1   0 wz-pn-  80.00g  10.00g
+EOF
+
+cat > test-data/lvm/lvs.txt << 'EOF'
+  LV     VG     Attr       LSize  Pool Origin Data%  Meta%  Move Log Cpy%Sync Convert
+  root   rootvg -wi-ao---- 15.00g                                                    
+  swap   rootvg -wi-ao----  2.00g                                                    
+  app    datavg -wi-ao---- 20.00g                                                    
+  data   datavg -wi-ao---- 30.00g                                                    
+  backup datavg -wi-ao---- 10.00g                                                    
+  db     missingvg -wi-a-----  70.00g
+EOF
+
+cat > test-data/lvm/pvdisplay.txt << 'EOF'
+  --- Physical volume ---
+  PV Name               /dev/sda2
+  VG Name               rootvg
+  PV Size               19.00 GiB / not usable 4.00 MiB
+  Allocatable           yes 
+  PE Size               4.00 MiB
+  Total PE              4863
+  Free PE               3072
+  Allocated PE          1791
+  
+  --- Physical volume ---
+  PV Name               /dev/sdb1
+  VG Name               datavg
+  PV Size               100.00 GiB
+  Allocatable           yes 
+  PE Size               4.00 MiB
+  Total PE              25600
+  Free PE               10240
+  Allocated PE          15360
+  
+  "/dev/sdc1" is a new physical volume of "50.00 GiB"
+  --- NEW Physical volume ---
+  PV Name               /dev/sdc1
+  VG Name               
+  PV Size               50.00 GiB
+  Allocatable           NO
+  PE Size               0   
+  Total PE              0
+  Free PE               0
+  Allocated PE          0
+EOF
+
+cat > test-data/lvm/vgdisplay.txt << 'EOF'
+  --- Volume group ---
+  VG Name               rootvg
+  System ID             
+  Format                lvm2
+  Metadata Areas        1
+  Metadata Sequence No  3
+  VG Access             read/write
+  VG Status             resizable
+  MAX LV                0
+  Cur LV                2
+  Open LV               2
+  Max PV                0
+  Cur PV                1
+  Act PV                1
+  VG Size               <19.00 GiB
+  PE Size               4.00 MiB
+  Total PE              4863
+  Alloc PE / Size       1791 / 7.00 GiB
+  Free  PE / Size       3072 / 12.00 GiB
+  
+  --- Volume group ---
+  VG Name               datavg
+  System ID             
+  Format                lvm2
+  Metadata Areas        1
+  Metadata Sequence No  4
+  VG Access             read/write
+  VG Status             resizable
+  MAX LV                0
+  Cur LV                3
+  Open LV               3
+  Max PV                0
+  Cur PV                1
+  Act PV                1
+  VG Size               100.00 GiB
+  PE Size               4.00 MiB
+  Total PE              25600
+  Alloc PE / Size       15360 / 60.00 GiB
+  Free  PE / Size       10240 / 40.00 GiB
+  
+  --- Volume group ---
+  VG Name               missingvg
+  System ID             
+  Format                lvm2
+  Metadata Areas        2
+  Metadata Sequence No  2
+  VG Access             read/write
+  VG Status             resizable/PARTIAL
+  MAX LV                0
+  Cur LV                1
+  Open LV               1
+  Max PV                0
+  Cur PV                2
+  Act PV                1
+  VG Size               80.00 GiB
+  PE Size               4.00 MiB
+  Total PE              20480
+  Alloc PE / Size       17920 / 70.00 GiB
+  Free  PE / Size       2560 / 10.00 GiB
+EOF
+
+cat > test-data/lvm/lvdisplay.txt << 'EOF'
+  --- Logical volume ---
+  LV Path                /dev/rootvg/root
+  LV Name                root
+  VG Name                rootvg
+  LV UUID                abc123-def4-5678-90ab-cdef12345678
+  LV Write Access        read/write
+  LV Creation host, time node01, 2024-01-15 10:30:00 +0000
+  LV Status              available
+  # open                 1
+  LV Size                15.00 GiB
+  Current LE             3840
+  Segments               1
+  Allocation             inherit
+  Read ahead sectors     auto
+  - currently set to     256
+  Block device           253:0
+  
+  --- Logical volume ---
+  LV Path                /dev/datavg/app
+  LV Name                app
+  VG Name                datavg
+  LV UUID                def456-ghi7-8901-23ab-cdef45678901
+  LV Write Access        read/write
+  LV Creation host, time node01, 2024-02-20 14:15:00 +0000
+  LV Status              available
+  # open                 1
+  LV Size                20.00 GiB
+  Current LE             5120
+  Segments               1
+  Allocation             inherit
+  Read ahead sectors     auto
+  - currently set to     256
+  Block device           253:1
+EOF
+
+create_fixture "test-lvm"
+
+# 31b. Test for LVM configuration from sosreport (verbose pvs/vgs/lvs in sos_commands/lvm2/)
+echo ""
+echo "=== Creating test-lvm-sosreport.tar.xz ==="
+mkdir -p test-data/sos_commands/lvm2
+
+cat > "test-data/sos_commands/lvm2/pvs_-a_-v_-o_pv_mda_free_--config_global_locking_type_0" << 'EOF'
+  Reloading config files
+  WARNING: locking_type (0) is deprecated, using --nolocking.
+  WARNING: File locking is disabled.
+  PV         VG          Fmt  Attr PSize    PFree DevSize   PV UUID                            PMdaFree  PMdaSize  #PMda #PMdaUse 1st PE
+  /dev/sda1                   ---        0     0    800.00m                                           0         0      0        0      0
+  /dev/sda2  rootvg      lvm2 a--   <28.73g    0    <28.73g 4uu5BU-0TAy-rc94-icWO-qE9Q-nPgR-m0VmAc   507.50k  1020.00k     1        1   1.00m
+  /dev/sda3  rootvg      lvm2 a--   <98.00g 4.00m    98.00g GFR5X8-rnj6-qUMi-ZIDS-cimp-thG1-ZlNN5L   507.50k  1020.00k     1        1   1.00m
+  /dev/sdb1                   ---        0     0     <1.76t                                           0         0      0        0      0
+  /dev/sdc1  vgoraclebip lvm2 a--   <64.00g    0    <64.00g VQZW3z-25sX-nZyU-q3f3-8AcZ-dCYz-Dp8fPr   508.00k  1020.00k     1        1   1.00m
+  /dev/sdd1  vggridhome  lvm2 a--   <64.00g    0    <64.00g PUYyrj-DtbS-uChW-v6tH-aSZE-ezRh-MckD8g   508.00k  1020.00k     1        1   1.00m
+EOF
+
+cat > "test-data/sos_commands/lvm2/vgs_-v_-o_vg_mda_count_--config_global_locking_type_0" << 'EOF'
+  Reloading config files
+  WARNING: locking_type (0) is deprecated, using --nolocking.
+  WARNING: File locking is disabled.
+  VG          Attr   Ext   #PV #LV #SN VSize    VFree VG UUID                                VProfile #VMda VMdaFree  VMdaSize  #VMdaUse VG Tags
+  rootvg      wz--n- 4.00m   2   2   0  126.72g 4.00m 67jA2p-1x3X-SqhR-1iY7-j9jS-h8XB-XNqtys              2   507.50k  1020.00k        2         
+  vggridhome  wz--n- 4.00m   1   1   0  <64.00g    0  Al6ivs-izrr-zrw3-Yf6b-3a59-Trnt-yn3nRK              1   508.00k  1020.00k        1         
+  vgoraclebip wz--n- 4.00m   1   1   0  <64.00g    0  rfoP9b-5Y4C-ZWBP-QsRM-B8dZ-4abx-u2hF7B              1   508.00k  1020.00k        1         
+  Reloading config files
+EOF
+
+cat > "test-data/sos_commands/lvm2/lvs_-a_-o_lv_tags_devices_--config_global_locking_type_0" << 'EOF'
+  WARNING: locking_type (0) is deprecated, using --nolocking.
+  WARNING: File locking is disabled.
+  LV          VG          Attr       LSize    Pool Origin Data%  Meta%  Move Log Cpy%Sync Convert LV Tags Devices         KRahead Rahead #Str Stripe
+  crashlv     rootvg      -wi-ao----   10.00g                                                             /dev/sda2(0)      4.00m   auto    1     0
+  rootlv      rootvg      -wi-ao---- <116.72g                                                             /dev/sda3(0)      4.00m   auto    1     0
+  lvgridhome  vggridhome  -wi-ao----  <64.00g                                                             /dev/sdd1(0)      4.00m   auto    1     0
+  lvoraclebip vgoraclebip -wi-ao----  <64.00g                                                             /dev/sdc1(0)      4.00m   auto    1     0
+EOF
+
+create_fixture "test-lvm-sosreport"
+
+# 32. Test for RAID configuration
+echo ""
+echo "=== Creating test-raid.tar.xz ==="
+mkdir -p test-data/proc
+
+cat > test-data/proc/mdstat.txt << 'EOF'
+Personalities : [raid1] [raid5] [raid6] 
+md0 : active raid1 sda1[0] sdb1[1]
+      104320 blocks super 1.2 [2/2] [UU]
+      
+md1 : active raid5 sdc1[0] sdd1[1] sde1[2]
+      209584128 blocks super 1.2 level 5, 512k chunk, algorithm 2 [3/3] [UUU]
+      bitmap: 0/1 pages [0KB], 65536KB chunk
+
+md2 : active (auto-read-only) raid1 sdf1[0] sdg1[1](F)
+      52428800 blocks super 1.2 [2/1] [U_]
+      [>....................]  recovery =  3.5% (1843200/52428800) finish=5.3min speed=157542K/sec
+      
+md3 : inactive sdi1[0](S) sdj1[2](S)
+      209584128 blocks super 1.2
+      
+unused devices: <none>
+EOF
+
+mkdir -p test-data/mdadm
+cat > test-data/mdadm/mdadm-detail-md0.txt << 'EOF'
+/dev/md0:
+           Version : 1.2
+     Creation Time : Mon Jan 15 10:45:32 2024
+        Raid Level : raid1
+        Array Size : 104320 (101.89 MiB 106.82 MB)
+     Used Dev Size : 104320 (101.89 MiB 106.82 MB)
+      Raid Devices : 2
+     Total Devices : 2
+       Persistence : Superblock is persistent
+
+       Update Time : Mon Mar 11 15:23:45 2024
+             State : clean 
+    Active Devices : 2
+   Working Devices : 2
+    Failed Devices : 0
+     Spare Devices : 0
+
+Consistency Policy : resync
+
+              Name : node01:0
+              UUID : 12345678:90abcdef:12345678:90abcdef
+            Events : 125
+
+    Number   Major   Minor   RaidDevice State
+       0       8        1        0      active sync   /dev/sda1
+       1       8       17        1      active sync   /dev/sdb1
+EOF
+
+cat > test-data/mdadm/mdadm-detail-md1.txt << 'EOF'
+/dev/md1:
+           Version : 1.2
+     Creation Time : Mon Jan 15 11:00:00 2024
+        Raid Level : raid5
+        Array Size : 209584128 (199.87 GiB 214.61 GB)
+     Used Dev Size : 104792064 (99.94 GiB 107.30 GB)
+      Raid Devices : 3
+     Total Devices : 3
+       Persistence : Superblock is persistent
+
+     Intent Bitmap : Internal
+
+       Update Time : Mon Mar 11 15:30:12 2024
+             State : clean 
+    Active Devices : 3
+   Working Devices : 3
+    Failed Devices : 0
+     Spare Devices : 0
+
+            Layout : left-symmetric
+        Chunk Size : 512K
+
+Consistency Policy : bitmap
+
+              Name : node01:1
+              UUID : abcdef12:34567890:abcdef12:34567890
+            Events : 2543
+
+    Number   Major   Minor   RaidDevice State
+       0       8       33        0      active sync   /dev/sdc1
+       1       8       49        1      active sync   /dev/sdd1
+       2       8       65        2      active sync   /dev/sde1
+EOF
+
+cat > test-data/mdadm/mdadm-detail-md2.txt << 'EOF'
+/dev/md2:
+           Version : 1.2
+     Creation Time : Mon Feb 01 09:15:22 2024
+        Raid Level : raid1
+        Array Size : 52428800 (50.00 GiB 53.69 GB)
+     Used Dev Size : 52428800 (50.00 GiB 53.69 GB)
+      Raid Devices : 2
+     Total Devices : 2
+       Persistence : Superblock is persistent
+
+       Update Time : Mon Mar 11 15:25:00 2024
+             State : clean, degraded, recovering 
+    Active Devices : 1
+   Working Devices : 1
+    Failed Devices : 1
+     Spare Devices : 0
+
+Consistency Policy : resync
+
+    Rebuild Status : 3% complete
+
+              Name : node01:2
+              UUID : fedcba09:87654321:fedcba09:87654321
+            Events : 89
+
+    Number   Major   Minor   RaidDevice State
+       0       8       81        0      active sync   /dev/sdf1
+       -       0        0        1      removed
+       
+       1       8       97        -      faulty   /dev/sdg1
+EOF
+
+create_fixture "test-raid"
+
+################################################################################
+# Test: BTRFS Configuration
+################################################################################
+echo ""
+echo "=== Creating test-btrfs.tar.xz ==="
+mkdir -p test-data/basic-environment
+
+cat > test-data/basic-environment/btrfs.txt << 'EOF'
+#==[ Command ]======================================#
+# /usr/sbin/btrfs filesystem show
+Label: 'root'  uuid: 550e8400-e29b-41d4-a716-446655440000
+	Total devices 2 FS bytes used 45.23GiB
+	devid    1 size 100.00GiB used 50.00GiB path /dev/sda2
+	devid    2 size 100.00GiB used 50.00GiB path /dev/sdb2
+
+Label: 'data'  uuid: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
+	Total devices 3 FS bytes used 250.75GiB
+	devid    1 size 500.00GiB used 300.00GiB path /dev/sdc1
+	devid    2 size 500.00GiB used 300.00GiB path /dev/sdd1
+	devid    3 size 500.00GiB used 300.00GiB path /dev/sde1
+
+Label: none  uuid: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
+	Total devices 1 FS bytes used 15.89GiB
+	devid    1 size 50.00GiB used 20.00GiB path /dev/sdf1
+
+#==[ Command ]======================================#
+# /usr/sbin/btrfs subvolume list /
+ID 256 gen 123 top level 5 path @rootfs
+ID 257 gen 124 top level 5 path @home
+ID 258 gen 125 top level 5 path @opt
+ID 259 gen 126 top level 5 path @srv
+ID 260 gen 127 top level 5 path @tmp
+ID 261 gen 128 top level 5 path @var
+ID 262 gen 129 parent 261 top level 5 path @var/log
+ID 263 gen 130 parent 261 top level 5 path @var/cache
+ID 264 gen 131 top level 5 path @snapshots
+ID 265 gen 132 parent 264 top level 5 path @snapshots/root-2024-01-15
+EOF
+
+create_fixture "test-btrfs"
+
+################################################################################
+# Test: Block Devices and fstab UUID Correlation
+################################################################################
+echo ""
+echo "=== Creating test-block-devices.tar.xz ==="
+mkdir -p test-data/sos_commands/block
+mkdir -p test-data/etc
+
+# lsblk basic output
+cat > test-data/sos_commands/block/lsblk << 'EOF'
+NAME    MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
+sda       8:0    0   64G  0 disk 
+|-sda1    8:1    0  500M  0 part /boot/efi
+|-sda2    8:2    0    1G  0 part /boot
+`-sda3    8:3    0 62.5G  0 part /
+sdb       8:16   0  128G  0 disk 
+`-sdb1    8:17   0  128G  0 part /mnt
+sdc       8:32   0  256G  0 disk 
+`-sdc1    8:33   0  256G  0 part /data
+EOF
+
+# lsblk -f -a -l output with filesystem and UUID info
+cat > 'test-data/sos_commands/block/lsblk_-f_-a_-l' << 'EOF'
+NAME  FSTYPE FSVER LABEL UUID                                 FSAVAIL FSUSE% MOUNTPOINTS
+sda                                                                          
+sda1  vfat   FAT32       ABCD-1234                            450M     10% /boot/efi
+sda2  ext4   1.0         11111111-1111-1111-1111-111111111111  800M    20% /boot
+sda3  ext4   1.0         22222222-2222-2222-2222-222222222222   45G    28% /
+sdb                                                                          
+sdb1  ext4   1.0         33333333-3333-3333-3333-333333333333  120G     6% /mnt
+sdc                                                                          
+sdc1  ext4   1.0         44444444-4444-4444-4444-444444444444  240G     6% /data
+EOF
+
+# blkid output
+cat > 'test-data/sos_commands/block/blkid_-c_.dev.null' << 'EOF'
+/dev/sda1: UUID="ABCD-1234" BLOCK_SIZE="512" TYPE="vfat" PARTUUID="aaaa1111-01"
+/dev/sda2: UUID="11111111-1111-1111-1111-111111111111" BLOCK_SIZE="4096" TYPE="ext4" PARTUUID="aaaa1111-02"
+/dev/sda3: UUID="22222222-2222-2222-2222-222222222222" BLOCK_SIZE="4096" TYPE="ext4" PARTUUID="aaaa1111-03"
+/dev/sdb1: UUID="33333333-3333-3333-3333-333333333333" BLOCK_SIZE="4096" TYPE="ext4" PARTUUID="bbbb2222-01"
+/dev/sdc1: UUID="44444444-4444-4444-4444-444444444444" BLOCK_SIZE="4096" TYPE="ext4" PARTUUID="cccc3333-01"
+EOF
+
+# fstab - matching UUIDs (no issues)
+cat > test-data/etc/fstab << 'EOF'
+# /etc/fstab
+UUID=22222222-2222-2222-2222-222222222222 / ext4 defaults 0 1
+UUID=11111111-1111-1111-1111-111111111111 /boot ext4 defaults 0 2
+UUID=ABCD-1234 /boot/efi vfat defaults 0 2
+UUID=33333333-3333-3333-3333-333333333333 /mnt ext4 defaults,nofail 0 2
+UUID=44444444-4444-4444-4444-444444444444 /data ext4 defaults,nofail 0 2
+EOF
+
+create_fixture "test-block-devices"
+
+################################################################################
+# Test: Block Devices with fstab UUID Mismatch
+################################################################################
+echo ""
+echo "=== Creating test-block-devices-mismatch.tar.xz ==="
+mkdir -p test-data/sos_commands/block
+mkdir -p test-data/etc
+
+# lsblk -f -a -l output
+cat > 'test-data/sos_commands/block/lsblk_-f_-a_-l' << 'EOF'
+NAME  FSTYPE FSVER LABEL UUID                                 FSAVAIL FSUSE% MOUNTPOINTS
+sda                                                                          
+sda1  vfat   FAT32       ABCD-1234                            450M     10% /boot/efi
+sda2  ext4   1.0         11111111-1111-1111-1111-111111111111  800M    20% /boot
+sda3  ext4   1.0         22222222-2222-2222-2222-222222222222   45G    28% /
+sdb                                                                          
+sdb1  ext4   1.0         NEW-UUID-5555-5555-5555-555555555555  120G     6% /mnt
+sdc                                                                          
+sdc1  xfs          data  66666666-6666-6666-6666-666666666666  240G     6% /data
+EOF
+
+# blkid output - note sdb1 has a different UUID than expected in fstab
+cat > 'test-data/sos_commands/block/blkid_-c_.dev.null' << 'EOF'
+/dev/sda1: UUID="ABCD-1234" BLOCK_SIZE="512" TYPE="vfat" PARTUUID="aaaa1111-01"
+/dev/sda2: UUID="11111111-1111-1111-1111-111111111111" BLOCK_SIZE="4096" TYPE="ext4" PARTUUID="aaaa1111-02"
+/dev/sda3: UUID="22222222-2222-2222-2222-222222222222" BLOCK_SIZE="4096" TYPE="ext4" PARTUUID="aaaa1111-03"
+/dev/sdb1: UUID="NEW-UUID-5555-5555-5555-555555555555" BLOCK_SIZE="4096" TYPE="ext4" PARTUUID="bbbb2222-01"
+/dev/sdc1: UUID="66666666-6666-6666-6666-666666666666" BLOCK_SIZE="4096" TYPE="xfs" PARTUUID="cccc3333-01"
+EOF
+
+# fstab - has UUID mismatches and filesystem type mismatch
+cat > test-data/etc/fstab << 'EOF'
+# /etc/fstab - with intentional issues for testing
+UUID=22222222-2222-2222-2222-222222222222 / ext4 defaults 0 1
+UUID=11111111-1111-1111-1111-111111111111 /boot ext4 defaults 0 2
+UUID=ABCD-1234 /boot/efi vfat defaults 0 2
+# This UUID no longer exists - disk was replaced
+UUID=OLD-UUID-3333-3333-3333-333333333333 /mnt ext4 defaults,nofail 0 2
+# This has wrong filesystem type (fstab says ext4 but disk has xfs)
+UUID=66666666-6666-6666-6666-666666666666 /data ext4 defaults,nofail 0 2
+# This UUID doesn't exist at all
+UUID=MISSING-UUID-9999-9999-9999-999999 /opt ext4 defaults,nofail 0 2
+EOF
+
+create_fixture "test-block-devices-mismatch"
+
+################################################################################
+# Test: EOL Distribution - SLES 12 (End of Life)
+################################################################################
+echo ""
+echo "=== Creating test-eol-sles12.tar.xz ==="
+mkdir -p test-data
+
+# basic-environment.txt for SLES 12 SP5 (EOL distribution)
+cat > test-data/basic-environment.txt << 'EOF'
+#==[ Configuration File ]===========================#
+# /etc/os-release
+NAME="SLES"
+VERSION="12-SP5"
+VERSION_ID="12.5"
+PRETTY_NAME="SUSE Linux Enterprise Server 12 SP5"
+ID="sles"
+ID_LIKE="suse"
+ANSI_COLOR="0;32"
+CPE_NAME="cpe:/o:suse:sles:12:sp5"
+
+#==[ Command ]======================================#
+# uname -a
+Linux sles12-test 4.12.14-122.162-default #1 SMP Thu May 30 08:00:36 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
+EOF
+
+create_fixture "test-eol-sles12"
+
+################################################################################
+# Test: EOL Distribution - RHEL 7 (End of Life)
+################################################################################
+echo ""
+echo "=== Creating test-eol-rhel7.tar.xz ==="
+mkdir -p test-data/usr/lib
+
+# os-release for RHEL 7.9 (EOL distribution)
+cat > test-data/usr/lib/os-release << 'EOF'
+NAME="Red Hat Enterprise Linux Server"
+VERSION="7.9 (Maipo)"
+ID="rhel"
+ID_LIKE="fedora"
+VARIANT="Server"
+VARIANT_ID="server"
+VERSION_ID="7.9"
+PRETTY_NAME="Red Hat Enterprise Linux Server 7.9 (Maipo)"
+ANSI_COLOR="0;31"
+CPE_NAME="cpe:/o:redhat:enterprise_linux:7.9:GA:server"
+HOME_URL="https://www.redhat.com/"
+BUG_REPORT_URL="https://bugzilla.redhat.com/"
+REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 7"
+REDHAT_BUGZILLA_PRODUCT_VERSION=7.9
+REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
+REDHAT_SUPPORT_PRODUCT_VERSION="7.9"
+EOF
+
+create_fixture "test-eol-rhel7"
+
+################################################################################
+# Test: EOL Distribution - CentOS 7 (End of Life)
+################################################################################
+echo ""
+echo "=== Creating test-eol-centos7.tar.xz ==="
+mkdir -p test-data/usr/lib
+
+# os-release for CentOS 7.9 (EOL distribution)
+cat > test-data/usr/lib/os-release << 'EOF'
+NAME="CentOS Linux"
+VERSION="7 (Core)"
+ID="centos"
+ID_LIKE="rhel fedora"
+VERSION_ID="7"
+PRETTY_NAME="CentOS Linux 7 (Core)"
+ANSI_COLOR="0;31"
+CPE_NAME="cpe:/o:centos:centos:7"
+HOME_URL="https://www.centos.org/"
+BUG_REPORT_URL="https://bugs.centos.org/"
+CENTOS_MANTISBT_PROJECT="CentOS-7"
+CENTOS_MANTISBT_PROJECT_VERSION="7"
+EOF
+
+create_fixture "test-eol-centos7"
+
+################################################################################
+# Test: Time Sync Service - chronyd enabled and running
+################################################################################
+echo ""
+echo "=== Creating test-timesync-chrony.tar.xz ==="
+mkdir -p test-data/sos_commands/systemd
+
+# systemd-status.txt with chronyd service status (SCC format)
+cat > test-data/sos_commands/systemd/systemd-status.txt << 'EOF'
+# /bin/systemctl status 'chronyd.service'
+● chronyd.service - NTP client/server
+     Loaded: loaded (/usr/lib/systemd/system/chronyd.service; enabled; vendor preset: enabled)
+     Active: active (running) since Mon 2026-01-27 10:00:00 UTC; 1 week 2 days ago
+       Docs: man:chronyd(8)
+             man:chrony.conf(5)
+   Main PID: 1234 (chronyd)
+      Tasks: 1 (limit: 49152)
+     Memory: 1.5M
+        CPU: 123ms
+     CGroup: /system.slice/chronyd.service
+             └─1234 /usr/sbin/chronyd
+
+Jan 27 10:00:00 test-host systemd[1]: Starting NTP client/server...
+Jan 27 10:00:00 test-host chronyd[1234]: chronyd version 4.1 starting (+CMDMON +NTP +REFCLOCK +RTC +PRIVDROP +SCFILTER +SIGND +ASYNCDNS +NTS +SECHASH +IPV6 +DEBUG)
+Jan 27 10:00:00 test-host systemd[1]: Started NTP client/server.
+EOF
+
+create_fixture "test-timesync-chrony"
+
+################################################################################
+# Test: SAP Instance Configuration - START_PROFILE and InstanceName issues
+# Tests for sapInstanceConfigParser and sapInstanceErrorsParser
+# Reference: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux_for_sap_solutions/8/html/configuring_ha_clusters_to_manage_sap_netweaver_or_sap_s4hana_application_server_instances_using_the_rhel_ha_add-on
+################################################################################
+echo ""
+echo "=== Creating test-sap-instance-config.tar.xz ==="
+mkdir -p test-data/sos_commands/pacemaker
+mkdir -p test-data/sos_commands/pacemaker/crm_report
+# SAP indicator directories for SAP detection in UI
+mkdir -p test-data/usr/sap/PJU
+mkdir -p test-data/sapmnt/PJU/profile
+touch test-data/usr/sap/PJU/sapservices
+
+# pcs_config with SAP SAPInstance resources - note hostname mismatch
+cat > test-data/sos_commands/pacemaker/pcs_config << 'EOF'
+Cluster Name: pju-prod-cluster
+Corosync Nodes:
+ awenwjeupcs01 awenwjeupcs02
+Pacemaker Nodes:
+ awenwjeupcs01 awenwjeupcs02
+
+Resources:
+ Group: g-PJU_SCS
+  Meta Attrs: resource-stickiness=3000
+  Resource: fs_PJU_SCS (class=ocf provider=heartbeat type=Filesystem)
+   Attributes: device=eufusionsapwesteuprodst.file.core.windows.net:/eufusionsapwesteuprodst/sap-core-pju-scs01 directory=/usr/sap/PJU/SCS01 force_unmount=safe fstype=nfs options=sec=sys,vers=4.1
+   Operations: monitor interval=200 timeout=40 (fs_PJU_SCS-monitor-interval-200)
+               start interval=0 timeout=60 (fs_PJU_SCS-start-interval-0)
+               stop interval=0 timeout=120 (fs_PJU_SCS-stop-interval-0)
+  Resource: vip_PJU_SCS (class=ocf provider=heartbeat type=IPaddr2)
+   Attributes: ip=10.82.8.23
+   Operations: monitor interval=10s timeout=20s (vip_PJU_SCS-monitor-interval-10s)
+               start interval=0s timeout=20s (vip_PJU_SCS-start-interval-0s)
+               stop interval=0s timeout=20s (vip_PJU_SCS-stop-interval-0s)
+  Resource: nc_PJU_SCS (class=ocf provider=heartbeat type=azure-lb)
+   Attributes: port=62000
+   Operations: monitor interval=10s timeout=20s (nc_PJU_SCS-monitor-interval-10s)
+               start interval=0s timeout=20s (nc_PJU_SCS-start-interval-0s)
+               stop interval=0s timeout=20s (nc_PJU_SCS-stop-interval-0s)
+  Resource: rsc_sap_PJU_SCS01 (class=ocf provider=heartbeat type=SAPInstance)
+   Attributes: AUTOMATIC_RECOVER=false InstanceName=PJU_SCS01_ppu-scs START_PROFILE=/sapmnt/PJU/profile/PJU_SCS01_awenwjeusscs
+   Meta Attrs: failure-timeout=60 migration-threshold=1 resource-stickiness=5000
+   Operations: demote interval=0s timeout=320s (rsc_sap_PJU_SCS01-demote-interval-0s)
+               methods interval=0s timeout=5s (rsc_sap_PJU_SCS01-methods-interval-0s)
+               monitor interval=20 on-fail=restart timeout=60 (rsc_sap_PJU_SCS01-monitor-interval-20)
+               promote interval=0s timeout=320s (rsc_sap_PJU_SCS01-promote-interval-0s)
+               reload interval=0s timeout=320s (rsc_sap_PJU_SCS01-reload-interval-0s)
+               start interval=0 timeout=600 (rsc_sap_PJU_SCS01-start-interval-0)
+               stop interval=0 timeout=600 (rsc_sap_PJU_SCS01-stop-interval-0)
+ Group: g-PJU_ERS
+  Resource: fs_PJU_ERS (class=ocf provider=heartbeat type=Filesystem)
+   Attributes: device=eufusionsapwesteuprodst.file.core.windows.net:/eufusionsapwesteuprodst/sap-core-pju-ers11 directory=/usr/sap/PJU/ERS11 force_unmount=safe fstype=nfs options=sec=sys,vers=4.1
+   Operations: monitor interval=200 timeout=40 (fs_PJU_ERS-monitor-interval-200)
+               start interval=0 timeout=60 (fs_PJU_ERS-start-interval-0)
+               stop interval=0 timeout=120 (fs_PJU_ERS-stop-interval-0)
+  Resource: vip_PJU_AERS (class=ocf provider=heartbeat type=IPaddr2)
+   Attributes: ip=10.82.8.24
+   Operations: monitor interval=10s timeout=20s (vip_PJU_AERS-monitor-interval-10s)
+               start interval=0s timeout=20s (vip_PJU_AERS-start-interval-0s)
+               stop interval=0s timeout=20s (vip_PJU_AERS-stop-interval-0s)
+  Resource: nc_PJU_AERS (class=ocf provider=heartbeat type=azure-lb)
+   Attributes: port=62111
+   Operations: monitor interval=10s timeout=20s (nc_PJU_AERS-monitor-interval-10s)
+               start interval=0s timeout=20s (nc_PJU_AERS-start-interval-0s)
+               stop interval=0s timeout=20s (nc_PJU_AERS-stop-interval-0s)
+  Resource: rsc_sap_PJU_ERS11 (class=ocf provider=heartbeat type=SAPInstance)
+   Attributes: AUTOMATIC_RECOVER=false IS_ERS=true InstanceName=PJU_ERS11_ppu-ers START_PROFILE=/sapmnt/PJU/profile/PJU_ERS11_awenwjeusscs
+   Operations: demote interval=0s timeout=320s (rsc_sap_PJU_ERS11-demote-interval-0s)
+               methods interval=0s timeout=5s (rsc_sap_PJU_ERS11-methods-interval-0s)
+               monitor interval=20 on-fail=restart timeout=60 (rsc_sap_PJU_ERS11-monitor-interval-20)
+               promote interval=0s timeout=320s (rsc_sap_PJU_ERS11-promote-interval-0s)
+               reload interval=0s timeout=320s (rsc_sap_PJU_ERS11-reload-interval-0s)
+               start interval=0 timeout=600 (rsc_sap_PJU_ERS11-start-interval-0)
+               stop interval=0 timeout=600 (rsc_sap_PJU_ERS11-stop-interval-0)
+
+Stonith Devices:
+  Resource: rsc_st_azure (class=stonith type=fence_azure_arm)
+    Attributes: msi=true resourceGroup=myRG subscriptionId=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+    Operations:
+      monitor: rsc_st_azure-monitor-interval-3600
+        interval=3600
+
+Cluster Properties:
+ cluster-infrastructure: corosync
+ cluster-name: pju-prod-cluster
+ stonith-enabled: true
+ stonith-timeout: 900
+EOF
+
+# crm_report analysis.txt with SAP errors (START_PROFILE and GRAY status)
+cat > test-data/sos_commands/pacemaker/crm_report/analysis.txt << 'EOF'
+Diff members.txt... OK
+Diff cib.xml... OK
+Diff crm_mon.txt... OK
+Diff sysinfo.txt... OK
+Log pattern matches from awenwjeupcs01:
+Jan 11 11:02:37 awenwjeupcs01 SAPInstance(rsc_sap_PJU_ERS11)[16872]: ERROR: Expected /sapmnt/PJU/profile/PJU_ERS11_awenwjeusscs to be the instance START profile, please set START_PROFILE parameter!
+Jan 11 11:03:36 awenwjeupcs01 SAPInstance(rsc_sap_PJU_ERS11)[18199]: ERROR: Expected /sapmnt/PJU/profile/PJU_ERS11_awenwjeusscs to be the instance START profile, please set START_PROFILE parameter!
+Jan 11 11:19:03 awenwjeupcs01 SAPInstance(rsc_sap_PJU_SCS01)[37447]: ERROR: SAP instance service msg_server is not running with status GRAY !
+Jan 11 11:19:03 awenwjeupcs01 SAPInstance(rsc_sap_PJU_SCS01)[37447]: ERROR: SAP instance service enserver is not running with status GRAY !
+Jan 11 11:19:06 awenwjeupcs01 Filesystem(fs_PJU_SCS)[38065]: ERROR: Couldn't unmount /usr/sap/PJU/SCS01; trying cleanup with TERM
+Jan 11 11:23:44 awenwjeupcs01 SAPInstance(rsc_sap_PJU_ERS11)[41957]: ERROR: Expected /sapmnt/PJU/profile/PJU_ERS11_awenwjeusscs to be the instance START profile, please set START_PROFILE parameter!
+Jan 11 11:26:37 awenwjeupcs01 Filesystem(fs_PJU_SCS)[45202]: ERROR: Couldn't unmount /usr/sap/PJU/SCS01; trying cleanup with TERM
+EOF
+
+# Add pcs_status to show the daemon status
+cat > test-data/sos_commands/pacemaker/pcs_status_--full << 'EOF'
+Cluster name: pju-prod-cluster
+Cluster Summary:
+  * Stack: corosync
+  * Current DC: awenwjeupcs01 (version 2.1.2-4.el8_6.9-ada5c3b36e2) - partition with quorum
+  * Last updated: Sun Jan 12 14:01:52 2026
+  * Last change:  Sat Jan 11 08:31:29 2026 by root via cibadmin on awenwjeupcs01
+  * 2 nodes configured
+  * 12 resource instances configured
+
+Node List:
+  * Online: [ awenwjeupcs01 awenwjeupcs02 ]
+
+Full List of Resources:
+  * Resource Group: g-PJU_SCS:
+    * fs_PJU_SCS        (ocf::heartbeat:Filesystem):     Started awenwjeupcs01
+    * vip_PJU_SCS       (ocf::heartbeat:IPaddr2):        Started awenwjeupcs01
+    * nc_PJU_SCS        (ocf::heartbeat:azure-lb):       Started awenwjeupcs01
+    * rsc_sap_PJU_SCS01 (ocf::heartbeat:SAPInstance):    Started awenwjeupcs01
+  * Resource Group: g-PJU_ERS:
+    * fs_PJU_ERS        (ocf::heartbeat:Filesystem):     Started awenwjeupcs02
+    * vip_PJU_AERS      (ocf::heartbeat:IPaddr2):        Started awenwjeupcs02
+    * nc_PJU_AERS       (ocf::heartbeat:azure-lb):       Started awenwjeupcs02
+    * rsc_sap_PJU_ERS11 (ocf::heartbeat:SAPInstance):    Started awenwjeupcs02
+  * rsc_st_azure        (stonith:fence_azure_arm):       Started awenwjeupcs01
+
+Daemon Status:
+  corosync: active/disabled
+  pacemaker: active/enabled
+  pcsd: active/enabled
+EOF
+
+create_fixture "test-sap-instance-config"
+
+################################################################################
+# Test: Cluster events detection from supportconfig ha.txt
+# Verifies that clusterEvents parser can extract embedded pacemaker/corosync
+# log sections from ha.txt and detect resource migrations, fencing events,
+# and resource failures.
+################################################################################
+echo ""
+echo "=== Creating test-cluster-events.tar.xz ==="
+mkdir -p test-data
+cat > test-data/ha.txt << 'EOF'
+#==[ Configuration File ]====# /etc/corosync/corosync.conf
+totem {
+    version: 2
+    cluster_name: hana-cluster
+    token: 30000
+}
+nodelist {
+    node {
+        ring0_addr: node1
+        nodeid: 1
+    }
+    node {
+        ring0_addr: node2
+        nodeid: 2
+    }
+}
+
+#==[ Command ]====# /usr/sbin/crm configure show
+property cib-bootstrap-options: \
+    stonith-enabled=true \
+    stonith-timeout=150s
+
+primitive rsc_SAPHana_HDB_HDB00 ocf:suse:SAPHana \
+    op start timeout=3600 \
+    op stop timeout=3600
+
+primitive stonith-fence_azure_arm stonith:fence_azure_arm \
+    op monitor interval=3600 timeout=120
+
+#==[ Command ]====# /usr/sbin/crm_mon -1 -r -f
+Stack: corosync
+Current DC: node1
+Last updated: Wed Jan 15 10:35:00 2025
+2 nodes configured
+3 resources configured
+
+Online: [ node1 ]
+OFFLINE: [ node2 ]
+
+Full list of resources:
+
+ rsc_SAPHana_HDB_HDB00  (ocf::heartbeat:SAPHana):      Started node1
+ rsc_ip_HDB_HDB00       (ocf::heartbeat:IPaddr2):      Started node1
+ stonith-fence_azure_arm (stonith:fence_azure_arm):     Started node1
+
+#==[ Log File ]====# /var/log/pacemaker/pacemaker.log
+Jan 15 10:30:45 node1 pacemaker-controld  [1234] (handle_request)          notice: Requesting fencing (reboot) of node node2
+Jan 15 10:30:48 node1 pacemaker-fenced    [1235] (handle_request)          notice: fence_azure_arm: Called fence_azure_arm for node node2
+Jan 15 10:30:50 node1 pacemaker-controld  [1234] (tengine_stonith_notify)  notice: Peer node2 was terminated (reboot) by node1 on behalf of pacemaker-controld.1234
+Jan 15 10:31:00 node1 pacemaker-controld  [1234] (te_rsc_command)          notice: Moving resource rsc_ip_HDB_HDB00 from node2 to node1
+Jan 15 10:31:05 node1 pacemaker-controld  [1234] (do_lrm_rsc_op)          notice: Operation rsc_SAPHana_HDB_HDB00_start_0: ok (node=node1)
+Jan 15 10:33:00 node1 pacemaker-controld  [1234] (process_lrm_event)      notice: Unexpected result (error: unknown error) was recorded for monitor of rsc_SAPHana_HDB_HDB00 on node2
+
+#==[ Log File ]====# /var/log/cluster/corosync.log
+Jan 15 10:30:42 node1 corosync  [5678] notice: Node node2 will be fenced
+Jan 15 10:30:55 node1 corosync  [5678] notice: Fencing node2: success
+EOF
+
+create_fixture "test-cluster-events"
+
+################################################################################
+# Test: Pacemaker high CPU detection from cluster logs
+# Verifies that clusterEvents parser detects pacemaker-controld high CPU load
+# notices and surfaces them in the Cluster Events section.
+################################################################################
+echo ""
+echo "=== Creating test-cluster-high-cpu.tar.xz ==="
+mkdir -p test-data/var/log/pacemaker
+cat > test-data/var/log/pacemaker/pacemaker.log << 'EOF'
+Apr 16 09:10:00 node01 pacemaker-controld[2404]: notice: High CPU load detected: 23.270000
+EOF
+create_fixture "test-cluster-high-cpu"
+
+################################################################################
+# Test: Cluster events detection from sosreport (RHEL format)
+# Verifies that clusterEvents parser handles sosreport structure:
+# - pacemaker.log in sos_strings as .tailed file
+# - "targeting node X" format (vs SUSE's "of node X")
+# - "Cluster node X will be fenced" format  
+# - "Peer X was not terminated" as fencing failure
+# Also verifies RHEL-specific totem transport validation (knet expected)
+################################################################################
+echo ""
+echo "=== Creating test-cluster-events-sosreport.tar.xz ==="
+SOSDIR="sosreport-testnode-2025-01-27-abc123"
+mkdir -p "test-data/${SOSDIR}/etc/corosync"
+mkdir -p "test-data/${SOSDIR}/sos_strings/pacemaker"
+mkdir -p "test-data/${SOSDIR}/var/log/pacemaker"
+mkdir -p "test-data/${SOSDIR}/etc"
+
+# Create os-release for RHEL detection
+cat > "test-data/${SOSDIR}/etc/os-release" << 'EOF'
+NAME="Red Hat Enterprise Linux"
+VERSION="8.8 (Ootpa)"
+ID="rhel"
+ID_LIKE="fedora"
+VERSION_ID="8.8"
+PRETTY_NAME="Red Hat Enterprise Linux 8.8 (Ootpa)"
+EOF
+
+# Create corosync.conf with knet transport (correct for RHEL)
+cat > "test-data/${SOSDIR}/etc/corosync/corosync.conf" << 'EOF'
+totem {
+    version: 2
+    cluster_name: testcluster
+    transport: knet
+    token: 30000
+    token_retransmits_before_loss_const: 10
+    join: 60
+    consensus: 36000
+    max_messages: 20
+}
+
+quorum {
+    provider: corosync_votequorum
+    expected_votes: 2
+    two_node: 1
+}
+
+nodelist {
+    node {
+        ring0_addr: testnode1
+        nodeid: 1
+    }
+    node {
+        ring0_addr: testnode2
+        nodeid: 2
+    }
+}
+EOF
+
+# Create pacemaker.log as a tailed file in sos_strings (sosreport format)
+cat > "test-data/${SOSDIR}/sos_strings/pacemaker/var.log.pacemaker.pacemaker.log.tailed" << 'EOF'
+Jan 27 09:10:00 testnode1 pacemaker-schedulerd[8138] (unpack_rsc_op_failure)	warning: Unexpected result (error: Resource agent did not complete within 11m40s) was recorded for monitor of SAPHana_TST_00:1 on testnode2 at Jan 27 09:08:10 2025
+Jan 27 09:13:13 testnode1 pacemaker-schedulerd[8138] (pe_fence_node)	warning: Cluster node testnode2 will be fenced: SAPHanaTopology_TST_00:1 is thought to be active there
+Jan 27 09:13:13 testnode1 pacemaker-controld  [8146] (controld_execute_fence_action)	notice: Requesting fencing (reboot) targeting node testnode2 | action=4 timeout=150000
+Jan 27 09:13:30 testnode1 pacemaker-controld  [8146] (handle_fence_notification)	notice: Peer testnode2 was not terminated (reboot) by testnode1 on behalf of pacemaker-controld.8146: delegate failed
+Jan 27 09:14:00 testnode1 pacemaker-controld  [8146] (controld_execute_fence_action)	notice: Requesting fencing (reboot) targeting node testnode2 | action=4 timeout=150000
+Jan 27 09:14:30 testnode1 pacemaker-controld  [8146] (tengine_stonith_notify)	notice: Peer testnode2 was terminated (reboot) by testnode1 on behalf of pacemaker-controld.8146
+Jan 27 09:15:00 testnode1 pacemaker-controld  [8146] (te_rsc_command)	notice: Moving resource rsc_ip_TST_00 from testnode2 to testnode1
+EOF
+
+# Create 0-byte symlink placeholder at original path (sosreport convention)
+touch "test-data/${SOSDIR}/var/log/pacemaker/pacemaker.log"
+
+create_fixture "test-cluster-events-sosreport"
+
+################################################################################
+# Test: Firewall Rules - SCC (supportconfig) format
+# Tests iptables, ip6tables, nftables, and firewalld detection in network.txt
+################################################################################
+echo ""
+echo "=== Creating test-firewall-scc.tar.xz ==="
+mkdir -p test-data
+cat > test-data/network.txt << 'SCCEOF'
+#==[ Verification ]=================================#
+# rpm -V firewalld-0.9.3-150400.8.12.1.noarch
+# Verification Status: Passed
+
+#==[ Command ]======================================#
+# /bin/systemctl status firewalld.service
+○ firewalld.service - firewalld - dynamic firewall daemon
+     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: disabled)
+     Active: inactive (dead)
+       Docs: man:firewalld(1)
+
+#==[ Command ]======================================#
+# /usr/bin/firewall-cmd --list-all
+FirewallD is not running
+
+#==[ Command ]======================================#
+# iptables
+
+# NOTE: The iptable_filter module is not loaded, skipping check
+
+#==[ Command ]======================================#
+# iptables
+
+# NOTE: The iptable_nat module is not loaded, skipping check
+
+#==[ Command ]======================================#
+# iptables
+
+# NOTE: The iptable_mangle module is not loaded, skipping check
+
+#==[ Command ]======================================#
+# iptables
+
+# NOTE: The iptable_raw module is not loaded, skipping check
+
+#==[ Command ]======================================#
+# ip6tables
+
+# NOTE: The ip6table_filter module is not loaded, skipping check
+
+#==[ Command ]======================================#
+# ip6tables
+
+# NOTE: The ip6table_nat module is not loaded, skipping check
+
+#==[ Command ]======================================#
+# ip6tables
+
+# NOTE: The ip6table_mangle module is not loaded, skipping check
+
+#==[ Command ]======================================#
+# ip6tables
+
+# NOTE: The ip6table_raw module is not loaded, skipping check
+
+#==[ Verification ]=================================#
+# rpm -V nftables-0.9.8-150400.6.3.1.x86_64
+# Verification Status: Passed
+
+#==[ Command ]======================================#
+# /usr/sbin/nft list tables
+
+SCCEOF
+create_fixture "test-firewall-scc"
+
+################################################################################
+# Test: Firewall Rules - SCC with active nftables rules
+# Tests nftables ruleset detection in SCC network.txt
+################################################################################
+echo ""
+echo "=== Creating test-firewall-scc-nftables.tar.xz ==="
+mkdir -p test-data
+cat > test-data/network.txt << 'SCCEOF'
+#==[ Command ]======================================#
+# /bin/systemctl status firewalld.service
+○ firewalld.service - firewalld - dynamic firewall daemon
+     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: disabled)
+     Active: inactive (dead)
+
+#==[ Command ]======================================#
+# /usr/bin/firewall-cmd --list-all
+FirewallD is not running
+
+#==[ Command ]======================================#
+# iptables
+
+# NOTE: The iptable_filter module is not loaded, skipping check
+
+#==[ Command ]======================================#
+# /usr/sbin/nft list tables
+ip security
+
+#==[ Command ]======================================#
+# /usr/sbin/nft -a list ruleset
+table ip security {
+    chain INPUT {
+        type filter hook input priority 150; policy accept;
+    }
+    chain FORWARD {
+        type filter hook forward priority 150; policy accept;
+    }
+    chain OUTPUT {
+        type filter hook output priority 150; policy accept;
+        meta l4proto tcp ip daddr 168.63.129.16 tcp dport 53 counter packets 0 bytes 0 accept
+        meta l4proto tcp ip daddr 168.63.129.16 skuid 0 counter packets 12345 bytes 6789012 accept
+        meta l4proto tcp ip daddr 168.63.129.16 ct state invalid,new counter packets 0 bytes 0 drop
+    }
+}
+
+SCCEOF
+create_fixture "test-firewall-scc-nftables"
+
+################################################################################
+# Test: Firewall Rules - SOS (sosreport) format
+# Tests firewalld, nftables and config file detection across multiple files
+################################################################################
+echo ""
+echo "=== Creating test-firewall-sosreport.tar.xz ==="
+SOSDIR="sosreport-testfw-2025-01-15-abcdef"
+mkdir -p "test-data/${SOSDIR}/sos_commands/firewalld"
+mkdir -p "test-data/${SOSDIR}/sos_commands/firewall_tables"
+mkdir -p "test-data/${SOSDIR}/etc/sysconfig"
+mkdir -p "test-data/${SOSDIR}/etc/firewalld"
+
+# firewalld state: not running
+echo "not running" > "test-data/${SOSDIR}/sos_commands/firewalld/firewall-cmd_--state"
+
+# firewalld zones (runtime)
+echo "FirewallD is not running" > "test-data/${SOSDIR}/sos_commands/firewalld/firewall-cmd_--list-all-zones"
+
+# firewalld zones (permanent)
+echo "FirewallD is not running" > "test-data/${SOSDIR}/sos_commands/firewalld/firewall-cmd_--permanent_--list-all-zones"
+
+# firewalld direct rules
+echo "FirewallD is not running" > "test-data/${SOSDIR}/sos_commands/firewalld/firewall-cmd_--direct_--get-all-rules"
+echo "FirewallD is not running" > "test-data/${SOSDIR}/sos_commands/firewalld/firewall-cmd_--permanent_--direct_--get-all-rules"
+
+# firewalld direct chains
+echo "FirewallD is not running" > "test-data/${SOSDIR}/sos_commands/firewalld/firewall-cmd_--direct_--get-all-chains"
+echo "FirewallD is not running" > "test-data/${SOSDIR}/sos_commands/firewalld/firewall-cmd_--permanent_--direct_--get-all-chains"
+
+# firewalld passthroughs
+echo "FirewallD is not running" > "test-data/${SOSDIR}/sos_commands/firewalld/firewall-cmd_--direct_--get-all-passthroughs"
+echo "FirewallD is not running" > "test-data/${SOSDIR}/sos_commands/firewalld/firewall-cmd_--permanent_--direct_--get-all-passthroughs"
+
+# firewalld log-denied
+echo "FirewallD is not running" > "test-data/${SOSDIR}/sos_commands/firewalld/firewall-cmd_--get-log-denied"
+
+# nftables ruleset
+cat > "test-data/${SOSDIR}/sos_commands/firewall_tables/nft_-a_list_ruleset" << 'EOF'
+table ip security { # handle 3
+    chain INPUT { # handle 1
+        type filter hook input priority 150; policy accept;
+    }
+
+    chain FORWARD { # handle 2
+        type filter hook forward priority 150; policy accept;
+    }
+
+    chain OUTPUT { # handle 3
+        type filter hook output priority 150; policy accept;
+        meta l4proto tcp ip daddr 168.63.129.16 tcp dport 53 counter packets 0 bytes 0 accept # handle 4
+        meta l4proto tcp ip daddr 168.63.129.16 skuid 0 counter packets 319671 bytes 451835370 accept # handle 5
+        meta l4proto tcp ip daddr 168.63.129.16 ct state invalid,new counter packets 0 bytes 0 drop # handle 6
+    }
+}
+EOF
+
+# firewalld.conf
+cat > "test-data/${SOSDIR}/etc/firewalld/firewalld.conf" << 'EOF'
+# firewalld config file
+DefaultZone=public
+CleanupOnExit=yes
+Lockdown=no
+IPv6_rpfilter=yes
+IndividualCalls=no
+LogDenied=off
+FirewallBackend=nftables
+FlushAllOnReload=yes
+AllowZoneDrifting=yes
+EOF
+
+# /etc/sysconfig/iptables-config
+cat > "test-data/${SOSDIR}/etc/sysconfig/iptables-config" << 'EOF'
+IPTABLES_MODULES=""
+IPTABLES_SAVE_ON_STOP="no"
+IPTABLES_SAVE_ON_RESTART="no"
+IPTABLES_SAVE_COUNTER="no"
+IPTABLES_STATUS_NUMERIC="yes"
+IPTABLES_STATUS_VERBOSE="no"
+IPTABLES_STATUS_LINENUMBERS="yes"
+EOF
+
+# /etc/sysconfig/ebtables-config
+cat > "test-data/${SOSDIR}/etc/sysconfig/ebtables-config" << 'EOF'
+EBTABLES_SAVE_ON_STOP="no"
+EBTABLES_SAVE_COUNTER="no"
+EOF
+
+# /etc/sysconfig/nftables.conf
+cat > "test-data/${SOSDIR}/etc/sysconfig/nftables.conf" << 'EOF'
+# Uncomment the include statement here to load the default config sample
+#include "/etc/nftables/main.nft"
+EOF
+
+# /etc/sysconfig/firewalld
+cat > "test-data/${SOSDIR}/etc/sysconfig/firewalld" << 'EOF'
+# firewalld command line args
+FIREWALLD_ARGS=
+EOF
+
+create_fixture "test-firewall-sosreport"
+
+################################################################################
+# Test: Firewall Rules - SOS with firewalld running and active zones
+################################################################################
+echo ""
+echo "=== Creating test-firewall-sosreport-active.tar.xz ==="
+SOSDIR="sosreport-testfwactive-2025-01-15-xyzabc"
+mkdir -p "test-data/${SOSDIR}/sos_commands/firewalld"
+mkdir -p "test-data/${SOSDIR}/sos_commands/firewall_tables"
+mkdir -p "test-data/${SOSDIR}/etc/firewalld"
+
+# firewalld state: running
+echo "running" > "test-data/${SOSDIR}/sos_commands/firewalld/firewall-cmd_--state"
+
+# firewalld zones (runtime) - active
+cat > "test-data/${SOSDIR}/sos_commands/firewalld/firewall-cmd_--list-all-zones" << 'EOF'
+public (active)
+  target: default
+  icmp-block-inversion: no
+  interfaces: eth0
+  sources:
+  services: cockpit dhcpv6-client ssh
+  ports: 8080/tcp 443/tcp
+  protocols:
+  forward: yes
+  masquerade: no
+  forward-ports:
+  source-ports:
+  icmp-blocks:
+  rich rules:
+	rule family="ipv4" source address="10.0.0.0/8" accept
+EOF
+
+# firewalld zones (permanent)
+cat > "test-data/${SOSDIR}/sos_commands/firewalld/firewall-cmd_--permanent_--list-all-zones" << 'EOF'
+public (active)
+  target: default
+  icmp-block-inversion: no
+  interfaces: eth0
+  sources:
+  services: cockpit dhcpv6-client ssh
+  ports: 8080/tcp 443/tcp
+  protocols:
+  forward: yes
+  masquerade: no
+  forward-ports:
+  source-ports:
+  icmp-blocks:
+  rich rules:
+	rule family="ipv4" source address="10.0.0.0/8" accept
+EOF
+
+# firewalld direct rules
+echo "" > "test-data/${SOSDIR}/sos_commands/firewalld/firewall-cmd_--direct_--get-all-rules"
+echo "" > "test-data/${SOSDIR}/sos_commands/firewalld/firewall-cmd_--permanent_--direct_--get-all-rules"
+
+# firewalld direct chains
+echo "" > "test-data/${SOSDIR}/sos_commands/firewalld/firewall-cmd_--direct_--get-all-chains"
+echo "" > "test-data/${SOSDIR}/sos_commands/firewalld/firewall-cmd_--permanent_--direct_--get-all-chains"
+
+# firewalld passthroughs
+echo "" > "test-data/${SOSDIR}/sos_commands/firewalld/firewall-cmd_--direct_--get-all-passthroughs"
+echo "" > "test-data/${SOSDIR}/sos_commands/firewalld/firewall-cmd_--permanent_--direct_--get-all-passthroughs"
+
+# firewalld log-denied
+echo "off" > "test-data/${SOSDIR}/sos_commands/firewalld/firewall-cmd_--get-log-denied"
+
+# nftables ruleset (firewalld-generated)
+cat > "test-data/${SOSDIR}/sos_commands/firewall_tables/nft_-a_list_ruleset" << 'EOF'
+table inet firewalld { # handle 1
+    chain filter_INPUT { # handle 1
+        type filter hook input priority 10; policy accept;
+        ct state established,related accept # handle 4
+        iifname "lo" accept # handle 5
+        ct state invalid drop # handle 6
+        jump filter_INPUT_ZONES # handle 7
+        reject with icmpx admin-prohibited # handle 8
+    }
+    chain filter_FORWARD { # handle 2
+        type filter hook forward priority 10; policy accept;
+        ct state established,related accept # handle 9
+        ct state invalid drop # handle 10
+        jump filter_FORWARD_ZONES # handle 11
+        reject with icmpx admin-prohibited # handle 12
+    }
+    chain filter_OUTPUT { # handle 3
+        type filter hook output priority 10; policy accept;
+    }
+}
+EOF
+
+# firewalld.conf
+cat > "test-data/${SOSDIR}/etc/firewalld/firewalld.conf" << 'EOF'
+DefaultZone=public
+CleanupOnExit=yes
+Lockdown=no
+IPv6_rpfilter=yes
+LogDenied=off
+FirewallBackend=nftables
+FlushAllOnReload=yes
+AllowZoneDrifting=no
+EOF
+
+create_fixture "test-firewall-sosreport-active"
+
+################################################################################
+# Test: Network Interfaces - SCC (supportconfig) format
+# Tests interface detection, DHCP/static, accelerated networking in network.txt
+################################################################################
+echo ""
+echo "=== Creating test-network-interfaces-scc.tar.xz ==="
+mkdir -p test-data
+cat > test-data/network.txt << 'SCCEOF'
+#==[ Command ]======================================#
+# /sbin/ip addr show
+1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
+    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
+    inet 127.0.0.1/8 scope host lo
+       valid_lft forever preferred_lft forever
+    inet6 ::1/128 scope host
+       valid_lft forever preferred_lft forever
+2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
+    link/ether 00:0d:3a:12:34:56 brd ff:ff:ff:ff:ff:ff
+    inet 10.0.0.4/24 brd 10.0.0.255 scope global eth0
+       valid_lft forever preferred_lft forever
+    inet6 fe80::20d:3aff:fe12:3456/64 scope link
+       valid_lft forever preferred_lft forever
+3: eth1: <BROADCAST,MULTICAST,SLAVE,UP,LOWER_UP> mtu 1500 qdisc mq master eth0 state UP group default qlen 1000
+    link/ether 00:0d:3a:12:34:57 brd ff:ff:ff:ff:ff:ff
+
+#==[ Command ]======================================#
+# /sbin/ethtool -i eth0
+driver: hv_netvsc
+version: 5.4.0
+firmware-version: N/A
+bus-info: vmbus:xxx-yyy
+supports-statistics: yes
+
+#==[ Command ]======================================#
+# /sbin/ethtool -i eth1
+driver: mlx5_core
+version: 5.8-3.0.7
+firmware-version: 16.35.2000
+bus-info: 0000:00:02.0
+supports-statistics: yes
+
+#==[ Configuration File ]======================================#
+# /etc/sysconfig/network/ifcfg-eth0
+BOOTPROTO='dhcp'
+STARTMODE='onboot'
+CLOUD_NETCONFIG_MANAGE='yes'
+
+#==[ Configuration File ]======================================#
+# /etc/sysconfig/network/ifcfg-eth1
+BOOTPROTO='static'
+IPADDR='10.0.0.10'
+NETMASK='255.255.255.0'
+STARTMODE='hotplug'
+SCCEOF
+create_fixture "test-network-interfaces-scc"
+
+################################################################################
+# Test: Network Interfaces - SOS report format with MANA driver
+# Tests MANA detection and DHCP config in separate SOS files
+################################################################################
+echo ""
+echo "=== Creating test-network-interfaces-sos-mana.tar.xz ==="
+SOSDIR="sos_commands"
+mkdir -p "test-data/${SOSDIR}/networking"
+mkdir -p "test-data/etc/sysconfig/network-scripts"
+
+cat > "test-data/${SOSDIR}/networking/ip_-o_addr" << 'EOF'
+1: lo    inet 127.0.0.1/8 scope host lo\       valid_lft forever preferred_lft forever
+2: eth0    inet 10.1.0.5/24 brd 10.1.0.255 scope global dynamic noprefixroute eth0\       valid_lft 86399sec preferred_lft 86399sec
+3: enP30832s1    inet 10.1.0.5/24 brd 10.1.0.255 scope global dynamic noprefixroute enP30832s1\       valid_lft 86399sec preferred_lft 86399sec
+1: lo    inet6 ::1/128 scope host \       valid_lft forever preferred_lft forever
+2: eth0    inet6 fe80::1234:abcd:ef01:2345/64 scope link \       valid_lft forever preferred_lft forever
+EOF
+
+cat > "test-data/${SOSDIR}/networking/ip_-s_-d_link" << 'EOF'
+1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
+    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 promiscuity 0 minmtu 0 maxmtu 0 addrgenmode eui64 numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
+2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
+    link/ether 60:45:bd:12:34:56 brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65521 addrgenmode eui64 numtxqueues 64 numrxqueues 64 gso_max_size 62780 gso_max_segs 44
+3: enP30832s1: <BROADCAST,MULTICAST,SLAVE,UP,LOWER_UP> mtu 1500 qdisc mq master eth0 state UP mode DEFAULT group default qlen 1000
+    link/ether 60:45:bd:12:34:57 brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 9706 addrgenmode eui64 numtxqueues 64 numrxqueues 64 gso_max_size 62780 gso_max_segs 44
+EOF
+
+cat > "test-data/${SOSDIR}/networking/ethtool_-i_eth0" << 'EOF'
+driver: hv_netvsc
+version: N/A
+firmware-version: N/A
+bus-info: {c6a23e40-1234-5678-abcd-ef0123456789}
+supports-statistics: yes
+supports-test: no
+supports-eeprom-access: no
+supports-register-dump: yes
+supports-priv-flags: no
+EOF
+
+cat > "test-data/${SOSDIR}/networking/ethtool_-i_enP30832s1" << 'EOF'
+driver: mana
+version: N/A
+firmware-version: N/A
+bus-info: 7870:00:01.0
+supports-statistics: yes
+supports-test: no
+supports-eeprom-access: no
+supports-register-dump: no
+supports-priv-flags: no
+EOF
+
+cat > "test-data/etc/sysconfig/network-scripts/ifcfg-eth0" << 'EOF'
+TYPE=Ethernet
+PROXY_METHOD=none
+BROWSER_ONLY=no
+BOOTPROTO=dhcp
+DEFROUTE=yes
+IPV4_FAILURE_FATAL=no
+NAME=eth0
+UUID=abc12345-6789-def0-1234-567890abcdef
+DEVICE=eth0
+ONBOOT=yes
+EOF
+create_fixture "test-network-interfaces-sos-mana"
+
+# === Vmcore / Kernel Crash Dump test fixtures ===
+
+echo ""
+echo "=== Creating test-vmcore-crashes.tar.xz ==="
+# Simulates a sosreport with vmcore crash dumps under /var/crash/
+mkdir -p test-data/var/crash/127.0.0.1-2026-02-13-03:48:00
+cat > test-data/var/crash/127.0.0.1-2026-02-13-03:48:00/vmcore-dmesg.txt << 'VMCORE1'
+[1402779.794755] RBP: 00007ffd130716b0 R08: 0000000000000000 R09: 000055afb46cc04a
+[1402779.794758] Call Trace:
+[1402779.794758]  <NMI>
+[1402779.794759]  ? nmi_cpu_backtrace.cold.8+0x36/0x4f
+[1402779.794760]  ? nmi_handle+0x63/0x110
+[1402779.794760]  ? default_do_nmi+0x49/0x110
+[1402779.794762]  ? entry_SYSCALL_64+0x20/0x29
+[1402779.794763]  </NMI>
+[1402779.795694] Kernel panic - not syncing: hung_task: blocked tasks
+[1402779.799668] CPU: 2 PID: 71 Comm: khungtaskd Kdump: loaded Not tainted 4.18.0-553.89.1.el8_10.x86_64 #1
+[1402779.804715] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090008  12/07/2018
+[1402779.810167] Call Trace:
+[1402779.811613]  dump_stack+0x41/0x60
+[1402779.813585]  panic+0xe7/0x2ac
+[1402779.815436]  watchdog+0x25c/0x2f0
+[1402779.817475]  ? hungtask_pm_notify+0x50/0x50
+[1402779.819840]  kthread+0x134/0x150
+[1402779.822015]  ? set_kthread_struct+0x50/0x50
+[1402779.824325]  ret_from_fork+0x35/0x40
+[1402779.827475] Kernel Offset: 0x31800000 from 0xffffffff81000000
+VMCORE1
+
+mkdir -p test-data/var/crash/127.0.0.1-2025-10-05-09:02:28
+cat > test-data/var/crash/127.0.0.1-2025-10-05-09:02:28/vmcore-dmesg.txt << 'VMCORE2'
+[1597907.803447]  </NMI>
+[1597907.803448]  do_sys_openat2+0x19a/0x2b0
+[1597907.803449]  do_sys_open+0x4b/0x80
+[1597907.803449]  do_syscall_64+0x5b/0x1a0
+[1597907.804298] Kernel panic - not syncing: hung_task: blocked tasks
+[1597907.807824] CPU: 2 PID: 71 Comm: khungtaskd Kdump: loaded Not tainted 4.18.0-553.75.1.el8_10.x86_64 #1
+[1597907.812843] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090008  12/07/2018
+[1597907.817822] Call Trace:
+[1597907.819308]  dump_stack+0x41/0x60
+[1597907.821112]  panic+0xe7/0x2ac
+[1597907.823058]  watchdog+0x25c/0x2f0
+[1597907.825156]  ? hungtask_pm_notify+0x50/0x50
+[1597907.827669]  kthread+0x134/0x150
+[1597907.829724]  ? set_kthread_struct+0x50/0x50
+[1597907.832021]  ret_from_fork+0x35/0x40
+VMCORE2
+
+mkdir -p test-data/sos_commands/kdump
+cat > test-data/sos_commands/kdump/kdumpctl_status << 'KDSTATUS'
+kdump: Kdump is operational
+KDSTATUS
+
+cat > test-data/sos_commands/kdump/ls_-alZR_.var.crash << 'CRASHLS'
+/var/crash:
+total 4
+drwxr-xr-x.  4 root root system_u:object_r:kdump_crash_t:s0  154 Feb 13 03:48 .
+drwxr-xr-x. 22 root root system_u:object_r:var_t:s0         4096 Mar 17  2022 ..
+drwxr-xr-x.  2 root root system_u:object_r:unlabeled_t:s0     67 Oct  5 09:02 127.0.0.1-2025-10-05-09:02:28
+drwxr-xr-x.  2 root root system_u:object_r:unlabeled_t:s0     67 Feb 13 03:48 127.0.0.1-2026-02-13-03:48:00
+
+/var/crash/127.0.0.1-2025-10-05-09:02:28:
+total 735368
+drwxr-xr-x. 2 root root system_u:object_r:unlabeled_t:s0          67 Oct  5 09:02 .
+drwxr-xr-x. 4 root root system_u:object_r:kdump_crash_t:s0       154 Feb 13 03:48 ..
+-rw-------. 1 root root system_u:object_r:unlabeled_t:s0       50098 Oct  5 09:02 kexec-dmesg.log
+-rw-------. 1 root root system_u:object_r:unlabeled_t:s0   752719997 Oct  5 09:02 vmcore
+-rw-------. 1 root root system_u:object_r:unlabeled_t:s0      240185 Oct  5 09:02 vmcore-dmesg.txt
+
+/var/crash/127.0.0.1-2026-02-13-03:48:00:
+total 1320564
+drwxr-xr-x. 2 root root system_u:object_r:unlabeled_t:s0           67 Feb 13 03:48 .
+drwxr-xr-x. 4 root root system_u:object_r:kdump_crash_t:s0        154 Feb 13 03:48 ..
+-rw-------. 1 root root system_u:object_r:unlabeled_t:s0        50470 Feb 13 03:48 kexec-dmesg.log
+-rw-------. 1 root root system_u:object_r:unlabeled_t:s0   1351110790 Feb 13 03:48 vmcore
+-rw-------. 1 root root system_u:object_r:unlabeled_t:s0      1082635 Feb 13 03:48 vmcore-dmesg.txt
+CRASHLS
+
+mkdir -p test-data/etc
+cat > test-data/etc/kdump.conf << 'KDCONF'
+# kdump configuration
+path /var/crash
+core_collector makedumpfile -l --message-level 7 -d 31
+failure_action shell
+KDCONF
+
+create_fixture "test-vmcore-crashes"
+
+################################################################################
+# Vmcore edge-cases: empty kdump status, no-vmcore listing, no-date crash,
+# timestamp-free dmesg ending with ---[ ... ]--- (exercises every branch)
+################################################################################
+echo ""
+echo "=== Creating test-vmcore-edge-cases.tar.xz ==="
+
+# vmcore-dmesg WITHOUT date in directory path → crash.date stays null
+# Also no timestamp prefixes so "---[ end ... ]---" terminates the call trace
+mkdir -p test-data/var/crash/nodate-crash
+cat > test-data/var/crash/nodate-crash/vmcore-dmesg.txt << 'VMCORE_NODATE'
+Linux version 5.14.0-362.el9.x86_64
+Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
+CPU: 0 PID: 1 Comm: swapper/0 Kdump: loaded Not tainted 5.14.0-362.el9.x86_64 #1
+Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090008  12/07/2018
+Call Trace:
+ <TASK>
+ mount_block_root+0x1f0/0x220
+ prepare_namespace+0x136/0x170
+ kernel_init_freeable+0x2a4/0x2d0
+ kernel_init+0x1a/0x130
+ </TASK>
+Kernel Offset: disabled
+VMCORE_NODATE
+
+# vmcore-dmesg WITH valid date → when sorted with the nodate crash, exercises
+# the !a.date / !b.date null-date sort guards
+mkdir -p "test-data/var/crash/127.0.0.1-2026-01-20-15:30:00"
+cat > "test-data/var/crash/127.0.0.1-2026-01-20-15:30:00/vmcore-dmesg.txt" << 'VMCORE_DATED'
+[300.000001] Kernel panic - not syncing: Fatal exception in interrupt
+[300.000005] CPU: 3 PID: 0 Comm: swapper/3 Kdump: loaded Not tainted 5.14.0-362.el9.x86_64 #1
+[300.000010] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090008  12/07/2018
+[300.000015] Call Trace:
+[300.000016]  die+0x5/0x50
+[300.000017]  do_trap+0x80/0x100
+[300.000018]  do_error_trap+0x65/0x80
+VMCORE_DATED
+
+# Empty kdump status → parseKdumpStatus returns null (covers empty-content branch)
+mkdir -p test-data/sos_commands/kdump
+touch test-data/sos_commands/kdump/kdumpctl_status
+
+# Crash listing with no vmcore files → parseCrashListing returns null
+cat > test-data/sos_commands/kdump/ls_-alZR_.var.crash << 'CRASHLS_EMPTY'
+/var/crash:
+total 0
+drwxr-xr-x. 2 root root system_u:object_r:var_t:s0    6 Jan  1 00:00 .
+drwxr-xr-x. 22 root root system_u:object_r:var_t:s0 4096 Jan  1 00:00 ..
+CRASHLS_EMPTY
+
+# Basic kdump.conf
+mkdir -p test-data/etc
+cat > test-data/etc/kdump.conf << 'KDCONF_EDGE'
+# kdump configuration
+path /var/crash
+core_collector makedumpfile -l --message-level 7 -d 31
+default reboot
+KDCONF_EDGE
+
+create_fixture "test-vmcore-edge-cases"
+
+################################################################################
+# Test: InspectIaaSDisk storage - block devices from results.txt + fstab
+# Tests that blockDevicesParser extracts Filesystem Status from results.txt
+# and correlates UUIDs with fstab entries (including mismatches)
+################################################################################
+echo ""
+echo "=== Creating test-inspect-iaas-disk-storage.zip ==="
+
+python3 - "$FIXTURES_DIR" << 'INSPECT_STORAGE_PYEOF'
+import zipfile, sys
+fixtures_dir = sys.argv[1]
+fixture_path = f"{fixtures_dir}/test-inspect-iaas-disk-storage.zip"
+
+# results.txt with Filesystem Status providing device/uuid/fstype data
+results_txt = """Execution start time: 14:30:00.
+
+========== Request Info ==========
+Storage Acct: md-storagetest.z45.blob.storage.azure.net
+Container/Vhd: /storagecontainer/test
+Manifest requested: diagnostic
+Inspect service Operational ID: aabbccdd-1234-5678-90ab-cdef01234567
+Guestfish version: 1.52.1.
+========== End Request Info ==========
+
+Filesystem Status:
+/dev/sda1: xfs [uuid=11111111-aaaa-bbbb-cccc-111111111111]
+/dev/sda14: unknown [uuid=]
+/dev/sda15: vfat [uuid=ABCD-EF01]
+/dev/rootvg/homelv: xfs [uuid=22222222-aaaa-bbbb-cccc-222222222222]
+/dev/rootvg/rootlv: xfs [uuid=33333333-aaaa-bbbb-cccc-333333333333]
+/dev/rootvg/tmplv: xfs [uuid=44444444-aaaa-bbbb-cccc-444444444444]
+/dev/rootvg/usrlv: xfs [uuid=55555555-aaaa-bbbb-cccc-555555555555]
+/dev/rootvg/varlv: xfs [uuid=66666666-aaaa-bbbb-cccc-666666666666]
+Inspection Status:
+/dev/rootvg/rootlv
+Inspection Metadata for /dev/rootvg/rootlv
+Type: linux
+Distribution: rhel
+Product Name: Red Hat Enterprise Linux release 8.8 (Ootpa)
+Mount Points:
+/: /dev/rootvg/rootlv
+/var: /dev/rootvg/varlv
+/usr: /dev/rootvg/usrlv
+/tmp: /dev/rootvg/tmplv
+/home: /dev/rootvg/homelv
+/boot: /dev/sda1
+/boot/efi: /dev/sda15
+/mnt: /dev/disk/cloud/azure_resource-part1
+Mounting /dev/rootvg/rootlv on / SUCCEEDED.
+Mounting /dev/rootvg/varlv on /var SUCCEEDED.
+Mounting /dev/rootvg/usrlv on /usr SUCCEEDED.
+Mounting /dev/rootvg/tmplv on /tmp SUCCEEDED.
+Mounting /dev/rootvg/homelv on /home SUCCEEDED.
+Mounting /dev/sda1 on /boot SUCCEEDED.
+Mounting /dev/sda15 on /boot/efi SUCCEEDED.
+Mounting /dev/disk/cloud/azure_resource-part1 on /mnt FAILED.
+
+Using manifest: diagnostic  [linux]
+14:30:30  Executing Operation [1/1]: echo,### Done ###
+### Done ###
+"""
+
+# fstab with intentional issues for testing UUID correlation:
+# - OLD-UUID-DEAD references a UUID not present on disk (disk replaced)
+# - 77777777 has fstype mismatch (fstab=ext4, disk=xfs)
+# - GONE-UUID has no matching device at all
+fstab_content = """#
+# /etc/fstab
+#
+/dev/mapper/rootvg-rootlv /                       xfs     defaults        0 0
+UUID=11111111-aaaa-bbbb-cccc-111111111111 /boot   xfs     defaults        0 0
+UUID=ABCD-EF01          /boot/efi               vfat    defaults,uid=0,gid=0,umask=077,shortname=winnt 0 2
+/dev/mapper/rootvg-homelv /home                   xfs     defaults        0 0
+/dev/mapper/rootvg-tmplv /tmp                    xfs     defaults        0 0
+/dev/mapper/rootvg-usrlv /usr                    xfs     defaults        0 0
+/dev/mapper/rootvg-varlv /var                    xfs     defaults        0 0
+/dev/disk/cloud/azure_resource-part1    /mnt    auto    defaults,nofail,x-systemd.requires=cloud-init.service,comment=cloudconfig       0       2
+# Data disk was replaced - UUID no longer exists on any device
+UUID=OLD-UUID-DEAD-DEAD-DEAD-DEADDEADDEAD /data xfs defaults,nofail 0 2
+# UUID does not exist at all
+UUID=GONE-UUID-0000-0000-0000-000000000000 /opt ext4 defaults,nofail 0 2
+"""
+
+redhat_release = "Red Hat Enterprise Linux release 8.8 (Ootpa)\\n"
+hostname_content = "storagetest01\\n"
+
+with zipfile.ZipFile(fixture_path, 'w', zipfile.ZIP_DEFLATED) as zf:
+    zf.writestr('results.txt', results_txt)
+    zf.writestr('diskinfo.txt', 'Disk info placeholder\\n')
+    zf.writestr('device_0/etc/fstab', fstab_content)
+    zf.writestr('device_0/etc/redhat-release', redhat_release)
+    zf.writestr('device_0/etc/hostname', hostname_content)
+INSPECT_STORAGE_PYEOF
+echo "[OK] Created test-inspect-iaas-disk-storage.zip"
+
+################################################################################
+# Test: sosreport storage - block devices from lsblk/blkid + fstab
+# Tests blockDevicesParser with sosreport sos_commands/block files including
+# basic lsblk, lsblk -f, and blkid, correlated with /etc/fstab
+################################################################################
+echo ""
+echo "=== Creating test-sosreport-storage.tar.xz ==="
+
+# Standard sosreport directory structure
+mkdir -p test-data/sos_commands/block
+mkdir -p test-data/etc
+
+# Basic lsblk output
+cat > test-data/sos_commands/block/lsblk << 'EOF'
+NAME            MAJ:MIN RM   SIZE RO TYPE MOUNTPOINTS
+sda               8:0    0    64G  0 disk 
+├─sda1            8:1    0   500M  0 part /boot
+├─sda2            8:2    0     1M  0 part 
+├─sda14           8:14   0     4M  0 part 
+├─sda15           8:15   0   495M  0 part /boot/efi
+└─sda16           8:16   0    63G  0 part 
+  ├─rootvg-rootlv  253:0  0    10G  0 lvm  /
+  ├─rootvg-usrlv   253:1  0    10G  0 lvm  /usr
+  ├─rootvg-varlv   253:2  0    10G  0 lvm  /var
+  ├─rootvg-tmplv   253:3  0     5G  0 lvm  /tmp
+  └─rootvg-homelv  253:4  0     5G  0 lvm  /home
+sdb               8:16   0   128G  0 disk 
+└─sdb1            8:17   0   128G  0 part /mnt
+sdc               8:32   0   256G  0 disk 
+└─sdc1            8:33   0   256G  0 part /data
+EOF
+
+# lsblk -f -a -l output (includes filesystem, UUID, mount info)
+cat > 'test-data/sos_commands/block/lsblk_-f_-a_-l' << 'EOF'
+NAME             FSTYPE FSVER LABEL UUID                                 FSAVAIL FSUSE% MOUNTPOINTS
+sda                                                                                      
+sda1             xfs                aaaa1111-1111-1111-1111-aaaaaaaaaaaa  300M    40%    /boot
+sda2                                                                                     
+sda14                                                                                    
+sda15            vfat   FAT32       EFI0-BOOT                            400M    19%    /boot/efi
+sda16            LVM2_m LVM2                                                             
+rootvg-rootlv    xfs                bbbb2222-2222-2222-2222-bbbbbbbbbbbb    7G    30%    /
+rootvg-usrlv     xfs                cccc3333-3333-3333-3333-cccccccccccc    6G    40%    /usr
+rootvg-varlv     xfs                dddd4444-4444-4444-4444-dddddddddddd    7G    30%    /var
+rootvg-tmplv     xfs                eeee5555-5555-5555-5555-eeeeeeeeeeee    4G    20%    /tmp
+rootvg-homelv    xfs                ffff6666-6666-6666-6666-ffffffffffff    4G    20%    /home
+sdb                                                                                      
+sdb1             ext4   1.0         1234abcd-abcd-abcd-abcd-1234abcd1234  110G     6%   /mnt
+sdc                                                                                      
+sdc1             xfs          data  5678ef01-ef01-ef01-ef01-5678ef015678  230G     6%   /data
+EOF
+
+# blkid output
+cat > 'test-data/sos_commands/block/blkid_-c_.dev.null' << 'EOF'
+/dev/sda1: UUID="aaaa1111-1111-1111-1111-aaaaaaaaaaaa" BLOCK_SIZE="512" TYPE="xfs" PARTUUID="p-sda1"
+/dev/sda15: UUID="EFI0-BOOT" BLOCK_SIZE="512" TYPE="vfat" PARTUUID="p-sda15"
+/dev/sda16: TYPE="LVM2_member" PARTUUID="p-sda16"
+/dev/mapper/rootvg-rootlv: UUID="bbbb2222-2222-2222-2222-bbbbbbbbbbbb" BLOCK_SIZE="4096" TYPE="xfs"
+/dev/mapper/rootvg-usrlv: UUID="cccc3333-3333-3333-3333-cccccccccccc" BLOCK_SIZE="4096" TYPE="xfs"
+/dev/mapper/rootvg-varlv: UUID="dddd4444-4444-4444-4444-dddddddddddd" BLOCK_SIZE="4096" TYPE="xfs"
+/dev/mapper/rootvg-tmplv: UUID="eeee5555-5555-5555-5555-eeeeeeeeeeee" BLOCK_SIZE="4096" TYPE="xfs"
+/dev/mapper/rootvg-homelv: UUID="ffff6666-6666-6666-6666-ffffffffffff" BLOCK_SIZE="4096" TYPE="xfs"
+/dev/sdb1: UUID="1234abcd-abcd-abcd-abcd-1234abcd1234" BLOCK_SIZE="4096" TYPE="ext4" PARTUUID="p-sdb1"
+/dev/sdc1: UUID="5678ef01-ef01-ef01-ef01-5678ef015678" BLOCK_SIZE="4096" TYPE="xfs" LABEL="data" PARTUUID="p-sdc1"
+EOF
+
+# fstab with known-good entries + one missing UUID + one fstype mismatch
+cat > test-data/etc/fstab << 'EOF'
+# /etc/fstab - sosreport storage test
+/dev/mapper/rootvg-rootlv /                       xfs     defaults        0 1
+UUID=aaaa1111-1111-1111-1111-aaaaaaaaaaaa /boot   xfs     defaults        0 2
+UUID=EFI0-BOOT /boot/efi                          vfat    defaults        0 2
+/dev/mapper/rootvg-usrlv /usr                      xfs     defaults        0 0
+/dev/mapper/rootvg-varlv /var                      xfs     defaults        0 0
+/dev/mapper/rootvg-tmplv /tmp                      xfs     defaults        0 0
+/dev/mapper/rootvg-homelv /home                    xfs     defaults        0 0
+UUID=1234abcd-abcd-abcd-abcd-1234abcd1234 /mnt    ext4    defaults,nofail 0 2
+# Filesystem type mismatch: fstab says ext4, actual disk (sdc1) is xfs
+UUID=5678ef01-ef01-ef01-ef01-5678ef015678 /data   ext4    defaults,nofail 0 2
+# This UUID no longer exists on any disk
+UUID=DEAD0000-0000-0000-0000-DEAD00000000 /backup ext4    defaults,nofail 0 2
+EOF
+
+# Add os-release for sosreport identification
+cat > test-data/etc/os-release << 'EOF'
+NAME="Red Hat Enterprise Linux"
+VERSION="8.8 (Ootpa)"
+ID="rhel"
+VERSION_ID="8.8"
+PRETTY_NAME="Red Hat Enterprise Linux 8.8 (Ootpa)"
+EOF
+
+create_fixture "test-sosreport-storage"
+
+# =====================================================================
+# InspectIaaSDisk ZIP fixture
+# =====================================================================
+echo ""
+echo "=== Creating test-inspect-iaas-disk.zip ==="
+
+# InspectIaaSDisk files are ZIP archives (not tar.xz), so we use python/zip directly
+python3 - "$FIXTURES_DIR" << 'INSPECT_PYEOF'
+import zipfile, sys
+fixtures_dir = sys.argv[1]
+fixture_path = f"{fixtures_dir}/test-inspect-iaas-disk.zip"
+
+results_txt = """Execution start time: 20:46:49.
+
+========== Request Info ==========
+Storage Acct: md-testaccount.z45.blob.storage.azure.net
+Container/Vhd: /testcontainer/abcd
+Manifest requested: diagnostic
+Inspect service Operational ID: 117c4d70-8c42-44c5-9f3e-cddeb3eb4264
+Guestfish version: 1.52.1.
+========== End Request Info ==========
+
+Filesystem Status:
+/dev/sda1: xfs [uuid=849d8772-f8d2-4698-8d69-53c316388aa8]
+/dev/sda14: unknown [uuid=]
+/dev/sda15: vfat [uuid=E1E6-DC77]
+/dev/rootvg/homelv: xfs [uuid=49728169-a170-45f8-a201-4a379b58e421]
+/dev/rootvg/rootlv: xfs [uuid=b6a91419-76de-400f-b28c-6eb44864e89f]
+/dev/rootvg/tmplv: xfs [uuid=ff83b522-e9c1-4d94-98c9-5a9fe925a8e8]
+/dev/rootvg/usrlv: xfs [uuid=d081f48e-8ab0-4512-b8c6-bd4180d2e13e]
+/dev/rootvg/varlv: xfs [uuid=d73a5f17-6c3f-4cd6-b6b5-cea4b582aef2]
+Inspection Status:
+/dev/rootvg/rootlv
+Inspection Metadata for /dev/rootvg/rootlv
+Type: linux
+Distribution: rhel
+Product Name: Red Hat Enterprise Linux release 8.8 (Ootpa)
+Mount Points:
+/: /dev/rootvg/rootlv
+/mnt: /dev/disk/cloud/azure_resource-part1
+/var: /dev/rootvg/varlv
+/usr: /dev/rootvg/usrlv
+/tmp: /dev/rootvg/tmplv
+/home: /dev/rootvg/homelv
+/boot: /dev/sda1
+/boot/efi: /dev/sda15
+Mounting /dev/rootvg/rootlv on / SUCCEEDED.
+Mounting /dev/disk/cloud/azure_resource-part1 on /mnt FAILED.
+Mounting /dev/rootvg/varlv on /var SUCCEEDED.
+Mounting /dev/rootvg/usrlv on /usr SUCCEEDED.
+Mounting /dev/rootvg/tmplv on /tmp SUCCEEDED.
+Mounting /dev/rootvg/homelv on /home SUCCEEDED.
+Mounting /dev/sda1 on /boot SUCCEEDED.
+Mounting /dev/sda15 on /boot/efi SUCCEEDED.
+
+
+Using manifest: diagnostic  [linux]
+20:47:21  Executing Operation [1/3]: echo,### Probing Directories ###
+### Probing Directories ###
+20:47:21  Executing Operation [2/3]: ll,/boot
+20:47:21  Listing contents of /boot:
+total 226040
+drwxr-xr-x.  2 root root     4096 Oct 18 22:57 .
+20:47:22  Executing Operation [3/3]: ll,/var/log
+20:47:22  Listing contents of /var/log:
+total 1000
+drwxr-xr-x.  2 root root     4096 Oct 18 22:57 .
+"""
+
+fstab_content = """#
+# /etc/fstab
+# Created by anaconda on Thu Aug 18 07:45:40 2022
+#
+/dev/mapper/rootvg-rootlv /                       xfs     defaults        0 0
+UUID=849d8772-f8d2-4698-8d69-53c316388aa8 /boot                   xfs     defaults        0 0
+UUID=E1E6-DC77          /boot/efi               vfat    defaults,uid=0,gid=0,umask=077,shortname=winnt 0 2
+/dev/mapper/rootvg-homelv /home                   xfs     defaults        0 0
+/dev/mapper/rootvg-tmplv /tmp                    xfs     defaults        0 0
+/dev/mapper/rootvg-usrlv /usr                    xfs     defaults        0 0
+/dev/mapper/rootvg-varlv /var                    xfs     defaults        0 0
+/dev/disk/cloud/azure_resource-part1    /mnt    auto    defaults,nofail,x-systemd.requires=cloud-init.service,comment=cloudconfig       0       2
+"""
+
+redhat_release = "Red Hat Enterprise Linux release 8.8 (Ootpa)\n"
+hostname_content = "testvm001\n"
+
+hosts_content = """127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
+::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
+10.0.0.10   testvm001 testvm001.internal.cloudapp.net
+10.0.0.11   testvm002 testvm002.internal.cloudapp.net
+"""
+
+waagent_conf = """#
+# Microsoft Azure Linux Agent Configuration
+#
+Extensions.Enabled=y
+Provisioning.Agent=auto
+ResourceDisk.Format=n
+ResourceDisk.EnableSwap=n
+ResourceDisk.SwapSizeMB=2048
+ResourceDisk.MountPoint=/mnt
+OS.EnableFirewall=y
+OS.EnableFIPS=n
+OS.RootDeviceScsiTimeout=300
+Logs.Verbose=n
+Logs.Collect=n
+AutoUpdate.Enabled=y
+AutoUpdate.GAFamily=Prod
+"""
+
+messages_content = """2026-01-15T03:22:01.000000+00:00 testvm001 kernel: Linux version 4.18.0-477.27.1.el8_8.x86_64 (mockbuild@x86-vm-09.build.eng.example.com) (gcc version 8.5.0 20210514 (Red Hat 8.5.0-18)) #1 SMP Thu Aug 31 10:29:22 EDT 2025
+2026-01-15T03:22:05.000000+00:00 testvm001 kernel: Command line: BOOT_IMAGE=(hd0,gpt2)/vmlinuz-4.18.0-477.27.1.el8_8.x86_64 root=/dev/mapper/rootvg-rootlv ro crashkernel=auto
+2026-01-15T03:22:30.000000+00:00 testvm001 cloud-init[1234]: ci-info: ++++++++++++++++++++++++++++++++++++++Net device info+++++++++++++++++++++++++++++++++++++++
+2026-01-15T03:22:30.000001+00:00 testvm001 cloud-init[1234]: ci-info: +--------+------+-----------------------------+---------------+--------+-------------------+
+2026-01-15T03:22:30.000002+00:00 testvm001 cloud-init[1234]: ci-info: | Device |  Up  |           Address           |      Mask     | Scope  |     Hw-Address    |
+2026-01-15T03:22:30.000003+00:00 testvm001 cloud-init[1234]: ci-info: +--------+------+-----------------------------+---------------+--------+-------------------+
+2026-01-15T03:22:30.000004+00:00 testvm001 cloud-init[1234]: ci-info: |  eth0  | True |         10.0.0.99           | 255.255.255.0 | global | 00:11:22:33:44:55 |
+2026-01-15T03:22:30.000005+00:00 testvm001 cloud-init[1234]: ci-info: |   lo   | True |          127.0.0.1          |   255.0.0.0   |  host  |         .         |
+2026-01-15T03:22:30.000006+00:00 testvm001 cloud-init[1234]: ci-info: +--------+------+-----------------------------+---------------+--------+-------------------+
+2026-01-15T03:22:30.000007+00:00 testvm001 cloud-init[1234]: ci-info: +++++++++++++++++++++++++++++++Route IPv4 info+++++++++++++++++++++++++++++++
+2026-01-15T08:15:33.000000+00:00 testvm001 systemd[1]: Shutting down...
