@attraccess/plugin-wago 0.1.0-alpha.0 → 0.1.0-nightly.1002.1

package/frontend/{__federation_expose_Plugin-BoHSTQq7.js → __federation_expose_Plugin-B8WKMfaS.js}

@@ -65,24 +65,24 @@ function createPluginApiClient(basePath = "") {
 var RESOURCE_OVERVIEW_SLOT = "resource.overview";
 //#endregion
 //#region frontend/src/api.ts
-var api$6 = createPluginApiClient("/api/wago");
+var api$5 = createPluginApiClient("/api/wago");
 var hostApi = createPluginApiClient("/api");
-var listControllers = () => api$6.request("/controllers");
-var getSettings = () => api$6.request("/settings");
-var setSettings = (defaultMqttServerId) => api$6.request("/settings", {
+var listControllers = () => api$5.request("/controllers");
+var getSettings = () => api$5.request("/settings");
+var setSettings = (defaultMqttServerId) => api$5.request("/settings", {
 	method: "POST",
 	body: { defaultMqttServerId }
 });
 var listMqttServers = () => hostApi.request("/mqtt/servers");
-var claimController = (id, input) => api$6.request(`/controllers/${id}/claim`, {
+var claimController = (id, input) => api$5.request(`/controllers/${id}/claim`, {
 	method: "POST",
 	body: input
 });
-var createCommissioningSession = (input) => api$6.request("/commissioning/sessions", {
+var createCommissioningSession = (input) => api$5.request("/commissioning/sessions", {
 	method: "POST",
 	body: input
 });
-var confirmCommissioningHostKey = (id, hostKeyFingerprint, physicalIdentityConfirmed = false) => api$6.request(`/commissioning/sessions/${id}/confirm-host-key`, {
+var confirmCommissioningHostKey = (id, hostKeyFingerprint, physicalIdentityConfirmed = false) => api$5.request(`/commissioning/sessions/${id}/confirm-host-key`, {
 	method: "POST",
 	body: {
 		hostKeyFingerprint,
@@ -90,22 +90,22 @@ var confirmCommissioningHostKey = (id, hostKeyFingerprint, physicalIdentityConfi
 		trustMethod: physicalIdentityConfirmed ? "isolated_service_connection" : "trusted_inventory"
 	}
 });
-var listCommissioningSessions = (limit = 100, offset = 0) => api$6.request(`/commissioning/sessions?limit=${limit}&offset=${offset}`);
-var getCommissioningVerification = (id) => api$6.request(`/commissioning/sessions/${id}/verification`);
-var getCommissioningSupport = () => api$6.request("/commissioning/support");
-var deliverCommissioningSession = (id, input) => api$6.request(`/commissioning/sessions/${id}/deliver`, {
+var listCommissioningSessions = (limit = 100, offset = 0) => api$5.request(`/commissioning/sessions?limit=${limit}&offset=${offset}`);
+var getCommissioningVerification = (id) => api$5.request(`/commissioning/sessions/${id}/verification`);
+var getCommissioningSupport = () => api$5.request("/commissioning/support");
+var deliverCommissioningSession = (id, input) => api$5.request(`/commissioning/sessions/${id}/deliver`, {
 	method: "POST",
 	body: input
 });
-var recoverCommissioningSession = (id, input) => api$6.request(`/commissioning/sessions/${id}/recover`, {
+var recoverCommissioningSession = (id, input) => api$5.request(`/commissioning/sessions/${id}/recover`, {
 	method: "POST",
 	body: input
 });
-var removeCommissioningSession = (id) => api$6.request(`/commissioning/sessions/${id}`, { method: "DELETE" });
-var removeController = (id) => api$6.request(`/controllers/${id}`, { method: "DELETE" });
-var getDraft = (id) => api$6.request(`/controllers/${id}/configuration/draft`);
-var getConfigurationBaseline = (id) => api$6.request(`/controllers/${id}/configuration/baseline`);
-var saveDraft = (id, snapshot, metadata, expectedDraft) => api$6.request(`/controllers/${id}/configuration/draft`, {
+var removeCommissioningSession = (id) => api$5.request(`/commissioning/sessions/${id}`, { method: "DELETE" });
+var removeController = (id) => api$5.request(`/controllers/${id}`, { method: "DELETE" });
+var getDraft = (id) => api$5.request(`/controllers/${id}/configuration/draft`);
+var getConfigurationBaseline = (id) => api$5.request(`/controllers/${id}/configuration/baseline`);
+var saveDraft = (id, snapshot, metadata, expectedDraft) => api$5.request(`/controllers/${id}/configuration/draft`, {
 	method: "POST",
 	body: {
 		snapshot,
@@ -113,15 +113,15 @@ var saveDraft = (id, snapshot, metadata, expectedDraft) => api$6.request(`/contr
 		expectedDraft
 	}
 });
-var listPresets = () => api$6.request("/configuration/presets");