+2026-01-15T08:15:45.000000+00:00 testvm001 kernel: Linux version 4.18.0-477.27.1.el8_8.x86_64 (mockbuild@x86-vm-09.build.eng.example.com) (gcc version 8.5.0 20210514 (Red Hat 8.5.0-18)) #1 SMP Thu Aug 31 10:29:22 EDT 2025
+2026-01-15T08:16:10.000000+00:00 testvm001 cloud-init[2634]: ci-info: ++++++++++++++++++++++++++++++++++++++Net device info+++++++++++++++++++++++++++++++++++++++
+2026-01-15T08:16:10.000001+00:00 testvm001 cloud-init[2634]: ci-info: +--------+------+-----------------------------+---------------+--------+-------------------+
+2026-01-15T08:16:10.000002+00:00 testvm001 cloud-init[2634]: ci-info: | Device |  Up  |           Address           |      Mask     | Scope  |     Hw-Address    |
+2026-01-15T08:16:10.000003+00:00 testvm001 cloud-init[2634]: ci-info: +--------+------+-----------------------------+---------------+--------+-------------------+
+2026-01-15T08:16:10.000004+00:00 testvm001 cloud-init[2634]: ci-info: |  eth0  | True |         10.0.0.4            | 255.255.254.0 | global | 00:0d:3a:ab:cd:ef |
+2026-01-15T08:16:10.000005+00:00 testvm001 cloud-init[2634]: ci-info: |  eth0  | True | fe80::20d:3aff:feab:cdef/64 |       .       |  link  | 00:0d:3a:ab:cd:ef |
+2026-01-15T08:16:10.000006+00:00 testvm001 cloud-init[2634]: ci-info: |  eth1  | True | fe80::20d:3aff:feab:cdef/64 |       .       |  link  | 00:0d:3a:ab:cd:ef |
+2026-01-15T08:16:10.000007+00:00 testvm001 cloud-init[2634]: ci-info: |   lo   | True |          127.0.0.1          |   255.0.0.0   |  host  |         .         |
+2026-01-15T08:16:10.000008+00:00 testvm001 cloud-init[2634]: ci-info: |   lo   | True |           ::1/128           |       .       |  host  |         .         |
+2026-01-15T08:16:10.000009+00:00 testvm001 cloud-init[2634]: ci-info: +--------+------+-----------------------------+---------------+--------+-------------------+
+2026-01-15T08:16:10.000010+00:00 testvm001 cloud-init[2634]: ci-info: +++++++++++++++++++++++++++++++Route IPv4 info+++++++++++++++++++++++++++++++
+2026-02-10T14:33:12.000000+00:00 testvm001 kernel: java invoked oom-killer: gfp_mask=0x6200ca(GFP_HIGHUSER_MOVABLE), order=0
+2026-02-10T14:33:12.100000+00:00 testvm001 kernel: Out of memory: Killed process 12345 (java) total-vm:8192000kB, anon-rss:7654321kB, file-rss:0kB, shmem-rss:0kB, UID:1000 pgtables:15012kB oom_score_adj:0
+2026-02-18T22:05:44.000000+00:00 testvm001 kernel: XFS (sdb1): Internal error xfs_iget_cache_miss at line 355 of file fs/xfs/xfs_icache.c. Caller xfs_iget+0x15c/0x240
+2026-02-19T04:10:01.000000+00:00 testvm001 kernel: XFS (sdk4): Found unrecovered unlinked inode 0xb75 in AG 0x4.  Initiating recovery.
+2026-02-20T01:45:22.000000+00:00 testvm001 systemd[1]: You are in emergency mode. After logging in, type \"journalctl -xb\" to view
+"""
+
+ifcfg_eth0 = """DEVICE=eth0
+BOOTPROTO=dhcp
+ONBOOT=yes
+TYPE=Ethernet
+USERCTL=no
+PEERDNS=yes
+IPV6INIT=no
+NM_CONTROLLED=no
+"""
+
+ifcfg_eth1 = """DEVICE=eth1
+BOOTPROTO=static
+IPADDR=10.0.0.50
+PREFIX=24
+ONBOOT=yes
+TYPE=Ethernet
+USERCTL=no
+IPV6INIT=no
+NM_CONTROLLED=no
+"""
+
+firewalld_conf = """# firewalld config file
+DefaultZone=public
+MinimalMark=100
+CleanupOnExit=yes
+Lockdown=no
+IPv6_rpfilter=yes
+IndividualCalls=no
+LogDenied=off
+FirewallBackend=nftables
+"""
+
+dnf_log = """2024-11-17T09:27:25+0000 INFO Installed: python3-azure-mgmt-compute-18.0.0-1.el8.noarch
+2024-11-17T09:27:26+0000 INFO Installed: python3-azure-identity-1.5.0-1.el8.noarch
+2024-11-17T09:27:27+0000 INFO Installed: python3-azure-core-1.22.1-1.el8.noarch
+2024-11-17T09:28:00+0000 INFO Installed: fence-agents-azure-arm-4.10.0-55.el8_9.3.x86_64
+2024-11-17T09:28:01+0000 INFO Installed: resource-agents-4.9.0-44.el8.x86_64
+"""
+
+# Azure VM extension HandlerStatus files (JSON)
+handler_status_defender = '{"name": "Microsoft.Azure.AzureDefenderForServers.MDE.Linux", "version": "1.0.9.2", "status": "NotReady", "code": 1009, "message": "[ExtensionOperationError] Non-zero exit code: 1, /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/MDE-installer.sh", "supports_multi_config": false, "extension_status": null}'
+
+handler_status_backup = '{"name": "Microsoft.Azure.RecoveryServices.VMSnapshotLinux", "version": "1.0.9225.0", "status": "Ready", "code": 0, "message": "Plugin enabled", "supports_multi_config": false, "extension_status": null}'
+
+handler_status_patch = '{"name": "Microsoft.CPlat.Core.LinuxPatchExtension", "version": "1.6.64", "status": "Ready", "code": 0, "message": "Plugin enabled", "supports_multi_config": false, "extension_status": null}'
+
+handler_status_runcommand = '{"name": "Microsoft.CPlat.Core.RunCommandLinux", "version": "1.0.11", "status": "Ready", "code": 0, "message": "Plugin enabled", "supports_multi_config": false, "extension_status": null}'
+
+with zipfile.ZipFile(fixture_path, 'w', zipfile.ZIP_DEFLATED) as zf:
+    zf.writestr('results.txt', results_txt)
+    zf.writestr('diskinfo.txt', 'Disk info placeholder\n')
+    zf.writestr('device_0/etc/fstab', fstab_content)
+    zf.writestr('device_0/etc/redhat-release', redhat_release)
+    zf.writestr('device_0/etc/hostname', hostname_content)
+    zf.writestr('device_0/etc/hosts', hosts_content)
+    zf.writestr('device_0/etc/waagent.conf', waagent_conf)
+    zf.writestr('device_0/var/log/messages', messages_content)
+    zf.writestr('device_0/etc/sysconfig/network-scripts/ifcfg-eth0', ifcfg_eth0)
+    zf.writestr('device_0/etc/sysconfig/network-scripts/ifcfg-eth1', ifcfg_eth1)
+    zf.writestr('device_0/etc/firewalld/firewalld.conf', firewalld_conf)
+    zf.writestr('device_0/var/log/dnf.log', dnf_log)
+    zf.writestr('device_0/var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config/HandlerStatus', handler_status_defender)
+    zf.writestr('device_0/var/lib/waagent/Microsoft.Azure.RecoveryServices.VMSnapshotLinux-1.0.9225.0/config/HandlerStatus', handler_status_backup)
+    zf.writestr('device_0/var/lib/waagent/Microsoft.CPlat.Core.LinuxPatchExtension-1.6.64/config/HandlerStatus', handler_status_patch)
+    zf.writestr('device_0/var/lib/waagent/Microsoft.CPlat.Core.RunCommandLinux-1.0.11/config/HandlerStatus', handler_status_runcommand)
+INSPECT_PYEOF
+echo "[OK] Created test-inspect-iaas-disk.zip"
+
+echo "=== Creating test-inspect-iaas-disk-cluster.zip ==="
+
+python3 - "$FIXTURES_DIR" << 'INSPECT_CLUSTER_PYEOF'
+import zipfile, sys
+fixtures_dir = sys.argv[1]
+fixture_path = f"{fixtures_dir}/test-inspect-iaas-disk-cluster.zip"
+
+results_txt = """Execution start time: 10:12:30.
+
+========== Request Info ==========
+Storage Acct: md-clustertest.z45.blob.storage.azure.net
+Container/Vhd: /clustercontainer/efgh
+Manifest requested: diagnostic
+Inspect service Operational ID: 99a1b2c3-d4e5-6f78-90ab-cdef01234567
+Guestfish version: 1.52.1.
+========== End Request Info ==========
+
+Filesystem Status:
+/dev/sda1: xfs [uuid=aaa11111-1111-1111-1111-111111111111]
+/dev/sda15: vfat [uuid=B00B-1234]
+/dev/rootvg/rootlv: xfs [uuid=bbb22222-2222-2222-2222-222222222222]
+Inspection Status:
+/dev/rootvg/rootlv
+Inspection Metadata for /dev/rootvg/rootlv
+Type: linux
+Distribution: sles
+Product Name: SUSE Linux Enterprise Server 15 SP5
+Mount Points:
+/: /dev/rootvg/rootlv
+/boot: /dev/sda1
+/boot/efi: /dev/sda15
+Mounting /dev/rootvg/rootlv on / SUCCEEDED.
+Mounting /dev/sda1 on /boot SUCCEEDED.
+Mounting /dev/sda15 on /boot/efi SUCCEEDED.
+"""
+
+hosts_content = """127.0.0.1   localhost
+::1         localhost
+# Cluster nodes
+10.0.1.10   hananode01 hananode01.internal.cloudapp.net
+10.0.1.11   hananode02 hananode02.internal.cloudapp.net
+10.0.1.20   hanamajority hanamajority.internal.cloudapp.net
+"""
+
+corosync_conf = """totem {
+    version: 2
+    secauth: on
+    crypto_hash: sha1
+    crypto_cipher: aes256
+    cluster_name: hacluster
+    clear_node_high_bit: yes
+    token: 30000
+    token_retransmits_before_loss_const: 10
+    join: 60
+    consensus: 36000
+    max_messages: 20
+    transport: udpu
+    interface {
+        ringnumber: 0
+        bindnetaddr: 10.0.1.0
+        mcastport: 5405
+        ttl: 1
+    }
+}
+
+logging {
+    fileline: off
+    to_logfile: yes
+    to_syslog: yes
+    logfile: /var/log/cluster/corosync.log
+    debug: off
+    timestamp: on
+    logger_subsys {
+        subsys: QUORUM
+        debug: off
+    }
+}
+
+quorum {
+    provider: corosync_votequorum
+    expected_votes: 2
+    two_node: 1
+}
+
+nodelist {
+    node {
+        ring0_addr: 10.0.1.10
+        name: hananode01
+        nodeid: 1
+    }
+    node {
+        ring0_addr: 10.0.1.11
+        name: hananode02
+        nodeid: 2
+    }
+}
+"""
+
+fstab_content = """#
+# /etc/fstab
+#
+/dev/mapper/rootvg-rootlv /                       xfs     defaults        0 0
+UUID=aaa11111-1111-1111-1111-111111111111 /boot   xfs     defaults        0 0
+UUID=B00B-1234          /boot/efi               vfat    defaults        0 2
+"""
+
+sles_release = "SUSE Linux Enterprise Server 15 (s390x)\nVERSION = 15\nPATCHLEVEL = 5\n"
+
+ifcfg_eth0_suse = """BOOTPROTO='dhcp'
+MTU=''
+REMOTE_IPADDR=''
+STARTMODE='auto'
+CLOUD_NETCONFIG_MANAGE='yes'
+"""
+
+cloud_init_output = """ci-info: ++++++++++++++++++++++++++++++++++++++Net device info+++++++++++++++++++++++++++++++++++++++
+ci-info: +--------+------+-----------------------------+---------------+--------+-------------------+
+ci-info: | Device |  Up  |           Address           |      Mask     | Scope  |     Hw-Address    |
+ci-info: +--------+------+-----------------------------+---------------+--------+-------------------+
+ci-info: |  eth0  | True |         10.0.1.10           | 255.255.255.0 | global | 60:45:bd:12:34:56 |
+ci-info: |  eth0  | True | fe80::6245:bdff:fe12:3456/64 |       .       |  link  | 60:45:bd:12:34:56 |
+ci-info: |   lo   | True |          127.0.0.1          |   255.0.0.0   |  host  |         .         |
+ci-info: |   lo   | True |           ::1/128           |       .       |  host  |         .         |
+ci-info: +--------+------+-----------------------------+---------------+--------+-------------------+
+ci-info: +++++++++++++++++++++++++++++++Route IPv4 info+++++++++++++++++++++++++++++++
+ci-info: +-------+-----------------+-----------+-----------------+-----------+-------+
+ci-info: | Route |   Destination   |  Gateway  |     Genmask     | Interface | Flags |
+ci-info: +-------+-----------------+-----------+-----------------+-----------+-------+
+ci-info: |   0   |     0.0.0.0     | 10.0.1.1  |     0.0.0.0     |    eth0   |   UG  |
+ci-info: |   1   |    10.0.1.0     |  0.0.0.0  |  255.255.255.0  |    eth0   |   U   |
+ci-info: |   2   |  168.63.129.16  | 10.0.1.1  | 255.255.255.255 |    eth0   |  UGH  |
+ci-info: |   3   | 169.254.169.254 | 10.0.1.1  | 255.255.255.255 |    eth0   |  UGH  |
+ci-info: +-------+-----------------+-----------+-----------------+-----------+-------+
+"""
+
+zypper_history = """# zypp history v1
+2021-03-08 15:31:22|radd   |fe6aa9d27ce|dir:/usr/src/packages/SOURCES/repos/SUSE%3ASLE-15-SP1%3AUpdate/standard|
+2021-03-08 15:31:22|command|root@hananode01|'zypper' 'install' '--auto-agree-with-licenses' 'pacemaker' 'corosync'|
+2021-03-08 15:31:23|install|pacemaker|2.1.7+20231219.0f7f88312-150600.4.7|x86_64||SLE-HA-Product|abc123|
+2021-03-08 15:31:23|install|corosync|2.4.6-150300.12.10.1|x86_64||SLE-HA-Product|def456|
+2021-03-08 15:31:24|install|resource-agents|4.13.0+git6.ae50f94f-150600.2.2|x86_64||SLE-HA-Product|ghi789|
+2021-03-08 15:31:24|install|fence-agents-azure-arm|4.12.1+git.1677142927.bf55c675-150500.4.19.1|noarch||SLE-HA-Product|jkl012|
+2021-03-08 15:31:25|install|cloud-netconfig-azure|1.15-150000.25.26.1|noarch||SLE-Module-Public-Cloud|mno345|
+2021-03-08 15:31:25|install|python3-azure-mgmt-compute|18.0.0-150100.6.11.2|noarch||SLE-Module-Public-Cloud|pqr678|
+2021-03-08 15:31:25|install|python3-azure-core|1.22.1-150100.3.7.2|noarch||SLE-Module-Public-Cloud|stu901|
+2021-03-08 15:31:26|install|sbd|1.5.2+20241209.5946119-150500.3.3.2|x86_64||SLE-HA-Product|vwx234|
+"""
+
+with zipfile.ZipFile(fixture_path, 'w', zipfile.ZIP_DEFLATED) as zf:
+    zf.writestr('results.txt', results_txt)
+    zf.writestr('diskinfo.txt', 'Disk info placeholder\n')
+    zf.writestr('device_0/etc/fstab', fstab_content)
+    zf.writestr('device_0/etc/SuSE-release', sles_release)
+    zf.writestr('device_0/etc/hostname', 'hananode01\n')
+    zf.writestr('device_0/etc/hosts', hosts_content)
+    zf.writestr('device_0/etc/corosync/corosync.conf', corosync_conf)
+    zf.writestr('device_0/etc/sysconfig/network/network/ifcfg-eth0', ifcfg_eth0_suse)
+    zf.writestr('device_0/var/log/cloud-init-output.log', cloud_init_output)
+    zf.writestr('device_0/var/log/zypp/history', zypper_history)
+INSPECT_CLUSTER_PYEOF
+echo "[OK] Created test-inspect-iaas-disk-cluster.zip"
+
+################################################################################
+# InspectIaaSDisk SLES ZIP fixture
+# Used by unix.spec.js tests for SLES-specific InspectIaaSDisk parsing:
+#   - results.txt with SLES distribution, mount successes/failures
+#   - os-release, fstab with HANA mounts, sysctl.conf, sysctl.d
+#   - waagent.conf, waagent.log with categorised errors/warnings
+#   - Azure VM extension HandlerStatus files
+#   - sysconfig network interface (ifcfg-eth0)
+################################################################################
+echo ""
+echo "=== Creating test-inspect-iaas-disk-sles.zip ==="
+
+python3 - "$FIXTURES_DIR" << 'INSPECT_SLES_PYEOF'
+import zipfile, sys
+fixtures_dir = sys.argv[1]
+fixture_path = f"{fixtures_dir}/test-inspect-iaas-disk-sles.zip"
+
+results_txt = """Execution start time: 18:12:51.
+
+========== Request Info ==========
+Storage Acct: md-djzwkqttxnxb.z50.blob.storage.azure.net
+Container/Vhd: /jhfcb3s4xnxv/abcd
+Manifest requested: diagnostic
+Inspect service Operational ID: fc5d80d2-86aa-4b1f-a601-1d59ae66eba7
+Guestfish version: 1.57.5.
+========== End Request Info ==========
+
+Filesystem Status:
+/dev/sda1: unknown [uuid=]
+/dev/sda2: vfat [uuid=4150-8F0C]
+/dev/sda3: xfs [uuid=e98ca93f-ca1e-497e-a071-6157e9b1b704]
+/dev/sda4: xfs [uuid=3b92cd1e-e4ff-498d-b4a1-3cf4710b9e84]
+Inspection Status:
+/dev/sda4
+Inspection Metadata for /dev/sda4
+Type: linux
+Distribution: sles
+Product Name: SUSE Linux Enterprise Server 15 SP6
+Mount Points:
+/: /dev/sda4
+/mnt: /dev/disk/cloud/azure_resource-part1
+/boot: /dev/sda3
+/boot/efi: /dev/sda2
+Mounting /dev/sda4 on / SUCCEEDED.
+Mounting /dev/disk/cloud/azure_resource-part1 on /mnt FAILED.
+Mounting /dev/sda3 on /boot SUCCEEDED.
+Mounting /dev/sda2 on /boot/efi SUCCEEDED.
+
+
+Using manifest: diagnostic  [linux]
+18:13:11  Executing Operation [1/3]: echo,### Probing Directories ###
+### Probing Directories ###
+18:13:12  Executing Operation [2/3]: ll,/boot
+18:13:12  Listing contents of /boot:
+total 151204
+drwxr-xr-x  4 root root     4096 Feb 19 08:01 .
+drwxr-xr-x 25 root root     4096 Apr 21  2024 ..
+-rw-r--r--  1 root root 14191584 Jun 12  2024 vmlinuz-6.4.0-150600.21-default
+18:13:13  Executing Operation [3/3]: ll,/var/log
+18:13:13  Listing contents of /var/log:
+total 90924
+drwxr-xr-x 23 root root    16384 Feb 20 16:23 .
+drwxr-xr-x 11 root root      175 Feb 15 09:29 ..
+drwxr-xr-x  8 root root      310 Mar 29  2025 azure
+-rw-r--r--  1 root root   185883 Feb 20 16:21 cloud-init-output.log
+-rw-r-----  1 root root  4284310 Feb 20 16:21 cloud-init.log
+-rw-r-----  1 root root   734311 Feb 20 16:16 messages
+"""
+
+diskinfo_txt = """Filesystem      Size  Used Avail Use% Mounted on
+/dev/root       4.0G  455M  3.3G  12% /
+/dev            592M     0  592M   0% /dev
+shmfs           600M     0  600M   0% /dev/shm
+tmpfs           240M  308K  240M   1% /run
+/dev/sda4        39G   12G   28G  30% /sysroot
+/dev/sda3      1014M  162M  853M  16% /sysroot/boot
+/dev/sda2       512M  336K  512M   1% /sysroot/boot/efi
+"""
+
+fstab_content = """UUID=3b92cd1e-e4ff-498d-b4a1-3cf4710b9e84 / xfs defaults 0 0
+UUID=e98ca93f-ca1e-497e-a071-6157e9b1b704 /boot xfs defaults 0 0
+UUID=4150-8F0C /boot/efi vfat defaults 0 0
+UUID=7a9e73d4-8de4-4eea-b71c-9bf061c3ac58 /hana/data xfs nofail,noatime,nodiratime,logbsize=256k 0 0
+UUID=3c468c3c-f109-4afe-8817-9d3b98fe752d /hana/log xfs nofail,noatime,nodiratime,logbsize=64k 0 0
+UUID=302db8c5-2c48-45ef-a9b3-d4a4a7a1aff7 /hana/shared xfs nofail,noatime,nodiratime 0 0
+UUID=c2b3591b-c75b-4b4d-81d0-07bb200be71c /usr/sap xfs nofail,noatime,nodiratime 0 0
+/dev/disk/cloud/azure_resource-part1    /mnt    auto    defaults,nofail,x-systemd.requires=cloud-init.service,_netdev,comment=cloudconfig       0       2
+"""
+
+os_release = """NAME="SLES"
+VERSION="15-SP6"
+VERSION_ID="15.6"
+PRETTY_NAME="SUSE Linux Enterprise Server 15 SP6"
+ID="sles"
+ID_LIKE="suse"
+ANSI_COLOR="0;32"
+CPE_NAME="cpe:/o:suse:sles:15:sp6"
+"""
+
+hostname_content = "PH1LDBI02\n"
+
+hosts_content = """127.0.0.1 localhost
+::1 localhost
+10.100.1.10 PH1LDBI02
+168.63.129.16 metadata.azure.com
+"""
+
+ifcfg_eth0 = """BOOTPROTO='dhcp'
+STARTMODE='onboot'
+CLOUD_NETCONFIG_MANAGE='yes'
+"""
+
+sysctl_conf = """net.core.rmem_max=629145
+net.core.wmem_max=4194304
+"""
+
+sysctl_sap = """fs.aio-max-nr=18446744073709551615
+vm.memory_failure_early_kill=1
+net.ipv4.tcp_max_syn_backlog=8192
+net.ipv4.tcp_slow_start_after_idle=0
+net.ipv4.tcp_window_scaling=1
+net.core.somaxconn=4096
+vm.swappiness=15
+vm.dirty_bytes=629145600
+vm.dirty_background_bytes=314572800
+"""
+
+waagent_conf = """Provisioning.Enabled=y
+Extensions.Enabled=y
+Provisioning.UseCloudInit=n
+Provisioning.DeleteRootPassword=y
+ResourceDisk.Format=y
+ResourceDisk.Filesystem=ext4
+ResourceDisk.MountPoint=/mnt
+ResourceDisk.EnableSwap=y
+ResourceDisk.SwapSizeMB=2048
+OS.EnableFirewall=y
+AutoUpdate.Enabled=n
+"""
+
+messages_log = """Feb 20 16:21:01 PH1LDBI02 systemd[1]: Starting Azure Linux Agent...
+Feb 20 16:21:02 PH1LDBI02 python3[1234]: 2026/02/20 16:21:02.123456 INFO MonitorHandler Azure Enhanced Monitoring agent for SAP enabled
+Feb 20 16:21:03 PH1LDBI02 kernel: [    0.000000] Linux version 6.4.0-150600.21-default (geeko@buildhost) (gcc-13 (SUSE Linux)) #1 SMP PREEMPT_DYNAMIC
+Feb 20 16:22:00 PH1LDBI02 wickedd-dhcp4[567]: eth0: Committed DHCPv4 lease with address 10.100.1.10
+Feb 20 16:23:00 PH1LDBI02 systemd[1]: Started Pacemaker High Availability Cluster Manager.
+Feb 20 16:23:01 PH1LDBI02 corosync[890]: [TOTEM] A processor joined or left the membership and a new membership was formed.
+"""
+
+waagent_log = """2026-02-19T06:05:04.123456Z INFO ExtHandler ExtHandler [HEARTBEAT] Agent WALinuxAgent-2.14.0.1 is running as the goal state agent [DEBUG HeartbeatCounter: 1;HeartbeatId: E4ADA91F-9183-4119-BA91-DF4FB32320D7;UpdateGSErrors: 0;AutoUpdate: 0;UpdateMode: SelfUpdate;]
+2026-02-19T06:11:48.234567Z INFO ExtHandler ExtHandler Fetched new vmSettings [HostGAPlugin correlation ID: 66b50f65-1914-44ca-af6e-d3ae6fcfab4d eTag: 15590114118628401591 source: FastTrack]
+2026-02-19T06:11:48.345678Z INFO ExtHandler ExtHandler ProcessExtensionsGoalState started [etag_15590114118628401591 channel: HostGAPlugin source: FastTrack activity: 1d0e7c19-a12b-441c-8a04-1783c6908355]
+2026-02-19T06:20:14.456789Z INFO ExtHandler [Microsoft.Azure.RecoveryServices.VMSnapshotLinux-1.0.9225.0] Target handler state: enabled [etag_15590114118628401591]
+2026-02-19T06:20:14.567890Z INFO ExtHandler [Microsoft.Azure.RecoveryServices.VMSnapshotLinux-1.0.9225.0] [Enable] current handler state is: enabled
+2026-02-19T07:22:26.678901Z ERROR ExtHandler ExtHandler Error fetching the goal state: [ProtocolError] GET vmSettings [correlation ID: 16758839-2b40-40d5-80cd-10572beda761 eTag: 1234] [Internal error: 500]
+2026-02-19T07:28:24.789012Z ERROR ExtHandler ExtHandler Error fetching the goal state: [ProtocolError] [Wireserver Exception] [HttpError] [HTTP Failed] GET http://168.63.129.16/machine/?comp=goalstate [HTTP Retry]
+2026-02-19T08:10:28.890123Z WARNING MonitorHandler ExtHandler [PERIODIC] [IMDS_CONNECTION_ERROR] Unable to connect to IMDS endpoint 169.254.169.254
+2026-02-19T08:28:52.901234Z ERROR ExtHandler ExtHandler Event: name=Microsoft.Azure.AzureDefenderForServers.MDE.Linux, op=Enable, message=[ExtensionOperationError] Non-zero exit code: 52, /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/MDE.Linux.sh enable
+2026-02-19T08:44:26.012345Z ERROR Daemon Daemon Failed to mount resource disk [ResourceDiskError] Could not mount /dev/sdc1 after syncing partition table: [32] mount: /mnt: /dev/sdc1 already mounted on /mnt.
+2026-02-19T09:27:24.123456Z WARNING ExtHandler ExtHandler [PERIODIC] The status reported by the extension Microsoft.CPlat.Core.LinuxPatchExtension-1.6.64(Sequence number 17), was in an incorrect format and the agent could not parse it correctly. Failed due to [ExtensionStatusError] Expecting value: line 1 column 1 (char 0)
+2026-02-19T09:27:24.234567Z WARNING ExtHandler ExtHandler [PERIODIC] This status is being reported by the Guest Agent since no status file was reported by extension Microsoft.Azure.AzureDefenderForServers.MDE.Linux: [ExtensionStatusError] Status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/status/51.status does not exist
+2026-02-19T10:36:32.345678Z INFO ExtHandler ExtHandler Extension status: [("Microsoft.Azure.AzureDefenderForServers.MDE.Linux", "transitioning"), ("Microsoft.Azure.RecoveryServices.VMSnapshotLinux", "success"), ("Microsoft.CPlat.Core.LinuxPatchExtension", "error"), ("Microsoft.CPlat.Core.RunCommandLinux", "success")]
+2026-02-19T12:10:11.456789Z INFO Daemon Daemon Agent WALinuxAgent-2.14.0.1 launched with command "/usr/bin/python3 -u /usr/sbin/waagent -run-exthandlers" is successfully running
+2026-02-19T15:29:33.567890Z INFO ExtHandler ExtHandler [HEARTBEAT] Agent WALinuxAgent-2.14.0.1 is running as the goal state agent [DEBUG HeartbeatCounter: 2;HeartbeatId: E4ADA91F-9183-4119-BA91-DF4FB32320D7;UpdateGSErrors: 0;AutoUpdate: 0;UpdateMode: SelfUpdate;]
+2026-02-20T16:11:27.678901Z WARNING Daemon Daemon Failed to mount resource disk. Attempting to format and retry mount. [mount: /mnt: /dev/sdc1 already mounted on /mnt.
+2026-02-20T16:23:39.789012Z INFO ExtHandler ExtHandler ProcessExtensionsGoalState completed [etag_5312742817917373788 125692 ms]
+"""
+
+mde_status = '{"handlerName":"Microsoft.Azure.AzureDefenderForServers.MDE.Linux","handlerVersion":"1.0.9.2","status":"Ready","code":0,"formattedMessage":{"lang":"en-US","message":"MDE agent installed successfully"}}'
+
+snapshot_status = '{"handlerName":"Microsoft.Azure.RecoveryServices.VMSnapshotLinux","handlerVersion":"1.0.9225.0","status":"Ready","code":0,"formattedMessage":{"lang":"en-US","message":"Snapshot extension ready"}}'
+
+workload_status = '{"handlerName":"Microsoft.Azure.RecoveryServices.WorkloadBackup.AzureBackupLinuxWorkload","handlerVersion":"2.0.0.5","status":"Ready","code":0,"formattedMessage":{"lang":"en-US","message":"Workload backup handler ready"}}'
+
+patch_status = '{"handlerName":"Microsoft.CPlat.Core.LinuxPatchExtension","handlerVersion":"1.6.64","status":"Ready","code":0,"formattedMessage":{"lang":"en-US","message":"Patch extension ready"}}'
+
+runcmd_status = '{"handlerName":"Microsoft.CPlat.Core.RunCommandLinux","handlerVersion":"1.0.11","status":"Ready","code":0,"formattedMessage":{"lang":"en-US","message":"RunCommand handler ready"}}'
+
+with zipfile.ZipFile(fixture_path, 'w', zipfile.ZIP_DEFLATED) as zf:
+    zf.writestr('results.txt', results_txt)
+    zf.writestr('diskinfo.txt', diskinfo_txt)
+    zf.writestr('device_0/etc/fstab', fstab_content)
+    zf.writestr('device_0/etc/hostname', hostname_content)
+    zf.writestr('device_0/etc/hosts', hosts_content)
+    zf.writestr('device_0/etc/os-release', os_release)
+    zf.writestr('device_0/etc/sysconfig/network/network/ifcfg-eth0', ifcfg_eth0)
+    zf.writestr('device_0/etc/sysctl.conf', sysctl_conf)
+    zf.writestr('device_0/etc/sysctl.d/sap_hdb_sysctl.conf', sysctl_sap)
+    zf.writestr('device_0/etc/waagent.conf', waagent_conf)
+    zf.writestr('device_0/var/log/messages', messages_log)
+    zf.writestr('device_0/var/log/waagent.log', waagent_log)
+    zf.writestr('device_0/var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.9.2/config/HandlerStatus', mde_status)
+    zf.writestr('device_0/var/lib/waagent/Microsoft.Azure.RecoveryServices.VMSnapshotLinux-1.0.9225.0/config/HandlerStatus', snapshot_status)
+    zf.writestr('device_0/var/lib/waagent/Microsoft.Azure.RecoveryServices.WorkloadBackup.AzureBackupLinuxWorkload-2.0.0.5/config/HandlerStatus', workload_status)
+    zf.writestr('device_0/var/lib/waagent/Microsoft.CPlat.Core.LinuxPatchExtension-1.6.64/config/HandlerStatus', patch_status)
+    zf.writestr('device_0/var/lib/waagent/Microsoft.CPlat.Core.RunCommandLinux-1.0.11/config/HandlerStatus', runcmd_status)
+INSPECT_SLES_PYEOF
+echo "[OK] Created test-inspect-iaas-disk-sles.zip"
+
+# Test: mtab vs fstab comparison
+# Tests detection of mounts in mtab that are NOT in fstab
+echo ""
+echo "=== Creating test-mtab-comparison.tar.xz ==="
+mkdir -p test-data/etc
+
+# fstab - defines a few mounts
+cat > test-data/etc/fstab << 'EOF'
+# /etc/fstab
+UUID=1234-5678-9abc-def0 / xfs defaults 0 1
+UUID=aaaa-bbbb-cccc-dddd /boot ext4 defaults 0 2
+UUID=2222-3333-4444-5555 /home xfs defaults,nofail 0 0
+UUID=7777-8888-9999-0000 /mnt xfs defaults,nofail 0 0
+EOF
+
+# mtab - has extra mounts not in fstab (hand-mounted + cluster-managed)
+cat > test-data/etc/mtab << 'EOF'
+/dev/sda2 / xfs rw,relatime,attr2 0 0
+/dev/sda1 /boot ext4 rw,relatime 0 0
+/dev/sdb1 /home xfs rw,relatime,nofail 0 0
+/dev/sdc1 /mnt xfs rw,relatime,nofail 0 0
+/dev/sdd1 /data ext4 rw,relatime 0 0
+10.0.0.5:/shared /sapmnt nfs rw,hard,rsize=65536,wsize=65536 0 0
+/dev/mapper/datavg-hanalv /hana/data xfs rw,relatime,attr2 0 0
+/dev/mapper/logvg-hanaloglv /hana/log xfs rw,relatime,attr2 0 0
+sysfs /sys sysfs rw,nosuid,nodev,noexec,relatime 0 0
+proc /proc proc rw,nosuid,nodev,noexec,relatime 0 0
+tmpfs /run tmpfs rw,nosuid,nodev 0 0
+devtmpfs /dev devtmpfs rw,nosuid,relatime 0 0
+EOF
+
+create_fixture "test-mtab-comparison"
+
+################################################################################
+# Test: FIPS Enabled (sosreport style)
+# Tests detection of FIPS mode from multiple indicators:
+#   - sos_commands/crypto/fips-mode-setup_--check
+#   - proc/cmdline with fips=1
+#   - sysctl crypto.fips_enabled = 1
+#   - crypto-policies/config = FIPS
+#   - installed-rpms with dracut-fips
+#   - waagent.conf with OS.EnableFIPS=y
+################################################################################
+echo ""
+echo "=== Creating test-fips-enabled.tar.xz ==="
+
+# fips-mode-setup --check output
+mkdir -p test-data/sos_commands/crypto
+cat > "test-data/sos_commands/crypto/fips-mode-setup_--check" << 'EOF'
+FIPS mode is enabled.
+EOF
+
+# Kernel command line with fips=1
+mkdir -p test-data/proc
+cat > test-data/proc/cmdline << 'EOF'
+BOOT_IMAGE=(hd0,gpt2)/vmlinuz-4.18.0-425.3.1.el8.x86_64 root=UUID=abcdef01-2345-6789-abcd-ef0123456789 ro crashkernel=auto fips=1 rd.lvm.lv=rootvg/rootlv console=tty0 console=ttyS0,115200n8
+EOF
+
+# Kernel sysctl with crypto.fips_enabled = 1
+mkdir -p test-data/sos_commands/kernel
+cat > test-data/sos_commands/kernel/sysctl_-a << 'EOF'
+crypto.fips_enabled = 1
+kernel.hostname = fips-test-host
+kernel.osrelease = 4.18.0-425.3.1.el8.x86_64
+kernel.ostype = Linux
+vm.swappiness = 10
+net.ipv4.tcp_keepalive_time = 7200
+EOF
+
+# Crypto policy set to FIPS
+mkdir -p test-data/etc/crypto-policies
+cat > test-data/etc/crypto-policies/config << 'EOF'
+FIPS
+EOF
+
+# installed-rpms with dracut-fips
+mkdir -p test-data/sos_commands/rpm
+cat > test-data/sos_commands/rpm/installed-rpms << 'EOF'
+WALinuxAgent-2.9.1.1-3.el8_8.noarch      Wed Aug  2 00:00:00 2023
+bash-4.4.20-4.el8_6.x86_64               Mon Oct 17 00:00:00 2022
+cloud-init-23.1.1-12.el8.noarch          Thu Oct  5 00:00:00 2023
+crypto-policies-20230731-1.git94f0e2c.el8.noarch Thu Oct  5 00:00:00 2023
+dracut-fips-049-233.git20240115.el8.x86_64 Wed Jan 17 00:00:00 2024
+fipscheck-1.5.0-5.el8.x86_64             Thu Oct  5 00:00:00 2023
+fipscheck-lib-1.5.0-5.el8.x86_64         Thu Oct  5 00:00:00 2023
+kernel-4.18.0-425.3.1.el8.x86_64         Thu Nov  3 00:00:00 2022
+openssl-1.1.1k-12.el8_9.x86_64           Mon Dec 18 00:00:00 2023
+EOF
+
+# waagent.conf with FIPS enabled
+mkdir -p test-data/etc
+cat > test-data/etc/waagent.conf << 'EOF'
+# Microsoft Azure Linux Agent Configuration
+OS.EnableFIPS=y
+Provisioning.Agent=auto
+ResourceDisk.Format=n
+EOF
+
+# os-release for distro detection
+cat > test-data/etc/os-release << 'EOF'
+NAME="Red Hat Enterprise Linux"
+VERSION="8.8 (Ootpa)"
+ID="rhel"
+ID_LIKE="fedora"
+VERSION_ID="8.8"
+PRETTY_NAME="Red Hat Enterprise Linux 8.8 (Ootpa)"
+EOF
+
+create_fixture "test-fips-enabled"
+
+################################################################################
+# Test: FIPS Disabled (sosreport style)
+# Tests detection when FIPS mode is explicitly disabled
+################################################################################
+echo ""
+echo "=== Creating test-fips-disabled.tar.xz ==="
+
+# fips-mode-setup --check output (disabled)
+mkdir -p test-data/sos_commands/crypto
+cat > "test-data/sos_commands/crypto/fips-mode-setup_--check" << 'EOF'
+FIPS mode is disabled.
+EOF
+
+# Kernel command line without fips=1
+mkdir -p test-data/proc
+cat > test-data/proc/cmdline << 'EOF'
+BOOT_IMAGE=(hd0,gpt2)/vmlinuz-4.18.0-425.3.1.el8.x86_64 root=UUID=abcdef01-2345-6789-abcd-ef0123456789 ro crashkernel=auto rd.lvm.lv=rootvg/rootlv console=tty0 console=ttyS0,115200n8
+EOF
+
+# Kernel sysctl with crypto.fips_enabled = 0
+mkdir -p test-data/sos_commands/kernel
+cat > test-data/sos_commands/kernel/sysctl_-a << 'EOF'
+crypto.fips_enabled = 0
+kernel.hostname = nofips-test-host
+kernel.osrelease = 4.18.0-425.3.1.el8.x86_64
+kernel.ostype = Linux
+vm.swappiness = 10
+net.ipv4.tcp_keepalive_time = 7200
+EOF
+
+# Crypto policy set to DEFAULT
+mkdir -p test-data/etc/crypto-policies
+cat > test-data/etc/crypto-policies/config << 'EOF'
+DEFAULT
+EOF
+
+# installed-rpms without dracut-fips
+mkdir -p test-data/sos_commands/rpm
+cat > test-data/sos_commands/rpm/installed-rpms << 'EOF'
+WALinuxAgent-2.9.1.1-3.el8_8.noarch      Wed Aug  2 00:00:00 2023
+bash-4.4.20-4.el8_6.x86_64               Mon Oct 17 00:00:00 2022
+cloud-init-23.1.1-12.el8.noarch          Thu Oct  5 00:00:00 2023
+crypto-policies-20230731-1.git94f0e2c.el8.noarch Thu Oct  5 00:00:00 2023
+kernel-4.18.0-425.3.1.el8.x86_64         Thu Nov  3 00:00:00 2022
+openssl-1.1.1k-12.el8_9.x86_64           Mon Dec 18 00:00:00 2023
+EOF
+
+# waagent.conf without FIPS
+mkdir -p test-data/etc
+cat > test-data/etc/waagent.conf << 'EOF'
+# Microsoft Azure Linux Agent Configuration
+Provisioning.Agent=auto
+ResourceDisk.Format=n
+EOF
+
+# os-release
+cat > test-data/etc/os-release << 'EOF'
+NAME="Red Hat Enterprise Linux"
+VERSION="8.8 (Ootpa)"
+ID="rhel"
+ID_LIKE="fedora"
+VERSION_ID="8.8"
+PRETTY_NAME="Red Hat Enterprise Linux 8.8 (Ootpa)"
+EOF
+
+create_fixture "test-fips-disabled"
+
+################################################################################
+# Test: FIPS Inconsistent state (sosreport style)
+# Tests detection when FIPS mode is in an inconsistent state:
+#   fips-mode-setup says enabled but sysctl says disabled
+################################################################################
+echo ""
+echo "=== Creating test-fips-inconsistent.tar.xz ==="
+
+# fips-mode-setup reports inconsistent
+mkdir -p test-data/sos_commands/crypto
+cat > "test-data/sos_commands/crypto/fips-mode-setup_--check" << 'EOF'
+FIPS mode is enabled.
+Inconsistent state detected.
+The current crypto policy (DEFAULT) does not match FIPS.
+EOF
+
+# Kernel command line WITH fips=1 (was set at boot)
+mkdir -p test-data/proc
+cat > test-data/proc/cmdline << 'EOF'
+BOOT_IMAGE=(hd0,gpt2)/vmlinuz-4.18.0-425.3.1.el8.x86_64 root=UUID=abcdef01-2345-6789-abcd-ef0123456789 ro crashkernel=auto fips=1 rd.lvm.lv=rootvg/rootlv console=tty0 console=ttyS0,115200n8
+EOF
+
+# sysctl says FIPS enabled at kernel level
+mkdir -p test-data/sos_commands/kernel
+cat > test-data/sos_commands/kernel/sysctl_-a << 'EOF'
+crypto.fips_enabled = 1
+kernel.hostname = fips-inconsistent-host
+kernel.osrelease = 4.18.0-425.3.1.el8.x86_64
+kernel.ostype = Linux
+vm.swappiness = 10
+EOF
+
+# But crypto policy is DEFAULT (not FIPS) - the inconsistency!
+mkdir -p test-data/etc/crypto-policies
+cat > test-data/etc/crypto-policies/config << 'EOF'
+DEFAULT
+EOF
+
+# installed-rpms with dracut-fips
+mkdir -p test-data/sos_commands/rpm
+cat > test-data/sos_commands/rpm/installed-rpms << 'EOF'
+WALinuxAgent-2.9.1.1-3.el8_8.noarch      Wed Aug  2 00:00:00 2023
+dracut-fips-049-233.git20240115.el8.x86_64 Wed Jan 17 00:00:00 2024
+kernel-4.18.0-425.3.1.el8.x86_64         Thu Nov  3 00:00:00 2022
+EOF
+
+# os-release
+mkdir -p test-data/etc
+cat > test-data/etc/os-release << 'EOF'
+NAME="Red Hat Enterprise Linux"
+VERSION="8.8 (Ootpa)"
+ID="rhel"
+ID_LIKE="fedora"
+VERSION_ID="8.8"
+PRETTY_NAME="Red Hat Enterprise Linux 8.8 (Ootpa)"
+EOF
+
+create_fixture "test-fips-inconsistent"
+
+# ============================================================================
+# SecureBoot fixtures (sosreport-only: sos_commands/boot/mokutil_--sb-state)
+# ============================================================================
+
+echo ""
+echo "=== Creating test-secureboot-disabled.tar.xz ==="
+mkdir -p test-data/sos_commands/boot
+cat > test-data/sos_commands/boot/mokutil_--sb-state << 'EOF'
+SecureBoot disabled
+EOF
+create_fixture "test-secureboot-disabled"
+
+echo ""
+echo "=== Creating test-secureboot-enabled.tar.xz ==="
+mkdir -p test-data/sos_commands/boot
+cat > test-data/sos_commands/boot/mokutil_--sb-state << 'EOF'
+SecureBoot enabled
+EOF
+create_fixture "test-secureboot-enabled"
+
+echo ""
+echo "=== Creating test-secureboot-unsupported.tar.xz ==="
+mkdir -p test-data/sos_commands/boot
+cat > test-data/sos_commands/boot/mokutil_--sb-state << 'EOF'
+EFI variables are not supported on this system
+EOF
+create_fixture "test-secureboot-unsupported"
+
+################################################################################
+# OS tuning and security (SAP-on-Azure QualityCheck ports):
+# tuned profile, SELinux mode, swap space, and the fstrim timer.
+# Designed to trigger one warning per detector plus a tuned recommendation.
+################################################################################
+echo ""
+echo "=== Creating test-os-tuning.tar.xz ==="
+mkdir -p test-data/sos_commands/tuned
+cat > test-data/sos_commands/tuned/tuned-adm_active << 'EOF'
+Current active profile: sap-hana
+EOF
+mkdir -p test-data/etc/selinux
+cat > test-data/etc/selinux/config << 'EOF'
+# This file controls the state of SELinux on the system.
+SELINUX=enforcing
+SELINUXTYPE=targeted
+EOF
+mkdir -p test-data/proc
+cat > test-data/proc/meminfo << 'EOF'
+MemTotal:       16307152 kB
+MemFree:         8123456 kB
+SwapTotal:             0 kB
+SwapFree:              0 kB
+EOF
+mkdir -p test-data/sos_commands/systemd
+cat > test-data/sos_commands/systemd/systemctl_list-unit-files << 'EOF'
+UNIT FILE                                     STATE
+chronyd.service                               enabled
+fstrim.timer                                  enabled
+getty@.service                                enabled
+EOF
+mkdir -p test-data/etc
+cat > test-data/etc/os-release << 'EOF'
+NAME="Red Hat Enterprise Linux"
+VERSION="8.6 (Ootpa)"
+ID="rhel"
+VERSION_ID="8.6"
+PRETTY_NAME="Red Hat Enterprise Linux 8.6 (Ootpa)"
+EOF
+create_fixture "test-os-tuning"
+
+echo ""
+echo "=== Creating test-nfs-mounts.tar.xz ==="
+mkdir -p test-data/etc
+cat > test-data/etc/fstab << 'EOF'
+# /etc/fstab
+UUID=00000000-0000-0000-0000-000000000001 /     xfs    defaults                                              0 0
+UUID=00000000-0000-0000-0000-000000000002 /boot xfs    defaults                                              0 0
+10.0.0.4:/hana/data  /hana/data  nfs  vers=4.0,soft,rsize=65536,wsize=65536,timeo=600  0 0
+10.0.0.4:/hana/log   /hana/log   nfs  vers=4.0,soft,rsize=65536,wsize=65536,timeo=600  0 0
+10.0.0.5:/sapmnt     /sapmnt     nfs  vers=4.1,hard,rsize=262144,wsize=262144,nconnect=8,timeo=600  0 0
+EOF
+cat > test-data/etc/os-release << 'EOF'
+NAME="SLES"
+VERSION="15-SP4"
+ID="sles"
+VERSION_ID="15.4"
+PRETTY_NAME="SUSE Linux Enterprise Server 15 SP4"
+EOF
+create_fixture "test-nfs-mounts"
+
+echo ""
+echo "========================================="
+echo ""
+echo "Fixtures created in: $FIXTURES_DIR"
+echo ""
+echo "To run tests:"
+echo "  npm install"
+echo "  npm test"
diff --git a/rca-tool/tests/events.spec.js b/rca-tool/tests/events.spec.js
new file mode 100644
index 0000000..3ecbbec
--- /dev/null
+++ b/rca-tool/tests/events.spec.js
@@ -0,0 +1,235 @@
+/**
+ * @module tests/events
+ * @description Playwright tests for {@link module:parsers/events}.
+ *
+ * Covers kernel-reboot detection, OOM killer event parsing, and XFS
+ * error analysis including danger-block alerts, deduplication across
+ * rotated log files, timestamp normalisation, correct counts after
+ * dedup, and duplicate-UUID detection.
+ */
+import { test, expect } from './coverage-fixture.js';
+import { uploadAndWaitForAnalysis, getResultText, navigateToApp, fixturePath } from './test-helpers.js';
+
+test.describe('Events Parsers', () => {
+
+  test.beforeEach(async ({ page }, testInfo) => {
+    await navigateToApp(page, testInfo);
+    await expect(page.locator('h1')).toContainText('RCA Tool');
+  });
+
+  test('detects kernel reboots', async ({ page }) => {
+    const result = await uploadAndWaitForAnalysis(page, 'scc_test-kernel-reboots.tar.xz');
+    
+    expect(result).toContain('Kernel Reboots');
+    expect(result).toMatch(/\d+ events? found/i);
+    // Should show reboot timestamps
+    expect(result).toMatch(/\d{4}-\d{2}-\d{2}|\w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}/);
+  });
+
+  test('detects OOM killer events', async ({ page }) => {
+    const result = await uploadAndWaitForAnalysis(page, 'scc_test-oom-killer.tar.xz');
+    
+    if (result.includes('OOM Killer')) {
+      expect(result).toMatch(/OOM Killer.*\d+ event/i);
+      // Should show process names
+      expect(result).toMatch(/invoked oom-killer|Killed process/i);
+    }
+  });
+
+  test('detects XFS errors in log files', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-xfs-errors.tar.xz');
+    
+    // Check that XFS Filesystem Errors section exists
+    expect(resultHTML).toContain('XFS Filesystem Errors');
+    
+    // Check for specific error messages that are actually in the output
+    expect(resultHTML).toContain('Corruption detected');
+    expect(resultHTML).toContain('Internal error xfs_trans_cancel');
+    
+    // Check for devices that appear in non-deduplicated errors
+    expect(resultHTML).toContain('sdb2');
+    expect(resultHTML).toContain('sdc3');
+    
+    // Check for unrecovered unlinked inode pattern
+    expect(resultHTML).toContain('unrecovered unlinked inode');
+    expect(resultHTML).toContain('sdk4');
+    
+    // Check for timestamps (normalized format with zero-padded days)
+    expect(resultHTML).toContain('Dec 02 15:07:11');
+    expect(resultHTML).toContain('Dec 03 08:45:23');
+  });
+
+  test('shows critical alert (danger-block) for XFS errors', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-xfs-errors.tar.xz');
+    
+    // Check that Events section has danger-block class (red background)
+    const eventsSection = await page.locator('#output').innerHTML();
+    expect(eventsSection).toContain('danger-block');
+    
+    // Verify the Events section is highlighted as critical
+    const hasEventsTitle = eventsSection.includes('Events') || eventsSection.includes('events');
+    expect(hasEventsTitle).toBeTruthy();
+  });
+
+  test('deduplicates XFS errors across rotated log files', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-xfs-errors.tar.xz');
+    
+    // Check that we have the XFS Filesystem Errors section
+    expect(resultHTML).toContain('XFS Filesystem Errors');
+    
+    // Verify that duplicates were removed - the total count should be less than 9
+    const content = await page.locator('#output').textContent();
+    const countMatch = content.match(/XFS Filesystem Errors\s*\((\d+)\s+errors? found\)/);
+    expect(countMatch).toBeTruthy();
+    
+    const count = parseInt(countMatch[1], 10);
+    // We expect deduplication to work, so count should be less than total lines with XFS
+    expect(count).toBeLessThan(9);
+    expect(count).toBeGreaterThan(0);
+  });
+
+  test('normalizes timestamps for consistent deduplication', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-xfs-timestamp-normalization.tar.xz');
+    
+    // Check that XFS section exists
+    expect(resultHTML).toContain('XFS Filesystem Errors');
+    
+    // Both "Dec  5" and "Dec 05" should be normalized to "Dec 05"
+    const content = await page.locator('#output').textContent();
+    const countMatch = content.match(/XFS Filesystem Errors\s*\((\d+)\s+errors? found\)/);
+    expect(countMatch).toBeTruthy();
+    
+    const count = parseInt(countMatch[1], 10);
+    // Should have exactly 2 errors (one corruption warning, one internal error)
+    expect(count).toBe(2);
+    
+    // Verify both error types are present
+    expect(resultHTML).toContain('Corruption warning: inode 456789');
+    expect(resultHTML).toContain('Internal error XFS_WANT_CORRUPTED_GOTO');
+    
+    // Verify normalized timestamp format is used (zero-padded day)
+    expect(resultHTML).toContain('Dec 05 10:15:');
+  });
+
+  test('counts XFS errors correctly after deduplication', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-xfs-errors.tar.xz');
+    
+    // Get the full content
+    const content = await page.locator('#output').textContent();
+    
+    // Should have XFS Filesystem Errors section with a count
+    expect(content).toContain('XFS Filesystem Errors');
+    
+    // Parse the count (format: "XFS Filesystem Errors (X errors found)")
+    const countMatch = content.match(/XFS Filesystem Errors\s*\((\d+)\s+errors? found\)/);
+    expect(countMatch).toBeTruthy();
+    
+    const count = parseInt(countMatch[1], 10);
+    
+    // Based on actual output, we're seeing 2 errors displayed
+    expect(count).toBeGreaterThan(0);
+    expect(count).toBeLessThanOrEqual(7);
+  });
+
+  test('detects XFS duplicate UUID errors', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-xfs-duplicate-uuid.tar.xz');
+    
+    // Check that XFS Filesystem Errors section exists
+    expect(resultHTML).toContain('XFS Filesystem Errors');
+    
+    // Check for duplicate UUID error message
+    expect(resultHTML).toContain('duplicate UUID');
+    expect(resultHTML).toContain('can\'t mount');
+    
+    // Check for the UUID values
+    expect(resultHTML).toContain('ac560ede-78b1-4d66-b199-2c1284ad1aaf');
+    expect(resultHTML).toContain('f1234567-89ab-cdef-0123-456789abcdef');
+    
+    // Check for devices
+    expect(resultHTML).toContain('sde1');
+    expect(resultHTML).toContain('sdf1');
+    
+    // Verify it's treated as critical (danger-block)
+    expect(resultHTML).toContain('danger-block');
+    
+    // Check for timestamp normalization
+    expect(resultHTML).toContain('Dec 03 17:37:');
+  });
+
+  test('detects kernel reboots from InspectIaaSDisk ZIP', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('test-inspect-iaas-disk.zip'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('InspectIaaSDisk Results');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+
+    // Should detect kernel boot events from device_0/var/log/messages
+    expect(content).toContain('4.18.0-477.27.1.el8_8.x86_64');
+    // Should show reboot events section
+    expect(content).toMatch(/kernel.*reboot|reboot.*event/i);
+  });
+
+  test('detects OOM killer events from InspectIaaSDisk ZIP', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('test-inspect-iaas-disk.zip'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('InspectIaaSDisk Results');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+
+    // Should detect OOM killer event
+    expect(content).toContain('java');
+    expect(content).toMatch(/oom|out of memory/i);
+  });
+
+  test('detects XFS errors from InspectIaaSDisk ZIP', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('test-inspect-iaas-disk.zip'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('InspectIaaSDisk Results');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+
+    // Should detect XFS errors from device_0/var/log/messages
+    expect(content).toContain('XFS Filesystem Errors');
+    expect(content).toContain('sdb1');
+    expect(content).toContain('unrecovered unlinked inode');
+  });
+
+  test('detects emergency mode from InspectIaaSDisk ZIP', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('test-inspect-iaas-disk.zip'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('InspectIaaSDisk Results');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+
+    // Should detect emergency mode from device_0/var/log/messages
+    expect(content).toMatch(/emergency mode/i);
+  });
+});
diff --git a/rca-tool/tests/hana-fixtures.global-setup.js b/rca-tool/tests/hana-fixtures.global-setup.js
new file mode 100644
index 0000000..c6599e0
--- /dev/null
+++ b/rca-tool/tests/hana-fixtures.global-setup.js
@@ -0,0 +1,27 @@
+/**
+ * @module tests/hana-fixtures.global-setup
+ * @description Playwright global setup that (re)generates the SAP HANA `.zip`
+ * test fixtures from the `fixtures-gen` Rust crate.
+ *
+ * The fixtures live under the gitignored `tests/fixtures/` directory and are
+ * never committed. Generating them here — rather than checking in binaries —
+ * keeps the repository free of prebuilt archives while guaranteeing the HANA
+ * specs have their inputs in both local and CI runs. The crate's own
+ * `cargo test` round-trips the generated traces through the real parsers, so a
+ * format regression fails fast there too.
+ */
+import { execFileSync } from 'child_process';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const manifest = path.resolve(__dirname, '../fixtures-gen/Cargo.toml');
+const fixturesDir = path.join(__dirname, 'fixtures');
+
+export default function globalSetup() {
+  execFileSync(
+    'cargo',
+    ['run', '--quiet', '--manifest-path', manifest, '--', '--out', fixturesDir],
+    { stdio: 'inherit' },
+  );
+}
diff --git a/rca-tool/tests/hana-trace-events.spec.js b/rca-tool/tests/hana-trace-events.spec.js
new file mode 100644
index 0000000..e8a660c
--- /dev/null
+++ b/rca-tool/tests/hana-trace-events.spec.js
@@ -0,0 +1,41 @@
+/**
+ * @module tests/hana-trace-events
+ * @description Playwright tests for the SAP HANA trace-event detectors
+ * (deadlocks, out-of-memory, and delta-merge failures).
+ *
+ * The `hana_test-trace-events.zip` fixture (generated by the `fixtures-gen`
+ * Rust crate) contains a single `indexserver_test.trc` with:
+ *   - several record-lock deadlock cycles on `SAPHANADB:ADR2`,
+ *   - one `OUT OF MEMORY` block on host `vmltmdbuspd01`, and
+ *   - a batch of `rc = 2465` merge-token-exhaustion failures.
+ */
+import { test, expect } from './coverage-fixture.js';
+import { uploadAndWaitForAnalysis, navigateToApp } from './test-helpers.js';
+
+test.describe('SAP HANA trace events', () => {
+
+  test.beforeEach(async ({ page }, testInfo) => {
+    await navigateToApp(page, testInfo);
+    await expect(page.locator('h1')).toContainText('RCA Tool');
+  });
+
+  test('detects deadlocks, OOM and delta-merge failures', async ({ page }) => {
+    const html = await uploadAndWaitForAnalysis(page, 'hana_test-trace-events.zip');
+
+    // Deadlocks section with the most-contended object.
+    expect(html).toContain('SAP HANA Deadlocks');
+    expect(html).toContain('Deadlocks detected');
+    expect(html).toContain('Most contended objects');
+    expect(html).toContain('SAPHANADB:ADR2');
+
+    // Out-of-memory section with the failing host and executable.
+    expect(html).toContain('SAP HANA Out-of-Memory');
+    expect(html).toContain('Out-of-memory events');
+    expect(html).toContain('vmltmdbuspd01');
+    expect(html).toContain('hdbindexserver');
+
+    // Delta-merge failures with merge-token exhaustion (rc=2465).
+    expect(html).toContain('SAP HANA Delta-Merge Failures');
+    expect(html).toContain('Merge-token exhaustion (rc=2465)');
+  });
+});
diff --git a/rca-tool/tests/hana.spec.js b/rca-tool/tests/hana.spec.js
new file mode 100644
index 0000000..f3f1eff
--- /dev/null
+++ b/rca-tool/tests/hana.spec.js
@@ -0,0 +1,35 @@
+/**
+ * @module tests/hana
+ * @description Playwright tests for the SAP HANA savepoint detector.
+ *
+ * The `hana_test-savepoints.zip` fixture (generated by the `fixtures-gen`
+ * Rust crate) contains a single `indexserver_test.trc` with periodic
+ * savepoints, replication snapshots, and one slow savepoint callback that
+ * stalled for 12.4 s — which the analyzer surfaces as a warning.
+ */
+import { test, expect } from './coverage-fixture.js';
+import { uploadAndWaitForAnalysis, navigateToApp } from './test-helpers.js';
+
+test.describe('SAP HANA savepoints', () => {
+
+  test.beforeEach(async ({ page }, testInfo) => {
+    await navigateToApp(page, testInfo);
+    await expect(page.locator('h1')).toContainText('RCA Tool');
+  });
+
+  test('detects savepoints and flags a slow savepoint callback', async ({ page }) => {
+    const html = await uploadAndWaitForAnalysis(page, 'hana_test-savepoints.zip');
+
+    // Savepoints section and summary rows are present.
+    expect(html).toContain('SAP HANA Savepoints');
+    expect(html).toContain('Periodic savepoints');
+    expect(html).toContain('Snapshot savepoints');
+
+    // The slow callback (12384 ms) is rendered as a stall warning.
+    expect(html).toContain('HANA savepoint callback stalled for 12.4s');
+
+    // The savepoint events table lists individual savepoint versions.
+    expect(html).toContain('Savepoint events');
+    expect(html).toContain('609685');
+  });
+});
diff --git a/rca-tool/tests/instrument-coverage.sh b/rca-tool/tests/instrument-coverage.sh
new file mode 100755
index 0000000..07fe225
--- /dev/null
+++ b/rca-tool/tests/instrument-coverage.sh
@@ -0,0 +1,44 @@
+#!/bin/bash
+# Generate Rust coverage for the supportfile_core library.
+#
+# This script intentionally does NOT instrument Node/JS worker files.
+# It produces Rust coverage artifacts under tests/coverage-report-rust/.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PROJECT_ROOT="$SCRIPT_DIR/.."
+CORE_LIB_DIR="$PROJECT_ROOT/lib/supportfile_core"
+RUST_REPORT_DIR="$SCRIPT_DIR/coverage-report-rust"
+
+if ! command -v cargo-llvm-cov >/dev/null 2>&1; then
+  echo "cargo-llvm-cov is required but was not found in PATH."
+  echo "Install it with: cargo install cargo-llvm-cov"
+  exit 1
+fi
+
+echo "Generating Rust coverage for supportfile_core..."
+mkdir -p "$RUST_REPORT_DIR"
+
+cd "$CORE_LIB_DIR"
+
+# Ensure stale profdata/profraw files do not pollute the report.
+cargo llvm-cov clean --workspace
+
+# Collect coverage once, then generate reports separately.
+cargo llvm-cov \
+  --lib \
+  --tests \
+  --no-report
+
+cargo llvm-cov report \
+  --html \
+  --output-dir "$RUST_REPORT_DIR"
+
+cargo llvm-cov report \
+  --lcov \
+  --output-path "$RUST_REPORT_DIR/lcov.info"
+
+echo "Rust coverage complete."
+echo "  HTML report: $RUST_REPORT_DIR/html/index.html"
+echo "  LCOV report: $RUST_REPORT_DIR/lcov.info"
diff --git a/rca-tool/tests/network-interfaces.spec.js b/rca-tool/tests/network-interfaces.spec.js
new file mode 100644
index 0000000..48305ab
--- /dev/null
+++ b/rca-tool/tests/network-interfaces.spec.js
@@ -0,0 +1,124 @@
+/**
+ * @module tests/network-interfaces
+ * @description Playwright tests for {@link module:parsers/network-interfaces}.
+ *
+ * Verifies network-interface detection from SCC `network.txt`
+ * (eth0/eth1, DHCP vs static, mlx5_core accelerated networking) and
+ * SOS reports (MANA driver, DHCP configuration).
+ */
+import { test, expect } from './coverage-fixture.js';
+import { uploadAndWaitForAnalysis, getResultText, navigateToApp, fixturePath } from './test-helpers.js';
+
+test.describe('Network Interfaces Parser', () => {
+
+  test.beforeEach(async ({ page }, testInfo) => {
+    await navigateToApp(page, testInfo);
+    await expect(page.locator('h1')).toContainText('RCA Tool');
+  });
+
+  test('detects interfaces, DHCP/static, and accelerated networking from SCC network.txt', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-network-interfaces-scc.tar.xz');
+    const resultText = await getResultText(page);
+
+    // Should show Networking section with Network Interfaces sub-section
+    expect(resultHTML).toContain('Networking');
+    expect(resultHTML).toContain('Network Interfaces');
+    // Should detect eth0 and eth1
+    expect(resultHTML).toContain('eth0');
+    expect(resultHTML).toContain('eth1');
+    // Should show IP address
+    expect(resultHTML).toContain('10.0.0.4');
+    // Should show DHCP for eth0
+    expect(resultHTML).toContain('DHCP');
+    // Should show Static for eth1
+    expect(resultHTML).toContain('Static');
+    // Should detect accelerated networking via mlx5_core on eth1
+    expect(resultHTML).toContain('mlx5_core');
+    // Should show hv_netvsc driver for eth0
+    expect(resultHTML).toContain('hv_netvsc');
+    // Should show Accelerated Networking label
+    expect(resultHTML).toMatch(/Accelerated Networking/i);
+  });
+
+  test('detects MANA driver and DHCP from SOS report', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-network-interfaces-sos-mana.tar.xz');
+    const resultText = await getResultText(page);
+
+    // Should show Network Interfaces
+    expect(resultHTML).toContain('Network Interfaces');
+    // Should detect eth0
+    expect(resultHTML).toContain('eth0');
+    // Should detect enP30832s1 (MANA interface)
+    expect(resultHTML).toContain('enP30832s1');
+    // Should detect MANA driver
+    expect(resultHTML).toContain('mana');
+    expect(resultHTML).toContain('MANA');
+    // Should show DHCP for eth0
+    expect(resultHTML).toContain('DHCP');
+    // Should show IP
+    expect(resultHTML).toContain('10.1.0.5');
+    // Should show accelerated networking
+    expect(resultHTML).toMatch(/Accelerated Networking/i);
+  });
+
+  test('detects network interfaces from ifcfg files in InspectIaaSDisk ZIP', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('test-inspect-iaas-disk.zip'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('InspectIaaSDisk Results');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+
+    // Should detect eth0 and eth1 from ifcfg files
+    expect(content).toContain('eth0');
+    expect(content).toContain('eth1');
+    // Should detect DHCP for eth0
+    expect(content).toMatch(/dhcp/i);
+    // Should detect static IP for eth1
+    expect(content).toContain('10.0.0.50');
+    // Should detect DHCP IP from cloud-init ci-info (latest boot only)
+    expect(content).toContain('10.0.0.4');
+    // Should NOT show old boot IP
+    expect(content).not.toContain('10.0.0.99');
+    // Should detect MAC from cloud-init ci-info
+    expect(content).toContain('00:0d:3a:ab:cd:ef');
+    // Should show cloud-init source warning with file provenance
+    expect(content).toMatch(/cloud-init/);
+    expect(content).toContain('last reported configuration');
+    expect(content).toMatch(/messages:\d+/);  // source file:lineNumber
+  });
+
+  test('detects SUSE network interface from InspectIaaSDisk cluster ZIP', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('test-inspect-iaas-disk-cluster.zip'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('InspectIaaSDisk Results');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+
+    // Should detect eth0 from SUSE ifcfg path
+    expect(content).toContain('eth0');
+    // Should detect DHCP
+    expect(content).toMatch(/dhcp/i);
+    // Should detect DHCP IP from cloud-init-output.log
+    expect(content).toContain('10.0.1.10');
+    // Should detect MAC from cloud-init
+    expect(content).toContain('60:45:bd:12:34:56');
+    // Should show cloud-init source warning with file provenance
+    expect(content).toMatch(/cloud-init/);
+    expect(content).toContain('last reported configuration');
+    expect(content).toMatch(/cloud-init-output\.log:\d+/);  // source file:lineNumber
+  });
+});
diff --git a/rca-tool/tests/networking.spec.js b/rca-tool/tests/networking.spec.js
new file mode 100644
index 0000000..19d3a07
--- /dev/null
+++ b/rca-tool/tests/networking.spec.js
@@ -0,0 +1,89 @@
+/**
+ * @module tests/networking
+ * @description Playwright tests for {@link module:parsers/networking}.
+ *
+ * Tests firewall-rule detection from SOS reports (nftables active,
+ * firewalld active) and SCC archives (no active firewall, nftables
+ * in `network.txt`).
+ */
+import { test, expect } from './coverage-fixture.js';
+import { uploadAndWaitForAnalysis, getResultText, navigateToApp, fixturePath } from './test-helpers.js';
+
+test.describe('Networking Parser', () => {
+
+  test.beforeEach(async ({ page }, testInfo) => {
+    await navigateToApp(page, testInfo);
+    await expect(page.locator('h1')).toContainText('RCA Tool');
+  });
+
+  test('detects firewall rules from SOS report with nftables active', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-firewall-sosreport.tar.xz');
+    const resultText = await getResultText(page);
+
+    // Should show the Networking section
+    expect(resultHTML).toContain('Networking');
+    // Should show the Firewall Rules sub-section
+    expect(resultHTML).toContain('Firewall Rules');
+    // Should detect nftables as active (firewalld not running, nftables has rules)
+    expect(resultText).toMatch(/nftables|Active.*nftables/i);
+    // Should show waagent security rules (168.63.129.16)
+    expect(resultHTML).toContain('168.63.129.16');
+  });
+
+  test('detects firewall rules from SOS report with firewalld active', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-firewall-sosreport-active.tar.xz');
+    const resultText = await getResultText(page);
+
+    // Should show Networking section with Firewall Rules
+    expect(resultHTML).toContain('Networking');
+    expect(resultHTML).toContain('Firewall Rules');
+    // Should detect firewalld as active
+    expect(resultText).toMatch(/firewalld|Active.*firewalld/i);
+    // Should show firewalld is running
+    expect(resultHTML).toMatch(/running/i);
+  });
+
+  test('detects no active firewall from SCC report', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-firewall-scc.tar.xz');
+    const resultText = await getResultText(page);
+
+    // Should show Networking section with Firewall Rules
+    expect(resultHTML).toContain('Networking');
+    expect(resultHTML).toContain('Firewall Rules');
+    // Should indicate no active firewall
+    expect(resultText).toMatch(/No Active Firewall/i);
+  });
+
+  test('detects nftables from SCC network.txt', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-firewall-scc-nftables.tar.xz');
+    const resultText = await getResultText(page);
+
+    // Should show Networking section
+    expect(resultHTML).toContain('Networking');
+    expect(resultHTML).toContain('Firewall Rules');
+    // Should detect nftables as active
+    expect(resultText).toMatch(/nftables|Active.*nftables/i);
+    // Should show the security table with waagent rules
+    expect(resultHTML).toContain('168.63.129.16');
+  });
+
+  test('detects firewalld configuration from InspectIaaSDisk ZIP', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('test-inspect-iaas-disk.zip'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('InspectIaaSDisk Results');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+
+    // Should detect firewalld from firewalld.conf
+    expect(content).toMatch(/firewall/i);
+    // Should detect nftables backend
+    expect(content).toContain('nftables');
+  });
+});
diff --git a/rca-tool/tests/nfs.spec.js b/rca-tool/tests/nfs.spec.js
new file mode 100644
index 0000000..d3f7b6e
--- /dev/null
+++ b/rca-tool/tests/nfs.spec.js
@@ -0,0 +1,41 @@
+/**
+ * @module tests/nfs
+ * @description Playwright tests for the NFS mount-option detector.
+ *
+ * The `scc_test-nfs-mounts.tar.xz` fixture contains an `/etc/fstab` with two
+ * SAP/HANA NFS mounts that use sub-optimal options (soft, small rsize/wsize,
+ * NFSv4.0) and one correctly-tuned mount (hard, 256 KiB sizes, nconnect=8,
+ * NFSv4.1) that should produce no warnings.
+ */
+import { test, expect } from './coverage-fixture.js';
+import { uploadAndWaitForAnalysis, navigateToApp } from './test-helpers.js';
+
+test.describe('NFS mount options', () => {
+
+  test.beforeEach(async ({ page }, testInfo) => {
+    await navigateToApp(page, testInfo);
+    await expect(page.locator('h1')).toContainText('RCA Tool');
+  });
+
+  test('flags soft mounts, small rsize/wsize, and outdated NFS version', async ({ page }) => {
+    const html = await uploadAndWaitForAnalysis(page, 'scc_test-nfs-mounts.tar.xz');
+
+    // NFS subsection and mount table are present.
+    expect(html).toContain('NFS Mounts');
+    expect(html).toContain('/hana/data');
+    expect(html).toContain('/hana/log');
+    expect(html).toContain('/sapmnt');
+
+    // soft-mount error.
+    expect(html).toContain("uses the 'soft' option");
+
+    // small rsize/wsize warning.
+    expect(html).toContain('small read/write sizes');
+
+    // outdated protocol version warning (NFSv4.0).
+    expect(html).toContain('uses protocol version 4.0');
+
+    // The well-tuned /sapmnt mount uses NFSv4.1 with hard + nconnect.
+    expect(html).toContain('4.1');
+  });
+});
diff --git a/rca-tool/tests/os-tuning.spec.js b/rca-tool/tests/os-tuning.spec.js
new file mode 100644
index 0000000..c5794ef
--- /dev/null
+++ b/rca-tool/tests/os-tuning.spec.js
@@ -0,0 +1,48 @@
+/**
+ * @module tests/os-tuning
+ * @description Playwright tests for the OS Tuning and Security section.
+ *
+ * Covers the four SAP-on-Azure QualityCheck ports surfaced by the Leptos UI:
+ * tuned profile, SELinux mode, swap space, and the fstrim timer.  The
+ * `scc_test-os-tuning.tar.xz` fixture is crafted to trigger one warning per
+ * detector (SELinux enforcing, no swap configured, fstrim timer enabled) plus
+ * a tuned recommendation.
+ */
+import { test, expect } from './coverage-fixture.js';
+import { uploadAndWaitForAnalysis, navigateToApp } from './test-helpers.js';
+
+test.describe('OS Tuning and Security', () => {
+
+  test.beforeEach(async ({ page }, testInfo) => {
+    await navigateToApp(page, testInfo);
+    await expect(page.locator('h1')).toContainText('RCA Tool');
+  });
+
+  test('renders tuned, SELinux, swap, and fstrim findings', async ({ page }) => {
+    const html = await uploadAndWaitForAnalysis(page, 'scc_test-os-tuning.tar.xz');
+
+    // Section is present.
+    expect(html).toContain('OS Tuning and Security');
+
+    // Tuned profile.
+    expect(html).toContain('Tuned Profile:');
+    expect(html).toContain('Active profile');
+    expect(html).toContain('sap-hana');
+
+    // SELinux enforcing warning.
+    expect(html).toContain('SELinux:');
+    expect(html).toContain('Current mode');
+    expect(html).toContain('enforcing');
+    expect(html).toContain('SELinux is in enforcing mode.');
+
+    // Swap space warning (no swap configured).
+    expect(html).toContain('Swap Space:');
+    expect(html).toContain('Swap total');
+    expect(html).toContain('No swap space is configured');
+
+    // fstrim timer warning.
+    expect(html).toContain('fstrim Timer:');
+    expect(html).toContain('Timer state');
+    expect(html).toContain('enabled');
+  });
+});
diff --git a/rca-tool/tests/package-lock.json b/rca-tool/tests/package-lock.json
new file mode 100644
index 0000000..044fb2e
--- /dev/null
+++ b/rca-tool/tests/package-lock.json
@@ -0,0 +1,3042 @@
+{
+  "name": "rca-tool-tests",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "rca-tool-tests",
+      "version": "1.0.0",
+      "devDependencies": {
+        "@axe-core/playwright": "^4.11.0",
+        "@playwright/test": "^1.60.0",
+        "http-server": "^14.1.1",
+        "monocart-reporter": "^2.10.0",
+        "nyc": "^17.1.0"
+      }
+    },
+    "node_modules/@axe-core/playwright": {
+      "version": "4.11.0",
+      "resolved": "https://registry.npmjs.org/@axe-core/playwright/-/playwright-4.11.0.tgz",
+      "integrity": "sha512-70vBT/Ylqpm65RQz2iCG2o0JJCEG/WCNyefTr2xcOcr1CoSee60gNQYUMZZ7YukoKkFLv26I/jjlsvwwp532oQ==",
+      "dev": true,
+      "dependencies": {
+        "axe-core": "~4.11.0"
+      },
+      "peerDependencies": {
+        "playwright-core": ">= 1.0.0"
+      }
+    },
+    "node_modules/@babel/code-frame": {
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
+      "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-validator-identifier": "^7.28.5",
+        "js-tokens": "^4.0.0",
+        "picocolors": "^1.1.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/compat-data": {
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.0.tgz",
+      "integrity": "sha512-T1NCJqT/j9+cn8fvkt7jtwbLBfLC/1y1c7NtCeXFRgzGTsafi68MRv8yzkYSapBnFA6L3U2VSc02ciDzoAJhJg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/core": {
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.0.tgz",
+      "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/code-frame": "^7.29.0",
+        "@babel/generator": "^7.29.0",
+        "@babel/helper-compilation-targets": "^7.28.6",
+        "@babel/helper-module-transforms": "^7.28.6",
+        "@babel/helpers": "^7.28.6",
+        "@babel/parser": "^7.29.0",
+        "@babel/template": "^7.28.6",
+        "@babel/traverse": "^7.29.0",
+        "@babel/types": "^7.29.0",
+        "@jridgewell/remapping": "^2.3.5",
+        "convert-source-map": "^2.0.0",
+        "debug": "^4.1.0",
+        "gensync": "^1.0.0-beta.2",
+        "json5": "^2.2.3",
+        "semver": "^6.3.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/babel"
+      }
+    },
+    "node_modules/@babel/core/node_modules/convert-source-map": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
+      "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@babel/core/node_modules/semver": {
+      "version": "6.3.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      }
+    },
+    "node_modules/@babel/generator": {
+      "version": "7.29.1",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.1.tgz",
+      "integrity": "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^7.29.0",
+        "@babel/types": "^7.29.0",
+        "@jridgewell/gen-mapping": "^0.3.12",
+        "@jridgewell/trace-mapping": "^0.3.28",
+        "jsesc": "^3.0.2"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-compilation-targets": {
+      "version": "7.28.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.28.6.tgz",
+      "integrity": "sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/compat-data": "^7.28.6",
+        "@babel/helper-validator-option": "^7.27.1",
+        "browserslist": "^4.24.0",
+        "lru-cache": "^5.1.1",
+        "semver": "^6.3.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-compilation-targets/node_modules/semver": {
+      "version": "6.3.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      }
+    },
+    "node_modules/@babel/helper-globals": {
+      "version": "7.28.0",
+      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.28.0.tgz",
+      "integrity": "sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-module-imports": {
+      "version": "7.28.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.28.6.tgz",
+      "integrity": "sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/traverse": "^7.28.6",
+        "@babel/types": "^7.28.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-module-transforms": {
+      "version": "7.28.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.28.6.tgz",
+      "integrity": "sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-module-imports": "^7.28.6",
+        "@babel/helper-validator-identifier": "^7.28.5",
+        "@babel/traverse": "^7.28.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0"
+      }
+    },
+    "node_modules/@babel/helper-string-parser": {
+      "version": "7.27.1",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.27.1.tgz",
+      "integrity": "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-validator-identifier": {
+      "version": "7.28.5",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.28.5.tgz",
+      "integrity": "sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-validator-option": {
+      "version": "7.27.1",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.27.1.tgz",
+      "integrity": "sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helpers": {
+      "version": "7.28.6",
+      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.28.6.tgz",
+      "integrity": "sha512-xOBvwq86HHdB7WUDTfKfT/Vuxh7gElQ+Sfti2Cy6yIWNW05P8iUslOVcZ4/sKbE+/jQaukQAdz/gf3724kYdqw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/template": "^7.28.6",
+        "@babel/types": "^7.28.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/parser": {
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.0.tgz",
+      "integrity": "sha512-IyDgFV5GeDUVX4YdF/3CPULtVGSXXMLh1xVIgdCgxApktqnQV0r7/8Nqthg+8YLGaAtdyIlo2qIdZrbCv4+7ww==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^7.29.0"
+      },
+      "bin": {
+        "parser": "bin/babel-parser.js"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@babel/template": {
+      "version": "7.28.6",
+      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.28.6.tgz",
+      "integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/code-frame": "^7.28.6",
+        "@babel/parser": "^7.28.6",
+        "@babel/types": "^7.28.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/traverse": {
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.0.tgz",
+      "integrity": "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/code-frame": "^7.29.0",
+        "@babel/generator": "^7.29.0",
+        "@babel/helper-globals": "^7.28.0",
+        "@babel/parser": "^7.29.0",
+        "@babel/template": "^7.28.6",
+        "@babel/types": "^7.29.0",
+        "debug": "^4.3.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/types": {
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
+      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-string-parser": "^7.27.1",
+        "@babel/helper-validator-identifier": "^7.28.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@istanbuljs/load-nyc-config": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@istanbuljs/load-nyc-config/-/load-nyc-config-1.1.0.tgz",
+      "integrity": "sha512-VjeHSlIzpv/NyD3N0YuHfXOPDIixcA1q2ZV98wsMqcYlPmv2n3Yb2lYP9XMElnaFVXg5A7YLTeLu6V84uQDjmQ==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "camelcase": "^5.3.1",
+        "find-up": "^4.1.0",
+        "get-package-type": "^0.1.0",
+        "js-yaml": "^3.13.1",
+        "resolve-from": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@istanbuljs/schema": {
+      "version": "0.1.3",
+      "resolved": "https://registry.npmjs.org/@istanbuljs/schema/-/schema-0.1.3.tgz",
+      "integrity": "sha512-ZXRY4jNvVgSVQ8DL3LTcakaAtXwTVUxE81hslsyD2AtoXW/wVob10HkOJ1X/pAlcI7D+2YoZKg5do8G/w6RYgA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@jridgewell/gen-mapping": {
+      "version": "0.3.13",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
+      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.0",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
+    },
+    "node_modules/@jridgewell/remapping": {
+      "version": "2.3.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
+      "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/gen-mapping": "^0.3.5",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
+    },
+    "node_modules/@jridgewell/resolve-uri": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
+      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/sourcemap-codec": {
+      "version": "1.5.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
+      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@jridgewell/trace-mapping": {
+      "version": "0.3.31",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
+      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/resolve-uri": "^3.1.0",
+        "@jridgewell/sourcemap-codec": "^1.4.14"
+      }
+    },
+    "node_modules/@playwright/test": {
+      "version": "1.60.0",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.60.0.tgz",
+      "integrity": "sha512-O71yZIbAh/PxDMNGns37GHBIfrVkEVyn+AXyIa5dOTfb4/xNvRWV+Vv/NMbNCtODB/pO7vLlF2OTmMVLhmr7Ag==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright": "1.60.0"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/accepts": {
+      "version": "1.3.8",
+      "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",
+      "integrity": "sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "mime-types": "~2.1.34",
+        "negotiator": "0.6.3"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/accepts/node_modules/mime-db": {
+      "version": "1.52.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
+      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/accepts/node_modules/mime-types": {
+      "version": "2.1.35",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
+      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "mime-db": "1.52.0"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/acorn": {
+      "version": "8.15.0",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz",
+      "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "acorn": "bin/acorn"
+      },
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
+    "node_modules/acorn-loose": {
+      "version": "8.5.2",
+      "resolved": "https://registry.npmjs.org/acorn-loose/-/acorn-loose-8.5.2.tgz",
+      "integrity": "sha512-PPvV6g8UGMGgjrMu+n/f9E/tCSkNQ2Y97eFvuVdJfG11+xdIeDcLyNdC8SHcrHbRqkfwLASdplyR6B6sKM1U4A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "acorn": "^8.15.0"
+      },
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
+    "node_modules/acorn-walk": {
+      "version": "8.3.4",
+      "resolved": "https://registry.npmjs.org/acorn-walk/-/acorn-walk-8.3.4.tgz",
+      "integrity": "sha512-ueEepnujpqee2o5aIYnvHU6C0A42MNdsIDeqy5BydrkuC5R1ZuUFnm27EeFJGoEHJQgn3uleRvmTXaJgfXbt4g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "acorn": "^8.11.0"
+      },
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
+    "node_modules/aggregate-error": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/aggregate-error/-/aggregate-error-3.1.0.tgz",
+      "integrity": "sha512-4I7Td01quW/RpocfNayFdFVk1qSuoh0E7JrbRJ16nH01HhKFQ88INq9Sd+nd72zqRySlr9BmDA8xlEJ6vJMrYA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "clean-stack": "^2.0.0",
+        "indent-string": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/append-transform": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/append-transform/-/append-transform-2.0.0.tgz",
+      "integrity": "sha512-7yeyCEurROLQJFv5Xj4lEGTy0borxepjFv1g22oAdqFu//SrAlDl1O1Nxx15SH1RoliUml6p8dwJW9jvZughhg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "default-require-extensions": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/archy": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/archy/-/archy-1.0.0.tgz",
+      "integrity": "sha512-Xg+9RwCg/0p32teKdGMPTPnVXKD0w3DfHnFTficozsAgsvq2XenPJq/MYpzzQ/v8zrOyJn6Ds39VA4JIDwFfqw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/argparse": {
+      "version": "1.0.10",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
+      "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "sprintf-js": "~1.0.2"
+      }
+    },
+    "node_modules/async": {
+      "version": "3.2.6",
+      "resolved": "https://registry.npmjs.org/async/-/async-3.2.6.tgz",
+      "integrity": "sha512-htCUDlxyyCLMgaM3xXg0C0LW2xqfuQ6p05pCEIsXuyQ+a1koYKTuBMzRNwmybfLgvJDMd0r1LTn4+E0Ti6C2AA==",
+      "dev": true
+    },
+    "node_modules/axe-core": {
+      "version": "4.11.0",
+      "resolved": "https://registry.npmjs.org/axe-core/-/axe-core-4.11.0.tgz",
+      "integrity": "sha512-ilYanEU8vxxBexpJd8cWM4ElSQq4QctCLKih0TSfjIfCQTeyH/6zVrmIJfLPrKTKJRbiG+cfnZbQIjAlJmF1jQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/baseline-browser-mapping": {
+      "version": "2.9.19",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.9.19.tgz",
+      "integrity": "sha512-ipDqC8FrAl/76p2SSWKSI+H9tFwm7vYqXQrItCuiVPt26Km0jS+NzSsBWAaBusvSbQcfJG+JitdMm+wZAgTYqg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "baseline-browser-mapping": "dist/cli.js"
+      }
+    },
+    "node_modules/basic-auth": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/basic-auth/-/basic-auth-2.0.1.tgz",
+      "integrity": "sha512-NF+epuEdnUYVlGuhaxbbq+dvJttwLnGY+YixlXlME5KpQ5W3CnXA5cVTneY3SPbPDRkcjMbifrwmFYcClgOZeg==",
+      "dev": true,
+      "dependencies": {
+        "safe-buffer": "5.1.2"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/brace-expansion": {
+      "version": "1.1.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
+      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/browserslist": {
+      "version": "4.28.1",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.1.tgz",
+      "integrity": "sha512-ZC5Bd0LgJXgwGqUknZY/vkUQ04r8NXnJZ3yYi4vDmSiZmC/pdSN0NbNRPxZpbtO4uAfDUAFffO8IZoM3Gj8IkA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/browserslist"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "baseline-browser-mapping": "^2.9.0",
+        "caniuse-lite": "^1.0.30001759",
+        "electron-to-chromium": "^1.5.263",
+        "node-releases": "^2.0.27",
+        "update-browserslist-db": "^1.2.0"
+      },
+      "bin": {
+        "browserslist": "cli.js"
+      },
+      "engines": {
+        "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7"
+      }
+    },
+    "node_modules/caching-transform": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/caching-transform/-/caching-transform-4.0.0.tgz",
+      "integrity": "sha512-kpqOvwXnjjN44D89K5ccQC+RUrsy7jB/XLlRrx0D7/2HNcTPqzsb6XgYoErwko6QsV184CA2YgS1fxDiiDZMWA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "hasha": "^5.0.0",
+        "make-dir": "^3.0.0",
+        "package-hash": "^4.0.0",
+        "write-file-atomic": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/caching-transform/node_modules/make-dir": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-3.1.0.tgz",
+      "integrity": "sha512-g3FeP20LNwhALb/6Cz6Dd4F2ngze0jz7tbzrD2wAV+o9FeNHe4rL+yK2md0J/fiSf1sa1ADhXqi5+oVwOM/eGw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "semver": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/caching-transform/node_modules/semver": {
+      "version": "6.3.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      }
+    },
+    "node_modules/call-bind-apply-helpers": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
+      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
+      "dev": true,
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/call-bound": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz",
+      "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==",
+      "dev": true,
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "get-intrinsic": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/camelcase": {
+      "version": "5.3.1",
+      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-5.3.1.tgz",
+      "integrity": "sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/caniuse-lite": {
+      "version": "1.0.30001770",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001770.tgz",
+      "integrity": "sha512-x/2CLQ1jHENRbHg5PSId2sXq1CIO1CISvwWAj027ltMVG2UNgW+w9oH2+HzgEIRFembL8bUlXtfbBHR1fCg2xw==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/caniuse-lite"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "CC-BY-4.0"
+    },
+    "node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/clean-stack": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/clean-stack/-/clean-stack-2.2.0.tgz",
+      "integrity": "sha512-4diC9HaTE+KRAMWhDhrGOECgWZxoevMc5TlkObMqNSsVU62PYzXZ/SMTjzyGAFF1YusgxGcSWTEXBhp0CPwQ1A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/cliui": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/cliui/-/cliui-6.0.0.tgz",
+      "integrity": "sha512-t6wbgtoCXvAzst7QgXxJYqPt0usEfbgQdftEPbLL/cvv6HPE5VgvqCuAIDR0NgU52ds6rFwqrgakNLrHEjCbrQ==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "string-width": "^4.2.0",
+        "strip-ansi": "^6.0.0",
+        "wrap-ansi": "^6.2.0"
+      }
+    },
+    "node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/commander": {
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-14.0.3.tgz",
+      "integrity": "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/commondir": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/commondir/-/commondir-1.0.1.tgz",
+      "integrity": "sha512-W9pAhw0ja1Edb5GVdIF1mjZw/ASI0AlShXM83UUGe2DVr5TdAPEA1OA8m/g8zWp9x6On7gqufY+FatDbC3MDQg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/console-grid": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/console-grid/-/console-grid-2.2.3.tgz",
+      "integrity": "sha512-+mecFacaFxGl+1G31IsCx41taUXuW2FxX+4xIE0TIPhgML+Jb9JFcBWGhhWerd1/vhScubdmHqTwOhB0KCUUAg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/content-disposition": {
+      "version": "0.5.4",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
+      "integrity": "sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "5.2.1"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/content-disposition/node_modules/safe-buffer": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/content-type": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
+      "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/convert-source-map": {
+      "version": "1.9.0",
+      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-1.9.0.tgz",
+      "integrity": "sha512-ASFBup0Mz1uyiIjANan1jzLQami9z1PoYSZCiiYW2FczPbenXc45FZdBZLzOT+r6+iciuEModtmCti+hjaAk0A==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/cookies": {
+      "version": "0.9.1",
+      "resolved": "https://registry.npmjs.org/cookies/-/cookies-0.9.1.tgz",
+      "integrity": "sha512-TG2hpqe4ELx54QER/S3HQ9SRVnQnGBtKUz5bLQWtYAQ+o6GpgMs6sYUvaiJjVxb+UXwhRhAEP3m7LbsIZ77Hmw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "depd": "~2.0.0",
+        "keygrip": "~1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/corser": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/corser/-/corser-2.0.1.tgz",
+      "integrity": "sha512-utCYNzRSQIZNPIcGZdQc92UVJYAhtGAteCFg0yRaFm8f0P+CPtyGyHXJcGXnffjCybUCEx3FQ2G7U3/o9eIkVQ==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.4.0"
+      }
+    },
+    "node_modules/cross-spawn": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "dev": true,
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/decamelize": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/decamelize/-/decamelize-1.2.0.tgz",
+      "integrity": "sha512-z2S+W9X73hAUUki+N+9Za2lBlun89zigOyGrsax+KUQ6wKW4ZoWpEYBkGhQjwAjjDCkWxhY0VKEhk8wzY7F5cA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/deep-equal": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/deep-equal/-/deep-equal-1.0.1.tgz",
+      "integrity": "sha512-bHtC0iYvWhyaTzvV3CZgPeZQqCOBGyGsVV7v4eevpdkLHfiSrXUdBG+qAuSz4RI70sszvjQ1QSZ98An1yNwpSw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/default-require-extensions": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/default-require-extensions/-/default-require-extensions-3.0.1.tgz",
+      "integrity": "sha512-eXTJmRbm2TIt9MgWTsOH1wEuhew6XGZcMeGKCtLedIg/NCsg1iBePXkceTdK4Fii7pzmN9tGsZhKzZ4h7O/fxw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "strip-bom": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/delegates": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/delegates/-/delegates-1.0.0.tgz",
+      "integrity": "sha512-bd2L678uiWATM6m5Z1VzNCErI3jiGzt6HGY8OVICs40JQq/HALfbyNJmp0UDakEY4pMMaN0Ly5om/B1VI/+xfQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/depd": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
+      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/destroy": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/destroy/-/destroy-1.2.0.tgz",
+      "integrity": "sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8",
+        "npm": "1.2.8000 || >= 1.4.16"
+      }
+    },
+    "node_modules/dunder-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
+      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+      "dev": true,
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "gopd": "^1.2.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/ee-first": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
+      "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/eight-colors": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/eight-colors/-/eight-colors-1.3.1.tgz",
+      "integrity": "sha512-7nXPYDeKh6DgJDR/mpt2G7N/hCNSGwwoPVmoI3+4TEwOb07VFN1WMPG0DFf6nMEjrkgdj8Og7l7IaEEk3VE6Zg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/electron-to-chromium": {
+      "version": "1.5.286",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.286.tgz",
+      "integrity": "sha512-9tfDXhJ4RKFNerfjdCcZfufu49vg620741MNs26a9+bhLThdB+plgMeou98CAaHu/WATj2iHOOHTp1hWtABj2A==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/encodeurl": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
+      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/es-define-property": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
+      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-errors": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
+      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-object-atoms": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
+      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
+      "dev": true,
+      "dependencies": {
+        "es-errors": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es6-error": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/es6-error/-/es6-error-4.1.1.tgz",
+      "integrity": "sha512-Um/+FxMr9CISWh0bi5Zv0iOD+4cFh5qLeks1qhAopKVAJw3drgKbKySikp7wGhDL0HPeaja0P5ULZrxLkniUVg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/escalade": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz",
+      "integrity": "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/escape-html": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
+      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/esprima": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz",
+      "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "bin": {
+        "esparse": "bin/esparse.js",
+        "esvalidate": "bin/esvalidate.js"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/eventemitter3": {
+      "version": "4.0.7",
+      "resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-4.0.7.tgz",
+      "integrity": "sha512-8guHBZCwKnFhYdHr2ysuRWErTwhoN2X8XELRlrRwpmfeY2jjuUN4taQMsULKUVo1K4DvZl+0pgfyoysHxvmvEw==",
+      "dev": true
+    },
+    "node_modules/find-cache-dir": {
+      "version": "3.3.2",
+      "resolved": "https://registry.npmjs.org/find-cache-dir/-/find-cache-dir-3.3.2.tgz",
+      "integrity": "sha512-wXZV5emFEjrridIgED11OoUKLxiYjAcqot/NJdAkOhlJ+vGzwhOAfcG5OX1jP+S0PcjEn8bdMJv+g2jwQ3Onig==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "commondir": "^1.0.1",
+        "make-dir": "^3.0.2",
+        "pkg-dir": "^4.1.0"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/avajs/find-cache-dir?sponsor=1"
+      }
+    },
+    "node_modules/find-cache-dir/node_modules/make-dir": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-3.1.0.tgz",
+      "integrity": "sha512-g3FeP20LNwhALb/6Cz6Dd4F2ngze0jz7tbzrD2wAV+o9FeNHe4rL+yK2md0J/fiSf1sa1ADhXqi5+oVwOM/eGw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "semver": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/find-cache-dir/node_modules/semver": {
+      "version": "6.3.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      }
+    },
+    "node_modules/find-up": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz",
+      "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "locate-path": "^5.0.0",
+        "path-exists": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/follow-redirects": {
+      "version": "1.15.11",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.11.tgz",
+      "integrity": "sha512-deG2P0JfjrTxl50XGCDyfI97ZGVCxIpfKYmfyrQ54n5FO/0gfIES8C/Psl6kWVDolizcaaxZJnTS0QSMxvnsBQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/RubenVerborgh"
+        }
+      ],
+      "engines": {
+        "node": ">=4.0"
+      },
+      "peerDependenciesMeta": {
+        "debug": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/foreground-child": {
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",
+      "integrity": "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "cross-spawn": "^7.0.6",
+        "signal-exit": "^4.0.1"
+      },
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/fresh": {
+      "version": "0.5.2",
+      "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz",
+      "integrity": "sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/fromentries": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/fromentries/-/fromentries-1.3.2.tgz",
+      "integrity": "sha512-cHEpEQHUg0f8XdtZCc2ZAhrHzKzT0MrFUTcvx+hfxYu7rGMDc5SKoXFh+n4YigxsHXRzc6OrCshdR1bWH6HHyg==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/fs.realpath": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
+      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
+      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/function-bind": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
+      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
+      "dev": true,
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/gensync": {
+      "version": "1.0.0-beta.2",
+      "resolved": "https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.2.tgz",
+      "integrity": "sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/get-caller-file": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/get-caller-file/-/get-caller-file-2.0.5.tgz",
+      "integrity": "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==",
+      "dev": true,
+      "license": "ISC",
+      "engines": {
+        "node": "6.* || 8.* || >= 10.*"
+      }
+    },
+    "node_modules/get-intrinsic": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
+      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
+      "dev": true,
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "es-define-property": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.1.1",
+        "function-bind": "^1.1.2",
+        "get-proto": "^1.0.1",
+        "gopd": "^1.2.0",
+        "has-symbols": "^1.1.0",
+        "hasown": "^2.0.2",
+        "math-intrinsics": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-package-type": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/get-package-type/-/get-package-type-0.1.0.tgz",
+      "integrity": "sha512-pjzuKtY64GYfWizNAJ0fr9VqttZkNiK2iS430LtIHzjBEr6bX8Am2zm4sW4Ro5wjWW5cAlRL1qAMTcXbjNAO2Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
+    "node_modules/get-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
+      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
+      "dev": true,
+      "dependencies": {
+        "dunder-proto": "^1.0.1",
+        "es-object-atoms": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/glob": {
+      "version": "7.2.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.1.1",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      },
+      "engines": {
+        "node": "*"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/gopd": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
+      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/graceful-fs": {
+      "version": "4.2.11",
+      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
+      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/has-symbols": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
+      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/hasha": {
+      "version": "5.2.2",
+      "resolved": "https://registry.npmjs.org/hasha/-/hasha-5.2.2.tgz",
+      "integrity": "sha512-Hrp5vIK/xr5SkeN2onO32H0MgNZ0f17HRNH39WfL0SYUNOTZ5Lz1TJ8Pajo/87dYGEFlLMm7mIc/k/s6Bvz9HQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "is-stream": "^2.0.0",
+        "type-fest": "^0.8.0"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/hasown": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
+      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
+      "dev": true,
+      "dependencies": {
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/he": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/he/-/he-1.2.0.tgz",
+      "integrity": "sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw==",
+      "dev": true,
+      "bin": {
+        "he": "bin/he"
+      }
+    },
+    "node_modules/html-encoding-sniffer": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/html-encoding-sniffer/-/html-encoding-sniffer-3.0.0.tgz",
+      "integrity": "sha512-oWv4T4yJ52iKrufjnyZPkrN0CH3QnrUqdB6In1g5Fe1mia8GmF36gnfNySxoZtxD5+NmYw1EElVXiBk93UeskA==",
+      "dev": true,
+      "dependencies": {
+        "whatwg-encoding": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/html-escaper": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz",
+      "integrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/http-assert": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/http-assert/-/http-assert-1.5.0.tgz",
+      "integrity": "sha512-uPpH7OKX4H25hBmU6G1jWNaqJGpTXxey+YOUizJUAgu0AjLUeC8D73hTrhvDS5D+GJN1DN1+hhc/eF/wpxtp0w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "deep-equal": "~1.0.1",
+        "http-errors": "~1.8.0"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/http-assert/node_modules/depd": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/depd/-/depd-1.1.2.tgz",
+      "integrity": "sha512-7emPTl6Dpo6JRXOXjLRxck+FlLRX5847cLKEn00PLAgc3g2hTZZgr+e4c2v6QpSmLeFP3n5yUo7ft6avBK/5jQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/http-assert/node_modules/http-errors": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.8.1.tgz",
+      "integrity": "sha512-Kpk9Sm7NmI+RHhnj6OIWDI1d6fIoFAtFt9RLaTMRlg/8w49juAStsrBgp0Dp4OdxdVbRIeKhtCUvoi/RuAhO4g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "depd": "~1.1.2",
+        "inherits": "2.0.4",
+        "setprototypeof": "1.2.0",
+        "statuses": ">= 1.5.0 < 2",
+        "toidentifier": "1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/http-assert/node_modules/statuses": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/statuses/-/statuses-1.5.0.tgz",
+      "integrity": "sha512-OpZ3zP+jT1PI7I8nemJX4AKmAX070ZkYPVWV/AaKTJl+tXCTGyVdC1a4SL8RUQYEwk/f34ZX8UTykN68FwrqAA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/http-errors": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
+      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "depd": "~2.0.0",
+        "inherits": "~2.0.4",
+        "setprototypeof": "~1.2.0",
+        "statuses": "~2.0.2",
+        "toidentifier": "~1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/http-proxy": {
+      "version": "1.18.1",
+      "resolved": "https://registry.npmjs.org/http-proxy/-/http-proxy-1.18.1.tgz",
+      "integrity": "sha512-7mz/721AbnJwIVbnaSv1Cz3Am0ZLT/UBwkC92VlxhXv/k/BBQfM2fXElQNC27BVGr0uwUpplYPQM9LnaBMR5NQ==",
+      "dev": true,
+      "dependencies": {
+        "eventemitter3": "^4.0.0",
+        "follow-redirects": "^1.0.0",
+        "requires-port": "^1.0.0"
+      },
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
+    "node_modules/http-server": {
+      "version": "14.1.1",
+      "resolved": "https://registry.npmjs.org/http-server/-/http-server-14.1.1.tgz",
+      "integrity": "sha512-+cbxadF40UXd9T01zUHgA+rlo2Bg1Srer4+B4NwIHdaGxAGGv59nYRnGGDJ9LBk7alpS0US+J+bLLdQOOkJq4A==",
+      "dev": true,
+      "dependencies": {
+        "basic-auth": "^2.0.1",
+        "chalk": "^4.1.2",
+        "corser": "^2.0.1",
+        "he": "^1.2.0",
+        "html-encoding-sniffer": "^3.0.0",
+        "http-proxy": "^1.18.1",
+        "mime": "^1.6.0",
+        "minimist": "^1.2.6",
+        "opener": "^1.5.1",
+        "portfinder": "^1.0.28",
+        "secure-compare": "3.0.1",
+        "union": "~0.5.0",
+        "url-join": "^4.0.1"
+      },
+      "bin": {
+        "http-server": "bin/http-server"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/iconv-lite": {
+      "version": "0.6.3",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
+      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
+      "dev": true,
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/imurmurhash": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
+      "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.8.19"
+      }
+    },
+    "node_modules/indent-string": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/indent-string/-/indent-string-4.0.0.tgz",
+      "integrity": "sha512-EdDDZu4A2OyIK7Lr/2zG+w5jmbuk1DVBnEwREQvBzspBJkCEbRa8GxU1lghYcaGJCnRWibjDXlq779X1/y5xwg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/inflight": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
+      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
+      "deprecated": "This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "once": "^1.3.0",
+        "wrappy": "1"
+      }
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/is-fullwidth-code-point": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/is-stream": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
+      "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/is-typedarray": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/is-typedarray/-/is-typedarray-1.0.0.tgz",
+      "integrity": "sha512-cyA56iCMHAh5CdzjJIa4aohJyeO1YbwLi3Jc35MmRU6poroFjIGZzUzupGiRPOjgHg9TLu43xbpwXk523fMxKA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/is-windows": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/is-windows/-/is-windows-1.0.2.tgz",
+      "integrity": "sha512-eXK1UInq2bPmjyX6e3VHIzMLobc4J94i4AWn+Hpq3OU5KkrRC96OAcR3PRJ/pGu6m8TRnBHP9dkXQVsT/COVIA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/isexe": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
+      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/istanbul-lib-coverage": {
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-coverage/-/istanbul-lib-coverage-3.2.2.tgz",
+      "integrity": "sha512-O8dpsF+r0WV/8MNRKfnmrtCWhuKjxrq2w+jpzBL5UZKTi2LeVWnWOmWRxFlesJONmc+wLAGvKQZEOanko0LFTg==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/istanbul-lib-hook": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-hook/-/istanbul-lib-hook-3.0.0.tgz",
+      "integrity": "sha512-Pt/uge1Q9s+5VAZ+pCo16TYMWPBIl+oaNIjgLQxcX0itS6ueeaA+pEfThZpH8WxhFgCiEb8sAJY6MdUKgiIWaQ==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "append-transform": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/istanbul-lib-instrument": {
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-instrument/-/istanbul-lib-instrument-6.0.3.tgz",
+      "integrity": "sha512-Vtgk7L/R2JHyyGW07spoFlB8/lpjiOLTjMdms6AFMraYt3BaJauod/NGrfnVG/y4Ix1JEuMRPDPEj2ua+zz1/Q==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "@babel/core": "^7.23.9",
+        "@babel/parser": "^7.23.9",
+        "@istanbuljs/schema": "^0.1.3",
+        "istanbul-lib-coverage": "^3.2.0",
+        "semver": "^7.5.4"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/istanbul-lib-processinfo": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-processinfo/-/istanbul-lib-processinfo-2.0.3.tgz",
+      "integrity": "sha512-NkwHbo3E00oybX6NGJi6ar0B29vxyvNwoC7eJ4G4Yq28UfY758Hgn/heV8VRFhevPED4LXfFz0DQ8z/0kw9zMg==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "archy": "^1.0.0",
+        "cross-spawn": "^7.0.3",
+        "istanbul-lib-coverage": "^3.2.0",
+        "p-map": "^3.0.0",
+        "rimraf": "^3.0.0",
+        "uuid": "^8.3.2"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/istanbul-lib-report": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-report/-/istanbul-lib-report-3.0.1.tgz",
+      "integrity": "sha512-GCfE1mtsHGOELCU8e/Z7YWzpmybrx/+dSTfLrvY8qRmaY6zXTKWn6WQIjaAFw069icm6GVMNkgu0NzI4iPZUNw==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "istanbul-lib-coverage": "^3.0.0",
+        "make-dir": "^4.0.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/istanbul-lib-source-maps": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-source-maps/-/istanbul-lib-source-maps-4.0.1.tgz",
+      "integrity": "sha512-n3s8EwkdFIJCG3BPKBYvskgXGoy88ARzvegkitk60NxRdwltLOTaH7CUiMRXvwYorl0Q712iEjcWB+fK/MrWVw==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "debug": "^4.1.1",
+        "istanbul-lib-coverage": "^3.0.0",
+        "source-map": "^0.6.1"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/istanbul-reports": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/istanbul-reports/-/istanbul-reports-3.2.0.tgz",
+      "integrity": "sha512-HGYWWS/ehqTV3xN10i23tkPkpH46MLCIMFNCaaKNavAXTF1RkqxawEPtnjnGZ6XKSInBKkiOA5BKS+aZiY3AvA==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "html-escaper": "^2.0.0",
+        "istanbul-lib-report": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/js-tokens": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
+      "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/js-yaml": {
+      "version": "3.14.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
+      "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "argparse": "^1.0.7",
+        "esprima": "^4.0.0"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
+    "node_modules/jsesc": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-3.1.0.tgz",
+      "integrity": "sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "jsesc": "bin/jsesc"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/json5": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "json5": "lib/cli.js"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/keygrip": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/keygrip/-/keygrip-1.1.0.tgz",
+      "integrity": "sha512-iYSchDJ+liQ8iwbSI2QqsQOvqv58eJCEanyJPJi+Khyu8smkcKSFUCbPwzFcL7YVtZ6eONjqRX/38caJ7QjRAQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tsscmp": "1.0.6"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/koa": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/koa/-/koa-3.1.1.tgz",
+      "integrity": "sha512-KDDuvpfqSK0ZKEO2gCPedNjl5wYpfj+HNiuVRlbhd1A88S3M0ySkdf2V/EJ4NWt5dwh5PXCdcenrKK2IQJAxsg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "accepts": "^1.3.8",
+        "content-disposition": "~0.5.4",
+        "content-type": "^1.0.5",
+        "cookies": "~0.9.1",
+        "delegates": "^1.0.0",
+        "destroy": "^1.2.0",
+        "encodeurl": "^2.0.0",
+        "escape-html": "^1.0.3",
+        "fresh": "~0.5.2",
+        "http-assert": "^1.5.0",
+        "http-errors": "^2.0.0",
+        "koa-compose": "^4.1.0",
+        "mime-types": "^3.0.1",
+        "on-finished": "^2.4.1",
+        "parseurl": "^1.3.3",
+        "statuses": "^2.0.1",
+        "type-is": "^2.0.1",
+        "vary": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/koa-compose": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/koa-compose/-/koa-compose-4.1.0.tgz",
+      "integrity": "sha512-8ODW8TrDuMYvXRwra/Kh7/rJo9BtOfPc6qO8eAfC80CnCvSjSl0bkRM24X6/XBBEyj0v1nRUQ1LyOy3dbqOWXw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/koa-static-resolver": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/koa-static-resolver/-/koa-static-resolver-1.0.6.tgz",
+      "integrity": "sha512-ZX5RshSzH8nFn05/vUNQzqw32nEigsPa67AVUr6ZuQxuGdnCcTLcdgr4C81+YbJjpgqKHfacMBd7NmJIbj7fXw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/locate-path": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz",
+      "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "p-locate": "^4.1.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/lodash.flattendeep": {
+      "version": "4.4.0",
+      "resolved": "https://registry.npmjs.org/lodash.flattendeep/-/lodash.flattendeep-4.4.0.tgz",
+      "integrity": "sha512-uHaJFihxmJcEX3kT4I23ABqKKalJ/zDrDg0lsFtc1h+3uw49SIJ5beyhx5ExVRti3AvKoOJngIj7xz3oylPdWQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/lru-cache": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-5.1.1.tgz",
+      "integrity": "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "yallist": "^3.0.2"
+      }
+    },
+    "node_modules/lz-utils": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/lz-utils/-/lz-utils-2.1.0.tgz",
+      "integrity": "sha512-CMkfimAypidTtWjNDxY8a1bc1mJdyEh04V2FfEQ5Zh8Nx4v7k850EYa+dOWGn9hKG5xOyHP5MkuduAZCTHRvJw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/make-dir": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-4.0.0.tgz",
+      "integrity": "sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "semver": "^7.5.3"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/math-intrinsics": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
+      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/media-typer": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-1.1.0.tgz",
+      "integrity": "sha512-aisnrDP4GNe06UcKFnV5bfMNPBUw4jsLGaWwWfnH3v02GnBuXX2MCVn5RbrWo0j3pczUilYblq7fQ7Nw2t5XKw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/mime": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/mime/-/mime-1.6.0.tgz",
+      "integrity": "sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==",
+      "dev": true,
+      "bin": {
+        "mime": "cli.js"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/mime-db": {
+      "version": "1.54.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
+      "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/mime-types": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
+      "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "mime-db": "^1.54.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/minimatch": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/minimist": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
+      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
+      "dev": true,
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/monocart-coverage-reports": {
+      "version": "2.12.9",
+      "resolved": "https://registry.npmjs.org/monocart-coverage-reports/-/monocart-coverage-reports-2.12.9.tgz",
+      "integrity": "sha512-vtFqbC3Egl4nVa1FSIrQvMPO6HZtb9lo+3IW7/crdvrLNW2IH8lUsxaK0TsKNmMO2mhFWwqQywLV2CZelqPgwA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "acorn": "^8.15.0",
+        "acorn-loose": "^8.5.2",
+        "acorn-walk": "^8.3.4",
+        "commander": "^14.0.0",
+        "console-grid": "^2.2.3",
+        "eight-colors": "^1.3.1",
+        "foreground-child": "^3.3.1",
+        "istanbul-lib-coverage": "^3.2.2",
+        "istanbul-lib-report": "^3.0.1",
+        "istanbul-reports": "^3.2.0",
+        "lz-utils": "^2.1.0",
+        "monocart-locator": "^1.0.2"
+      },
+      "bin": {
+        "mcr": "lib/cli.js"
+      }
+    },
+    "node_modules/monocart-locator": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/monocart-locator/-/monocart-locator-1.0.2.tgz",
+      "integrity": "sha512-v8W5hJLcWMIxLCcSi/MHh+VeefI+ycFmGz23Froer9QzWjrbg4J3gFJBuI/T1VLNoYxF47bVPPxq8ZlNX4gVCw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/monocart-reporter": {
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/monocart-reporter/-/monocart-reporter-2.10.0.tgz",
+      "integrity": "sha512-Q421HL8hCr024HMjQcQylEpOLy69FE6Zli2s/A0zptfFEPW/kaz6B1Ll3CYs8L1j67+egt1HeNC1LTHUsp6W+A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "console-grid": "^2.2.3",
+        "eight-colors": "^1.3.1",
+        "koa": "^3.0.1",
+        "koa-static-resolver": "^1.0.6",
+        "lz-utils": "^2.1.0",
+        "monocart-coverage-reports": "^2.12.9",
+        "monocart-locator": "^1.0.2",
+        "nodemailer": "^7.0.6"
+      },
+      "bin": {
+        "monocart": "lib/cli.js"
+      }
+    },
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "dev": true
+    },
+    "node_modules/negotiator": {
+      "version": "0.6.3",
+      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz",
+      "integrity": "sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/node-preload": {
+      "version": "0.2.1",
+      "resolved": "https://registry.npmjs.org/node-preload/-/node-preload-0.2.1.tgz",
+      "integrity": "sha512-RM5oyBy45cLEoHqCeh+MNuFAxO0vTFBLskvQbOKnEE7YTTSN4tbN8QWDIPQ6L+WvKsB/qLEGpYe2ZZ9d4W9OIQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "process-on-spawn": "^1.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/node-releases": {
+      "version": "2.0.27",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.27.tgz",
+      "integrity": "sha512-nmh3lCkYZ3grZvqcCH+fjmQ7X+H0OeZgP40OierEaAptX4XofMh5kwNbWh7lBduUzCcV/8kZ+NDLCwm2iorIlA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/nodemailer": {
+      "version": "7.0.13",
+      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-7.0.13.tgz",
+      "integrity": "sha512-PNDFSJdP+KFgdsG3ZzMXCgquO7I6McjY2vlqILjtJd0hy8wEvtugS9xKRF2NWlPNGxvLCXlTNIae4serI7dinw==",
+      "dev": true,
+      "license": "MIT-0",
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/nyc": {
+      "version": "17.1.0",
+      "resolved": "https://registry.npmjs.org/nyc/-/nyc-17.1.0.tgz",
+      "integrity": "sha512-U42vQ4czpKa0QdI1hu950XuNhYqgoM+ZF1HT+VuUHL9hPfDPVvNQyltmMqdE9bUHMVa+8yNbc3QKTj8zQhlVxQ==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "@istanbuljs/load-nyc-config": "^1.0.0",
+        "@istanbuljs/schema": "^0.1.2",
+        "caching-transform": "^4.0.0",
+        "convert-source-map": "^1.7.0",
+        "decamelize": "^1.2.0",
+        "find-cache-dir": "^3.2.0",
+        "find-up": "^4.1.0",
+        "foreground-child": "^3.3.0",
+        "get-package-type": "^0.1.0",
+        "glob": "^7.1.6",
+        "istanbul-lib-coverage": "^3.0.0",
+        "istanbul-lib-hook": "^3.0.0",
+        "istanbul-lib-instrument": "^6.0.2",
+        "istanbul-lib-processinfo": "^2.0.2",
+        "istanbul-lib-report": "^3.0.0",
+        "istanbul-lib-source-maps": "^4.0.0",
+        "istanbul-reports": "^3.0.2",
+        "make-dir": "^3.0.0",
+        "node-preload": "^0.2.1",
+        "p-map": "^3.0.0",
+        "process-on-spawn": "^1.0.0",
+        "resolve-from": "^5.0.0",
+        "rimraf": "^3.0.0",
+        "signal-exit": "^3.0.2",
+        "spawn-wrap": "^2.0.0",
+        "test-exclude": "^6.0.0",
+        "yargs": "^15.0.2"
+      },
+      "bin": {
+        "nyc": "bin/nyc.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/nyc/node_modules/make-dir": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-3.1.0.tgz",
+      "integrity": "sha512-g3FeP20LNwhALb/6Cz6Dd4F2ngze0jz7tbzrD2wAV+o9FeNHe4rL+yK2md0J/fiSf1sa1ADhXqi5+oVwOM/eGw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "semver": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/nyc/node_modules/semver": {
+      "version": "6.3.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      }
+    },
+    "node_modules/nyc/node_modules/signal-exit": {
+      "version": "3.0.7",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
+      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/object-inspect": {
+      "version": "1.13.4",
+      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
+      "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/on-finished": {
+      "version": "2.4.1",
+      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
+      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ee-first": "1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
+    "node_modules/opener": {
+      "version": "1.5.2",
+      "resolved": "https://registry.npmjs.org/opener/-/opener-1.5.2.tgz",
+      "integrity": "sha512-ur5UIdyw5Y7yEj9wLzhqXiy6GZ3Mwx0yGI+5sMn2r0N0v3cKJvUmFH5yPP+WXh9e0xfyzyJX95D8l088DNFj7A==",
+      "dev": true,
+      "bin": {
+        "opener": "bin/opener-bin.js"
+      }
+    },
+    "node_modules/p-limit": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz",
+      "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "p-try": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/p-locate": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-4.1.0.tgz",
+      "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "p-limit": "^2.2.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/p-map": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/p-map/-/p-map-3.0.0.tgz",
+      "integrity": "sha512-d3qXVTF/s+W+CdJ5A29wywV2n8CQQYahlgz2bFiA+4eVNJbHJodPZ+/gXwPGh0bOqA+j8S+6+ckmvLGPk1QpxQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "aggregate-error": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/p-try": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/p-try/-/p-try-2.2.0.tgz",
+      "integrity": "sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/package-hash": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/package-hash/-/package-hash-4.0.0.tgz",
+      "integrity": "sha512-whdkPIooSu/bASggZ96BWVvZTRMOFxnyUG5PnTSGKoJE2gd5mbVNmR2Nj20QFzxYYgAXpoqC+AiXzl+UMRh7zQ==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "graceful-fs": "^4.1.15",
+        "hasha": "^5.0.0",
+        "lodash.flattendeep": "^4.4.0",
+        "release-zalgo": "^1.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/parseurl": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
+      "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/path-exists": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
+      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/path-is-absolute": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
+      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/path-key": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/picocolors": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
+      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/pkg-dir": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/pkg-dir/-/pkg-dir-4.2.0.tgz",
+      "integrity": "sha512-HRDzbaKjC+AOWVXxAU/x54COGeIv9eb+6CkDSQoNTt4XyWoIJvuPsXizxu/Fr23EiekbtZwmh1IcIG/l/a10GQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "find-up": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/playwright": {
+      "version": "1.60.0",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.60.0.tgz",
+      "integrity": "sha512-hheHdokM8cdqCb0lcE3s+zT4t4W+vvjpGxsZlDnikarzx8tSzMebh3UiFtgqwFwnTnjYQcsyMF8ei2mCO/tpeA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright-core": "1.60.0"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "fsevents": "2.3.2"
+      }
+    },
+    "node_modules/playwright-core": {
+      "version": "1.60.0",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.60.0.tgz",
+      "integrity": "sha512-9bW6zvX/m0lEbgTKJ6YppOKx8H3VOPBMOCFh2irXFOT4BbHgrx5hPjwJYLT40Lu+4qtD36qKc/Hn56StUW57IA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "playwright-core": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/portfinder": {
+      "version": "1.0.38",
+      "resolved": "https://registry.npmjs.org/portfinder/-/portfinder-1.0.38.tgz",
+      "integrity": "sha512-rEwq/ZHlJIKw++XtLAO8PPuOQA/zaPJOZJ37BVuN97nLpMJeuDVLVGRwbFoBgLudgdTMP2hdRJP++H+8QOA3vg==",
+      "dev": true,
+      "dependencies": {
+        "async": "^3.2.6",
+        "debug": "^4.3.6"
+      },
+      "engines": {
+        "node": ">= 10.12"
+      }
+    },
+    "node_modules/process-on-spawn": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/process-on-spawn/-/process-on-spawn-1.1.0.tgz",
+      "integrity": "sha512-JOnOPQ/8TZgjs1JIH/m9ni7FfimjNa/PRx7y/Wb5qdItsnhO0jE4AT7fC0HjC28DUQWDr50dwSYZLdRMlqDq3Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fromentries": "^1.2.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/qs": {
+      "version": "6.14.0",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.0.tgz",
+      "integrity": "sha512-YWWTjgABSKcvs/nWBi9PycY/JiPJqOD4JA6o9Sej2AtvSGarXxKC3OQSk4pAarbdQlKAh5D4FCQkJNkW+GAn3w==",
+      "dev": true,
+      "dependencies": {
+        "side-channel": "^1.1.0"
+      },
+      "engines": {
+        "node": ">=0.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/release-zalgo": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/release-zalgo/-/release-zalgo-1.0.0.tgz",
+      "integrity": "sha512-gUAyHVHPPC5wdqX/LG4LWtRYtgjxyX78oanFNTMMyFEfOqdC54s3eE82imuWKbOeqYht2CrNf64Qb8vgmmtZGA==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "es6-error": "^4.0.1"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/require-directory": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/require-directory/-/require-directory-2.1.1.tgz",
+      "integrity": "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/require-main-filename": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/require-main-filename/-/require-main-filename-2.0.0.tgz",
+      "integrity": "sha512-NKN5kMDylKuldxYLSUfrbo5Tuzh4hd+2E8NPPX02mZtn1VuREQToYe/ZdlJy+J3uCpfaiGF05e7B8W0iXbQHmg==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/requires-port": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/requires-port/-/requires-port-1.0.0.tgz",
+      "integrity": "sha512-KigOCHcocU3XODJxsu8i/j8T9tzT4adHiecwORRQ0ZZFcp7ahwXuRU1m+yuO90C5ZUyGeGfocHDI14M3L3yDAQ==",
+      "dev": true
+    },
+    "node_modules/resolve-from": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-5.0.0.tgz",
+      "integrity": "sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/rimraf": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-3.0.2.tgz",
+      "integrity": "sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA==",
+      "deprecated": "Rimraf versions prior to v4 are no longer supported",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "glob": "^7.1.3"
+      },
+      "bin": {
+        "rimraf": "bin.js"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/safe-buffer": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
+      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
+      "dev": true
+    },
+    "node_modules/safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "dev": true
+    },
+    "node_modules/secure-compare": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/secure-compare/-/secure-compare-3.0.1.tgz",
+      "integrity": "sha512-AckIIV90rPDcBcglUwXPF3kg0P0qmPsPXAj6BBEENQE1p5yA1xfmDJzfi1Tappj37Pv2mVbKpL3Z1T+Nn7k1Qw==",
+      "dev": true
+    },
+    "node_modules/semver": {
+      "version": "7.7.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
+      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/set-blocking": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/set-blocking/-/set-blocking-2.0.0.tgz",
+      "integrity": "sha512-KiKBS8AnWGEyLzofFfmvKwpdPzqiy16LvQfK3yv/fVH7Bj13/wl3JSR1J+rfgRE9q7xUJK4qvgS8raSOeLUehw==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/setprototypeof": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/shebang-command": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "shebang-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/side-channel": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
+      "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==",
+      "dev": true,
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.3",
+        "side-channel-list": "^1.0.0",
+        "side-channel-map": "^1.0.1",
+        "side-channel-weakmap": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-list": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.0.tgz",
+      "integrity": "sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA==",
+      "dev": true,
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-map": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
+      "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
+      "dev": true,
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-weakmap": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
+      "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
+      "dev": true,
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3",
+        "side-channel-map": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/signal-exit": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
+      "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
+      "dev": true,
+      "license": "ISC",
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/source-map": {
+      "version": "0.6.1",
+      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
+      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/spawn-wrap": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/spawn-wrap/-/spawn-wrap-2.0.0.tgz",
+      "integrity": "sha512-EeajNjfN9zMnULLwhZZQU3GWBoFNkbngTUPfaawT4RkMiviTxcX0qfhVbGey39mfctfDHkWtuecgQ8NJcyQWHg==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "foreground-child": "^2.0.0",
+        "is-windows": "^1.0.2",
+        "make-dir": "^3.0.0",
+        "rimraf": "^3.0.0",
+        "signal-exit": "^3.0.2",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/spawn-wrap/node_modules/foreground-child": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-2.0.0.tgz",
+      "integrity": "sha512-dCIq9FpEcyQyXKCkyzmlPTFNgrCzPudOe+mhvJU5zAtlBnGVy2yKxtfsxK2tQBThwq225jcvBjpw1Gr40uzZCA==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "cross-spawn": "^7.0.0",
+        "signal-exit": "^3.0.2"
+      },
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
+    "node_modules/spawn-wrap/node_modules/make-dir": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-3.1.0.tgz",
+      "integrity": "sha512-g3FeP20LNwhALb/6Cz6Dd4F2ngze0jz7tbzrD2wAV+o9FeNHe4rL+yK2md0J/fiSf1sa1ADhXqi5+oVwOM/eGw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "semver": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/spawn-wrap/node_modules/semver": {
+      "version": "6.3.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      }
+    },
+    "node_modules/spawn-wrap/node_modules/signal-exit": {
+      "version": "3.0.7",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
+      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/sprintf-js": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz",
+      "integrity": "sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==",
+      "dev": true,
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/statuses": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
+      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/string-width": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-bom": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/strip-bom/-/strip-bom-4.0.0.tgz",
+      "integrity": "sha512-3xurFv5tEgii33Zi8Jtp55wEIILR9eh34FAW00PZf+JnSsTmV/ioewSgQl97JHvgjoRGwPShsWm+IdrxB35d0w==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/test-exclude": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-6.0.0.tgz",
+      "integrity": "sha512-cAGWPIyOHU6zlmg88jwm7VRyXnMN7iV68OGAbYDk/Mh/xC/pzVPlQtY6ngoIH/5/tciuhGfvESU8GrHrcxD56w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "@istanbuljs/schema": "^0.1.2",
+        "glob": "^7.1.4",
+        "minimatch": "^3.0.4"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/toidentifier": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.6"
+      }
+    },
+    "node_modules/tsscmp": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/tsscmp/-/tsscmp-1.0.6.tgz",
+      "integrity": "sha512-LxhtAkPDTkVCMQjt2h6eBVY28KCjikZqZfMcC15YBeNjkgUpdCfBu5HoiOTDu86v6smE8yOjyEktJ8hlbANHQA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.6.x"
+      }
+    },
+    "node_modules/type-fest": {
+      "version": "0.8.1",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.8.1.tgz",
+      "integrity": "sha512-4dbzIzqvjtgiM5rw1k5rEHtBANKmdudhGyBEajN01fEyhaAIhsoKNy6y7+IN93IfpFtwY9iqi7kD+xwKhQsNJA==",
+      "dev": true,
+      "license": "(MIT OR CC0-1.0)",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/type-is": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.0.1.tgz",
+      "integrity": "sha512-OZs6gsjF4vMp32qrCbiVSkrFmXtG/AZhY3t0iAMrMBiAZyV9oALtXO8hsrHbMXF9x6L3grlFuwW2oAz7cav+Gw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "content-type": "^1.0.5",
+        "media-typer": "^1.1.0",
+        "mime-types": "^3.0.0"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/typedarray-to-buffer": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/typedarray-to-buffer/-/typedarray-to-buffer-3.1.5.tgz",
+      "integrity": "sha512-zdu8XMNEDepKKR+XYOXAVPtWui0ly0NtohUscw+UmaHiAWT8hrV1rr//H6V+0DvJ3OQ19S979M0laLfX8rm82Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "is-typedarray": "^1.0.0"
+      }
+    },
+    "node_modules/union": {
+      "version": "0.5.0",
+      "resolved": "https://registry.npmjs.org/union/-/union-0.5.0.tgz",
+      "integrity": "sha512-N6uOhuW6zO95P3Mel2I2zMsbsanvvtgn6jVqJv4vbVcz/JN0OkL9suomjQGmWtxJQXOCqUJvquc1sMeNz/IwlA==",
+      "dev": true,
+      "dependencies": {
+        "qs": "^6.4.0"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/update-browserslist-db": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
+      "integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/browserslist"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "escalade": "^3.2.0",
+        "picocolors": "^1.1.1"
+      },
+      "bin": {
+        "update-browserslist-db": "cli.js"
+      },
+      "peerDependencies": {
+        "browserslist": ">= 4.21.0"
+      }
+    },
+    "node_modules/url-join": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/url-join/-/url-join-4.0.1.tgz",
+      "integrity": "sha512-jk1+QP6ZJqyOiuEI9AEWQfju/nB2Pw466kbA0LEZljHwKeMgd9WrAEgEGxjPDD2+TNbbb37rTyhEfrCXfuKXnA==",
+      "dev": true
+    },
+    "node_modules/uuid": {
+      "version": "8.3.2",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
+      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "uuid": "dist/bin/uuid"
+      }
+    },
+    "node_modules/vary": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
+      "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/whatwg-encoding": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/whatwg-encoding/-/whatwg-encoding-2.0.0.tgz",
+      "integrity": "sha512-p41ogyeMUrw3jWclHWTQg1k05DSVXPLcVxRTYsXUk+ZooOCZLcoYgPZ/HL/D/N+uQPOtcp1me1WhBEaX02mhWg==",
+      "dev": true,
+      "dependencies": {
+        "iconv-lite": "0.6.3"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/which-module": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/which-module/-/which-module-2.0.1.tgz",
+      "integrity": "sha512-iBdZ57RDvnOR9AGBhML2vFZf7h8vmBjhoaZqODJBFWHVtKkDmKuHai3cx5PgVMrX5YDNp27AofYbAwctSS+vhQ==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/wrap-ansi": {
+      "version": "6.2.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-6.2.0.tgz",
+      "integrity": "sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^4.0.0",
+        "string-width": "^4.1.0",
+        "strip-ansi": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/write-file-atomic": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/write-file-atomic/-/write-file-atomic-3.0.3.tgz",
+      "integrity": "sha512-AvHcyZ5JnSfq3ioSyjrBkH9yW4m7Ayk8/9My/DD9onKeu/94fwrMocemO2QAJFAlnnDN+ZDS+ZjAR5ua1/PV/Q==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "imurmurhash": "^0.1.4",
+        "is-typedarray": "^1.0.0",
+        "signal-exit": "^3.0.2",
+        "typedarray-to-buffer": "^3.1.5"
+      }
+    },
+    "node_modules/write-file-atomic/node_modules/signal-exit": {
+      "version": "3.0.7",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
+      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/y18n": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/y18n/-/y18n-4.0.3.tgz",
+      "integrity": "sha512-JKhqTOwSrqNA1NY5lSztJ1GrBiUodLMmIZuLiDaMRJ+itFd+ABVE8XBjOvIWL+rSqNDC74LCSFmlb/U4UZ4hJQ==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/yallist": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
+      "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/yargs": {
+      "version": "15.4.1",
+      "resolved": "https://registry.npmjs.org/yargs/-/yargs-15.4.1.tgz",
+      "integrity": "sha512-aePbxDmcYW++PaqBsJ+HYUFwCdv4LVvdnhBy78E57PIor8/OVvhMrADFFEDh8DHDFRv/O9i3lPhsENjO7QX0+A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "cliui": "^6.0.0",
+        "decamelize": "^1.2.0",
+        "find-up": "^4.1.0",
+        "get-caller-file": "^2.0.1",
+        "require-directory": "^2.1.1",
+        "require-main-filename": "^2.0.0",
+        "set-blocking": "^2.0.0",
+        "string-width": "^4.2.0",
+        "which-module": "^2.0.0",
+        "y18n": "^4.0.0",
+        "yargs-parser": "^18.1.2"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/yargs-parser": {
+      "version": "18.1.3",
+      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-18.1.3.tgz",
+      "integrity": "sha512-o50j0JeToy/4K6OZcaQmW6lyXXKhq7csREXcDwk2omFPJEwUNOVtJKvmDr9EI1fAJZUyZcRF7kxGBWmRXudrCQ==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "camelcase": "^5.0.0",
+        "decamelize": "^1.2.0"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    }
+  }
+}
diff --git a/rca-tool/tests/package.json b/rca-tool/tests/package.json
new file mode 100644
index 0000000..ff7b4d0
--- /dev/null
+++ b/rca-tool/tests/package.json
@@ -0,0 +1,24 @@
+{
+  "name": "rca-tool-tests",
+  "version": "1.0.0",
+  "type": "module",
+  "description": "Tests for RCA Tool",
+  "scripts": {
+    "test": "playwright test --config=playwright.leptos.config.js",
+    "test:debug": "playwright test --config=playwright.leptos.config.js --debug",
+    "test:ui": "playwright test --config=playwright.leptos.config.js --ui",
+    "test:headed": "playwright test --config=playwright.leptos.config.js --headed",
+    "test:coverage": "bash instrument-coverage.sh && echo '\nOpen coverage-report-rust/html/index.html for Rust coverage report'",
+    "test:leptos": "playwright test --config=playwright.leptos.config.js",
+    "test:leptos:headed": "playwright test --config=playwright.leptos.config.js --headed",
+    "coverage:view": "npx monocart show-report coverage-report-leptos/index.html",
+    "serve": "http-server -p 8080"
+  },
+  "devDependencies": {
+    "@axe-core/playwright": "^4.11.0",
+    "@playwright/test": "^1.60.0",
+    "http-server": "^14.1.1",
+    "monocart-reporter": "^2.10.0",
+    "nyc": "^17.1.0"
+  }
+}
diff --git a/rca-tool/tests/packages.spec.js b/rca-tool/tests/packages.spec.js
new file mode 100644
index 0000000..66b0c5e
--- /dev/null
+++ b/rca-tool/tests/packages.spec.js
@@ -0,0 +1,162 @@
+/**
+ * @module tests/packages
+ * @description Playwright tests for {@link module:parsers/packages}.
+ *
+ * Validates raw package-list rendering for RPM-based distributions
+ * (`dnf_list_installed`, `yum_list_installed`), Debian-based
+ * distributions (`dpkg_-l`), zypper history, and dnf/yum logs.
+ */
+import { test, expect } from './coverage-fixture.js';
+import { uploadAndWaitForAnalysis, navigateToApp, fixturePath } from './test-helpers.js';
+
+test.describe('Packages Parser', () => {
+
+  test.beforeEach(async ({ page }, testInfo) => {
+    await navigateToApp(page, testInfo);
+    await expect(page.locator('h1')).toContainText('RCA Tool');
+  });
+
+  test('displays raw RPM package list from dnf_list_installed', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'sosreport-rpm-raw.tar.xz');
+    
+    // Should show Distribution section with package content
+    expect(resultHTML).toContain('Distribution');
+    
+    // Should display package names from dnf list
+    expect(resultHTML).toContain('GConf2');
+    expect(resultHTML).toContain('NetworkManager');
+    expect(resultHTML).toContain('PackageKit');
+    
+    // Should show package count in subsection header
+    expect(resultHTML).toMatch(/Packages \(\d+ RPM-based\)/i);
+  });
+
+  test('displays raw RPM package list from yum_list_installed', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'sosreport-yum-raw.tar.xz');
+    
+    // Should show Distribution section with package content
+    expect(resultHTML).toContain('Distribution');
+    
+    // Should display package names from yum list
+    expect(resultHTML).toContain('BladeLogic_RSCD_Agent');
+    expect(resultHTML).toContain('GConf2');
+    expect(resultHTML).toContain('NetworkManager');
+    
+    // Should show package count in subsection header
+    expect(resultHTML).toMatch(/Packages \(\d+ RPM-based\)/i);
+    
+    // Should handle yum plugin headers
+    expect(resultHTML).not.toContain('Loaded plugins');
+  });
+
+  test('displays raw DEB package list from dpkg_-l', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'sosreport-deb-raw.tar.xz');
+    
+    // Should show Distribution section with package content
+    expect(resultHTML).toContain('Distribution');
+    
+    // Should display package names from dpkg
+    expect(resultHTML).toContain('accountsservice');
+    expect(resultHTML).toContain('bash');
+    expect(resultHTML).toContain('systemd');
+    
+    // Should show package count in subsection header
+    expect(resultHTML).toMatch(/Packages \(\d+ Debian\/Ubuntu\)/i);
+  });
+
+  test('displays SUSE supportconfig rpm.txt with section parsing', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'sosreport-rpm-txt-scc.tar.xz');
+
+    // Should show Distribution section
+    expect(resultHTML).toContain('Distribution');
+
+    // Should display packages from the filtered section (between queryformat headers)
+    expect(resultHTML).toContain('cloud-netconfig-azure');
+    expect(resultHTML).toContain('resource-agents');
+    expect(resultHTML).toContain('fence-agents');
+    expect(resultHTML).toContain('kernel-default');
+
+    // Should show RPM-based package count
+    expect(resultHTML).toMatch(/Packages \(\d+ RPM-based\)/i);
+
+    // Should NOT include content from the SIGPGP section (after the second header)
+    expect(resultHTML).not.toContain('some-other-section-data');
+  });
+
+  test('validates RPM package versions from installed-rpms', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'sosreport-installed-rpms.tar.xz');
+
+    // Should show Distribution section
+    expect(resultHTML).toContain('Distribution');
+
+    // Should show version warnings for fence-agents (4.2.1 < 4.4 required)
+    expect(resultHTML).toContain('fence-agents');
+    expect(resultHTML).toContain('4.2.1');
+
+    // Should show problematic range warning for python3-azure-core (1.15.0 is in 1.9-1.22 range)
+    expect(resultHTML).toContain('python3-azure-core');
+    expect(resultHTML).toContain('1.15.0');
+
+    // Should flag missing package: cloud-netconfig-azure not in the RPM list
+    expect(resultHTML).toContain('cloud-netconfig-azure');
+    expect(resultHTML).toContain('not found');
+
+    // Found packages should be listed
+    expect(resultHTML).toContain('python3-azure-mgmt-compute');
+    expect(resultHTML).toContain('python3-azure-identity');
+    expect(resultHTML).toContain('resource-agents');
+  });
+
+  test('detects packages from zypper history in InspectIaaSDisk SUSE cluster ZIP', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('test-inspect-iaas-disk-cluster.zip'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('InspectIaaSDisk Results');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+
+    // Should show Distribution/Packages section with RPM-based label
+    expect(content).toMatch(/Packages \(\d+ RPM-based\)/i);
+
+    // Should detect Azure-critical packages from zypper history
+    expect(content).toContain('fence-agents-azure-arm');
+    expect(content).toContain('resource-agents');
+    expect(content).toContain('cloud-netconfig-azure');
+    expect(content).toContain('python3-azure-mgmt-compute');
+
+    // python3-azure-core 1.22.1 is in problematic range (1.9-1.22) — should trigger warning
+    expect(content).toContain('python3-azure-core');
+    expect(content).toContain('1.22.1');
+  });
+
+  test('detects packages from dnf.log in InspectIaaSDisk RHEL ZIP', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('test-inspect-iaas-disk.zip'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('InspectIaaSDisk Results');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+
+    // Should show Distribution/Packages section
+    expect(content).toMatch(/Packages \(\d+ RPM-based\)/i);
+
+    // Should detect packages from dnf.log install records
+    expect(content).toContain('fence-agents-azure-arm');
+    expect(content).toContain('resource-agents');
+    expect(content).toContain('python3-azure-mgmt-compute');
+    expect(content).toContain('python3-azure-identity');
+    expect(content).toContain('python3-azure-core');
+  });
+});
diff --git a/rca-tool/tests/playwright.leptos.config.js b/rca-tool/tests/playwright.leptos.config.js
new file mode 100644
index 0000000..8d77d0a
--- /dev/null
+++ b/rca-tool/tests/playwright.leptos.config.js
@@ -0,0 +1,77 @@
+import { defineConfig, devices } from '@playwright/test';
+
+const localTestPort = process.env.LEPTOS_TEST_PORT || '4180';
+const localBaseUrl = process.env.BASE_URL || `http://localhost:${localTestPort}`;
+
+export default defineConfig({
+  testDir: './',
+  // Regenerate the (gitignored) HANA zip fixtures from the `fixtures-gen` Rust
+  // crate before the suite runs, so the round-trip-validated fixtures are
+  // always present in CI without committing binaries.
+  globalSetup: './hana-fixtures.global-setup.js',
+  fullyParallel: true,
+  forbidOnly: !!process.env.CI,
+  retries: 0,
+  timeout: 10_000,
+  workers: process.env.CI ? 1 : 4,
+  reporter: [
+    ['html', { outputFolder: 'playwright-report-leptos', open: 'never' }],
+    ['junit', { outputFile: 'playwright-report-leptos/junit.xml' }],
+    ['list'],
+    ['monocart-reporter', {
+      name: 'RCA Tool Leptos Coverage Report',
+      outputFile: './coverage-report-leptos/index.html',
+      coverage: {
+        reports: [
+          ['v8', { outputFile: 'coverage-report-leptos/v8/index.html' }],
+          ['console-details'],
+        ],
+        entryFilter: (entry) => {
+          if (((entry.url.includes('/web-leptos/dist/')
+              || entry.url.startsWith(`${localBaseUrl}/`))
+              && !entry.url.includes('node_modules'))) {
+            return true;
+          }
+          if (entry.url.startsWith('file://') && entry.url.includes('/src/')) {
+            return true;
+          }
+          return false;
+        },
+        sourceFilter: (sourcePath) => {
+          return !sourcePath.includes('node_modules')
+            && !sourcePath.includes('docs/');
+        },
+      }
+    }]
+  ],
+  use: {
+    baseURL: localBaseUrl,
+    // Retries are disabled; keep traces for failing tests to diagnose CI-only issues.
+    trace: 'retain-on-failure',
+    screenshot: 'only-on-failure',
+  },
+
+  projects: [
+    {
+      name: 'local-leptos',
+      use: {
+        ...devices['Desktop Edge'],
+        channel: 'msedge',
+      },
+    },
+    {
+      name: 'deployed-leptos',
+      use: {
+        ...devices['Desktop Edge'],
+        channel: 'msedge',
+        baseURL: (process.env.DEPLOYED_URL || 'https://fede2cr.github.io/azure-support-scripts').replace(/\/?$/, '/'),
+      },
+    },
+  ],
+
+  webServer: (process.env.BASE_URL || process.env.DEPLOYED_URL) ? undefined : {
+    command: `cd .. && npx http-server web-leptos/dist -p ${localTestPort} -c-1`,
+    port: Number(localTestPort),
+    reuseExistingServer: !process.env.CI,
+  },
+});
diff --git a/rca-tool/tests/services.spec.js b/rca-tool/tests/services.spec.js
new file mode 100644
index 0000000..f987ec7
--- /dev/null
+++ b/rca-tool/tests/services.spec.js
@@ -0,0 +1,112 @@
+/**
+ * @module tests/services
+ * @description Playwright tests for {@link module:parsers/services}.
+ *
+ * Covers antivirus detection (Falcon Sensor, Microsoft Defender),
+ * Illumio and Trend Micro Deep Security identification, Azure Site
+ * Recovery (`involflt`) module and runtime version parsing, and DLM
+ * service-enabled detection with documentation links.
+ */
+import { test, expect } from './coverage-fixture.js';
+import { uploadAndWaitForAnalysis, navigateToApp } from './test-helpers.js';
+
+test.describe('Services Parsers', () => {
+
+  test.beforeEach(async ({ page }, testInfo) => {
+    await navigateToApp(page, testInfo);
+    await expect(page.locator('h1')).toContainText('RCA Tool');
+  });
+
+  test('detects antivirus software', async ({ page }) => {
+    const result = await uploadAndWaitForAnalysis(page, 'scc_test-antivirus.tar.xz');
+
+    // The section title always contains "Antivirus", so assert on actual
+    // security-software detection instead of the generic heading text.
+    const hasAntivirus = /Falcon Sensor|Microsoft Defender/i.test(result);
+    expect(hasAntivirus, result).toBeTruthy();
+
+    // The fixture includes SAP exclusion guidance/config, so the rendered
+    // output should mention SAP exclusions.
+    expect(result).toMatch(/SAP.*exclusion/i);
+  });
+
+  test('detects Illumio security software', async ({ page }) => {
+    const result = await uploadAndWaitForAnalysis(page, 'scc_test-illumio.tar.xz');
+    
+    // Should detect Illumio
+    expect(result).toContain('Illumio');
+    
+    // Should show SAP exclusions message
+    expect(result).toMatch(/SAP.*exclusion/i);
+  });
+
+  test('detects Trend Micro Deep Security', async ({ page }) => {
+    const result = await uploadAndWaitForAnalysis(page, 'scc_test-trendmicro.tar.xz');
+    
+    // Should detect Trend Micro
+    expect(result).toContain('Trend Micro');
+    
+    // Should show SAP exclusions message
+    expect(result).toMatch(/SAP.*exclusion/i);
+  });
+
+  test('detects Azure Site Recovery (involflt) service', async ({ page }) => {
+    const result = await uploadAndWaitForAnalysis(page, 'scc_test-asr.tar.xz');
+    
+    // Should detect Azure Site Recovery
+    expect(result).toContain('Azure Site Recovery');
+    expect(result).toContain('involflt');
+  });
+
+  test('detects involflt module version from modinfo', async ({ page }) => {
+    const result = await uploadAndWaitForAnalysis(page, 'scc_test-asr.tar.xz');
+    
+    // Should detect involflt version information
+    expect(result).toContain('InMage Filter Driver');
+    expect(result).toContain('Build Version');
+    
+    // Should show loaded status
+    expect(result).toMatch(/Loaded|Not Loaded/);
+  });
+
+  test('detects involflt runtime version from kernel logs', async ({ page }) => {
+    const result = await uploadAndWaitForAnalysis(page, 'scc_test-asr.tar.xz');
+    
+    // Should detect runtime version from kernel messages
+    if (result.includes('Runtime Version')) {
+      expect(result).toMatch(/Runtime Version:.*\d+\.\d+\.\d+\.\d+/);
+    }
+  });
+
+  test('detects DLM service enabled', async ({ page }) => {
+    const result = await uploadAndWaitForAnalysis(page, 'scc_test-dlm-service.tar.xz');
+    
+    // Should detect DLM service
+    expect(result).toContain('DLM Service');
+    expect(result).toContain('Cluster Services');
+    
+    // Should show error message and documentation link
+    expect(result).toMatch(/DLM.*enabled/i);
+    expect(result).toContain('https://access.redhat.com/solutions/878023');
+  });
+
+  test('detects Azure VM Extensions from InspectIaaSDisk ZIP', async ({ page }) => {
+    const result = await uploadAndWaitForAnalysis(page, 'test-inspect-iaas-disk.zip');
+
+    // Should show Azure VM Extensions section with 4 extensions
+    expect(result).toContain('Azure VM Extensions');
+
+    // Should detect Defender as NotReady
+    expect(result).toContain('Microsoft Defender for Endpoint');
+    expect(result).toMatch(/NotReady/);
+
+    // Should detect healthy extensions
+    expect(result).toContain('Azure Backup');
+    expect(result).toContain('Azure Update Manager');
+    expect(result).toContain('Run Command');
+    expect(result).toContain('Ready');
+
+    // Should show the not-ready warning badge
+    expect(result).toMatch(/not ready/i);
+  });
+});
diff --git a/rca-tool/tests/storage.spec.js b/rca-tool/tests/storage.spec.js
new file mode 100644
index 0000000..2648fe0
--- /dev/null
+++ b/rca-tool/tests/storage.spec.js
@@ -0,0 +1,161 @@
+/**
+ * @module tests/storage
+ * @description Playwright tests for {@link module:parsers/storage}.
+ *
+ * Tests UUID-mismatch detection between `/etc/fstab` and block
+ * devices, LVM configuration parsing from both SCC and sosreport
+ * formats, including multi-file accumulation for separate
+ * pvs/vgs/lvs files.
+ */
+import { test, expect } from './coverage-fixture.js';
+import { uploadAndWaitForAnalysis, getResultText, navigateToApp } from './test-helpers.js';
+
+test.describe('Storage Parsers', () => {
+
+  test.beforeEach(async ({ page }, testInfo) => {
+    await navigateToApp(page, testInfo);
+    await expect(page.locator('h1')).toContainText('RCA Tool');
+  });
+
+  test('detects and displays LVM configuration from SCC', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-lvm.tar.xz');
+    
+    // Should display LVM Configuration section
+    expect(resultHTML).toContain('LVM Configuration');
+    
+    // Should show Physical Volumes
+    expect(resultHTML).toContain('Physical Volumes');
+    expect(resultHTML).toContain('/dev/sda2');
+    expect(resultHTML).toContain('/dev/sdb1');
+    
+    // Should show Volume Groups
+    expect(resultHTML).toContain('Volume Groups');
+    expect(resultHTML).toContain('rootvg');
+    expect(resultHTML).toContain('datavg');
+    
+    // Should show Logical Volumes
+    expect(resultHTML).toContain('Logical Volumes');
+    expect(resultHTML).toContain('root');
+    expect(resultHTML).toContain('swap');
+    expect(resultHTML).toContain('app');
+    expect(resultHTML).toContain('data');
+    expect(resultHTML).toContain('backup');
+  });
+
+  test('detects LVM configuration from sosreport verbose format', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-lvm-sosreport.tar.xz');
+
+    // Should display LVM Configuration section
+    expect(resultHTML).toContain('LVM Configuration');
+
+    // Should detect PVs from separate pvs file (filtering WARNING lines)
+    expect(resultHTML).toContain('Physical Volumes');
+    expect(resultHTML).toContain('/dev/sda2');
+    expect(resultHTML).toContain('/dev/sdc1');
+    expect(resultHTML).toContain('/dev/sdd1');
+
+    // Should detect VGs from separate verbose-format vgs file
+    expect(resultHTML).toContain('Volume Groups');
+    expect(resultHTML).toContain('rootvg');
+    expect(resultHTML).toContain('vggridhome');
+    expect(resultHTML).toContain('vgoraclebip');
+
+    // Should detect LVs from separate lvs file
+    expect(resultHTML).toContain('Logical Volumes');
+    expect(resultHTML).toContain('crashlv');
+    expect(resultHTML).toContain('rootlv');
+    expect(resultHTML).toContain('lvgridhome');
+    expect(resultHTML).toContain('lvoraclebip');
+  });
+
+  test('detects UUID mismatches between fstab and block devices', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-block-devices-mismatch.tar.xz');
+    
+    // Should display storage correlation section
+    expect(resultHTML).toMatch(/Storage Correlation|UUID|fstab/i);
+    
+    // Should show error for UUIDs in fstab that don't exist on disk
+    expect(resultHTML).toContain('OLD-UUID-3333');
+    expect(resultHTML).toContain('MISSING-UUID-9999');
+    
+    // Should show warnings for filesystem type mismatches
+    // fstab says ext4 but disk has xfs for UUID 66666666-6666-6666-6666-666666666666
+    expect(resultHTML).toMatch(/66666666.*type.*mismatch|mismatch.*66666666|ext4.*xfs|xfs.*ext4/i);
+    
+    // Should have error badge or indicator in summary
+    const resultText = await getResultText(page);
+    expect(resultText).toMatch(/\[X\].*UUID|UUID.*error|error.*UUID/i);
+  });
+
+  test('detects block devices from InspectIaaSDisk results.txt and correlates with fstab', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'test-inspect-iaas-disk-storage.zip');
+
+    // Should parse the Filesystem Status section from results.txt
+    // and build a UUID map that enables fstab correlation
+
+    // Should display storage correlation section
+    expect(resultHTML).toMatch(/Storage Correlation|UUID|fstab/i);
+
+    // UUIDs present in results.txt should be detected and matched
+    expect(resultHTML).toContain('11111111-aaaa-bbbb-cccc-111111111111');
+
+    // Missing UUID from fstab (OLD-UUID-DEAD) should generate an error
+    expect(resultHTML).toContain('OLD-UUID-DEAD');
+
+    // Missing UUID (GONE-UUID) should also be flagged
+    expect(resultHTML).toContain('GONE-UUID-0000');
+
+    // Should have error badge for UUID not found
+    const resultText = await getResultText(page);
+    expect(resultText).toMatch(/\[X\].*UUID|UUID.*error|error.*UUID/i);
+  });
+
+  test('detects block devices from sosreport lsblk/blkid and correlates with fstab', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-sosreport-storage.tar.xz');
+
+    // Should display storage correlation section
+    expect(resultHTML).toMatch(/Storage Correlation|UUID|fstab/i);
+
+    // UUIDs present in lsblk/blkid should be detected
+    expect(resultHTML).toContain('aaaa1111-1111-1111-1111-aaaaaaaaaaaa');
+
+    // UUID that doesn't exist on disk (DEAD0000) should generate error
+    expect(resultHTML).toContain('DEAD0000');
+
+    // fstype mismatch: fstab says ext4, disk (sdc1) has xfs for UUID 5678ef01
+    expect(resultHTML).toMatch(/5678ef01.*type.*mismatch|mismatch.*5678ef01|ext4.*xfs|xfs.*ext4/i);
+
+    // Should have error badge for UUID not found
+    const resultText = await getResultText(page);
+    expect(resultText).toMatch(/\[X\].*UUID|UUID.*error|error.*UUID/i);
+  });
+
+  test('detects mtab entries and highlights mounts not in fstab', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-mtab-comparison.tar.xz');
+
+    // Should show the mtab section
+    expect(resultHTML).toContain('Mounted Filesystems');
+    expect(resultHTML).toContain('/etc/mtab');
+
+    // Extra mounts NOT in fstab should be flagged
+    expect(resultHTML).toContain('/data');
+    expect(resultHTML).toContain('/sapmnt');
+    expect(resultHTML).toContain('/hana/data');
+    expect(resultHTML).toContain('/hana/log');
+
+    // Should show "not in fstab" badge
+    expect(resultHTML).toMatch(/not in fstab/i);
+
+    // Virtual filesystems (sysfs, proc, tmpfs, devtmpfs) should NOT appear as extra mounts
+    const resultText = await getResultText(page);
+    // The extra mounts table should not contain virtual fs entries
+    expect(resultHTML).not.toMatch(/Hand-mounted.*\/sys\b/);
+    expect(resultHTML).not.toMatch(/Hand-mounted.*\/proc\b/);
+
+    // Should show raw mtab content
+    expect(resultHTML).toContain('Show raw /etc/mtab');
+
+    // SAP/HANA mounts should be identified as likely cluster-managed
+    expect(resultHTML).toMatch(/cluster-managed/i);
+  });
+});
diff --git a/rca-tool/tests/test-helpers.js b/rca-tool/tests/test-helpers.js
new file mode 100644
index 0000000..6e733fe
--- /dev/null
+++ b/rca-tool/tests/test-helpers.js
@@ -0,0 +1,139 @@
+/**
+ * @module tests/test-helpers
+ * @description Shared Playwright test utilities for the RCA Tool test suite.
+ *
+ * Provides reusable helper functions that eliminate boilerplate across all
+ * spec files.  Every helper is designed for both the `local` project
+ * (http-server on port 8080) and the `deployed` project (GitHub Pages).
+ *
+ * ### Exported helpers
+ *
+ * | Function | Purpose |
+ * |----------|--------|
+ * | {@link uploadAndWaitForAnalysis} | Upload a fixture file and return the rendered `#output` HTML |
+ * | {@link getResultText} | Return the plain-text content of `#output` |
+ * | {@link isSapDetectedFromResult} | Check whether SAP indicators were rendered |
+ * | {@link fixturePath} | Resolve an absolute path to a file inside `tests/fixtures/` |
+ * | {@link navigateToApp} | Navigate to the app root, respecting the active Playwright project |
+ */
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __fixturesDir = path.join(path.dirname(fileURLToPath(import.meta.url)), 'fixtures');
+
+/**
+ * Upload a fixture archive and wait for the analysis to render.
+ *
+ * @async
+ * @param {Object} page - Playwright page object.
+ * @param {string} filename - Name of the fixture file inside `tests/fixtures/`.
+ * @returns {Promise<string>} The inner HTML of the `#output` element.
+ */
+export async function uploadAndWaitForAnalysis(page, filename) {
+  const filePath = path.join(__fixturesDir, filename);
+  
+  // Upload file
+  const fileInput = await page.locator('input[type="file"]');
+  await fileInput.setInputFiles(filePath);
+  
+  // Wait for the final results view rather than the transient progress view.
+  // On slower CI runners, `#output.innerHTML.length > 100` can become true
+  // while the file is still being analysed, which makes the tests flaky.
+  await page.waitForFunction((expectedFilename) => {
+    const output = document.getElementById('output');
+    if (!output) return false;
+
+    const header = output.querySelector('.analysis-header h2');
+    const button = output.querySelector('.analysis-header button');
+    const progress = output.querySelector('.progress-container');
+    const results = output.querySelector('.analysis-results');
+
+    const headerText = header?.textContent || '';
+    const buttonText = button?.textContent || '';
+
+    return headerText.includes(expectedFilename)
+      && buttonText.includes('Analyse another file')
+      && !progress
+      && !!results;
+  }, filename, { timeout: 60000 });
+
+  // Give the DOM a brief moment to settle before snapshotting the HTML.
+  await page.waitForTimeout(100);
+
+  // Get the analysis result HTML
+  const resultHTML = await page.locator('#output').innerHTML();
+  
+  return resultHTML;
+}
+
+/**
+ * Extract the plain-text content of the result panel.
+ *
+ * @async
+ * @param {Object} page - Playwright page object.
+ * @returns {Promise<string>} Plain text of `#output`.
+ */
+export async function getResultText(page) {
+  return await page.locator('#output').textContent();
+}
+
+/**
+ * Check whether the rendered HTML contains SAP detection indicators.
+ *
+ * @param {string} resultHtml - The inner HTML returned by {@link uploadAndWaitForAnalysis}.
+ * @returns {boolean} `true` when SAP Application Detection with indicators is present.
+ */
+export function isSapDetectedFromResult(resultHtml) {
+  if (!resultHtml) return false;
+  return resultHtml.includes('SAP Application Detection') && resultHtml.includes('(indicators found)');
+}
+
+/**
+ * Resolve the absolute path to a fixture file.
+ *
+ * @param {string} filename - Fixture file name (e.g. `'scc_test-azure-vm.tar.xz'`).
+ * @returns {string} Absolute file-system path.
+ */
+export function fixturePath(filename) {
+  return path.join(__fixturesDir, filename);
+}
+
+/**
+ * Navigate to the RCA Tool app root, always preferring the Leptos UI for
+ * local runs and using the deployed site root in hosted environments.
+ *
+ * @async
+ * @param {Object} page - Playwright page object.
+ * @param {Object} testInfo - Playwright test info.
+ */
+export async function navigateToApp(page, testInfo) {
+  const projectName = testInfo.project.name || '';
+  const isDeployed = projectName === 'deployed' || projectName.includes('deployed');
+  const cacheBuster = isDeployed && process.env.CACHE_BUSTER
+    ? `?cb=${encodeURIComponent(process.env.CACHE_BUSTER)}`
+    : '';
+
+  if (isDeployed) {
+    await page.goto(`./${cacheBuster}`);
+    return;
+  }
+
+  // Local runs may serve the app at '/' (current) or '/web-leptos/dist/' (legacy).
+  // Try root first and fall back for compatibility.
+  const localCandidates = [
+    `/${cacheBuster}`,
+    `/web-leptos/dist/${cacheBuster}`
+  ];
+
+  let lastError;
+  for (const candidate of localCandidates) {
+    try {
+      await page.goto(candidate);
+      return;
+    } catch (error) {
+      lastError = error;
+    }
+  }
+
+  throw lastError;
+}
diff --git a/rca-tool/tests/ui.spec.js b/rca-tool/tests/ui.spec.js
new file mode 100644
index 0000000..8d049a2
--- /dev/null
+++ b/rca-tool/tests/ui.spec.js
@@ -0,0 +1,105 @@
+/**
+ * @module tests/ui
+ * @description Playwright tests for general UI behaviour and error handling.
+ *
+ * Verifies page loading, dark/colorblind/light theme cycling,
+ * graceful handling of invalid file uploads, and resilience against
+ * corrupted or truncated `tar.xz` archives.
+ */
+import { test, expect } from './coverage-fixture.js';
+import { uploadAndWaitForAnalysis, navigateToApp, fixturePath } from './test-helpers.js';
+
+test.describe('UI and Error Handling', () => {
+
+  test.beforeEach(async ({ page }, testInfo) => {
+    await navigateToApp(page, testInfo);
+    await expect(page.locator('h1')).toContainText('RCA Tool');
+  });
+
+  test('page loads correctly', async ({ page }) => {
+    await expect(page.locator('#drop-zone')).toBeVisible();
+    await expect(page.locator('#drop-zone')).toContainText('Drag and Drop Support File');
+  });
+
+  test('theme toggle cycles through all modes', async ({ page }) => {
+    // Check initial state (dark mode by default)
+    const body = page.locator('body');
+    await expect(body).toHaveClass(/dark-mode/);
+    
+    // Click once: dark -> colorblind
+    await page.click('#theme-toggle');
+    await expect(body).toHaveClass(/colorblind-mode/);
+    await expect(body).not.toHaveClass(/dark-mode/);
+    
+    // Click twice: colorblind -> light
+    await page.click('#theme-toggle');
+    await expect(body).not.toHaveClass(/dark-mode/);
+    await expect(body).not.toHaveClass(/colorblind-mode/);
+    
+    // Click thrice: light -> dark
+    await page.click('#theme-toggle');
+    await expect(body).toHaveClass(/dark-mode/);
+    await expect(body).not.toHaveClass(/colorblind-mode/);
+  });
+
+  test('handles invalid file format gracefully', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    
+    // Create a dummy text file
+    const buffer = Buffer.from('This is not a tar file');
+    await fileInput.setInputFiles({
+      name: 'invalid.txt',
+      mimeType: 'text/plain',
+      buffer: buffer,
+    });
+    
+    // Should show error or reject the file
+    // Wait for potential error message
+    await page.waitForTimeout(2000);
+    
+    // Result should either be empty or contain error message
+    const result = await page.locator('#output').textContent();
+    const isEmpty = result.trim().length === 0;
+    const hasError = result.includes('error') || result.includes('invalid');
+    
+    expect(isEmpty || hasError).toBeTruthy();
+  });
+
+  test('handles corrupted/truncated tar.xz file gracefully', async ({ page }) => {
+    // Capture console logs to verify error handling
+    const logs = [];
+    page.on('console', msg => logs.push(msg.text()));
+    
+    const fileInput = await page.locator('input[type="file"]');
+    
+    // Use corrupted fixture
+    await fileInput.setInputFiles(fixturePath('scc_test-corrupted.tar.xz'));
+    
+    // Wait for processing attempt
+    await page.waitForTimeout(5000);
+    
+    // Check that page didn't crash and shows some content
+    const content = await page.locator('#output').textContent();
+    
+    // Should not be completely empty
+    expect(content.length).toBeGreaterThan(0);
+    
+    // Should indicate corruption or error
+    const hasCorruptionIndicator = 
+      content.toLowerCase().includes('corrupt') ||
+      content.toLowerCase().includes('error') ||
+      content.toLowerCase().includes('fail') ||
+      content.toLowerCase().includes('incomplete');
+    
+    expect(hasCorruptionIndicator).toBeTruthy();
+    
+    // Should show some progress (blocks/bytes processed)
+    const contentLower = content.toLowerCase();
+    const showsProgress = 
+      contentLower.includes('block') ||
+      contentLower.includes('byte') ||
+      contentLower.includes('decompressed');
+    
+    expect(showsProgress).toBeTruthy();
+  });
+});
diff --git a/rca-tool/tests/unix.spec.js b/rca-tool/tests/unix.spec.js
new file mode 100644
index 0000000..3b65ca5
--- /dev/null
+++ b/rca-tool/tests/unix.spec.js
@@ -0,0 +1,814 @@
+/**
+ * @module tests/unix
+ * @description Playwright tests for {@link module:parsers/unix}.
+ *
+ * Covers `crm_report` sysinfo distribution detection, kernel-tuning
+ * parameter validation and warnings, huge-pages configuration and
+ * SAP recommendations, fstab rendering, Azure network-tuning
+ * optimisation (correct, warnings, optional, complete, whitespace),
+ * chronyd time-sync service detection, and InspectIaaSDisk integration
+ * for both RHEL and SLES archives (SLES 15 SP6 with SAP HANA mounts).
+ */
+import { test, expect } from './coverage-fixture.js';
+import { uploadAndWaitForAnalysis, getResultText, navigateToApp, fixturePath } from './test-helpers.js';
+
+test.describe('Unix Parsers', () => {
+
+  test.beforeEach(async ({ page }, testInfo) => {
+    await navigateToApp(page, testInfo);
+    await expect(page.locator('h1')).toContainText('RCA Tool');
+  });
+
+  test('detects distribution from crm_report sysinfo.txt', async ({ page }) => {
+    await page.setInputFiles(
+      'input[type="file"]',
+      fixturePath('scc_test-crm-report-sysinfo.tar.xz')
+    );
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('Azure VM Properties');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+    
+    // Should show in Azure VM Properties section
+    expect(content).toContain('Azure VM Properties');
+    // Should detect SLES 15 SP5 from sysinfo.txt
+    expect(content).toContain('SUSE Linux Enterprise Server 15 SP5');
+    // Should show under Operating System subsection
+    expect(content).toContain('Operating System');
+  });
+
+  test('analyzes kernel tuning with correct values', async ({ page }) => {
+    // Listen to console messages
+    page.on('console', msg => console.log('BROWSER:', msg.text()));
+    page.on('pageerror', err => console.error('PAGE ERROR:', err));
+    
+    const fileInput = await page.locator('input[type="file"]');
+    
+    await fileInput.setInputFiles(fixturePath('scc_test-kernel-tuning.tar.xz'));
+    
+    // Wait for analysis to complete - wait for specific content to appear
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('Kernel and System Parameters');
+      },
+      { timeout: 60000 }
+    );
+    
+    // Check that kernel tuning section exists
+    const content = await page.locator('#output').textContent();
+    expect(content).toContain('Kernel and System Parameters');
+    
+    // Should have parameters table
+    expect(content).toMatch(/vm\.dirty_bytes.*629145600/);
+    expect(content).toMatch(/vm\.dirty_background_bytes.*314572800/);
+    expect(content).toMatch(/vm\.swappiness.*10/);
+    
+    // Should not have warnings (all values are correct)
+    expect(content).not.toContain('Kernel Parameter Warnings');
+  });
+
+  test('detects kernel tuning warnings', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    
+    await fileInput.setInputFiles(fixturePath('scc_test-kernel-tuning.tar.xz'));
+    
+    // Wait for analysis to complete - wait for specific content to appear
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('Kernel and System Parameters');
+      },
+      { timeout: 60000 }
+    );
+    
+    // Check that kernel tuning section exists
+    const content = await page.locator('#output').textContent();
+    expect(content).toContain('Kernel and System Parameters');
+    
+    // Verify kernel parameters are displayed
+    expect(content).toContain('All Kernel Parameters');
+  });
+
+  test('detects and displays huge pages configuration', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    
+    // Use huge pages fixture
+    await fileInput.setInputFiles(fixturePath('scc_test-huge-pages.tar.xz'));
+    
+    // Wait for analysis to complete
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('Kernel and System Parameters');
+      },
+      { timeout: 60000 }
+    );
+    
+    // Check that huge pages section exists
+    const content = await page.locator('#output').textContent();
+    expect(content).toContain('Huge Pages Configuration');
+    
+    // Should detect static huge pages
+    expect(content).toContain('Static Huge Pages');
+    expect(content).toMatch(/2048.*pages/i);
+    expect(content).toMatch(/4096.*MB/i);
+    
+    // Should detect transparent huge pages
+    expect(content).toContain('Transparent Huge Pages');
+    expect(content).toMatch(/2048.*MB.*in use/i);
+    
+    // Should show kernel parameters
+    expect(content).toContain('vm.nr_hugepages');
+    expect(content).toMatch(/vm\.nr_hugepages.*2048/);
+  });
+
+  test('detects huge pages recommendations for SAP', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    // Use huge pages none fixture (has SAP indicator)
+    await fileInput.setInputFiles(fixturePath('scc_test-huge-pages-none.tar.xz'));
+    // Wait for analysis to complete
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('Kernel and System Parameters');
+      },
+      { timeout: 60000 }
+    );
+    // Check that huge pages configuration appears
+    const content = await page.locator('#output').textContent();
+    expect(content).toContain('Huge Pages Configuration');
+    expect(content).toContain('Static Huge Pages');
+    expect(content).toContain('Total Pages0');
+  });
+
+  test('detects and displays fstab configuration', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    
+    // Use fstab fixture
+    await fileInput.setInputFiles(fixturePath('scc_test-fstab.tar.xz'));
+    
+    // Wait for analysis to complete - fstab is now in the Storage section
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('Storage');
+      },
+      { timeout: 60000 }
+    );
+    
+    // Check that Storage section exists
+    const content = await page.locator('#output').textContent();
+    expect(content).toContain('Storage');
+    
+    // Verify fstab subsection exists
+    expect(content).toContain('Filesystem Table (/etc/fstab)');
+    
+    // Verify fstab content is displayed
+    expect(content).toContain('UUID=12345678-1234-1234-1234-123456789abc');
+    expect(content).toContain('/boot');
+    expect(content).toContain('/data');
+    expect(content).toContain('xfs');
+    expect(content).toContain('defaults');
+  });
+
+  test('detects correctly configured Azure Network tuning', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-azure-network-tuned.tar.xz');
+    
+    // Check that Kernel and System Parameters section exists
+    expect(resultHTML).toContain('Kernel and System Parameters');
+    
+    // Check for success message
+    expect(resultHTML).toContain('Kernel parameters tuned for Azure Network');
+    expect(resultHTML).toContain('[OK]');
+    
+    // Should link to documentation
+    expect(resultHTML).toContain('virtual-network-optimize-network-bandwidth');
+    
+    // Should not have warnings
+    expect(resultHTML).not.toContain('Parameters Need Adjustment');
+  });
+
+  test('detects Azure Network tuning parameters needing adjustment', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-azure-network-warnings.tar.xz');
+    
+    // Check that Kernel and System Parameters section exists
+    expect(resultHTML).toContain('Kernel and System Parameters');
+    
+    // Check for warnings message
+    expect(resultHTML).toContain('Azure Network Optimization - Parameters Need Adjustment');
+    expect(resultHTML).toContain('[!]');
+
+    // Check for specific parameters that need adjustment
+    expect(resultHTML).toContain('net.ipv4.tcp_congestion_control');
+    expect(resultHTML).toContain('net.core.busy_poll');
+    expect(resultHTML).toContain('net.core.rmem_max');
+    
+    // Check expected vs actual values shown
+    expect(resultHTML).toContain('Expected');
+    expect(resultHTML).toContain('Found');
+    expect(resultHTML).toContain('bbr'); // Expected value for tcp_congestion_control
+    expect(resultHTML).toContain('cubic'); // Actual value
+    
+    // Should link to documentation
+    expect(resultHTML).toContain('virtual-network-optimize-network-bandwidth');
+    
+    // Should show badge in summary
+    expect(resultHTML).toContain('Network tuning');
+  });
+
+  test('displays optional network tuning parameters', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-optional-network-tuning.tar.xz');
+    
+    // Check that Kernel and System Parameters section exists
+    expect(resultHTML).toContain('Kernel and System Parameters');
+    
+    // Check for Optional Network Tuning section (collapsed by default)
+    expect(resultHTML).toContain('Optional Network Tuning');
+    expect(resultHTML).toContain('informational');
+    
+    // Check for explanatory text
+    expect(resultHTML).toContain('optional recommendations');
+    expect(resultHTML).toContain('do not indicate configuration issues');
+    
+    // Check for specific optional parameters
+    expect(resultHTML).toContain('net.ipv4.tcp_timestamps');
+    expect(resultHTML).toContain('net.ipv4.tcp_tw_reuse');
+    expect(resultHTML).toContain('net.core.default_qdisc');
+    expect(resultHTML).toContain('net.core.somaxconn');
+    
+    // Check for status indicators
+    expect(resultHTML).toContain('[OK]'); // Some parameters match
+    expect(resultHTML).toContain('Recommended');
+    expect(resultHTML).toContain('Current');
+    
+    // Should link to documentation
+    expect(resultHTML).toContain('virtual-network-optimize-network-bandwidth');
+  });
+
+  test('displays complete network tuning configuration', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-complete-network-tuning.tar.xz');
+    
+    // Check that Kernel and System Parameters section exists
+    expect(resultHTML).toContain('Kernel and System Parameters');
+    
+    // Check for Azure Network success message
+    expect(resultHTML).toContain('Kernel parameters tuned for Azure Network');
+    expect(resultHTML).toContain('[OK]');
+    expect(resultHTML).toContain('Optional Network Tuning');
+    
+    // Should have all optional parameters showing as configured correctly
+    const content = await page.locator('#output').textContent();
+    
+    // Verify both Azure and optional parameters are present
+    expect(content).toContain('net.ipv4.tcp_congestion_control');
+    expect(content).toContain('net.ipv4.tcp_timestamps');
+    expect(content).toContain('net.core.default_qdisc');
+    
+    // Should not have any warnings
+    expect(resultHTML).not.toContain('Parameters Need Adjustment');
+    expect(resultHTML).not.toContain('danger-block');
+  });
+
+  test('detects incorrect Azure Network optimization parameters', async ({ page }) => {
+    // Use pre-created fixture with incorrect values
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-azure-network-warnings.tar.xz');
+    
+    // Check for Azure Network warnings
+    expect(resultHTML).toContain('Azure Network Optimization - Parameters Need Adjustment');
+    expect(resultHTML).toContain('[!]');
+
+    // Should show incorrect parameters
+    expect(resultHTML).toContain('net.ipv4.tcp_mem');
+    expect(resultHTML).toContain('net.core.rmem_default');
+    expect(resultHTML).toContain('net.ipv4.tcp_congestion_control');
+    
+    // Should show expected vs actual values
+    expect(resultHTML).toContain('67108864');
+    expect(resultHTML).toContain('33554432');
+    expect(resultHTML).toContain('bbr');
+    
+    // Should have documentation link
+    expect(resultHTML).toContain('virtual-network-optimize-network-bandwidth');
+  });
+
+  test('shows optional network tuning parameters as informational', async ({ page }) => {
+    // Use pre-created fixture with Azure correct but optional params different
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-optional-network-tuning.tar.xz');
+    
+    // Should show Azure Network as tuned (no warnings) - note: fixture doesn't have Azure params
+    // So we check for Optional Network Tuning section
+    expect(resultHTML).toContain('Optional Network Tuning');
+    expect(resultHTML).toContain('informational');
+    
+    // Expand the optional section and check content
+    const content = await page.locator('#output').textContent();
+    
+    // Should show optional parameters
+    expect(content).toContain('net.ipv4.tcp_timestamps');
+    expect(content).toContain('net.ipv4.tcp_tw_reuse');
+    expect(content).toContain('net.core.default_qdisc');
+    
+    // Should use checkmarks for matching params
+    expect(resultHTML).toContain('[OK]');
+    expect(resultHTML).toContain('informational only');
+    
+    // Should NOT have warning-block for optional params
+    const optionalSection = resultHTML.match(/Optional Network Tuning[\s\S]*?<\/details>/);
+    if (optionalSection) {
+      expect(optionalSection[0]).not.toContain('warning-block');
+      expect(optionalSection[0]).not.toContain('danger-block');
+    }
+  });
+
+  test('shows checkmarks for matching optional network parameters', async ({ page }) => {
+    // Use pre-created fixture with all parameters optimal
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-complete-network-tuning.tar.xz');
+    
+    // Azure Network should be tuned
+    expect(resultHTML).toContain('Kernel parameters tuned for Azure Network');
+    expect(resultHTML).toContain('[OK]');
+    expect(resultHTML).toContain('Optional Network Tuning');
+    
+    // All optional parameters should show checkmarks (matches = true)
+    const optionalSection = resultHTML.match(/Optional Network Tuning[\s\S]*?<\/details>/);
+    if (optionalSection) {
+      // Count checkmarks - should have at least 10 (one per optional parameter)
+      const checkmarkCount = (optionalSection[0].match(/\[OK\]/g) || []).length;
+      expect(checkmarkCount).toBeGreaterThanOrEqual(10);
+      
+      // Should have minimal or no info icons (all should match)
+      const infoIconCount = (optionalSection[0].match(/\[i\]/g) || []).length;
+      expect(infoIconCount).toBeLessThanOrEqual(0);
+    }
+  });
+
+  test('handles whitespace differences in network parameter values', async ({ page }) => {
+    // The azure-network-tuned fixture has tabs which tests whitespace normalization
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-azure-network-tuned.tar.xz');
+    
+    // Should recognize as correctly tuned despite whitespace differences
+    expect(resultHTML).toContain('Kernel parameters tuned for Azure Network');
+    expect(resultHTML).toContain('[OK]');
+    
+    // Should not show warnings
+    expect(resultHTML).not.toContain('Parameters Need Adjustment');
+  });
+
+  test('detects chronyd service status from SCC systemd-status.txt', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-timesync-chrony.tar.xz');
+    
+    // Should detect time sync service information
+    expect(resultHTML).toMatch(/Time.*Sync.*Service|timeSyncService/i);
+    
+    // Should show service is enabled and running
+    const resultText = await getResultText(page);
+    expect(resultText).toMatch(/chrony.*enabled|enabled.*chrony/i);
+    
+    // Should reference systemd-status.txt as the source
+    expect(resultHTML).toContain('systemd-status.txt');
+    expect(resultHTML).toMatch(/systemd-status\.txt.*chronyd|chronyd.*systemd-status\.txt/i);
+    
+    // Should NOT show error if chronyd is running properly
+    if (resultText.includes('chrony') && resultText.includes('enabled')) {
+      expect(resultText).not.toMatch(/chrony.*not running|service.*not.*running.*chrony/i);
+    }
+  });
+
+  // ── InspectIaaSDisk tests ──────────────────────────────────────────
+
+  test('parses InspectIaaSDisk results.txt from ZIP', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('test-inspect-iaas-disk.zip'));
+
+    // Wait for the InspectIaaSDisk Results section to render
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('InspectIaaSDisk Results');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+
+    // Should show the InspectIaaSDisk Results section
+    expect(content).toContain('InspectIaaSDisk Results');
+
+    // Request Info subsection
+    expect(content).toContain('md-testaccount.z45.blob.storage.azure.net');
+    expect(content).toContain('/testcontainer/abcd');
+    expect(content).toContain('117c4d70-8c42-44c5-9f3e-cddeb3eb4264');
+
+    // Inspection Metadata
+    expect(content).toContain('Red Hat Enterprise Linux release 8.8 (Ootpa)');
+    expect(content).toContain('rhel');
+
+    // Filesystem Status table
+    expect(content).toContain('Filesystem Status');
+    expect(content).toContain('/dev/sda1');
+    expect(content).toContain('xfs');
+    expect(content).toContain('vfat');
+
+    // Mount Results table
+    expect(content).toContain('Mount Results');
+    expect(content).toContain('/dev/rootvg/rootlv');
+    expect(content).toContain('SUCCEEDED');
+    expect(content).toContain('FAILED');
+  });
+
+  test('detects mount failures and shows warnings for InspectIaaSDisk', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('test-inspect-iaas-disk.zip'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('InspectIaaSDisk Results');
+      },
+      { timeout: 60000 }
+    );
+
+    const resultHTML = await page.locator('#output').innerHTML();
+
+    // Should show mount failure warning
+    expect(resultHTML).toContain('Mount failed');
+    expect(resultHTML).toContain('/dev/disk/cloud/azure_resource-part1');
+    expect(resultHTML).toContain('/mnt');
+
+    // Section should open with danger styling when mounts failed
+    expect(resultHTML).toContain('danger');
+  });
+
+  test('detects OS from redhat-release in InspectIaaSDisk ZIP', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('test-inspect-iaas-disk.zip'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('InspectIaaSDisk Results');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+
+    // Should detect RHEL 8.8 from device_0/etc/redhat-release
+    expect(content).toContain('Red Hat Enterprise Linux');
+    expect(content).toContain('8.8');
+  });
+
+  test('parses fstab from InspectIaaSDisk ZIP', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('test-inspect-iaas-disk.zip'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('InspectIaaSDisk Results');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+
+    // Should detect fstab entries from device_0/etc/fstab
+    expect(content).toContain('/dev/mapper/rootvg-rootlv');
+    expect(content).toContain('/boot');
+    expect(content).toContain('/boot/efi');
+    expect(content).toContain('azure_resource-part1');
+  });
+
+  // ── InspectIaaSDisk SLES tests ─────────────────────────────────────
+
+  test('parses InspectIaaSDisk results.txt from SLES ZIP', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('test-inspect-iaas-disk-sles.zip'));
+
+    // Wait for the InspectIaaSDisk Results section to render
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('InspectIaaSDisk Results');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+
+    // Should show the InspectIaaSDisk Results section
+    expect(content).toContain('InspectIaaSDisk Results');
+
+    // Request Info subsection
+    expect(content).toContain('md-djzwkqttxnxb.z50.blob.storage.azure.net');
+    expect(content).toContain('/jhfcb3s4xnxv/abcd');
+    expect(content).toContain('fc5d80d2-86aa-4b1f-a601-1d59ae66eba7');
+    expect(content).toContain('1.57.5');
+
+    // Inspection Metadata — SLES distribution
+    expect(content).toContain('SUSE Linux Enterprise Server 15 SP6');
+    expect(content).toContain('sles');
+
+    // Filesystem Status table
+    expect(content).toContain('Filesystem Status');
+    expect(content).toContain('/dev/sda1');
+    expect(content).toContain('/dev/sda4');
+    expect(content).toContain('xfs');
+    expect(content).toContain('vfat');
+
+    // Mount Results table
+    expect(content).toContain('Mount Results');
+    expect(content).toContain('/dev/sda4');
+    expect(content).toContain('SUCCEEDED');
+    expect(content).toContain('FAILED');
+  });
+
+  test('detects mount failures and shows warnings for SLES InspectIaaSDisk', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('test-inspect-iaas-disk-sles.zip'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('InspectIaaSDisk Results');
+      },
+      { timeout: 60000 }
+    );
+
+    const resultHTML = await page.locator('#output').innerHTML();
+
+    // Should show mount failure warning for /mnt
+    expect(resultHTML).toContain('Mount failed');
+    expect(resultHTML).toContain('/dev/disk/cloud/azure_resource-part1');
+    expect(resultHTML).toContain('/mnt');
+
+    // Section should open with danger styling when mounts failed
+    expect(resultHTML).toContain('danger');
+  });
+
+  test('detects SLES OS from os-release in InspectIaaSDisk ZIP', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('test-inspect-iaas-disk-sles.zip'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('InspectIaaSDisk Results');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+
+    // Should detect SLES 15 SP6 from device_0/etc/os-release
+    expect(content).toContain('SUSE Linux Enterprise Server 15 SP6');
+    expect(content).toContain('Operating System');
+  });
+
+  test('parses fstab with HANA mounts from SLES InspectIaaSDisk ZIP', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('test-inspect-iaas-disk-sles.zip'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('InspectIaaSDisk Results');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+
+    // Should detect fstab entries including SAP HANA mount points
+    expect(content).toContain('/boot');
+    expect(content).toContain('/boot/efi');
+    expect(content).toContain('/hana/data');
+    expect(content).toContain('/hana/log');
+    expect(content).toContain('/hana/shared');
+    expect(content).toContain('/usr/sap');
+    expect(content).toContain('azure_resource-part1');
+  });
+
+  test('detects Azure extensions from SLES InspectIaaSDisk ZIP', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('test-inspect-iaas-disk-sles.zip'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('InspectIaaSDisk Results');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+
+    // Should detect Azure extensions from waagent handler status files
+    expect(content).toContain('MDE');
+    expect(content).toContain('VMSnapshot');
+    expect(content).toContain('LinuxPatchExtension');
+    expect(content).toContain('RunCommand');
+  });
+
+  test('parses sysctl.conf and sysctl.d files from SLES InspectIaaSDisk ZIP', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('test-inspect-iaas-disk-sles.zip'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('InspectIaaSDisk Results');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+
+    // Parameters from device_0/etc/sysctl.conf should be detected
+    expect(content).toContain('net.core.rmem_max');
+    expect(content).toContain('net.core.wmem_max');
+
+    // SAP parameters from device_0/etc/sysctl.d/sap_hdb_sysctl.conf
+    expect(content).toContain('vm.swappiness');
+    expect(content).toContain('vm.dirty_bytes');
+
+    // vm.swappiness=15 (expected 10) should generate a warning
+    const html = await page.locator('#output').innerHTML();
+    expect(html).toContain('vm.swappiness');
+    // The kernel parameters section should appear
+    expect(content).toContain('Kernel and System Parameters');
+  });
+
+  test('parses waagent.log and categorises errors from SLES InspectIaaSDisk ZIP', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('test-inspect-iaas-disk-sles.zip'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('Azure Linux Agent Log');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+    const html = await page.locator('#output').innerHTML();
+
+    // Should detect agent version
+    expect(content).toContain('2.14.0.1');
+
+    // Should show error count badges
+    // Fixture has: 2 goal state errors, 1 extension error, 1 resource disk error = 4 errors
+    // And: 1 IMDS warning, 2 status file warnings (lines 11-12), 1 resource disk warning = 4 warnings
+    expect(html).toContain('error');
+
+    // Goal state errors should be categorised
+    expect(content).toContain('Goal State');
+
+    // Extension error (MDE) should be detected
+    expect(content).toContain('MDE');
+
+    // Resource disk errors should be detected
+    expect(content).toContain('Resource Disk');
+
+    // IMDS connection error should be detected
+    expect(content).toContain('IMDS');
+  });
+
+  // ── FIPS Detection Tests ──────────────────────────────────────────────
+
+  test('detects FIPS enabled from all indicators', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('scc_test-fips-enabled.tar.xz'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('FIPS Status');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+    const html = await page.locator('#output').innerHTML();
+
+    // FIPS Status section must appear
+    expect(content).toContain('FIPS Status');
+
+    // Should show ENABLED badge
+    expect(html).toContain('ENABLED');
+
+    // All six sources should be listed
+    expect(content).toContain('fips-mode-setup --check');
+    expect(content).toContain('Kernel cmdline (fips=1)');
+    expect(content).toContain('sysctl crypto.fips_enabled');
+    expect(content).toContain('Crypto policy');
+    expect(content).toContain('waagent.conf OS.EnableFIPS');
+    expect(content).toContain('dracut-fips package');
+
+    // All should show Enabled
+    expect(content).toMatch(/fips-mode-setup.*Enabled/s);
+    expect(content).toMatch(/Kernel cmdline.*Enabled/s);
+    expect(content).toMatch(/sysctl.*Enabled/s);
+    expect(content).toMatch(/dracut-fips.*Enabled/s);
+
+    // FIPS-related packages should be listed
+    expect(content).toContain('FIPS-related packages');
+    expect(content).toContain('dracut-fips');
+    expect(content).toContain('fipscheck');
+
+    // Kernel command line should show fips=1
+    expect(content).toContain('Kernel Command Line');
+    expect(content).toContain('fips=1');
+
+    // Should NOT show inconsistent warning
+    expect(content).not.toContain('Inconsistent FIPS state');
+  });
+
+  test('detects FIPS disabled from all indicators', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('scc_test-fips-disabled.tar.xz'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('FIPS Status');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+    const html = await page.locator('#output').innerHTML();
+
+    // FIPS Status section must appear
+    expect(content).toContain('FIPS Status');
+
+    // Should NOT show ENABLED badge
+    expect(html).not.toMatch(/FIPS Status.*ENABLED/s);
+
+    // Disabled sources should show "Disabled / Not set"
+    expect(content).toContain('Disabled / Not set');
+
+    // Should show fips-mode-setup as disabled
+    expect(content).toContain('fips-mode-setup --check');
+
+    // Kernel cmdline should be present but without fips=1
+    expect(content).toContain('Kernel cmdline (fips=1)');
+
+    // Should NOT list dracut-fips as a source (package not installed)
+    expect(content).not.toMatch(/dracut-fips package/);
+
+    // Should NOT show inconsistent warning
+    expect(content).not.toContain('Inconsistent FIPS state');
+
+    // Should have Kernel Command Line section (without fips=1 in params)
+    expect(content).toContain('Kernel Command Line');
+  });
+
+  test('detects FIPS inconsistent state and shows warning', async ({ page }) => {
+    const fileInput = await page.locator('input[type="file"]');
+    await fileInput.setInputFiles(fixturePath('scc_test-fips-inconsistent.tar.xz'));
+
+    await page.waitForFunction(
+      () => {
+        const output = document.getElementById('output');
+        return output && output.textContent.includes('FIPS Status');
+      },
+      { timeout: 60000 }
+    );
+
+    const content = await page.locator('#output').textContent();
+    const html = await page.locator('#output').innerHTML();
+
+    // FIPS Status section must appear
+    expect(content).toContain('FIPS Status');
+
+    // Should show inconsistent warning
+    expect(content).toContain('Inconsistent FIPS state');
+
+    // fips-mode-setup should report enabled
+    expect(content).toContain('fips-mode-setup --check');
+
+    // Inconsistent tag should appear in the table
+    expect(html).toContain('inconsistent');
+
+    // Crypto policy should show DEFAULT (which is the mismatch)
+    expect(content).toContain('DEFAULT');
+
+    // Should show the fips-mode-setup --enable recommendation
+    expect(content).toContain('fips-mode-setup --enable');
+
+    // Kernel cmdline should show fips=1 (boot param was set)
+    expect(content).toContain('fips=1');
+
+    // dracut-fips package should be detected
+    expect(content).toContain('dracut-fips');
+  });
+});
diff --git a/rca-tool/tests/vmcore.spec.js b/rca-tool/tests/vmcore.spec.js
new file mode 100644
index 0000000..36846d4
--- /dev/null
+++ b/rca-tool/tests/vmcore.spec.js
@@ -0,0 +1,96 @@
+/**
+ * @module tests/vmcore
+ * @description Playwright tests for {@link module:parsers/vmcore}.