-var previewPreset = (id, application, snapshot) => api$6.request(`/controllers/${id}/configuration/presets/preview`, {
+var listPresets = () => api$5.request("/configuration/presets");
+var previewPreset = (id, application, snapshot) => api$5.request(`/controllers/${id}/configuration/presets/preview`, {
 	method: "POST",
 	body: {
 		application,
 		snapshot
 	}
 });
-var applyPreset = (id, application, selectedPaths, previewedDraftHash, snapshot) => api$6.request(`/controllers/${id}/configuration/presets/apply`, {
+var applyPreset = (id, application, selectedPaths, previewedDraftHash, snapshot) => api$5.request(`/controllers/${id}/configuration/presets/apply`, {
 	method: "POST",
 	body: {
 		application,
@@ -130,28 +130,28 @@ var applyPreset = (id, application, selectedPaths, previewedDraftHash, snapshot)
 		snapshot
 	}
 });
-var validateConfiguration = (id, snapshot) => api$6.request(`/controllers/${id}/configuration/validate`, {
+var validateConfiguration = (id, snapshot) => api$5.request(`/controllers/${id}/configuration/validate`, {
 	method: "POST",
 	body: { snapshot }
 });
-var reviewConfiguration = (id) => api$6.request(`/controllers/${id}/configuration/review`, { method: "POST" });
-var publishConfiguration = (id, force, reviewedHash) => api$6.request(`/controllers/${id}/configuration/publish`, {
+var reviewConfiguration = (id) => api$5.request(`/controllers/${id}/configuration/review`, { method: "POST" });
+var publishConfiguration = (id, force, reviewedHash) => api$5.request(`/controllers/${id}/configuration/publish`, {
 	method: "POST",
 	body: {
 		force,
 		reviewedHash
 	}
 });
-var listConfigurationRevisions = (id, offset) => api$6.request(`/controllers/${id}/configuration/revisions?offset=${offset}&limit=20`);
-var previewConfigurationRevision = (id, revision) => api$6.request(`/controllers/${id}/configuration/revisions/${revision}/preview`);
-var acknowledgeConfigurationRejection = (id, revision, contentHash, reportedAt) => api$6.request(`/controllers/${id}/configuration/revisions/${revision}/acknowledge-rejection`, {
+var listConfigurationRevisions = (id, offset) => api$5.request(`/controllers/${id}/configuration/revisions?offset=${offset}&limit=20`);
+var previewConfigurationRevision = (id, revision) => api$5.request(`/controllers/${id}/configuration/revisions/${revision}/preview`);
+var acknowledgeConfigurationRejection = (id, revision, contentHash, reportedAt) => api$5.request(`/controllers/${id}/configuration/revisions/${revision}/acknowledge-rejection`, {
 	method: "POST",
 	body: {
 		contentHash,
 		reportedAt
 	}
 });
-var rollbackConfiguration = (id, revision, force, sourceHash, currentHash, draftHash) => api$6.request(`/controllers/${id}/configuration/rollback/${revision}`, {
+var rollbackConfiguration = (id, revision, force, sourceHash, currentHash, draftHash) => api$5.request(`/controllers/${id}/configuration/rollback/${revision}`, {
 	method: "POST",
 	body: {
 		force,
@@ -369,7 +369,7 @@ function useConfigurationActions(controllerId) {
 //#endregion
 //#region frontend/src/ClaimControllerModal.tsx
 var import_jsx_runtime = require_jsx_runtime();
-var { Alert: Alert$9, Button: Button$18, Form: Form$3, Input: Input$7, Label: Label$10, Modal: Modal$2, ModalBackdrop: ModalBackdrop$1, ModalBody: ModalBody$1, ModalContainer: ModalContainer$1, ModalDialog: ModalDialog$1, ModalFooter: ModalFooter$1, ModalHeader: ModalHeader$1, ModalHeading: ModalHeading$1, TextField: TextField$7 } = await importShared("@heroui/react");
+var { Alert: Alert$8, Button: Button$17, Form: Form$3, Input: Input$6, Label: Label$9, Modal: Modal$2, ModalBackdrop: ModalBackdrop$1, ModalBody: ModalBody$1, ModalContainer: ModalContainer$1, ModalDialog: ModalDialog$1, ModalFooter: ModalFooter$1, ModalHeader: ModalHeader$1, ModalHeading: ModalHeading$1, TextField: TextField$6 } = await importShared("@heroui/react");
 var { useEffectEvent, useState: useState$15 } = await importShared("react");
 function ClaimControllerModal({ controllerId, onOpenChange }) {
 	const claimMutation = useClaimControllerMutation();
@@ -412,31 +412,31 @@ function ClaimControllerModal({ controllerId, onOpenChange }) {
 						className: "wg:text-sm wg:text-muted",
 						children: "Verify physical access to this controller before it can receive commands."