+ *
+ * Validates vmcore crash-dump detection from sosreports: crash count
+ * badge, kdump operational status, panic reasons, crash dates,
+ * kernel versions, call-trace frames, vmcore sizes and disk usage,
+ * kdump configuration, and documentation links.
+ */
+import { test, expect } from './coverage-fixture.js';
+import { uploadAndWaitForAnalysis, navigateToApp } from './test-helpers.js';
+
+test.describe('Vmcore Parser', () => {
+
+  test.beforeEach(async ({ page }, testInfo) => {
+    await navigateToApp(page, testInfo);
+    await expect(page.locator('h1')).toContainText('RCA Tool');
+  });
+
+  test('detects vmcore crash dumps from sosreport', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-vmcore-crashes.tar.xz');
+
+    // Should show Kernel Crash Dumps section
+    expect(resultHTML).toContain('Kernel Crash Dumps');
+    // Should show the crash count badge
+    expect(resultHTML).toContain('2 vmcores');
+
+    // Should show kdump status
+    expect(resultHTML).toContain('Kdump is operational');
+
+    // Should show panic reason
+    expect(resultHTML).toContain('hung_task: blocked tasks');
+
+    // Should show crash dates
+    expect(resultHTML).toContain('2026-02-13');
+    expect(resultHTML).toContain('2025-10-05');
+
+    // Should show kernel versions
+    expect(resultHTML).toContain('4.18.0-553.89.1.el8_10.x86_64');
+    expect(resultHTML).toContain('4.18.0-553.75.1.el8_10.x86_64');
+
+    // Should show process names
+    expect(resultHTML).toContain('khungtaskd');
+
+    // Should show call trace frames
+    expect(resultHTML).toContain('dump_stack');
+    expect(resultHTML).toContain('watchdog');
+
+    // Should show vmcore sizes from listing
+    expect(resultHTML).toMatch(/GB|MB/);
+
+    // Should show total disk usage
+    expect(resultHTML).toContain('Total vmcore disk usage');
+
+    // Should show kdump configuration
+    expect(resultHTML).toContain('Kdump Configuration');
+    expect(resultHTML).toContain('/var/crash');
+
+    // Should link to documentation
+    expect(resultHTML).toContain('troubleshoot-kdump');
+  });
+
+  test('handles edge cases: no-date crash, empty kdump status, empty listing', async ({ page }) => {
+    const resultHTML = await uploadAndWaitForAnalysis(page, 'scc_test-vmcore-edge-cases.tar.xz');
+
+    // Should still detect kernel crash dumps
+    expect(resultHTML).toContain('Kernel Crash Dumps');
+
+    // Should show 2 crashes (one with date, one without)
+    expect(resultHTML).toContain('2 vmcores');
+
+    // Crash without date in directory path (nodate-crash) — covers null date sort guards
+    expect(resultHTML).toContain('VFS: Unable to mount root fs');
+
+    // Crash with valid date — covers dated crash + sort with null-date crash
+    expect(resultHTML).toContain('Fatal exception in interrupt');
+    expect(resultHTML).toContain('2026-01-20');
+
+    // Call trace from no-timestamp dmesg terminated by ---[ end ... ]--- line
+    expect(resultHTML).toContain('mount_block_root');
+    expect(resultHTML).toContain('kernel_init');
+
+    // Empty kdump status → parseKdumpStatus returns null, no status shown
+    expect(resultHTML).not.toContain('Kdump is operational');
+
+    // Empty crash listing → parseCrashListing returns null, no sizes shown
+    expect(resultHTML).not.toContain('Total vmcore disk usage');
+
+    // kdump.conf should still be parsed
+    expect(resultHTML).toContain('Kdump Configuration');
+    expect(resultHTML).toContain('/var/crash');
+
+    // failure_action = reboot (using 'default' keyword in conf)
+    expect(resultHTML).toContain('reboot');
+  });
+});
diff --git a/rca-tool/vscode-extension/.gitignore b/rca-tool/vscode-extension/.gitignore
new file mode 100644
index 0000000..6e32335
--- /dev/null
+++ b/rca-tool/vscode-extension/.gitignore
@@ -0,0 +1,6 @@
+node_modules/
+dist/
+*.vsix
+
+# Platform binaries are injected by CI (or copied locally) before packaging.
+bin/
diff --git a/rca-tool/vscode-extension/.vscodeignore b/rca-tool/vscode-extension/.vscodeignore
new file mode 100644
index 0000000..e4c8c3e
--- /dev/null
+++ b/rca-tool/vscode-extension/.vscodeignore
@@ -0,0 +1,14 @@
+# Files and folders excluded from the packaged .vsix.
+.vscode/**
+.gitignore
+.vscodeignore
+esbuild.js
+tsconfig.json
+src/**
+node_modules/**
+**/*.ts
+**/*.map
+
+# Keep only the dist bundle, the platform binaries, media, and docs.
+# What ships: dist/extension.js, bin/** (platform binaries), README.md,
+# CHANGELOG.md, LICENSE.txt, package.json.
diff --git a/rca-tool/vscode-extension/CHANGELOG.md b/rca-tool/vscode-extension/CHANGELOG.md
new file mode 100644
index 0000000..bfb016d
--- /dev/null
+++ b/rca-tool/vscode-extension/CHANGELOG.md
@@ -0,0 +1,14 @@
+# Changelog
+
+All notable changes to the RCA Tool extension are documented here.
+
+## [0.1.0] - 2026-06-19
+
+### Added
+
+- Initial release.
+- Bundles the `supportfile_mcp` MCP server and `rca_cli` analyzer.
+- Registers the `rca-tool` MCP server definition provider for VS Code Agent mode.
+- Settings to override the bundled `supportfile_mcp` / `rca_cli` binary paths.
+- Platform-specific packages for `linux-x64`, `linux-arm64`, `darwin-arm64`,
+  and `win32-x64`.
diff --git a/rca-tool/vscode-extension/LICENSE.txt b/rca-tool/vscode-extension/LICENSE.txt
new file mode 100644
index 0000000..7e5d60b
--- /dev/null
+++ b/rca-tool/vscode-extension/LICENSE.txt
@@ -0,0 +1,9 @@
+Azure/azure-support-scripts
+
+Copyright (c) Microsoft Corporation
+All rights reserved.
+
+MIT License
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the ""Software""), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+THE SOFTWARE IS PROVIDED *AS IS*, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/rca-tool/vscode-extension/README.md b/rca-tool/vscode-extension/README.md
new file mode 100644
index 0000000..2343005
--- /dev/null
+++ b/rca-tool/vscode-extension/README.md
@@ -0,0 +1,56 @@
+# RCA Tool
+
+Analyze Linux support archives (`sosreport` / `supportconfig`) for Azure VMs
+directly from VS Code Chat. This extension bundles the **RCA Tool** MCP server
+(`supportfile_mcp`) and the `rca_cli` analyzer and registers them with VS Code's
+Model Context Protocol integration, so the tools appear automatically in
+**Agent mode**.
+
+## What you get
+
+Once installed, the server `rca-tool` is contributed automatically. In the Chat
+view (Agent mode), the following tools become available under **rca-tool**:
+
+- `list_parsers` — list the available detectors/parsers
+- `analyze_archive` — run the analyzer over a support archive
+- `summarize_findings` — produce a high-level summary of detected issues
+
+Example prompt:
+
+> Summarize the findings in `path/to/sosreport.tar.xz`
+
+## How it works
+
+The extension ships a platform-specific build of two native binaries under
+`bin/`:
+
+- `supportfile_mcp` — the stdio MCP server
+- `rca_cli` — the analyzer the server shells out to
+
+On activation the extension registers an `McpServerDefinitionProvider` that
+launches `supportfile_mcp` over stdio and points it at the bundled `rca_cli`
+via the `RCA_CLI_BIN` environment variable.
+
+## Settings
+
+| Setting | Description |
+| --- | --- |
+| `rcaTool.mcpServerPath` | Absolute path to a `supportfile_mcp` binary to use instead of the bundled one. |
+| `rcaTool.rcaCliPath` | Absolute path to an `rca_cli` binary to use instead of the bundled one. |
+
+Leave both empty to use the binaries shipped with the extension.
+
+## Platform support
+
+Platform-specific VSIX packages are published for:
+
+- `linux-x64`, `linux-arm64`
+- `darwin-arm64`
+- `win32-x64`
+
+The Marketplace serves the package matching your OS and architecture
+automatically.
+
+## License
+
+MIT — see [LICENSE.txt](LICENSE.txt).
diff --git a/rca-tool/vscode-extension/esbuild.js b/rca-tool/vscode-extension/esbuild.js
new file mode 100644
index 0000000..5b80674
--- /dev/null
+++ b/rca-tool/vscode-extension/esbuild.js
@@ -0,0 +1,34 @@
+// esbuild bundler for the RCA Tool VS Code extension.
+// Bundles src/extension.ts into dist/extension.js as a CommonJS module,
+// keeping the `vscode` module external (provided by the host at runtime).
+const esbuild = require('esbuild');
+
+const production = process.argv.includes('--production');
+const watch = process.argv.includes('--watch');
+
+async function main() {
+  const ctx = await esbuild.context({
+    entryPoints: ['src/extension.ts'],
+    bundle: true,
+    format: 'cjs',
+    platform: 'node',
+    target: 'node18',
+    outfile: 'dist/extension.js',
+    external: ['vscode'],
+    sourcemap: !production,
+    minify: production,
+    logLevel: 'info',
+  });
+
+  if (watch) {
+    await ctx.watch();
+  } else {
+    await ctx.rebuild();
+    await ctx.dispose();
+  }
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});
diff --git a/rca-tool/vscode-extension/package-lock.json b/rca-tool/vscode-extension/package-lock.json
new file mode 100644
index 0000000..9b3dd9b
--- /dev/null
+++ b/rca-tool/vscode-extension/package-lock.json
@@ -0,0 +1,508 @@
+{
+  "name": "rca-tool",
+  "version": "0.1.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "rca-tool",
+      "version": "0.1.0",
+      "license": "MIT",
+      "devDependencies": {
+        "@types/node": "^20.0.0",
+        "@types/vscode": "^1.101.0",
+        "esbuild": "^0.23.0",
+        "typescript": "^5.5.0"
+      },
+      "engines": {
+        "vscode": "^1.101.0"
+      }
+    },
+    "node_modules/@esbuild/aix-ppc64": {
+      "version": "0.23.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.23.1.tgz",
+      "integrity": "sha512-6VhYk1diRqrhBAqpJEdjASR/+WVRtfjpqKuNw11cLiaWpAT/Uu+nokB+UJnevzy/P9C/ty6AOe0dwueMrGh/iQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm": {
+      "version": "0.23.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.23.1.tgz",
+      "integrity": "sha512-uz6/tEy2IFm9RYOyvKl88zdzZfwEfKZmnX9Cj1BHjeSGNuGLuMD1kR8y5bteYmwqKm1tj8m4cb/aKEorr6fHWQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm64": {
+      "version": "0.23.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.23.1.tgz",
+      "integrity": "sha512-xw50ipykXcLstLeWH7WRdQuysJqejuAGPd30vd1i5zSyKK3WE+ijzHmLKxdiCMtH1pHz78rOg0BKSYOSB/2Khw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-x64": {
+      "version": "0.23.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.23.1.tgz",
+      "integrity": "sha512-nlN9B69St9BwUoB+jkyU090bru8L0NA3yFvAd7k8dNsVH8bi9a8cUAUSEcEEgTp2z3dbEDGJGfP6VUnkQnlReg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-arm64": {
+      "version": "0.23.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.23.1.tgz",
+      "integrity": "sha512-YsS2e3Wtgnw7Wq53XXBLcV6JhRsEq8hkfg91ESVadIrzr9wO6jJDMZnCQbHm1Guc5t/CdDiFSSfWP58FNuvT3Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-x64": {
+      "version": "0.23.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.23.1.tgz",
+      "integrity": "sha512-aClqdgTDVPSEGgoCS8QDG37Gu8yc9lTHNAQlsztQ6ENetKEO//b8y31MMu2ZaPbn4kVsIABzVLXYLhCGekGDqw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.23.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.23.1.tgz",
+      "integrity": "sha512-h1k6yS8/pN/NHlMl5+v4XPfikhJulk4G+tKGFIOwURBSFzE8bixw1ebjluLOjfwtLqY0kewfjLSrO6tN2MgIhA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-x64": {
+      "version": "0.23.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.23.1.tgz",
+      "integrity": "sha512-lK1eJeyk1ZX8UklqFd/3A60UuZ/6UVfGT2LuGo3Wp4/z7eRTRYY+0xOu2kpClP+vMTi9wKOfXi2vjUpO1Ro76g==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm": {
+      "version": "0.23.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.23.1.tgz",
+      "integrity": "sha512-CXXkzgn+dXAPs3WBwE+Kvnrf4WECwBdfjfeYHpMeVxWE0EceB6vhWGShs6wi0IYEqMSIzdOF1XjQ/Mkm5d7ZdQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm64": {
+      "version": "0.23.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.23.1.tgz",
+      "integrity": "sha512-/93bf2yxencYDnItMYV/v116zff6UyTjo4EtEQjUBeGiVpMmffDNUyD9UN2zV+V3LRV3/on4xdZ26NKzn6754g==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ia32": {
+      "version": "0.23.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.23.1.tgz",
+      "integrity": "sha512-VTN4EuOHwXEkXzX5nTvVY4s7E/Krz7COC8xkftbbKRYAl96vPiUssGkeMELQMOnLOJ8k3BY1+ZY52tttZnHcXQ==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-loong64": {
+      "version": "0.23.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.23.1.tgz",
+      "integrity": "sha512-Vx09LzEoBa5zDnieH8LSMRToj7ir/Jeq0Gu6qJ/1GcBq9GkfoEAoXvLiW1U9J1qE/Y/Oyaq33w5p2ZWrNNHNEw==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-mips64el": {
+      "version": "0.23.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.23.1.tgz",
+      "integrity": "sha512-nrFzzMQ7W4WRLNUOU5dlWAqa6yVeI0P78WKGUo7lg2HShq/yx+UYkeNSE0SSfSure0SqgnsxPvmAUu/vu0E+3Q==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ppc64": {
+      "version": "0.23.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.23.1.tgz",
+      "integrity": "sha512-dKN8fgVqd0vUIjxuJI6P/9SSSe/mB9rvA98CSH2sJnlZ/OCZWO1DJvxj8jvKTfYUdGfcq2dDxoKaC6bHuTlgcw==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-riscv64": {
+      "version": "0.23.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.23.1.tgz",
+      "integrity": "sha512-5AV4Pzp80fhHL83JM6LoA6pTQVWgB1HovMBsLQ9OZWLDqVY8MVobBXNSmAJi//Csh6tcY7e7Lny2Hg1tElMjIA==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-s390x": {
+      "version": "0.23.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.23.1.tgz",
+      "integrity": "sha512-9ygs73tuFCe6f6m/Tb+9LtYxWR4c9yg7zjt2cYkjDbDpV/xVn+68cQxMXCjUpYwEkze2RcU/rMnfIXNRFmSoDw==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-x64": {
+      "version": "0.23.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.23.1.tgz",
+      "integrity": "sha512-EV6+ovTsEXCPAp58g2dD68LxoP/wK5pRvgy0J/HxPGB009omFPv3Yet0HiaqvrIrgPTBuC6wCH1LTOY91EO5hQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-x64": {
+      "version": "0.23.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.23.1.tgz",
+      "integrity": "sha512-aevEkCNu7KlPRpYLjwmdcuNz6bDFiE7Z8XC4CPqExjTvrHugh28QzUXVOZtiYghciKUacNktqxdpymplil1beA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.23.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.23.1.tgz",
+      "integrity": "sha512-3x37szhLexNA4bXhLrCC/LImN/YtWis6WXr1VESlfVtVeoFJBRINPJ3f0a/6LV8zpikqoUg4hyXw0sFBt5Cr+Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-x64": {
+      "version": "0.23.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.23.1.tgz",
+      "integrity": "sha512-aY2gMmKmPhxfU+0EdnN+XNtGbjfQgwZj43k8G3fyrDM/UdZww6xrWxmDkuz2eCZchqVeABjV5BpildOrUbBTqA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/sunos-x64": {
+      "version": "0.23.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.23.1.tgz",
+      "integrity": "sha512-RBRT2gqEl0IKQABT4XTj78tpk9v7ehp+mazn2HbUeZl1YMdaGAQqhapjGTCe7uw7y0frDi4gS0uHzhvpFuI1sA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-arm64": {
+      "version": "0.23.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.23.1.tgz",
+      "integrity": "sha512-4O+gPR5rEBe2FpKOVyiJ7wNDPA8nGzDuJ6gN4okSA1gEOYZ67N8JPk58tkWtdtPeLz7lBnY6I5L3jdsr3S+A6A==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-ia32": {
+      "version": "0.23.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.23.1.tgz",
+      "integrity": "sha512-BcaL0Vn6QwCwre3Y717nVHZbAa4UBEigzFm6VdsVdT/MbZ38xoj1X9HPkZhbmaBGUD1W8vxAfffbDe8bA6AKnQ==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-x64": {
+      "version": "0.23.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.23.1.tgz",
+      "integrity": "sha512-BHpFFeslkWrXWyUPnbKm+xYYVYruCinGcftSBaa8zoF9hZO4BcSCFUvHVTtzpIY6YzUnYtuEhZ+C9iEXjxnasg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@types/node": {
+      "version": "20.19.43",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.19.43.tgz",
+      "integrity": "sha512-6oYBAi5ikg4Pl+kGsoYtawUMBT2zZMCvPNF7pVLnHZfd1zf38DRiWn/gT01RYCdUqkv7Fhr+C9ot4/tb+2sVvA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~6.21.0"
+      }
+    },
+    "node_modules/@types/vscode": {
+      "version": "1.125.0",
+      "resolved": "https://registry.npmjs.org/@types/vscode/-/vscode-1.125.0.tgz",
+      "integrity": "sha512-0icm/ZQAaism87P0ekHqi4/Ju9du+Tm0RUW+y7vqRsxY2cY0FNRX1nAnaW7nT6npPt2tfHiheZ55Zm9UhqonFA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/esbuild": {
+      "version": "0.23.1",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.23.1.tgz",
+      "integrity": "sha512-VVNz/9Sa0bs5SELtn3f7qhJCDPCF5oMEl5cO9/SSinpE9hbPVvxbd572HH5AKiP7WD8INO53GgfDDhRjkylHEg==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.23.1",
+        "@esbuild/android-arm": "0.23.1",
+        "@esbuild/android-arm64": "0.23.1",
+        "@esbuild/android-x64": "0.23.1",
+        "@esbuild/darwin-arm64": "0.23.1",
+        "@esbuild/darwin-x64": "0.23.1",
+        "@esbuild/freebsd-arm64": "0.23.1",
+        "@esbuild/freebsd-x64": "0.23.1",
+        "@esbuild/linux-arm": "0.23.1",
+        "@esbuild/linux-arm64": "0.23.1",
+        "@esbuild/linux-ia32": "0.23.1",
+        "@esbuild/linux-loong64": "0.23.1",
+        "@esbuild/linux-mips64el": "0.23.1",
+        "@esbuild/linux-ppc64": "0.23.1",
+        "@esbuild/linux-riscv64": "0.23.1",
+        "@esbuild/linux-s390x": "0.23.1",
+        "@esbuild/linux-x64": "0.23.1",
+        "@esbuild/netbsd-x64": "0.23.1",
+        "@esbuild/openbsd-arm64": "0.23.1",
+        "@esbuild/openbsd-x64": "0.23.1",
+        "@esbuild/sunos-x64": "0.23.1",
+        "@esbuild/win32-arm64": "0.23.1",
+        "@esbuild/win32-ia32": "0.23.1",
+        "@esbuild/win32-x64": "0.23.1"
+      }
+    },
+    "node_modules/typescript": {
+      "version": "5.9.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
+      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/undici-types": {
+      "version": "6.21.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
+      "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
+      "dev": true,
+      "license": "MIT"
+    }
+  }
+}
diff --git a/rca-tool/vscode-extension/package.json b/rca-tool/vscode-extension/package.json
new file mode 100644
index 0000000..086c10a
--- /dev/null
+++ b/rca-tool/vscode-extension/package.json
@@ -0,0 +1,67 @@
+{
+  "name": "rca-tool",
+  "displayName": "RCA Tool",
+  "description": "Analyze Linux support archives (sosreport / supportconfig) directly from VS Code Chat via the RCA Tool MCP server.",
+  "version": "0.1.0",
+  "publisher": "fede2cr",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Azure/azure-support-scripts.git",
+    "directory": "rca-tool/vscode-extension"
+  },
+  "engines": {
+    "vscode": "^1.101.0"
+  },
+  "categories": [
+    "AI",
+    "Other"
+  ],
+  "keywords": [
+    "mcp",
+    "rca",
+    "sosreport",
+    "supportconfig",
+    "azure"
+  ],
+  "main": "./dist/extension.js",
+  "activationEvents": [
+    "onMcpCollection:rca-tool"
+  ],
+  "contributes": {
+    "mcpServerDefinitionProviders": [
+      {
+        "id": "rca-tool",
+        "label": "RCA Tool"
+      }
+    ],
+    "configuration": {
+      "title": "RCA Tool",
+      "properties": {
+        "rcaTool.mcpServerPath": {
+          "type": "string",
+          "default": "",
+          "markdownDescription": "Absolute path to a `supportfile_mcp` binary to use instead of the one bundled with the extension. Leave empty to use the bundled binary."
+        },
+        "rcaTool.rcaCliPath": {
+          "type": "string",
+          "default": "",
+          "markdownDescription": "Absolute path to an `rca_cli` binary to use instead of the one bundled with the extension. Leave empty to use the bundled binary (exposed to the server via `RCA_CLI_BIN`)."
+        }
+      }
+    }
+  },
+  "scripts": {
+    "vscode:prepublish": "npm run package",
+    "compile": "node esbuild.js",
+    "watch": "node esbuild.js --watch",
+    "package": "node esbuild.js --production",
+    "lint": "tsc --noEmit"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "@types/vscode": "^1.101.0",
+    "esbuild": "^0.23.0",
+    "typescript": "^5.5.0"
+  }
+}
diff --git a/rca-tool/vscode-extension/src/extension.ts b/rca-tool/vscode-extension/src/extension.ts
new file mode 100644
index 0000000..49e92b6
--- /dev/null
+++ b/rca-tool/vscode-extension/src/extension.ts
@@ -0,0 +1,90 @@
+import * as vscode from 'vscode';
+import * as fs from 'fs';
+import * as path from 'path';
+
+const PROVIDER_ID = 'rca-tool';
+
+/** Append `.exe` on Windows. */
+function exe(name: string): string {
+  return process.platform === 'win32' ? `${name}.exe` : name;
+}
+
+/**
+ * Resolve a binary path: prefer the user-configured override, otherwise fall
+ * back to the binary bundled under the extension's `bin/` directory.
+ */
+function resolveBinary(
+  context: vscode.ExtensionContext,
+  configKey: string,
+  binName: string,
+): string {
+  const override = vscode.workspace
+    .getConfiguration('rcaTool')
+    .get<string>(configKey, '')
+    .trim();
+  if (override) {
+    return override;
+  }
+  return path.join(context.extensionPath, 'bin', exe(binName));
+}
+
+/**
+ * Ensure the bundled binary is executable. VSIX packaging does not preserve the
+ * Unix executable bit, so restore it on activation. No-op on Windows.
+ */
+function ensureExecutable(binPath: string): void {
+  if (process.platform === 'win32') {
+    return;
+  }
+  try {
+    fs.chmodSync(binPath, 0o755);
+  } catch {
+    // Non-fatal: an override path the user owns may already be executable, or
+    // the file may not exist yet (surfaced later when the server fails to start).
+  }
+}
+
+export function activate(context: vscode.ExtensionContext): void {
+  const didChange = new vscode.EventEmitter<void>();
+  context.subscriptions.push(didChange);
+
+  const provider: vscode.McpServerDefinitionProvider = {
+    onDidChangeMcpServerDefinitions: didChange.event,
+    provideMcpServerDefinitions: () => {
+      const serverBin = resolveBinary(context, 'mcpServerPath', 'supportfile_mcp');
+      const rcaCliBin = resolveBinary(context, 'rcaCliPath', 'rca_cli');
+
+      ensureExecutable(serverBin);
+      ensureExecutable(rcaCliBin);
+
+      return [
+        new vscode.McpStdioServerDefinition(
+          'RCA Tool',
+          serverBin,
+          [],
+          { RCA_CLI_BIN: rcaCliBin },
+        ),
+      ];
+    },
+  };
+
+  context.subscriptions.push(
+    vscode.lm.registerMcpServerDefinitionProvider(PROVIDER_ID, provider),
+  );
+
+  // Re-resolve server definitions when the user changes the override paths.
+  context.subscriptions.push(
+    vscode.workspace.onDidChangeConfiguration((e) => {
+      if (
+        e.affectsConfiguration('rcaTool.mcpServerPath') ||
+        e.affectsConfiguration('rcaTool.rcaCliPath')
+      ) {
+        didChange.fire();
+      }
+    }),
+  );
+}
+
+export function deactivate(): void {
+  // Subscriptions are disposed automatically by VS Code.
+}
diff --git a/rca-tool/vscode-extension/tsconfig.json b/rca-tool/vscode-extension/tsconfig.json
new file mode 100644
index 0000000..bd3584c
--- /dev/null
+++ b/rca-tool/vscode-extension/tsconfig.json
@@ -0,0 +1,17 @@
+{
+  "compilerOptions": {
+    "module": "Node16",
+    "moduleResolution": "Node16",
+    "target": "ES2022",
+    "lib": ["ES2022"],
+    "outDir": "dist",
+    "rootDir": "src",
+    "sourceMap": true,
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true
+  },
+  "include": ["src"],
+  "exclude": ["node_modules", "dist"]
+}
diff --git a/rca-tool/web-leptos/.gitignore b/rca-tool/web-leptos/.gitignore
new file mode 100644
index 0000000..4e14d82
--- /dev/null
+++ b/rca-tool/web-leptos/.gitignore
@@ -0,0 +1,3 @@
+/target
+/dist
+/assets
diff --git a/rca-tool/web-leptos/Cargo.lock b/rca-tool/web-leptos/Cargo.lock
new file mode 100644
index 0000000..32a591d
--- /dev/null
+++ b/rca-tool/web-leptos/Cargo.lock
@@ -0,0 +1,2085 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "any_spawner"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1384d3fe1eecb464229fcf6eebb72306591c56bf27b373561489458a7c73027d"
+dependencies = [
+ "futures",
+ "thiserror 2.0.18",
+ "wasm-bindgen-futures",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.102"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+
+[[package]]
+name = "async-lock"
+version = "3.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "290f7f2596bd5b78a9fec8088ccd89180d7f9f55b94b0576823bbbdc72ee8311"
+dependencies = [
+ "event-listener",
+ "event-listener-strategy",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-once-cell"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288f83726785267c6f2ef073a3d83dc3f9b81464e9f99898240cced85fce35a"
+
+[[package]]
+name = "async-trait"
+version = "0.1.89"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "attribute-derive"
+version = "0.10.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05832cdddc8f2650cc2cc187cc2e952b8c133a48eb055f35211f61ee81502d77"
+dependencies = [
+ "attribute-derive-macro",
+ "derive-where",
+ "manyhow",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "attribute-derive-macro"
+version = "0.10.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a7cdbbd4bd005c5d3e2e9c885e6fa575db4f4a3572335b974d8db853b6beb61"
+dependencies = [
+ "collection_literals",
+ "interpolator",
+ "manyhow",
+ "proc-macro-utils",
+ "proc-macro2",
+ "quote",
+ "quote-use",
+ "syn",
+]
+
+[[package]]
+name = "base16"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d27c3610c36aee21ce8ac510e6224498de4228ad772a171ed65643a24693a5a8"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "bitflags"
+version = "2.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af"
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
+
+[[package]]
+name = "bytes"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
+
+[[package]]
+name = "camino"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e629a66d692cb9ff1a1c664e41771b3dcaf961985a9774c0eb0bd1b51cf60a48"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "codee"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9dbbdc4b4d349732bc6690de10a9de952bd39ba6a065c586e26600b6b0b91f5"
+dependencies = [
+ "serde",
+ "serde_json",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "collection_literals"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2550f75b8cfac212855f6b1885455df8eaee8fe8e246b647d69146142e016084"
+
+[[package]]
+name = "concurrent-queue"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "config"
+version = "0.15.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b30fa8254caad766fc03cb0ccae691e14bf3bd72bfff27f72802ce729551b3d6"
+dependencies = [
+ "convert_case 0.6.0",
+ "pathdiff",
+ "serde_core",
+ "toml",
+ "winnow",
+]
+
+[[package]]
+name = "console_log"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e89f72f65e8501878b8a004d5a1afb780987e2ce2b4532c562e367a72c57499f"
+dependencies = [
+ "log",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "const-str"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18f12cc9948ed9604230cdddc7c86e270f9401ccbe3c2e98a4378c5e7632212f"
+
+[[package]]
+name = "const_format"
+version = "0.2.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7faa7469a93a566e9ccc1c73fe783b4a65c274c5ace346038dca9c39fe0030ad"
+dependencies = [
+ "const_format_proc_macros",
+]
+
+[[package]]
+name = "const_format_proc_macros"
+version = "0.2.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d57c2eccfb16dbac1f4e61e206105db5820c9d26c3c472bc17c774259ef7744"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-xid",
+]
+
+[[package]]
+name = "const_str_slice_concat"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f67855af358fcb20fac58f9d714c94e2b228fe5694c1c9b4ead4a366343eda1b"
+
+[[package]]
+name = "convert_case"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec182b0ca2f35d8fc196cf3404988fd8b8c739a4d270ff118a398feb0cbec1ca"
+dependencies = [
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "convert_case"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "affbf0190ed2caf063e3def54ff444b449371d55c58e513a95ab98eca50adb49"
+dependencies = [
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "convert_case_extras"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589c70f0faf8aa9d17787557d5eae854d7755cac50f5c3d12c81d3d57661cebb"
+dependencies = [
+ "convert_case 0.11.0",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "derive-where"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef941ded77d15ca19b40374869ac6000af1c9f2a4c0f3d4c70926287e6364a8f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "drain_filter_polyfill"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "669a445ee724c5c69b1b06fe0b63e70a1c84bc9bb7d9696cd4f4e3ec45050408"
+
+[[package]]
+name = "either"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+
+[[package]]
+name = "either_of"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14f7f86eef3a7e4b9c2107583dbbbe3d9535c4b800796faf1774b82ba22033da"
+dependencies = [
+ "paste",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "erased"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1731451909bde27714eacba19c2566362a7f35224f52b153d3f42cf60f72472"
+
+[[package]]
+name = "event-listener"
+version = "5.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab"
+dependencies = [
+ "concurrent-queue",
+ "parking",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "event-listener-strategy"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8be9f3dfaaffdae2972880079a491a1a8bb7cbed0b8dd7a347f668b4150a3b93"
+dependencies = [
+ "event-listener",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "futures"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
+
+[[package]]
+name = "futures-task"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+
+[[package]]
+name = "futures-util"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi",
+ "wasip2",
+ "wasip3",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "gloo-net"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c06f627b1a58ca3d42b45d6104bf1e1a03799df472df00988b6ba21accc10580"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-sink",
+ "gloo-utils",
+ "http",
+ "js-sys",
+ "pin-project",
+ "serde",
+ "serde_json",
+ "thiserror 1.0.69",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "gloo-timers"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbb143cf96099802033e0d4f4963b19fd2e0b728bcf076cd9cf7f6634f092994"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "gloo-utils"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b5555354113b18c547c1d3a98fbf7fb32a9ff4f6fa112ce823a21641a0ba3aa"
+dependencies = [
+ "js-sys",
+ "serde",
+ "serde_json",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "guardian"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "17e2ac29387b1aa07a1e448f7bb4f35b500787971e965b02842b900afa5c8f6f"
+
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "foldhash",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "html-escape"
+version = "0.2.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d1ad449764d627e22bfd7cd5e8868264fc9236e07c752972b4080cd351cb476"
+dependencies = [
+ "utf8-width",
+]
+
+[[package]]
+name = "http"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "hydration_context"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8714ae4adeaa846d838f380fbd72f049197de629948f91bf045329e0cf0a283"
+dependencies = [
+ "futures",
+ "once_cell",
+ "or_poisoned",
+ "pin-project-lite",
+ "serde",
+ "throw_error",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c6b649701667bbe825c3b7e6388cb521c23d88644678e83c0c4d0a621a34b43"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edba7861004dd3714265b4db54a3c390e880ab658fec5f7db895fae2046b5bb6"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f6c8828b67bf8908d82127b2054ea1b4427ff0230ee9141c54251934ab1b599"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7aedcccd01fc5fe81e6b489c15b247b8b0690feb23304303a9e560f37efc560a"
+
+[[package]]
+name = "icu_properties"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "020bfc02fe870ec3a66d93e677ccca0562506e5872c650f893269e08615d74ec"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "616c294cf8d725c6afcd8f55abc17c56464ef6211f9ed59cccffe534129c77af"
+
+[[package]]
+name = "icu_provider"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85962cf0ce02e1e0a629cc34e7ca3e373ce20dda4c4d7294bbd0bf1fdb59e614"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7714e70437a7dc3ac8eb7e6f8df75fd8eb422675fc7678aff7364301092b1017"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.16.1",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "interpolator"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71dd52191aae121e8611f1e8dc3e324dd0dd1dee1e6dd91d10ee07a3cfb4d9d8"
+
+[[package]]
+name = "itertools"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
+
+[[package]]
+name = "js-sys"
+version = "0.3.91"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b49715b7073f385ba4bc528e5747d02e66cb39c6146efb66b781f131f0fb399c"
+dependencies = [
+ "once_cell",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "leb128fmt"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
+
+[[package]]
+name = "leptos"
+version = "0.8.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b540ac2868724738f0f5d00f00ec4640e587223774219c1baddc46bad46fb8e"
+dependencies = [
+ "any_spawner",
+ "cfg-if",
+ "either_of",
+ "futures",
+ "getrandom",
+ "hydration_context",
+ "leptos_config",
+ "leptos_dom",
+ "leptos_hot_reload",
+ "leptos_macro",
+ "leptos_server",
+ "oco_ref",
+ "or_poisoned",
+ "paste",
+ "reactive_graph",
+ "rustc-hash",
+ "rustc_version",
+ "send_wrapper",
+ "serde",
+ "serde_json",
+ "serde_qs",
+ "server_fn",
+ "slotmap",
+ "tachys",
+ "thiserror 2.0.18",
+ "throw_error",
+ "typed-builder",
+ "typed-builder-macro",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wasm_split_helpers",
+ "web-sys",
+]
+
+[[package]]
+name = "leptos_config"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19a2ac32008dda0d657f2147cc33336f4e743e091597db10f7a99d668e92a46d"
+dependencies = [
+ "config",
+ "regex",
+ "serde",
+ "thiserror 2.0.18",
+ "typed-builder",
+]
+
+[[package]]
+name = "leptos_dom"
+version = "0.8.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35742e9ed8f8aaf9e549b454c68a7ac0992536e06856365639b111f72ab07884"
+dependencies = [
+ "js-sys",
+ "or_poisoned",
+ "reactive_graph",
+ "send_wrapper",
+ "tachys",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "leptos_hot_reload"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d2a0f220c8a5ef3c51199dfb9cdd702bc0eb80d52fbe70c7890adfaaae8a4b1"
+dependencies = [
+ "anyhow",
+ "camino",
+ "indexmap",
+ "or_poisoned",
+ "proc-macro2",
+ "quote",
+ "rstml",
+ "serde",
+ "syn",
+ "walkdir",
+]
+
+[[package]]
+name = "leptos_macro"
+version = "0.8.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712325a77f1d050bf2897061ccaf2b075930aab36954980d658f04452686c474"
+dependencies = [
+ "attribute-derive",
+ "cfg-if",
+ "convert_case 0.11.0",
+ "convert_case_extras",
+ "html-escape",
+ "itertools",
+ "leptos_hot_reload",
+ "prettyplease",
+ "proc-macro-error2",
+ "proc-macro2",
+ "quote",
+ "rstml",
+ "rustc_version",
+ "server_fn_macro",
+ "syn",
+ "uuid",
+]
+
+[[package]]
+name = "leptos_server"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da974775c5ccbb6bd64be7f53f75e8321542e28f21563a416574dbe4d5447eae"
+dependencies = [
+ "any_spawner",
+ "base64",
+ "codee",
+ "futures",
+ "hydration_context",
+ "or_poisoned",
+ "reactive_graph",
+ "send_wrapper",
+ "serde",
+ "serde_json",
+ "server_fn",
+ "tachys",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.183"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5b646652bf6661599e1da8901b3b9522896f01e736bad5f723fe7a3a27f899d"
+
+[[package]]
+name = "litemap"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6373607a59f0be73a39b6fe456b8192fcc3585f602af20751600e974dd455e77"
+
+[[package]]
+name = "log"
+version = "0.4.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+
+[[package]]
+name = "manyhow"
+version = "0.11.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b33efb3ca6d3b07393750d4030418d594ab1139cee518f0dc88db70fec873587"
+dependencies = [
+ "manyhow-macros",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "manyhow-macros"
+version = "0.11.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46fce34d199b78b6e6073abf984c9cf5fd3e9330145a93ee0738a7443e371495"
+dependencies = [
+ "proc-macro-utils",
+ "proc-macro2",
+ "quote",
+]
+
+[[package]]
+name = "memchr"
+version = "2.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
+
+[[package]]
+name = "next_tuple"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60993920e071b0c9b66f14e2b32740a4e27ffc82854dcd72035887f336a09a28"
+
+[[package]]
+name = "oco_ref"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed0423ff9973dea4d6bd075934fdda86ebb8c05bdf9d6b0507067d4a1226371d"
+dependencies = [
+ "serde",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+
+[[package]]
+name = "or_poisoned"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c04f5d74368e4d0dfe06c45c8627c81bd7c317d52762d118fb9b3076f6420fd"
+
+[[package]]
+name = "parking"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
+
+[[package]]
+name = "paste"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
+
+[[package]]
+name = "pathdiff"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df94ce210e5bc13cb6651479fa48d14f601d9858cfe0467f43ae157023b938d3"
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pin-project"
+version = "1.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1749c7ed4bcaf4c3d0a3efc28538844fb29bcdd7d2b67b2be7e20ba861ff517"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b20ed30f105399776b9c883e68e536ef602a16ae6f596d2c473591d6ad64c6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "potential_utf"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b73949432f5e2a09657003c25bca5e19a0e9c84f8058ca374f49e0ebe605af77"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn",
+]
+
+[[package]]
+name = "proc-macro-error-attr2"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96de42df36bb9bba5542fe9f1a054b8cc87e172759a1868aa05c1f3acc89dfc5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+]
+
+[[package]]
+name = "proc-macro-error2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11ec05c52be0a07b08061f7dd003e7d7092e0472bc731b4af7bb1ef876109802"
+dependencies = [
+ "proc-macro-error-attr2",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "proc-macro-utils"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eeaf08a13de400bc215877b5bdc088f241b12eb42f0a548d3390dc1c56bb7071"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "smallvec",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "proc-macro2-diagnostics"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af066a9c399a26e020ada66a034357a868728e72cd426f3adcd35f80d88d88c8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "version_check",
+ "yansi",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "quote-use"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9619db1197b497a36178cfc736dc96b271fe918875fbf1344c436a7e93d0321e"
+dependencies = [
+ "quote",
+ "quote-use-macros",
+]
+
+[[package]]
+name = "quote-use-macros"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82ebfb7faafadc06a7ab141a6f67bcfb24cb8beb158c6fe933f2f035afa99f35"
+dependencies = [
+ "proc-macro-utils",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rca-tool-leptos"
+version = "0.1.0"
+dependencies = [
+ "console_log",
+ "gloo-timers",
+ "js-sys",
+ "leptos",
+ "log",
+ "serde",
+ "serde-wasm-bindgen",
+ "serde_json",
+ "supportfile",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "reactive_graph"
+version = "0.2.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35774620b3da884a07341e9e36612e1509b1eb0553ef3bb76f1547dd1b797417"
+dependencies = [
+ "any_spawner",
+ "async-lock",
+ "futures",
+ "guardian",
+ "hydration_context",
+ "indexmap",
+ "or_poisoned",
+ "paste",
+ "pin-project-lite",
+ "rustc-hash",
+ "rustc_version",
+ "send_wrapper",
+ "serde",
+ "slotmap",
+ "thiserror 2.0.18",
+ "web-sys",
+]
+
+[[package]]
+name = "reactive_stores"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e114642d342893571ff40b4e1da8ccdea907be44c649041eb7d8413b3fd95e8"
+dependencies = [
+ "guardian",
+ "indexmap",
+ "itertools",
+ "or_poisoned",
+ "paste",
+ "reactive_graph",
+ "reactive_stores_macro",
+ "rustc-hash",
+ "send_wrapper",
+]
+
+[[package]]
+name = "reactive_stores_macro"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b024812c47a6867b6cb32767a46182203f94e59eb88c69b032fd9caffa304ce"
+dependencies = [
+ "convert_case 0.11.0",
+ "proc-macro-error2",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "regex"
+version = "1.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
+
+[[package]]
+name = "rstml"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61cf4616de7499fc5164570d40ca4e1b24d231c6833a88bff0fe00725080fd56"
+dependencies = [
+ "derive-where",
+ "proc-macro2",
+ "proc-macro2-diagnostics",
+ "quote",
+ "syn",
+ "syn_derive",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
+
+[[package]]
+name = "send_wrapper"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd0b0ec5f1c1ca621c432a25813d8d60c88abe6d3e08a3eb9cf37d97a0fe3d73"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde-wasm-bindgen"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8302e169f0eddcc139c70f139d19d6467353af16f9fce27e8c30158036a1e16b"
+dependencies = [
+ "js-sys",
+ "serde",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.149"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_qs"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3faaf9e727533a19351a43cc5a8de957372163c7d35cc48c90b75cdda13c352"
+dependencies = [
+ "percent-encoding",
+ "serde",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8bbf91e5a4d6315eee45e704372590b30e260ee83af6639d64557f51b067776"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "server_fn"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c799cec4e8e210dfb2f203aa97f0e82232c619e385ef4d011b17a58d6397c7b"
+dependencies = [
+ "base64",
+ "bytes",
+ "const-str",
+ "const_format",
+ "futures",
+ "gloo-net",
+ "http",
+ "js-sys",
+ "or_poisoned",
+ "pin-project-lite",
+ "rustc_version",
+ "rustversion",
+ "send_wrapper",
+ "serde",
+ "serde_json",
+ "serde_qs",
+ "server_fn_macro_default",
+ "thiserror 2.0.18",
+ "throw_error",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wasm-streams",
+ "web-sys",
+ "xxhash-rust",
+]
+
+[[package]]
+name = "server_fn_macro"
+version = "0.8.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1295b54815397d30d986b63f93cfd515fa86d5e528e0bb589ce9d530502f9e0f"
+dependencies = [
+ "const_format",
+ "convert_case 0.11.0",
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "syn",
+ "xxhash-rust",
+]
+
+[[package]]
+name = "server_fn_macro_default"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63eb08f80db903d3c42f64e60ebb3875e0305be502bdc064ec0a0eab42207f00"
+dependencies = [
+ "server_fn_macro",
+ "syn",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "slotmap"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bdd58c3c93c3d278ca835519292445cb4b0d4dc59ccfdf7ceadaab3f8aeb4038"
+dependencies = [
+ "version_check",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "supportfile"
+version = "0.1.1"
+dependencies = [
+ "regex",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn_derive"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdb066a04799e45f5d582e8fc6ec8e6d6896040d00898eb4e6a835196815b219"
+dependencies = [
+ "proc-macro-error2",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tachys"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f768750b0d5514f487772187d4b20c66f56faff4541b1faa5aad4975f5aee085"
+dependencies = [
+ "any_spawner",
+ "async-trait",
+ "const_str_slice_concat",
+ "drain_filter_polyfill",
+ "either_of",
+ "erased",
+ "futures",
+ "html-escape",
+ "indexmap",
+ "itertools",
+ "js-sys",
+ "next_tuple",
+ "oco_ref",
+ "or_poisoned",
+ "paste",
+ "reactive_graph",
+ "reactive_stores",
+ "rustc-hash",
+ "rustc_version",
+ "send_wrapper",
+ "slotmap",
+ "throw_error",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl 2.0.18",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "throw_error"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc0ed6038fcbc0795aca7c92963ddda636573b956679204e044492d2b13c8f64"
+dependencies = [
+ "pin-project-lite",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42d3e9c45c09de15d06dd8acf5f4e0e399e85927b7f00711024eb7ae10fa4869"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "toml"
+version = "0.9.12+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863"
+dependencies = [
+ "serde_core",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_parser",
+ "winnow",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.7.5+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.0.9+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "702d4415e08923e7e1ef96cd5727c0dfed80b4d2fa25db9647fe5eb6f7c5a4c4"
+dependencies = [
+ "winnow",
+]
+
+[[package]]
+name = "typed-builder"
+version = "0.23.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31aa81521b70f94402501d848ccc0ecaa8f93c8eb6999eb9747e72287757ffda"
+dependencies = [
+ "typed-builder-macro",
+]
+
+[[package]]
+name = "typed-builder-macro"
+version = "0.23.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "076a02dc54dd46795c2e9c8282ed40bcfb1e22747e955de9389a1de28190fb26"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "typenum"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8-width"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1292c0d970b54115d14f2492fe0170adf21d68a1de108eebc51c1df4f346a091"
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "uuid"
+version = "1.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a68d3c8f01c0cfa54a75291d83601161799e4a89a39e0929f4b0354d88757a37"
+dependencies = [
+ "getrandom",
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "wasip2"
+version = "1.0.2+wasi-0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasip3"
+version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.114"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6532f9a5c1ece3798cb1c2cfdba640b9b3ba884f5db45973a6f442510a87d38e"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.64"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9c5522b3a28661442748e09d40924dfb9ca614b21c00d3fd135720e48b67db8"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "js-sys",
+ "once_cell",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.114"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18a2d50fcf105fb33bb15f00e7a77b772945a2ee45dcf454961fd843e74c18e6"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.114"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03ce4caeaac547cdf713d280eda22a730824dd11e6b8c3ca9e42247b25c631e3"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.114"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75a326b8c223ee17883a4251907455a2431acc2791c98c26279376490c378c16"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "wasm-encoder"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
+dependencies = [
+ "leb128fmt",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "wasm-encoder",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-streams"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1ec4f6517c9e11ae630e200b2b65d193279042e28edd4a2cda233e46670bbb"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "wasm_split_helpers"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a114b3073258dd5de3d812cdd048cca6842342755e828a14dbf15f843f2d1b84"
+dependencies = [
+ "async-once-cell",
+ "wasm_split_macros",
+]
+
+[[package]]
+name = "wasm_split_macros"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56481f8ed1a9f9ae97ea7b08a5e2b12e8adf9a7818a6ba952b918e09c7be8bf0"
+dependencies = [
+ "base16",
+ "quote",
+ "sha2",
+ "syn",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
+dependencies = [
+ "bitflags",
+ "hashbrown 0.15.5",
+ "indexmap",
+ "semver",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.91"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "854ba17bb104abfb26ba36da9729addc7ce7f06f5c0f90f3c391f8461cca21f9"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "winnow"
+version = "0.7.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+dependencies = [
+ "wit-bindgen-rust-macro",
+]
+
+[[package]]
+name = "wit-bindgen-core"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
+dependencies = [
+ "anyhow",
+ "heck",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-bindgen-rust"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
+dependencies = [
+ "anyhow",
+ "heck",
+ "indexmap",
+ "prettyplease",
+ "syn",
+ "wasm-metadata",
+ "wit-bindgen-core",
+ "wit-component",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
+dependencies = [
+ "anyhow",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wit-bindgen-core",
+ "wit-bindgen-rust",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
+dependencies = [
+ "anyhow",
+ "bitflags",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder",
+ "wasm-metadata",
+ "wasmparser",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid",
+ "wasmparser",
+]
+
+[[package]]
+name = "writeable"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9edde0db4769d2dc68579893f2306b26c6ecfbe0ef499b013d731b7b9247e0b9"
+
+[[package]]
+name = "xxhash-rust"
+version = "0.8.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fdd20c5420375476fbd4394763288da7eb0cc0b8c11deed431a91562af7335d3"
+
+[[package]]
+name = "yansi"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfe53a6657fd280eaa890a3bc59152892ffa3e30101319d168b781ed6529b049"
+
+[[package]]
+name = "yoke"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72d6e5c6afb84d73944e5cedb052c4680d5657337201555f9f2a16b7406d4954"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b659052874eb698efe5b9e8cf382204678a0086ebf46982b79d6ca3182927e5d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zerotrie"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a59c17a5562d507e4b54960e8569ebee33bee890c70aa3fe7b97e85a9fd7851"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c28719294829477f525be0186d13efa9a3c602f7ec202ca9e353d310fb9a002"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eadce39539ca5cb3985590102671f2567e659fca9666581ad3411d59207951f3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
diff --git a/rca-tool/web-leptos/Cargo.toml b/rca-tool/web-leptos/Cargo.toml
new file mode 100644
index 0000000..5c686d4
--- /dev/null
+++ b/rca-tool/web-leptos/Cargo.toml
@@ -0,0 +1,44 @@
+[package]
+name = "rca-tool-leptos"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+leptos = { version = "0.8", features = ["csr"] }
+wasm-bindgen = "0.2"
+wasm-bindgen-futures = "0.4"
+js-sys = "0.3"
+web-sys = { version = "0.3", features = [
+    "console",
+    "Document",
+    "DragEvent",
+    "DataTransfer",
+    "Element",
+    "ErrorEvent",
+    "Event",
+    "File",
+    "FileList",
+    "FileReader",
+    "HtmlElement",
+    "HtmlInputElement",
+    "Location",
+    "MessageEvent",
+    "ProgressEvent",
+    "Storage",
+    "Url",
+    "UrlSearchParams",
+    "Window",
+    "Worker",
+] }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+serde-wasm-bindgen = "0.6"
+gloo-timers = { version = "0.3", features = ["futures"] }
+log = "0.4"
+console_log = { version = "0.2", features = ["color"] }
+supportfile = { path = "../lib/supportfile_core" }
+
+[profile.release]
+opt-level = "z"
+lto = true
+codegen-units = 1
diff --git a/rca-tool/web-leptos/README.md b/rca-tool/web-leptos/README.md
new file mode 100644
index 0000000..07715b0
--- /dev/null
+++ b/rca-tool/web-leptos/README.md
@@ -0,0 +1,116 @@
+# RCA Tool — Leptos 0.8 Web Interface
+
+A pure client-side (CSR) WebAssembly reimplementation of the RCA Tool UI using
+[Leptos 0.8](https://leptos.dev/).
+
+## Key Properties
+
+- **No server required** — compiles to static HTML + WASM + JS files
+- **Reuses existing JS parsers** — the same Web Worker (`worker.js`) and
+  parser modules (`src/parsers/*.js`) run unchanged
+- **Stream decompression** — XZ archives are decompressed via the same
+  `liblzma-wasm` streaming pipeline
+- **Per-parser debug** — pass `?debug` in the URL to enable per-parser
+  `console.log` output from the JS worker
+
+## Prerequisites
+
+- Rust 1.75+ with `wasm32-unknown-unknown` target:
+  ```bash
+  rustup target add wasm32-unknown-unknown
+  ```
+- [Trunk](https://trunkrs.dev/) 0.21+:
+  ```bash
+  cargo install trunk
+  ```
+
+## Build
+
+```bash
+./build.sh            # copies JS assets + runs trunk build
+```
+
+Or manually:
+```bash
+# 1. Copy JS assets (worker, parsers, liblzma-wasm)
+mkdir -p assets/parsers assets/liblzma-wasm/dist-streaming
+cp ../src/worker.js assets/liblzma-streaming-worker.js
+cp ../src/parsers/*.js assets/parsers/
+cp ../src/utils.js assets/
+cp ../src/performance.js assets/
+cp -r ../web/liblzma-wasm/dist-streaming/* assets/liblzma-wasm/dist-streaming/
+
+# 2. Build with trunk
+trunk build
+```
+
+Output goes to `dist/`.
+
+## Serve Locally
+
+```bash
+trunk serve --open     # starts dev server on http://localhost:8090
+```
+
+Or serve the `dist/` directory with any static file server.
+
+## Architecture
+
+```
+web-leptos/
+├── Cargo.toml          # Rust dependencies (leptos 0.8 csr, web-sys, serde)
+├── Trunk.toml          # Trunk build config
+├── index.html          # Trunk entry point
+├── styles.css          # Shared CSS (copied from web/styles.css)
+├── build.sh            # Build helper script
+├── assets/             # JS runtime files (generated by build.sh)
+│   ├── liblzma-streaming-worker.js
+│   ├── parsers/*.js
+│   ├── liblzma-wasm/dist-streaming/
+│   ├── utils.js
+│   └── performance.js
+└── src/
+    ├── main.rs          # App entry point, mounts Leptos to <body>
+    ├── types.rs         # Rust types mirroring JS analysis results
+    ├── worker_bridge.rs # web_sys::Worker interop (postMessage protocol)
+    └── components/
+        ├── mod.rs
+        ├── theme_toggle.rs   # Dark / Light / Colorblind toggle
+        ├── drop_zone.rs      # File upload (drag-and-drop + input)
+        ├── progress_bar.rs   # Decompression / parsing progress
+        ├── analysis_view.rs  # Routes to section renderers
+        └── sections/
+            ├── mod.rs
+            ├── helpers.rs     # Shared: Section, KvTable, JsonDump
+            ├── azure_vm.rs    # Azure VM Properties + Extensions
+            ├── cluster.rs     # Cluster Configuration
+            ├── distribution.rs # RHUI, FIPS, Leapp, Packages
+            ├── events.rs      # Events (OOM, reboot, XFS, SSH, etc.)
+            ├── networking.rs   # Interfaces + Firewall
+            ├── kernel.rs       # Kernel tuning, time sync, debugfs, vmcore
+            ├── storage.rs      # LVM, RAID, BTRFS, fstab, NVMe
+            └── archive.rs      # Archive contents summary
+```
+
+## How It Works
+
+1. User drops an archive file (sosreport `.tar.xz`, supportconfig, InspectIaaSDisk `.zip`)
+2. Leptos reads the file via `FileReader`, detects the format (magic bytes)
+3. A `web_sys::Worker` is created pointing to `liblzma-streaming-worker.js`
+4. The worker decompresses → parses → posts progress and results back
+5. Leptos deserializes the result via `serde-wasm-bindgen` into `AnalysisResult`
+6. Reactive components render each section (Azure VM, Cluster, Distribution, etc.)
+
+## Status
+
+This is an initial implementation. Some sections render their data as pretty-printed
+JSON (`JsonDump`) rather than full structured tables. The sections that are fully
+rendered include:
+
+- Azure VM Properties (key-value tables)
+- FIPS Status (6-source table)
+- Events (per-category with counts)
+- Networking (interface table)
+- Archive Contents (file type summary)
+
+All other sections display via `JsonDump` and can be iteratively improved.
diff --git a/rca-tool/web-leptos/Trunk.toml b/rca-tool/web-leptos/Trunk.toml
new file mode 100644
index 0000000..ec1b0dd
--- /dev/null
+++ b/rca-tool/web-leptos/Trunk.toml
@@ -0,0 +1,6 @@
+[build]
+target = "index.html"
+dist = "dist"
+
+[serve]
+port = 8090
diff --git a/rca-tool/web-leptos/build.sh b/rca-tool/web-leptos/build.sh
new file mode 100755
index 0000000..9d14664
--- /dev/null
+++ b/rca-tool/web-leptos/build.sh
@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# Build the Leptos CSR web interface for RCA Tool.
+#
+# This script:
+#   1. (Re)builds the supportfile WASM module from supportfile_wasm/
+#      (skip with SKIP_WASM_BUILD=1 if pkg/ is already up to date)
+#   2. Copies the JS worker, parsers, and WASM runtime into assets/
+#   3. Runs `trunk build` to produce dist/
+#
+# The dist/ directory is fully self-contained and can be served from
+# any static file server (or opened via file://).
+set -euo pipefail
+cd "$(dirname "$0")"
+
+SUPPORTFILE_WASM_DIR="../lib/supportfile_wasm"
+SUPPORTFILE_WASM_PKG="${SUPPORTFILE_WASM_DIR}/pkg"
+LZMA_STREAM_WASM_DIR="../lib/lzma_stream_wasm"
+LZMA_STREAM_WASM_PKG="${LZMA_STREAM_WASM_DIR}/pkg"
+
+if [[ "${SKIP_WASM_BUILD:-0}" != "1" ]]; then
+    echo "==> Building supportfile WASM (wasm-pack, target=no-modules, release)…"
+    (cd "${SUPPORTFILE_WASM_DIR}" && wasm-pack build --target no-modules --release --out-dir pkg)
+else
+    echo "==> SKIP_WASM_BUILD=1 — using existing ${SUPPORTFILE_WASM_PKG}/"
+fi
+
+if [[ "${SKIP_LZMA_WASM_BUILD:-0}" != "1" ]]; then
+    echo "==> Building Rust XZ streaming WASM (wasm-pack, target=no-modules, release)…"
+    (cd "${LZMA_STREAM_WASM_DIR}" && wasm-pack build --target no-modules --release --out-dir pkg)
+else
+    echo "==> SKIP_LZMA_WASM_BUILD=1 — using existing ${LZMA_STREAM_WASM_PKG}/"
+fi
+
+# Avoid global name collisions between supportfile_wasm.js and lzma_stream_wasm.js
+# (both are wasm-pack no-modules bundles that default to `wasm_bindgen`).
+if grep -q '^let wasm_bindgen =' "${LZMA_STREAM_WASM_PKG}/lzma_stream_wasm.js"; then
+    # Portable in-place edit: BSD/macOS `sed -i` requires a backup-suffix
+    # argument and would otherwise misparse the file path as the script, so
+    # edit via a temp file instead.
+    _sed_tmp="$(mktemp)"
+    sed 's/^let wasm_bindgen =/let lzma_bindgen =/' "${LZMA_STREAM_WASM_PKG}/lzma_stream_wasm.js" > "${_sed_tmp}"
+    mv "${_sed_tmp}" "${LZMA_STREAM_WASM_PKG}/lzma_stream_wasm.js"
+fi
+
+echo "==> Building bundled worker asset…"
+mkdir -p assets/lzma-stream-wasm assets/supportfile-wasm
+cat \
+    ../src/wasm-bridge.js \
+    ../src/parsers/unix.js \
+    ../src/parsers/services.js \
+    ../src/parsers/events.js \
+    ../src/parsers/azure.js \
+    ../src/parsers/cluster.js \
+    ../src/parsers/storage.js \
+    ../src/parsers/hana.js \
+    ../src/parsers/networking.js \
+    ../src/parsers/network-interfaces.js \
+    ../src/parsers/vmcore.js \
+    ../src/parsers/debugfs.js \
+    ../src/worker.js > assets/liblzma-streaming-worker.js
+
+cp "${LZMA_STREAM_WASM_PKG}/lzma_stream_wasm.js"      assets/lzma-stream-wasm/
+cp "${LZMA_STREAM_WASM_PKG}/lzma_stream_wasm_bg.wasm" assets/lzma-stream-wasm/
+cp "${SUPPORTFILE_WASM_PKG}/supportfile_wasm.js"     assets/supportfile-wasm/
+cp "${SUPPORTFILE_WASM_PKG}/supportfile_wasm_bg.wasm" assets/supportfile-wasm/
+
+echo "==> Cleaning previous build output…"
+rm -rf dist .stage
+
+PUBLIC_URL="${PUBLIC_URL:-./}"
+ASSET_VERSION="${ASSET_VERSION:-${GITHUB_SHA:-$(git rev-parse --short=12 HEAD 2>/dev/null || echo dev)}}"
+export ASSET_VERSION
+
+echo "==> Running trunk build (release, public URL: ${PUBLIC_URL}, asset version: ${ASSET_VERSION})…"
+trunk build --release --public-url "$PUBLIC_URL" "$@"
+
+echo "==> Done.  Output in dist/"
+ls -lh dist/
diff --git a/rca-tool/web-leptos/index.html b/rca-tool/web-leptos/index.html
new file mode 100644
index 0000000..5956b96
--- /dev/null
+++ b/rca-tool/web-leptos/index.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>RCA Tool — Leptos</title>
+    <link data-trunk rel="rust" data-wasm-opt="z" />
+    <link data-trunk rel="css" href="styles.css" />
+    <!-- Copy the JS worker, parsers, utils and WASM runtime into dist -->
+    <link data-trunk rel="copy-dir" href="assets" />
+</head>
+<body class="dark-mode">
+</body>
+</html>
diff --git a/rca-tool/web-leptos/src/components/analysis_view.rs b/rca-tool/web-leptos/src/components/analysis_view.rs
new file mode 100644
index 0000000..95023cc
--- /dev/null
+++ b/rca-tool/web-leptos/src/components/analysis_view.rs
@@ -0,0 +1,112 @@
+use leptos::prelude::*;
+
+use crate::worker_bridge::WorkerResult;
+
+use super::sections::archive::ArchiveSection;
+use super::sections::azure_vm::{
+    AzureExtensionsSection, AzureVmSection, SecureBootSection, WaagentLogSection,
+};
+use super::sections::cluster::{ApplicationsSection, ClusterSection, SapInstanceSection};
+use super::sections::deadlocks::DeadlocksSection;
+use super::sections::distribution::DistributionSection;
+use super::sections::events::EventsSection;
+use super::sections::hana::HanaSection;
+use super::sections::kernel::{KernelCrashSection, KernelSection};
+use super::sections::merge_errors::MergeErrorsSection;
+use super::sections::networking::NetworkingSection;
+use super::sections::oom::OomSection;
+use super::sections::os_tuning::OsTuningSection;
+use super::sections::services::ServicesAntivirusSection;
+use super::sections::storage::{InspectDiskSection, StorageSection};
+
+fn format_bytes(bytes: f64) -> String {
+    const UNITS: [&str; 5] = ["B", "KB", "MB", "GB", "TB"];
+    let mut value = bytes.max(0.0);
+    let mut unit = 0usize;
+    while value >= 1024.0 && unit < UNITS.len() - 1 {
+        value /= 1024.0;
+        unit += 1;
+    }
+    if unit == 0 {
+        format!("{value:.0} {}", UNITS[unit])
+    } else {
+        format!("{value:.1} {}", UNITS[unit])
+    }
+}
+
+/// Renders the full analysis once the worker is done.
+#[component]
+pub fn AnalysisView(result: ReadSignal<WorkerResult>) -> impl IntoView {
+    move || match result.get() {
+        WorkerResult::InProgress => view! {}.into_any(),
+
+        WorkerResult::Error(msg) => view! {
+            <div class="error-banner">
+                <h2>"Analysis Error"</h2>
+                <p>{msg}</p>
+            </div>
+        }
+        .into_any(),
+
+        WorkerResult::Success {
+            analysis,
+            total_decompressed,
+            partial,
+        } => {
+            let json = analysis;
+
+            let partial_banner = partial.then(|| {
+                let msg = json
+                    .get("corruptionMessage")
+                    .and_then(|v| v.as_str())
+                    .unwrap_or("Archive may be partially corrupted.")
+                    .to_string();
+                let progress_summary = if total_decompressed > 0.0 {
+                    format!(
+                        "Processed {} of decompressed data before corruption was detected.",
+                        format_bytes(total_decompressed)
+                    )
+                } else {
+                    "Processed a partial amount of decompressed data before corruption was detected."
+                        .to_string()
+                };
+                view! {
+                    <div class="warning-banner">
+                        <strong>"⚠ Partial Analysis — "</strong>{msg}
+                        <div><small>{progress_summary}</small></div>
+                    </div>
+                }
+            });
+
+            view! {
+                <div class="analysis-results">
+                    {partial_banner}
+
+                    // Sections in the same order as the original HTML
+                    <AzureVmSection data=json.clone()/>
+                    <SecureBootSection data=json.clone()/>
+                    <WaagentLogSection data=json.clone()/>
+                    <InspectDiskSection data=json.clone()/>
+                    <ClusterSection data=json.clone()/>
+                    <ApplicationsSection data=json.clone()/>
+                    <SapInstanceSection data=json.clone()/>
+                    <DistributionSection data=json.clone()/>
+                    <EventsSection data=json.clone()/>
+                    <KernelCrashSection data=json.clone()/>
+                    <NetworkingSection data=json.clone()/>
+                    <ServicesAntivirusSection data=json.clone()/>
+                    <AzureExtensionsSection data=json.clone()/>
+                    <KernelSection data=json.clone()/>
+                    <OsTuningSection data=json.clone()/>
+                    <StorageSection data=json.clone()/>
+                    <HanaSection data=json.clone()/>
+                    <DeadlocksSection data=json.clone()/>
+                    <OomSection data=json.clone()/>
+                    <MergeErrorsSection data=json.clone()/>
+                    <ArchiveSection data=json.clone()/>
+                </div>
+            }
+            .into_any()
+        }
+    }
+}
diff --git a/rca-tool/web-leptos/src/components/drop_zone.rs b/rca-tool/web-leptos/src/components/drop_zone.rs
new file mode 100644
index 0000000..677501d
--- /dev/null
+++ b/rca-tool/web-leptos/src/components/drop_zone.rs
@@ -0,0 +1,115 @@
+use leptos::prelude::*;
+use wasm_bindgen::prelude::*;
+use wasm_bindgen::JsCast;
+use web_sys::{Event, File, FileList, FileReader, HtmlInputElement};
+
+use crate::worker_bridge::{console_dbg, detect_format, FileFormat};
+
+/// Sniff the first bytes of an ArrayBuffer for format detection without
+/// copying the entire file into wasm linear memory. We allocate at most
+/// `SNIFF_BYTES` bytes inside wasm; the full ArrayBuffer stays in the JS
+/// heap and is later transferred (zero-copy) to the worker.
+const SNIFF_BYTES: u32 = 512;
+
+fn detect_format_from_buffer(array_buf: &js_sys::ArrayBuffer) -> FileFormat {
+    let total = array_buf.byte_length();
+    let len = total.min(SNIFF_BYTES);
+    let head = js_sys::Uint8Array::new_with_byte_offset_and_length(array_buf, 0, len);
+    let mut buf = vec![0u8; len as usize];
+    head.copy_to(&mut buf);
+    detect_format(&buf)
+}
+
+fn read_file(file: File, on_file: Callback<(String, js_sys::ArrayBuffer, FileFormat)>) {
+    let name = file.name();
+    let reader = FileReader::new().unwrap();
+    let reader_clone = reader.clone();
+
+    let onload = Closure::<dyn FnMut(Event)>::new(move |_ev: Event| {
+        let result = reader_clone.result().unwrap();
+        let array_buf = result.dyn_into::<js_sys::ArrayBuffer>().unwrap();
+        let fmt = detect_format_from_buffer(&array_buf);
+        console_dbg!(
+            "[Leptos] Loaded {} ({} bytes, format={fmt})",
+            name,
+            array_buf.byte_length()
+        );
+        on_file.run((name.clone(), array_buf, fmt));
+    });
+
+    reader.set_onload(Some(onload.as_ref().unchecked_ref()));
+    onload.forget();
+    reader.read_as_array_buffer(&file).unwrap();
+}
+
+pub fn handle_file_list(
+    files: FileList,
+    on_file: Callback<(String, js_sys::ArrayBuffer, FileFormat)>,
+) -> bool {
+    let count = files.length();
+
+    if let Some(file) = files.item(0) {
+        if count > 1 {
+            console_dbg!(
+                "[Leptos] {} files received; starting with the first one: {}",
+                count,
+                file.name()
+            );
+        }
+        read_file(file, on_file);
+        true
+    } else {
+        false
+    }
+}
+
+/// File drop zone and file-input button.
+///
+/// When a file is loaded it calls `on_file` with `(filename, buffer, format)`.
+/// `buffer` is a JS-heap `ArrayBuffer` that callers should transfer (not copy)
+/// to a worker so that multi-GB files do not exhaust wasm linear memory.
+#[component]
+pub fn DropZone(
+    #[prop(into)] on_file: Callback<(String, js_sys::ArrayBuffer, FileFormat)>,
+    dragging: ReadSignal<bool>,
+) -> impl IntoView {
+    // -- file input change ------------------------------------------------
+
+    let on_input_change = move |ev: Event| {
+        let input: HtmlInputElement = ev.target().unwrap().dyn_into().unwrap();
+        if let Some(files) = input.files() {
+            handle_file_list(files, on_file.clone());
+        }
+    };
+
+    view! {
+        <div
+            id="drop-zone"
+            class=move || {
+                if dragging.get() {
+                    "drop-zone drop-zone--active"
+                } else {
+                    "drop-zone"
+                }
+            }
+        >
+            <h2>"Drag and Drop Support File"</h2>
+            <p>
+                "Choose a .tar.gz, .tar.xz, or .zip cluster file (hb_report, crm_report, supportconfig, or sosreport)"
+            </p>
+            <p>"Or a plain text console log file (.log)"</p>
+            <p class="drop-zone__support-note">"Supports gzip, XZ, and ZIP compression"</p>
+            <input
+                id="file-input"
+                type="file"
+                accept=".txz,.tar.xz,.tar.gz,.tgz,.zip,.txt,.log"
+                aria-label="Drag and drop support file (.tar.gz, .tar.xz, .zip, or .log)"
+                on:change=on_input_change
+                class="drop-zone__input"
+            />
+            <p id="detection-warning" class="detection-warning">
+                "Detection is pattern-based and not exhaustive. Missing findings may reflect unimplemented detectors rather than absence of issues. Manual review of the source report (hb_report, SCC, sosreport) is recommended."
+            </p>
+        </div>
+    }
+}
diff --git a/rca-tool/web-leptos/src/components/mod.rs b/rca-tool/web-leptos/src/components/mod.rs
new file mode 100644
index 0000000..053399a
--- /dev/null
+++ b/rca-tool/web-leptos/src/components/mod.rs
@@ -0,0 +1,5 @@
+pub mod analysis_view;
+pub mod drop_zone;
+pub mod progress_bar;
+pub mod sections;
+pub mod theme_toggle;
diff --git a/rca-tool/web-leptos/src/components/progress_bar.rs b/rca-tool/web-leptos/src/components/progress_bar.rs
new file mode 100644
index 0000000..aa60721
--- /dev/null
+++ b/rca-tool/web-leptos/src/components/progress_bar.rs
@@ -0,0 +1,71 @@
+use leptos::prelude::*;
+
+use crate::worker_bridge::ProgressState;
+
+/// Displays a progress bar with file-count, decompressed size, and current file.
+#[component]
+pub fn ProgressBar(progress: ReadSignal<ProgressState>) -> impl IntoView {
+    let pct = move || {
+        let raw = progress.get().percent;
+        let scaled = if raw <= 1.0 { raw * 100.0 } else { raw };
+        scaled.clamp(0.0, 100.0)
+    };
+    let pct_text = move || format!("{:.0}%", pct());
+
+    let decompressed = move || {
+        let bytes = progress.get().decompressed_bytes;
+        format_bytes(bytes)
+    };
+
+    let file_count = move || progress.get().file_count;
+    let current_file = move || {
+        let f = progress.get().current_file.clone();
+        if f.is_empty() {
+            "Waiting for worker output…".to_string()
+        } else {
+            // show last path component
+            f.rsplit('/').next().unwrap_or(&f).to_string()
+        }
+    };
+    let status_message = move || {
+        let msg = progress.get().message.trim().to_string();
+        if msg.is_empty() {
+            format!("Processing {:.0}%…", pct())
+        } else {
+            msg
+        }
+    };
+
+    view! {
+        <div class="progress-container" role="status" aria-live="polite">
+            <div class="progress-meta">
+                <span class="progress-label">"Analysis progress"</span>
+                <span class="progress-percent">{pct_text}</span>
+            </div>
+
+            <progress class="progress-bar" max="100" value=move || pct().to_string()>
+                {pct_text}
+            </progress>
+
+            <p class="progress-message">{status_message}</p>
+
+            <div class="progress-stats">
+                <span class="progress-stats__files">{move || format!("{} files", file_count())}</span>
+                <span class="progress-stats__size">{move || format!("{} decompressed", decompressed())}</span>
+                <span class="progress-stats__current" title=current_file.clone()>{current_file}</span>
+            </div>
+        </div>
+    }
+}
+
+fn format_bytes(b: f64) -> String {
+    if b < 1024.0 {
+        format!("{b:.0} B")
+    } else if b < 1024.0 * 1024.0 {
+        format!("{:.1} KB", b / 1024.0)
+    } else if b < 1024.0 * 1024.0 * 1024.0 {
+        format!("{:.1} MB", b / (1024.0 * 1024.0))
+    } else {
+        format!("{:.2} GB", b / (1024.0 * 1024.0 * 1024.0))
+    }
+}
diff --git a/rca-tool/web-leptos/src/components/sections/archive.rs b/rca-tool/web-leptos/src/components/sections/archive.rs
new file mode 100644
index 0000000..acc70fd
--- /dev/null
+++ b/rca-tool/web-leptos/src/components/sections/archive.rs
@@ -0,0 +1,69 @@
+use leptos::prelude::*;
+use serde_json::Value;
+
+use super::helpers::*;
+
+/// Section 17 – Archive Contents (always rendered).
+#[component]
+pub fn ArchiveSection(data: Value) -> impl IntoView {
+    let file_count = data.get("fileCount").and_then(|v| v.as_u64()).unwrap_or(0);
+    let directories = data
+        .get("directories")
+        .and_then(|v| v.as_u64())
+        .unwrap_or(0);
+    let total_parsed = data
+        .get("totalParsed")
+        .and_then(|v| v.as_u64())
+        .unwrap_or(0);
+    let nested_gzip_total_count = data
+        .get("nestedGzipTotalCount")
+        .and_then(|v| v.as_u64())
+        .unwrap_or(0);
+    let nested_gzip_count = data
+        .get("nestedGzipCount")
+        .and_then(|v| v.as_u64())
+        .unwrap_or(0);
+    let nested_gzip_compressed_bytes = data
+        .get("nestedGzipCompressedBytes")
+        .and_then(|v| v.as_f64())
+        .unwrap_or(0.0);
+    let nested_gzip_decompressed_bytes = data
+        .get("nestedGzipDecompressedBytes")
+        .and_then(|v| v.as_f64())
+        .unwrap_or(0.0);
+
+    view! {
+        <Section title="Archive Contents" class="content-details">
+            <KvTable>
+                <KvRow label="Files" value=file_count.to_string()/>
+                <KvRow label="Directories" value=directories.to_string()/>
+                <KvRow label="Parsed" value=total_parsed.to_string()/>
+            </KvTable>
+            {(nested_gzip_total_count > 0).then(|| {
+                let mut summary = format!(
+                    "{} .gz file{} found",
+                    nested_gzip_total_count,
+                    if nested_gzip_total_count == 1 { "" } else { "s" },
+                );
+                if nested_gzip_count > 0 {
+                    summary.push_str(&format!(" ({} decompressed", nested_gzip_count));
+                    if nested_gzip_compressed_bytes > 0.0 && nested_gzip_decompressed_bytes > 0.0 {
+                        summary.push_str(&format!(
+                            ": {:.1} MB → {:.1} MB",
+                            nested_gzip_compressed_bytes / 1024.0 / 1024.0,
+                            nested_gzip_decompressed_bytes / 1024.0 / 1024.0,
+                        ));
+                    }
+                    summary.push(')');
+                }
+                view! {
+                    <p>
+                        <strong>"Nested Compression:"</strong>
+                        {format!(" {}", summary)}
+                    </p>
+                }
+            })}
+        </Section>
+    }
+    .into_any()
+}
diff --git a/rca-tool/web-leptos/src/components/sections/azure_vm.rs b/rca-tool/web-leptos/src/components/sections/azure_vm.rs
new file mode 100644
index 0000000..16b8e6f
--- /dev/null
+++ b/rca-tool/web-leptos/src/components/sections/azure_vm.rs
@@ -0,0 +1,889 @@
+use leptos::prelude::*;
+use serde_json::Value;
+
+use super::helpers::*;
+
+/// Section 1 – Azure VM Properties + OS Release + Waagent Config.
+#[component]
+pub fn AzureVmSection(data: Value) -> impl IntoView {
+    let vm = data
+        .get("azureVMProperties")
+        .cloned()
+        .unwrap_or(Value::Null);
+    let os = data.get("osRelease").cloned().unwrap_or(Value::Null);
+    let wa = data.get("waagentConfig").cloned().unwrap_or(Value::Null);
+
+    let has_vm = json_bool(&vm, "found");
+    let has_os = json_bool(&os, "found");
+    let has_wa = json_bool(&wa, "found");
+
+    if !has_vm && !has_os && !has_wa {
+        return view! {}.into_any();
+    }
+
+    let vm_name = json_str(&vm, "vmName");
+    let vm_size = json_str(&vm, "vmSize");
+    let location = json_str(&vm, "location");
+    let publisher = json_str(&vm, "publisher");
+    let offer = json_str(&vm, "offer");
+    let sku = json_str(&vm, "sku");
+    let version = json_str(&vm, "version");
+    let billing_code = json_str(&vm, "billingCode");
+    let billing_model = json_str(&vm, "billingModel");
+    let detection_method = json_str(&vm, "detectionMethod");
+    let license_type = json_str(&vm, "licenseType");
+    let registration_server = {
+        let direct = json_str(&vm, "registrationServer");
+        if direct.is_empty() {
+            json_str(&vm, "suseRegistrationServer")
+        } else {
+            direct
+        }
+    };
+    let registration_type = {
+        let direct = json_str(&vm, "registrationType");
+        if direct.is_empty() {
+            json_str(&vm, "suseRegistrationType")
+        } else {
+            direct
+        }
+    };
+    let alternative_billing_model = json_str(&vm, "alternativeBillingModel");
+    let alternative_detection_method = json_str(&vm, "alternativeDetectionMethod");
+    let os_disk_type = json_str(&vm, "osDiskType");
+    let data_disks = json_array(&vm, "dataDisks");
+
+    let pretty_name = {
+        let pretty = json_str(&os, "prettyName");
+        if !pretty.is_empty() {
+            pretty
+        } else {
+            let distro = json_str(&os, "distribution");
+            if !distro.is_empty() {
+                distro
+            } else {
+                json_str(&os, "name")
+            }
+        }
+    };
+    let os_version = {
+        let version_id = json_str(&os, "versionId");
+        if !version_id.is_empty() {
+            version_id
+        } else {
+            let major = json_str(&os, "majorVersion");
+            let minor = json_str(&os, "minorVersion");
+            if !major.is_empty() && !minor.is_empty() {
+                format!("{major}.{minor}")
+            } else if !major.is_empty() {
+                major
+            } else {
+                minor
+            }
+        }
+    };
+    let os_warnings = json_array(&os, "warnings");
+
+    let wa_summary = wa.get("summary").cloned().unwrap_or(Value::Null);
+    let wa_warnings = json_array(&wa, "warnings");
+    let extensions_enabled = wa_summary
+        .get("extensionsEnabled")
+        .and_then(|v| v.as_bool());
+    let provisioning_agent = json_str(&wa_summary, "provisioningAgent");
+    let enable_firewall = wa_summary.get("enableFirewall").and_then(|v| v.as_bool());
+    let resource_disk_enable_swap = wa_summary
+        .get("resourceDiskEnableSwap")
+        .and_then(|v| v.as_bool());
+    let resource_disk_swap_size_mb = wa_summary
+        .get("resourceDiskSwapSizeMB")
+        .and_then(|v| v.as_i64());
+    let resource_disk_format = wa_summary
+        .get("resourceDiskFormat")
+        .and_then(|v| v.as_bool());
+    let resource_disk_mount_point = json_str(&wa_summary, "resourceDiskMountPoint");
+    let root_device_scsi_timeout = wa_summary
+        .get("rootDeviceScsiTimeout")
+        .and_then(|v| v.as_i64());
+    let auto_update_enabled = wa_summary.get("autoUpdateEnabled").and_then(|v| v.as_bool());
+    let auto_update_ga_family = json_str(&wa_summary, "autoUpdateGAFamily");
+
+    let billing_badge_class = match billing_model.as_str() {
+        "BYOS" => "badge badge-warning",
+        "PAYG" => "badge badge-info",
+        _ => "badge",
+    };
+
+    view! {
+        <Section title="Azure VM Properties" class="success-block" open=true>
+            <div class="vm-properties">
+                {(!vm_size.is_empty()).then(|| view! {
+                    <p class="vm-inline-row">
+                        <strong>"VM Size:"</strong>
+                        " "
+                        <code>{vm_size.clone()}</code>
+                    </p>
+                })}
+                {(!vm_name.is_empty()).then(|| view! {
+                    <p class="vm-inline-row">
+                        <strong>"VM Name:"</strong>
+                        " "
+                        <code>{vm_name.clone()}</code>
+                    </p>
+                })}
+                {(!location.is_empty()).then(|| view! {
+                    <p class="vm-inline-row"><strong>"Location:"</strong> " " <code>{location.clone()}</code></p>
+                })}
+                {(!publisher.is_empty()).then(|| view! {
+                    <p class="vm-inline-row"><strong>"Publisher:"</strong> " " <code>{publisher.clone()}</code></p>
+                })}
+                {(!offer.is_empty()).then(|| view! {
+                    <p class="vm-inline-row"><strong>"Offer:"</strong> " " <code>{offer.clone()}</code></p>
+                })}
+                {(!sku.is_empty()).then(|| view! {
+                    <p class="vm-inline-row"><strong>"SKU:"</strong> " " <code>{sku.clone()}</code></p>
+                })}
+                {(!version.is_empty()).then(|| view! {
+                    <p class="vm-inline-row"><strong>"Version:"</strong> " " <code>{version.clone()}</code></p>
+                })}
+                {(!billing_code.is_empty()).then(|| view! {
+                    <p class="vm-inline-row"><strong>"Billing Code:"</strong> " " <code>{billing_code.clone()}</code></p>
+                })}
+
+                {has_vm.then(|| view! {
+                    <div class="subsection">
+                        <p class="subsection-title">"Billing Model:"</p>
+                        {if billing_model.is_empty() {
+                            view! {
+                                <p class="text-muted"><em>"Unable to determine billing model"</em></p>
+                            }.into_any()
+                        } else {
+                            view! {
+                                <p class="vm-inline-row">
+                                    <strong>"Type:"</strong>
+                                    " "
+                                    <span class=billing_badge_class>{billing_model.clone()}</span>
+                                </p>
+                                {(!detection_method.is_empty()).then(|| view! {
+                                    <p class="text-muted"><em>{format!("Detected via: {detection_method}")}</em></p>
+                                })}
+                                {((!registration_server.is_empty()) || (!registration_type.is_empty()) || (!alternative_billing_model.is_empty())).then(|| view! {
+                                    <div class="vm-note info">
+                                        <p class="subsection-title">"SUSE Registration:"</p>
+                                        {(!registration_type.is_empty()).then(|| view! {
+                                            <p class="vm-inline-row"><strong>"Type:"</strong> " " {registration_type.clone()}</p>
+                                        })}
+                                        {(!registration_server.is_empty()).then(|| view! {
+                                            <p class="vm-inline-row"><strong>"Server:"</strong> " " <code>{registration_server.clone()}</code></p>
+                                        })}
+                                        {(!alternative_billing_model.is_empty()).then(|| view! {
+                                            <p class="text-warning-dark">
+                                                <em>{format!("[!] Alternative detection suggests: {}", alternative_billing_model.clone())}</em>
+                                            </p>
+                                        })}
+                                        {(!alternative_detection_method.is_empty()).then(|| view! {
+                                            <p class="text-muted"><em>{alternative_detection_method.clone()}</em></p>
+                                        })}
+                                    </div>
+                                })}
+                            }
+                            .into_any()
+                        }}
+                        {(!license_type.is_empty()).then(|| view! {
+                            <p class="vm-inline-row"><strong>"License Type:"</strong> " " <code>{license_type.clone()}</code></p>
+                        })}
+                    </div>
+                })}
+
+                {(has_vm && (!os_disk_type.is_empty() || !data_disks.is_empty())).then(|| view! {
+                    <div class="subsection">
+                        <p class="subsection-title">"Storage:"</p>
+                        {(!os_disk_type.is_empty()).then(|| view! {
+                            <p class="vm-inline-row">
+                                <strong>"OS Disk:"</strong>
+                                " "
+                                <span class=disk_badge_class(&os_disk_type)>{display_disk_type(&os_disk_type)}</span>
+                            </p>
+                        })}
+                        {(!data_disks.is_empty()).then(|| view! {
+                            <>
+                                <p class="vm-inline-row">
+                                    <strong>"Data Disks:"</strong>
+                                    " "
+                                    {format!("{} disk(s)", data_disks.len())}
+                                </p>
+                                <ul class="disk-list">
+                                    {data_disks
+                                        .iter()
+                                        .map(|disk| {
+                                            let lun = disk
+                                                .get("lun")
+                                                .or_else(|| disk.get("LUN"))
+                                                .and_then(value_as_text)
+                                                .unwrap_or_else(|| "?".to_string());
+                                            let size = disk
+                                                .get("diskSizeGB")
+                                                .or_else(|| disk.get("diskSizeGb"))
+                                                .or_else(|| disk.get("sizeGB"))
+                                                .and_then(value_as_text)
+                                                .map(|v| format!(" ({v} GB)"))
+                                                .unwrap_or_default();
+                                            let disk_type = json_str(disk, "storageAccountType");
+                                            view! {
+                                                <li>
+                                                    {format!("LUN {lun}{size}: ")}
+                                                    <span class=disk_badge_class(&disk_type)>{display_disk_type(&disk_type)}</span>
+                                                </li>
+                                            }
+                                        })
+                                        .collect::<Vec<_>>()}
+                                </ul>
+                            </>
+                        })}
+                    </div>
+                })}
+
+                {has_os.then(|| view! {
+                    <div class="subsection">
+                        <p class="subsection-title">"Operating System:"</p>
+                        {(!pretty_name.is_empty()).then(|| view! {
+                            <p class="vm-inline-row"><strong>"Distribution:"</strong> " " <code>{pretty_name.clone()}</code></p>
+                        })}
+                        {(!os_version.is_empty()).then(|| view! {
+                            <p class="vm-inline-row"><strong>"Version:"</strong> " " <code>{os_version.clone()}</code></p>
+                        })}
+                        {os_warnings
+                            .into_iter()
+                            .map(|warning| {
+                                let message = json_str(&warning, "message");
+                                let recommendation = json_str(&warning, "recommendation");
+                                view! {
+                                    <div class="vm-note warning">
+                                        <p><strong>{format!("[!] {message}")}</strong></p>
+                                        {(!recommendation.is_empty()).then(|| view! {
+                                            <p>{recommendation}</p>
+                                        })}
+                                    </div>
+                                }
+                            })
+                            .collect::<Vec<_>>()}
+                    </div>
+                })}
+
+                {has_wa.then(|| view! {
+                    <div class="subsection">
+                        <p class="subsection-title">"Azure Linux Agent Configuration:"</p>
+                        <div class="property-grid">
+                            {extensions_enabled.map(|enabled| view! {
+                                <>
+                                    <span class="property-label">"Extensions:"</span>
+                                    <span class=if enabled { "badge badge-success" } else { "badge badge-danger" }>
+                                        {if enabled { "Enabled" } else { "Disabled" }}
+                                    </span>
+                                </>
+                            })}
+                            {(!provisioning_agent.is_empty()).then(|| view! {
+                                <>
+                                    <span class="property-label">"Provisioning Agent:"</span>
+                                    <code class="property-value">{provisioning_agent.clone()}</code>
+                                </>
+                            })}
+                            {enable_firewall.map(|enabled| view! {
+                                <>
+                                    <span class="property-label">"OS Firewall:"</span>
+                                    <span class=if enabled { "badge badge-success" } else { "badge badge-warning" }>
+                                        {if enabled { "Enabled" } else { "Disabled" }}
+                                    </span>
+                                </>
+                            })}
+                            {resource_disk_enable_swap.map(|enabled| {
+                                let label = if enabled {
+                                    if let Some(size) = resource_disk_swap_size_mb {
+                                        format!("Enabled ({size} MB)")
+                                    } else {
+                                        "Enabled".to_string()
+                                    }
+                                } else {
+                                    "Disabled".to_string()
+                                };
+                                view! {
+                                    <>
+                                        <span class="property-label">"Resource Disk Swap:"</span>
+                                        <span class=if enabled { "badge badge-info" } else { "badge badge-success" }>{label}</span>
+                                    </>
+                                }
+                            })}
+                            {resource_disk_format.map(|enabled| view! {
+                                <>
+                                    <span class="property-label">"Resource Disk Format:"</span>
+                                    <span class="property-value">{if enabled { "Yes" } else { "No" }}</span>
+                                </>
+                            })}
+                            {(!resource_disk_mount_point.is_empty()).then(|| view! {
+                                <>
+                                    <span class="property-label">"Resource Disk Mount:"</span>
+                                    <code class="property-value">{resource_disk_mount_point.clone()}</code>
+                                </>
+                            })}
+                            {root_device_scsi_timeout.map(|timeout| view! {
+                                <>
+                                    <span class="property-label">"SCSI Timeout:"</span>
+                                    <span class="property-value">{format!("{timeout}s")}</span>
+                                </>
+                            })}
+                            {auto_update_enabled.map(|enabled| {
+                                let label = if auto_update_ga_family.is_empty() {
+                                    if enabled {
+                                        "Enabled".to_string()
+                                    } else {
+                                        "Disabled".to_string()
+                                    }
+                                } else if enabled {
+                                    format!("Enabled ({})", auto_update_ga_family.clone())
+                                } else {
+                                    format!("Disabled ({})", auto_update_ga_family.clone())
+                                };
+                                view! {
+                                    <>
+                                        <span class="property-label">"Auto-Update:"</span>
+                                        <span class=if enabled { "badge badge-success" } else { "badge badge-info" }>{label}</span>
+                                    </>
+                                }
+                            })}
+                        </div>
+
+                        {(!wa_warnings.is_empty()).then(|| view! {
+                            <div class="vm-notes">
+                                {wa_warnings
+                                    .into_iter()
+                                    .map(|warning| {
+                                        let severity = json_str(&warning, "severity");
+                                        let setting = json_str(&warning, "setting");
+                                        let value = json_str(&warning, "value");
+                                        let message = json_str(&warning, "message");
+                                        let note_class = match severity.as_str() {
+                                            "warning" => "vm-note warning",
+                                            "info" => "vm-note info",
+                                            _ => "vm-note",
+                                        };
+                                        view! {
+                                            <div class=note_class>
+                                                <p>
+                                                    <strong>
+                                                        {if setting.is_empty() {
+                                                            message.clone()
+                                                        } else if value.is_empty() {
+                                                            setting.clone()
+                                                        } else {
+                                                            format!("{setting}={value}")
+                                                        }}
+                                                    </strong>
+                                                    {if !message.is_empty() && !setting.is_empty() {
+                                                        format!(" — {message}")
+                                                    } else {
+                                                        String::new()
+                                                    }}
+                                                </p>
+                                            </div>
+                                        }
+                                    })
+                                    .collect::<Vec<_>>()}
+                            </div>
+                        })}
+                    </div>
+                })}
+            </div>
+        </Section>
+    }
+    .into_any()
+}
+
+/// Section 2 – Azure Linux Agent Log.
+#[component]
+pub fn WaagentLogSection(data: Value) -> impl IntoView {
+    let wa_log = data.get("waagentLog").cloned().unwrap_or(Value::Null);
+    if !json_bool(&wa_log, "found") {
+        return view! {}.into_any();
+    }
+
+    let total_errors = wa_log
+        .get("totalErrors")
+        .and_then(|v| v.as_u64())
+        .unwrap_or(0) as usize;
+    let total_warnings = wa_log
+        .get("totalWarnings")
+        .and_then(|v| v.as_u64())
+        .unwrap_or(0) as usize;
+    let has_issues = json_bool(&wa_log, "hasErrors") || json_bool(&wa_log, "hasWarnings");
+    let block_class = if has_issues {
+        "danger-block"
+    } else {
+        "success-block"
+    };
+
+    let agent_version = json_str(&wa_log, "agentVersion");
+    let version_history = json_array(&wa_log, "agentVersionHistory");
+    let extension_status = json_array(&wa_log, "extensionStatusSummary");
+    let goal_state_errors = json_array(&wa_log, "goalStateErrors");
+    let extension_errors = json_array(&wa_log, "extensionErrors");
+    let resource_disk_errors = json_array(&wa_log, "resourceDiskErrors");
+    let imds_errors = json_array(&wa_log, "imdsErrors");
+    let status_file_warnings = json_array(&wa_log, "statusFileWarnings");
+    let other_errors = json_array(&wa_log, "otherErrors");
+    let other_warnings = json_array(&wa_log, "otherWarnings");
+
+    view! {
+        <details class=block_class open=has_issues>
+            <summary>
+                "Azure Linux Agent Log"
+                {(!agent_version.is_empty()).then(|| view! {
+                    <span class="badge badge-info">{format!("v{agent_version}")}</span>
+                })}
+                {(total_errors > 0).then(|| view! {
+                    <span class="badge badge-danger">
+                        {format!(
+                            "{total_errors} error{}",
+                            if total_errors == 1 { "" } else { "s" },
+                        )}
+                    </span>
+                })}
+                {(total_warnings > 0).then(|| view! {
+                    <span class="badge badge-warning">
+                        {format!(
+                            "{total_warnings} warning{}",
+                            if total_warnings == 1 { "" } else { "s" },
+                        )}
+                    </span>
+                })}
+                {(!has_issues).then(|| view! {
+                    <span class="badge badge-success">"No issues found"</span>
+                })}
+            </summary>
+
+            <div class="section-body">
+                {(!version_history.is_empty()).then(|| {
+                    if version_history.len() == 1 {
+                        let version = json_str(&version_history[0], "version");
+                        let first_seen = json_str(&version_history[0], "firstSeen");
+                        view! {
+                            <div class="subsection">
+                                <p><strong>"Agent Version History:"</strong></p>
+                                <p>
+                                    "WALinuxAgent "
+                                    <strong>{version}</strong>
+                                    {(!first_seen.is_empty()).then(|| view! {
+                                        <span>{format!(" (since {first_seen})")}</span>
+                                    })}
+                                </p>
+                            </div>
+                        }
+                        .into_any()
+                    } else {
+                        view! {
+                            <div class="subsection">
+                                <p><strong>"Agent Version History:"</strong></p>
+                                <table class="data-table">
+                                    <thead>
+                                        <tr>
+                                            <th>"Version"</th>
+                                            <th>"First Seen"</th>
+                                        </tr>
+                                    </thead>
+                                    <tbody>
+                                        {version_history
+                                            .into_iter()
+                                            .map(|entry| {
+                                                let version = json_str(&entry, "version");
+                                                let first_seen = json_str(&entry, "firstSeen");
+                                                view! {
+                                                    <tr>
+                                                        <td><code>{version}</code></td>
+                                                        <td>{if first_seen.is_empty() {
+                                                            "N/A".to_string()
+                                                        } else {
+                                                            first_seen
+                                                        }}</td>
+                                                    </tr>
+                                                }
+                                            })
+                                            .collect::<Vec<_>>()}
+                                    </tbody>
+                                </table>
+                            </div>
+                        }
+                        .into_any()
+                    }
+                })}
+
+                {(!extension_status.is_empty()).then(|| view! {
+                    <div class="subsection">
+                        <p><strong>"Extension Status (last reported):"</strong></p>
+                        <table class="data-table">
+                            <tbody>
+                                {extension_status
+                                    .into_iter()
+                                    .map(|ext| {
+                                        let name = json_str(&ext, "name");
+                                        let status = json_str(&ext, "status");
+                                        let badge_class = match status.as_str() {
+                                            "Ready" => "badge badge-success",
+                                            "NotReady" => "badge badge-danger",
+                                            _ => "badge badge-warning",
+                                        };
+                                        view! {
+                                            <tr>
+                                                <td><code>{name}</code></td>
+                                                <td><span class=badge_class>{status}</span></td>
+                                            </tr>
+                                        }
+                                    })
+                                    .collect::<Vec<_>>()}
+                            </tbody>
+                        </table>
+                    </div>
+                })}
+
+                {render_waagent_issue_group("Goal State Errors", goal_state_errors, false)}
+                {render_waagent_issue_group("Extension Errors", extension_errors, false)}
+                {render_waagent_issue_group("Resource Disk Errors", resource_disk_errors, false)}
+                {render_waagent_issue_group("IMDS Connectivity Errors", imds_errors, false)}
+                {render_waagent_issue_group("Status File Warnings", status_file_warnings, true)}
+                {render_waagent_issue_group("Other Warnings", other_warnings, true)}
+
+                {(!other_errors.is_empty()).then(|| view! {
+                    <details class="content-details">
+                        <summary>{format!("Other Errors ({})", other_errors.len())}</summary>
+                        <ul>
+                            {other_errors
+                                .iter()
+                                .take(20)
+                                .map(|entry| {
+                                    let timestamp = json_str(entry, "timestamp");
+                                    let line = json_str(entry, "line");
+                                    view! {
+                                        <li>
+                                            {(!timestamp.is_empty()).then(|| view! {
+                                                <span class="text-muted">{format!("{timestamp} ")}</span>
+                                            })}
+                                            <code>{line.chars().take(200).collect::<String>()}</code>
+                                        </li>
+                                    }
+                                })
+                                .collect::<Vec<_>>()}
+                            {(other_errors.len() > 20).then(|| view! {
+                                <li class="text-muted">
+                                    {format!("...and {} more", other_errors.len() - 20)}
+                                </li>
+                            })}
+                        </ul>
+                    </details>
+                })}
+            </div>
+        </details>
+    }
+    .into_any()
+}
+
+/// Section 13 – Azure VM Extensions.
+#[component]
+pub fn AzureExtensionsSection(data: Value) -> impl IntoView {
+    let ext = data.get("azureExtensions").cloned().unwrap_or(Value::Null);
+    if !json_bool(&ext, "found") {
+        return view! {}.into_any();
+    }
+
+    let mut extensions = json_array(&ext, "events");
+    if extensions.is_empty() {
+        extensions = json_array(&ext, "extensions");
+    }
+    if extensions.is_empty() {
+        return view! {}.into_any();
+    }
+
+    extensions.sort_by(|a, b| {
+        let a_healthy = a
+            .get("healthy")
+            .and_then(|v| v.as_bool())
+            .unwrap_or_else(|| json_str(a, "status") == "Ready");
+        let b_healthy = b
+            .get("healthy")
+            .and_then(|v| v.as_bool())
+            .unwrap_or_else(|| json_str(b, "status") == "Ready");
+
+        let a_label = json_str(a, "label");
+        let b_label = json_str(b, "label");
+
+        a_healthy
+            .cmp(&b_healthy)
+            .then_with(|| a_label.to_lowercase().cmp(&b_label.to_lowercase()))
+    });
+
+    let unhealthy_count = extensions
+        .iter()
+        .filter(|ext| {
+            !ext.get("healthy")
+                .and_then(|v| v.as_bool())
+                .unwrap_or_else(|| json_str(ext, "status") == "Ready")
+        })
+        .count();
+
+    let block_class = if unhealthy_count > 0 {
+        "danger-block"
+    } else {
+        "info-block"
+    };
+
+    view! {
+        <details class=block_class>
+            <summary>
+                {if unhealthy_count > 0 {
+                    format!(
+                        "Azure VM Extensions ({}) – {} not ready",
+                        extensions.len(),
+                        unhealthy_count,
+                    )
+                } else {
+                    format!("Azure VM Extensions ({})", extensions.len())
+                }}
+            </summary>
+
+            <div class="section-body">
+                {extensions
+                    .into_iter()
+                    .map(|extension| {
+                        let name = json_str(&extension, "name");
+                        let label = {
+                            let label = json_str(&extension, "label");
+                            if label.is_empty() { name.clone() } else { label }
+                        };
+                        let version = json_str(&extension, "version");
+                        let status = json_str(&extension, "status");
+                        let message = json_str(&extension, "message");
+                        let healthy = extension
+                            .get("healthy")
+                            .and_then(|v| v.as_bool())
+                            .unwrap_or(status == "Ready");
+                        let badge_class = if healthy {
+                            "badge badge-success"
+                        } else {
+                            "badge badge-danger"
+                        };
+                        let text_class = if healthy { "text-success" } else { "text-danger" };
+
+                        view! {
+                            <div class="subsection">
+                                <p class=text_class>
+                                    <strong>{label.clone()}</strong>
+                                </p>
+                                <p>
+                                    "Version: " <code>{version}</code>
+                                    <span class=badge_class>{if status.is_empty() {
+                                        if healthy {
+                                            "Ready".to_string()
+                                        } else {
+                                            "NotReady".to_string()
+                                        }
+                                    } else {
+                                        status.clone()
+                                    }}</span>
+                                </p>
+                                {(!message.is_empty() && !healthy).then(|| view! {
+                                    <p class="text-danger">
+                                        <strong>"Error:"</strong>
+                                        " "
+                                        <code>{message}</code>
+                                    </p>
+                                })}
+                                {(name != label && !name.is_empty()).then(|| view! {
+                                    <p class="text-muted">{name}</p>
+                                })}
+                            </div>
+                        }
+                    })
+                    .collect::<Vec<_>>()}
+            </div>
+        </details>
+    }
+    .into_any()
+}
+
+fn render_waagent_issue_group(
+    title: &'static str,
+    items: Vec<Value>,
+    is_warning: bool,
+) -> Option<AnyView> {
+    if items.is_empty() {
+        return None;
+    }
+
+    let class = if is_warning {
+        "warning-block"
+    } else {
+        "danger-block"
+    };
+    let len = items.len();
+
+    Some(
+        view! {
+            <div class=class>
+                <p><strong>{format!("{title} ({len})")}</strong></p>
+                <ul>
+                    {items
+                        .into_iter()
+                        .take(10)
+                        .map(|item| {
+                            let timestamp = json_str(&item, "timestamp");
+                            let description = describe_waagent_item(&item);
+                            view! {
+                                <li>
+                                    {(!timestamp.is_empty()).then(|| view! {
+                                        <span class="text-muted">{format!("{timestamp} ")}</span>
+                                    })}
+                                    {description}
+                                </li>
+                            }
+                        })
+                        .collect::<Vec<_>>()}
+                    {(len > 10).then(|| view! {
+                        <li class="text-muted">{format!("...and {} more", len - 10)}</li>
+                    })}
+                </ul>
+            </div>
+        }
+        .into_any(),
+    )
+}
+
+fn describe_waagent_item(item: &Value) -> String {
+    let extension_name = json_str(item, "extensionName");
+    let operation = json_str(item, "operation");
+    let message = json_str(item, "message");
+
+    if !extension_name.is_empty() && !operation.is_empty() {
+        if message.is_empty() {
+            format!("{extension_name} ({operation})")
+        } else {
+            format!("{extension_name} ({operation}): {message}")
+        }
+    } else if !message.is_empty() {
+        message
+    } else {
+        let line = json_str(item, "line");
+        if line.is_empty() {
+            "Unknown issue".to_string()
+        } else {
+            line.chars().take(200).collect()
+        }
+    }
+}
+
+fn display_disk_type(raw: &str) -> String {
+    let trimmed = raw.trim();
+    if trimmed.is_empty() {
+        return "Unknown".to_string();
+    }
+
+    let display = trimmed.replace("_LRS", "").replace("_ZRS", " (ZRS)");
+
+    match display.as_str() {
+        "PremiumV2" => "Premium SSD v2".to_string(),
+        "UltraSSD" => "Ultra Disk".to_string(),
+        "Premium" => "Premium SSD".to_string(),
+        "StandardSSD" => "Standard SSD".to_string(),
+        "Standard" => "Standard HDD".to_string(),
+        _ => display,
+    }
+}
+
+fn value_as_text(value: &Value) -> Option<String> {
+    value
+        .as_str()
+        .map(|s| s.trim().to_string())
+        .filter(|s| !s.is_empty())
+        .or_else(|| value.as_i64().map(|v| v.to_string()))
+        .or_else(|| value.as_u64().map(|v| v.to_string()))
+        .or_else(|| {
+            value.as_f64().map(|v| {
+                if v.fract() == 0.0 {
+                    format!("{v:.0}")
+                } else {
+                    v.to_string()
+                }
+            })
+        })
+}
+
+fn disk_badge_class(raw: &str) -> &'static str {
+    match raw {
+        "PremiumV2_LRS" | "UltraSSD_LRS" => "badge badge-success",
+        "Premium_LRS" | "Premium_ZRS" | "StandardSSD_LRS" | "StandardSSD_ZRS" => "badge badge-info",
+        _ => "badge",
+    }
+}
+
+/// SecureBoot status section. Only available from sosreport archives
+/// (`sos_commands/boot/mokutil_--sb-state`). Renders a single info/warning
+/// block depending on enabled/disabled/unsupported state.
+#[component]
+pub fn SecureBootSection(data: Value) -> impl IntoView {
+    let sb = data.get("secureBoot").cloned().unwrap_or(Value::Null);
+    if !json_bool(&sb, "found") {
+        return view! {}.into_any();
+    }
+
+    let supported = sb
+        .get("supported")
+        .and_then(|v| v.as_bool())
+        .unwrap_or(true);
+    let enabled = sb.get("enabled").and_then(|v| v.as_bool());
+    let state_text = json_str(&sb, "stateText");
+    let source_path = json_str(&sb, "sourcePath");
+
+    let (block_class, badge_class, status_label, summary_text) = if !supported {
+        (
+            "warning-block",
+            "badge badge-warning",
+            "Not supported".to_string(),
+            "SecureBoot: Not supported (no EFI variables)".to_string(),
+        )
+    } else {
+        match enabled {
+            Some(true) => (
+                "info-block",
+                "badge badge-success",
+                "Enabled".to_string(),
+                "SecureBoot: Enabled".to_string(),
+            ),
+            Some(false) => (
+                "warning-block",
+                "badge badge-warning",
+                "Disabled".to_string(),
+                "SecureBoot: Disabled".to_string(),
+            ),
+            None => (
+                "info-block",
+                "badge",
+                "Unknown".to_string(),
+                "SecureBoot: Unknown".to_string(),
+            ),
+        }
+    };
+
+    view! {
+        <details class=block_class open=true>
+            <summary>{summary_text}</summary>
+            <div class="section-body">
+                <p>
+                    "Status: "
+                    <span class=badge_class>{status_label}</span>
+                </p>
+                {(!state_text.is_empty()).then(|| view! {
+                    <p>"Raw state: " <code>{state_text}</code></p>
+                })}
+                {(!source_path.is_empty()).then(|| view! {
+                    <p class="text-muted"><small>"Source: " <code>{source_path}</code></small></p>
+                })}
+            </div>
+        </details>
+    }
+    .into_any()
+}
diff --git a/rca-tool/web-leptos/src/components/sections/cluster.rs b/rca-tool/web-leptos/src/components/sections/cluster.rs
new file mode 100644
index 0000000..92c2bd4
--- /dev/null
+++ b/rca-tool/web-leptos/src/components/sections/cluster.rs
@@ -0,0 +1,1947 @@
+use leptos::prelude::*;
+use supportfile::parse_pacemaker_high_cpu;
+use serde_json::Value;
+
+use super::helpers::*;
+
+/// Section 4 – Cluster Configuration.
+#[component]
+pub fn ClusterSection(data: Value) -> impl IntoView {
+    let corosync = data.get("corosyncConfig").cloned().unwrap_or(Value::Null);
+    let cluster_status = data.get("clusterStatus").cloned().unwrap_or(Value::Null);
+    let pacemaker = data
+        .get("pacemakerResources")
+        .cloned()
+        .unwrap_or(Value::Null);
+    let fencing = data.get("fencingConfig").cloned().unwrap_or(Value::Null);
+    let sbd = data.get("sbdConfig").cloned().unwrap_or(Value::Null);
+    let nodes = data.get("clusterNodes").cloned().unwrap_or(Value::Null);
+    let events = data.get("clusterEvents").cloned().unwrap_or(Value::Null);
+    let maintenance = data
+        .get("clusterMaintenanceMode")
+        .cloned()
+        .unwrap_or(Value::Null);
+    let daemon = data
+        .get("clusterDaemonStatus")
+        .cloned()
+        .unwrap_or(Value::Null);
+    let azure_fence = data.get("azureFenceAuth").cloned().unwrap_or(Value::Null);
+    let cluster_services = data.get("clusterServices").cloned().unwrap_or(Value::Null);
+    let hosts_file = data.get("hostsFile").cloned().unwrap_or(Value::Null);
+    let nodes_in_hosts = data
+        .get("nodesInHosts")
+        .and_then(|v| v.as_array())
+        .cloned()
+        .unwrap_or_default();
+    let nodes_missing_from_hosts = data
+        .get("nodesMissingFromHosts")
+        .and_then(|v| v.as_array())
+        .cloned()
+        .unwrap_or_default();
+
+    let has_corosync_content = json_bool(&corosync, "found")
+        || !json_array(&corosync, "warnings").is_empty()
+        || corosync.get("token").is_some()
+        || corosync.get("totemToken").is_some()
+        || corosync.get("transport").is_some()
+        || corosync.get("totemTransport").is_some();
+    let has_pacemaker_content = json_bool(&pacemaker, "found")
+        || !json_array(&pacemaker, "resources").is_empty()
+        || !json_array(&pacemaker, "groups").is_empty()
+        || !json_array(&pacemaker, "failedActions").is_empty()
+        || !json_array(&pacemaker, "constraints").is_empty();
+    let has_node_content = json_bool(&nodes, "found")
+        || !json_array(&nodes, "nodes").is_empty()
+        || !json_array(&nodes, "clusterNodes").is_empty()
+        || !nodes_in_hosts.is_empty()
+        || !nodes_missing_from_hosts.is_empty();
+    let has_event_content = !json_array(&events, "resourceMigrations").is_empty()
+        || !json_array(&events, "fencingEvents").is_empty();
+
+    let has_content = has_corosync_content
+        || json_bool(&cluster_status, "found")
+        || has_pacemaker_content
+        || json_bool(&fencing, "found")
+        || json_bool(&sbd, "found")
+        || has_node_content
+        || has_event_content
+        || json_bool(&maintenance, "found")
+        || json_bool(&daemon, "found")
+        || json_bool(&azure_fence, "found")
+        || cluster_services.get("dlmService").is_some();
+
+    if !has_content {
+        return view! {}.into_any();
+    }
+
+    let corosync_warning_count = json_array(&corosync, "warnings").len();
+    let daemon_warning_count = json_array(&daemon, "warnings").len();
+    let failed_actions_count = pacemaker
+        .get("failedActionsCount")
+        .and_then(|v| v.as_u64())
+        .unwrap_or(0) as usize;
+    let maintenance_enabled = maintenance
+        .get("maintenanceMode")
+        .and_then(|v| v.as_bool())
+        .unwrap_or(false);
+    let stonith_enabled = fencing.get("stonithEnabled").and_then(|v| v.as_bool());
+    let cluster_event_count = json_array(&events, "resourceMigrations").len()
+        + json_array(&events, "fencingEvents").len();
+
+    let class = if maintenance_enabled
+        || stonith_enabled == Some(false)
+        || failed_actions_count > 0
+        || daemon_warning_count > 0
+    {
+        "danger-block"
+    } else if corosync_warning_count > 0 || cluster_event_count > 0 {
+        "warning-block"
+    } else {
+        "success-block"
+    };
+
+    view! {
+        <Section title="Cluster Configuration" class=class open=true>
+            {render_cluster_health(&cluster_status)}
+            {render_corosync_warnings(&corosync)}
+            {render_cluster_nodes(&nodes, &hosts_file, &nodes_in_hosts, &nodes_missing_from_hosts)}
+            {render_pacemaker_resources(&pacemaker, &cluster_status)}
+            {render_fencing_section(&fencing)}
+            {render_maintenance_section(&maintenance)}
+            {render_sbd_section(&sbd)}
+            {render_cluster_events(&events)}
+            {render_daemon_status(&daemon)}
+            {render_cluster_services(&cluster_services)}
+            {render_azure_fence_auth(&azure_fence)}
+        </Section>
+    }
+    .into_any()
+}
+
+fn render_cluster_health(cluster_status: &Value) -> Option<AnyView> {
+    if !json_bool(cluster_status, "found") {
+        return None;
+    }
+
+    let cluster_name = json_text(cluster_status, "clusterName");
+    let dc_node = json_text(cluster_status, "dcNode");
+    let quorum_status = json_text(cluster_status, "quorumStatus");
+    let nodes_configured = json_text(cluster_status, "nodesConfigured");
+    let resources_configured = json_text(cluster_status, "resourcesConfigured");
+    let last_updated = json_text(cluster_status, "lastUpdated");
+    let online = json_text(cluster_status, "online");
+    let node_statuses = json_array(cluster_status, "nodeStatuses");
+
+    Some(
+        view! {
+            <div class="subsection">
+                <p class="subsection-title">"Cluster Health:"</p>
+                <KvTable>
+                    {(!cluster_name.is_empty()).then(|| view! {
+                        <KvRow label="Cluster Stack" value=cluster_name.clone()/>
+                    })}
+                    {(!dc_node.is_empty()).then(|| view! {
+                        <KvRow label="DC Node" value=if quorum_status.is_empty() {
+                            dc_node.clone()
+                        } else {
+                            format!("{} ({})", dc_node.clone(), quorum_status.clone())
+                        }/>
+                    })}
+                    {(!nodes_configured.is_empty()).then(|| view! {
+                        <KvRow label="Nodes" value=format!("{} configured", nodes_configured.clone())/>
+                    })}
+                    {(!resources_configured.is_empty()).then(|| view! {
+                        <KvRow label="Resources" value=format!("{} configured", resources_configured.clone())/>
+                    })}
+                    {(!online.is_empty()).then(|| view! {
+                        <KvRow label="Online" value=online.clone()/>
+                    })}
+                    {(!last_updated.is_empty()).then(|| view! {
+                        <KvRow label="Last Updated" value=last_updated.clone()/>
+                    })}
+                </KvTable>
+
+                {(!node_statuses.is_empty()).then(|| view! {
+                    <>
+                        <p><strong>"Node Status:"</strong></p>
+                        <ul class="disk-list">
+                            {node_statuses
+                                .into_iter()
+                                .map(|node| {
+                                    let name = json_text(&node, "name");
+                                    let status = json_text(&node, "status");
+                                    let is_dc = node.get("isDC").and_then(|v| v.as_bool()).unwrap_or(false);
+                                    let resources_running = node
+                                        .get("resourcesRunning")
+                                        .and_then(|v| v.as_u64())
+                                        .unwrap_or(0);
+                                    let status_class = match status.as_str() {
+                                        "online" => "text-success",
+                                        "standby" => "text-warning",
+                                        "maintenance" => "text-info",
+                                        _ => "text-danger",
+                                    };
+                                    view! {
+                                        <li>
+                                            <strong>{name.clone()}</strong>
+                                            ": "
+                                            <span class=status_class>{status.clone()}</span>
+                                            {is_dc.then(|| view! { <span class="text-info">" (DC)"</span> })}
+                                            {(resources_running > 0).then(|| view! {
+                                                <span class="text-muted">{format!(" ({} resources)", resources_running)}</span>
+                                            })}
+                                        </li>
+                                    }
+                                })
+                                .collect::<Vec<_>>()}
+                        </ul>
+                    </>
+                })}
+            </div>
+        }
+        .into_any(),
+    )
+}
+
+fn render_corosync_warnings(corosync: &Value) -> Option<AnyView> {
+    let warnings = json_array(corosync, "warnings");
+    let token = corosync
+        .get("token")
+        .and_then(value_as_text)
+        .or_else(|| corosync.get("totemToken").and_then(value_as_text))
+        .unwrap_or_default();
+    let transport = corosync
+        .get("transport")
+        .and_then(value_as_text)
+        .or_else(|| corosync.get("totemTransport").and_then(value_as_text))
+        .unwrap_or_default();
+    let provider = corosync
+        .get("provider")
+        .and_then(value_as_text)
+        .or_else(|| corosync.get("quorumProvider").and_then(value_as_text))
+        .unwrap_or_default();
+    let expected_votes = corosync
+        .get("expectedVotes")
+        .and_then(value_as_text)
+        .or_else(|| corosync.get("quorumExpectedVotes").and_then(value_as_text))
+        .unwrap_or_default();
+    let two_node = corosync
+        .get("twoNode")
+        .and_then(value_as_text)
+        .or_else(|| corosync.get("quorumTwoNode").and_then(value_as_text))
+        .unwrap_or_default();
+    let source_file = json_text(corosync, "sourceFile");
+
+    if !json_bool(corosync, "found")
+        && warnings.is_empty()
+        && token.is_empty()
+        && transport.is_empty()
+        && provider.is_empty()
+        && expected_votes.is_empty()
+        && two_node.is_empty()
+    {
+        return None;
+    }
+
+    Some(
+        view! {
+            <div class="subsection">
+                <p class="subsection-title">"Corosync Configuration:"</p>
+                <KvTable>
+                    {(!token.is_empty()).then(|| view! {
+                        <KvRow label="Totem token" value=token.clone()/>
+                    })}
+                    {(!transport.is_empty()).then(|| view! {
+                        <KvRow label="Transport" value=transport.clone()/>
+                    })}
+                    {(!provider.is_empty()).then(|| view! {
+                        <KvRow label="Quorum provider" value=provider.clone()/>
+                    })}
+                    {(!expected_votes.is_empty()).then(|| view! {
+                        <KvRow label="Expected votes" value=expected_votes.clone()/>
+                    })}
+                    {(!two_node.is_empty()).then(|| view! {
+                        <KvRow label="two_node" value=two_node.clone()/>
+                    })}
+                </KvTable>
+                {(!source_file.is_empty()).then(|| view! {
+                    <p class="text-muted"><em>{format!("Source: {}", source_file.clone())}</em></p>
+                })}
+
+                {(!warnings.is_empty()).then(|| view! {
+                    <div class="warning-block">
+                        <p><strong>"Corosync Checks:"</strong></p>
+                        {warnings
+                            .into_iter()
+                            .map(|warning| {
+                                let message = json_text(&warning, "message");
+                                let expected = json_text(&warning, "expected");
+                                let actual = json_text(&warning, "actual");
+                                let documentation_url = json_text(&warning, "documentationUrl");
+                                view! {
+                                    <div class="subsection">
+                                        <p class="text-danger"><strong>{format!("[!] {}", message)}</strong></p>
+                                        {(!expected.is_empty() || !actual.is_empty()).then(|| view! {
+                                            <p>
+                                                {(!expected.is_empty()).then(|| view! {
+                                                    <span>
+                                                        <strong>"Expected:"</strong>
+                                                        " "
+                                                        <code>{expected.clone()}</code>
+                                                    </span>
+                                                })}
+                                                {(!expected.is_empty() && !actual.is_empty()).then(|| view! { <span>" • "</span> })}
+                                                {(!actual.is_empty()).then(|| view! {
+                                                    <span>
+                                                        <strong>"Found:"</strong>
+                                                        " "
+                                                        <code>{actual.clone()}</code>
+                                                    </span>
+                                                })}
+                                            </p>
+                                        })}
+                                        {(!documentation_url.is_empty()).then(|| view! {
+                                            <p>
+                                                <a
+                                                    href=documentation_url
+                                                    target="_blank"
+                                                    rel="noopener noreferrer"
+                                                    class="text-info"
+                                                >
+                                                    "View Documentation"
+                                                </a>
+                                            </p>
+                                        })}
+                                    </div>
+                                }
+                            })
+                            .collect::<Vec<_>>()}
+                    </div>
+                })}
+            </div>
+        }
+        .into_any(),
+    )
+}
+
+fn render_cluster_nodes(
+    nodes: &Value,
+    hosts_file: &Value,
+    nodes_in_hosts: &[Value],
+    nodes_missing_from_hosts: &[Value],
+) -> Option<AnyView> {
+    let mut node_entries = json_array(nodes, "nodes");
+    if node_entries.is_empty() {
+        node_entries = json_array(nodes, "clusterNodes");
+    }
+
+    let mut node_names = node_entries
+        .iter()
+        .filter_map(value_name)
+        .collect::<Vec<_>>();
+
+    let in_hosts = nodes_in_hosts
+         .iter()
+         .filter_map(value_name)
+         .collect::<Vec<_>>();
+    let missing = nodes_missing_from_hosts
+         .iter()
+         .filter_map(value_name)
+         .collect::<Vec<_>>();
+    if node_names.is_empty() {
+        node_names = in_hosts.clone();
+    }
+    if node_names.is_empty() {
+        node_names = missing.clone();
+    }
+    if node_names.is_empty() {
+        node_names = hosts_file
+            .get("allHostnames")
+            .and_then(|v| v.as_array())
+            .map(|entries| entries.iter().filter_map(value_name).collect::<Vec<_>>())
+            .unwrap_or_default();
+    }
+    if node_names.is_empty() {
+        return None;
+    }
+
+    let total_hostnames = hosts_file
+        .get("allHostnames")
+        .and_then(|v| v.as_array())
+        .map(|a| a.len())
+        .unwrap_or(0);
+    let ip_map = nodes
+        .get("nodeToIpMap")
+        .and_then(|v| v.as_object())
+        .cloned()
+        .unwrap_or_default();
+    let has_hosts = json_bool(hosts_file, "found");
+
+    Some(
+        view! {
+            <div class="subsection">
+                <p class="subsection-title">"Cluster nodes in ha.txt and hosts file"</p>
+                <ul class="disk-list">
+                    {node_names
+                        .into_iter()
+                        .map(|node| {
+                            let node_in_hosts = in_hosts.iter().any(|entry| entry == &node);
+                            let ip = ip_map.get(&node).and_then(value_as_text).unwrap_or_default();
+                            view! {
+                                <li>
+                                    <code>{node.clone()}</code>
+                                    {has_hosts.then(|| view! {
+                                        <span class=if node_in_hosts {
+                                            "badge badge-success"
+                                        } else {
+                                            "badge badge-danger"
+                                        }>
+                                            {if node_in_hosts { "in hosts" } else { "not in hosts" }}
+                                        </span>
+                                    })}
+                                    {(!ip.is_empty()).then(|| view! {
+                                        <span class="text-muted">{format!(" — IP: {ip}")}</span>
+                                    })}
+                                </li>
+                            }
+                        })
+                        .collect::<Vec<_>>()}
+                </ul>
+
+                {has_hosts.then(|| view! {
+                    <div class="vm-note info">
+                        <p><strong>"Hosts File Validation:"</strong></p>
+                        <p class="text-success">{format!("[OK] {} node(s) found in /etc/hosts", in_hosts.len())}</p>
+                        {(!missing.is_empty()).then(|| view! {
+                            <>
+                                <p class="text-danger">{format!("[ERROR] {} node(s) missing from /etc/hosts", missing.len())}</p>
+                                <ul class="disk-list">
+                                    {missing
+                                        .into_iter()
+                                        .map(|name| view! { <li><code>{name}</code></li> })
+                                        .collect::<Vec<_>>()}
+                                </ul>
+                            </>
+                        })}
+                        {(total_hostnames > 0).then(|| view! {
+                            <p class="text-muted">{format!("Total hostnames in /etc/hosts: {}", total_hostnames)}</p>
+                        })}
+                    </div>
+                })}
+            </div>
+        }
+        .into_any(),
+    )
+}
+
+fn render_pacemaker_resources(pacemaker: &Value, cluster_status: &Value) -> Option<AnyView> {
+    let resources = json_array(pacemaker, "resources");
+    let groups = json_array(pacemaker, "groups");
+    let failed_actions = json_array(pacemaker, "failedActions");
+    let constraints = json_array(pacemaker, "constraints");
+    if !json_bool(pacemaker, "found")
+        && resources.is_empty()
+        && groups.is_empty()
+        && failed_actions.is_empty()
+        && constraints.is_empty()
+    {
+        return None;
+    }
+    let count = pacemaker
+        .get("count")
+        .and_then(|v| v.as_u64())
+        .unwrap_or(resources.len() as u64) as usize;
+    let groups_count = pacemaker
+        .get("groupsCount")
+        .and_then(|v| v.as_u64())
+        .unwrap_or(groups.len() as u64) as usize;
+    let total_count = count + groups_count;
+    let configured_count = cluster_status
+        .get("resourcesConfigured")
+        .and_then(|v| v.as_u64())
+        .unwrap_or(0) as usize;
+
+    Some(
+        view! {
+            <div class="subsection">
+                <p class="subsection-title">"Cluster Resources:"</p>
+                <p class="text-muted">
+                    {format!(
+                        "{} active resource{} detected",
+                        total_count,
+                        if total_count == 1 { "" } else { "s" },
+                    )}
+                    {(groups_count > 0).then(|| format!(
+                        " ({} group{}, {} primitive{})",
+                        groups_count,
+                        if groups_count == 1 { "" } else { "s" },
+                        count,
+                        if count == 1 { "" } else { "s" },
+                    ))}
+                </p>
+                <p class="text-muted"><em>"Source: ha.txt / cluster status output"</em></p>
+                {(configured_count > total_count && total_count > 0).then(|| view! {
+                    <p class="text-warning-dark">
+                        {format!(
+                            "Note: {} total configured ({} may be stopped, disabled, or failed)",
+                            configured_count,
+                            configured_count - total_count,
+                        )}
+                    </p>
+                })}
+
+                {(!groups.is_empty()).then(|| view! {
+                    <ul class="disk-list">
+                        {groups
+                            .iter()
+                            .map(|group| {
+                                let name = json_text(group, "name");
+                                let kind = match json_text(group, "type").as_str() {
+                                    "clone" => "Clone Set",
+                                    "master-slave" => "Primary/Secondary Set",
+                                    _ => "Resource Group",
+                                };
+                                let node = json_text(group, "node");
+                                let maintenance = group
+                                    .get("maintenance")
+                                    .and_then(|v| v.as_bool())
+                                    .unwrap_or(false);
+                                let members = group
+                                    .get("members")
+                                    .and_then(|v| v.as_array())
+                                    .cloned()
+                                    .unwrap_or_default();
+                                view! {
+                                    <li>
+                                        <strong>{format!("{}: ", kind)}</strong>
+                                        <code class="text-info">{name.clone()}</code>
+                                        {maintenance.then(|| view! {
+                                            <span class="badge badge-warning">"In maintenance"</span>
+                                        })}
+                                        {(!node.is_empty()).then(|| view! {
+                                            <div class="text-success">{format!("Active on: {}", node.clone())}</div>
+                                        })}
+                                        {(!members.is_empty()).then(|| view! {
+                                            <ul class="disk-list">
+                                                {members
+                                                    .iter()
+                                                    .filter_map(value_name)
+                                                    .map(|member_name| {
+                                                        let member = resources
+                                                            .iter()
+                                                            .find(|resource| json_text(resource, "name") == member_name)
+                                                            .cloned()
+                                                            .unwrap_or(Value::Null);
+                                                        let status = json_text(&member, "status")
+                                                            .replace("Master", "Primary")
+                                                            .replace("Slave", "Secondary");
+                                                        let node = json_text(&member, "node");
+                                                        view! {
+                                                            <li>
+                                                                <code>{member_name.clone()}</code>
+                                                                {(!resource_spec(&member).is_empty()).then(|| view! {
+                                                                    <span class="text-muted">{format!(" ({})", resource_spec(&member))}</span>
+                                                                })}
+                                                                {(!status.is_empty()).then(|| view! {
+                                                                    <span class="text-muted">{format!(" — {}", status)}</span>
+                                                                })}
+                                                                {(!node.is_empty()).then(|| view! {
+                                                                    <span class="text-success">{format!(" on {}", node.clone())}</span>
+                                                                })}
+                                                            </li>
+                                                        }
+                                                    })
+                                                    .collect::<Vec<_>>()}
+                                            </ul>
+                                        })}
+                                    </li>
+                                }
+                            })
+                            .collect::<Vec<_>>()}
+                    </ul>
+                })}
+
+                {(!resources.is_empty()).then(|| view! {
+                    <ul class="disk-list">
+                        {resources
+                            .iter()
+                            .filter(|resource| {
+                                !resource.get("groupMember").and_then(|v| v.as_bool()).unwrap_or(false)
+                                    && !resource.get("cloneMember").and_then(|v| v.as_bool()).unwrap_or(false)
+                            })
+                            .map(|resource| {
+                                let name = json_text(resource, "name");
+                                let node = json_text(resource, "node");
+                                let status = json_text(resource, "status")
+                                    .replace("Master", "Primary")
+                                    .replace("Slave", "Secondary");
+                                let maintenance = resource
+                                    .get("maintenance")
+                                    .and_then(|v| v.as_bool())
+                                    .unwrap_or(false);
+                                view! {
+                                    <li>
+                                        <code class="text-info">{name.clone()}</code>
+                                        {(!resource_spec(resource).is_empty()).then(|| view! {
+                                            <span class="text-muted">{format!(" ({})", resource_spec(resource))}</span>
+                                        })}
+                                        {maintenance.then(|| view! {
+                                            <span class="badge badge-warning">"In maintenance"</span>
+                                        })}
+                                        {(!node.is_empty()).then(|| view! {
+                                            <div class="text-success">
+                                                {format!("Active on: {}{}", node.clone(), if status.is_empty() {
+                                                    String::new()
+                                                } else {
+                                                    format!(" ({})", status.clone())
+                                                })}
+                                            </div>
+                                        })}
+                                        {(node.is_empty() && !status.is_empty()).then(|| view! {
+                                            <div class="text-muted">{format!("Status: {}", status.clone())}</div>
+                                        })}
+                                    </li>
+                                }
+                            })
+                            .collect::<Vec<_>>()}
+                    </ul>
+                })}
+
+                {(!failed_actions.is_empty()).then(|| view! {
+                    <div class="warning-block">
+                        <p><strong>{format!("Failed Resource Actions ({})", failed_actions.len())}</strong></p>
+                        <ul class="disk-list">
+                            {failed_actions
+                                .into_iter()
+                                .map(|action| {
+                                    let action_name = json_text(&action, "action");
+                                    let node = json_text(&action, "node");
+                                    let state = json_text(&action, "state");
+                                    let return_code = json_text(&action, "returnCode");
+                                    let details = json_text(&action, "details");
+                                    view! {
+                                        <li>
+                                            <code class="text-danger">{action_name}</code>
+                                            {(!node.is_empty()).then(|| view! {
+                                                <span>{format!(" on {}", node.clone())}</span>
+                                            })}
+                                            {(!state.is_empty() || !return_code.is_empty()).then(|| view! {
+                                                <div class="text-warning-dark">
+                                                    {format!(
+                                                        "State: {}{}",
+                                                        if state.is_empty() { "unknown".to_string() } else { state.clone() },
+                                                        if return_code.is_empty() {
+                                                            String::new()
+                                                        } else {
+                                                            format!(" | Return Code: {}", return_code.clone())
+                                                        },
+                                                    )}
+                                                </div>
+                                            })}
+                                            {(!details.is_empty()).then(|| view! {
+                                                <div class="text-muted">{details}</div>
+                                            })}
+                                        </li>
+                                    }
+                                })
+                                .collect::<Vec<_>>()}
+                        </ul>
+                    </div>
+                })}
+
+                {(!constraints.is_empty()).then(|| view! {
+                    <details class="content-details">
+                        <summary>{format!("Resource Constraints ({})", constraints.len())}</summary>
+                        <ul class="disk-list">
+                            {constraints
+                                .into_iter()
+                                .map(|constraint| {
+                                    let kind = json_text(&constraint, "type");
+                                    let resource = json_text(&constraint, "resource");
+                                    let with_resource = json_text(&constraint, "withResource");
+                                    let node = json_text(&constraint, "node");
+                                    let score = json_text(&constraint, "score");
+                                    let first_resource = json_text(&constraint, "firstResource");
+                                    let then_resource = json_text(&constraint, "thenResource");
+                                    let first_action = json_text(&constraint, "firstAction");
+                                    let then_action = json_text(&constraint, "thenAction");
+                                    let id = json_text(&constraint, "id");
+                                    let description = if kind == "location" {
+                                        format!("{} → {}{}", resource, if node.is_empty() { "rule-based".to_string() } else { node }, if score.is_empty() { String::new() } else { format!(" (score: {})", score) })
+                                    } else if kind == "colocation" {
+                                        format!("{} ↔ {}{}", resource, with_resource, if score.is_empty() { String::new() } else { format!(" (score: {})", score) })
+                                    } else if kind == "order" {
+                                        format!("{} ({}) → {} ({})", first_resource, first_action, then_resource, then_action)
+                                    } else {
+                                        format!("{} constraint", kind)
+                                    };
+                                    view! {
+                                        <li>
+                                            {description}
+                                            {(!id.is_empty()).then(|| view! {
+                                                <span class="text-muted">{format!(" — ID: {}", id)}</span>
+                                            })}
+                                        </li>
+                                    }
+                                })
+                                .collect::<Vec<_>>()}
+                        </ul>
+                    </details>
+                })}
+            </div>
+        }
+        .into_any(),
+    )
+}
+
+fn render_fencing_section(fencing: &Value) -> Option<AnyView> {
+    if !json_bool(fencing, "found") {
+        return None;
+    }
+
+    let stonith_enabled = fencing.get("stonithEnabled").and_then(|v| v.as_bool());
+    let stonith_status = match stonith_enabled {
+        Some(true) => "Enabled".to_string(),
+        Some(false) => "Disabled".to_string(),
+        None => "Unknown".to_string(),
+    };
+    let stonith_class = if stonith_enabled == Some(true) {
+        "text-success"
+    } else {
+        "text-danger"
+    };
+    let source_file = json_text(fencing, "stonithSourceFile");
+    let source_pattern = json_text(fencing, "stonithSourcePattern");
+    let devices = json_array(fencing, "fencingDevices");
+
+    Some(
+        view! {
+            <div class="subsection">
+                <p class="subsection-title">"Fencing Configuration:"</p>
+                <p>
+                    <strong>"STONITH Status:"</strong>
+                    " "
+                    <span class=stonith_class>{stonith_status}</span>
+                </p>
+                {(!source_file.is_empty()).then(|| view! {
+                    <p class="text-muted">
+                        <em>{format!("Source: {}", source_file.clone())}</em>
+                    </p>
+                })}
+                {(!source_pattern.is_empty()).then(|| view! {
+                    <p><code>{source_pattern.clone()}</code></p>
+                })}
+
+                {if devices.is_empty() {
+                    view! { <p class="text-danger"><em>"No fencing devices detected"</em></p> }
+                        .into_any()
+                } else {
+                    view! {
+                        <>
+                            <p class="text-muted">
+                                {format!(
+                                    "{} fencing device{} configured",
+                                    devices.len(),
+                                    if devices.len() == 1 { "" } else { "s" },
+                                )}
+                            </p>
+                            <ul class="disk-list">
+                                {devices
+                                    .into_iter()
+                                    .map(|device| {
+                                        let name = json_text(&device, "name");
+                                        let agent = json_text(&device, "agent");
+                                        let cloud = json_text(&device, "cloud");
+                                        let device_type = json_text(&device, "type");
+                                        let source_file = json_text(&device, "sourceFile");
+                                        let source_line = json_text(&device, "sourceLine");
+                                        let pattern = json_text(&device, "pattern");
+                                        view! {
+                                            <li>
+                                                <code class="text-info">{name}</code>
+                                                {(!agent.is_empty()).then(|| view! {
+                                                    <span class="text-muted">{format!(" — {}", agent.clone())}</span>
+                                                })}
+                                                {(!cloud.is_empty()).then(|| view! {
+                                                    <span class="badge badge-info">{cloud.clone()}</span>
+                                                })}
+                                                {(!device_type.is_empty()).then(|| view! {
+                                                    <div class="text-muted">{format!("Type: {}", device_type.clone())}</div>
+                                                })}
+                                                {(!source_file.is_empty()).then(|| view! {
+                                                    <div class="text-muted">
+                                                        {format!(
+                                                            "Source: {}{}",
+                                                            source_file.clone(),
+                                                            if source_line.is_empty() {
+                                                                String::new()
+                                                            } else {
+                                                                format!(" (line {})", source_line.clone())
+                                                            },
+                                                        )}
+                                                    </div>
+                                                })}
+                                                {(!pattern.is_empty()).then(|| view! {
+                                                    <div><code>{pattern.clone()}</code></div>
+                                                })}
+                                            </li>
+                                        }
+                                    })
+                                    .collect::<Vec<_>>()}
+                            </ul>
+                        </>
+                    }
+                    .into_any()
+                }}
+            </div>
+        }
+        .into_any(),
+    )
+}
+
+fn render_maintenance_section(maintenance: &Value) -> Option<AnyView> {
+    if !json_bool(maintenance, "found") {
+        return None;
+    }
+
+    let maintenance_mode = maintenance
+        .get("maintenanceMode")
+        .and_then(|v| v.as_bool())
+        .unwrap_or(false);
+    let resources_in_maintenance = json_array(maintenance, "resourcesInMaintenance")
+        .iter()
+        .filter_map(value_name)
+        .collect::<Vec<_>>();
+
+    if !maintenance_mode && resources_in_maintenance.is_empty() {
+        return None;
+    }
+
+    Some(
+        view! {
+            <div class="warning-block">
+                <p><strong>"Maintenance Mode:"</strong></p>
+                {maintenance_mode.then(|| view! {
+                    <>
+                        <p class="text-warning"><strong>"[!] Cluster is in MAINTENANCE MODE"</strong></p>
+                        <p>
+                            "Resources are not being managed. Run "
+                            <code>"crm configure property maintenance-mode=false"</code>
+                            " to exit."
+                        </p>
+                    </>
+                })}
+                {(!resources_in_maintenance.is_empty()).then(|| view! {
+                    <>
+                        <p><strong>"Resources in maintenance:"</strong></p>
+                        <ul class="disk-list">
+                            {resources_in_maintenance
+                                .into_iter()
+                                .map(|resource| view! { <li><code>{resource}</code></li> })
+                                .collect::<Vec<_>>()}
+                        </ul>
+                    </>
+                })}
+            </div>
+        }
+        .into_any(),
+    )
+}
+
+fn render_sbd_section(sbd: &Value) -> Option<AnyView> {
+    if !json_bool(sbd, "found") {
+        return None;
+    }
+
+    let devices = json_array(sbd, "sbdDevices")
+        .iter()
+        .filter_map(value_name)
+        .collect::<Vec<_>>();
+    let sbd_device = json_text(sbd, "sbdDevice");
+    let sbd_pacemaker = json_text(sbd, "sbdPacemaker");
+    let sbd_startmode = json_text(sbd, "sbdStartmode");
+    let sbd_delay_start = json_text(sbd, "sbdDelayStart");
+    let sbd_watchdog_dev = json_text(sbd, "sbdWatchdogDev");
+    let sbd_watchdog_timeout = json_text(sbd, "sbdWatchdogTimeout");
+    let sbd_timeout_action = json_text(sbd, "sbdTimeoutAction");
+    let warnings = json_array(sbd, "warnings");
+    let recommendations = json_array(sbd, "recommendations");
+
+    Some(
+        view! {
+            <div class="subsection">
+                <p class="subsection-title">"SBD Configuration:"</p>
+                <KvTable>
+                    {(!sbd_device.is_empty()).then(|| view! {
+                        <KvRow label="SBD Device" value=sbd_device.clone()/>
+                    })}
+                    {(!devices.is_empty()).then(|| view! {
+                        <KvRow label="SBD Devices" value=devices.join("; ")/>
+                    })}
+                    {(!sbd_pacemaker.is_empty()).then(|| view! {
+                        <KvRow label="SBD_PACEMAKER" value=sbd_pacemaker.clone()/>
+                    })}
+                    {(!sbd_startmode.is_empty()).then(|| view! {
+                        <KvRow label="SBD_STARTMODE" value=sbd_startmode.clone()/>
+                    })}
+                    {(!sbd_delay_start.is_empty()).then(|| view! {
+                        <KvRow label="SBD_DELAY_START" value=sbd_delay_start.clone()/>
+                    })}
+                    {(!sbd_watchdog_dev.is_empty()).then(|| view! {
+                        <KvRow label="Watchdog Device" value=sbd_watchdog_dev.clone()/>
+                    })}
+                    {(!sbd_watchdog_timeout.is_empty()).then(|| view! {
+                        <KvRow label="Watchdog Timeout" value=sbd_watchdog_timeout.clone()/>
+                    })}
+                    {(!sbd_timeout_action.is_empty()).then(|| view! {
+                        <KvRow label="Timeout Action" value=sbd_timeout_action.clone()/>
+                    })}
+                </KvTable>
+
+                {(!warnings.is_empty()).then(|| view! {
+                    <div class="warning-block">
+                        <p><strong>{format!("Warnings ({})", warnings.len())}</strong></p>
+                        <ul class="disk-list">
+                            {warnings
+                                .into_iter()
+                                .map(|warning| {
+                                    let message = json_text(&warning, "message");
+                                    let recommendation = json_text(&warning, "recommendation");
+                                    view! {
+                                        <li>
+                                            {message}
+                                            {(!recommendation.is_empty()).then(|| view! {
+                                                <div class="text-muted">{recommendation}</div>
+                                            })}
+                                        </li>
+                                    }
+                                })
+                                .collect::<Vec<_>>()}
+                        </ul>
+                    </div>
+                })}
+
+                {(!recommendations.is_empty()).then(|| view! {
+                    <details class="content-details">
+                        <summary>{format!("Recommendations ({})", recommendations.len())}</summary>
+                        <ul class="disk-list">
+                            {recommendations
+                                .into_iter()
+                                .map(|item| {
+                                    let message = json_text(&item, "message");
+                                    view! { <li>{message}</li> }
+                                })
+                                .collect::<Vec<_>>()}
+                        </ul>
+                    </details>
+                })}
+            </div>
+        }
+        .into_any(),
+    )
+}
+
+fn render_cluster_events(events: &Value) -> Option<AnyView> {
+    let mut resource_migrations = json_array(events, "resourceMigrations");
+    let mut fencing_events = json_array(events, "fencingEvents");
+
+    if resource_migrations.is_empty() && fencing_events.is_empty() {
+        return None;
+    }
+
+    resource_migrations.sort_by(|a, b| json_text(b, "timestamp").cmp(&json_text(a, "timestamp")));
+    fencing_events.sort_by(|a, b| json_text(b, "timestamp").cmp(&json_text(a, "timestamp")));
+
+    let total_migrations = events
+        .get("totalResourceMigrations")
+        .and_then(|v| v.as_u64())
+        .unwrap_or(resource_migrations.len() as u64) as usize;
+    let total_fencing = events
+        .get("totalFencingEvents")
+        .and_then(|v| v.as_u64())
+        .unwrap_or(fencing_events.len() as u64) as usize;
+    let total_events = total_migrations + total_fencing;
+
+    let rust_high_cpu_input = resource_migrations
+        .iter()
+        .filter_map(|migration| migration.get("logLine").and_then(|v| v.as_str()))
+        .collect::<Vec<_>>()
+        .join("\n");
+    let rust_high_cpu_events = parse_pacemaker_high_cpu(&rust_high_cpu_input, "");
+
+    Some(
+        view! {
+            <details class="warning-block" open=true>
+                <summary>{format!("Cluster Events Detected ({} event{} found)", total_events, if total_events == 1 { "" } else { "s" })}</summary>
+                <div class="section-body">
+                    {(!resource_migrations.is_empty()).then(|| view! {
+                        <>
+                            <p><strong>{format!("Resource Events ({})", total_migrations)}</strong></p>
+                            <ul class="disk-list">
+                                {resource_migrations
+                                    .into_iter()
+                                    .map(|migration| {
+                                        let timestamp = json_text(&migration, "timestamp");
+                                        let resource = json_text(&migration, "resource");
+                                        let action = json_text(&migration, "action");
+                                        let from_node = json_text(&migration, "fromNode");
+                                        let to_node = json_text(&migration, "toNode");
+                                        let source_file = first_non_empty_text(&migration, &["sourcePath", "sourceFile"]);
+                                        let source_line = json_text(&migration, "sourceLine");
+                                        let log_line = first_non_empty_text(&migration, &["rawLine", "logLine"]);
+                                        let description = if action == "migration" && !from_node.is_empty() && !to_node.is_empty() {
+                                            format!("migrated from {} to {}", from_node, to_node)
+                                        } else if action == "start" && !to_node.is_empty() {
+                                            format!("started on {}", to_node)
+                                        } else if action == "stop" && !from_node.is_empty() {
+                                            format!("stopped on {}", from_node)
+                                        } else {
+                                            action.clone()
+                                        };
+                                        view! {
+                                            <li class="event-item">
+                                                {(!timestamp.is_empty()).then(|| view! {
+                                                    <div class="event-timestamp text-info">{timestamp.clone()}</div>
+                                                })}
+                                                <div>
+                                                    <code class="text-info">{resource}</code>
+                                                    {(!description.is_empty()).then(|| view! {
+                                                        <span>{format!(" {}", description.clone())}</span>
+                                                    })}
+                                                </div>
+                                                {(!source_file.is_empty()).then(|| view! {
+                                                    <div class="event-details">
+                                                        {format!(
+                                                            "Source: {}{}",
+                                                            source_file.clone(),
+                                                            if source_line.is_empty() {
+                                                                String::new()
+                                                            } else {
+                                                                format!(":{}", source_line.clone())
+                                                            },
+                                                        )}
+                                                    </div>
+                                                })}
+                                                {(!log_line.is_empty()).then(|| view! {
+                                                    <div class="event-raw-line">{log_line.clone()}</div>
+                                                })}
+                                            </li>
+                                        }
+                                    })
+                                    .collect::<Vec<_>>()}
+                            </ul>
+                        </>
+                    })}
+
+                    {(!rust_high_cpu_events.is_empty()).then(|| view! {
+                        <div class="subsection">
+                            <p><strong>{format!("Rust parser preview: Pacemaker high CPU events ({})", rust_high_cpu_events.len())}</strong></p>
+                            <p class="text-muted">
+                                "This list is produced by the shared Supportfile library used for the WASM UI and the Python prototype."
+                            </p>
+                            <ul class="disk-list">
+                                {rust_high_cpu_events
+                                    .clone()
+                                    .into_iter()
+                                    .map(|event| {
+                                        view! {
+                                            <li class="event-item">
+                                                <div class="event-timestamp text-warning">{event.timestamp}</div>
+                                                <div>
+                                                    <strong class="text-warning">{event.source_node}</strong>
+                                                    {format!(" - {:.6}% CPU via {}", event.cpu_load, event.resource)}
+                                                </div>
+                                                <div class="event-raw-line">{event.raw_line}</div>
+                                            </li>
+                                        }
+                                    })
+                                    .collect::<Vec<_>>()}
+                            </ul>
+                        </div>
+                    })}
+
+                    {(!fencing_events.is_empty()).then(|| view! {
+                        <div class="subsection-danger">
+                            <p><strong>{format!("Fencing/STONITH Events ({})", total_fencing)}</strong></p>
+                            <ul class="disk-list">
+                                {fencing_events
+                                    .into_iter()
+                                    .map(|event| {
+                                        let timestamp = json_text(&event, "timestamp");
+                                        let status = json_text(&event, "status");
+                                        let target_node = json_text(&event, "targetNode");
+                                        let action = json_text(&event, "action");
+                                        let agent = json_text(&event, "agent");
+                                        let source_file = first_non_empty_text(&event, &["sourcePath", "sourceFile"]);
+                                        let source_line = json_text(&event, "sourceLine");
+                                        let log_line = first_non_empty_text(&event, &["rawLine", "logLine"]);
+                                        let status_class = match status.as_str() {
+                                            "success" => "text-success",
+                                            "failed" => "text-danger",
+                                            "requested" | "pending" => "text-warning",
+                                            "in_progress" => "text-info",
+                                            _ => "text-muted",
+                                        };
+                                        view! {
+                                            <li class="event-item">
+                                                {(!timestamp.is_empty()).then(|| view! {
+                                                    <div class="event-timestamp text-danger">{timestamp.clone()}</div>
+                                                })}
+                                                <div>
+                                                    <span class=status_class><strong>{status.to_uppercase()}</strong></span>
+                                                    " - Fencing of node "
+                                                    <strong class="text-danger">{target_node}</strong>
+                                                    {(!action.is_empty() && action != "fence").then(|| view! {
+                                                        <span class="text-muted">{format!(" ({})", action.clone())}</span>
+                                                    })}
+                                                </div>
+                                                {(!agent.is_empty()).then(|| view! {
+                                                    <div class="event-details">{format!("Agent: {}", agent.clone())}</div>
+                                                })}
+                                                {(!source_file.is_empty()).then(|| view! {
+                                                    <div class="event-details">
+                                                        {format!(
+                                                            "Source: {}{}",
+                                                            source_file.clone(),
+                                                            if source_line.is_empty() {
+                                                                String::new()
+                                                            } else {
+                                                                format!(":{}", source_line.clone())
+                                                            },
+                                                        )}
+                                                    </div>
+                                                })}
+                                                {(!log_line.is_empty()).then(|| view! {
+                                                    <div class="event-raw-line">{log_line.clone()}</div>
+                                                })}
+                                            </li>
+                                        }
+                                    })
+                                    .collect::<Vec<_>>()}
+                            </ul>
+                        </div>
+                    })}
+                </div>
+            </details>
+        }
+        .into_any(),
+    )
+}
+
+fn render_cluster_services(cluster_services: &Value) -> Option<AnyView> {
+    let dlm = cluster_services.get("dlmService").cloned().unwrap_or(Value::Null);
+    if !json_bool(&dlm, "detected") {
+        return None;
+    }
+
+    let message = json_text(&dlm, "message");
+    let detection_file = json_text(&dlm, "detectionFile");
+    let doc = json_text(&dlm, "documentationUrl");
+
+    Some(
+        view! {
+            <div class="danger-block">
+                <p class="subsection-title">"Cluster Services"</p>
+                <p><strong>"DLM Service"</strong> " — " {if message.is_empty() { "Enabled".to_string() } else { message }}</p>
+                {(!detection_file.is_empty()).then(|| view! {
+                    <p class="text-muted">{format!("Detected in {}", detection_file)}</p>
+                })}
+                {(!doc.is_empty()).then(|| view! {
+                    <p>
+                        <a href=doc.clone() target="_blank" rel="noopener noreferrer" class="text-info">{doc.clone()}</a>
+                    </p>
+                })}
+            </div>
+        }
+        .into_any(),
+    )
+}
+
+fn render_daemon_status(daemon: &Value) -> Option<AnyView> {
+    if !json_bool(daemon, "found") {
+        return None;
+    }
+
+    let warnings = json_array(daemon, "warnings");
+
+    Some(
+        view! {
+            <div class="subsection">
+                <p class="subsection-title">"Daemon Status:"</p>
+                <table class="data-table">
+                    <thead>
+                        <tr>
+                            <th>"Service"</th>
+                            <th>"Running"</th>
+                            <th>"Boot Enabled"</th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        {[
+                            "corosync",
+                            "pacemaker",
+                            "pcsd",
+                        ]
+                            .into_iter()
+                            .filter_map(|service| {
+                                let status = daemon.get("daemons").and_then(|v| v.get(service))?;
+                                let active = status.get("active").and_then(|v| v.as_bool());
+                                let enabled = status.get("enabled").and_then(|v| v.as_bool());
+                                Some(view! {
+                                    <tr>
+                                        <td><code>{service}</code></td>
+                                        <td class=if active == Some(true) { "text-success" } else { "text-danger" }>
+                                            {match active {
+                                                Some(true) => "active",
+                                                Some(false) => "inactive",
+                                                None => "unknown",
+                                            }}
+                                        </td>
+                                        <td class=if enabled == Some(true) { "text-success" } else { "text-danger" }>
+                                            {match enabled {
+                                                Some(true) => "enabled",
+                                                Some(false) => "disabled",
+                                                None => "unknown",
+                                            }}
+                                        </td>
+                                    </tr>
+                                })
+                            })
+                            .collect::<Vec<_>>()}
+                    </tbody>
+                </table>
+
+                {(!warnings.is_empty()).then(|| view! {
+                    <div class="vm-notes">
+                        {warnings
+                            .into_iter()
+                            .map(|warning| {
+                                let severity = json_text(&warning, "severity");
+                                let message = json_text(&warning, "message");
+                                let recommendation = json_text(&warning, "recommendation");
+                                let class = if severity == "error" {
+                                    "vm-note warning"
+                                } else {
+                                    "vm-note info"
+                                };
+                                view! {
+                                    <div class=class>
+                                        <p><strong>{message}</strong></p>
+                                        {(!recommendation.is_empty()).then(|| view! {
+                                            <p>{recommendation}</p>
+                                        })}
+                                    </div>
+                                }
+                            })
+                            .collect::<Vec<_>>()}
+                    </div>
+                })}
+            </div>
+        }
+        .into_any(),
+    )
+}
+
+fn render_azure_fence_auth(auth: &Value) -> Option<AnyView> {
+    if !json_bool(auth, "found") {
+        return None;
+    }
+
+    let auth_method = json_text(auth, "authMethod");
+    let auth_display = match auth_method.as_str() {
+        "msi" => "Managed Identity (MSI)",
+        "service_principal" => "Service Principal",
+        _ => "Unknown",
+    }
+    .to_string();
+    let auth_class = if auth_method == "msi" {
+        "text-success"
+    } else {
+        "text-warning"
+    };
+    let subscription_id = json_text(auth, "subscriptionId");
+    let resource_group = json_text(auth, "resourceGroup");
+    let tenant_id = json_text(auth, "tenantId");
+    let pcmk_monitor_retries = json_text(auth, "pcmkMonitorRetries");
+    let pcmk_action_limit = json_text(auth, "pcmkActionLimit");
+    let power_timeout = json_text(auth, "powerTimeout");
+    let pcmk_reboot_timeout = json_text(auth, "pcmkRebootTimeout");
+    let pcmk_delay_max = json_text(auth, "pcmkDelayMax");
+    let pcmk_host_map = json_text(auth, "pcmkHostMap");
+    let warnings = json_array(auth, "warnings");
+    let recommendations = json_array(auth, "recommendations");
+
+    Some(
+        view! {
+            <div class="subsection">
+                <p class="subsection-title">"Azure Fence Agent Authentication:"</p>
+                <p>
+                    <strong>"Auth Method:"</strong>
+                    " "
+                    <span class=auth_class>{auth_display}</span>
+                </p>
+                <KvTable>
+                    {(!subscription_id.is_empty()).then(|| view! {
+                        <KvRow label="Subscription ID" value=subscription_id.clone()/>
+                    })}
+                    {(!resource_group.is_empty()).then(|| view! {
+                        <KvRow label="Resource Group" value=resource_group.clone()/>
+                    })}
+                    {(!tenant_id.is_empty()).then(|| view! {
+                        <KvRow label="Tenant ID" value=tenant_id.clone()/>
+                    })}
+                    {(!pcmk_monitor_retries.is_empty()).then(|| view! {
+                        <KvRow label="pcmk_monitor_retries" value=pcmk_monitor_retries.clone()/>
+                    })}
+                    {(!pcmk_action_limit.is_empty()).then(|| view! {
+                        <KvRow label="pcmk_action_limit" value=pcmk_action_limit.clone()/>
+                    })}
+                    {(!power_timeout.is_empty()).then(|| view! {
+                        <KvRow label="power_timeout" value=power_timeout.clone()/>
+                    })}
+                    {(!pcmk_reboot_timeout.is_empty()).then(|| view! {
+                        <KvRow label="pcmk_reboot_timeout" value=pcmk_reboot_timeout.clone()/>
+                    })}
+                    {(!pcmk_delay_max.is_empty()).then(|| view! {
+                        <KvRow label="pcmk_delay_max" value=pcmk_delay_max.clone()/>
+                    })}
+                    {(!pcmk_host_map.is_empty()).then(|| view! {
+                        <KvRow label="pcmk_host_map" value=pcmk_host_map.clone()/>
+                    })}
+                </KvTable>
+
+                {(!warnings.is_empty() || !recommendations.is_empty()).then(|| view! {
+                    <div class="vm-notes">
+                        {warnings
+                            .into_iter()
+                            .chain(recommendations.into_iter())
+                            .map(|item| {
+                                let severity = json_text(&item, "severity");
+                                let message = json_text(&item, "message");
+                                let recommendation = json_text(&item, "recommendation");
+                                let documentation_url = json_text(&item, "documentationUrl");
+                                let class = if severity == "warning" {
+                                    "vm-note warning"
+                                } else {
+                                    "vm-note info"
+                                };
+                                view! {
+                                    <div class=class>
+                                        <p><strong>{message}</strong></p>
+                                        {(!recommendation.is_empty()).then(|| view! {
+                                            <p>{recommendation}</p>
+                                        })}
+                                        {(!documentation_url.is_empty()).then(|| view! {
+                                            <p>
+                                                <a
+                                                    href=documentation_url
+                                                    target="_blank"
+                                                    rel="noopener noreferrer"
+                                                    class="text-info"
+                                                >
+                                                    "View Documentation"
+                                                </a>
+                                            </p>
+                                        })}
+                                    </div>
+                                }
+                            })
+                            .collect::<Vec<_>>()}
+                    </div>
+                })}
+            </div>
+        }
+        .into_any(),
+    )
+}
+
+fn resource_spec(resource: &Value) -> String {
+    let class = json_text(resource, "class");
+    let provider = json_text(resource, "provider");
+    let resource_type = json_text(resource, "type");
+
+    if resource_type.is_empty() {
+        String::new()
+    } else if class.is_empty() && provider.is_empty() {
+        resource_type
+    } else if provider.is_empty() {
+        format!("{}:{}", class, resource_type)
+    } else {
+        format!("{}::{}:{}", class, provider, resource_type)
+    }
+}
+
+fn json_text(value: &Value, key: &str) -> String {
+    value.get(key).and_then(value_as_text).unwrap_or_default()
+}
+
+fn first_non_empty_text(value: &Value, keys: &[&str]) -> String {
+    for key in keys {
+        let text = json_text(value, key);
+        if !text.is_empty() {
+            return text;
+        }
+    }
+    String::new()
+}
+
+fn value_as_text(value: &Value) -> Option<String> {
+    value
+        .as_str()
+        .map(|s| s.trim().to_string())
+        .filter(|s| !s.is_empty())
+        .or_else(|| value.as_i64().map(|v| v.to_string()))
+        .or_else(|| value.as_u64().map(|v| v.to_string()))
+        .or_else(|| {
+            value
+                .as_bool()
+                .map(|v| if v { "true" } else { "false" }.to_string())
+        })
+        .or_else(|| {
+            value.as_f64().map(|v| {
+                if v.fract() == 0.0 {
+                    format!("{v:.0}")
+                } else {
+                    v.to_string()
+                }
+            })
+        })
+}
+
+/// Section 6 – Applications (SAP / EPIC).
+#[component]
+pub fn ApplicationsSection(data: Value) -> impl IntoView {
+    let directories = json_array(&data, "directories");
+    let files = json_array(&data, "files");
+    let pacemaker = data
+        .get("pacemakerResources")
+        .cloned()
+        .unwrap_or(Value::Null);
+    let resources = json_array(&pacemaker, "resources");
+    let distro_packages = data.get("distroPackages").cloned().unwrap_or(Value::Null);
+    let basic_environment = data.get("basicEnvironment").cloned().unwrap_or(Value::Null);
+
+    let dir_list = directories
+        .iter()
+        .filter_map(value_name)
+        .map(|name| name.to_ascii_lowercase())
+        .collect::<Vec<_>>();
+    let file_list = files
+        .iter()
+        .filter_map(value_name)
+        .map(|name| name.to_ascii_lowercase())
+        .collect::<Vec<_>>();
+
+    let sap_paths = ["usr/sap", "sapmnt", "hana/shared", "hana/data", "hana/log"];
+    let found_sap_indicator = sap_paths.iter().any(|path| {
+        dir_list.iter().any(|entry| entry.contains(path))
+            || file_list.iter().any(|entry| entry.contains(path))
+    });
+
+    let hana_resources = resources
+        .iter()
+        .filter_map(|resource| {
+            let name = json_str(resource, "name");
+            let resource_type = json_str(resource, "type");
+            let provider = json_str(resource, "provider");
+            let haystack = format!(
+                "{} {} {}",
+                name.to_ascii_lowercase(),
+                resource_type.to_ascii_lowercase(),
+                provider.to_ascii_lowercase(),
+            );
+
+            if haystack.contains("hana") || haystack.contains("hdb") || haystack.contains("saphana")
+            {
+                Some(name)
+            } else {
+                None
+            }
+        })
+        .collect::<Vec<_>>();
+
+    let sap_pacemaker_resources = resources
+        .iter()
+        .filter_map(|resource| {
+            let name = json_str(resource, "name");
+            let resource_type = json_str(resource, "type");
+            let provider = json_str(resource, "provider");
+            let haystack = format!(
+                "{} {} {}",
+                name.to_ascii_lowercase(),
+                resource_type.to_ascii_lowercase(),
+                provider.to_ascii_lowercase(),
+            );
+
+            if haystack.contains("sap") || resource_type.contains("SAPInstance") {
+                Some(name)
+            } else {
+                None
+            }
+        })
+        .collect::<Vec<_>>();
+
+    let sap_packages = collect_packages(&distro_packages, &["sap", "hana", "hdb", "saptune"]);
+    let service_files_found = file_list.iter().any(|entry| {
+        entry.ends_with(".service")
+            || entry.contains("/etc/systemd/")
+            || entry.contains("systemctl")
+            || entry.contains("sapstart")
+            || entry.contains("sapstartsrv")
+            || entry.contains("saposcol")
+    });
+
+    let basic_env_sap = json_bool(&basic_environment, "sapProductDetected")
+        || json_str(&basic_environment, "product")
+            .to_ascii_lowercase()
+            .contains("sap")
+        || json_str(&basic_environment, "prettyName")
+            .to_ascii_lowercase()
+            .contains("sap")
+        || json_str(&basic_environment, "name")
+            .to_ascii_lowercase()
+            .contains("sap");
+
+    let sap_detected = found_sap_indicator
+        || !hana_resources.is_empty()
+        || !sap_pacemaker_resources.is_empty()
+        || !sap_packages.is_empty()
+        || service_files_found
+        || basic_env_sap;
+
+    let basic_env_epic = basic_environment
+        .get("epicProductDetected")
+        .and_then(|value| value.as_bool())
+        .unwrap_or(false);
+    let epic_packages = collect_packages(
+        &distro_packages,
+        &[
+            "sap-instance-",
+            "sapstartsrv",
+            "sap-saptune",
+            "sap-host-agent",
+            "lvm2-clvm",
+        ],
+    );
+    let epic_pacemaker_resources = resources
+        .iter()
+        .filter_map(|resource| {
+            let name = json_str(resource, "name");
+            let resource_type = json_str(resource, "type");
+            let haystack = format!(
+                "{} {}",
+                name.to_ascii_lowercase(),
+                resource_type.to_ascii_lowercase(),
+            );
+
+            if haystack.contains("epic") || haystack.contains("sap") {
+                Some(name)
+            } else {
+                None
+            }
+        })
+        .collect::<Vec<_>>();
+    let epic_detected =
+        basic_env_epic || !epic_packages.is_empty() || !epic_pacemaker_resources.is_empty();
+
+    if !sap_detected && !epic_detected {
+        return view! {}.into_any();
+    }
+
+    let mut sap_sources = Vec::new();
+    if found_sap_indicator {
+        sap_sources.push("SAP directory structure (/usr/sap, /hana/*, /sapmnt)".to_string());
+    }
+    if !hana_resources.is_empty() {
+        sap_sources.push(format!("HANA resources ({})", hana_resources.join(", ")));
+    }
+    if !sap_pacemaker_resources.is_empty() {
+        sap_sources.push(format!(
+            "SAP pacemaker resources ({})",
+            sap_pacemaker_resources.join(", "),
+        ));
+    }
+    if !sap_packages.is_empty() {
+        sap_sources.push(format!("SAP packages ({})", sap_packages.join(", ")));
+    }
+    if service_files_found {
+        sap_sources.push("SAP service files".to_string());
+    }
+    if basic_env_sap {
+        sap_sources.push("SAP product identification in OS metadata".to_string());
+    }
+
+    let mut epic_sources = Vec::new();
+    if basic_env_epic {
+        epic_sources.push("EPIC product identification in OS metadata".to_string());
+    }
+    if !epic_pacemaker_resources.is_empty() {
+        epic_sources.push(format!(
+            "EPIC pacemaker resources ({})",
+            epic_pacemaker_resources.join(", "),
+        ));
+    }
+    if !epic_packages.is_empty() {
+        epic_sources.push(format!("EPIC packages ({})", epic_packages.join(", ")));
+    }
+
+    view! {
+        <Section title="[OK] Applications" class="success-block" open=true>
+            {sap_detected.then(|| view! {
+                <div class="subsection">
+                    <p class="text-success"><strong>"SAP Applications Detected"</strong></p>
+                    <p>"The analysis detected SAP-related components:"</p>
+                    <ul>
+                        {sap_sources
+                            .into_iter()
+                            .map(|source| view! { <li>{format!("[OK] {source}")}</li> })
+                            .collect::<Vec<_>>()}
+                    </ul>
+                </div>
+            })}
+
+            {epic_detected.then(|| view! {
+                <div class="subsection">
+                    <p class="text-success"><strong>"SAP EPIC Applications Detected"</strong></p>
+                    <p>"The analysis detected SAP EPIC-related components:"</p>
+                    <ul>
+                        {epic_sources
+                            .into_iter()
+                            .map(|source| view! { <li>{format!("[OK] {source}")}</li> })
+                            .collect::<Vec<_>>()}
+                    </ul>
+                </div>
+            })}
+        </Section>
+    }
+    .into_any()
+}
+
+/// Section 7 – SAP Instance Configuration.
+#[component]
+pub fn SapInstanceSection(data: Value) -> impl IntoView {
+    let sap_config = data
+        .get("sapInstanceConfig")
+        .cloned()
+        .unwrap_or(Value::Null);
+    let sap_errors = data
+        .get("sapInstanceErrors")
+        .cloned()
+        .unwrap_or(Value::Null);
+
+    let config_warnings = json_array(&sap_config, "warnings");
+    let runtime_errors = json_array(&sap_errors, "errors");
+
+    let has_issues = (json_bool(&sap_config, "found") && !config_warnings.is_empty())
+        || (json_bool(&sap_errors, "found") && !runtime_errors.is_empty());
+    if !has_issues {
+        return view! {}.into_any();
+    }
+
+    let total_issues = config_warnings.len() + runtime_errors.len();
+    let has_errors = runtime_errors
+        .iter()
+        .any(|entry| json_str(entry, "severity").eq_ignore_ascii_case("error"));
+    let block_class = if has_errors {
+        "danger-block"
+    } else {
+        "warning-block"
+    };
+
+    let instances = json_array(&sap_config, "instances");
+    let start_profile_errors = runtime_errors
+        .iter()
+        .filter(|entry| json_str(entry, "type") == "start_profile_not_found")
+        .cloned()
+        .collect::<Vec<_>>();
+    let gray_status_errors = runtime_errors
+        .iter()
+        .filter(|entry| json_str(entry, "type") == "sap_service_gray_status")
+        .cloned()
+        .collect::<Vec<_>>();
+    let filesystem_errors = runtime_errors
+        .iter()
+        .filter(|entry| json_str(entry, "type") == "filesystem_unmount_error")
+        .cloned()
+        .collect::<Vec<_>>();
+
+    view! {
+        <details class=block_class open=true>
+            <summary>
+                {format!(
+                    "SAP Instance Configuration ({} issue{} found)",
+                    total_issues,
+                    if total_issues == 1 { "" } else { "s" },
+                )}
+            </summary>
+
+            <div class="section-body">
+                {(!instances.is_empty()).then(|| view! {
+                    <div class="subsection">
+                        <p><strong>"SAPInstance Resources:"</strong></p>
+                        <table class="data-table">
+                            <thead>
+                                <tr>
+                                    <th>"Resource"</th>
+                                    <th>"InstanceName"</th>
+                                    <th>"START_PROFILE"</th>
+                                </tr>
+                            </thead>
+                            <tbody>
+                                {instances
+                                    .into_iter()
+                                    .map(|instance| {
+                                        let resource_name = json_str(&instance, "resourceName");
+                                        let instance_name = json_str(&instance, "instanceName");
+                                        let start_profile = json_str(&instance, "startProfile");
+                                        view! {
+                                            <tr>
+                                                <td><code>{resource_name}</code></td>
+                                                <td><code>{if instance_name.is_empty() {
+                                                    "N/A".to_string()
+                                                } else {
+                                                    instance_name
+                                                }}</code></td>
+                                                <td><code>{if start_profile.is_empty() {
+                                                    "N/A".to_string()
+                                                } else {
+                                                    start_profile
+                                                }}</code></td>
+                                            </tr>
+                                        }
+                                    })
+                                    .collect::<Vec<_>>()}
+                            </tbody>
+                        </table>
+                    </div>
+                })}
+
+                {(!config_warnings.is_empty()).then(|| view! {
+                    <div class="warning-block">
+                        <p class="text-warning"><strong>"Configuration Issues:"</strong></p>
+                        {config_warnings
+                            .into_iter()
+                            .map(|warning| {
+                                let severity = json_str(&warning, "severity");
+                                let message = json_str(&warning, "message");
+                                let resource = json_str(&warning, "resource");
+                                let recommendation = json_str(&warning, "recommendation");
+                                let documentation_url = json_str(&warning, "documentationUrl");
+                                let text_class = if severity == "error" {
+                                    "text-danger"
+                                } else {
+                                    "text-warning"
+                                };
+                                view! {
+                                    <div class="subsection">
+                                        <p class=text_class><strong>{message}</strong></p>
+                                        {(!resource.is_empty()).then(|| view! {
+                                            <p>
+                                                <strong>"Resource:"</strong>
+                                                " "
+                                                <code>{resource}</code>
+                                            </p>
+                                        })}
+                                        {(!recommendation.is_empty()).then(|| view! {
+                                            <p>
+                                                <strong>"Recommendation:"</strong>
+                                                " "
+                                                {recommendation}
+                                            </p>
+                                        })}
+                                        {(!documentation_url.is_empty()).then(|| view! {
+                                            <p>
+                                                <a
+                                                    href=documentation_url
+                                                    target="_blank"
+                                                    rel="noopener noreferrer"
+                                                    class="text-info"
+                                                >
+                                                    "View Documentation"
+                                                </a>
+                                            </p>
+                                        })}
+                                    </div>
+                                }
+                            })
+                            .collect::<Vec<_>>()}
+                    </div>
+                })}
+
+                {render_sap_issue_group(
+                    "START_PROFILE Errors",
+                    "The SAP instance cannot find the expected START profile.",
+                    start_profile_errors,
+                    "danger-block",
+                )}
+                {render_sap_issue_group(
+                    "SAP Services in GRAY Status",
+                    "SAP instance services are not running properly.",
+                    gray_status_errors,
+                    "danger-block",
+                )}
+                {render_sap_issue_group(
+                    "Filesystem Errors",
+                    "Filesystem operations failed during cluster resource management.",
+                    filesystem_errors,
+                    "warning-block",
+                )}
+            </div>
+        </details>
+    }
+    .into_any()
+}
+
+fn value_name(value: &Value) -> Option<String> {
+    value.as_str().map(|name| name.to_string()).or_else(|| {
+        value
+            .get("name")
+            .and_then(|name| name.as_str())
+            .map(|name| name.to_string())
+    })
+}
+
+fn collect_packages(packages_value: &Value, patterns: &[&str]) -> Vec<String> {
+    packages_value
+        .get("packages")
+        .and_then(|packages| packages.as_object())
+        .map(|packages| {
+            packages
+                .iter()
+                .filter_map(|(name, version)| {
+                    let lower_name = name.to_ascii_lowercase();
+                    if patterns.iter().any(|pattern| lower_name.contains(pattern)) {
+                        let version = version.as_str().unwrap_or("");
+                        if version.is_empty() {
+                            Some(name.clone())
+                        } else {
+                            Some(format!("{name}-{version}"))
+                        }
+                    } else {
+                        None
+                    }
+                })
+                .collect::<Vec<_>>()
+        })
+        .unwrap_or_default()
+}
+
+fn render_sap_issue_group(
+    title: &'static str,
+    intro: &'static str,
+    items: Vec<Value>,
+    class: &'static str,
+) -> Option<AnyView> {
+    if items.is_empty() {
+        return None;
+    }
+
+    let len = items.len();
+    let recommendation = items.iter().find_map(|item| {
+        let recommendation = json_str(item, "recommendation");
+        if recommendation.is_empty() {
+            None
+        } else {
+            Some(recommendation)
+        }
+    });
+
+    Some(
+        view! {
+            <div class=class>
+                <p><strong>{format!("{title} ({len})")}</strong></p>
+                <p>{intro}</p>
+
+                {items
+                    .into_iter()
+                    .map(|item| {
+                        let resource_name = json_str(&item, "resourceName");
+                        let service_name = json_str(&item, "serviceName");
+                        let mount_point = json_str(&item, "mountPoint");
+                        let profile_path = json_str(&item, "profilePath");
+                        let message = json_str(&item, "message");
+                        let timestamp = json_str(&item, "timestamp");
+                        let source_file = json_str(&item, "sourceFile");
+                        let raw_line = json_str(&item, "rawLine");
+                        let line_number = item
+                            .get("lineNumber")
+                            .and_then(|value| value.as_u64())
+                            .map(|value| value.to_string())
+                            .unwrap_or_default();
+
+                        view! {
+                            <div class="subsection">
+                                {(!resource_name.is_empty()).then(|| view! {
+                                    <p>
+                                        <strong>"Resource:"</strong>
+                                        " "
+                                        <code>{resource_name}</code>
+                                    </p>
+                                })}
+                                {(!service_name.is_empty()).then(|| view! {
+                                    <p>
+                                        <strong>"Service:"</strong>
+                                        " "
+                                        <code>{service_name}</code>
+                                    </p>
+                                })}
+                                {(!mount_point.is_empty()).then(|| view! {
+                                    <p>
+                                        <strong>"Mount Point:"</strong>
+                                        " "
+                                        <code>{mount_point}</code>
+                                    </p>
+                                })}
+                                {(!profile_path.is_empty()).then(|| view! {
+                                    <p>
+                                        <strong>"Profile Path:"</strong>
+                                        " "
+                                        <code>{profile_path}</code>
+                                    </p>
+                                })}
+                                {(!message.is_empty()).then(|| view! {
+                                    <p>
+                                        <strong>"Error:"</strong>
+                                        " "
+                                        {message}
+                                    </p>
+                                })}
+                                {(!timestamp.is_empty()).then(|| view! {
+                                    <p class="text-muted">{format!("Timestamp: {timestamp}")}</p>
+                                })}
+                                {(!source_file.is_empty() || !line_number.is_empty()).then(|| view! {
+                                    <p class="text-muted">
+                                        <strong>"Source:"</strong>
+                                        " "
+                                        <code>{if line_number.is_empty() {
+                                            source_file.clone()
+                                        } else {
+                                            format!("{} (line {})", source_file, line_number)
+                                        }}</code>
+                                    </p>
+                                })}
+                                {(!raw_line.is_empty()).then(|| view! {
+                                    <details class="content-details">
+                                        <summary>"Show raw log line"</summary>
+                                        <pre>{raw_line}</pre>
+                                    </details>
+                                })}
+                            </div>
+                        }
+                    })
+                    .collect::<Vec<_>>()}
+
+                {recommendation.map(|text| {
+                    view! {
+                        <p>
+                            <strong>"Recommendation:"</strong>
+                            " "
+                            {text}
+                        </p>
+                    }
+                })}
+            </div>
+        }
+        .into_any(),
+    )
+}
diff --git a/rca-tool/web-leptos/src/components/sections/deadlocks.rs b/rca-tool/web-leptos/src/components/sections/deadlocks.rs
new file mode 100644
index 0000000..eaec24b
--- /dev/null
+++ b/rca-tool/web-leptos/src/components/sections/deadlocks.rs
@@ -0,0 +1,215 @@
+use leptos::prelude::*;
+use serde_json::Value;
+
+use super::helpers::*;
+
+/// Section – SAP HANA deadlocks (from indexserver/nameserver trace files).
+#[component]
+pub fn DeadlocksSection(data: Value) -> impl IntoView {
+    let dl = data.get("hanaDeadlocks").cloned().unwrap_or(Value::Null);
+
+    if !json_bool(&dl, "found") {
+        return view! {}.into_any();
+    }
+
+    let warnings = json_array(&dl, "warnings");
+    let error_count = warnings
+        .iter()
+        .filter(|w| json_str(w, "severity") == "error")
+        .count();
+    let warning_count = warnings.len() - error_count;
+    let class = if error_count > 0 {
+        "danger-block"
+    } else if warning_count > 0 {
+        "warning-block"
+    } else {
+        "content-details"
+    };
+
+    view! {
+        <Section title="SAP HANA Deadlocks" class=class>
+            {render_deadlock_summary(&dl)}
+            {render_deadlock_warnings(&warnings)}
+            {render_top_counts(&dl, "topObjects", "Most contended objects", "Object")}
+            {render_top_counts(&dl, "topStatements", "Most rolled-back statements", "Statement hash")}
+            {render_deadlock_table(&dl)}
+        </Section>
+    }
+    .into_any()
+}
+
+fn render_deadlock_summary(dl: &Value) -> AnyView {
+    let count = json_u64(dl, "count");
+    let last = json_str(dl, "lastDeadlock");
+
+    view! {
+        <table class="kv-table">
+            <tbody>
+                <KvRow label="Deadlocks detected" value=count.to_string()/>
+                <KvRow
+                    label="Last deadlock"
+                    value=if last.is_empty() { "—".to_string() } else { last }
+                />
+            </tbody>
+        </table>
+    }
+    .into_any()
+}
+
+fn render_deadlock_warnings(warnings: &[Value]) -> Option<AnyView> {
+    if warnings.is_empty() {
+        return None;
+    }
+
+    Some(
+        warnings
+            .iter()
+            .map(|warning| {
+                let severity = json_str(warning, "severity");
+                let message = json_str(warning, "message");
+                let details = json_str(warning, "details");
+                let recommendation = json_str(warning, "recommendation");
+                let class = if severity == "error" {
+                    "danger-block"
+                } else if severity == "warning" {
+                    "warning-block"
+                } else {
+                    "info-block"
+                };
+                let heading = if severity == "error" {
+                    "Error"
+                } else if severity == "warning" {
+                    "Warning"
+                } else {
+                    "Info"
+                };
+                view! {
+                    <div class=class>
+                        <p>
+                            <strong>{format!("{heading}:")}</strong>
+                            " "
+                            {message}
+                        </p>
+                        {(!details.is_empty())
+                            .then(|| view! { <p><code>{details}</code></p> })}
+                        {(!recommendation.is_empty())
+                            .then(|| view! { <p>{recommendation}</p> })}
+                    </div>
+                }
+            })
+            .collect::<Vec<_>>()
+            .into_any(),
+    )
+}
+
+/// Render a `name -> count` top-N list (top objects / top statements).
+fn render_top_counts(dl: &Value, key: &str, title: &str, label: &str) -> Option<AnyView> {
+    let counts = json_array(dl, key);
+    if counts.is_empty() {
+        return None;
+    }
+    let title = title.to_string();
+    let label = label.to_string();
+
+    let rows = counts
+        .iter()
+        .map(|row| {
+            let name = json_str(row, "name");
+            let count = json_u64(row, "count");
+            view! {
+                <tr>
+                    <td><code>{name}</code></td>
+                    <td>{count.to_string()}</td>
+                </tr>
+            }
+        })
+        .collect::<Vec<_>>();
+
+    Some(
+        view! {
+            <details class="content-details">
+                <summary>{title}</summary>
+                <table class="data-table">
+                    <thead>
+                        <tr>
+                            <th>{label}</th>
+                            <th>"Deadlocks"</th>
+                        </tr>
+                    </thead>
+                    <tbody>{rows}</tbody>
+                </table>
+            </details>
+        }
+        .into_any(),
+    )
+}
+
+fn render_deadlock_table(dl: &Value) -> Option<AnyView> {
+    let deadlocks = json_array(dl, "deadlocks");
+    if deadlocks.is_empty() {
+        return None;
+    }
+
+    // Cap the rendered rows to keep the DOM light on multi-day traces.
+    const MAX_ROWS: usize = 200;
+    let total = deadlocks.len();
+    let truncated = total > MAX_ROWS;
+
+    let rows = deadlocks
+        .iter()
+        .take(MAX_ROWS)
+        .map(|row| {
+            let timestamp = json_str(row, "timestamp");
+            let participants = json_u64(row, "participantCount");
+            let objects = json_array(row, "objects")
+                .iter()
+                .map(|o| o.as_str().unwrap_or("").to_string())
+                .collect::<Vec<_>>()
+                .join(", ");
+            let victim = row.get("victim").cloned().unwrap_or(Value::Null);
+            let victim_host = json_str(&victim, "clientHost");
+            let victim_user = json_str(&victim, "dbUser");
+            let victim_label = match (victim_host.is_empty(), victim_user.is_empty()) {
+                (true, true) => "—".to_string(),
+                (false, true) => victim_host,
+                (true, false) => victim_user,
+                (false, false) => format!("{victim_user} @ {victim_host}"),
+            };
+            view! {
+                <tr>
+                    <td>{timestamp}</td>
+                    <td>{participants.to_string()}</td>
+                    <td><code>{objects}</code></td>
+                    <td>{victim_label}</td>
+                </tr>
+            }
+        })
+        .collect::<Vec<_>>();
+
+    Some(
+        view! {
+            <details class="content-details">
+                <summary>
+                    {format!("Deadlock events ({total})")}
+                </summary>
+                <table class="data-table">
+                    <thead>
+                        <tr>
+                            <th>"Timestamp"</th>
+                            <th>"Parties"</th>
+                            <th>"Objects"</th>
+                            <th>"Victim"</th>
+                        </tr>
+                    </thead>
+                    <tbody>{rows}</tbody>
+                </table>
+                {truncated.then(|| view! {
+                    <p class="muted">
+                        {format!("Showing first {MAX_ROWS} of {total} deadlock events.")}
+                    </p>
+                })}
+            </details>
+        }
+        .into_any(),
+    )
+}
diff --git a/rca-tool/web-leptos/src/components/sections/distribution.rs b/rca-tool/web-leptos/src/components/sections/distribution.rs
new file mode 100644
index 0000000..97de1f1
--- /dev/null
+++ b/rca-tool/web-leptos/src/components/sections/distribution.rs
@@ -0,0 +1,1027 @@
+use leptos::prelude::*;
+use serde_json::Value;
+
+use super::helpers::*;
+
+/// Section 8 – Distribution (RHUI, FIPS, Leapp, Packages).
+#[component]
+pub fn DistributionSection(data: Value) -> impl IntoView {
+    let rhui = data.get("rhuiConfig").cloned().unwrap_or(Value::Null);
+    let eus = data.get("eusVersionLock").cloned().unwrap_or(Value::Null);
+    let rhel_rhui = data.get("rhelRhuiCheck").cloned().unwrap_or(Value::Null);
+    let crypto = data.get("cryptoPolicies").cloned().unwrap_or(Value::Null);
+    let rhui_err = data.get("rhuiErrors").cloned().unwrap_or(Value::Null);
+    let fips_setup = data.get("fipsModeSetup").cloned().unwrap_or(Value::Null);
+    let kcmd = data.get("kernelCmdline").cloned().unwrap_or(Value::Null);
+    let ktune = data.get("kernelTuning").cloned().unwrap_or(Value::Null);
+    let waagent = data.get("waagentConfig").cloned().unwrap_or(Value::Null);
+    let distro_pkgs = data.get("distroPackages").cloned().unwrap_or(Value::Null);
+    let leapp_report = data.get("leappReport").cloned().unwrap_or(Value::Null);
+    let leapp_log = data.get("leappLog").cloned().unwrap_or(Value::Null);
+
+    let has_rhui = json_bool(&rhui, "found")
+        || json_bool(&eus, "found")
+        || json_bool(&rhel_rhui, "found")
+        || json_bool(&crypto, "found")
+        || json_bool(&rhui_err, "found");
+    let has_fips = json_bool(&fips_setup, "found")
+        || json_bool(&kcmd, "found")
+        || (json_bool(&ktune, "found") && ktune.get("fipsEnabled").is_some())
+        || json_bool(&crypto, "found");
+    let has_leapp = json_bool(&leapp_report, "found") || json_bool(&leapp_log, "found");
+    let has_pkgs = json_bool(&distro_pkgs, "found");
+
+    if !has_rhui && !has_fips && !has_leapp && !has_pkgs {
+        return view! {}.into_any();
+    }
+
+    let warnings = collect_warnings(&[
+        &rhui,
+        &eus,
+        &rhel_rhui,
+        &crypto,
+        &rhui_err,
+        &leapp_report,
+        &leapp_log,
+    ]);
+    let section_class = if warnings.is_empty() {
+        "content-details"
+    } else {
+        "warning-block"
+    };
+
+    view! {
+        <Section title="Distribution" class=section_class open=true>
+            {has_rhui.then(|| render_rhui_section(&rhui, &eus, &rhel_rhui, &crypto, &rhui_err, warnings.clone()))}
+            {has_fips.then(|| render_fips_section(&fips_setup, &kcmd, &ktune, &crypto, &waagent, &distro_pkgs))}
+            {has_leapp.then(|| render_leapp_section(&leapp_report, &leapp_log))}
+            {has_pkgs.then(|| render_packages_section(&distro_pkgs))}
+        </Section>
+    }
+    .into_any()
+}
+
+fn render_rhui_section(
+    rhui: &Value,
+    eus: &Value,
+    rhel_rhui: &Value,
+    crypto: &Value,
+    rhui_err: &Value,
+    warnings: Vec<Value>,
+) -> AnyView {
+    let rhui = rhui.clone();
+    let eus = eus.clone();
+    let rhel_rhui = rhel_rhui.clone();
+    let crypto = crypto.clone();
+    let rhui_err = rhui_err.clone();
+
+    let repo_values = json_array(&rhui, "repos");
+    let repo_list = repo_values
+        .iter()
+        .filter(|repo| json_bool(repo, "isMicrosoft") || json_bool(repo, "isEus"))
+        .cloned()
+        .collect::<Vec<_>>();
+    let enabled_repo_count = repo_list
+        .iter()
+        .filter(|repo| json_bool(repo, "enabled"))
+        .count();
+
+    let connectivity =
+        if json_bool(&rhui_err, "hasCertExpiration") || json_bool(&rhui_err, "hasHttp403") {
+            "Certificate Issue Detected"
+        } else if json_bool(&rhui_err, "hasHttp400") {
+            "EUS Version Issue Detected"
+        } else if json_bool(&rhui_err, "hasConnectionError") {
+            "Connection Error"
+        } else {
+            "Issues Detected"
+        };
+    let rhui_found = json_bool(&rhui_err, "found");
+
+    view! {
+        <details class="content-details" open=true>
+            <summary>"RHUI Configuration"</summary>
+            <div class="section-body">
+                {(!warnings.is_empty()).then(|| view! {
+                    <div class="warning-block">
+                        <p class="text-warning"><strong>{format!("RHUI Warnings ({}):", warnings.len())}</strong></p>
+                        <ul>
+                            {warnings
+                                .into_iter()
+                                .map(|warning| {
+                                    let warning_type = json_str(&warning, "type");
+                                    let message = json_str(&warning, "message");
+                                    let recommendation = json_str(&warning, "recommendation");
+                                    let docs = json_str(&warning, "documentationUrl");
+                                    view! {
+                                        <li>
+                                            <strong>{if warning_type.is_empty() { "warning".to_string() } else { warning_type }}</strong>
+                                            ": "
+                                            {message}
+                                            {(!recommendation.is_empty()).then(|| view! {
+                                                <div class="text-muted">{format!("Recommendation: {recommendation}")}</div>
+                                            })}
+                                            {(!docs.is_empty()).then(|| view! {
+                                                <div>
+                                                    <a href=docs.clone() target="_blank" rel="noopener noreferrer" class="text-info">"[docs]"</a>
+                                                </div>
+                                            })}
+                                        </li>
+                                    }
+                                })
+                                .collect::<Vec<_>>()}
+                        </ul>
+                    </div>
+                })}
+
+                <KvTable>
+                    {json_bool(&rhel_rhui, "found").then(|| {
+                        let has_pkg = json_bool(&rhel_rhui, "hasRhuiPackage");
+                        let packages = string_array_from_key(&rhel_rhui, "rhuiPackages");
+                        let rhui_type = json_str(&rhel_rhui, "rhuiType");
+                        let value = if has_pkg {
+                            if rhui_type.is_empty() {
+                                packages.join(", ")
+                            } else {
+                                format!("{} ({})", packages.join(", "), rhui_type)
+                            }
+                        } else {
+                            "Not found".to_string()
+                        };
+                        let class = if has_pkg {
+                            "text-success".to_string()
+                        } else {
+                            "text-danger".to_string()
+                        };
+                        view! { <KvRow label="RHUI Package" value=value class=class/> }
+                    })}
+                    {json_bool(&eus, "found").then(|| {
+                        let value = if json_bool(&eus, "hasReleaseverFile") {
+                            let releasever = json_str(&eus, "releasever");
+                            let source = json_str(&eus, "source");
+                            if source.is_empty() {
+                                releasever
+                            } else {
+                                format!("{} (from {})", releasever, source)
+                            }
+                        } else {
+                            "Not locked".to_string()
+                        };
+                        view! { <KvRow label="EUS Version Lock" value=value/> }
+                    })}
+                    {json_bool(&crypto, "found").then(|| {
+                        let policy = json_str(&crypto, "policy");
+                        let is_default = crypto
+                            .get("isDefault")
+                            .and_then(|value| value.as_bool())
+                            .unwrap_or(false);
+                        let value = if policy.is_empty() {
+                            "-".to_string()
+                        } else if is_default {
+                            policy
+                        } else {
+                            format!("{} (non-default)", policy)
+                        };
+                        let class = if is_default {
+                            "text-success".to_string()
+                        } else {
+                            "text-warning".to_string()
+                        };
+                        view! { <KvRow label="Crypto Policy" value=value class=class/> }
+                    })}
+                    {rhui_found.then(|| {
+                        let class = if connectivity.contains("Certificate") {
+                            "text-danger".to_string()
+                        } else {
+                            "text-warning".to_string()
+                        };
+                        view! { <KvRow label="RHUI Connectivity" value=connectivity.to_string() class=class/> }
+                    })}
+                </KvTable>
+
+                {(!repo_list.is_empty()).then(|| view! {
+                    <div class="subsection">
+                        <p><strong>"RHUI Repositories:"</strong> <span class="text-muted">{format!("({} enabled)", enabled_repo_count)}</span></p>
+                        <ul>
+                            {repo_list
+                                .into_iter()
+                                .map(|repo| {
+                                    let name = json_str(&repo, "name");
+                                    let enabled = json_bool(&repo, "enabled");
+                                    let is_eus = json_bool(&repo, "isEus");
+                                    let status = if enabled { "enabled" } else { "disabled" };
+                                    let class = if enabled { "text-success" } else { "text-muted" };
+                                    view! {
+                                        <li>
+                                            <code>{name}</code>
+                                            {is_eus.then(|| view! { <span class="text-info">" [EUS]"</span> })}
+                                            " - "
+                                            <span class=class>{status}</span>
+                                        </li>
+                                    }
+                                })
+                                .collect::<Vec<_>>()}
+                        </ul>
+                    </div>
+                })}
+
+                {render_rhui_errors(&rhui_err)}
+            </div>
+        </details>
+    }
+    .into_any()
+}
+
+fn render_rhui_errors(rhui_err: &Value) -> Option<AnyView> {
+    if !json_bool(rhui_err, "found") {
+        return None;
+    }
+
+    let errors = json_array(rhui_err, "errors");
+    let affected_repos = string_array_from_key(rhui_err, "affectedRepos");
+    let has_errors = !errors.is_empty();
+    let has_samples = errors.iter().any(|err| !json_str(err, "sample").is_empty());
+    let errors_for_list = errors.clone();
+    let errors_for_samples = errors.clone();
+
+    Some(
+        view! {
+            <div class="subsection">
+                {has_errors.then(|| view! {
+                    <>
+                        <p><strong>"Errors Found:"</strong></p>
+                        <ul>
+                            {errors_for_list
+                                .iter()
+                                .map(|err| {
+                                    let repo = json_str(err, "repo");
+                                    let message = json_str(err, "message");
+                                    let kind = json_str(err, "type");
+                                    let class = if kind == "certificate_expired" || kind == "http_403" {
+                                        "text-danger"
+                                    } else {
+                                        "text-warning"
+                                    };
+                                    view! {
+                                        <li>
+                                            {(!repo.is_empty()).then(|| view! { <code>{format!("{}: ", repo)}</code> })}
+                                            <span class=class>{message}</span>
+                                        </li>
+                                    }
+                                })
+                                .collect::<Vec<_>>()}
+                        </ul>
+                    </>
+                })}
+
+                {has_samples.then(|| view! {
+                    <details class="content-details">
+                        <summary>"View Raw Log Details"</summary>
+                        <ul>
+                            {errors_for_samples
+                                .clone()
+                                .into_iter()
+                                .filter_map(|err| {
+                                    let sample = json_str(&err, "sample");
+                                    if sample.is_empty() {
+                                        None
+                                    } else {
+                                        Some(view! { <li><code>{sample}</code></li> })
+                                    }
+                                })
+                                .collect::<Vec<_>>()}
+                        </ul>
+                    </details>
+                })}
+
+                {(!has_errors && !affected_repos.is_empty()).then(|| view! {
+                    <>
+                        <p><strong>"Affected Repositories:"</strong></p>
+                        <ul>
+                            {affected_repos
+                                .into_iter()
+                                .map(|repo| view! { <li><code>{repo}</code></li> })
+                                .collect::<Vec<_>>()}
+                        </ul>
+                    </>
+                })}
+            </div>
+        }
+        .into_any(),
+    )
+}
+
+fn render_fips_section(
+    fips_setup: &Value,
+    kcmd: &Value,
+    ktune: &Value,
+    crypto: &Value,
+    waagent: &Value,
+    distro_pkgs: &Value,
+) -> AnyView {
+    let fips_rows = build_fips_rows(fips_setup, kcmd, ktune, crypto, waagent, distro_pkgs);
+    let mut present_signals: Vec<bool> = Vec::new();
+
+    if json_bool(fips_setup, "found") {
+        present_signals.push(
+            fips_setup
+                .get("fipsEnabled")
+                .and_then(|value| value.as_bool())
+                .unwrap_or(false),
+        );
+    }
+    if json_bool(kcmd, "found") {
+        present_signals.push(
+            kcmd.get("fipsEnabled")
+                .and_then(|value| value.as_bool())
+                .unwrap_or(false),
+        );
+    }
+    if let Some(enabled) = ktune.get("fipsEnabled").and_then(|value| value.as_bool()) {
+        present_signals.push(enabled);
+    }
+    if json_bool(crypto, "found") {
+        present_signals.push(json_str(crypto, "policy").to_ascii_uppercase().contains("FIPS"));
+    }
+    if json_bool(waagent, "found") {
+        let waagent_enabled = matches!(
+            waagent
+                .get("summary")
+                .and_then(|summary| summary.get("enableFIPS"))
+                .map(value_to_inline_string)
+                .unwrap_or_default()
+                .to_ascii_lowercase()
+                .as_str(),
+            "y" | "yes" | "true"
+        );
+        present_signals.push(waagent_enabled);
+    }
+    let has_dracut = json_array(distro_pkgs, "fipsPackages").iter().any(|pkg| {
+        let name = json_str(pkg, "name");
+        name == "dracut-fips" || name.starts_with("dracut-fips-")
+    }) || json_bool(distro_pkgs, "hasDracutFips");
+    if has_dracut {
+        present_signals.push(true);
+    }
+
+    let has_enabled = present_signals.iter().any(|flag| *flag);
+    let has_disabled = present_signals.iter().any(|flag| !*flag);
+    let inconsistent = json_bool(fips_setup, "inconsistentState") || (has_enabled && has_disabled);
+    let overall_enabled = has_enabled && !has_disabled && !inconsistent;
+
+    view! {
+        <details class="content-details" open=true>
+            <summary>
+                "FIPS Status"
+                {overall_enabled.then(|| view! { <span class="badge badge-success">"ENABLED"</span> })}
+                {inconsistent.then(|| view! { <span class="badge badge-warning">"inconsistent"</span> })}
+            </summary>
+            {inconsistent.then(|| view! {
+                <div class="warning-block">
+                    <p><strong>"Inconsistent FIPS state"</strong></p>
+                    <p>
+                        "Some indicators report FIPS enabled while others remain disabled or not set. "
+                        <code>"fips-mode-setup --enable"</code>
+                    </p>
+                </div>
+            })}
+            <table class="data-table">
+                <thead>
+                    <tr>
+                        <th>"Source"</th>
+                        <th>"Indicator"</th>
+                        <th>"Status"</th>
+                    </tr>
+                </thead>
+                <tbody>{fips_rows}</tbody>
+            </table>
+            {(!json_str(kcmd, "rawCmdline").is_empty()).then(|| view! {
+                <details class="content-details">
+                    <summary>"Kernel Command Line"</summary>
+                    <pre class="json-dump">{json_str(kcmd, "rawCmdline")}</pre>
+                </details>
+            })}
+        </details>
+    }
+    .into_any()
+}
+
+fn render_leapp_section(leapp_report: &Value, leapp_log: &Value) -> AnyView {
+    let has_report = json_bool(leapp_report, "found");
+    let has_log = json_bool(leapp_log, "found");
+    let upgrade_blocked = leapp_report
+        .get("upgradeBlocked")
+        .and_then(|value| value.as_bool())
+        .unwrap_or(false)
+        || leapp_log
+            .get("hasErrors")
+            .and_then(|value| value.as_bool())
+            .unwrap_or(false);
+    let has_high_risk = leapp_report
+        .get("hasHighRisk")
+        .and_then(|value| value.as_bool())
+        .unwrap_or(false);
+    let block_class = if upgrade_blocked {
+        "danger-block"
+    } else if has_high_risk {
+        "warning-block"
+    } else {
+        "content-details"
+    };
+
+    let report_error_count = leapp_report
+        .get("errorCount")
+        .and_then(|value| value.as_u64())
+        .unwrap_or(0);
+    let log_error_count = leapp_log
+        .get("errorCount")
+        .and_then(|value| value.as_u64())
+        .unwrap_or(0);
+    let high_risk_count = leapp_report
+        .get("highRiskCount")
+        .and_then(|value| value.as_u64())
+        .unwrap_or(0);
+
+    view! {
+        <details class=block_class open=true>
+            <summary>"Leapp Upgrade Analysis"</summary>
+            <div class="section-body">
+                <p>
+                    {if upgrade_blocked {
+                        view! {
+                            <span class="text-danger">
+                                <strong>"Upgrade Blocked:"</strong>
+                                " "
+                                {format!("{} error(s) must be resolved", report_error_count + log_error_count)}
+                            </span>
+                        }
+                        .into_any()
+                    } else if has_high_risk {
+                        view! {
+                            <span class="text-warning">
+                                <strong>"Review Required:"</strong>
+                                " "
+                                {format!("{} high-risk warning(s) detected", high_risk_count)}
+                            </span>
+                        }
+                        .into_any()
+                    } else {
+                        view! {
+                            <span class="text-success">
+                                <strong>"Upgrade Ready:"</strong>
+                                " No blocking issues found"
+                            </span>
+                        }
+                        .into_any()
+                    }}
+                </p>
+
+                {render_leapp_log_errors(leapp_log)}
+
+                {has_report.then(|| view! {
+                    <>
+                        <p class="text-muted">
+                            {format!(
+                                "Report: {} issue(s) - {} error(s), {} high, {} medium, {} info",
+                                leapp_report.get("totalIssues").and_then(|value| value.as_u64()).unwrap_or(0),
+                                report_error_count,
+                                high_risk_count,
+                                leapp_report.get("mediumRiskCount").and_then(|value| value.as_u64()).unwrap_or(0),
+                                leapp_report.get("infoCount").and_then(|value| value.as_u64()).unwrap_or(0),
+                            )}
+                        </p>
+
+                        {render_issue_group("Errors (Upgrade Blockers)", &json_array(leapp_report, "errors"), "danger-block")}
+                        {render_issue_group(
+                            &format!("High Risk Warnings ({})", high_risk_count),
+                            &json_array(leapp_report, "highRisk"),
+                            "warning-block",
+                        )}
+
+                        {(!json_array(leapp_report, "thirdPartyPackages").is_empty()).then(|| view! {
+                            <details class="content-details">
+                                <summary>{format!("Third-Party Packages ({})", json_array(leapp_report, "thirdPartyPackages").len())}</summary>
+                                <p class="text-muted">"These packages are not signed by Red Hat and may need manual handling:"</p>
+                                <ul>
+                                    {json_array(leapp_report, "thirdPartyPackages")
+                                        .into_iter()
+                                        .filter_map(|pkg| pkg.as_str().map(|value| value.to_string()))
+                                        .map(|pkg| view! { <li><code>{pkg}</code></li> })
+                                        .collect::<Vec<_>>()}
+                                </ul>
+                            </details>
+                        })}
+
+                        {(!json_array(leapp_report, "info").is_empty()).then(|| view! {
+                            <details class="content-details">
+                                <summary>{format!("Informational Notes ({})", json_array(leapp_report, "info").len())}</summary>
+                                <ul>
+                                    {json_array(leapp_report, "info")
+                                        .into_iter()
+                                        .map(|issue| view! { <li>{json_str(&issue, "title")}</li> })
+                                        .collect::<Vec<_>>()}
+                                </ul>
+                            </details>
+                        })}
+                    </>
+                })}
+
+                {(has_log && !json_array(leapp_log, "curlErrors").is_empty()).then(|| view! {
+                    <details class="content-details">
+                        <summary>{format!("Connection Errors from Log ({})", json_array(leapp_log, "curlErrors").len())}</summary>
+                        <div class="section-body">
+                            {json_array(leapp_log, "curlErrors")
+                                .into_iter()
+                                .map(|err| {
+                                    let message = json_str(&err, "message");
+                                    let curl_code = err.get("curlCode").map(value_to_inline_string).unwrap_or_default();
+                                    let url = json_str(&err, "url");
+                                    view! {
+                                        <div class="subsection">
+                                            <code>{format!("Curl error ({}) {}", curl_code, message)}</code>
+                                            {(!url.is_empty()).then(|| view! { <p class="text-muted"><code>{url}</code></p> })}
+                                        </div>
+                                    }
+                                })
+                                .collect::<Vec<_>>()}
+                        </div>
+                    </details>
+                })}
+
+                <p>
+                    <a
+                        href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/upgrading_from_rhel_8_to_rhel_9/index"
+                        target="_blank"
+                        rel="noopener noreferrer"
+                        class="text-info"
+                    >
+                        "Leapp Upgrade Documentation"
+                    </a>
+                </p>
+            </div>
+        </details>
+    }
+    .into_any()
+}
+
+fn render_leapp_log_errors(leapp_log: &Value) -> Option<AnyView> {
+    let dns_errors = json_array(leapp_log, "dnsErrors");
+    let rhui_errors = json_array(leapp_log, "rhuiErrors");
+    let has_dns_errors = !dns_errors.is_empty();
+    let has_rhui_errors = !rhui_errors.is_empty();
+    let dns_errors_for_view = dns_errors.clone();
+    let rhui_errors_for_view = rhui_errors.clone();
+
+    if !has_dns_errors && !has_rhui_errors {
+        return None;
+    }
+
+    Some(
+        view! {
+            <>
+                {has_dns_errors.then(|| view! {
+                    <div class="danger-block">
+                        <p><strong>"DNS Resolution Errors (Root Cause):"</strong></p>
+                        {dns_errors_for_view
+                            .clone()
+                            .into_iter()
+                            .map(|err| {
+                                let curl_code = err.get("curlCode").map(value_to_inline_string).unwrap_or_default();
+                                let message = json_str(&err, "message");
+                                let host = json_str(&err, "host");
+                                let url = json_str(&err, "url");
+                                view! {
+                                    <div class="subsection">
+                                        <p><strong>{format!("Curl error ({}) {}", curl_code, message)}</strong></p>
+                                        {(!host.is_empty()).then(|| view! { <p><code>{format!("Host: {}", host)}</code></p> })}
+                                        {(!url.is_empty()).then(|| view! { <p class="text-muted"><code>{url}</code></p> })}
+                                    </div>
+                                }
+                            })
+                            .collect::<Vec<_>>()}
+                    </div>
+                })}
+
+                {(!has_dns_errors && has_rhui_errors).then(|| view! {
+                    <div class="danger-block">
+                        <p><strong>"RHUI Connection Errors:"</strong></p>
+                        {rhui_errors_for_view
+                            .clone()
+                            .into_iter()
+                            .map(|err| {
+                                let curl_code = err.get("curlCode").map(value_to_inline_string).unwrap_or_default();
+                                let message = json_str(&err, "message");
+                                let url = json_str(&err, "url");
+                                view! {
+                                    <div class="subsection">
+                                        <p><strong>{format!("Curl error ({}) {}", curl_code, message)}</strong></p>
+                                        {(!url.is_empty()).then(|| view! { <p class="text-muted"><code>{url}</code></p> })}
+                                    </div>
+                                }
+                            })
+                            .collect::<Vec<_>>()}
+                    </div>
+                })}
+            </>
+        }
+        .into_any(),
+    )
+}
+
+fn render_issue_group(title: &str, issues: &[Value], class_name: &'static str) -> Option<AnyView> {
+    if issues.is_empty() {
+        return None;
+    }
+
+    Some(
+        view! {
+            <details class="content-details">
+                <summary>{title.to_string()}</summary>
+                <div class="section-body">
+                    {issues
+                        .iter()
+                        .cloned()
+                        .map(|issue| {
+                            let item_title = json_str(&issue, "title");
+                            let summary = json_str(&issue, "summary");
+                            let remediation = json_str(&issue, "remediation");
+                            view! {
+                                <div class=class_name>
+                                    <p><strong>{item_title}</strong></p>
+                                    {(!summary.is_empty()).then(|| view! { <p>{summary}</p> })}
+                                    {(!remediation.is_empty()).then(|| view! { <p class="text-muted"><em>{format!("Remediation: {remediation}")}</em></p> })}
+                                </div>
+                            }
+                        })
+                        .collect::<Vec<_>>()}
+                </div>
+            </details>
+        }
+        .into_any(),
+    )
+}
+
+fn render_packages_section(distro_pkgs: &Value) -> AnyView {
+    let is_dpkg = distro_pkgs
+        .get("isDpkg")
+        .and_then(|value| value.as_bool())
+        .unwrap_or(false);
+    let is_rpm_based = distro_pkgs
+        .get("isRpmRaw")
+        .and_then(|value| value.as_bool())
+        .unwrap_or(false)
+        || !is_dpkg;
+    let raw_content = json_str(distro_pkgs, "rawContent");
+    let package_entries = distro_pkgs
+        .get("packages")
+        .and_then(|value| value.as_object())
+        .map(|packages| {
+            let mut items = packages
+                .iter()
+                .map(|(name, value)| {
+                    let version = value
+                        .as_str()
+                        .map(|item| item.to_string())
+                        .or_else(|| {
+                            value
+                                .get("version")
+                                .and_then(|item| item.as_str())
+                                .map(|item| item.to_string())
+                        })
+                        .unwrap_or_default();
+                    (name.clone(), version)
+                })
+                .collect::<Vec<_>>();
+            items.sort_by(|a, b| a.0.cmp(&b.0));
+            items
+        })
+        .unwrap_or_default();
+    let package_count = distro_pkgs
+        .get("packageCount")
+        .and_then(|value| value.as_u64())
+        .unwrap_or_else(|| {
+            if !raw_content.is_empty() {
+                raw_content.lines().filter(|line| !line.trim().is_empty()).count() as u64
+            } else {
+                package_entries.len() as u64
+            }
+        });
+    let fips_packages = json_array(distro_pkgs, "fipsPackages");
+    let warning_entries = json_array(distro_pkgs, "warnings");
+    let summary = if is_dpkg {
+        format!("Packages ({package_count} Debian/Ubuntu)")
+    } else if is_rpm_based {
+        format!("Packages ({package_count} RPM-based)")
+    } else {
+        format!("Packages ({package_count})")
+    };
+
+    view! {
+        <details class="content-details">
+            <summary>{summary}</summary>
+            <div class="section-body">
+                {(!warning_entries.is_empty()).then(|| view! {
+                    <div class="warning-block">
+                        <p><strong>{format!("Azure package validation warnings ({})", warning_entries.len())}</strong></p>
+                        <ul>
+                            {warning_entries
+                                .into_iter()
+                                .map(|warning| {
+                                    let package = json_str(&warning, "package");
+                                    let expected = json_str(&warning, "expected");
+                                    let actual = json_str(&warning, "actual");
+                                    let message = json_str(&warning, "message");
+                                    let docs = json_str(&warning, "documentationUrl");
+                                    let source_path = json_str(&warning, "sourcePath");
+                                    let source_line = warning
+                                        .get("sourceLine")
+                                        .and_then(|value| value.as_u64())
+                                        .unwrap_or(0);
+                                    view! {
+                                        <li class="text-warning">
+                                            <strong>{package.clone()}</strong>
+                                            {if message.is_empty() {
+                                                format!(": expected {expected}, found {actual}")
+                                            } else {
+                                                format!(": {message}")
+                                            }}
+                                            {(!expected.is_empty() || !actual.is_empty()).then(|| view! {
+                                                <div class="text-muted">{format!(
+                                                    "Expected: {} • Actual: {}",
+                                                    if expected.is_empty() { "-".to_string() } else { expected.clone() },
+                                                    if actual.is_empty() { "-".to_string() } else { actual.clone() },
+                                                )}</div>
+                                            })}
+                                            {(!source_path.is_empty()).then(|| view! {
+                                                <div class="text-muted">{format!("Source: {}", source_path)}</div>
+                                            })}
+                                            {(source_line > 0).then(|| view! {
+                                                <div class="text-muted">{format!("Line: {}", source_line)}</div>
+                                            })}
+                                            {(!docs.is_empty()).then(|| view! {
+                                                <div>
+                                                    <a href=docs.clone() target="_blank" rel="noopener noreferrer" class="text-info">"[docs]"</a>
+                                                </div>
+                                            })}
+                                        </li>
+                                    }
+                                })
+                                .collect::<Vec<_>>()}
+                        </ul>
+                    </div>
+                })}
+
+                {(!raw_content.is_empty()).then(|| view! {
+                    <details class="content-details" open=true>
+                        <summary>{if is_dpkg {
+                            format!("Raw package list ({package_count} entries)")
+                        } else {
+                            format!("Raw RPM package list ({package_count} entries)")
+                        }}</summary>
+                        <pre class="json-dump">{raw_content.clone()}</pre>
+                    </details>
+                })}
+
+                {(!fips_packages.is_empty()).then(|| view! {
+                    <div class="subsection">
+                        <p><strong>"FIPS-related packages:"</strong></p>
+                        <ul>
+                            {fips_packages
+                                .into_iter()
+                                .map(|pkg| {
+                                    let name = json_str(&pkg, "name");
+                                    let version = json_str(&pkg, "version");
+                                    view! {
+                                        <li>
+                                            <code>{name}</code>
+                                            {(!version.is_empty()).then(|| view! { <span class="text-muted">{format!(" {}", version)}</span> })}
+                                        </li>
+                                    }
+                                })
+                                .collect::<Vec<_>>()}
+                        </ul>
+                    </div>
+                })}
+
+                {(!package_entries.is_empty()).then(|| view! {
+                    <details class="content-details">
+                        <summary>{format!("Validated package inventory ({})", package_entries.len())}</summary>
+                        <ul>
+                            {package_entries
+                                .into_iter()
+                                .map(|(name, version)| view! {
+                                    <li>
+                                        <code>{name}</code>
+                                        {(!version.is_empty()).then(|| view! { <span class="text-muted">{format!(" {}", version)}</span> })}
+                                    </li>
+                                })
+                                .collect::<Vec<_>>()}
+                        </ul>
+                    </details>
+                })}
+            </div>
+        </details>
+    }
+    .into_any()
+}
+
+fn build_fips_rows(
+    fips_setup: &Value,
+    kcmd: &Value,
+    ktune: &Value,
+    crypto: &Value,
+    waagent: &Value,
+    distro_pkgs: &Value,
+) -> Vec<AnyView> {
+    let mut rows: Vec<AnyView> = Vec::new();
+
+    if json_bool(fips_setup, "found") {
+        let enabled = fips_setup
+            .get("fipsEnabled")
+            .and_then(|value| value.as_bool())
+            .unwrap_or(false);
+        let text = if enabled {
+            "Enabled".to_string()
+        } else {
+            "Disabled / Not set".to_string()
+        };
+        let class = if enabled {
+            "text-success".to_string()
+        } else {
+            "text-muted".to_string()
+        };
+        rows.push(
+            view! {
+                <tr>
+                    <td>"fips-mode-setup --check"</td>
+                    <td>"FIPS mode check"</td>
+                    <td class=class>{text}</td>
+                </tr>
+            }
+            .into_any(),
+        );
+    }
+
+    if json_bool(kcmd, "found") {
+        let has_fips = kcmd
+            .get("fipsEnabled")
+            .and_then(|value| value.as_bool())
+            .unwrap_or(false);
+        let (text, class) = if has_fips {
+            ("Enabled".to_string(), "text-success".to_string())
+        } else {
+            ("Disabled / Not set".to_string(), "text-muted".to_string())
+        };
+        rows.push(
+            view! {
+                <tr>
+                    <td>"Kernel cmdline (fips=1)"</td>
+                    <td>"Boot parameter"</td>
+                    <td class=class>{text}</td>
+                </tr>
+            }
+            .into_any(),
+        );
+    }
+
+    if json_bool(ktune, "found") {
+        if let Some(val) = ktune.get("fipsEnabled") {
+            let enabled = val.as_bool().unwrap_or(false);
+            let (text, class) = if enabled {
+                ("Enabled".to_string(), "text-success".to_string())
+            } else {
+                ("Disabled / Not set".to_string(), "text-muted".to_string())
+            };
+            rows.push(
+                view! {
+                    <tr>
+                        <td>"sysctl crypto.fips_enabled"</td>
+                        <td>"Kernel state"</td>
+                        <td class=class>{text}</td>
+                    </tr>
+                }
+                .into_any(),
+            );
+        }
+    }
+
+    if json_bool(crypto, "found") {
+        let policy = json_str(crypto, "policy");
+        let is_fips = policy.to_uppercase().contains("FIPS");
+        let class = if is_fips {
+            "text-success".to_string()
+        } else {
+            "text-muted".to_string()
+        };
+        let display = if is_fips {
+            "Enabled (FIPS)".to_string()
+        } else if policy.is_empty() {
+            "Disabled / Not set".to_string()
+        } else {
+            format!("Disabled / Not set ({policy})")
+        };
+        rows.push(
+            view! {
+                <tr>
+                    <td>"Crypto policy"</td>
+                    <td>"Current policy"</td>
+                    <td class=class>{display}</td>
+                </tr>
+            }
+            .into_any(),
+        );
+    }
+
+    if json_bool(waagent, "found") {
+        let summary = waagent.get("summary").unwrap_or(&Value::Null);
+        let enable_fips = summary
+            .get("enableFIPS")
+            .map(value_to_inline_string)
+            .unwrap_or_else(|| "n/a".to_string());
+        let enabled = matches!(
+            enable_fips.to_ascii_lowercase().as_str(),
+            "y" | "yes" | "true"
+        );
+        let class = if enabled {
+            "text-success".to_string()
+        } else {
+            "text-muted".to_string()
+        };
+        rows.push(
+            view! {
+                <tr>
+                    <td>"waagent.conf OS.EnableFIPS"</td>
+                    <td>"Azure agent setting"</td>
+                    <td class=class>{if enabled { "Enabled".to_string() } else { "Disabled / Not set".to_string() }}</td>
+                </tr>
+            }
+            .into_any(),
+        );
+    }
+
+    if json_bool(distro_pkgs, "found") {
+        let fips_pkgs = json_array(distro_pkgs, "fipsPackages");
+        let has_dracut = fips_pkgs.iter().any(|pkg| {
+            let name = json_str(pkg, "name");
+            name == "dracut-fips" || name.starts_with("dracut-fips-")
+        }) || json_bool(distro_pkgs, "hasDracutFips");
+        if has_dracut {
+            rows.push(
+                view! {
+                    <tr>
+                        <td>"dracut-fips package"</td>
+                        <td>"Installed package"</td>
+                        <td class="text-success">"Enabled"</td>
+                    </tr>
+                }
+                .into_any(),
+            );
+        }
+    }
+
+    rows
+}
+
+fn collect_warnings(values: &[&Value]) -> Vec<Value> {
+    values
+        .iter()
+        .flat_map(|value| json_array(value, "warnings"))
+        .collect::<Vec<_>>()
+}
+
+fn string_array_from_key(value: &Value, key: &str) -> Vec<String> {
+    value
+        .get(key)
+        .and_then(|items| items.as_array())
+        .map(|items| {
+            items
+                .iter()
+                .filter_map(|item| item.as_str().map(|entry| entry.to_string()))
+                .collect::<Vec<_>>()
+        })
+        .unwrap_or_default()
+}
+
+fn value_to_inline_string(value: &Value) -> String {
+    if let Some(text) = value.as_str() {
+        text.to_string()
+    } else if let Some(number) = value.as_i64() {
+        number.to_string()
+    } else if let Some(number) = value.as_u64() {
+        number.to_string()
+    } else if let Some(number) = value.as_f64() {
+        if number.fract() == 0.0 {
+            (number as i64).to_string()
+        } else {
+            format!("{number:.2}")
+        }
+    } else if let Some(boolean) = value.as_bool() {
+        if boolean {
+            "true".to_string()
+        } else {
+            "false".to_string()
+        }
+    } else {
+        "".to_string()
+    }
+}
diff --git a/rca-tool/web-leptos/src/components/sections/events.rs b/rca-tool/web-leptos/src/components/sections/events.rs
new file mode 100644
index 0000000..ac93ba8
--- /dev/null
+++ b/rca-tool/web-leptos/src/components/sections/events.rs
@@ -0,0 +1,412 @@
+use std::collections::BTreeMap;
+
+use leptos::prelude::*;
+use serde_json::Value;
+
+use super::helpers::*;
+
+/// Section 9 – Events (always rendered, count-based severity).
+#[component]
+pub fn EventsSection(data: Value) -> impl IntoView {
+    let live_migration = data.get("liveMigration").cloned().unwrap_or(Value::Null);
+    let kernel_reboots = data.get("kernelReboots").cloned().unwrap_or(Value::Null);
+    let oom_killer = data.get("oomKiller").cloned().unwrap_or(Value::Null);
+    let xfs_errors = data.get("xfsErrors").cloned().unwrap_or(Value::Null);
+    let emergency_mode = data.get("emergencyMode").cloned().unwrap_or(Value::Null);
+    let ssh_service = data.get("sshService").cloned().unwrap_or(Value::Null);
+    let automation = data.get("automation").cloned().unwrap_or(Value::Null);
+
+    let lm_count = event_count(&live_migration);
+    let kr_count = event_count(&kernel_reboots);
+    let oom_count = event_count(&oom_killer);
+    let xfs_count = event_count(&xfs_errors);
+    let em_count = event_count(&emergency_mode);
+    let ssh_count = event_count(&ssh_service);
+    let automation_count = event_count(&automation);
+
+    let total_danger = oom_count + xfs_count + em_count + ssh_count;
+    let total_warning = lm_count + kr_count;
+    let total = lm_count + kr_count + oom_count + xfs_count + em_count + ssh_count;
+
+    if total == 0 && automation_count == 0 {
+        return view! {}.into_any();
+    }
+
+    let class = severity_class(total_danger, total_warning);
+
+    view! {
+        <Section title="Events" class=class>
+            {render_event_subsection("Live Migration Events", &live_migration, lm_count, "info")}
+            {render_event_subsection("Kernel Reboots", &kernel_reboots, kr_count, "warning")}
+            {render_event_subsection("OOM Killer Events", &oom_killer, oom_count, "danger")}
+            {render_event_subsection("XFS Filesystem Errors", &xfs_errors, xfs_count, "danger")}
+            {render_event_subsection("Emergency Mode Events", &emergency_mode, em_count, "danger")}
+            {render_event_subsection("SSH Service Issues", &ssh_service, ssh_count, "danger")}
+            {render_automation_section(&automation, automation_count)}
+        </Section>
+    }
+    .into_any()
+}
+
+fn event_count(value: &Value) -> usize {
+    value
+        .get("count")
+        .and_then(|v| v.as_u64())
+        .map(|v| v as usize)
+        .unwrap_or_else(|| json_array(value, "events").len())
+}
+
+fn render_event_subsection(title: &str, data: &Value, count: usize, kind: &str) -> AnyView {
+    let class = if count > 0 {
+        format!("{kind}-block")
+    } else {
+        "info-block".to_string()
+    };
+    let unit = if title == "XFS Filesystem Errors" {
+        "error"
+    } else if title == "SSH Service Issues" {
+        "issue"
+    } else {
+        "event"
+    };
+    let summary_title = if count > 0 {
+        match title {
+            "Live Migration Events" => "Live Migration Events Detected",
+            "Kernel Reboots" => "Kernel Reboots Detected",
+            _ => title,
+        }
+    } else {
+        title
+    };
+    let summary_text = format!(
+        "{} ({} {}{} found)",
+        summary_title,
+        count,
+        unit,
+        if count == 1 { "" } else { "s" }
+    );
+
+    view! {
+        <details class=class>
+            <summary>{summary_text}</summary>
+            <div class="section-body">{render_event_body(title, data, count)}</div>
+        </details>
+    }
+    .into_any()
+}
+
+fn render_event_body(title: &str, data: &Value, count: usize) -> AnyView {
+    let mut events = json_array(data, "events");
+    events.sort_by(|a, b| {
+        let ts_cmp = json_str(b, "timestamp").cmp(&json_str(a, "timestamp"));
+        if ts_cmp == std::cmp::Ordering::Equal {
+            b.get("lineNumber")
+                .and_then(|v| v.as_u64())
+                .cmp(&a.get("lineNumber").and_then(|v| v.as_u64()))
+        } else {
+            ts_cmp
+        }
+    });
+
+    if count == 0 || events.is_empty() {
+        let empty_message = match title {
+            "Live Migration Events" => "No live migration events were detected in the analyzed files.",
+            "Kernel Reboots" => "No kernel reboot events were detected in the analyzed files.",
+            "OOM Killer Events" => "No OOM (Out of Memory) killer events were detected in the analyzed files.",
+            "XFS Filesystem Errors" => "No XFS filesystem errors were detected in the analyzed files.",
+            "Emergency Mode Events" => "No emergency mode events were detected in the analyzed files.",
+            "SSH Service Issues" => "No SSH service issues were detected in the analyzed files.",
+            _ => "No events found.",
+        };
+        return view! { <p class="text-muted"><em>{empty_message}</em></p> }.into_any();
+    }
+
+    match title {
+        "Live Migration Events" => view! {
+            <>
+                <p><strong>"Detected Hyper-V Live Migration events:"</strong></p>
+                <ul class="event-list">
+                    {events
+                        .into_iter()
+                        .map(|event| {
+                            let timestamp = non_empty(json_str(&event, "timestamp"), "Unknown".to_string());
+                            let source = format_source(&event);
+                            let line_number = event
+                                .get("lineNumber")
+                                .and_then(|v| v.as_u64())
+                                .map(|v| v.to_string())
+                                .unwrap_or_default();
+                            view! {
+                                <li class="event-item">
+                                    <strong class="text-info">{timestamp}</strong>
+                                    {(!line_number.is_empty()).then(|| view! {
+                                        <span class="text-muted">{format!(" | Line: {}", line_number)}</span>
+                                    })}
+                                    {(!source.is_empty()).then(|| view! {
+                                        <div class="event-details">{format!("Source: {}", source)}</div>
+                                    })}
+                                </li>
+                            }
+                        })
+                        .collect::<Vec<_>>()}
+                </ul>
+                <p class="text-muted"><em>"Detection pattern: hv_utils: Heartbeat IC → hv_balloon → hv_netvsc within 100 lines"</em></p>
+            </>
+        }
+        .into_any(),
+
+        "Kernel Reboots" => view! {
+            <>
+                <p><strong>"Detected system reboots:"</strong></p>
+                <ul class="event-list">
+                    {events
+                        .into_iter()
+                        .map(|event| {
+                            let timestamp = non_empty(json_str(&event, "timestamp"), "Unknown".to_string());
+                            let kernel_version = json_str(&event, "kernelVersion");
+                            let event_type = json_str(&event, "type").replace('_', " ");
+                            let source = format_source(&event);
+                            view! {
+                                <li class="event-item">
+                                    <strong class="text-warning-dark">{timestamp}</strong>
+                                    {(!kernel_version.is_empty()).then(|| view! {
+                                        <span class="badge badge-warning">{format!("Kernel {}", kernel_version.clone())}</span>
+                                    })}
+                                    {(!event_type.is_empty()).then(|| view! {
+                                        <div class="event-details">{format!("Type: {}", event_type)}</div>
+                                    })}
+                                    {(!source.is_empty()).then(|| view! {
+                                        <div class="event-details">{format!("Source: {}", source)}</div>
+                                    })}
+                                </li>
+                            }
+                        })
+                        .collect::<Vec<_>>()}
+                </ul>
+            </>
+        }
+        .into_any(),
+
+        "OOM Killer Events" => view! {
+            <>
+                <p><strong>"Detected OOM killer events:"</strong></p>
+                <ul class="event-list">
+                    {events
+                        .into_iter()
+                        .map(|event| {
+                            let timestamp = non_empty(json_str(&event, "timestamp"), "Unknown".to_string());
+                            let process_name = json_str(&event, "processName");
+                            let pid = json_str(&event, "pid");
+                            let raw_line = json_str(&event, "rawLine");
+                            let source = format_source(&event);
+                            view! {
+                                <li class="event-item">
+                                    <strong class="text-danger">{timestamp}</strong>
+                                    {(!process_name.is_empty()).then(|| view! {
+                                        <div>
+                                            <strong>{process_name.clone()}</strong>
+                                            {(!pid.is_empty()).then(|| view! {
+                                                <span class="text-muted">{format!(" (PID {})", pid.clone())}</span>
+                                            })}
+                                        </div>
+                                    })}
+                                    {(!raw_line.is_empty()).then(|| view! {
+                                        <div class="event-raw-line">{raw_line.clone()}</div>
+                                    })}
+                                    {(!source.is_empty()).then(|| view! {
+                                        <div class="event-details">{format!("Source: {}", source)}</div>
+                                    })}
+                                </li>
+                            }
+                        })
+                        .collect::<Vec<_>>()}
+                </ul>
+            </>
+        }
+        .into_any(),
+
+        "XFS Filesystem Errors" => view! {
+            <>
+                <p><strong>"Detected XFS filesystem errors requiring attention:"</strong></p>
+                <ul class="event-list">
+                    {events
+                        .into_iter()
+                        .map(|event| {
+                            let timestamp = non_empty(json_str(&event, "timestamp"), "Unknown".to_string());
+                            let device = json_str(&event, "device");
+                            let message = json_str(&event, "message");
+                            let raw_line = json_str(&event, "rawLine");
+                            let source = format_source(&event);
+                            view! {
+                                <li class="event-item">
+                                    <strong class="text-danger">{timestamp}</strong>
+                                    {(!device.is_empty()).then(|| view! {
+                                        <div><strong>{format!("Device: {}", device.clone())}</strong></div>
+                                    })}
+                                    {(!message.is_empty()).then(|| view! {
+                                        <div>{message.clone()}</div>
+                                    })}
+                                    {(!raw_line.is_empty()).then(|| view! {
+                                        <div class="event-raw-line">{raw_line.clone()}</div>
+                                    })}
+                                    {(!source.is_empty()).then(|| view! {
+                                        <div class="event-details">{format!("Source: {}", source)}</div>
+                                    })}
+                                </li>
+                            }
+                        })
+                        .collect::<Vec<_>>()}
+                </ul>
+            </>
+        }
+        .into_any(),
+
+        _ => view! {
+            <ul class="event-list">
+                {events
+                    .into_iter()
+                    .map(|event| {
+                        let message = first_non_empty(&[
+                            json_str(&event, "message"),
+                            json_str(&event, "rawLine"),
+                            event.as_str().unwrap_or_default().to_string(),
+                        ]);
+                        let source = format_source(&event);
+                        view! {
+                            <li class="event-item">
+                                <div>{message}</div>
+                                {(!source.is_empty()).then(|| view! {
+                                    <div class="event-details">{format!("Source: {}", source)}</div>
+                                })}
+                            </li>
+                        }
+                    })
+                    .collect::<Vec<_>>()}
+            </ul>
+        }
+        .into_any(),
+    }
+}
+
+fn render_automation_section(automation: &Value, count: usize) -> AnyView {
+    let events = json_array(automation, "events");
+    let mut events_by_tool: BTreeMap<String, Vec<Value>> = BTreeMap::new();
+    for event in events {
+        let tool_type = non_empty(json_str(&event, "toolType"), "other".to_string());
+        events_by_tool.entry(tool_type).or_default().push(event);
+    }
+
+    view! {
+        <details class="info-block">
+            <summary>{format!("Automation Tools Usage ({} event{} found)", count, if count == 1 { "" } else { "s" })}</summary>
+            <div class="section-body">
+                {if count == 0 || events_by_tool.is_empty() {
+                    view! {
+                        <>
+                            <p class="text-muted"><em>"No automation tool usage was detected in the analyzed files."</em></p>
+                            <p class="text-muted"><em>"Detection patterns: \"ansible-command:\", \"ansible-setup:\", \"puppet-agent:\", \"puppet apply\", \"puppet-run:\", \"chef-client[PID]:\", \"chef-solo[PID]:\", \"chef-apply[PID]:\" (Future: SaltStack)"</em></p>
+                        </>
+                    }
+                    .into_any()
+                } else {
+                    view! {
+                        <>
+                            <p><strong>"Detected automation tool executions:"</strong></p>
+                            {events_by_tool
+                                .into_iter()
+                                .map(|(tool_type, mut tool_events)| {
+                                    tool_events.sort_by(|a, b| {
+                                        a.get("lineNumber")
+                                            .and_then(|v| v.as_u64())
+                                            .cmp(&b.get("lineNumber").and_then(|v| v.as_u64()))
+                                    });
+                                    let tool_name = format_tool_name(&tool_type);
+                                    let execution_count = tool_events.len();
+                                    view! {
+                                        <details class="content-details" open=true>
+                                            <summary>{format!("{} ({} execution{})", tool_name, execution_count, if execution_count == 1 { "" } else { "s" })}</summary>
+                                            <ul class="event-list">
+                                                {tool_events
+                                                    .into_iter()
+                                                    .map(|event| {
+                                                        let timestamp = non_empty(json_str(&event, "timestamp"), "Unknown".to_string());
+                                                        let pattern_type = json_str(&event, "patternType");
+                                                        let command = json_str(&event, "command");
+                                                        let source = format_source(&event);
+                                                        let pattern_label = if pattern_type.is_empty() {
+                                                            String::new()
+                                                        } else {
+                                                            format!("{}-{}:", tool_type, pattern_type)
+                                                        };
+                                                        view! {
+                                                            <li class="event-item">
+                                                                <strong class="text-info">{timestamp}</strong>
+                                                                {(!pattern_label.is_empty()).then(|| view! {
+                                                                    <div><code>{pattern_label.clone()}</code></div>
+                                                                })}
+                                                                {(!command.is_empty()).then(|| view! {
+                                                                    <div><code>{command.clone()}</code></div>
+                                                                })}
+                                                                {(!source.is_empty()).then(|| view! {
+                                                                    <div class="event-details">{format!("Source: {}", source)}</div>
+                                                                })}
+                                                            </li>
+                                                        }
+                                                    })
+                                                    .collect::<Vec<_>>()}
+                                            </ul>
+                                        </details>
+                                    }
+                                })
+                                .collect::<Vec<_>>()}
+                            <p class="text-muted"><em>"Detection patterns: \"ansible-command:\", \"ansible-setup:\", \"puppet-agent:\", \"puppet apply\", \"puppet-run:\", \"chef-client[PID]:\", \"chef-solo[PID]:\", \"chef-apply[PID]:\""</em></p>
+                        </>
+                    }
+                    .into_any()
+                }}
+            </div>
+        </details>
+    }
+    .into_any()
+}
+
+fn format_tool_name(tool_type: &str) -> String {
+    let mut chars = tool_type.chars();
+    match chars.next() {
+        Some(first) => first.to_uppercase().collect::<String>() + chars.as_str(),
+        None => "Other".to_string(),
+    }
+}
+
+fn format_source(event: &Value) -> String {
+    let source_file = json_str(event, "sourceFile");
+    let line_number = event
+        .get("lineNumber")
+        .or_else(|| event.get("sourceLine"))
+        .and_then(|v| v.as_u64())
+        .map(|v| v.to_string())
+        .unwrap_or_default();
+    if source_file.is_empty() {
+        String::new()
+    } else if line_number.is_empty() {
+        source_file
+    } else {
+        format!("{}:{}", source_file, line_number)
+    }
+}
+
+fn first_non_empty(values: &[String]) -> String {
+    values
+        .iter()
+        .find(|value| !value.trim().is_empty())
+        .cloned()
+        .unwrap_or_else(|| "No details available".to_string())
+}
+
+fn non_empty(value: String, fallback: String) -> String {
+    if value.trim().is_empty() {
+        fallback
+    } else {
+        value
+    }
+}
diff --git a/rca-tool/web-leptos/src/components/sections/hana.rs b/rca-tool/web-leptos/src/components/sections/hana.rs
new file mode 100644
index 0000000..ed4b7a8
--- /dev/null
+++ b/rca-tool/web-leptos/src/components/sections/hana.rs
@@ -0,0 +1,191 @@
+use leptos::prelude::*;
+use serde_json::Value;
+
+use super::helpers::*;
+
+/// Extract an f64 from a JSON value, or `None` if missing / not numeric.
+fn json_opt_f64(value: &Value, key: &str) -> Option<f64> {
+    value.get(key).and_then(|v| v.as_f64())
+}
+
+/// Section – SAP HANA savepoints (from indexserver/nameserver trace files).
+#[component]
+pub fn HanaSection(data: Value) -> impl IntoView {
+    let sp = data.get("hanaSavepoints").cloned().unwrap_or(Value::Null);
+
+    if !json_bool(&sp, "found") {
+        return view! {}.into_any();
+    }
+
+    let warnings = json_array(&sp, "warnings");
+    let error_count = warnings
+        .iter()
+        .filter(|w| json_str(w, "severity") == "error")
+        .count();
+    let warning_count = warnings.len() - error_count;
+    let class = if error_count > 0 {
+        "danger-block"
+    } else if warning_count > 0 {
+        "warning-block"
+    } else {
+        "content-details"
+    };
+
+    view! {
+        <Section title="SAP HANA Savepoints" class=class>
+            {render_savepoint_summary(&sp)}
+            {render_savepoint_warnings(&warnings)}
+            {render_savepoint_table(&sp)}
+        </Section>
+    }
+    .into_any()
+}
+
+fn render_savepoint_summary(sp: &Value) -> AnyView {
+    let count = json_u64(sp, "count");
+    let snapshot_count = json_u64(sp, "snapshotCount");
+    let last = json_str(sp, "lastSavepoint");
+    let avg = json_opt_f64(sp, "avgIntervalS");
+    let max = json_opt_f64(sp, "maxIntervalS");
+
+    let fmt_secs = |v: Option<f64>| -> String {
+        v.map(|s| format!("{s:.0} s")).unwrap_or_else(|| "—".to_string())
+    };
+
+    view! {
+        <table class="kv-table">
+            <tbody>
+                <KvRow label="Periodic savepoints" value=count.to_string()/>
+                <KvRow label="Snapshot savepoints" value=snapshot_count.to_string()/>
+                <KvRow
+                    label="Last savepoint"
+                    value=if last.is_empty() { "—".to_string() } else { last }
+                />
+                <KvRow label="Average interval" value=fmt_secs(avg)/>
+                <KvRow label="Longest interval" value=fmt_secs(max)/>
+            </tbody>
+        </table>
+    }
+    .into_any()
+}
+
+fn render_savepoint_warnings(warnings: &[Value]) -> Option<AnyView> {
+    if warnings.is_empty() {
+        return None;
+    }
+
+    Some(
+        warnings
+            .iter()
+            .map(|warning| {
+                let severity = json_str(warning, "severity");
+                let message = json_str(warning, "message");
+                let details = json_str(warning, "details");
+                let recommendation = json_str(warning, "recommendation");
+                let class = if severity == "error" {
+                    "danger-block"
+                } else if severity == "warning" {
+                    "warning-block"
+                } else {
+                    "info-block"
+                };
+                let heading = if severity == "error" {
+                    "Error"
+                } else if severity == "warning" {
+                    "Warning"
+                } else {
+                    "Info"
+                };
+                view! {
+                    <div class=class>
+                        <p>
+                            <strong>{format!("{heading}:")}</strong>
+                            " "
+                            {message}
+                        </p>
+                        {(!details.is_empty())
+                            .then(|| view! { <p><code>{details}</code></p> })}
+                        {(!recommendation.is_empty())
+                            .then(|| view! { <p>{recommendation}</p> })}
+                    </div>
+                }
+            })
+            .collect::<Vec<_>>()
+            .into_any(),
+    )
+}
+
+fn render_savepoint_table(sp: &Value) -> Option<AnyView> {
+    let savepoints = json_array(sp, "savepoints");
+    if savepoints.is_empty() {
+        return None;
+    }
+
+    // Cap the rendered rows to keep the DOM light on multi-day traces.
+    const MAX_ROWS: usize = 200;
+    let total = savepoints.len();
+    let truncated = total > MAX_ROWS;
+
+    let opt_u64 = |row: &Value, key: &str| -> String {
+        row.get(key)
+            .and_then(|v| v.as_u64())
+            .map(|n| n.to_string())
+            .unwrap_or_else(|| "—".to_string())
+    };
+
+    let rows = savepoints
+        .iter()
+        .take(MAX_ROWS)
+        .map(|row| {
+            let timestamp = json_str(row, "timestamp");
+            let kind = {
+                let k = json_str(row, "kind");
+                let sk = json_str(row, "snapshotKind");
+                if sk.is_empty() { k } else { format!("{k} ({sk})") }
+            };
+            let version = opt_u64(row, "savepointVersion");
+            let next = opt_u64(row, "nextSavepointVersion");
+            let redo = json_str(row, "restartRedoLogPosition");
+            let dropped = opt_u64(row, "droppedVersion");
+            view! {
+                <tr>
+                    <td>{timestamp}</td>
+                    <td>{kind}</td>
+                    <td>{version}</td>
+                    <td>{next}</td>
+                    <td><code>{redo}</code></td>
+                    <td>{dropped}</td>
+                </tr>
+            }
+        })
+        .collect::<Vec<_>>();
+
+    Some(
+        view! {
+            <details class="content-details">
+                <summary>
+                    {format!("Savepoint events ({total})")}
+                </summary>
+                <table class="data-table">
+                    <thead>
+                        <tr>
+                            <th>"Timestamp"</th>
+                            <th>"Kind"</th>
+                            <th>"Version"</th>
+                            <th>"Next"</th>
+                            <th>"Restart redo log pos"</th>
+                            <th>"Dropped"</th>
+                        </tr>
+                    </thead>
+                    <tbody>{rows}</tbody>
+                </table>
+                {truncated.then(|| view! {
+                    <p class="muted">
+                        {format!("Showing first {MAX_ROWS} of {total} savepoint events.")}
+                    </p>
+                })}
+            </details>
+        }
+        .into_any(),
+    )
+}
diff --git a/rca-tool/web-leptos/src/components/sections/helpers.rs b/rca-tool/web-leptos/src/components/sections/helpers.rs
new file mode 100644
index 0000000..a433ea0
--- /dev/null
+++ b/rca-tool/web-leptos/src/components/sections/helpers.rs
@@ -0,0 +1,96 @@
+use leptos::prelude::*;
+
+/// Convenience – collapsible `<details>/<summary>` block.
+#[component]
+pub fn Section(
+    #[prop(into)] title: String,
+    #[prop(default = "content-details".into(), into)] class: String,
+    #[prop(default = false)] open: bool,
+    #[prop(optional, into)] badge: Option<String>,
+    children: Children,
+) -> impl IntoView {
+    view! {
+        <details class=class open=open>
+            <summary>
+                {title.clone()}
+                {badge.map(|b| view! { <span class="badge">{b}</span> })}
+            </summary>
+            <div class="section-body">{children()}</div>
+        </details>
+    }
+}
+
+/// Key → value row inside a two-column table.
+#[component]
+pub fn KvRow(
+    #[prop(into)] label: String,
+    #[prop(into)] value: String,
+    #[prop(optional, into)] class: Option<String>,
+) -> impl IntoView {
+    view! {
+        <tr class=class.unwrap_or_default()>
+            <td class="kv-label">{label}</td>
+            <td class="kv-value">{value}</td>
+        </tr>
+    }
+}
+
+/// Wraps children in a nice two-column key-value table.
+#[component]
+pub fn KvTable(children: Children) -> impl IntoView {
+    view! {
+        <table class="kv-table">
+            <tbody>{children()}</tbody>
+        </table>
+    }
+}
+
+/// Badge helper that picks a class based on severity.
+pub fn severity_class(danger_count: usize, warning_count: usize) -> &'static str {
+    if danger_count > 0 {
+        "danger-block"
+    } else if warning_count > 0 {
+        "warning-block"
+    } else {
+        "success-block"
+    }
+}
+
+/// Format bytes → human string.
+pub fn format_bytes(b: f64) -> String {
+    if b < 1024.0 {
+        format!("{b:.0} B")
+    } else if b < 1024.0 * 1024.0 {
+        format!("{:.1} KB", b / 1024.0)
+    } else if b < 1024.0 * 1024.0 * 1024.0 {
+        format!("{:.1} MB", b / (1024.0 * 1024.0))
+    } else {
+        format!("{:.2} GB", b / (1024.0 * 1024.0 * 1024.0))
+    }
+}
+
+/// Extract a string from a JSON value, returning "" if missing.
+pub fn json_str(v: &serde_json::Value, key: &str) -> String {
+    v.get(key)
+        .and_then(|x| x.as_str())
+        .unwrap_or("")
+        .to_string()
+}
+
+/// Extract a bool from a JSON value.
+pub fn json_bool(v: &serde_json::Value, key: &str) -> bool {
+    v.get(key).and_then(|x| x.as_bool()).unwrap_or(false)
+}
+
+/// Extract a u64 from a JSON value (numbers only; defaults to 0).
+pub fn json_u64(v: &serde_json::Value, key: &str) -> u64 {
+    v.get(key).and_then(|x| x.as_u64()).unwrap_or(0)
+}
+
+/// Extract an array from a JSON value or return empty vec.
+pub fn json_array(v: &serde_json::Value, key: &str) -> Vec<serde_json::Value> {
+    v.get(key)
+        .and_then(|x| x.as_array())
+        .cloned()
+        .unwrap_or_default()
+}
diff --git a/rca-tool/web-leptos/src/components/sections/kernel.rs b/rca-tool/web-leptos/src/components/sections/kernel.rs
new file mode 100644
index 0000000..9dc724b
--- /dev/null
+++ b/rca-tool/web-leptos/src/components/sections/kernel.rs
@@ -0,0 +1,1169 @@
+use leptos::prelude::*;
+use serde_json::Value;
+
+use super::helpers::*;
+
+/// Section 10 – Kernel Crash Dumps (vmcore).
+#[component]
+pub fn KernelCrashSection(data: Value) -> impl IntoView {
+    let vmcore = data.get("vmcore").cloned().unwrap_or(Value::Null);
+    let crashes = json_array(&vmcore, "crashes");
+
+    if !json_bool(&vmcore, "found") || crashes.is_empty() {
+        return view! {}.into_any();
+    }
+
+    let crash_count = crashes.len();
+    let kdump_status = vmcore.get("kdumpStatus").cloned().unwrap_or(Value::Null);
+    let crash_listing = vmcore.get("crashListing").cloned().unwrap_or(Value::Null);
+    let listing_entries = json_array(&crash_listing, "entries");
+    let kdump_conf = vmcore.get("kdumpConf").cloned().unwrap_or(Value::Null);
+    let total_usage = crash_listing
+        .get("totalBytes")
+        .and_then(|value| value.as_f64())
+        .map(format_bytes)
+        .unwrap_or_else(|| {
+            let total_gb = json_str(&crash_listing, "totalGB");
+            if total_gb.is_empty() {
+                "-".to_string()
+            } else {
+                format!("{total_gb} GB")
+            }
+        });
+    let total_count = crash_listing
+        .get("count")
+        .and_then(|value| value.as_u64())
+        .unwrap_or(crash_count as u64);
+
+    view! {
+        <details class="danger-block" open=true>
+            <summary>
+                "Kernel Crash Dumps "
+                <span class="badge badge-danger">
+                    {format!("{} vmcore{}", crash_count, if crash_count == 1 { "" } else { "s" })}
+                </span>
+            </summary>
+
+            <div class="section-body">
+                {kdump_status
+                    .get("raw")
+                    .and_then(|value| value.as_str())
+                    .map(|raw| {
+                        let status_class = if json_bool(&kdump_status, "operational") {
+                            "text-success"
+                        } else {
+                            "text-danger"
+                        };
+                        let status_icon = if json_bool(&kdump_status, "operational") {
+                            "[OK]"
+                        } else {
+                            "[!]"
+                        };
+                        view! {
+                            <p>
+                                <strong>"Kdump Status:"</strong>
+                                " "
+                                <span class=status_class>{format!("{status_icon} {raw}")}</span>
+                            </p>
+                        }
+                    })}
+
+                <table class="kv-table">
+                    <thead>
+                        <tr>
+                            <th class="kv-label">"Date"</th>
+                            <th class="kv-label">"Panic Reason"</th>
+                            <th class="kv-label">"Kernel"</th>
+                            <th class="kv-label">"Process"</th>
+                            <th class="kv-label">"Vmcore Size"</th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        {crashes
+                            .into_iter()
+                            .map(|crash| {
+                                let date = json_str(&crash, "date");
+                                let panic_reason = json_str(&crash, "panicReason");
+                                let kernel_version = json_str(&crash, "kernelVersion");
+                                let comm = json_str(&crash, "comm");
+                                let pid = crash
+                                    .get("pid")
+                                    .and_then(|value| value.as_i64())
+                                    .map(|value| value.to_string())
+                                    .unwrap_or_default();
+                                let process = if comm.is_empty() {
+                                    "-".to_string()
+                                } else if pid.is_empty() {
+                                    comm.clone()
+                                } else {
+                                    format!("{comm} (PID {pid})")
+                                };
+                                let size = vmcore_size_for_date(&listing_entries, &date);
+                                let call_trace = json_array(&crash, "callTrace");
+
+                                view! {
+                                    <>
+                                        <tr>
+                                            <td class="kv-value"><code>{if date.is_empty() { "-".to_string() } else { date }}</code></td>
+                                            <td class="kv-value text-danger">
+                                                <strong>
+                                                    {if panic_reason.is_empty() {
+                                                        "-".to_string()
+                                                    } else {
+                                                        panic_reason
+                                                    }}
+                                                </strong>
+                                            </td>
+                                            <td class="kv-value"><code>{if kernel_version.is_empty() { "-".to_string() } else { kernel_version }}</code></td>
+                                            <td class="kv-value">{process}</td>
+                                            <td class="kv-value"><code>{size}</code></td>
+                                        </tr>
+                                        {(!call_trace.is_empty()).then(|| view! {
+                                            <tr>
+                                                <td colspan="5" class="kv-value">
+                                                    <details class="content-details">
+                                                        <summary>{format!("Call Trace ({} frames)", call_trace.len())}</summary>
+                                                        <pre class="json-dump">
+                                                            {call_trace
+                                                                .into_iter()
+                                                                .filter_map(|frame| frame.as_str().map(|value| value.to_string()))
+                                                                .collect::<Vec<_>>()
+                                                                .join("\n")}
+                                                        </pre>
+                                                    </details>
+                                                </td>
+                                            </tr>
+                                        })}
+                                    </>
+                                }
+                            })
+                            .collect::<Vec<_>>()}
+                    </tbody>
+                </table>
+
+                {(total_usage != "-").then(|| view! {
+                    <p class="text-muted">
+                        <strong>"Total vmcore disk usage:"</strong>
+                        " "
+                        {format!(
+                            "{} across {} dump{}",
+                            total_usage,
+                            total_count,
+                            if total_count == 1 { "" } else { "s" },
+                        )}
+                    </p>
+                })}
+
+                {(json_bool(&kdump_conf, "found") || !json_str(&kdump_conf, "path").is_empty())
+                    .then(|| view! {
+                        <details class="content-details">
+                            <summary>"Kdump Configuration"</summary>
+                            <KvTable>
+                                <KvRow label="Dump path" value={json_str(&kdump_conf, "path")}/>
+                                {(!json_str(&kdump_conf, "coreCollector").is_empty()).then(|| view! {
+                                    <KvRow
+                                        label="Core collector"
+                                        value={json_str(&kdump_conf, "coreCollector")}
+                                    />
+                                })}
+                                {(!json_str(&kdump_conf, "defaultAction").is_empty()).then(|| view! {
+                                    <KvRow
+                                        label="Failure action"
+                                        value={json_str(&kdump_conf, "defaultAction")}
+                                    />
+                                })}
+                            </KvTable>
+                        </details>
+                    })}
+
+                <p>
+                    <a
+                        href="https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/linux/troubleshoot-kdump"
+                        target="_blank"
+                        rel="noopener noreferrer"
+                        class="text-info"
+                    >
+                        "Kdump Documentation"
+                    </a>
+                </p>
+            </div>
+        </details>
+    }
+    .into_any()
+}
+
+/// Sections 14 + 16 – Kernel / System Parameters + Debugfs.
+#[component]
+pub fn KernelSection(data: Value) -> impl IntoView {
+    let ktune = data.get("kernelTuning").cloned().unwrap_or(Value::Null);
+    let hpages = data.get("hugePages").cloned().unwrap_or(Value::Null);
+    let time_sync = data.get("timeSync").cloned().unwrap_or(Value::Null);
+    let ptp_clock_source = data.get("ptpClockSource").cloned().unwrap_or(Value::Null);
+    let time_sync_service = data.get("timeSyncService").cloned().unwrap_or(Value::Null);
+    let timedatectl = data.get("timedatectl").cloned().unwrap_or(Value::Null);
+    let ptp_device = data.get("ptpDevice").cloned().unwrap_or(Value::Null);
+    let chrony_tracking = data.get("chronyTracking").cloned().unwrap_or(Value::Null);
+    let chrony_makestep = data.get("chronyMakestep").cloned().unwrap_or(Value::Null);
+    let hv_balloon = data.get("hvBalloon").cloned().unwrap_or(Value::Null);
+    let extfrag = data.get("extfrag").cloned().unwrap_or(Value::Null);
+
+    let has_kernel = json_bool(&ktune, "found")
+        || json_bool(&hpages, "found")
+        || json_bool(&time_sync, "found")
+        || json_bool(&ptp_clock_source, "found")
+        || json_bool(&time_sync_service, "found")
+        || json_bool(&timedatectl, "found")
+        || json_bool(&ptp_device, "found")
+        || json_bool(&chrony_tracking, "found")
+        || json_bool(&chrony_makestep, "found");
+    let has_debugfs = json_bool(&hv_balloon, "found") || json_bool(&extfrag, "found");
+
+    if !has_kernel && !has_debugfs {
+        return view! {}.into_any();
+    }
+
+    let has_warnings = json_bool(&ktune, "hasWarnings")
+        || json_bool(&ktune, "hasAzureNetworkWarnings")
+        || json_bool(&hpages, "hasWarnings")
+        || json_bool(&hpages, "hasRecommendations")
+        || json_bool(&time_sync, "hasWarnings")
+        || json_bool(&time_sync, "hasErrors")
+        || !json_array(&hv_balloon, "warnings").is_empty()
+        || !json_array(&extfrag, "warnings").is_empty();
+
+    view! {
+        {has_kernel.then(|| view! {
+            <Section
+                title="Kernel and System Parameters"
+                class=if has_warnings { "warning-block" } else { "content-details" }
+            >
+                {render_kernel_tuning_section(&ktune)}
+                {render_huge_pages_section(&hpages)}
+                {render_time_sync_section(
+                    &time_sync,
+                    &ptp_clock_source,
+                    &time_sync_service,
+                    &timedatectl,
+                    &ptp_device,
+                    &chrony_tracking,
+                    &chrony_makestep,
+                )}
+            </Section>
+        })}
+        {has_debugfs.then(|| view! {
+            <Section title="Debugfs (Advanced)" class="warning-block">
+                {render_hv_balloon_section(&hv_balloon)}
+                {render_extfrag_section(&extfrag)}
+            </Section>
+        })}
+    }
+    .into_any()
+}
+
+fn render_kernel_tuning_section(tuning: &Value) -> Option<AnyView> {
+    if !json_bool(tuning, "found") {
+        return None;
+    }
+
+    let warnings = json_array(tuning, "warnings");
+    let azure_warnings = json_array(tuning, "azureNetworkWarnings");
+    let optional_info = json_array(tuning, "optionalNetworkInfo");
+    let mut parameters = tuning
+        .get("parameters")
+        .and_then(|value| value.as_object())
+        .map(|map| {
+            map.iter()
+                .map(|(key, value)| {
+                    (
+                        key.clone(),
+                        value_as_text(value).unwrap_or_else(|| value.to_string()),
+                    )
+                })
+                .collect::<Vec<_>>()
+        })
+        .unwrap_or_default();
+    parameters.sort_by(|left, right| left.0.cmp(&right.0));
+
+    Some(
+        view! {
+            <div class="subsection">
+                <p class="subsection-title">"Kernel Tuning:"</p>
+
+                {(!warnings.is_empty()).then(|| view! {
+                    <div class="warning-block">
+                        <p><strong>{format!("Kernel Parameter Warnings ({})", warnings.len())}</strong></p>
+                        <table class="data-table">
+                            <thead>
+                                <tr>
+                                    <th>"Parameter"</th>
+                                    <th>"Expected"</th>
+                                    <th>"Found"</th>
+                                </tr>
+                            </thead>
+                            <tbody>
+                                {warnings
+                                    .iter()
+                                    .map(|warning| view! {
+                                        <tr>
+                                            <td><code>{json_text(warning, "parameter")}</code></td>
+                                            <td><code>{json_text(warning, "expected")}</code></td>
+                                            <td><code>{json_text(warning, "actual")}</code></td>
+                                        </tr>
+                                    })
+                                    .collect::<Vec<_>>()}
+                            </tbody>
+                        </table>
+                    </div>
+                })}
+
+                {tuning
+                    .get("azureNetworkTuned")
+                    .and_then(|value| value.as_bool())
+                    .unwrap_or(false)
+                    .then(|| view! {
+                        <div class="info-block">
+                            <p><strong>"[OK] Kernel parameters tuned for Azure Network"</strong></p>
+                            <p>
+                                <a
+                                    href="https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-optimize-network-bandwidth#linux-virtual-machines"
+                                    target="_blank"
+                                    rel="noopener noreferrer"
+                                    class="text-info"
+                                >
+                                    "View Documentation"
+                                </a>
+                            </p>
+                        </div>
+                    })}
+
+                {(!azure_warnings.is_empty()).then(|| view! {
+                    <div class="warning-block">
+                        <p>
+                            <strong>"[!] Azure Network Optimization - Parameters Need Adjustment"</strong>
+                            " "
+                            <span class="badge badge-warning">"Network tuning"</span>
+                        </p>
+                        <table class="data-table">
+                            <thead>
+                                <tr>
+                                    <th>"Parameter"</th>
+                                    <th>"Expected"</th>
+                                    <th>"Found"</th>
+                                </tr>
+                            </thead>
+                            <tbody>
+                                {azure_warnings
+                                    .iter()
+                                    .map(|warning| view! {
+                                        <tr>
+                                            <td><code>{json_text(warning, "parameter")}</code></td>
+                                            <td><code>{json_text(warning, "expected")}</code></td>
+                                            <td><code>{json_text(warning, "actual")}</code></td>
+                                        </tr>
+                                    })
+                                    .collect::<Vec<_>>()}
+                            </tbody>
+                        </table>
+                        <p>
+                            <a
+                                href="https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-optimize-network-bandwidth#linux-virtual-machines"
+                                target="_blank"
+                                rel="noopener noreferrer"
+                                class="text-info"
+                            >
+                                "View Documentation"
+                            </a>
+                        </p>
+                    </div>
+                })}
+
+                {tuning
+                    .get("fipsEnabled")
+                    .and_then(|value| value.as_bool())
+                    .unwrap_or(false)
+                    .then(|| view! {
+                        <div class="info-block">
+                            <p><strong>"FIPS mode is enabled in the kernel."</strong></p>
+                        </div>
+                    })}
+
+                {(!optional_info.is_empty()).then(|| view! {
+                    <details class="content-details">
+                        <summary>"Optional Network Tuning (informational only)"</summary>
+                        <p class="text-muted">
+                            "These are optional recommendations and do not indicate configuration issues; they are informational only."
+                        </p>
+                        <table class="data-table">
+                            <thead>
+                                <tr>
+                                    <th>"Status"</th>
+                                    <th>"Parameter"</th>
+                                    <th>"Recommended"</th>
+                                    <th>"Current"</th>
+                                </tr>
+                            </thead>
+                            <tbody>
+                                {optional_info
+                                    .iter()
+                                    .map(|item| {
+                                        let matches = item
+                                            .get("matches")
+                                            .and_then(|value| value.as_bool())
+                                            .unwrap_or(false);
+                                        view! {
+                                            <tr>
+                                                <td>{if matches { "[OK]" } else { "[i]" }}</td>
+                                                <td><code>{json_text(item, "parameter")}</code></td>
+                                                <td><code>{json_text(item, "expected")}</code></td>
+                                                <td><code>{json_text(item, "actual")}</code></td>
+                                            </tr>
+                                        }
+                                    })
+                                    .collect::<Vec<_>>()}
+                            </tbody>
+                        </table>
+                        <p>
+                            <a
+                                href="https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-optimize-network-bandwidth#linux-virtual-machines"
+                                target="_blank"
+                                rel="noopener noreferrer"
+                                class="text-info"
+                            >
+                                "View Documentation"
+                            </a>
+                        </p>
+                    </details>
+                })}
+
+                {(!parameters.is_empty()).then(|| view! {
+                    <details class="content-details">
+                        <summary>{format!("All Kernel Parameters ({})", parameters.len())}</summary>
+                        <table class="data-table">
+                            <thead>
+                                <tr>
+                                    <th>"Parameter"</th>
+                                    <th>"Value"</th>
+                                </tr>
+                            </thead>
+                            <tbody>
+                                {parameters
+                                    .iter()
+                                    .map(|(key, value)| view! {
+                                        <tr>
+                                            <td><code>{key.clone()}</code></td>
+                                            <td><code>{value.clone()}</code></td>
+                                        </tr>
+                                    })
+                                    .collect::<Vec<_>>()}
+                            </tbody>
+                        </table>
+                    </details>
+                })}
+            </div>
+        }
+        .into_any(),
+    )
+}
+
+fn render_huge_pages_section(huge: &Value) -> Option<AnyView> {
+    if !json_bool(huge, "found") {
+        return None;
+    }
+
+    let warnings = json_array(huge, "warnings");
+    let recommendations = json_array(huge, "recommendations");
+    let static_hp = huge.get("staticHugePages").cloned().unwrap_or(Value::Null);
+    let thp = huge
+        .get("transparentHugePages")
+        .cloned()
+        .unwrap_or(Value::Null);
+    let sysctl = huge.get("sysctlParams").cloned().unwrap_or(Value::Null);
+
+    Some(
+        view! {
+            <div class="subsection">
+                <p class="subsection-title">"Huge Pages Configuration:"</p>
+
+                {(!warnings.is_empty()).then(|| view! {
+                    <div class="warning-block">
+                        <p><strong>{format!("Huge Pages Warnings ({})", warnings.len())}</strong></p>
+                        <ul class="disk-list">
+                            {warnings
+                                .iter()
+                                .map(|warning| view! { <li>{json_text(warning, "message")}</li> })
+                                .collect::<Vec<_>>()}
+                        </ul>
+                    </div>
+                })}
+
+                {(!recommendations.is_empty()).then(|| view! {
+                    <div class="info-block">
+                        <p><strong>"Recommendations"</strong></p>
+                        <ul class="disk-list">
+                            {recommendations
+                                .iter()
+                                .map(|rec| {
+                                    let message = json_text(rec, "message");
+                                    let doc = json_text(rec, "documentationUrl");
+                                    view! {
+                                        <li>
+                                            {message}
+                                            {(!doc.is_empty()).then(|| view! {
+                                                <div>
+                                                    <a
+                                                        href=doc.clone()
+                                                        target="_blank"
+                                                        rel="noopener noreferrer"
+                                                        class="text-info"
+                                                    >
+                                                        "View Documentation"
+                                                    </a>
+                                                </div>
+                                            })}
+                                        </li>
+                                    }
+                                })
+                                .collect::<Vec<_>>()}
+                        </ul>
+                    </div>
+                })}
+
+                <details class="content-details" open=true>
+                    <summary>"Static Huge Pages"</summary>
+                    <KvTable>
+                        <KvRow
+                            label="Total Pages"
+                            value=empty_dash(json_text(&static_hp, "total"))
+                        />
+                        <KvRow
+                            label="Free Pages"
+                            value=empty_dash(json_text(&static_hp, "free"))
+                        />
+                        <KvRow
+                            label="Reserved Pages"
+                            value=empty_dash(json_text(&static_hp, "rsvd"))
+                        />
+                        <KvRow
+                            label="Surplus Pages"
+                            value=empty_dash(json_text(&static_hp, "surp"))
+                        />
+                        <KvRow
+                            label="Page Size"
+                            value=if json_text(&static_hp, "pagesize_kb").is_empty() {
+                                "-".to_string()
+                            } else {
+                                format!("{} kB", json_text(&static_hp, "pagesize_kb"))
+                            }
+                        />
+                        <KvRow
+                            label="Total Memory"
+                            value=if json_text(&static_hp, "total_mb").is_empty() {
+                                "-".to_string()
+                            } else {
+                                format!("{} MB", json_text(&static_hp, "total_mb"))
+                            }
+                        />
+                    </KvTable>
+                </details>
+
+                <details class="content-details">
+                    <summary>"Transparent Huge Pages (THP)"</summary>
+                    <KvTable>
+                        <KvRow
+                            label="Anonymous Huge Pages"
+                            value=if json_text(&thp, "anon_kb").is_empty() {
+                                "-".to_string()
+                            } else {
+                                format!("{} kB", json_text(&thp, "anon_kb"))
+                            }
+                        />
+                        <KvRow
+                            label="THP In Use"
+                            value=if json_text(&thp, "anon_mb").is_empty() {
+                                "-".to_string()
+                            } else {
+                                format!("{} MB", json_text(&thp, "anon_mb"))
+                            }
+                        />
+                        <KvRow
+                            label="Shared Memory Huge Pages"
+                            value=if json_text(&thp, "shmem_kb").is_empty() {
+                                "-".to_string()
+                            } else {
+                                format!("{} kB", json_text(&thp, "shmem_kb"))
+                            }
+                        />
+                        <KvRow
+                            label="Shared PMD Mapped"
+                            value=if json_text(&thp, "shmem_pmd_mapped_kb").is_empty() {
+                                "-".to_string()
+                            } else {
+                                format!("{} kB", json_text(&thp, "shmem_pmd_mapped_kb"))
+                            }
+                        />
+                    </KvTable>
+                </details>
+
+                {(sysctl.as_object().map(|obj| !obj.is_empty()).unwrap_or(false)).then(|| view! {
+                    <details class="content-details">
+                        <summary>"Huge Page Kernel Parameters (sysctl)"</summary>
+                        <KvTable>
+                            <KvRow
+                                label="vm.nr_hugepages"
+                                value=empty_dash(json_text(&sysctl, "nr_hugepages"))
+                            />
+                            <KvRow
+                                label="vm.nr_overcommit_hugepages"
+                                value=empty_dash(json_text(&sysctl, "nr_overcommit_hugepages"))
+                            />
+                            <KvRow
+                                label="vm.hugetlb_shm_group"
+                                value=empty_dash(json_text(&sysctl, "hugetlb_shm_group"))
+                            />
+                        </KvTable>
+                    </details>
+                })}
+            </div>
+        }
+        .into_any(),
+    )
+}
+
+fn render_time_sync_section(
+    time_sync: &Value,
+    ptp_clock_source: &Value,
+    time_sync_service: &Value,
+    timedatectl: &Value,
+    ptp_device: &Value,
+    chrony_tracking: &Value,
+    chrony_makestep: &Value,
+) -> Option<AnyView> {
+    let has_any = json_bool(time_sync, "found")
+        || json_bool(ptp_clock_source, "found")
+        || json_bool(time_sync_service, "found")
+        || json_bool(timedatectl, "found")
+        || json_bool(ptp_device, "found")
+        || json_bool(chrony_tracking, "found")
+        || json_bool(chrony_makestep, "found");
+
+    if !has_any {
+        return None;
+    }
+
+    let mut issues = Vec::new();
+    for source in [
+        time_sync,
+        ptp_clock_source,
+        time_sync_service,
+        timedatectl,
+        ptp_device,
+        chrony_tracking,
+        chrony_makestep,
+    ] {
+        issues.extend(json_array(source, "warnings"));
+    }
+
+    let error_count = issues
+        .iter()
+        .filter(|issue| json_text(issue, "severity") == "error")
+        .count();
+    let warning_count = issues.len().saturating_sub(error_count);
+
+    let hyperv_modules = string_array(time_sync, "hypervModules").join(", ");
+    let hv_utils_loaded = time_sync
+        .get("hvUtilsLoaded")
+        .and_then(|value| value.as_bool())
+        .unwrap_or(false);
+    let detection_file = json_text(time_sync_service, "detectionFile");
+    let service_details = if time_sync_service
+        .get("chronyEnabled")
+        .and_then(|value| value.as_bool())
+        .unwrap_or(false)
+    {
+        format!(
+            "chronyd ({})",
+            empty_dash(json_text(time_sync_service, "chronyStatus"))
+        )
+    } else if time_sync_service
+        .get("ntpdEnabled")
+        .and_then(|value| value.as_bool())
+        .unwrap_or(false)
+    {
+        format!(
+            "ntpd ({})",
+            empty_dash(json_text(time_sync_service, "ntpdStatus"))
+        )
+    } else if time_sync_service
+        .get("timesyncdEnabled")
+        .and_then(|value| value.as_bool())
+        .unwrap_or(false)
+    {
+        format!(
+            "systemd-timesyncd ({})",
+            empty_dash(json_text(time_sync_service, "timesyncdStatus")),
+        )
+    } else {
+        "No active time sync service detected".to_string()
+    };
+    let ptp_source = if ptp_clock_source
+        .get("hasPtpSource")
+        .and_then(|value| value.as_bool())
+        .unwrap_or(false)
+    {
+        empty_dash(json_text(ptp_clock_source, "ptpDevice"))
+    } else if chrony_tracking
+        .get("isPtpSource")
+        .and_then(|value| value.as_bool())
+        .unwrap_or(false)
+    {
+        empty_dash(json_text(chrony_tracking, "referenceName"))
+    } else {
+        "No PTP source configured".to_string()
+    };
+    let ntp_synchronized = timedatectl
+        .get("ntpSynchronized")
+        .and_then(|value| value.as_bool())
+        .unwrap_or(false);
+    let ptp_hyperv = ptp_device
+        .get("hasPtpHypervSymlink")
+        .and_then(|value| value.as_bool())
+        .unwrap_or(false);
+    let offset_ok = chrony_tracking
+        .get("lastOffsetSeconds")
+        .and_then(|value| value.as_f64())
+        .map(|offset| offset.abs() < 0.1)
+        .unwrap_or(true);
+    let offset_details = chrony_tracking
+        .get("lastOffsetSeconds")
+        .and_then(|value| value.as_f64())
+        .map(|offset| format!("{:.3} ms", offset * 1000.0))
+        .unwrap_or_else(|| "No offset data".to_string());
+    let makestep_details = if chrony_makestep
+        .get("hasMakestep")
+        .and_then(|value| value.as_bool())
+        .unwrap_or(false)
+    {
+        format!(
+            "{} {}",
+            empty_dash(json_text(chrony_makestep, "makestepThreshold")),
+            empty_dash(json_text(chrony_makestep, "makestepLimit")),
+        )
+    } else {
+        "Not configured".to_string()
+    };
+    let timezone = empty_dash(json_text(timedatectl, "timezone"));
+    let ptp_target = empty_dash(json_text(ptp_device, "ptpHypervTarget"));
+    let chrony_sources = json_array(ptp_clock_source, "chronySources");
+    let issues_class = if error_count > 0 {
+        "warning-block"
+    } else {
+        "info-block"
+    };
+
+    Some(
+        view! {
+            <details class="content-details" open=error_count > 0 || warning_count > 0>
+                <summary>
+                    "Time Synchronization"
+                    {(error_count > 0).then(|| view! {
+                        <span class="badge badge-danger">{format!("{} error(s)", error_count)}</span>
+                    })}
+                    {(warning_count > 0).then(|| view! {
+                        <span class="badge badge-warning">{format!("{} warning(s)", warning_count)}</span>
+                    })}
+                </summary>
+
+                <p class="text-muted">
+                    "Azure Linux VMs should use PTP from the host for accurate time synchronization."
+                    " "
+                    <a
+                        href="https://learn.microsoft.com/en-us/azure/virtual-machines/linux/time-sync"
+                        target="_blank"
+                        rel="noopener noreferrer"
+                        class="text-info"
+                    >
+                        "Documentation"
+                    </a>
+                </p>
+
+                <KvTable>
+                    <KvRow
+                        label="hv_utils module"
+                        value=if hyperv_modules.is_empty() {
+                            if hv_utils_loaded {
+                                "OK".to_string()
+                            } else {
+                                "ERROR — No Hyper-V modules listed".to_string()
+                            }
+                        } else if hv_utils_loaded {
+                            format!("OK — {}", hyperv_modules)
+                        } else {
+                            format!("ERROR — {}", hyperv_modules)
+                        }
+                    />
+                    <KvRow
+                        label="Time sync service"
+                        value=if service_details.starts_with("No active") {
+                            if detection_file.is_empty() {
+                                format!("ERROR — {}", service_details)
+                            } else {
+                                format!("ERROR — {} (from {})", service_details, detection_file)
+                            }
+                        } else if detection_file.is_empty() {
+                            format!("OK — {}", service_details)
+                        } else {
+                            format!("OK — {} (from {})", service_details, detection_file)
+                        }
+                    />
+                    <KvRow
+                        label="PTP clock source"
+                        value=if ptp_source.starts_with("No PTP") {
+                            format!("WARN — {}", ptp_source)
+                        } else {
+                            format!("OK — {}", ptp_source)
+                        }
+                    />
+                    <KvRow
+                        label="Clock synchronized"
+                        value=if ntp_synchronized {
+                            "OK — NTP synchronized".to_string()
+                        } else {
+                            format!("WARN — {}", timezone.clone())
+                        }
+                    />
+                    <KvRow
+                        label="/dev/ptp_hyperv"
+                        value=if ptp_hyperv {
+                            format!("OK — {}", ptp_target.clone())
+                        } else {
+                            "WARN — Symlink not present".to_string()
+                        }
+                    />
+                    <KvRow
+                        label="Chrony offset"
+                        value=if offset_ok {
+                            format!("OK — {}", offset_details)
+                        } else {
+                            format!("WARN — {}", offset_details)
+                        }
+                    />
+                    <KvRow
+                        label="makestep"
+                        value=if makestep_details == "Not configured" {
+                            "Info — Not configured".to_string()
+                        } else {
+                            format!("OK — {}", makestep_details)
+                        }
+                    />
+                </KvTable>
+
+                {(!issues.is_empty()).then(|| view! {
+                    <div class=issues_class>
+                        <p><strong>"Issues Detected"</strong></p>
+                        <ul class="disk-list">
+                            {issues
+                                .iter()
+                                .map(|issue| {
+                                    let message = json_text(issue, "message");
+                                    let recommendation = json_text(issue, "recommendation");
+                                    view! {
+                                        <li>
+                                            {message}
+                                            {(!recommendation.is_empty()).then(|| view! {
+                                                <div class="text-muted">{recommendation}</div>
+                                            })}
+                                        </li>
+                                    }
+                                })
+                                .collect::<Vec<_>>()}
+                        </ul>
+                    </div>
+                })}
+
+                {(!chrony_sources.is_empty()).then(|| view! {
+                    <details class="content-details">
+                        <summary>{format!("Chrony Sources ({})", chrony_sources.len())}</summary>
+                        <table class="data-table">
+                            <thead>
+                                <tr>
+                                    <th>"Type"</th>
+                                    <th>"Source"</th>
+                                    <th>"Status"</th>
+                                </tr>
+                            </thead>
+                            <tbody>
+                                {chrony_sources
+                                    .iter()
+                                    .map(|source| {
+                                        let active = source
+                                            .get("active")
+                                            .and_then(|value| value.as_bool())
+                                            .unwrap_or(false);
+                                        view! {
+                                            <tr>
+                                                <td>{json_text(source, "type")}</td>
+                                                <td><code>{json_text(source, "name")}</code></td>
+                                                <td>{if active { "Active sync source" } else { "Available" }}</td>
+                                            </tr>
+                                        }
+                                    })
+                                    .collect::<Vec<_>>()}
+                            </tbody>
+                        </table>
+                    </details>
+                })}
+            </details>
+        }
+        .into_any(),
+    )
+}
+
+fn render_hv_balloon_section(hv_balloon: &Value) -> Option<AnyView> {
+    if !json_bool(hv_balloon, "found") {
+        return None;
+    }
+
+    let warnings = json_array(hv_balloon, "warnings");
+    let raw_content = json_text(hv_balloon, "rawContent");
+    let host_version = empty_dash(json_text(hv_balloon, "hostVersion"));
+    let capabilities = empty_dash(json_text(hv_balloon, "capabilities"));
+    let state_value = if json_text(hv_balloon, "stateText").is_empty() {
+        empty_dash(json_text(hv_balloon, "state"))
+    } else {
+        format!(
+            "{} ({})",
+            empty_dash(json_text(hv_balloon, "state")),
+            json_text(hv_balloon, "stateText"),
+        )
+    };
+    let committed_memory = if json_text(hv_balloon, "committedMemoryGB").is_empty() {
+        "-".to_string()
+    } else {
+        format!("{} GB", json_text(hv_balloon, "committedMemoryGB"))
+    };
+    let max_dynamic_memory = if json_text(hv_balloon, "maxDynamicMemoryGB").is_empty() {
+        "-".to_string()
+    } else {
+        format!("{} GB", json_text(hv_balloon, "maxDynamicMemoryGB"))
+    };
+    let ballooned_memory = if json_text(hv_balloon, "balloonedMemoryMB").is_empty() {
+        "-".to_string()
+    } else {
+        format!("{} MB", json_text(hv_balloon, "balloonedMemoryMB"))
+    };
+    let pages_added = empty_dash(json_text(hv_balloon, "pagesAdded"));
+    let pages_onlined = empty_dash(json_text(hv_balloon, "pagesOnlined"));
+
+    Some(
+        view! {
+            <details class="content-details" open=true>
+                <summary>"Hyper-V Dynamic Memory (hv-balloon)"</summary>
+
+                {(!warnings.is_empty()).then(|| view! {
+                    <div class="warning-block">
+                        <p><strong>"Warnings"</strong></p>
+                        <ul class="disk-list">
+                            {warnings
+                                .iter()
+                                .map(|warning| {
+                                    let text = value_as_text(warning).unwrap_or_else(|| warning.to_string());
+                                    view! { <li>{text}</li> }
+                                })
+                                .collect::<Vec<_>>()}
+                        </ul>
+                    </div>
+                })}
+
+                <KvTable>
+                    <KvRow label="Host Version" value=host_version.clone() />
+                    <KvRow label="Capabilities" value=capabilities.clone() />
+                    <KvRow label="State" value=state_value.clone() />
+                    <KvRow label="Committed Memory" value=committed_memory.clone() />
+                    <KvRow label="Max Dynamic Memory" value=max_dynamic_memory.clone() />
+                    <KvRow label="Ballooned Memory" value=ballooned_memory.clone() />
+                    <KvRow label="Pages Added" value=pages_added.clone() />
+                    <KvRow label="Pages Onlined" value=pages_onlined.clone() />
+                </KvTable>
+
+                {render_raw_output_details("Raw debugfs output", raw_content)}
+            </details>
+        }
+        .into_any(),
+    )
+}
+
+fn render_extfrag_section(extfrag: &Value) -> Option<AnyView> {
+    if !json_bool(extfrag, "found") {
+        return None;
+    }
+
+    let zones = json_array(extfrag, "zones");
+    let warnings = json_array(extfrag, "warnings");
+    let raw_content = json_text(extfrag, "rawContent");
+
+    Some(
+        view! {
+            <details class="content-details" open=true>
+                <summary>{format!("Memory Fragmentation Index ({} zone{})", zones.len(), if zones.len() == 1 { "" } else { "s" })}</summary>
+
+                <p class="text-muted">
+                    "Values are reported per buddy allocator order (4K through 4M). Higher orders map to larger contiguous allocations; order 9 corresponds to 2 MB huge pages."
+                </p>
+
+                {(!warnings.is_empty()).then(|| view! {
+                    <div class="warning-block">
+                        <p><strong>{format!("Fragmentation warnings ({})", warnings.len())}</strong></p>
+                        <ul class="disk-list">
+                            {warnings
+                                .iter()
+                                .map(|warning| {
+                                    let text = value_as_text(warning).unwrap_or_else(|| warning.to_string());
+                                    view! { <li>{text}</li> }
+                                })
+                                .collect::<Vec<_>>()}
+                        </ul>
+                    </div>
+                })}
+
+                {zones
+                    .iter()
+                    .map(|zone| {
+                        let unusable = zone
+                            .get("unusableIndex")
+                            .and_then(|value| value.as_array())
+                            .map(|items| {
+                                items
+                                    .iter()
+                                    .filter_map(value_as_text)
+                                    .collect::<Vec<_>>()
+                                    .join(", ")
+                            })
+                            .unwrap_or_default();
+                        let extfrag_index = zone
+                            .get("extfragIndex")
+                            .and_then(|value| value.as_array())
+                            .map(|items| {
+                                items
+                                    .iter()
+                                    .filter_map(value_as_text)
+                                    .collect::<Vec<_>>()
+                                    .join(", ")
+                            })
+                            .unwrap_or_default();
+                        view! {
+                            <div class="vm-note info">
+                                <p>
+                                    <strong>
+                                        {format!(
+                                            "Node {}, zone {}",
+                                            json_text(zone, "node"),
+                                            json_text(zone, "zone"),
+                                        )}
+                                    </strong>
+                                </p>
+                                {(!unusable.is_empty()).then(|| view! {
+                                    <p>
+                                        <strong>"Unusable Index:"</strong>
+                                        " "
+                                        <code>{unusable}</code>
+                                    </p>
+                                })}
+                                {(!extfrag_index.is_empty()).then(|| view! {
+                                    <p>
+                                        <strong>"Extfrag Index:"</strong>
+                                        " "
+                                        <code>{extfrag_index}</code>
+                                    </p>
+                                })}
+                            </div>
+                        }
+                    })
+                    .collect::<Vec<_>>()}
+
+                {render_raw_output_details("Raw extfrag output", raw_content)}
+            </details>
+        }
+        .into_any(),
+    )
+}
+
+fn render_raw_output_details(title: &str, content: String) -> Option<AnyView> {
+    if content.trim().is_empty() {
+        return None;
+    }
+
+    Some(
+        view! {
+            <details class="content-details">
+                <summary>{title.to_string()}</summary>
+                <pre class="json-dump">{content}</pre>
+            </details>
+        }
+        .into_any(),
+    )
+}
+
+fn string_array(value: &Value, key: &str) -> Vec<String> {
+    value
+        .get(key)
+        .and_then(|value| value.as_array())
+        .map(|items| items.iter().filter_map(value_as_text).collect())
+        .unwrap_or_default()
+}
+
+fn json_text(value: &Value, key: &str) -> String {
+    value.get(key).and_then(value_as_text).unwrap_or_default()
+}
+
+fn value_as_text(value: &Value) -> Option<String> {
+    value
+        .as_str()
+        .map(|s| s.trim().to_string())
+        .filter(|s| !s.is_empty())
+        .or_else(|| value.as_i64().map(|v| v.to_string()))
+        .or_else(|| value.as_u64().map(|v| v.to_string()))
+        .or_else(|| {
+            value.as_f64().map(|v| {
+                if v.fract() == 0.0 {
+                    format!("{v:.0}")
+                } else {
+                    format!("{v:.3}")
+                }
+            })
+        })
+}
+
+fn empty_dash(value: String) -> String {
+    if value.trim().is_empty() {
+        "-".to_string()
+    } else {
+        value
+    }
+}
+
+fn vmcore_size_for_date(entries: &[Value], crash_date: &str) -> String {
+    entries
+        .iter()
+        .find(|entry| json_str(entry, "crashDate") == crash_date)
+        .map(|entry| {
+            entry
+                .get("sizeBytes")
+                .and_then(|value| value.as_f64())
+                .map(format_bytes)
+                .or_else(|| {
+                    entry
+                        .get("sizeMB")
+                        .and_then(|value| value.as_u64())
+                        .map(|value| format!("{value} MB"))
+                })
+                .unwrap_or_else(|| {
+                    let size_gb = json_str(entry, "sizeGB");
+                    if size_gb.is_empty() {
+                        "-".to_string()
+                    } else {
+                        format!("{size_gb} GB")
+                    }
+                })
+        })
+        .unwrap_or_else(|| "-".to_string())
+}
diff --git a/rca-tool/web-leptos/src/components/sections/merge_errors.rs b/rca-tool/web-leptos/src/components/sections/merge_errors.rs
new file mode 100644
index 0000000..ca0c079
--- /dev/null
+++ b/rca-tool/web-leptos/src/components/sections/merge_errors.rs
@@ -0,0 +1,213 @@
+use leptos::prelude::*;
+use serde_json::Value;
+
+use super::helpers::*;
+
+/// Section – SAP HANA delta-merge / optimize-compression failures.
+#[component]
+pub fn MergeErrorsSection(data: Value) -> impl IntoView {
+    let me = data.get("hanaMergeErrors").cloned().unwrap_or(Value::Null);
+
+    if !json_bool(&me, "found") {
+        return view! {}.into_any();
+    }
+
+    let warnings = json_array(&me, "warnings");
+    let error_count = warnings
+        .iter()
+        .filter(|w| json_str(w, "severity") == "error")
+        .count();
+    let warning_count = warnings.len() - error_count;
+    let class = if error_count > 0 {
+        "danger-block"
+    } else if warning_count > 0 {
+        "warning-block"
+    } else {
+        "content-details"
+    };
+
+    view! {
+        <Section title="SAP HANA Delta-Merge Failures" class=class>
+            {render_merge_summary(&me)}
+            {render_merge_warnings(&warnings)}
+            {render_top_tables(&me)}
+            {render_merge_table(&me)}
+        </Section>
+    }
+    .into_any()
+}
+
+fn render_merge_summary(me: &Value) -> AnyView {
+    let count = json_u64(me, "count");
+    let merge = json_u64(me, "mergeErrorCount");
+    let compression = json_u64(me, "compressionErrorCount");
+    let token = json_u64(me, "tokenExhaustionCount");
+    let last = json_str(me, "lastError");
+
+    view! {
+        <table class="kv-table">
+            <tbody>
+                <KvRow label="Total failures" value=count.to_string()/>
+                <KvRow label="Delta-merge failures" value=merge.to_string()/>
+                <KvRow label="Compression failures" value=compression.to_string()/>
+                <KvRow label="Merge-token exhaustion (rc=2465)" value=token.to_string()/>
+                <KvRow
+                    label="Last failure"
+                    value=if last.is_empty() { "—".to_string() } else { last }
+                />
+            </tbody>
+        </table>
+    }
+    .into_any()
+}
+
+fn render_merge_warnings(warnings: &[Value]) -> Option<AnyView> {
+    if warnings.is_empty() {
+        return None;
+    }
+
+    Some(
+        warnings
+            .iter()
+            .map(|warning| {
+                let severity = json_str(warning, "severity");
+                let message = json_str(warning, "message");
+                let details = json_str(warning, "details");
+                let recommendation = json_str(warning, "recommendation");
+                let class = if severity == "error" {
+                    "danger-block"
+                } else if severity == "warning" {
+                    "warning-block"
+                } else {
+                    "info-block"
+                };
+                let heading = if severity == "error" {
+                    "Error"
+                } else if severity == "warning" {
+                    "Warning"
+                } else {
+                    "Info"
+                };
+                view! {
+                    <div class=class>
+                        <p>
+                            <strong>{format!("{heading}:")}</strong>
+                            " "
+                            {message}
+                        </p>
+                        {(!details.is_empty())
+                            .then(|| view! { <p><code>{details}</code></p> })}
+                        {(!recommendation.is_empty())
+                            .then(|| view! { <p>{recommendation}</p> })}
+                    </div>
+                }
+            })
+            .collect::<Vec<_>>()
+            .into_any(),
+    )
+}
+
+fn render_top_tables(me: &Value) -> Option<AnyView> {
+    let tables = json_array(me, "topTables");
+    if tables.is_empty() {
+        return None;
+    }
+
+    let rows = tables
+        .iter()
+        .map(|row| {
+            let name = json_str(row, "name");
+            let count = json_u64(row, "count");
+            view! {
+                <tr>
+                    <td><code>{name}</code></td>
+                    <td>{count.to_string()}</td>
+                </tr>
+            }
+        })
+        .collect::<Vec<_>>();
+
+    Some(
+        view! {
+            <details class="content-details">
+                <summary>"Most frequently failing tables"</summary>
+                <table class="data-table">
+                    <thead>
+                        <tr>
+                            <th>"Table"</th>
+                            <th>"Failures"</th>
+                        </tr>
+                    </thead>
+                    <tbody>{rows}</tbody>
+                </table>
+            </details>
+        }
+        .into_any(),
+    )
+}
+
+fn render_merge_table(me: &Value) -> Option<AnyView> {
+    let errors = json_array(me, "errors");
+    if errors.is_empty() {
+        return None;
+    }
+
+    // Cap the rendered rows to keep the DOM light on multi-day traces.
+    const MAX_ROWS: usize = 200;
+    let total = errors.len();
+    let truncated = total > MAX_ROWS;
+
+    let opt_str = |row: &Value, key: &str| -> String {
+        let s = json_str(row, key);
+        if s.is_empty() { "—".to_string() } else { s }
+    };
+
+    let rows = errors
+        .iter()
+        .take(MAX_ROWS)
+        .map(|row| {
+            let timestamp = json_str(row, "timestamp");
+            let component = opt_str(row, "component");
+            let table = opt_str(row, "table");
+            let motivation = opt_str(row, "motivation");
+            let rc = opt_str(row, "rc");
+            view! {
+                <tr>
+                    <td>{timestamp}</td>
+                    <td>{component}</td>
+                    <td><code>{table}</code></td>
+                    <td>{motivation}</td>
+                    <td>{rc}</td>
+                </tr>
+            }
+        })
+        .collect::<Vec<_>>();
+
+    Some(
+        view! {
+            <details class="content-details">
+                <summary>
+                    {format!("Delta-merge failures ({total})")}
+                </summary>
+                <table class="data-table">
+                    <thead>
+                        <tr>
+                            <th>"Timestamp"</th>
+                            <th>"Component"</th>
+                            <th>"Table"</th>
+                            <th>"Motivation"</th>
+                            <th>"rc"</th>
+                        </tr>
+                    </thead>
+                    <tbody>{rows}</tbody>
+                </table>
+                {truncated.then(|| view! {
+                    <p class="muted">
+                        {format!("Showing first {MAX_ROWS} of {total} delta-merge failures.")}
+                    </p>
+                })}
+            </details>
+        }
+        .into_any(),
+    )
+}
diff --git a/rca-tool/web-leptos/src/components/sections/mod.rs b/rca-tool/web-leptos/src/components/sections/mod.rs
new file mode 100644
index 0000000..95cae9d
--- /dev/null
+++ b/rca-tool/web-leptos/src/components/sections/mod.rs
@@ -0,0 +1,15 @@
+pub mod archive;
+pub mod azure_vm;
+pub mod cluster;
+pub mod deadlocks;
+pub mod distribution;
+pub mod events;
+pub mod hana;
+pub mod helpers;
+pub mod kernel;
+pub mod merge_errors;
+pub mod networking;
+pub mod oom;
+pub mod os_tuning;
+pub mod services;
+pub mod storage;
diff --git a/rca-tool/web-leptos/src/components/sections/networking.rs b/rca-tool/web-leptos/src/components/sections/networking.rs
new file mode 100644
index 0000000..54efde3
--- /dev/null
+++ b/rca-tool/web-leptos/src/components/sections/networking.rs
@@ -0,0 +1,950 @@
+use leptos::prelude::*;
+use serde_json::Value;
+
+use super::helpers::*;
+
+/// Section 11 – Networking (interfaces + firewall).
+#[component]
+pub fn NetworkingSection(data: Value) -> impl IntoView {
+    let interfaces = data
+        .get("networkInterfaces")
+        .cloned()
+        .unwrap_or(Value::Null);
+    let firewall = data.get("firewallRules").cloned().unwrap_or(Value::Null);
+    let packet_loss = data.get("packetLoss").cloned().unwrap_or(Value::Null);
+    let ring_buffer = data.get("ringBuffer").cloned().unwrap_or(Value::Null);
+    let net_sysctl = data.get("networkSysctl").cloned().unwrap_or(Value::Null);
+
+    let has_intf = json_bool(&interfaces, "found");
+    let has_fw = json_bool(&firewall, "found");
+    let has_pl = json_bool(&packet_loss, "found");
+    let has_rb = json_bool(&ring_buffer, "found");
+    let has_sysctl = json_bool(&net_sysctl, "found");
+
+    if !has_intf && !has_fw && !has_pl && !has_rb && !has_sysctl {
+        return view! {}.into_any();
+    }
+
+    let mut ifaces = interface_values(&interfaces);
+    ifaces.retain(|iface| json_str(iface, "name") != "lo");
+    ifaces.sort_by(|a, b| {
+        let a_name = json_str(a, "name");
+        let b_name = json_str(b, "name");
+        match (a_name.as_str(), b_name.as_str()) {
+            ("eth0", "eth0") => std::cmp::Ordering::Equal,
+            ("eth0", _) => std::cmp::Ordering::Less,
+            (_, "eth0") => std::cmp::Ordering::Greater,
+            _ => a_name.cmp(&b_name),
+        }
+    });
+
+    let accel_net = ifaces.iter().any(|iface| json_bool(iface, "accelNet"));
+    let raw_interfaces = interfaces.get("raw").cloned().unwrap_or(Value::Null);
+    let section_class = if has_fw || !ifaces.is_empty() {
+        "info-block"
+    } else {
+        "content-details"
+    };
+
+    view! {
+        <Section title="Networking" class=section_class open=true>
+            {render_interfaces_section(&ifaces, has_intf, accel_net, &raw_interfaces)}
+            {render_packet_loss_section(&packet_loss, has_pl)}
+            {render_ring_buffer_section(&ring_buffer, has_rb)}
+            {render_network_sysctl_section(&net_sysctl, has_sysctl)}
+            {render_firewall_section(&firewall, has_fw)}
+        </Section>
+    }
+    .into_any()
+}
+
+fn warnings_from(value: &Value) -> Vec<Value> {
+    value
+        .get("warnings")
+        .and_then(|v| v.as_array())
+        .cloned()
+        .unwrap_or_default()
+}
+
+fn warning_class(severity: &str) -> &'static str {
+    match severity {
+        "warning" => "text-warning",
+        "danger" | "error" | "critical" => "text-danger",
+        _ => "text-muted",
+    }
+}
+
+fn render_packet_loss_section(packet_loss: &Value, has_pl: bool) -> AnyView {
+    if !has_pl {
+        return view! {}.into_any();
+    }
+    let interfaces = packet_loss
+        .get("interfaces")
+        .and_then(|v| v.as_array())
+        .cloned()
+        .unwrap_or_default();
+    // Hide loopback for clarity.
+    let interfaces: Vec<Value> = interfaces
+        .into_iter()
+        .filter(|i| json_str(i, "interface") != "lo")
+        .collect();
+    let warnings = warnings_from(packet_loss);
+    let has_warn = !warnings.is_empty();
+    let block_class = if has_warn { "warning-block" } else { "info-block" };
+    let summary = if has_warn {
+        format!("{} issue{}", warnings.len(), if warnings.len() == 1 { "" } else { "s" })
+    } else {
+        "no losses detected".to_string()
+    };
+
+    view! {
+        <details class=block_class open=has_warn>
+            <summary>
+                "Packet loss (ip -s link) "
+                <span class="text-muted">{format!("({summary})")}</span>
+            </summary>
+            <div class="section-body">
+                {(!interfaces.is_empty()).then(|| view! {
+                    <table class="kv-table">
+                        <thead>
+                            <tr>
+                                <th class="kv-label">"Interface"</th>
+                                <th class="kv-label">"RX packets"</th>
+                                <th class="kv-label">"RX errors"</th>
+                                <th class="kv-label">"RX dropped"</th>
+                                <th class="kv-label">"RX missed"</th>
+                                <th class="kv-label">"TX packets"</th>
+                                <th class="kv-label">"TX errors"</th>
+                                <th class="kv-label">"TX dropped"</th>
+                            </tr>
+                        </thead>
+                        <tbody>
+                            {interfaces.iter().cloned().map(|i| {
+                                let name = json_str(&i, "interface");
+                                let rx_pkts = json_u64(&i, "rxPackets");
+                                let rx_err = json_u64(&i, "rxErrors");
+                                let rx_drop = json_u64(&i, "rxDropped");
+                                let rx_miss = json_u64(&i, "rxMissed");
+                                let tx_pkts = json_u64(&i, "txPackets");
+                                let tx_err = json_u64(&i, "txErrors");
+                                let tx_drop = json_u64(&i, "txDropped");
+                                let rx_err_cls = if rx_err > 0 { "text-danger" } else { "kv-value" };
+                                let rx_drop_cls = if rx_drop > 0 { "text-warning" } else { "kv-value" };
+                                let rx_miss_cls = if rx_miss > 0 { "text-warning" } else { "kv-value" };
+                                let tx_err_cls = if tx_err > 0 { "text-danger" } else { "kv-value" };
+                                let tx_drop_cls = if tx_drop > 0 { "text-warning" } else { "kv-value" };
+                                view! {
+                                    <tr>
+                                        <td class="kv-value"><strong>{name}</strong></td>
+                                        <td class="kv-value">{rx_pkts.to_string()}</td>
+                                        <td class=rx_err_cls>{rx_err.to_string()}</td>
+                                        <td class=rx_drop_cls>{rx_drop.to_string()}</td>
+                                        <td class=rx_miss_cls>{rx_miss.to_string()}</td>
+                                        <td class="kv-value">{tx_pkts.to_string()}</td>
+                                        <td class=tx_err_cls>{tx_err.to_string()}</td>
+                                        <td class=tx_drop_cls>{tx_drop.to_string()}</td>
+                                    </tr>
+                                }
+                            }).collect::<Vec<_>>()}
+                        </tbody>
+                    </table>
+                })}
+                {has_warn.then(|| view! {
+                    <ul>
+                        {warnings.iter().cloned().map(|w| {
+                            let sev = json_str(&w, "severity");
+                            let cls = warning_class(&sev);
+                            let msg = json_str(&w, "message");
+                            view! { <li class=cls>{msg}</li> }
+                        }).collect::<Vec<_>>()}
+                    </ul>
+                })}
+            </div>
+        </details>
+    }.into_any()
+}
+
+fn render_ring_buffer_section(ring_buffer: &Value, has_rb: bool) -> AnyView {
+    if !has_rb {
+        return view! {}.into_any();
+    }
+    let entries = ring_buffer
+        .get("entries")
+        .and_then(|v| v.as_array())
+        .cloned()
+        .unwrap_or_default();
+    let entries: Vec<Value> = entries
+        .into_iter()
+        .filter(|i| json_str(i, "interface") != "lo")
+        .collect();
+    let warnings = warnings_from(ring_buffer);
+    let has_warn = !warnings.is_empty();
+    let block_class = if has_warn { "warning-block" } else { "info-block" };
+    let summary = if has_warn {
+        format!("{} undersized ring{}", warnings.len(), if warnings.len() == 1 { "" } else { "s" })
+    } else {
+        "ring buffers at hardware max".to_string()
+    };
+
+    let fmt_opt = |v: &Value, k: &str| -> String {
+        match v.get(k) {
+            Some(Value::Number(n)) => n.to_string(),
+            _ => "-".to_string(),
+        }
+    };
+
+    view! {
+        <details class=block_class open=has_warn>
+            <summary>
+                "Ring buffers (ethtool -g) "
+                <span class="text-muted">{format!("({summary})")}</span>
+            </summary>
+            <div class="section-body">
+                {(!entries.is_empty()).then(|| view! {
+                    <table class="kv-table">
+                        <thead>
+                            <tr>
+                                <th class="kv-label">"Interface"</th>
+                                <th class="kv-label">"RX current"</th>
+                                <th class="kv-label">"RX max"</th>
+                                <th class="kv-label">"TX current"</th>
+                                <th class="kv-label">"TX max"</th>
+                            </tr>
+                        </thead>
+                        <tbody>
+                            {entries.iter().cloned().map(|i| {
+                                let name = json_str(&i, "interface");
+                                let rx_cur = fmt_opt(&i, "rxCurrent");
+                                let rx_max = fmt_opt(&i, "rxMax");
+                                let tx_cur = fmt_opt(&i, "txCurrent");
+                                let tx_max = fmt_opt(&i, "txMax");
+                                let rx_cls = if rx_cur != rx_max && rx_max != "-" { "text-warning" } else { "kv-value" };
+                                let tx_cls = if tx_cur != tx_max && tx_max != "-" { "text-warning" } else { "kv-value" };
+                                view! {
+                                    <tr>
+                                        <td class="kv-value"><strong>{name}</strong></td>
+                                        <td class=rx_cls>{rx_cur}</td>
+                                        <td class="kv-value">{rx_max}</td>
+                                        <td class=tx_cls>{tx_cur}</td>
+                                        <td class="kv-value">{tx_max}</td>
+                                    </tr>
+                                }
+                            }).collect::<Vec<_>>()}
+                        </tbody>
+                    </table>
+                })}
+                {has_warn.then(|| view! {
+                    <ul>
+                        {warnings.iter().cloned().map(|w| {
+                            let sev = json_str(&w, "severity");
+                            let cls = warning_class(&sev);
+                            let msg = json_str(&w, "message");
+                            view! { <li class=cls>{msg}</li> }
+                        }).collect::<Vec<_>>()}
+                    </ul>
+                })}
+            </div>
+        </details>
+    }.into_any()
+}
+
+fn render_network_sysctl_section(net_sysctl: &Value, has_sysctl: bool) -> AnyView {
+    if !has_sysctl {
+        return view! {}.into_any();
+    }
+    let entries = net_sysctl
+        .get("rpFilter")
+        .and_then(|v| v.as_array())
+        .cloned()
+        .unwrap_or_default();
+    let warnings = warnings_from(net_sysctl);
+    let has_warn = !warnings.is_empty();
+    let block_class = if has_warn { "warning-block" } else { "info-block" };
+    let summary = if has_warn {
+        format!("rp_filter active on {} scope{}", warnings.len(), if warnings.len() == 1 { "" } else { "s" })
+    } else {
+        "rp_filter disabled".to_string()
+    };
+
+    view! {
+        <details class=block_class open=has_warn>
+            <summary>
+                "Network sysctl tuning "
+                <span class="text-muted">{format!("({summary})")}</span>
+            </summary>
+            <div class="section-body">
+                {(!entries.is_empty()).then(|| view! {
+                    <table class="kv-table">
+                        <thead>
+                            <tr>
+                                <th class="kv-label">"Sysctl key"</th>
+                                <th class="kv-label">"Value"</th>
+                            </tr>
+                        </thead>
+                        <tbody>
+                            {entries.iter().cloned().map(|e| {
+                                let key = json_str(&e, "key");
+                                let val = json_str(&e, "value");
+                                let cls = if val == "0" { "kv-value" } else { "text-warning" };
+                                view! {
+                                    <tr>
+                                        <td class="kv-value"><code>{key}</code></td>
+                                        <td class=cls><strong>{val}</strong></td>
+                                    </tr>
+                                }
+                            }).collect::<Vec<_>>()}
+                        </tbody>
+                    </table>
+                })}
+                {has_warn.then(|| view! {
+                    <ul>
+                        {warnings.iter().cloned().map(|w| {
+                            let sev = json_str(&w, "severity");
+                            let cls = warning_class(&sev);
+                            let msg = json_str(&w, "message");
+                            view! { <li class=cls>{msg}</li> }
+                        }).collect::<Vec<_>>()}
+                    </ul>
+                })}
+            </div>
+        </details>
+    }.into_any()
+}
+
+fn render_interfaces_section(
+    ifaces: &[Value],
+    has_intf: bool,
+    accel_net: bool,
+    raw_sections: &Value,
+) -> AnyView {
+    let iface_count = ifaces.len();
+    let summary = if iface_count == 0 {
+        "No interfaces detected".to_string()
+    } else if accel_net {
+        format!(
+            "{} interface{} | Accelerated Networking",
+            iface_count,
+            if iface_count == 1 { "" } else { "s" }
+        )
+    } else {
+        format!(
+            "{} interface{}",
+            iface_count,
+            if iface_count == 1 { "" } else { "s" }
+        )
+    };
+    let block_class = if has_intf {
+        "info-block"
+    } else {
+        "content-details"
+    };
+
+    let cloud_init_entries = collect_cloud_init_sources(ifaces);
+
+    view! {
+        <details class=block_class open=has_intf>
+            <summary>
+                "Network Interfaces "
+                <span class="text-muted">{format!("({summary})")}</span>
+            </summary>
+            <div class="section-body">
+                {if ifaces.is_empty() {
+                    view! {
+                        <p class="text-muted">
+                            <em>"No network interface configuration was detected in the analyzed files."</em>
+                        </p>
+                    }
+                    .into_any()
+                } else {
+                    view! {
+                        <>
+                            <table class="kv-table">
+                                <thead>
+                                    <tr>
+                                        <th class="kv-label">"Interface"</th>
+                                        <th class="kv-label">"State"</th>
+                                        <th class="kv-label">"IPv4"</th>
+                                        <th class="kv-label">"IPv6"</th>
+                                        <th class="kv-label">"MAC"</th>
+                                        <th class="kv-label">"MTU"</th>
+                                        <th class="kv-label">"DHCP / Static"</th>
+                                        <th class="kv-label">"Driver"</th>
+                                        <th class="kv-label">"Accel Net"</th>
+                                    </tr>
+                                </thead>
+                                <tbody>
+                                    {ifaces
+                                        .iter()
+                                        .cloned()
+                                        .map(|iface| {
+                                            let name = json_str(&iface, "name");
+                                            let master = json_str(&iface, "master");
+                                            let state = json_str(&iface, "state");
+                                            let state_class = if state == "UP" {
+                                                "text-success"
+                                            } else if state == "DOWN" {
+                                                "text-danger"
+                                            } else {
+                                                "text-muted"
+                                            };
+                                            let ipv4 = format_ip_entries(iface.get("ipv4").unwrap_or(&Value::Null), false);
+                                            let ipv6 = format_ip_entries(iface.get("ipv6").unwrap_or(&Value::Null), true);
+                                            let mac = json_str(&iface, "mac");
+                                            let mtu = display_value(&iface, "mtu");
+                                            let bootproto = display_bootproto(&iface);
+                                            let driver = json_str(&iface, "driver");
+                                            let accel = display_accel_net(&iface, ifaces);
+                                            let display_name = if master.is_empty() {
+                                                name.clone()
+                                            } else {
+                                                format!("{name} (linked to {master})")
+                                            };
+
+                                            view! {
+                                                <tr>
+                                                    <td class="kv-value"><strong>{display_name}</strong></td>
+                                                    <td class=state_class>{if state.is_empty() { "-".to_string() } else { state }}</td>
+                                                    <td class="kv-value">{ipv4}</td>
+                                                    <td class="kv-value">{ipv6}</td>
+                                                    <td class="kv-value"><code>{if mac.is_empty() { "-".to_string() } else { mac }}</code></td>
+                                                    <td class="kv-value">{mtu}</td>
+                                                    <td class="kv-value">{bootproto}</td>
+                                                    <td class="kv-value">{if driver.is_empty() { "-".to_string() } else { driver }}</td>
+                                                    <td class="kv-value">{accel}</td>
+                                                </tr>
+                                            }
+                                        })
+                                        .collect::<Vec<_>>()}
+                                </tbody>
+                            </table>
+
+                            {(!cloud_init_entries.is_empty()).then(|| view! {
+                                <div class="warning-block">
+                                    <p class="text-warning">
+                                        <strong>"cloud-init:"</strong>
+                                        " Some IP addresses were captured from cloud-init ci-info boot messages and reflect the last reported configuration during boot. They may not represent the current runtime state."
+                                    </p>
+                                    <ul>
+                                        {cloud_init_entries
+                                            .into_iter()
+                                            .map(|entry| view! { <li><code>{entry}</code></li> })
+                                            .collect::<Vec<_>>()}
+                                    </ul>
+                                </div>
+                            })}
+
+                            {render_raw_network_sections(raw_sections)}
+                        </>
+                    }
+                    .into_any()
+                }}
+            </div>
+        </details>
+    }
+    .into_any()
+}
+
+fn render_firewall_section(firewall: &Value, has_fw: bool) -> AnyView {
+    let active = json_str(firewall, "activeFirewall");
+    let active_label = if active.is_empty() || active == "none" {
+        "No Active Firewall".to_string()
+    } else {
+        format!("Active: {active}")
+    };
+    let block_class = if !has_fw {
+        "info-block"
+    } else if active.is_empty() || active == "none" {
+        "warning-block"
+    } else {
+        "info-block"
+    };
+
+    let warnings = string_array_from_key(firewall, "warnings");
+    let firewalld = firewall.get("firewalld").cloned().unwrap_or(Value::Null);
+    let nftables = firewall.get("nftables").cloned().unwrap_or(Value::Null);
+    let iptables = firewall.get("iptables").cloned().unwrap_or(Value::Null);
+    let ip6tables = firewall.get("ip6tables").cloned().unwrap_or(Value::Null);
+    let ebtables = firewall.get("ebtables").cloned().unwrap_or(Value::Null);
+    let raw_sections = firewall.get("rawSections").cloned().unwrap_or(Value::Null);
+
+    view! {
+        <details class=block_class>
+            <summary>
+                "Firewall Rules "
+                <span class="text-muted">{format!("({active_label})")}</span>
+            </summary>
+            <div class="section-body">
+                {if !has_fw {
+                    view! {
+                        <>
+                            <p class="text-muted">
+                                <em>"No firewall configuration was detected in the analyzed files."</em>
+                            </p>
+                            <p class="text-muted">
+                                <em>"Checked for: firewalld, iptables, ip6tables, ebtables, nftables"</em>
+                            </p>
+                        </>
+                    }
+                    .into_any()
+                } else {
+                    view! {
+                        <>
+                            {(!warnings.is_empty()).then(|| view! {
+                                <div class="warning-block">
+                                    <ul>
+                                        {warnings
+                                            .into_iter()
+                                            .map(|warning| view! { <li class="text-warning">{warning}</li> })
+                                            .collect::<Vec<_>>()}
+                                    </ul>
+                                </div>
+                            })}
+                            {render_firewalld_details(&firewalld, &raw_sections)}
+                            {render_nftables_details(&nftables, &raw_sections)}
+                            {render_iptables_details("iptables", &iptables, "iptables-config")}
+                            {render_iptables_details("ip6tables", &ip6tables, "")}
+                            {render_ebtables_details(&ebtables)}
+                            {render_remaining_raw_sections(&raw_sections)}
+                        </>
+                    }
+                    .into_any()
+                }}
+            </div>
+        </details>
+    }
+    .into_any()
+}
+
+fn render_firewalld_details(firewalld: &Value, raw_sections: &Value) -> Option<AnyView> {
+    if !json_bool(firewalld, "detected") {
+        return None;
+    }
+
+    let running = json_bool(firewalld, "running");
+    let backend = json_str(firewalld, "backend");
+    let log_denied = json_str(firewalld, "logDenied");
+    let zones = json_str(firewalld, "zones");
+    let direct_rules = json_str(firewalld, "directRules");
+    let chains = json_str(firewalld, "chains");
+    let passthroughs = json_str(firewalld, "passthroughs");
+    let config = firewalld.get("config").cloned().unwrap_or(Value::Null);
+    let config_entries = [
+        "DefaultZone",
+        "LogDenied",
+        "AllowZoneDrifting",
+        "FlushAllOnReload",
+        "Lockdown",
+    ]
+    .into_iter()
+    .filter_map(|key| {
+        config
+            .get(key)
+            .map(|value| format!("{}={}", key, value_to_inline_string(value)))
+    })
+    .collect::<Vec<_>>();
+
+    Some(
+        view! {
+            <details class="content-details" open=running>
+                <summary>
+                    "firewalld "
+                    <span class=if running { "text-success" } else { "text-warning" }>
+                        {format!("({})", if running { "running" } else { "not running" })}
+                    </span>
+                </summary>
+                <div class="section-body">
+                    <KvTable>
+                        {(!backend.is_empty()).then(|| view! { <KvRow label="Backend" value=backend.clone()/> })}
+                        {(!log_denied.is_empty()).then(|| view! { <KvRow label="LogDenied" value=log_denied.clone()/> })}
+                        {(!config_entries.is_empty()).then(|| view! {
+                            <KvRow label="Config" value=config_entries.join(", ")/>
+                        })}
+                    </KvTable>
+                    {render_pre_block("Zones (runtime)", zones)}
+                    {render_pre_block("Direct Rules", direct_rules)}
+                    {render_pre_block("Direct Chains", chains)}
+                    {render_pre_block("Passthroughs", passthroughs)}
+                    {render_pre_block(
+                        "Raw firewalld.conf",
+                        raw_sections
+                            .get("firewalld.conf")
+                            .and_then(|value| value.as_str())
+                            .unwrap_or("")
+                            .to_string(),
+                    )}
+                </div>
+            </details>
+        }
+        .into_any(),
+    )
+}
+
+fn render_nftables_details(nftables: &Value, raw_sections: &Value) -> Option<AnyView> {
+    if !json_bool(nftables, "detected") {
+        return None;
+    }
+
+    let tables = json_str(nftables, "tables");
+    let ruleset = json_str(nftables, "ruleset");
+    let has_rules = !ruleset.is_empty() && ruleset != "(empty)";
+
+    Some(
+        view! {
+            <details class="content-details" open=has_rules>
+                <summary>
+                    "nftables "
+                    <span class=if has_rules { "text-info" } else { "text-muted" }>
+                        {format!("({})", if has_rules { "rules present" } else { "no rules" })}
+                    </span>
+                </summary>
+                <div class="section-body">
+                    {(!tables.is_empty()).then(|| view! { <p><strong>"Tables:"</strong> " " <code>{tables.clone()}</code></p> })}
+                    {render_pre_block("Ruleset", ruleset)}
+                    {render_pre_block(
+                        "Raw /etc/sysconfig/nftables.conf",
+                        raw_sections
+                            .get("nftables-sysconfig")
+                            .and_then(|value| value.as_str())
+                            .unwrap_or("")
+                            .to_string(),
+                    )}
+                </div>
+            </details>
+        }
+        .into_any(),
+    )
+}
+
+fn render_iptables_details(
+    label: &'static str,
+    value: &Value,
+    raw_key: &'static str,
+) -> Option<AnyView> {
+    if !json_bool(value, "detected") {
+        return None;
+    }
+
+    let rules = json_array(value, "rules");
+    let modules = json_array(value, "modules");
+    let has_rules = !rules.is_empty();
+    let summary = if has_rules {
+        format!("{} table(s) with rules", rules.len())
+    } else if !modules.is_empty() {
+        "modules not loaded".to_string()
+    } else {
+        "no rules".to_string()
+    };
+
+    Some(
+        view! {
+            <details class="content-details" open=has_rules>
+                <summary>
+                    {label}
+                    " "
+                    <span class=if has_rules { "text-info" } else { "text-muted" }>
+                        {format!("({summary})")}
+                    </span>
+                </summary>
+                <div class="section-body">
+                    {rules
+                        .into_iter()
+                        .map(|rule| {
+                            let heading = json_str(&rule, "heading");
+                            let raw = json_str(&rule, "raw");
+                            view! {
+                                <div class="subsection">
+                                    <p><strong>{if heading.is_empty() { label.to_string() } else { heading }}</strong></p>
+                                    <pre class="json-dump">{raw}</pre>
+                                </div>
+                            }
+                        })
+                        .collect::<Vec<_>>()}
+                    {modules
+                        .into_iter()
+                        .map(|module| {
+                            let module_name = json_str(&module, "module");
+                            let note = json_str(&module, "note");
+                            view! { <p class="text-muted">{format!("{}: {}", module_name, note)}</p> }
+                        })
+                        .collect::<Vec<_>>()}
+                    {(!raw_key.is_empty())
+                        .then(|| render_pre_block(&format!("Raw /etc/sysconfig/{raw_key}"), json_str(value, "config")))}
+                </div>
+            </details>
+        }
+        .into_any(),
+    )
+}
+
+fn render_ebtables_details(ebtables: &Value) -> Option<AnyView> {
+    if !json_bool(ebtables, "detected") {
+        return None;
+    }
+
+    Some(
+        view! {
+            <details class="content-details">
+                <summary>
+                    "ebtables "
+                    <span class="text-muted">"(config present)"</span>
+                </summary>
+                <div class="section-body">
+                    {render_pre_block("Config", json_str(ebtables, "config"))}
+                </div>
+            </details>
+        }
+        .into_any(),
+    )
+}
+
+fn render_remaining_raw_sections(raw_sections: &Value) -> Option<AnyView> {
+    let sections = raw_sections
+        .as_object()
+        .map(|items| {
+            items
+                .iter()
+                .filter(|(key, _)| {
+                    ![
+                        "firewalld.conf",
+                        "iptables-config",
+                        "ebtables-config",
+                        "nftables-sysconfig",
+                    ]
+                    .contains(&key.as_str())
+                })
+                .map(|(key, value)| (key.clone(), value.as_str().unwrap_or("").to_string()))
+                .filter(|(_, value)| !value.trim().is_empty())
+                .collect::<Vec<_>>()
+        })
+        .unwrap_or_default();
+
+    if sections.is_empty() {
+        return None;
+    }
+
+    Some(
+        view! {
+            <details class="content-details">
+                <summary>{format!("All Raw Sections ({})", sections.len())}</summary>
+                <div class="section-body">
+                    {sections
+                        .into_iter()
+                        .map(|(key, value)| view! {
+                            <details class="content-details">
+                                <summary>{key}</summary>
+                                <pre class="json-dump">{value}</pre>
+                            </details>
+                        })
+                        .collect::<Vec<_>>()}
+                </div>
+            </details>
+        }
+        .into_any(),
+    )
+}
+
+fn render_pre_block(title: &str, content: String) -> Option<AnyView> {
+    if content.trim().is_empty() {
+        return None;
+    }
+
+    Some(
+        view! {
+            <details class="content-details">
+                <summary>{title.to_string()}</summary>
+                <pre class="json-dump">{content}</pre>
+            </details>
+        }
+        .into_any(),
+    )
+}
+
+fn interface_values(interfaces: &Value) -> Vec<Value> {
+    interfaces
+        .get("interfaces")
+        .and_then(|value| value.as_object())
+        .map(|items| items.values().cloned().collect::<Vec<_>>())
+        .unwrap_or_default()
+}
+
+fn format_ip_entries(value: &Value, skip_link_local: bool) -> String {
+    let entries = value
+        .as_array()
+        .map(|items| {
+            items
+                .iter()
+                .filter_map(|item| {
+                    let address = json_str(item, "address");
+                    if address.is_empty() || (skip_link_local && address.starts_with("fe80:")) {
+                        return None;
+                    }
+                    let prefix = item
+                        .get("prefix")
+                        .map(value_to_inline_string)
+                        .unwrap_or_default();
+                    Some(if prefix.is_empty() {
+                        address
+                    } else {
+                        format!("{address}/{prefix}")
+                    })
+                })
+                .collect::<Vec<_>>()
+        })
+        .unwrap_or_default();
+
+    if entries.is_empty() {
+        "-".to_string()
+    } else {
+        entries.join(", ")
+    }
+}
+
+fn display_value(value: &Value, key: &str) -> String {
+    value
+        .get(key)
+        .map(value_to_inline_string)
+        .filter(|item| !item.is_empty())
+        .unwrap_or_else(|| "-".to_string())
+}
+
+fn display_bootproto(iface: &Value) -> String {
+    match json_str(iface, "bootproto").to_ascii_lowercase().as_str() {
+        "dhcp" | "dhcp4" => "DHCP".to_string(),
+        "static" | "none" => "Static".to_string(),
+        "" => "-".to_string(),
+        other => other.to_string(),
+    }
+}
+
+fn display_accel_net(iface: &Value, all_ifaces: &[Value]) -> String {
+    let driver = json_str(iface, "driver");
+    if json_bool(iface, "accelNet") {
+        if driver == "mana" {
+            "MANA".to_string()
+        } else {
+            "Yes".to_string()
+        }
+    } else if driver == "hv_netvsc" {
+        let name = json_str(iface, "name");
+        if let Some(linked) = all_ifaces.iter().find(|candidate| {
+            json_bool(candidate, "accelNet") && json_str(candidate, "master") == name
+        }) {
+            format!("Yes (via {})", json_str(linked, "name"))
+        } else {
+            "No".to_string()
+        }
+    } else {
+        "-".to_string()
+    }
+}
+
+fn collect_cloud_init_sources(ifaces: &[Value]) -> Vec<String> {
+    let mut entries = Vec::new();
+
+    for iface in ifaces {
+        let iface_name = json_str(iface, "name");
+        for key in ["ipv4", "ipv6"] {
+            if let Some(items) = iface.get(key).and_then(|value| value.as_array()) {
+                for item in items {
+                    if json_str(item, "source") == "cloud-init" {
+                        let address = json_str(item, "address");
+                        let source_file = json_str(item, "sourceFile");
+                        let line = item
+                            .get("lineNumber")
+                            .map(value_to_inline_string)
+                            .unwrap_or_default();
+                        if !address.is_empty() {
+                            if source_file.is_empty() {
+                                entries.push(format!("{} {}", iface_name, address));
+                            } else if line.is_empty() {
+                                entries
+                                    .push(format!("{} {} ← {}", iface_name, address, source_file));
+                            } else {
+                                entries.push(format!(
+                                    "{} {} ← {}:{}",
+                                    iface_name, address, source_file, line
+                                ));
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    entries
+}
+
+fn render_raw_network_sections(raw: &Value) -> Option<AnyView> {
+    let sections = raw
+        .as_object()
+        .map(|items| {
+            items
+                .iter()
+                .map(|(key, value)| (key.clone(), value.as_str().unwrap_or("").to_string()))
+                .filter(|(_, value)| !value.trim().is_empty())
+                .collect::<Vec<_>>()
+        })
+        .unwrap_or_default();
+
+    if sections.is_empty() {
+        return None;
+    }
+
+    Some(
+        view! {
+            <details class="content-details">
+                <summary>{format!("Raw Network Configuration ({})", sections.len())}</summary>
+                <div class="section-body">
+                    {sections
+                        .into_iter()
+                        .map(|(key, value)| view! {
+                            <details class="content-details">
+                                <summary>{key}</summary>
+                                <pre class="json-dump">{value}</pre>
+                            </details>
+                        })
+                        .collect::<Vec<_>>()}
+                </div>
+            </details>
+        }
+        .into_any(),
+    )
+}
+
+fn string_array_from_key(value: &Value, key: &str) -> Vec<String> {
+    value
+        .get(key)
+        .and_then(|items| items.as_array())
+        .map(|items| {
+            items
+                .iter()
+                .filter_map(|item| item.as_str().map(|entry| entry.to_string()))
+                .collect::<Vec<_>>()
+        })
+        .unwrap_or_default()
+}
+
+fn value_to_inline_string(value: &Value) -> String {
+    if let Some(text) = value.as_str() {
+        text.to_string()
+    } else if let Some(number) = value.as_i64() {
+        number.to_string()
+    } else if let Some(number) = value.as_u64() {
+        number.to_string()
+    } else if let Some(number) = value.as_f64() {
+        if number.fract() == 0.0 {
+            (number as i64).to_string()
+        } else {
+            format!("{number:.2}")
+        }
+    } else if let Some(boolean) = value.as_bool() {
+        if boolean {
+            "true".to_string()
+        } else {
+            "false".to_string()
+        }
+    } else {
+        "".to_string()
+    }
+}
diff --git a/rca-tool/web-leptos/src/components/sections/oom.rs b/rca-tool/web-leptos/src/components/sections/oom.rs
new file mode 100644
index 0000000..fdc0744
--- /dev/null
+++ b/rca-tool/web-leptos/src/components/sections/oom.rs
@@ -0,0 +1,179 @@
+use leptos::prelude::*;
+use serde_json::Value;
+
+use super::helpers::*;
+
+/// Format an optional byte count into a human-readable string, or `—`.
+fn opt_bytes(row: &Value, key: &str) -> String {
+    row.get(key)
+        .and_then(|v| v.as_f64())
+        .map(format_bytes)
+        .unwrap_or_else(|| "—".to_string())
+}
+
+/// Section – SAP HANA out-of-memory events (from indexserver/nameserver traces).
+#[component]
+pub fn OomSection(data: Value) -> impl IntoView {
+    let oom = data.get("hanaOom").cloned().unwrap_or(Value::Null);
+
+    if !json_bool(&oom, "found") {
+        return view! {}.into_any();
+    }
+
+    let warnings = json_array(&oom, "warnings");
+    // OOM warnings are always errors, but keep the same severity-aware styling.
+    let error_count = warnings
+        .iter()
+        .filter(|w| json_str(w, "severity") == "error")
+        .count();
+    let warning_count = warnings.len() - error_count;
+    let class = if error_count > 0 {
+        "danger-block"
+    } else if warning_count > 0 {
+        "warning-block"
+    } else {
+        "content-details"
+    };
+
+    view! {
+        <Section title="SAP HANA Out-of-Memory" class=class>
+            {render_oom_summary(&oom)}
+            {render_oom_warnings(&warnings)}
+            {render_oom_table(&oom)}
+        </Section>
+    }
+    .into_any()
+}
+
+fn render_oom_summary(oom: &Value) -> AnyView {
+    let count = json_u64(oom, "count");
+    let last = json_str(oom, "lastOom");
+
+    view! {
+        <table class="kv-table">
+            <tbody>
+                <KvRow label="Out-of-memory events" value=count.to_string()/>
+                <KvRow
+                    label="Last OOM"
+                    value=if last.is_empty() { "—".to_string() } else { last }
+                />
+            </tbody>
+        </table>
+    }
+    .into_any()
+}
+
+fn render_oom_warnings(warnings: &[Value]) -> Option<AnyView> {
+    if warnings.is_empty() {
+        return None;
+    }
+
+    Some(
+        warnings
+            .iter()
+            .map(|warning| {
+                let severity = json_str(warning, "severity");
+                let message = json_str(warning, "message");
+                let details = json_str(warning, "details");
+                let recommendation = json_str(warning, "recommendation");
+                let class = if severity == "error" {
+                    "danger-block"
+                } else if severity == "warning" {
+                    "warning-block"
+                } else {
+                    "info-block"
+                };
+                let heading = if severity == "error" {
+                    "Error"
+                } else if severity == "warning" {
+                    "Warning"
+                } else {
+                    "Info"
+                };
+                view! {
+                    <div class=class>
+                        <p>
+                            <strong>{format!("{heading}:")}</strong>
+                            " "
+                            {message}
+                        </p>
+                        {(!details.is_empty())
+                            .then(|| view! { <p><code>{details}</code></p> })}
+                        {(!recommendation.is_empty())
+                            .then(|| view! { <p>{recommendation}</p> })}
+                    </div>
+                }
+            })
+            .collect::<Vec<_>>()
+            .into_any(),
+    )
+}
+
+fn render_oom_table(oom: &Value) -> Option<AnyView> {
+    let events = json_array(oom, "events");
+    if events.is_empty() {
+        return None;
+    }
+
+    // Cap the rendered rows to keep the DOM light on multi-day traces.
+    const MAX_ROWS: usize = 200;
+    let total = events.len();
+    let truncated = total > MAX_ROWS;
+
+    let opt_str = |row: &Value, key: &str| -> String {
+        let s = json_str(row, key);
+        if s.is_empty() { "—".to_string() } else { s }
+    };
+
+    let rows = events
+        .iter()
+        .take(MAX_ROWS)
+        .map(|row| {
+            let timestamp = json_str(row, "timestamp");
+            let mem_type = opt_str(row, "memoryType");
+            let host = opt_str(row, "host");
+            let executable = opt_str(row, "executable");
+            let failed = opt_bytes(row, "failedAllocBytes");
+            let gal = opt_bytes(row, "globalAllocationLimitBytes");
+            view! {
+                <tr>
+                    <td>{timestamp}</td>
+                    <td>{mem_type}</td>
+                    <td>{host}</td>
+                    <td>{executable}</td>
+                    <td>{failed}</td>
+                    <td>{gal}</td>
+                </tr>
+            }
+        })
+        .collect::<Vec<_>>();
+
+    Some(
+        view! {
+            <details class="content-details">
+                <summary>
+                    {format!("Out-of-memory events ({total})")}
+                </summary>
+                <table class="data-table">
+                    <thead>
+                        <tr>
+                            <th>"Timestamp"</th>
+                            <th>"Memory type"</th>
+                            <th>"Host"</th>
+                            <th>"Executable"</th>
+                            <th>"Failed allocation"</th>
+                            <th>"Global allocation limit"</th>
+                        </tr>
+                    </thead>
+                    <tbody>{rows}</tbody>
+                </table>
+                {truncated.then(|| view! {
+                    <p class="muted">
+                        {format!("Showing first {MAX_ROWS} of {total} out-of-memory events.")}
+                    </p>
+                })}
+            </details>
+        }
+        .into_any(),
+    )
+}
diff --git a/rca-tool/web-leptos/src/components/sections/os_tuning.rs b/rca-tool/web-leptos/src/components/sections/os_tuning.rs
new file mode 100644
index 0000000..1a01349
--- /dev/null
+++ b/rca-tool/web-leptos/src/components/sections/os_tuning.rs
@@ -0,0 +1,196 @@
+use leptos::prelude::*;
+use serde_json::Value;
+
+use super::helpers::*;
+
+/// OS tuning and security checks ported from the SAP-on-Azure QualityCheck
+/// utility: tuned profile, SELinux mode, swap space, and the fstrim timer.
+#[component]
+pub fn OsTuningSection(data: Value) -> impl IntoView {
+    let tuned = data.get("tunedProfile").cloned().unwrap_or(Value::Null);
+    let selinux = data.get("selinux").cloned().unwrap_or(Value::Null);
+    let swap = data.get("swapSpace").cloned().unwrap_or(Value::Null);
+    let fstrim = data.get("fstrim").cloned().unwrap_or(Value::Null);
+
+    let has_tuned = json_bool(&tuned, "found");
+    let has_selinux = json_bool(&selinux, "found");
+    let has_swap = json_bool(&swap, "found");
+    let has_fstrim = json_bool(&fstrim, "found");
+
+    if !has_tuned && !has_selinux && !has_swap && !has_fstrim {
+        return view! {}.into_any();
+    }
+
+    let has_warnings = !json_array(&tuned, "warnings").is_empty()
+        || !json_array(&selinux, "warnings").is_empty()
+        || !json_array(&swap, "warnings").is_empty()
+        || !json_array(&fstrim, "warnings").is_empty();
+
+    let section_class = if has_warnings {
+        "warning-block"
+    } else {
+        "content-details"
+    };
+
+    view! {
+        <Section title="OS Tuning and Security" class=section_class open=true>
+            {has_tuned.then(|| render_tuned_profile(&tuned))}
+            {has_selinux.then(|| render_selinux(&selinux))}
+            {has_swap.then(|| render_swap(&swap))}
+            {has_fstrim.then(|| render_fstrim(&fstrim))}
+        </Section>
+    }
+    .into_any()
+}
+
+/// Render a list of warning / recommendation objects (`UnixWarning` shape).
+fn render_findings(title: &str, block_class: &str, items: Vec<Value>) -> Option<AnyView> {
+    if items.is_empty() {
+        return None;
+    }
+    let title = title.to_string();
+    let block_class = block_class.to_string();
+    Some(
+        view! {
+            <div class=block_class>
+                <p><strong>{title}</strong></p>
+                <ul class="disk-list">
+                    {items
+                        .iter()
+                        .map(|item| {
+                            let message = json_str(item, "message");
+                            let recommendation = json_str(item, "recommendation");
+                            let doc = json_str(item, "documentationUrl");
+                            view! {
+                                <li>
+                                    {message}
+                                    {(!recommendation.is_empty()).then(|| view! {
+                                        <div><small>{recommendation}</small></div>
+                                    })}
+                                    {(!doc.is_empty()).then(|| view! {
+                                        <div>
+                                            <a
+                                                href=doc.clone()
+                                                target="_blank"
+                                                rel="noopener noreferrer"
+                                                class="text-info"
+                                            >
+                                                "View Documentation"
+                                            </a>
+                                        </div>
+                                    })}
+                                </li>
+                            }
+                        })
+                        .collect::<Vec<_>>()}
+                </ul>
+            </div>
+        }
+        .into_any(),
+    )
+}
+
+fn dash_if_empty(value: String) -> String {
+    if value.trim().is_empty() {
+        "-".to_string()
+    } else {
+        value
+    }
+}
+
+fn render_tuned_profile(tuned: &Value) -> AnyView {
+    let active = dash_if_empty(json_str(tuned, "activeProfile"));
+    let warnings = json_array(tuned, "warnings");
+    let recommendations = json_array(tuned, "recommendations");
+    view! {
+        <div class="subsection">
+            <p class="subsection-title">"Tuned Profile:"</p>
+            <KvTable>
+                <KvRow label="Active profile" value=active/>
+            </KvTable>
+            {render_findings(
+                &format!("Tuned Warnings ({})", warnings.len()),
+                "warning-block",
+                warnings,
+            )}
+            {render_findings("Recommendations", "info-block", recommendations)}
+        </div>
+    }
+    .into_any()
+}
+
+fn render_selinux(selinux: &Value) -> AnyView {
+    let config_mode = dash_if_empty(json_str(selinux, "configMode"));
+    let current_mode = dash_if_empty(json_str(selinux, "currentMode"));
+    let warnings = json_array(selinux, "warnings");
+    let recommendations = json_array(selinux, "recommendations");
+    view! {
+        <div class="subsection">
+            <p class="subsection-title">"SELinux:"</p>
+            <KvTable>
+                <KvRow label="Current mode" value=current_mode/>
+                <KvRow label="Mode from config" value=config_mode/>
+            </KvTable>
+            {render_findings(
+                &format!("SELinux Warnings ({})", warnings.len()),
+                "warning-block",
+                warnings,
+            )}
+            {render_findings("Recommendations", "info-block", recommendations)}
+        </div>
+    }
+    .into_any()
+}
+
+fn render_swap(swap: &Value) -> AnyView {
+    let total_kb = swap.get("swapTotalKb").and_then(|v| v.as_i64());
+    let free_kb = swap.get("swapFreeKb").and_then(|v| v.as_i64());
+    let warnings = json_array(swap, "warnings");
+    let total_display = match total_kb {
+        Some(kb) if kb >= 0 => format_bytes((kb * 1024) as f64),
+        _ => "-".to_string(),
+    };
+    let free_display = match free_kb {
+        Some(kb) if kb >= 0 => format_bytes((kb * 1024) as f64),
+        _ => "-".to_string(),
+    };
+    view! {
+        <div class="subsection">
+            <p class="subsection-title">"Swap Space:"</p>
+            <KvTable>
+                <KvRow label="Swap total" value=total_display/>
+                <KvRow label="Swap free" value=free_display/>
+            </KvTable>
+            {render_findings(
+                &format!("Swap Warnings ({})", warnings.len()),
+                "warning-block",
+                warnings,
+            )}
+        </div>
+    }
+    .into_any()
+}
+
+fn render_fstrim(fstrim: &Value) -> AnyView {
+    let state = dash_if_empty(json_str(fstrim, "timerState"));
+    let enabled = json_bool(fstrim, "timerEnabled");
+    let warnings = json_array(fstrim, "warnings");
+    view! {
+        <div class="subsection">
+            <p class="subsection-title">"fstrim Timer:"</p>
+            <KvTable>
+                <KvRow label="Timer state" value=state/>
+                <KvRow
+                    label="Periodic trim enabled"
+                    value=if enabled { "Yes".to_string() } else { "No".to_string() }
+                />
+            </KvTable>
+            {render_findings(
+                &format!("fstrim Warnings ({})", warnings.len()),
+                "warning-block",
+                warnings,
+            )}
+        </div>
+    }
+    .into_any()
+}
diff --git a/rca-tool/web-leptos/src/components/sections/services.rs b/rca-tool/web-leptos/src/components/sections/services.rs
new file mode 100644
index 0000000..db532af
--- /dev/null
+++ b/rca-tool/web-leptos/src/components/sections/services.rs
@@ -0,0 +1,621 @@
+use leptos::prelude::*;
+use serde_json::Value;
+
+use super::helpers::*;
+
+/// Section 12 – Azure Services / Antivirus.
+#[component]
+pub fn ServicesAntivirusSection(data: Value) -> impl IntoView {
+    let antivirus = data.get("antivirus").cloned().unwrap_or(Value::Null);
+    let involflt_version = data.get("involfltVersion").cloned().unwrap_or(Value::Null);
+    let involflt_kernel_version = data
+        .get("involfltKernelVersion")
+        .cloned()
+        .unwrap_or(Value::Null);
+
+    let sap_detected = detect_sap_workload(&data);
+    let has_antivirus = json_bool(&antivirus, "anyDetected")
+        || json_bool(&involflt_version, "found")
+        || json_bool(&involflt_kernel_version, "found");
+    let has_exceptions =
+        json_bool(&antivirus, "allHaveExceptions") && has_antivirus && sap_detected;
+
+    let (block_class, status_text) = if !has_antivirus {
+        ("info-block", "Azure Services or Antivirus".to_string())
+    } else if !sap_detected {
+        (
+            "info-block",
+            "Azure Services or Antivirus Detected".to_string(),
+        )
+    } else if has_exceptions {
+        (
+            "success-block",
+            "[OK] Azure Services or Antivirus Detected with SAP Exceptions".to_string(),
+        )
+    } else {
+        (
+            "danger-block",
+            "[WARNING] Antivirus Detected - SAP Exceptions Required".to_string(),
+        )
+    };
+
+    let falcon = antivirus
+        .get("falconSensor")
+        .cloned()
+        .unwrap_or(Value::Null);
+    let defender = antivirus.get("msDefender").cloned().unwrap_or(Value::Null);
+    let illumio = antivirus.get("illumio").cloned().unwrap_or(Value::Null);
+    let trend_micro = antivirus.get("trendMicro").cloned().unwrap_or(Value::Null);
+    let guardicore = antivirus
+        .get("guardicoreAgent")
+        .cloned()
+        .unwrap_or(Value::Null);
+    let puppet = antivirus.get("puppetAgent").cloned().unwrap_or(Value::Null);
+    let chef = antivirus.get("chefClient").cloned().unwrap_or(Value::Null);
+    let asr = antivirus
+        .get("azureSiteRecovery")
+        .cloned()
+        .unwrap_or(Value::Null);
+
+    view! {
+        <details class=block_class>
+            <summary>{status_text}</summary>
+
+            <div class="section-body">
+                {(!has_antivirus).then(|| view! {
+                    <>
+                        <p class="text-muted">
+                            <em>
+                                "No Azure services, antivirus or security software was detected in the analyzed files."
+                            </em>
+                        </p>
+                        <p class="text-muted">
+                            <em>
+                                "Checked for: Azure Site Recovery, CrowdStrike Falcon Sensor, Microsoft Defender for Endpoint (mdatp), Illumio, Trend Micro Deep Security, Guardicore Agent, Puppet Agent, Chef Client"
+                            </em>
+                        </p>
+                    </>
+                })}
+
+                {render_falcon_section(&falcon, sap_detected)}
+                {render_defender_section(&defender, sap_detected)}
+                {render_basic_detection_section(
+                    &illumio,
+                    "Illumio",
+                    sap_detected,
+                    "Please verify that SAP paths are excluded in Illumio policy configuration: /usr/sap, /hana/shared, /hana/data, /hana/log, /sapmnt",
+                )}
+                {render_basic_detection_section(
+                    &trend_micro,
+                    "Trend Micro Deep Security",
+                    sap_detected,
+                    "Please verify that SAP paths are excluded in Deep Security Manager: /usr/sap, /hana/shared, /hana/data, /hana/log, /sapmnt",
+                )}
+                {render_detected_with_source(
+                    &guardicore,
+                    "Guardicore Agent",
+                    "warning-block",
+                    "text-warning",
+                    sap_detected,
+                    Some("Please verify that SAP paths are excluded in Guardicore policy configuration: /usr/sap, /hana/shared, /hana/data, /hana/log, /sapmnt"),
+                )}
+                {render_detected_with_source(
+                    &puppet,
+                    "Puppet Agent",
+                    "info-block",
+                    "text-info",
+                    false,
+                    None,
+                )}
+                {render_detected_with_source(
+                    &chef,
+                    "Chef Client",
+                    "info-block",
+                    "text-info",
+                    false,
+                    None,
+                )}
+                {render_asr_section(&asr, &involflt_version, &involflt_kernel_version)}
+
+                {(sap_detected && has_antivirus).then(|| view! {
+                    <div class="warning-block">
+                        <p class="text-warning">
+                            <strong>"Important:"</strong>
+                            " When running SAP on Azure, antivirus software must exclude SAP directories to prevent performance issues and potential data corruption."
+                        </p>
+                        <p class="text-warning">
+                            "Recommended exclusions: /usr/sap, /hana/shared, /hana/data, /hana/log, /sapmnt, /usr/sap/*/SYS/exe"
+                        </p>
+                    </div>
+                })}
+            </div>
+        </details>
+    }
+    .into_any()
+}
+
+fn render_falcon_section(data: &Value, sap_detected: bool) -> Option<AnyView> {
+    if !json_bool(data, "detected") {
+        return None;
+    }
+
+    let version = json_str(data, "version");
+    let running = json_bool(data, "runningProcess");
+    let message = json_str(data, "message");
+    let has_exclusions = json_bool(data, "sapExceptions");
+    let exclusions = string_array(data, "exclusionPaths");
+    let text_class = if sap_detected && !has_exclusions {
+        "text-danger"
+    } else {
+        "text-success"
+    };
+
+    Some(
+        view! {
+            <div class="subsection">
+                <p class=text_class><strong>"CrowdStrike Falcon Sensor"</strong></p>
+                {(!version.is_empty()).then(|| view! {
+                    <p>
+                        <strong>"Version:"</strong>
+                        " "
+                        <code>{version.clone()}</code>
+                    </p>
+                })}
+                {running.then(|| view! {
+                    <p><span class="badge badge-success">"Running"</span></p>
+                })}
+
+                {if sap_detected {
+                    if has_exclusions && !exclusions.is_empty() {
+                        view! {
+                            <div class="success-block">
+                                <p class="text-success"><strong>"SAP Exclusions Configured:"</strong></p>
+                                <ul>
+                                    {exclusions
+                                        .into_iter()
+                                        .map(|path| view! { <li><code>{path}</code></li> })
+                                        .collect::<Vec<_>>()}
+                                </ul>
+                            </div>
+                        }
+                        .into_any()
+                    } else {
+                        view! {
+                            <div class="danger-block">
+                                <p class="text-danger"><strong>"[!] SAP exclusions not detected."</strong></p>
+                                <p class="text-muted">
+                                    "Required SAP paths should be excluded: /usr/sap, /hana/shared, /hana/data, /hana/log, /sapmnt"
+                                </p>
+                                <p>
+                                    <a
+                                        href="https://learn.microsoft.com/en-us/azure/sap/workloads/high-availability-guide-suse-pacemaker"
+                                        target="_blank"
+                                        rel="noopener noreferrer"
+                                        class="text-info"
+                                    >
+                                        "View SAP on Azure Documentation"
+                                    </a>
+                                </p>
+                            </div>
+                        }
+                        .into_any()
+                    }
+                } else {
+                    view! {
+                        <p class="text-muted">
+                            {format!(
+                                "Detected CrowdStrike Falcon Sensor{}.",
+                                if version.is_empty() {
+                                    "".to_string()
+                                } else {
+                                    format!(" - version {version}")
+                                },
+                            )}
+                        </p>
+                    }
+                    .into_any()
+                }}
+
+                {(!message.is_empty()).then(|| view! {
+                    <p class="text-muted"><em>{message}</em></p>
+                })}
+            </div>
+        }
+        .into_any(),
+    )
+}
+
+fn render_defender_section(data: &Value, sap_detected: bool) -> Option<AnyView> {
+    if !json_bool(data, "detected") {
+        return None;
+    }
+
+    let version = json_str(data, "version");
+    let running = json_bool(data, "runningProcess");
+    let message = json_str(data, "message");
+    let has_exclusions = json_bool(data, "sapExceptions");
+    let exclusions = string_array(data, "exclusionPaths");
+    let text_class = if sap_detected && !has_exclusions {
+        "text-warning"
+    } else {
+        "text-success"
+    };
+
+    Some(
+        view! {
+            <div class="subsection">
+                <p class=text_class><strong>"Microsoft Defender for Endpoint"</strong></p>
+                {(!version.is_empty()).then(|| view! {
+                    <p>
+                        <strong>"Version:"</strong>
+                        " "
+                        <code>{version.clone()}</code>
+                    </p>
+                })}
+                {running.then(|| view! {
+                    <p><span class="badge badge-success">"Running"</span></p>
+                })}
+
+                {if sap_detected {
+                    if has_exclusions && !exclusions.is_empty() {
+                        view! {
+                            <div class="success-block">
+                                <p class="text-success"><strong>"SAP Exclusions Configured:"</strong></p>
+                                <ul>
+                                    {exclusions
+                                        .into_iter()
+                                        .map(|path| view! { <li><code>{path}</code></li> })
+                                        .collect::<Vec<_>>()}
+                                </ul>
+                            </div>
+                        }
+                        .into_any()
+                    } else {
+                        view! {
+                            <div class="warning-block">
+                                <p class="text-warning"><strong>"[!] SAP exclusions need verification"</strong></p>
+                                <p class="text-muted">
+                                    "The exclusion configuration file was not found in the analyzed files. Please verify that the following SAP paths are excluded: /usr/sap, /hana/shared, /hana/data, /hana/log, /sapmnt"
+                                </p>
+                                <p>
+                                    <a
+                                        href="https://learn.microsoft.com/en-us/defender-endpoint/mde-linux-deployment-on-sap"
+                                        target="_blank"
+                                        rel="noopener noreferrer"
+                                        class="text-info"
+                                    >
+                                        "Configure Defender Exclusions on Linux"
+                                    </a>
+                                </p>
+                            </div>
+                        }
+                        .into_any()
+                    }
+                } else {
+                    view! {
+                        <p class="text-muted">
+                            {format!(
+                                "Detected Microsoft Defender{}.",
+                                if version.is_empty() {
+                                    "".to_string()
+                                } else {
+                                    format!(" - version {version}")
+                                },
+                            )}
+                        </p>
+                    }
+                    .into_any()
+                }}
+
+                {(!message.is_empty()).then(|| view! {
+                    <p class="text-muted"><em>{message}</em></p>
+                })}
+            </div>
+        }
+        .into_any(),
+    )
+}
+
+fn render_basic_detection_section(
+    data: &Value,
+    label: &'static str,
+    sap_detected: bool,
+    sap_guidance: &'static str,
+) -> Option<AnyView> {
+    if !json_bool(data, "detected") {
+        return None;
+    }
+
+    let message = json_str(data, "message");
+
+    Some(
+        view! {
+            <div class="subsection">
+                <p class="text-warning"><strong>{label}</strong></p>
+                {sap_detected.then(|| view! {
+                    <div class="warning-block">
+                        <p class="text-warning"><strong>"[!] SAP exclusions need verification"</strong></p>
+                        <p class="text-muted">{sap_guidance}</p>
+                    </div>
+                })}
+                {(!sap_detected).then(|| view! {
+                    <p class="text-muted">{format!("Detected {label}.")}</p>
+                })}
+                {(!message.is_empty()).then(|| view! {
+                    <p class="text-muted"><em>{message}</em></p>
+                })}
+            </div>
+        }
+        .into_any(),
+    )
+}
+
+fn render_detected_with_source(
+    data: &Value,
+    label: &'static str,
+    block_class: &'static str,
+    text_class: &'static str,
+    sap_detected: bool,
+    sap_guidance: Option<&'static str>,
+) -> Option<AnyView> {
+    if !json_bool(data, "detected") {
+        return None;
+    }
+
+    let message = json_str(data, "message");
+    let detection_file = json_str(data, "detectionFile");
+    let detection_line = data
+        .get("detectionLine")
+        .and_then(|value| value.as_i64())
+        .map(|value| value.to_string())
+        .unwrap_or_default();
+    let detection_content = json_str(data, "detectionContent");
+
+    Some(
+        view! {
+            <div class=block_class>
+                <p class=text_class><strong>{label}</strong></p>
+                {(!message.is_empty()).then(|| view! {
+                    <p>{message.clone()}</p>
+                })}
+                {(sap_detected && sap_guidance.is_some()).then(|| view! {
+                    <p class="text-muted">{sap_guidance.unwrap_or_default()}</p>
+                })}
+                {(!detection_file.is_empty()).then(|| view! {
+                    <p class="text-muted">
+                        <strong>"Detected in:"</strong>
+                        " "
+                        <code>
+                            {if detection_line.is_empty() {
+                                detection_file.clone()
+                            } else {
+                                format!("{} at line {}", detection_file, detection_line)
+                            }}
+                        </code>
+                    </p>
+                })}
+                {(!detection_content.is_empty()).then(|| view! {
+                    <p class="text-muted"><code>{detection_content}</code></p>
+                })}
+            </div>
+        }
+        .into_any(),
+    )
+}
+
+fn render_asr_section(
+    asr: &Value,
+    involflt_version: &Value,
+    involflt_kernel_version: &Value,
+) -> Option<AnyView> {
+    let has_asr = json_bool(asr, "detected");
+    let has_involflt =
+        json_bool(involflt_version, "found") || json_bool(involflt_kernel_version, "found");
+
+    if !has_asr && !has_involflt {
+        return None;
+    }
+
+    let message = json_str(asr, "message");
+    let detection_file = json_str(asr, "detectionFile");
+    let detection_line = asr
+        .get("detectionLine")
+        .and_then(|value| value.as_i64())
+        .map(|value| value.to_string())
+        .unwrap_or_default();
+    let detection_content = json_str(asr, "detectionContent");
+    let runtime_version = json_str(involflt_kernel_version, "version");
+    let build_version = json_str(involflt_version, "version");
+    let build_date = json_str(involflt_version, "buildDate");
+    let filename = json_str(involflt_version, "filename");
+    let loaded = json_bool(involflt_version, "loaded");
+
+    Some(
+        view! {
+            <div class="subsection">
+                <p class="text-info"><strong>"Azure Site Recovery"</strong></p>
+                {(has_asr && !message.is_empty()).then(|| view! {
+                    <p>{message}</p>
+                })}
+                {(has_asr && !detection_file.is_empty()).then(|| view! {
+                    <p class="text-muted">
+                        <strong>"Detected in:"</strong>
+                        " "
+                        <code>
+                            {if detection_line.is_empty() {
+                                detection_file.clone()
+                            } else {
+                                format!("{} at line {}", detection_file, detection_line)
+                            }}
+                        </code>
+                    </p>
+                })}
+                {(has_asr && !detection_content.is_empty()).then(|| view! {
+                    <p class="text-muted"><code>{detection_content}</code></p>
+                })}
+
+                {has_involflt.then(|| view! {
+                    <div class="info-block">
+                        <p><strong>"InMage Filter Driver (involflt):"</strong></p>
+                        {json_bool(involflt_version, "found").then(|| view! {
+                            <p>
+                                <span class=if loaded {
+                                    "badge badge-success"
+                                } else {
+                                    "badge badge-warning"
+                                }>
+                                    {if loaded { "Loaded" } else { "Not Loaded" }}
+                                </span>
+                            </p>
+                        })}
+                        {(!runtime_version.is_empty()).then(|| view! {
+                            <p>
+                                <strong>"Runtime Version:"</strong>
+                                " "
+                                <code>{runtime_version}</code>
+                            </p>
+                        })}
+                        {(!build_version.is_empty()).then(|| view! {
+                            <p>
+                                <strong>"Build Version:"</strong>
+                                " "
+                                <code>{build_version}</code>
+                            </p>
+                        })}
+                        {(!build_date.is_empty()).then(|| view! {
+                            <p>
+                                <strong>"Build Date:"</strong>
+                                " "
+                                <code>{build_date}</code>
+                            </p>
+                        })}
+                        {(!filename.is_empty()).then(|| view! {
+                            <p class="text-muted">
+                                <strong>"Location:"</strong>
+                                " "
+                                <code>{filename}</code>
+                            </p>
+                        })}
+                    </div>
+                })}
+            </div>
+        }
+        .into_any(),
+    )
+}
+
+fn detect_sap_workload(data: &Value) -> bool {
+    let basic_environment = data.get("basicEnvironment").cloned().unwrap_or(Value::Null);
+
+    if json_bool(&basic_environment, "sapProductDetected")
+        || json_str(&basic_environment, "product")
+            .to_ascii_lowercase()
+            .contains("sap")
+        || json_str(&basic_environment, "prettyName")
+            .to_ascii_lowercase()
+            .contains("sap")
+        || json_str(&basic_environment, "name")
+            .to_ascii_lowercase()
+            .contains("sap")
+        || json_bool(
+            &data
+                .get("sapInstanceConfig")
+                .cloned()
+                .unwrap_or(Value::Null),
+            "found",
+        )
+    {
+        return true;
+    }
+
+    let path_match = |path: &str| {
+        let lower = path.to_ascii_lowercase();
+        lower.contains("usr/sap")
+            || lower.contains("sapmnt")
+            || lower.contains("hana/shared")
+            || lower.contains("hana/data")
+            || lower.contains("hana/log")
+            || lower.contains("sapstartsrv")
+    };
+
+    if json_array(data, "directories")
+        .iter()
+        .filter_map(value_name)
+        .any(|entry| path_match(&entry))
+        || json_array(data, "files")
+            .iter()
+            .filter_map(value_name)
+            .any(|entry| path_match(&entry))
+    {
+        return true;
+    }
+
+    let pacemaker = data
+        .get("pacemakerResources")
+        .cloned()
+        .unwrap_or(Value::Null);
+    if json_array(&pacemaker, "resources").iter().any(|resource| {
+        let haystack = format!(
+            "{} {} {}",
+            json_str(resource, "name").to_ascii_lowercase(),
+            json_str(resource, "type").to_ascii_lowercase(),
+            json_str(resource, "provider").to_ascii_lowercase(),
+        );
+        haystack.contains("sap") || haystack.contains("hana") || haystack.contains("hdb")
+    }) {
+        return true;
+    }
+
+    !collect_packages(
+        &data.get("distroPackages").cloned().unwrap_or(Value::Null),
+        &["sap", "hana", "hdb", "saptune"],
+    )
+    .is_empty()
+}
+
+fn value_name(value: &Value) -> Option<String> {
+    value.as_str().map(|name| name.to_string()).or_else(|| {
+        value
+            .get("name")
+            .and_then(|name| name.as_str())
+            .map(|name| name.to_string())
+    })
+}
+
+fn collect_packages(packages_value: &Value, patterns: &[&str]) -> Vec<String> {
+    packages_value
+        .get("packages")
+        .and_then(|packages| packages.as_object())
+        .map(|packages| {
+            packages
+                .iter()
+                .filter_map(|(name, version)| {
+                    let lower_name = name.to_ascii_lowercase();
+                    if patterns.iter().any(|pattern| lower_name.contains(pattern)) {
+                        let version = version.as_str().unwrap_or("");
+                        if version.is_empty() {
+                            Some(name.clone())
+                        } else {
+                            Some(format!("{name}-{version}"))
+                        }
+                    } else {
+                        None
+                    }
+                })
+                .collect::<Vec<_>>()
+        })
+        .unwrap_or_default()
+}
+
+fn string_array(value: &Value, key: &str) -> Vec<String> {
+    value
+        .get(key)
+        .and_then(|items| items.as_array())
+        .map(|items| {
+            items
+                .iter()
+                .filter_map(|item| item.as_str().map(|s| s.to_string()))
+                .collect::<Vec<_>>()
+        })
+        .unwrap_or_default()
+}
diff --git a/rca-tool/web-leptos/src/components/sections/storage.rs b/rca-tool/web-leptos/src/components/sections/storage.rs
new file mode 100644
index 0000000..6ecd522
--- /dev/null
+++ b/rca-tool/web-leptos/src/components/sections/storage.rs
@@ -0,0 +1,1291 @@
+use leptos::prelude::*;
+use serde_json::Value;
+
+use super::helpers::*;
+
+/// Section 3 – InspectIaaSDisk Results.
+#[component]
+pub fn InspectDiskSection(data: Value) -> impl IntoView {
+    let inspect = data
+        .get("inspectDiskResults")
+        .cloned()
+        .unwrap_or(Value::Null);
+
+    if !json_bool(&inspect, "found") || !json_bool(&inspect, "isInspectDisk") {
+        return view! {}.into_any();
+    }
+
+    let request_info = inspect.get("requestInfo").cloned().unwrap_or(Value::Null);
+    let metadata = inspect
+        .get("inspectionMetadata")
+        .cloned()
+        .unwrap_or(Value::Null);
+    let filesystem_status = json_array(&inspect, "filesystemStatus");
+    let mount_results = json_array(&inspect, "mountResults");
+    let warnings = json_array(&inspect, "warnings");
+
+    let failed_mounts = mount_results
+        .iter()
+        .filter(|entry| json_str(entry, "status") == "FAILED")
+        .count();
+    let block_class = if failed_mounts > 0 {
+        "danger-block"
+    } else {
+        "success-block"
+    };
+
+    let has_request_info = request_info
+        .as_object()
+        .map(|obj| !obj.is_empty())
+        .unwrap_or(false);
+    let has_metadata = metadata
+        .as_object()
+        .map(|obj| !obj.is_empty())
+        .unwrap_or(false);
+
+    view! {
+        <details class=block_class open=true>
+            <summary>
+                "InspectIaaSDisk Results"
+                {(failed_mounts > 0).then(|| view! {
+                    <span class="badge badge-danger">
+                        {format!(
+                            "{failed_mounts} mount failure{}",
+                            if failed_mounts == 1 { "" } else { "s" },
+                        )}
+                    </span>
+                })}
+            </summary>
+
+            <div class="section-body">
+                {has_request_info.then(|| view! {
+                    <div class="subsection">
+                        <p><strong>"Request Info:"</strong></p>
+                        <KvTable>
+                            <KvRow label="Storage Account" value=json_str(&request_info, "storageAccount")/>
+                            <KvRow label="Container/VHD" value=json_str(&request_info, "containerVhd")/>
+                            <KvRow label="Manifest" value=json_str(&request_info, "manifest")/>
+                            <KvRow label="Operational ID" value=json_str(&request_info, "operationalId")/>
+                            <KvRow label="Guestfish" value=json_str(&request_info, "guestfishVersion")/>
+                        </KvTable>
+                    </div>
+                })}
+
+                {has_metadata.then(|| view! {
+                    <div class="subsection">
+                        <p><strong>"Disk Inspection:"</strong></p>
+                        <KvTable>
+                            <KvRow label="Product" value=json_str(&metadata, "productName")/>
+                            <KvRow label="Distribution" value=json_str(&metadata, "distribution")/>
+                            <KvRow label="Type" value=json_str(&metadata, "type")/>
+                        </KvTable>
+                    </div>
+                })}
+
+                {(!filesystem_status.is_empty()).then(|| view! {
+                    <details class="content-details">
+                        <summary>{format!("Filesystem Status ({} devices)", filesystem_status.len())}</summary>
+                        <table class="data-table">
+                            <thead>
+                                <tr>
+                                    <th>"Device"</th>
+                                    <th>"Type"</th>
+                                    <th>"UUID"</th>
+                                </tr>
+                            </thead>
+                            <tbody>
+                                {filesystem_status
+                                    .into_iter()
+                                    .map(|fs| {
+                                        let device = json_str(&fs, "device");
+                                        let fs_type = json_str(&fs, "type");
+                                        let uuid = json_str(&fs, "uuid");
+                                        view! {
+                                            <tr>
+                                                <td><code>{device}</code></td>
+                                                <td>{fs_type}</td>
+                                                <td><code>{if uuid.is_empty() { "-".to_string() } else { uuid }}</code></td>
+                                            </tr>
+                                        }
+                                    })
+                                    .collect::<Vec<_>>()}
+                            </tbody>
+                        </table>
+                    </details>
+                })}
+
+                {(!mount_results.is_empty()).then(|| view! {
+                    <details class="content-details" open=failed_mounts > 0>
+                        <summary>{format!("Mount Results ({} mounts)", mount_results.len())}</summary>
+                        <table class="data-table">
+                            <thead>
+                                <tr>
+                                    <th>"Device"</th>
+                                    <th>"Mount Point"</th>
+                                    <th>"Status"</th>
+                                </tr>
+                            </thead>
+                            <tbody>
+                                {mount_results
+                                    .into_iter()
+                                    .map(|mount| {
+                                        let device = json_str(&mount, "device");
+                                        let mount_point = json_str(&mount, "mountPoint");
+                                        let status = json_str(&mount, "status");
+                                        let status_class = if status == "SUCCEEDED" { "text-success" } else { "text-danger" };
+                                        let status_text = if status == "SUCCEEDED" {
+                                            format!("✓ {status}")
+                                        } else {
+                                            format!("✗ {status}")
+                                        };
+                                        view! {
+                                            <tr>
+                                                <td><code>{device}</code></td>
+                                                <td><code>{mount_point}</code></td>
+                                                <td class=status_class>{status_text}</td>
+                                            </tr>
+                                        }
+                                    })
+                                    .collect::<Vec<_>>()}
+                            </tbody>
+                        </table>
+                    </details>
+                })}
+
+                {warnings
+                    .into_iter()
+                    .map(|warning| {
+                        let severity = json_str(&warning, "severity");
+                        let message = json_str(&warning, "message");
+                        let recommendation = json_str(&warning, "recommendation");
+                        let class = if severity == "error" { "danger-block" } else { "warning-block" };
+                        let heading = if severity == "error" { "Error" } else { "Warning" };
+                        view! {
+                            <div class=class>
+                                <p>
+                                    <strong>{format!("{heading}:")}</strong>
+                                    " "
+                                    {message}
+                                </p>
+                                {(!recommendation.is_empty()).then(|| view! { <p>{recommendation}</p> })}
+                            </div>
+                        }
+                    })
+                    .collect::<Vec<_>>()}
+            </div>
+        </details>
+    }
+    .into_any()
+}
+
+/// Section 15 – Storage (LVM, RAID, BTRFS, block devices, fstab).
+#[component]
+pub fn StorageSection(data: Value) -> impl IntoView {
+    let lvm = data.get("lvmConfig").cloned().unwrap_or(Value::Null);
+    let raid = data.get("raidConfig").cloned().unwrap_or(Value::Null);
+    let btrfs = data.get("btrfsConfig").cloned().unwrap_or(Value::Null);
+    let fstab = data.get("fstab").cloned().unwrap_or(Value::Null);
+    let fstab_analysis = data.get("fstabAnalysis").cloned().unwrap_or(Value::Null);
+    let block = data.get("blockDevices").cloned().unwrap_or(Value::Null);
+    let correlation = data
+        .get("storageCorrelation")
+        .cloned()
+        .unwrap_or(Value::Null);
+    let df = data.get("dfOutput").cloned().unwrap_or(Value::Null);
+    let mtab = data.get("mtabAnalysis").cloned().unwrap_or(Value::Null);
+    let nvme = data.get("nvmeList").cloned().unwrap_or(Value::Null);
+    let nfs = data.get("nfsMounts").cloned().unwrap_or(Value::Null);
+
+    let has_any = json_bool(&lvm, "found")
+        || json_bool(&raid, "found")
+        || json_bool(&btrfs, "found")
+        || json_bool(&fstab, "found")
+        || json_bool(&fstab_analysis, "found")
+        || json_bool(&block, "found")
+        || json_bool(&correlation, "found")
+        || json_bool(&mtab, "found")
+        || json_bool(&nfs, "found")
+        || json_bool(&nvme, "hasNVMe");
+
+    if !has_any {
+        return view! {}.into_any();
+    }
+
+    let error_count = json_array(&correlation, "errors").len();
+    let warning_count = json_array(&correlation, "warnings").len();
+    let class = if error_count > 0 {
+        "danger-block"
+    } else if warning_count > 0 {
+        "warning-block"
+    } else {
+        "content-details"
+    };
+
+    view! {
+        <Section title="Storage" class=class>
+            {render_lvm_section(&lvm)}
+            {render_raid_section(&raid)}
+            {render_btrfs_section(&btrfs)}
+            {render_block_devices_section(&block)}
+            {render_storage_correlation(&correlation)}
+            {render_fstab_section(&fstab, &fstab_analysis, &df)}
+            {render_mtab_section(&mtab)}
+            {render_nfs_section(&nfs)}
+            {render_nvme_section(&nvme)}
+        </Section>
+    }
+    .into_any()
+}
+
+fn render_lvm_section(lvm: &Value) -> Option<AnyView> {
+    if !json_bool(lvm, "found") {
+        return None;
+    }
+
+    let warnings = json_array(lvm, "warnings");
+    let pvs = json_array(lvm, "pvs");
+    let vgs = json_array(lvm, "vgs");
+    let lvs = json_array(lvm, "lvs");
+    let raw_output = lvm.get("rawOutput").cloned().unwrap_or(Value::Null);
+
+    Some(
+        view! {
+            <div class="subsection">
+                <p class="subsection-title">"LVM Configuration:"</p>
+
+                {(!warnings.is_empty()).then(|| view! {
+                    <div class="warning-block">
+                        <p><strong>{format!("Warnings ({})", warnings.len())}</strong></p>
+                        <ul class="disk-list">
+                            {warnings
+                                .iter()
+                                .map(|warning| {
+                                    let warning_type = json_text(warning, "type");
+                                    let message = json_text(warning, "message");
+                                    let details = json_text(warning, "details");
+                                    view! {
+                                        <li>
+                                            <strong>{if warning_type.is_empty() {
+                                                "Warning".to_string()
+                                            } else {
+                                                format!("{}:", warning_type)
+                                            }}</strong>
+                                            " "
+                                            {message}
+                                            {(!details.is_empty()).then(|| view! {
+                                                <div class="text-muted">{details}</div>
+                                            })}
+                                        </li>
+                                    }
+                                })
+                                .collect::<Vec<_>>()}
+                        </ul>
+                    </div>
+                })}
+
+                {(!pvs.is_empty()).then(|| view! {
+                    <details class="content-details" open=true>
+                        <summary>{format!("Physical Volumes ({})", pvs.len())}</summary>
+                        <table class="data-table">
+                            <thead>
+                                <tr>
+                                    <th>"Device"</th>
+                                    <th>"Volume Group"</th>
+                                    <th>"Size"</th>
+                                    <th>"Free"</th>
+                                    <th>"Attributes"</th>
+                                </tr>
+                            </thead>
+                            <tbody>
+                                {pvs
+                                    .iter()
+                                    .map(|pv| view! {
+                                        <tr>
+                                            <td><code>{json_text(pv, "device")}</code></td>
+                                            <td><code>{empty_dash(json_text(pv, "vg"))}</code></td>
+                                            <td><code>{empty_dash(json_text(pv, "size"))}</code></td>
+                                            <td><code>{empty_dash(json_text(pv, "free"))}</code></td>
+                                            <td><code>{empty_dash(json_text(pv, "attr"))}</code></td>
+                                        </tr>
+                                    })
+                                    .collect::<Vec<_>>()}
+                            </tbody>
+                        </table>
+                        {render_raw_output_details("Raw pvs output", json_text(&raw_output, "pvs"))}
+                    </details>
+                })}
+
+                {(!vgs.is_empty()).then(|| view! {
+                    <details class="content-details">
+                        <summary>{format!("Volume Groups ({})", vgs.len())}</summary>
+                        <table class="data-table">
+                            <thead>
+                                <tr>
+                                    <th>"Volume Group"</th>
+                                    <th>"PVs"</th>
+                                    <th>"LVs"</th>
+                                    <th>"Size"</th>
+                                    <th>"Free"</th>
+                                    <th>"Attributes"</th>
+                                </tr>
+                            </thead>
+                            <tbody>
+                                {vgs
+                                    .iter()
+                                    .map(|vg| view! {
+                                        <tr>
+                                            <td><code>{json_text(vg, "name")}</code></td>
+                                            <td><code>{empty_dash(json_text(vg, "pv_count"))}</code></td>
+                                            <td><code>{empty_dash(json_text(vg, "lv_count"))}</code></td>
+                                            <td><code>{empty_dash(json_text(vg, "size"))}</code></td>
+                                            <td><code>{empty_dash(json_text(vg, "free"))}</code></td>
+                                            <td><code>{empty_dash(json_text(vg, "attr"))}</code></td>
+                                        </tr>
+                                    })
+                                    .collect::<Vec<_>>()}
+                            </tbody>
+                        </table>
+                        {render_raw_output_details("Raw vgs output", json_text(&raw_output, "vgs"))}
+                    </details>
+                })}
+
+                {(!lvs.is_empty()).then(|| view! {
+                    <details class="content-details">
+                        <summary>{format!("Logical Volumes ({})", lvs.len())}</summary>
+                        <table class="data-table">
+                            <thead>
+                                <tr>
+                                    <th>"Logical Volume"</th>
+                                    <th>"Volume Group"</th>
+                                    <th>"Size"</th>
+                                    <th>"Pool"</th>
+                                    <th>"Attributes"</th>
+                                </tr>
+                            </thead>
+                            <tbody>
+                                {lvs
+                                    .iter()
+                                    .map(|lv| view! {
+                                        <tr>
+                                            <td><code>{json_text(lv, "name")}</code></td>
+                                            <td><code>{empty_dash(json_text(lv, "vg"))}</code></td>
+                                            <td><code>{empty_dash(json_text(lv, "size"))}</code></td>
+                                            <td><code>{empty_dash(json_text(lv, "pool"))}</code></td>
+                                            <td><code>{empty_dash(json_text(lv, "attr"))}</code></td>
+                                        </tr>
+                                    })
+                                    .collect::<Vec<_>>()}
+                            </tbody>
+                        </table>
+                        {render_raw_output_details("Raw lvs output", json_text(&raw_output, "lvs"))}
+                    </details>
+                })}
+            </div>
+        }
+        .into_any(),
+    )
+}
+
+fn render_raid_section(raid: &Value) -> Option<AnyView> {
+    if !json_bool(raid, "found") {
+        return None;
+    }
+
+    let arrays = json_array(raid, "arrays");
+    let warnings = json_array(raid, "warnings");
+    let raw_output = raid.get("rawOutput").cloned().unwrap_or(Value::Null);
+
+    Some(
+        view! {
+            <div class="subsection">
+                <p class="subsection-title">"RAID Configuration:"</p>
+
+                {(!warnings.is_empty()).then(|| view! {
+                    <div class="warning-block">
+                        <p><strong>{format!("Warnings ({})", warnings.len())}</strong></p>
+                        <ul class="disk-list">
+                            {warnings
+                                .iter()
+                                .map(|warning| {
+                                    let warning_type = json_text(warning, "type");
+                                    let message = json_text(warning, "message");
+                                    let details = json_text(warning, "details");
+                                    view! {
+                                        <li>
+                                            <strong>{if warning_type.is_empty() {
+                                                "Warning".to_string()
+                                            } else {
+                                                format!("{}:", warning_type)
+                                            }}</strong>
+                                            " "
+                                            {message}
+                                            {(!details.is_empty()).then(|| view! { <div class="text-muted">{details}</div> })}
+                                        </li>
+                                    }
+                                })
+                                .collect::<Vec<_>>()}
+                        </ul>
+                    </div>
+                })}
+
+                {(!arrays.is_empty()).then(|| view! {
+                    <details class="content-details" open=true>
+                        <summary>{format!("RAID Arrays ({})", arrays.len())}</summary>
+                        {arrays
+                            .iter()
+                            .map(|array| {
+                                let device = json_text(array, "device");
+                                let state = json_text(array, "state");
+                                let level = json_text(array, "level");
+                                let size = json_text(array, "size");
+                                let devices = json_array(array, "devices");
+                                let sync_status = array.get("syncStatus").cloned().unwrap_or(Value::Null);
+                                let badge_class = match state.as_str() {
+                                    "active" => "badge badge-success",
+                                    "degraded" => "badge badge-warning",
+                                    _ => "badge badge-danger",
+                                };
+                                view! {
+                                    <div class="vm-note info">
+                                        <p>
+                                            <strong><code>{device.clone()}</code></strong>
+                                            " "
+                                            <span class=badge_class>{state.to_uppercase()}</span>
+                                            {(!level.is_empty()).then(|| view! {
+                                                <span class="text-muted">{format!(" — Level: {}", level.clone())}</span>
+                                            })}
+                                        </p>
+                                        {(!size.is_empty()).then(|| view! {
+                                            <p><strong>"Size:"</strong> " " {size.clone()}</p>
+                                        })}
+                                        {(!devices.is_empty()).then(|| view! {
+                                            <>
+                                                <p><strong>"Devices:"</strong></p>
+                                                <ul class="disk-list">
+                                                    {devices
+                                                        .iter()
+                                                        .map(|dev| {
+                                                            let name = json_text(dev, "device");
+                                                            let state = json_text(dev, "state");
+                                                            view! { <li><code>{name}</code>{format!(" - {}", state)}</li> }
+                                                        })
+                                                        .collect::<Vec<_>>()}
+                                                </ul>
+                                            </>
+                                        })}
+                                        {sync_status.as_object().map(|obj| !obj.is_empty()).unwrap_or(false).then(|| view! {
+                                            <div class="info-block">
+                                                <p>
+                                                    <strong>{format!("{} in progress", json_text(&sync_status, "operation").to_uppercase())}</strong>
+                                                </p>
+                                                <p>
+                                                    {format!(
+                                                        "Progress: {}%{}{}",
+                                                        empty_dash(json_text(&sync_status, "percentage")),
+                                                        if json_text(&sync_status, "finish").is_empty() {
+                                                            String::new()
+                                                        } else {
+                                                            format!(", finish {}", json_text(&sync_status, "finish"))
+                                                        },
+                                                        if json_text(&sync_status, "speed").is_empty() {
+                                                            String::new()
+                                                        } else {
+                                                            format!(", speed {}", json_text(&sync_status, "speed"))
+                                                        },
+                                                    )}
+                                                </p>
+                                            </div>
+                                        })}
+                                    </div>
+                                }
+                            })
+                            .collect::<Vec<_>>()}
+                        {render_raw_output_details("Raw /proc/mdstat", json_text(&raw_output, "mdstat"))}
+                    </details>
+                })}
+            </div>
+        }
+        .into_any(),
+    )
+}
+
+fn render_btrfs_section(btrfs: &Value) -> Option<AnyView> {
+    if !json_bool(btrfs, "found") {
+        return None;
+    }
+
+    let filesystems = json_array(btrfs, "filesystems");
+    let subvolumes = json_array(btrfs, "subvolumes");
+    let raw_output = btrfs.get("rawOutput").cloned().unwrap_or(Value::Null);
+
+    Some(
+        view! {
+            <div class="subsection">
+                <p class="subsection-title">"BTRFS Configuration:"</p>
+
+                {(!filesystems.is_empty()).then(|| view! {
+                    <details class="content-details" open=true>
+                        <summary>{format!("BTRFS Filesystems ({})", filesystems.len())}</summary>
+                        {filesystems
+                            .iter()
+                            .map(|fs| {
+                                let label = json_text(fs, "label");
+                                let uuid = json_text(fs, "uuid");
+                                let total_size = json_text(fs, "totalSize");
+                                let device_count = json_text(fs, "deviceCount");
+                                let devices = json_array(fs, "devices");
+                                view! {
+                                    <div class="vm-note info">
+                                        <p><strong>"Label:"</strong> " " {empty_dash(label.clone())}</p>
+                                        {(!uuid.is_empty()).then(|| view! {
+                                            <p><strong>"UUID:"</strong> " " <code>{uuid.clone()}</code></p>
+                                        })}
+                                        {(!device_count.is_empty() || !total_size.is_empty()).then(|| view! {
+                                            <p>
+                                                {(!device_count.is_empty()).then(|| view! {
+                                                    <span><strong>"Devices:"</strong> " " {device_count.clone()}</span>
+                                                })}
+                                                {(!device_count.is_empty() && !total_size.is_empty()).then(|| view! { <span>" | "</span> })}
+                                                {(!total_size.is_empty()).then(|| view! {
+                                                    <span><strong>"Used:"</strong> " " {total_size.clone()}</span>
+                                                })}
+                                            </p>
+                                        })}
+                                        {(!devices.is_empty()).then(|| view! {
+                                            <table class="data-table">
+                                                <thead>
+                                                    <tr>
+                                                        <th>"Device"</th>
+                                                        <th>"Size"</th>
+                                                        <th>"Used"</th>
+                                                    </tr>
+                                                </thead>
+                                                <tbody>
+                                                    {devices
+                                                        .iter()
+                                                        .map(|dev| view! {
+                                                            <tr>
+                                                                <td><code>{json_text(dev, "path")}</code></td>
+                                                                <td>{empty_dash(json_text(dev, "size"))}</td>
+                                                                <td>{empty_dash(json_text(dev, "used"))}</td>
+                                                            </tr>
+                                                        })
+                                                        .collect::<Vec<_>>()}
+                                                </tbody>
+                                            </table>
+                                        })}
+                                    </div>
+                                }
+                            })
+                            .collect::<Vec<_>>()}
+                        {render_raw_output_details(
+                            "Raw btrfs filesystem show",
+                            json_text(&raw_output, "filesystems"),
+                        )}
+                    </details>
+                })}
+
+                {(!subvolumes.is_empty()).then(|| view! {
+                    <details class="content-details">
+                        <summary>{format!("BTRFS Subvolumes ({})", subvolumes.len())}</summary>
+                        <table class="data-table">
+                            <thead>
+                                <tr>
+                                    <th>"ID"</th>
+                                    <th>"Path"</th>
+                                    <th>"Parent"</th>
+                                    <th>"Top Level"</th>
+                                </tr>
+                            </thead>
+                            <tbody>
+                                {subvolumes
+                                    .iter()
+                                    .map(|subvol| view! {
+                                        <tr>
+                                            <td><code>{json_text(subvol, "id")}</code></td>
+                                            <td><code>{json_text(subvol, "path")}</code></td>
+                                            <td><code>{empty_dash(json_text(subvol, "parent"))}</code></td>
+                                            <td><code>{empty_dash(json_text(subvol, "topLevel"))}</code></td>
+                                        </tr>
+                                    })
+                                    .collect::<Vec<_>>()}
+                            </tbody>
+                        </table>
+                        {render_raw_output_details(
+                            "Raw btrfs subvolume list",
+                            json_text(&raw_output, "subvolumes"),
+                        )}
+                    </details>
+                })}
+            </div>
+        }
+        .into_any(),
+    )
+}
+
+fn render_block_devices_section(block: &Value) -> Option<AnyView> {
+    if !json_bool(block, "found") {
+        return None;
+    }
+
+    let disks = json_array(block, "disks");
+    let partitions = json_array(block, "partitions");
+
+    if disks.is_empty() && partitions.is_empty() {
+        return None;
+    }
+
+    Some(
+        view! {
+            <div class="subsection">
+                <p class="subsection-title">"Block Devices:"</p>
+
+                {(!disks.is_empty()).then(|| view! {
+                    <details class="content-details" open=true>
+                        <summary>{format!("Disks ({})", disks.len())}</summary>
+                        <table class="data-table">
+                            <thead>
+                                <tr>
+                                    <th>"Device"</th>
+                                    <th>"Size"</th>
+                                    <th>"Type"</th>
+                                    <th>"Mount"</th>
+                                </tr>
+                            </thead>
+                            <tbody>
+                                {disks
+                                    .iter()
+                                    .map(|disk| view! {
+                                        <tr>
+                                            <td><code>{json_text(disk, "device")}</code></td>
+                                            <td>{empty_dash(json_text(disk, "size"))}</td>
+                                            <td>{empty_dash(json_text(disk, "type"))}</td>
+                                            <td><code>{empty_dash(json_text(disk, "mountpoint"))}</code></td>
+                                        </tr>
+                                    })
+                                    .collect::<Vec<_>>()}
+                            </tbody>
+                        </table>
+                    </details>
+                })}
+
+                {(!partitions.is_empty()).then(|| view! {
+                    <details class="content-details">
+                        <summary>{format!("Partitions ({})", partitions.len())}</summary>
+                        <table class="data-table">
+                            <thead>
+                                <tr>
+                                    <th>"Device"</th>
+                                    <th>"Size"</th>
+                                    <th>"Filesystem"</th>
+                                    <th>"UUID"</th>
+                                    <th>"Mount"</th>
+                                </tr>
+                            </thead>
+                            <tbody>
+                                {partitions
+                                    .iter()
+                                    .map(|part| view! {
+                                        <tr>
+                                            <td><code>{json_text(part, "device")}</code></td>
+                                            <td>{empty_dash(json_text(part, "size"))}</td>
+                                            <td>{empty_dash(json_text(part, "fstype"))}</td>
+                                            <td><code>{empty_dash(json_text(part, "uuid"))}</code></td>
+                                            <td><code>{empty_dash(json_text(part, "mountpoint"))}</code></td>
+                                        </tr>
+                                    })
+                                    .collect::<Vec<_>>()}
+                            </tbody>
+                        </table>
+                    </details>
+                })}
+            </div>
+        }
+        .into_any(),
+    )
+}
+
+fn render_storage_correlation(correlation: &Value) -> Option<AnyView> {
+    if !json_bool(correlation, "found") {
+        return None;
+    }
+
+    let errors = json_array(correlation, "errors");
+    let warnings = json_array(correlation, "warnings");
+
+    if errors.is_empty() && warnings.is_empty() {
+        return None;
+    }
+
+    Some(
+        view! {
+            <div class="subsection">
+                <p class="subsection-title">"Fstab / UUID Correlation:"</p>
+
+                {(!errors.is_empty()).then(|| view! {
+                    <div class="danger-block">
+                        <p><strong>{format!("UUID Errors ({})", errors.len())}</strong></p>
+                        <ul class="disk-list">
+                            {errors
+                                .iter()
+                                .map(|err| {
+                                    let mountpoint = json_text(err, "mountpoint");
+                                    let uuid = json_text(err, "uuid");
+                                    let message = json_text(err, "message");
+                                    view! {
+                                        <li>
+                                            <strong>{mountpoint}</strong>
+                                            ": UUID "
+                                            <code>{uuid}</code>
+                                            " not found on any device."
+                                            {(!message.is_empty()).then(|| view! {
+                                                <div class="text-muted">{message}</div>
+                                            })}
+                                        </li>
+                                    }
+                                })
+                                .collect::<Vec<_>>()}
+                        </ul>
+                    </div>
+                })}
+
+                {(!warnings.is_empty()).then(|| view! {
+                    <div class="warning-block">
+                        <p><strong>{format!("Filesystem Warnings ({})", warnings.len())}</strong></p>
+                        <ul class="disk-list">
+                            {warnings
+                                .iter()
+                                .map(|warning| {
+                                    let mountpoint = json_text(warning, "mountpoint");
+                                    let message = json_text(warning, "message");
+                                    view! {
+                                        <li>
+                                            {if mountpoint.is_empty() {
+                                                message.clone()
+                                            } else {
+                                                format!("{}: {}", mountpoint, message)
+                                            }}
+                                        </li>
+                                    }
+                                })
+                                .collect::<Vec<_>>()}
+                        </ul>
+                    </div>
+                })}
+            </div>
+        }
+        .into_any(),
+    )
+}
+
+fn render_fstab_section(fstab: &Value, fstab_analysis: &Value, df: &Value) -> Option<AnyView> {
+    let raw_content = {
+        let from_fstab = json_text(fstab, "content");
+        if from_fstab.is_empty() {
+            json_text(fstab_analysis, "rawContent")
+        } else {
+            from_fstab
+        }
+    };
+    let entries = json_array(fstab_analysis, "entries");
+    let nofail_warnings = json_array(fstab_analysis, "warnings")
+        .into_iter()
+        .filter(|warning| json_text(warning, "type") == "missing_nofail")
+        .collect::<Vec<_>>();
+
+    if entries.is_empty() && raw_content.is_empty() {
+        return None;
+    }
+
+    Some(
+        view! {
+            <details class="content-details" open=!nofail_warnings.is_empty()>
+                <summary>
+                    "Filesystem Table (/etc/fstab)"
+                    {(!nofail_warnings.is_empty()).then(|| view! {
+                        <span class="badge badge-warning">
+                            {format!(
+                                "{} missing nofail",
+                                nofail_warnings.len(),
+                            )}
+                        </span>
+                    })}
+                </summary>
+
+                {(!nofail_warnings.is_empty()).then(|| view! {
+                    <div class="warning-block">
+                        <p><strong>"Non-OS partitions missing 'nofail' option"</strong></p>
+                        <p>
+                            "These mount points may prevent the system from booting if the storage becomes unavailable:"
+                        </p>
+                        <ul class="disk-list">
+                            {nofail_warnings
+                                .iter()
+                                .map(|warning| {
+                                    let mountpoint = json_text(warning, "mountpoint");
+                                    let fstype = json_text(warning, "fstype");
+                                    let source = json_text(warning, "source");
+                                    view! {
+                                        <li>
+                                            <code>{mountpoint}</code>
+                                            {format!(" ({}) - source: {}", fstype, source)}
+                                        </li>
+                                    }
+                                })
+                                .collect::<Vec<_>>()}
+                        </ul>
+                        <p>
+                            <strong>"Recommendation:"</strong>
+                            " Add "
+                            <code>"nofail"</code>
+                            " to these entries in /etc/fstab."
+                        </p>
+                        <p>
+                            <a
+                                href="https://learn.microsoft.com/en-us/azure/virtual-machines/linux/fstab-device-names"
+                                target="_blank"
+                                rel="noopener noreferrer"
+                                class="text-info"
+                            >
+                                "Azure fstab best practices"
+                            </a>
+                        </p>
+                    </div>
+                })}
+
+                {(!entries.is_empty()).then(|| view! {
+                    <div class="section-body">
+                        <table class="data-table">
+                            <thead>
+                                <tr>
+                                    <th>"Mount Point"</th>
+                                    <th>"Source"</th>
+                                    <th>"Type"</th>
+                                    <th>"Size"</th>
+                                    <th>"Used"</th>
+                                    <th>"Use%"</th>
+                                    <th>"Options"</th>
+                                    <th>"Status"</th>
+                                </tr>
+                            </thead>
+                            <tbody>
+                                {entries
+                                    .iter()
+                                    .map(|entry| {
+                                        let mountpoint = json_text(entry, "mountpoint");
+                                        let source = json_text(entry, "source");
+                                        let fstype = json_text(entry, "fstype");
+                                        let options = json_text(entry, "options");
+                                        let usage = df
+                                            .get("mountToUsage")
+                                            .and_then(|usage| usage.get(&mountpoint))
+                                            .cloned()
+                                            .unwrap_or(Value::Null);
+                                        let size = format_df_size(&json_text(&usage, "size"));
+                                        let used = format_df_size(&json_text(&usage, "used"));
+                                        let use_percent = json_text(&usage, "usePercentStr");
+                                        let needs_nofail = entry
+                                            .get("needsNofail")
+                                            .and_then(|value| value.as_bool())
+                                            .unwrap_or(false);
+                                        let is_virtual = entry
+                                            .get("isVirtualFs")
+                                            .and_then(|value| value.as_bool())
+                                            .unwrap_or(false);
+                                        let is_os = entry
+                                            .get("isOsPartition")
+                                            .and_then(|value| value.as_bool())
+                                            .unwrap_or(false);
+                                        let has_nofail = entry
+                                            .get("hasNofail")
+                                            .and_then(|value| value.as_bool())
+                                            .unwrap_or(false);
+                                        view! {
+                                            <tr>
+                                                <td><code>{mountpoint.clone()}</code></td>
+                                                <td><code>{source.clone()}</code></td>
+                                                <td>{fstype.clone()}</td>
+                                                <td>{empty_dash(size)}</td>
+                                                <td>{empty_dash(used)}</td>
+                                                <td>{empty_dash(use_percent.clone())}</td>
+                                                <td>{options.clone()}</td>
+                                                <td>
+                                                    {if needs_nofail {
+                                                        view! { <span class="badge badge-warning">"nofail"</span> }
+                                                            .into_any()
+                                                    } else if is_virtual {
+                                                        view! { <span class="text-muted">"virtual"</span> }.into_any()
+                                                    } else if is_os {
+                                                        view! { <span class="text-success">"OS"</span> }.into_any()
+                                                    } else if has_nofail {
+                                                        view! { <span class="text-muted">"Data disk"</span> }.into_any()
+                                                    } else {
+                                                        view! { <span class="text-muted">"-"</span> }.into_any()
+                                                    }}
+                                                </td>
+                                            </tr>
+                                        }
+                                    })
+                                    .collect::<Vec<_>>()}
+                            </tbody>
+                        </table>
+                    </div>
+                })}
+
+                {render_raw_output_details("Show raw /etc/fstab", raw_content)}
+            </details>
+        }
+        .into_any(),
+    )
+}
+
+fn render_mtab_section(mtab: &Value) -> Option<AnyView> {
+    if !json_bool(mtab, "found") {
+        return None;
+    }
+
+    let entries = json_array(mtab, "entries");
+    let extra_mounts = json_array(mtab, "extraMounts");
+    let raw_content = json_text(mtab, "rawContent");
+    let real_mounts = mtab
+        .get("realMounts")
+        .and_then(|value| value.as_u64())
+        .unwrap_or_else(|| {
+            entries
+                .iter()
+                .filter(|entry| {
+                    !entry
+                        .get("isVirtualFs")
+                        .and_then(|value| value.as_bool())
+                        .unwrap_or(false)
+                })
+                .count() as u64
+        });
+
+    if entries.is_empty() && extra_mounts.is_empty() && raw_content.is_empty() {
+        return None;
+    }
+
+    Some(
+        view! {
+            <details class="content-details" open=!extra_mounts.is_empty()>
+                <summary>
+                    {format!("Mounted Filesystems ({} real mount{})", real_mounts, if real_mounts == 1 { "" } else { "s" })}
+                    {(!extra_mounts.is_empty()).then(|| view! {
+                        <span class="badge badge-warning">
+                            {format!(
+                                "{} mount{} not in fstab",
+                                extra_mounts.len(),
+                                if extra_mounts.len() == 1 { "" } else { "s" },
+                            )}
+                        </span>
+                    })}
+                </summary>
+
+                {(!extra_mounts.is_empty()).then(|| view! {
+                    <div class="warning-block">
+                        <p><strong>"Mounts not defined in /etc/fstab"</strong></p>
+                        <p>
+                            "These filesystems are currently mounted but have no entry in /etc/fstab. They may have been mounted manually or by a cluster resource agent."
+                        </p>
+                        <table class="data-table">
+                            <thead>
+                                <tr>
+                                    <th>"Mount Point"</th>
+                                    <th>"Source"</th>
+                                    <th>"Type"</th>
+                                    <th>"Options"</th>
+                                    <th>"Likely Origin"</th>
+                                </tr>
+                            </thead>
+                            <tbody>
+                                {extra_mounts
+                                    .iter()
+                                    .map(|mount| {
+                                        let mountpoint = json_text(mount, "mountpoint");
+                                        let source = json_text(mount, "source");
+                                        let fstype = json_text(mount, "fstype");
+                                        let options = json_text(mount, "options");
+                                        let source_type = json_text(mount, "sourceType");
+                                        let origin = if source_type == "network" {
+                                            "Network mount (NFS/CIFS)".to_string()
+                                        } else if mountpoint.contains("/hana/")
+                                            || mountpoint.contains("/sapmnt")
+                                            || mountpoint.contains("/usr/sap")
+                                        {
+                                            "SAP/HANA (likely cluster-managed)".to_string()
+                                        } else if fstype == "ocfs2" || fstype == "gfs2" {
+                                            "Cluster filesystem".to_string()
+                                        } else {
+                                            "Hand-mounted".to_string()
+                                        };
+                                        view! {
+                                            <tr>
+                                                <td><code>{mountpoint}</code></td>
+                                                <td><code>{source}</code></td>
+                                                <td>{fstype}</td>
+                                                <td>{options}</td>
+                                                <td>{origin}</td>
+                                            </tr>
+                                        }
+                                    })
+                                    .collect::<Vec<_>>()}
+                            </tbody>
+                        </table>
+                    </div>
+                })}
+
+                {render_raw_output_details("Show raw /etc/mtab", raw_content)}
+            </details>
+        }
+        .into_any(),
+    )
+}
+
+fn render_nfs_section(nfs: &Value) -> Option<AnyView> {
+    if !json_bool(nfs, "found") {
+        return None;
+    }
+
+    let mounts = json_array(nfs, "mounts");
+    let warnings = json_array(nfs, "warnings");
+
+    if mounts.is_empty() && warnings.is_empty() {
+        return None;
+    }
+
+    let opt_num = |mount: &Value, key: &str| -> String {
+        mount
+            .get(key)
+            .and_then(|v| v.as_i64())
+            .map(|n| n.to_string())
+            .unwrap_or_else(|| "—".to_string())
+    };
+
+    let has_warnings = !warnings.is_empty();
+    let block_class = if warnings
+        .iter()
+        .any(|w| json_str(w, "severity") == "error")
+    {
+        "danger-block"
+    } else if has_warnings {
+        "warning-block"
+    } else {
+        "content-details"
+    };
+
+    Some(
+        view! {
+            <details class=block_class open=has_warnings>
+                <summary>
+                    {format!(
+                        "NFS Mounts ({} mount{})",
+                        mounts.len(),
+                        if mounts.len() == 1 { "" } else { "s" },
+                    )}
+                    {has_warnings.then(|| view! {
+                        <span class="badge badge-warning">
+                            {format!(
+                                "{} issue{}",
+                                warnings.len(),
+                                if warnings.len() == 1 { "" } else { "s" },
+                            )}
+                        </span>
+                    })}
+                </summary>
+
+                <table class="data-table">
+                    <thead>
+                        <tr>
+                            <th>"Mount Point"</th>
+                            <th>"Source"</th>
+                            <th>"Type"</th>
+                            <th>"Version"</th>
+                            <th>"rsize"</th>
+                            <th>"wsize"</th>
+                            <th>"hard/soft"</th>
+                            <th>"nconnect"</th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        {mounts
+                            .iter()
+                            .map(|mount| {
+                                let mountpoint = json_text(mount, "mountpoint");
+                                let source = json_text(mount, "source");
+                                let fstype = json_text(mount, "fstype");
+                                let vers = {
+                                    let v = json_text(mount, "vers");
+                                    if v.is_empty() { "—".to_string() } else { v }
+                                };
+                                let rsize = opt_num(mount, "rsize");
+                                let wsize = opt_num(mount, "wsize");
+                                let has_hard = json_bool(mount, "has_hard");
+                                let has_soft = json_bool(mount, "has_soft");
+                                let hardsoft = if has_soft {
+                                    "soft".to_string()
+                                } else if has_hard {
+                                    "hard".to_string()
+                                } else {
+                                    "default".to_string()
+                                };
+                                let nconnect = opt_num(mount, "nconnect");
+                                view! {
+                                    <tr>
+                                        <td><code>{mountpoint}</code></td>
+                                        <td><code>{source}</code></td>
+                                        <td>{fstype}</td>
+                                        <td>{vers}</td>
+                                        <td>{rsize}</td>
+                                        <td>{wsize}</td>
+                                        <td>{hardsoft}</td>
+                                        <td>{nconnect}</td>
+                                    </tr>
+                                }
+                            })
+                            .collect::<Vec<_>>()}
+                    </tbody>
+                </table>
+
+                {warnings
+                    .into_iter()
+                    .map(|warning| {
+                        let severity = json_str(&warning, "severity");
+                        let message = json_str(&warning, "message");
+                        let recommendation = json_str(&warning, "recommendation");
+                        let class = if severity == "error" {
+                            "danger-block"
+                        } else if severity == "warning" {
+                            "warning-block"
+                        } else {
+                            "info-block"
+                        };
+                        let heading = if severity == "error" {
+                            "Error"
+                        } else if severity == "warning" {
+                            "Warning"
+                        } else {
+                            "Info"
+                        };
+                        view! {
+                            <div class=class>
+                                <p>
+                                    <strong>{format!("{heading}:")}</strong>
+                                    " "
+                                    {message}
+                                </p>
+                                {(!recommendation.is_empty()).then(|| view! { <p>{recommendation}</p> })}
+                            </div>
+                        }
+                    })
+                    .collect::<Vec<_>>()}
+            </details>
+        }
+        .into_any(),
+    )
+}
+
+fn render_nvme_section(nvme: &Value) -> Option<AnyView> {
+    if !json_bool(nvme, "hasNVMe") {
+        return None;
+    }
+
+    let drive_count = nvme
+        .get("driveCount")
+        .and_then(|value| value.as_u64())
+        .unwrap_or(0);
+    let content = json_text(nvme, "content");
+
+    Some(
+        view! {
+            <details class="content-details">
+                <summary>{format!("NVMe Drives ({} detected)", drive_count)}</summary>
+                <pre class="json-dump">{content}</pre>
+            </details>
+        }
+        .into_any(),
+    )
+}
+
+fn render_raw_output_details(title: &str, content: String) -> Option<AnyView> {
+    if content.trim().is_empty() {
+        return None;
+    }
+
+    Some(
+        view! {
+            <details class="content-details">
+                <summary>{title.to_string()}</summary>
+                <pre class="json-dump">{content}</pre>
+            </details>
+        }
+        .into_any(),
+    )
+}
+
+fn json_text(value: &Value, key: &str) -> String {
+    value.get(key).and_then(value_as_text).unwrap_or_default()
+}
+
+fn value_as_text(value: &Value) -> Option<String> {
+    value
+        .as_str()
+        .map(|s| s.trim().to_string())
+        .filter(|s| !s.is_empty())
+        .or_else(|| value.as_i64().map(|v| v.to_string()))
+        .or_else(|| value.as_u64().map(|v| v.to_string()))
+        .or_else(|| {
+            value.as_f64().map(|v| {
+                if v.fract() == 0.0 {
+                    format!("{v:.0}")
+                } else {
+                    v.to_string()
+                }
+            })
+        })
+}
+
+fn empty_dash(value: String) -> String {
+    if value.trim().is_empty() {
+        "-".to_string()
+    } else {
+        value
+    }
+}
+
+fn format_df_size(raw: &str) -> String {
+    let trimmed = raw.trim();
+    if trimmed.is_empty() || trimmed == "-" {
+        return "-".to_string();
+    }
+
+    if trimmed.chars().all(|ch| ch.is_ascii_digit() || ch == '.') {
+        if let Ok(mut size) = trimmed.parse::<f64>() {
+            let units = ["B", "KB", "MB", "GB", "TB", "PB"];
+            let mut unit_index = 0usize;
+
+            if size > 1024.0 {
+                size *= 1024.0; // df often reports 1K blocks
+            }
+
+            while size >= 1024.0 && unit_index < units.len() - 1 {
+                size /= 1024.0;
+                unit_index += 1;
+            }
+
+            if unit_index == 0 {
+                format!("{size:.0} {}", units[unit_index])
+            } else if size >= 100.0 {
+                format!("{size:.0} {}", units[unit_index])
+            } else if size >= 10.0 {
+                format!("{size:.1} {}", units[unit_index])
+            } else {
+                format!("{size:.2} {}", units[unit_index])
+            }
+        } else {
+            trimmed.to_string()
+        }
+    } else {
+        trimmed.to_string()
+    }
+}
diff --git a/rca-tool/web-leptos/src/components/theme_toggle.rs b/rca-tool/web-leptos/src/components/theme_toggle.rs
new file mode 100644
index 0000000..c3a3654
--- /dev/null
+++ b/rca-tool/web-leptos/src/components/theme_toggle.rs
@@ -0,0 +1,81 @@
+use leptos::prelude::*;
+
+/// Three-way theme toggle: Dark → Light → Colorblind → Dark …
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Theme {
+    Dark,
+    Light,
+    Colorblind,
+}
+
+impl Theme {
+    pub fn class_name(self) -> &'static str {
+        match self {
+            Self::Dark => "dark-mode",
+            Self::Light => "",
+            Self::Colorblind => "colorblind-mode",
+        }
+    }
+
+    pub fn icon(self) -> &'static str {
+        match self {
+            Self::Dark => "DARK",
+            Self::Light => "LIGHT",
+            Self::Colorblind => "CB",
+        }
+    }
+
+    pub fn cycle(self) -> Self {
+        match self {
+            Self::Dark => Self::Colorblind,
+            Self::Colorblind => Self::Light,
+            Self::Light => Self::Dark,
+        }
+    }
+
+    /// Read from `localStorage`, falling back to `Dark`.
+    pub fn from_storage() -> Self {
+        let window = web_sys::window().unwrap();
+        let storage = window.local_storage().ok().flatten();
+        match storage.and_then(|s| s.get_item("theme").ok().flatten()) {
+            Some(ref v) if v.is_empty() => Self::Light,
+            Some(ref v) if v == "colorblind-mode" => Self::Colorblind,
+            _ => Self::Dark,
+        }
+    }
+
+    /// Persist to `localStorage`.
+    pub fn save(self) {
+        let window = web_sys::window().unwrap();
+        if let Ok(Some(storage)) = window.local_storage() {
+            let _ = storage.set_item("theme", self.class_name());
+        }
+    }
+}
+
+#[component]
+pub fn ThemeToggle(theme: ReadSignal<Theme>, set_theme: WriteSignal<Theme>) -> impl IntoView {
+    let toggle = move |_| {
+        let next = theme.get().cycle();
+        next.save();
+        set_theme.set(next);
+    };
+
+    let aria_label = move || match theme.get() {
+        Theme::Dark => "Switch to color-blind friendly mode",
+        Theme::Colorblind => "Switch to light mode",
+        Theme::Light => "Switch to dark mode",
+    };
+
+    view! {
+        <button
+            id="theme-toggle"
+            class="theme-toggle"
+            on:click=toggle
+            title="Toggle theme"
+            aria-label=aria_label
+        >
+            <span id="theme-icon">{move || theme.get().icon()}</span>
+        </button>
+    }
+}
diff --git a/rca-tool/web-leptos/src/main.rs b/rca-tool/web-leptos/src/main.rs
new file mode 100644
index 0000000..9d21ad6
--- /dev/null
+++ b/rca-tool/web-leptos/src/main.rs
@@ -0,0 +1,202 @@
+mod components;
+mod types;
+mod worker_bridge;
+
+use leptos::prelude::*;
+use web_sys::DragEvent;
+
+use components::analysis_view::AnalysisView;
+use components::drop_zone::{handle_file_list, DropZone};
+use components::progress_bar::ProgressBar;
+use components::theme_toggle::{Theme, ThemeToggle};
+use worker_bridge::{console_dbg, FileFormat, ProgressState, WorkerResult};
+
+fn main() {
+    // Initialise console_log so `log::info!()` etc. go to the browser console
+    console_log::init_with_level(log::Level::Debug).ok();
+    console_dbg!("[Leptos] Mounting app");
+
+    leptos::mount::mount_to_body(App);
+}
+
+#[component]
+fn App() -> impl IntoView {
+    // ── Theme ───────────────────────────────────────────────────────
+
+    let (theme, set_theme) = signal(Theme::from_storage());
+
+    // Apply theme class to <body>
+    Effect::new(move || {
+        let doc = web_sys::window().unwrap().document().unwrap();
+        let body = doc.body().unwrap();
+        body.set_class_name(theme.get().class_name());
+    });
+
+    // ── Debug mode (toggle mirrors original "?debug" query param) ───
+
+    let debug_mode = {
+        let loc = web_sys::window().unwrap().location();
+        let search = loc.search().unwrap_or_default();
+        if search.contains("debug") {
+            "true"
+        } else {
+            "false"
+        }
+    };
+
+    // ── Worker signals ──────────────────────────────────────────────
+
+    let (progress, set_progress) = signal(ProgressState::default());
+    let (result, set_result) = signal(WorkerResult::InProgress);
+    let (analysing, set_analysing) = signal(false);
+    let (filename, set_filename) = signal(String::new());
+    let (page_dragging, set_page_dragging) = signal(false);
+    let (drag_depth, set_drag_depth) = signal(0_u32);
+
+    // ── File callback ───────────────────────────────────────────────
+
+    let on_file = {
+        let debug_mode = debug_mode.to_string();
+        Callback::new(move |(name, buffer, fmt): (String, js_sys::ArrayBuffer, FileFormat)| {
+            console_dbg!(
+                "[Leptos] File received: {name} ({} bytes, {fmt})",
+                buffer.byte_length()
+            );
+
+            if fmt == FileFormat::Unknown {
+                set_result.set(WorkerResult::Error(format!(
+                    "Unsupported file format for \"{name}\""
+                )));
+                return;
+            }
+
+            set_filename.set(name.clone());
+            set_analysing.set(true);
+            set_progress.set(ProgressState::default());
+            set_result.set(WorkerResult::InProgress);
+
+            worker_bridge::launch_worker(
+                buffer,
+                name,
+                fmt,
+                debug_mode.clone(),
+                set_progress,
+                set_result,
+            );
+        })
+    };
+
+    let on_page_dragenter = move |ev: DragEvent| {
+        ev.prevent_default();
+        let next = drag_depth.get_untracked().saturating_add(1);
+        set_drag_depth.set(next);
+        set_page_dragging.set(true);
+    };
+
+    let on_page_dragover = move |ev: DragEvent| {
+        ev.prevent_default();
+        set_page_dragging.set(true);
+    };
+
+    let on_page_dragleave = move |ev: DragEvent| {
+        ev.prevent_default();
+        let next = drag_depth.get_untracked().saturating_sub(1);
+        set_drag_depth.set(next);
+        if next == 0 {
+            set_page_dragging.set(false);
+        }
+    };
+
+    let on_page_drop = {
+        let on_file = on_file.clone();
+        move |ev: DragEvent| {
+            ev.prevent_default();
+            set_drag_depth.set(0);
+            set_page_dragging.set(false);
+
+            if let Some(files) = ev.data_transfer().and_then(|dt| dt.files()) {
+                handle_file_list(files, on_file.clone());
+            }
+        }
+    };
+
+    // Derived: are we done?
+    let is_done = move || !matches!(result.get(), WorkerResult::InProgress);
+
+    view! {
+        <div
+            class=move || {
+                if page_dragging.get() {
+                    "page-drop-target page-drop-target--active"
+                } else {
+                    "page-drop-target"
+                }
+            }
+            on:dragenter=on_page_dragenter
+            on:dragover=on_page_dragover
+            on:dragleave=on_page_dragleave
+            on:drop=on_page_drop
+        >
+            <div class="container">
+                <header class="header">
+                    <h1>"RCA Tool"</h1>
+                    <ThemeToggle theme=theme set_theme=set_theme/>
+                </header>
+
+                <main class="main-content">
+                    // Show drop-zone when idle
+                    {move || {
+                        if !analysing.get() {
+                            Some(view! { <DropZone on_file=on_file.clone() dragging=page_dragging/> })
+                        } else {
+                            None
+                        }
+                    }}
+
+                    <div id="output" role="region" aria-live="polite" aria-label="Analysis results" tabindex="-1">
+                        // Show progress while analysing
+                        {move || {
+                            if analysing.get() && !is_done() {
+                                Some(view! {
+                                    <div class="analysis-header">
+                                        <h2>"Analysing " <code>{filename.get()}</code> " …"</h2>
+                                    </div>
+                                    <ProgressBar progress=progress/>
+                                })
+                            } else {
+                                None
+                            }
+                        }}
+
+                        // Show results or error
+                        {move || {
+                            if is_done() {
+                                Some(view! {
+                                    <div class="analysis-header">
+                                        <h2>{filename.get()}</h2>
+                                        <button
+                                            class="btn btn-secondary"
+                                            on:click=move |_| {
+                                                set_analysing.set(false);
+                                                set_result.set(WorkerResult::InProgress);
+                                            }
+                                        >
+                                            "Analyse another file"
+                                        </button>
+                                    </div>
+                                    <AnalysisView result=result/>
+                                })
+                            } else {
+                                None
+                            }
+                        }}
+                    </div>
+                </main>
+
+                <footer class="footer">
+                    <p>"RCA Tool — Leptos 0.8 CSR • Pure WASM, no server required"</p>
+                </footer>
+            </div>
+        </div>
+    }
+}
diff --git a/rca-tool/web-leptos/src/types.rs b/rca-tool/web-leptos/src/types.rs
new file mode 100644
index 0000000..829bb02
--- /dev/null
+++ b/rca-tool/web-leptos/src/types.rs
@@ -0,0 +1,16 @@
+/// Rust mirror of the analysis result object returned by the JS worker.
+///
+/// Fields are kept as `serde_json::Value` for now: the JS parsers evolve
+/// frequently and encoding every nested struct would couple the Leptos UI
+/// to parser internals. Individual components pull what they need via
+/// helper methods on [`AnalysisResult`].
+
+// ── Analysis result (flat bag of optional sections) ─────────────────
+
+/// The big analysis object.  Every field is optional because the worker
+/// The analysis result is kept as a plain `serde_json::Value` map.
+///
+/// The JS worker's output evolves frequently; trying to enumerate every
+/// field in a Rust struct is fragile (e.g. `files` can be `[string]` or
+/// `[{name,size}]`).  Sections pull what they need via JSON helpers.
+pub type AnalysisResult = serde_json::Value;
diff --git a/rca-tool/web-leptos/src/worker_bridge.rs b/rca-tool/web-leptos/src/worker_bridge.rs
new file mode 100644
index 0000000..e8d51d3
--- /dev/null
+++ b/rca-tool/web-leptos/src/worker_bridge.rs
@@ -0,0 +1,365 @@
+/// Bridge between the Leptos UI and the existing JS web-worker.
+///
+/// This module creates the same worker as the original JS app
+/// (`liblzma-streaming-worker.js`) and speaks the same message protocol:
+///
+///   UI  ──→  { command: "set_debug", enabled }
+///   UI  ──→  { cmd: "decompress_streaming", compressedData, chunkSize }
+///   UI  ──→  { cmd: "analyze_tar", tarData }
+///   UI  ──→  { cmd: "analyze_zip", zipData }
+///   UI  ──→  { cmd: "analyze_plaintext", textData }
+///   Worker  ──→  { ready: true }
+///   Worker  ──→  { progress, decompressed, currentFile, analysis }
+///   Worker  ──→  { success: true, analysis }
+///   Worker  ──→  { error: "..." }
+use leptos::prelude::*;
+use wasm_bindgen::prelude::*;
+use wasm_bindgen::JsCast;
+use web_sys::{MessageEvent, Worker};
+
+use crate::types::AnalysisResult;
+
+// ── Debug-log helper (mirrors per-parser console.log) ───────────────
+
+/// Log to the browser console at the "log" level.
+macro_rules! console_dbg {
+    ($($arg:tt)*) => {
+        web_sys::console::log_1(&format!($($arg)*).into())
+    };
+}
+pub(crate) use console_dbg;
+
+/// Log to the browser console at the "error" level.
+macro_rules! console_err {
+    ($($arg:tt)*) => {
+        web_sys::console::error_1(&format!($($arg)*).into())
+    };
+}
+pub(crate) use console_err;
+
+// ── File format detection ───────────────────────────────────────────
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum FileFormat {
+    Gzip,
+    Xz,
+    Zip,
+    PlainText,
+    Unknown,
+}
+
+impl std::fmt::Display for FileFormat {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Gzip => write!(f, "gzip"),
+            Self::Xz => write!(f, "xz"),
+            Self::Zip => write!(f, "zip"),
+            Self::PlainText => write!(f, "plaintext"),
+            Self::Unknown => write!(f, "unknown"),
+        }
+    }
+}
+
+pub fn detect_format(data: &[u8]) -> FileFormat {
+    if data.len() >= 6
+        && data[0] == 0xfd
+        && data[1] == 0x37
+        && data[2] == 0x7a
+        && data[3] == 0x58
+        && data[4] == 0x5a
+        && data[5] == 0x00
+    {
+        return FileFormat::Xz;
+    }
+    if data.len() >= 2 && data[0] == 0x1f && data[1] == 0x8b {
+        return FileFormat::Gzip;
+    }
+    if data.len() >= 4 && data[0] == 0x50 && data[1] == 0x4b && data[2] == 0x03 && data[3] == 0x04 {
+        return FileFormat::Zip;
+    }
+
+    // Heuristic for plain text (same as JS version)
+    let sample_size = data.len().min(512);
+    let mut printable = 0usize;
+    for &b in &data[..sample_size] {
+        if b == 0 {
+            return FileFormat::Unknown;
+        }
+        if (0x20..=0x7e).contains(&b) || b == 0x09 || b == 0x0a || b == 0x0d {
+            printable += 1;
+        }
+    }
+    if printable as f64 / sample_size as f64 > 0.8 {
+        FileFormat::PlainText
+    } else {
+        FileFormat::Unknown
+    }
+}
+
+// ── Progress state ──────────────────────────────────────────────────
+
+#[derive(Debug, Clone)]
+pub struct ProgressState {
+    pub percent: f64,
+    pub decompressed_bytes: f64,
+    pub file_count: u32,
+    pub current_file: String,
+    pub message: String,
+}
+
+impl Default for ProgressState {
+    fn default() -> Self {
+        Self {
+            percent: 0.0,
+            decompressed_bytes: 0.0,
+            file_count: 0,
+            current_file: String::new(),
+            message: "Preparing…".into(),
+        }
+    }
+}
+
+// ── Worker result ───────────────────────────────────────────────────
+
+#[derive(Debug, Clone)]
+pub enum WorkerResult {
+    InProgress,
+    Success {
+        analysis: AnalysisResult,
+        total_decompressed: f64,
+        partial: bool,
+    },
+    Error(String),
+}
+
+// ── Public API: launch analysis ─────────────────────────────────────
+
+fn asset_version() -> &'static str {
+    option_env!("ASSET_VERSION")
+        .or(option_env!("GITHUB_SHA"))
+        .unwrap_or("dev")
+}
+
+/// Spawn a web-worker, send it the file data, and reactively drive the
+/// supplied signals as messages arrive.
+///
+/// `buffer` is a JS-heap `ArrayBuffer` containing the entire file. It is
+/// intentionally **not** copied into wasm linear memory: it is held as a
+/// `JsValue` until the worker reports `ready`, then transferred (zero-copy)
+/// to the worker. This keeps wasm memory usage flat regardless of file
+/// size, allowing multi-GB archives without exhausting the wasm32 address
+/// space.
+///
+/// The caller passes in the signals it owns so the bridge never needs to
+/// know about the component tree.
+pub fn launch_worker(
+    buffer: js_sys::ArrayBuffer,
+    filename: String,
+    format: FileFormat,
+    debug_mode: String,
+    set_progress: WriteSignal<ProgressState>,
+    set_result: WriteSignal<WorkerResult>,
+) {
+    // Create a versioned worker URL so GitHub Pages does not serve stale
+    // worker/parser assets from a previous deployment during the post-deploy
+    // validation window.
+    let worker_url = format!(
+        "./assets/liblzma-streaming-worker.js?v={}",
+        asset_version()
+    );
+    let worker = match Worker::new(&worker_url) {
+        Ok(w) => w,
+        Err(e) => {
+            console_err!("[Leptos] Failed to create worker ({}): {:?}", worker_url, e);
+            set_result.set(WorkerResult::Error(format!(
+                "Failed to create worker: {e:?}"
+            )));
+            return;
+        }
+    };
+
+    console_dbg!(
+        "[Leptos] Worker created for {filename} ({} bytes, format={format}, url={})",
+        buffer.byte_length(),
+        worker_url
+    );
+
+    // Hold the ArrayBuffer (a JS-heap reference, NOT a wasm copy) until
+    // the worker signals `ready`, then hand it off via transfer.
+    let data_cell = std::cell::RefCell::new(Some(buffer));
+    let format_cell = std::cell::Cell::new(format);
+    let debug_mode_clone = debug_mode.clone();
+
+    // -- onmessage handler ------------------------------------------------
+    //
+    // We use manual js_sys::Reflect extraction instead of serde(untagged)
+    // because the worker's success message includes BOTH `success: true`
+    // AND `progress: 100`, which causes the untagged enum to match the
+    // Progress variant first, swallowing the result.
+    let onmessage = {
+        let worker_ref = worker.clone();
+        Closure::<dyn FnMut(MessageEvent)>::new(move |ev: MessageEvent| {
+            let js_val = ev.data();
+            let get = |key: &str| js_sys::Reflect::get(&js_val, &JsValue::from_str(key)).ok();
+
+            // ── ready ────────────────────────────────────────────
+            if get("ready").and_then(|v| v.as_bool()) == Some(true) {
+                console_dbg!("[Leptos] Worker ready, sending debug config + data");
+
+                let dbg_obj = js_sys::Object::new();
+                js_sys::Reflect::set(&dbg_obj, &"command".into(), &"set_debug".into()).ok();
+                js_sys::Reflect::set(
+                    &dbg_obj,
+                    &"enabled".into(),
+                    &JsValue::from_str(&debug_mode_clone),
+                )
+                .ok();
+                worker_ref.post_message(&dbg_obj).ok();
+
+                if let Some(buf) = data_cell.borrow_mut().take() {
+                    let fmt = format_cell.get();
+                    send_data_to_worker(&worker_ref, buf, fmt);
+                }
+                return;
+            }
+
+            // ── error ────────────────────────────────────────────
+            if let Some(err_val) = get("error") {
+                if let Some(msg) = err_val.as_string() {
+                    console_err!("[Leptos] Worker error: {msg}");
+                    set_result.set(WorkerResult::Error(msg));
+                    worker_ref.terminate();
+                    return;
+                }
+            }
+
+            // ── success (check BEFORE progress — the success
+            //    message also carries `progress: 100`) ────────────
+            if get("success").and_then(|v| v.as_bool()) == Some(true) {
+                let partial = get("partialSuccess")
+                    .and_then(|v| v.as_bool())
+                    .unwrap_or(false);
+                let total_dec = get("totalDecompressed")
+                    .and_then(|v| v.as_f64())
+                    .unwrap_or(0.0);
+
+                // Deserialize the analysis object
+                let analysis_js = get("analysis").unwrap_or(JsValue::NULL);
+                let analysis: AnalysisResult = match serde_wasm_bindgen::from_value(analysis_js) {
+                    Ok(a) => a,
+                    Err(e) => {
+                        console_err!("[Leptos] Failed to deserialize analysis: {e:?}");
+                        set_result
+                            .set(WorkerResult::Error(format!("Deserialization error: {e:?}")));
+                        worker_ref.terminate();
+                        return;
+                    }
+                };
+
+                let fc = analysis
+                    .get("fileCount")
+                    .and_then(|v| v.as_u64())
+                    .unwrap_or(0);
+                console_dbg!("[Leptos] Worker success (partial={partial}): {fc} files");
+                set_result.set(WorkerResult::Success {
+                    analysis,
+                    total_decompressed: total_dec,
+                    partial,
+                });
+                worker_ref.terminate();
+                return;
+            }
+
+            // ── progress (the common streaming case) ─────────────
+            if let Some(pct) = get("progress").and_then(|v| v.as_f64()) {
+                let decompressed = get("decompressed").and_then(|v| v.as_f64()).unwrap_or(0.0);
+                let current_file = get("currentFile")
+                    .and_then(|v| v.as_string())
+                    .unwrap_or_default();
+                let file_count = get("analysis")
+                    .and_then(|a| js_sys::Reflect::get(&a, &"fileCount".into()).ok())
+                    .and_then(|v| v.as_f64())
+                    .unwrap_or(0.0) as u32;
+                let msg_text = get("message")
+                    .and_then(|v| v.as_string())
+                    .unwrap_or_default();
+
+                set_progress.set(ProgressState {
+                    percent: pct,
+                    decompressed_bytes: decompressed,
+                    file_count,
+                    current_file,
+                    message: msg_text,
+                });
+                return;
+            }
+
+            console_dbg!("[Leptos] Ignoring unrecognised worker message");
+        })
+    };
+
+    worker.set_onmessage(Some(onmessage.as_ref().unchecked_ref()));
+    onmessage.forget(); // prevent GC
+
+    // -- onerror handler --------------------------------------------------
+    let onerror = {
+        let set_result = set_result.clone();
+        Closure::<dyn FnMut(web_sys::ErrorEvent)>::new(move |ev: web_sys::ErrorEvent| {
+            let msg = ev.message();
+            console_err!("[Leptos] Worker onerror: {msg}");
+            set_result.set(WorkerResult::Error(msg));
+        })
+    };
+    worker.set_onerror(Some(onerror.as_ref().unchecked_ref()));
+    onerror.forget();
+}
+
+// ── Helpers ─────────────────────────────────────────────────────────
+
+/// Forward the file's `ArrayBuffer` to the worker via structured-clone
+/// transfer. The buffer is moved (zero-copy): after this call the JS-heap
+/// allocation is owned by the worker thread and the main thread no longer
+/// holds a reference, so peak memory stays at one copy regardless of
+/// file size.
+fn send_data_to_worker(worker: &Worker, buffer: js_sys::ArrayBuffer, format: FileFormat) {
+    let obj = js_sys::Object::new();
+    match format {
+        FileFormat::Xz => {
+            js_sys::Reflect::set(&obj, &"cmd".into(), &"decompress_streaming".into()).ok();
+            js_sys::Reflect::set(&obj, &"compressedData".into(), &buffer).ok();
+            js_sys::Reflect::set(&obj, &"chunkSize".into(), &(256 * 1024).into()).ok();
+        }
+        FileFormat::Gzip => {
+            // Gzip: send as analyze_tar after pako decompression.
+            // For the MVP we send raw gzip to the worker via decompress_streaming
+            // (the worker handles gzip → tar internally for the gzip command).
+            // Actually the original JS does pako decompression in the main thread
+            // then sends analyze_tar. For simplicity in the Leptos port we'll
+            // send as XZ-style streaming and let the worker handle it, but the
+            // worker only handles XZ in streaming mode. So for gzip we need to
+            // do pako in JS. We'll address gzip in a follow-up; for now XZ and
+            // plaintext are the primary paths.
+            js_sys::Reflect::set(&obj, &"cmd".into(), &"analyze_tar".into()).ok();
+            js_sys::Reflect::set(&obj, &"tarData".into(), &buffer).ok();
+        }
+        FileFormat::Zip => {
+            js_sys::Reflect::set(&obj, &"cmd".into(), &"analyze_zip".into()).ok();
+            js_sys::Reflect::set(&obj, &"zipData".into(), &buffer).ok();
+        }
+        FileFormat::PlainText => {
+            js_sys::Reflect::set(&obj, &"cmd".into(), &"analyze_plaintext".into()).ok();
+            js_sys::Reflect::set(&obj, &"textData".into(), &buffer).ok();
+        }
+        FileFormat::Unknown => {
+            console_err!("[Leptos] Unknown format, cannot send to worker");
+            return;
+        }
+    };
+
+    let transfer = js_sys::Array::new();
+    transfer.push(&buffer);
+
+    if let Err(e) = worker.post_message_with_transfer(&obj, &transfer) {
+        console_err!("[Leptos] Failed to post message to worker: {e:?}");
+    }
+}
diff --git a/rca-tool/web-leptos/styles.css b/rca-tool/web-leptos/styles.css
new file mode 100644
index 0000000..a3e496f
--- /dev/null
+++ b/rca-tool/web-leptos/styles.css
@@ -0,0 +1,789 @@
+/* CSS Variables for Light and Dark Mode */
+:root {
+    --bg-color: #f0f0f0;
+    --text-color: #333;
+    --card-bg: white;
+    --card-shadow: rgba(0,0,0,0.1);
+    --accent-color: #007bff;
+    --muted-text: #666;
+    --border-color: #ccc;
+    
+    /* Semantic colors */
+    --success-color: #28a745;
+    --danger-color: #dc3545;
+    --warning-color: #ffc107;
+    --info-color: #17a2b8;
+    --warning-text: #856404;
+    --danger-dark: #721c24;
+    --info-dark: #0c5460;
+    
+    /* Code and inline elements */
+    --code-bg: #f8f9fa;
+    --code-border: #e9ecef;
+    --progress-bg: #f0f0f0;
+    
+    /* Drop zone colors */
+    --dropzone-bg: #e3f2fd;
+    --dropzone-border: #007bff;
+    --dropzone-bg-active: #cce5ff;
+}
+
+body.dark-mode {
+    --bg-color: #1a1a1a;
+    --text-color: #e0e0e0;
+    --card-bg: #2d2d2d;
+    --card-shadow: rgba(0,0,0,0.3);
+    --accent-color: #4a9eff;
+    --muted-text: #aaa;
+    --border-color: #444;
+    
+    /* Semantic colors - adjusted for dark mode (WCAG AA contrast with white text) */
+    --success-color: #2e8b57;
+    --danger-color: #c62828;
+    --warning-color: #ffb74d;
+    --info-color: #0277bd;
+    --warning-text: #ffb74d;
+    --danger-dark: #ef5350;
+    --info-dark: #29b6f6;
+    
+    /* Code and inline elements */
+    --code-bg: #3a3a3a;
+    --code-border: #4a4a4a;
+    --progress-bg: #2d2d2d;
+    
+    /* Drop zone colors */
+    --dropzone-bg: #1e3a5f;
+    --dropzone-border: #4a9eff;
+    --dropzone-bg-active: #2a4a7f;
+}
+
+/* Color-Blind Friendly Mode (IBM Color Blind Safe Palette) */
+body.colorblind-mode {
+    --bg-color: #f5f5f5;
+    --text-color: #2d2d2d;
+    --card-bg: white;
+    --card-shadow: rgba(0,0,0,0.1);
+    --accent-color: #648FFF;
+    --muted-text: #666;
+    --border-color: #bbb;
+    
+    /* Semantic colors - optimized for color blindness */
+    --success-color: #648FFF; /* Blue instead of green */
+    --danger-color: #DC267F; /* Magenta instead of red */
+    --warning-color: #FFB000; /* Yellow - highly visible */
+    --info-color: #785EF0; /* Purple for info */
+    --warning-text: #B37800;
+    --danger-dark: #A01B5E;
+    --info-dark: #5940B8;
+    
+    /* Code and inline elements */
+    --code-bg: #f8f9fa;
+    --code-border: #e1e4e8;
+    --progress-bg: #e8e8e8;
+    
+    /* Drop zone colors */
+    --dropzone-bg: #E6EDFF;
+    --dropzone-border: #648FFF;
+    --dropzone-bg-active: #D4E0FF;
+}
+
+/* Base Styles */
+body {
+    font-family: Arial, sans-serif;
+    margin: 0;
+    padding: 20px;
+    background-color: var(--bg-color);
+    color: var(--text-color);
+    transition: background-color 0.3s, color 0.3s;
+    min-height: 100vh;
+    box-sizing: border-box;
+}
+
+*,
+*::before,
+*::after {
+    box-sizing: inherit;
+}
+
+.page-drop-target {
+    min-height: calc(100vh - 40px);
+    border-radius: 12px;
+}
+
+.page-drop-target--active {
+    outline: 2px dashed var(--accent-color);
+    outline-offset: 6px;
+}
+
+h1 {
+    text-align: center;
+    color: var(--text-color);
+    margin-bottom: 30px;
+}
+
+.header {
+    position: relative;
+}
+
+.main-content {
+    margin-top: 10px;
+}
+
+.footer {
+    text-align: center;
+    color: var(--muted-text);
+    margin-top: 24px;
+    font-size: 0.95rem;
+}
+
+.footer p {
+    margin: 0;
+}
+
+.container {
+    width: 100%;
+    max-width: none;
+    margin: 0;
+    position: relative;
+}
+
+.main-content,
+#output,
+.analysis-header,
+details.success-block,
+details.warning-block,
+details.danger-block,
+details.info-block,
+details.content-details,
+.section-body,
+.subsection,
+.subsection-danger,
+.warning-box,
+.json-dump {
+    width: 100%;
+    max-width: 100%;
+    min-width: 0;
+}
+
+/* Info Box Styles */
+.info {
+    background: var(--card-bg);
+    padding: 15px;
+    border-radius: 5px;
+    margin-bottom: 20px;
+    box-shadow: 0 2px 5px var(--card-shadow);
+    transition: background-color 0.3s, box-shadow 0.3s;
+}
+
+.info h3 {
+    margin-top: 0;
+    color: var(--accent-color);
+}
+
+.info ul {
+    margin: 10px 0;
+    padding-left: 20px;
+}
+
+/* Loading Indicator */
+#loading {
+    text-align: center;
+    padding: 20px;
+    color: var(--muted-text);
+}
+
+/* Theme Toggle Button */
+#theme-toggle,
+.theme-toggle {
+    position: fixed;
+    top: 20px;
+    right: 20px;
+    width: 50px;
+    height: 50px;
+    border-radius: 50%;
+    border: 2px solid var(--border-color);
+    background: var(--card-bg);
+    color: var(--text-color);
+    cursor: pointer;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    font-size: 14px;
+    font-weight: bold;
+    box-shadow: 0 2px 5px var(--card-shadow);
+    transition: all 0.3s;
+    z-index: 1000;
+}
+
+#theme-toggle:hover,
+.theme-toggle:hover {
+    transform: scale(1.1);
+}
+
+#theme-toggle:focus,
+.theme-toggle:focus {
+    outline: 2px solid var(--accent-color);
+    outline-offset: 2px;
+}
+
+/* Drop Zone Styles */
+#drop-zone,
+.drop-zone {
+    border: 2px dashed var(--border-color);
+    border-radius: 10px;
+    width: 100%;
+    max-width: 100%;
+    min-height: 200px;
+    text-align: center;
+    padding: 20px;
+    margin: 20px 0;
+    font-family: Arial, sans-serif;
+    display: flex;
+    flex-direction: column;
+    justify-content: center;
+    align-items: center;
+    background-color: var(--card-bg);
+    transition: background-color 0.3s, border-color 0.3s;
+}
+
+#drop-zone.drop-zone--active,
+.drop-zone.drop-zone--active {
+    background-color: var(--dropzone-bg-active);
+    border-color: var(--accent-color);
+}
+
+#drop-zone h2,
+.drop-zone h2 {
+    color: var(--text-color);
+    margin: 0 0 10px 0;
+}
+
+#drop-zone p,
+.drop-zone p {
+    color: var(--text-color);
+    margin: 5px 0;
+}
+
+.drop-zone__support-note {
+    font-size: 0.9em;
+}
+
+/* File Input Styles */
+#file-input,
+.drop-zone__input {
+    padding: 12px;
+    margin: 15px;
+    font-size: 16px;
+    cursor: pointer;
+    border: 2px solid var(--accent-color);
+    border-radius: 5px;
+    background: var(--card-bg);
+    color: var(--text-color);
+    transition: all 0.3s;
+}
+
+/* Detection Warning Styles */
+.detection-warning {
+    margin-top: 15px;
+    padding: 12px 15px;
+    font-size: 0.85em;
+    color: var(--warning-text, #856404);
+    background-color: var(--warning-bg, #fff3cd);
+    border: 1px solid var(--warning-border, #ffc107);
+    border-radius: 5px;
+    text-align: left;
+    max-width: 600px;
+    margin-left: auto;
+    margin-right: auto;
+}
+
+/* Content Block Styles - Dark Mode Variables */
+body.dark-mode {
+    --success-bg: #1e4620;
+    --success-text: #a8d5a8;
+    --success-border: #4caf50;
+    --warning-bg: #5a4a1f;
+    --warning-text: #f5d98f;
+    --warning-border: #ffc107;
+    --danger-bg: #4a1f1f;
+    --danger-text: #f5a8a8;
+    --danger-border: #dc3545;
+    --info-bg: #1f3a4a;
+    --info-text: #a8c8d8;
+    --info-border: #17a2b8;
+    --content-bg: #2d2d2d;
+    --content-border: #444;
+}
+
+/* Content Block Styles - Light Mode Variables */
+body:not(.dark-mode):not(.colorblind-mode) {
+    --success-bg: #d4edda;
+    --success-text: #155724;
+    --success-border: #28a745;
+    --warning-bg: #fff3cd;
+    --warning-text: #856404;
+    --warning-border: #ffc107;
+    --danger-bg: #f8d7da;
+    --danger-text: #721c24;
+    --danger-border: #dc3545;
+    --info-bg: #d1ecf1;
+    --info-text: #0c5460;
+    --info-border: #17a2b8;
+    --content-bg: white;
+    --content-border: #dee2e6;
+}
+
+/* Content Block Styles - Color-Blind Mode Variables */
+body.colorblind-mode {
+    --success-bg: #E6EDFF;
+    --success-text: #2D4AA8;
+    --success-border: #648FFF;
+    --warning-bg: #FFF5E0;
+    --warning-text: #B37800;
+    --warning-border: #FFB000;
+    --danger-bg: #FCE4F0;
+    --danger-text: #A01B5E;
+    --danger-border: #DC267F;
+    --info-bg: #F0EBFF;
+    --info-text: #5940B8;
+    --info-border: #785EF0;
+    --content-bg: white;
+    --content-border: #d0d0d0;
+}
+
+/* Success Block */
+.success-block {
+    background: var(--success-bg, #d4edda);
+    color: var(--success-text, #155724);
+    padding: 15px;
+    border-radius: 5px;
+    border-left: 4px solid var(--success-border, #28a745);
+    margin-bottom: 15px;
+}
+
+/* Warning Block */
+.warning-block {
+    background: var(--warning-bg);
+    color: var(--warning-text);
+    padding: 15px;
+    border-radius: 5px;
+    border-left: 4px solid var(--warning-border);
+    margin-bottom: 15px;
+}
+
+/* Danger Block */
+.danger-block {
+    background: var(--danger-bg);
+    color: var(--danger-text);
+    padding: 15px;
+    border-radius: 5px;
+    border-left: 4px solid var(--danger-border);
+    margin-bottom: 15px;
+}
+
+/* Info Block */
+.info-block {
+    background: var(--info-bg);
+    color: var(--info-text);
+    padding: 15px;
+    border-radius: 5px;
+    border-left: 4px solid var(--info-border);
+    margin-bottom: 15px;
+}
+
+/* Content Details */
+.content-details {
+    background: var(--content-bg);
+    padding: 15px;
+    border-radius: 5px;
+    border: 1px solid var(--content-border);
+    margin-bottom: 15px;
+}
+
+.content-details summary {
+    cursor: pointer;
+    font-weight: bold;
+    user-select: none;
+    color: var(--text-color);
+}
+
+/* Utility Classes for Text Colors */
+.text-success { color: var(--success-color); }
+.text-danger { color: var(--danger-color); }
+.text-warning { color: var(--warning-color); }
+.text-info { color: var(--info-color); }
+.text-muted { color: var(--muted-text); }
+.text-warning-dark { color: var(--warning-text); }
+.text-danger-dark { color: var(--danger-dark); }
+.text-info-dark { color: var(--info-dark); }
+
+/* Utility Classes for Backgrounds */
+.bg-code { background: var(--code-bg); }
+.bg-card { background: var(--card-bg); }
+
+/* Code Elements */
+code {
+    background: var(--code-bg);
+    padding: 2px 6px;
+    border-radius: 3px;
+    font-family: monospace;
+    font-size: 0.9em;
+}
+
+/* Badge Styles */
+.badge {
+    padding: 1px 5px;
+    border-radius: 3px;
+    font-size: 11px;
+    margin-left: 5px;
+    display: inline-block;
+}
+
+.badge-success {
+    background: var(--success-color);
+    color: white;
+}
+
+.badge-danger {
+    background: var(--danger-color);
+    color: white;
+}
+
+.badge-warning {
+    background: var(--warning-color);
+    color: #000;
+}
+
+.badge-info {
+    background: var(--info-color);
+    color: white;
+}
+
+/* Progress Bar */
+.progress-container {
+    margin: 12px 0 18px;
+    padding: 14px 16px;
+    background: var(--card-bg);
+    border: 1px solid var(--border-color);
+    border-radius: 10px;
+    box-shadow: 0 2px 8px var(--card-shadow);
+}
+
+.progress-meta {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 12px;
+    margin-bottom: 8px;
+}
+
+.progress-title,
+.progress-label {
+    color: var(--accent-color);
+    font-weight: bold;
+    text-align: left;
+}
+
+.progress-percent {
+    color: var(--text-color);
+    font-weight: bold;
+    font-variant-numeric: tabular-nums;
+}
+
+.progress-bar-wrapper {
+    margin: 10px auto;
+    max-width: 100%;
+}
+
+.progress-bar {
+    width: 100%;
+    height: 14px;
+    appearance: none;
+    -webkit-appearance: none;
+    border: none;
+    border-radius: 999px;
+    overflow: hidden;
+    background: var(--progress-bg);
+    accent-color: var(--accent-color);
+}
+
+.progress-bar::-webkit-progress-bar {
+    background: var(--progress-bg);
+    border-radius: 999px;
+}
+
+.progress-bar::-webkit-progress-value {
+    background: var(--accent-color);
+    border-radius: 999px;
+    transition: width 0.3s ease;
+}
+
+.progress-bar::-moz-progress-bar {
+    background: var(--accent-color);
+    border-radius: 999px;
+    transition: width 0.3s ease;
+}
+
+.progress-fill {
+    width: 0%;
+    background: var(--accent-color);
+    height: 12px;
+    border-radius: 3px;
+    transition: width 0.3s;
+}
+
+.progress-message,
+.progress-text {
+    font-size: 12px;
+    color: var(--muted-text);
+    margin: 8px 0 0;
+    text-align: left;
+}
+
+.progress-stats {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 8px;
+    margin-top: 10px;
+}
+
+.progress-stats > span {
+    padding: 4px 8px;
+    border-radius: 999px;
+    background: var(--code-bg);
+    border: 1px solid var(--code-border);
+    color: var(--muted-text);
+    font-size: 12px;
+}
+
+.progress-stats__current {
+    flex: 1 1 100%;
+    max-width: 100%;
+    overflow: hidden;
+    text-align: left;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+}
+
+/* List Item Styles */
+.event-item {
+    margin: 8px 0;
+    font-size: 13px;
+    border-bottom: 1px solid var(--code-border);
+    padding-bottom: 8px;
+}
+
+.event-timestamp {
+    font-weight: bold;
+    font-size: 12px;
+    margin-bottom: 3px;
+}
+
+.event-details {
+    font-size: 11px;
+    color: var(--muted-text);
+    margin-top: 3px;
+}
+
+.event-raw-line {
+    font-size: 10px;
+    color: var(--muted-text);
+    font-family: monospace;
+    display: block;
+    margin-top: 4px;
+    padding: 4px;
+    background: var(--code-bg);
+    border-radius: 2px;
+    overflow-x: auto;
+    white-space: pre-wrap;
+    overflow-wrap: anywhere;
+    word-break: break-word;
+}
+
+/* Subsection Styles */
+.subsection {
+    margin-top: 15px;
+    padding: 10px;
+    background: var(--card-bg);
+    border-radius: 3px;
+}
+
+.subsection-danger {
+    margin-top: 15px;
+    padding: 10px;
+    background: var(--card-bg);
+    border-radius: 3px;
+    border-left: 3px solid var(--danger-color);
+}
+
+.analysis-header {
+    margin: 10px 0 16px;
+}
+
+.analysis-header h2 {
+    margin: 0 0 10px 0;
+    word-break: break-word;
+}
+
+.btn {
+    border: 1px solid var(--border-color);
+    background: var(--card-bg);
+    color: var(--text-color);
+    padding: 8px 12px;
+    border-radius: 4px;
+    cursor: pointer;
+    transition: border-color 0.2s, color 0.2s, background-color 0.2s;
+}
+
+.btn:hover {
+    border-color: var(--accent-color);
+}
+
+.btn-secondary:hover {
+    color: var(--accent-color);
+}
+
+details.success-block,
+details.warning-block,
+details.danger-block,
+details.info-block,
+details.content-details {
+    box-shadow: 0 2px 8px var(--card-shadow);
+}
+
+details > summary {
+    cursor: pointer;
+    font-weight: bold;
+    user-select: none;
+}
+
+.section-body {
+    margin-top: 15px;
+}
+
+.kv-table {
+    width: 100%;
+    border-collapse: collapse;
+}
+
+.kv-table td {
+    padding: 4px 0;
+    vertical-align: top;
+}
+
+.kv-label {
+    width: 210px;
+    padding-right: 16px !important;
+    font-weight: bold;
+}
+
+.kv-value {
+    word-break: break-word;
+}
+
+.data-table {
+    width: 100%;
+    border-collapse: collapse;
+    background: var(--content-bg);
+    border: 1px solid var(--content-border);
+    border-radius: 6px;
+    overflow: hidden;
+}
+
+.data-table th,
+.data-table td {
+    padding: 8px 10px;
+    text-align: left;
+    border-bottom: 1px solid var(--content-border);
+    white-space: normal;
+    overflow-wrap: anywhere;
+    word-break: break-word;
+}
+
+.data-table tr:last-child td {
+    border-bottom: 0;
+}
+
+.json-dump {
+    background: var(--code-bg);
+    border: 1px solid var(--code-border);
+    border-radius: 6px;
+    padding: 12px;
+    overflow-x: auto;
+}
+
+.vm-inline-row {
+    margin: 5px 0;
+}
+
+.subsection-title {
+    margin: 0 0 8px 0;
+    font-weight: bold;
+}
+
+.property-grid {
+    display: grid;
+    grid-template-columns: max-content 1fr;
+    gap: 6px 14px;
+    align-items: center;
+}
+
+.property-label {
+    font-weight: bold;
+}
+
+.property-value {
+    min-width: 0;
+}
+
+.disk-list {
+    margin: 6px 0 0;
+    padding-left: 20px;
+}
+
+.disk-list li {
+    margin: 3px 0;
+}
+
+.vm-note {
+    margin-top: 10px;
+    padding: 8px 10px;
+    border-radius: 4px;
+    border-left: 3px solid var(--content-border);
+    background: rgba(0, 0, 0, 0.08);
+}
+
+.vm-note.warning {
+    background: var(--warning-bg);
+    border-left-color: var(--warning-border);
+}
+
+.vm-note.info {
+    background: var(--info-bg);
+    border-left-color: var(--info-border);
+}
+
+/* Experimental CSS for text wrapping */
+pre {
+    white-space: pre-wrap;
+    word-break: break-word;
+}
+
+.danger-block p {
+    white-space: normal;
+}
+
+/* Warning Box */
+.warning-box {
+    margin-top: 15px;
+    padding: 12px;
+    background: var(--card-bg);
+    border-radius: 3px;
+    border-left: 3px solid var(--danger-color);
+    max-width: 100%;
+    box-sizing: border-box;
+    overflow-wrap: break-word;
+    word-break: break-word;
+    white-space: normal;
+}
+