 					}),
-					/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TextField$7, {
+					/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TextField$6, {
 						isRequired: true,
 						name: "name",
-						children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Label$10, { children: "Controller name" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Input$7, {
+						children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Label$9, { children: "Controller name" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Input$6, {
 							value: name,
 							onChange: (event) => setName(event.target.value)
 						})]
 					}),
-					/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TextField$7, {
+					/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TextField$6, {
 						isRequired: true,
 						name: "verifier",
-						children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Label$10, { children: "Physical pairing code or fingerprint" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Input$7, {
+						children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Label$9, { children: "Physical pairing code or fingerprint" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Input$6, {
 							value: verifier,
 							onChange: (event) => setVerifier(event.target.value)
 						})]
 					}),
-					claimMutation.isError && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$9, {
+					claimMutation.isError && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$8, {
 						status: "danger",
-						children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$9.Indicator, {}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$9.Content, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$9.Description, { children: getErrorMessage$1(claimMutation.error) }) })]
+						children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$8.Indicator, {}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$8.Content, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$8.Description, { children: getErrorMessage$1(claimMutation.error) }) })]
 					})
-				] }), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(ModalFooter$1, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$18, {
+				] }), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(ModalFooter$1, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$17, {
 					variant: "secondary",
 					onPress: close,
 					children: "Cancel"
-				}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$18, {
+				}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$17, {
 					type: "submit",
 					isPending: claimMutation.isPending,
 					children: "Verify and claim"
@@ -449,8 +449,42 @@ function getErrorMessage$1(error) {
 	return error instanceof Error ? error.message : "Please try again.";
 }
 //#endregion
+//#region frontend/src/useCommissioningVerification.ts
+var { useQuery: useQuery$3 } = await importShared("@tanstack/react-query");
+var { useEffect: useEffect$12, useState: useState$14 } = await importShared("react");
+/** Enrollment evidence is independent of configuration and physical qualification. */
+function useCommissioningVerification(session) {
+	const enabled = ["awaiting_verification", "completed"].includes(session.state);
+	const query = useQuery$3({
+		queryKey: [
+			"wago",
+			"commissioning-verification",
+			session.id
+		],
+		queryFn: () => getCommissioningVerification(session.id),
+		enabled,
+		refetchInterval: 5e3
+	});
+	const [now, setNow] = useState$14(Date.now);
+	useEffect$12(() => {
+		if (!enabled) return;
+		const timer = setInterval(() => setNow(Date.now()), 1e3);
+		return () => clearInterval(timer);
+	}, [enabled]);
+	const stale = !!query.data && now - query.dataUpdatedAt > 15e3;
+	const unavailable = query.isError || stale;
+	const data = enabled && !unavailable ? query.data : void 0;
+	const enrollmentComplete = !!(data?.controllerId && data.permanentConnection && data.enrollmentRevoked);
+	return {
+		data,
+		unavailable,
+		enrollmentComplete,
+		runtimeVerified: enrollmentComplete && data?.configurationApplied === true && data.hardwareReadiness === "ready"
+	};
+}
+//#endregion
 //#region frontend/src/ControllersTable.tsx
-var { Button: Button$17, Chip: Chip$2, Table, TableBody, TableCell, TableColumn, TableContent, TableHeader, TableRow, TableScrollContainer } = await importShared("@heroui/react");
+var { Button: Button$16, Chip: Chip$2, Table, TableBody, TableCell, TableColumn, TableContent, TableHeader, TableRow, TableScrollContainer } = await importShared("@heroui/react");
 function ControllersTable({ controllers, sessions, onClaim, onConfigure, onRemove, onResume }) {
 	const activeSessions = sessions.filter((session) => session.state !== "completed" && (session.state !== "revoked" || !!session.runtimeRecoveryAvailable || !!session.dockerProvisionState || !!session.managementControllerId));
 	const rows = [...controllers.map((controller) => ({
@@ -540,23 +574,23 @@ function ControllerRow({ row, onClaim, onConfigure, onRemove, onResume }) {
 			/* @__PURE__ */ (0, import_jsx_runtime.jsx)(TableCell, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 				className: "wg:flex wg:justify-end wg:gap-2",
 				children: [
-					session && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$17, {
+					session && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$16, {
 						size: "sm",
 						variant: "secondary",
 						onPress: () => onResume(session),
 						children: "View progress"
 					}),
-					controller.trustState === "untrusted" ? !session && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$17, {
+					controller.trustState === "untrusted" ? !session && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$16, {
 						size: "sm",
 						onPress: () => onClaim(controller.id),
 						children: "Claim"
-					}) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$17, {
+					}) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$16, {
 						size: "sm",
 						variant: "secondary",
 						onPress: () => onConfigure(controller.id),
 						children: "Configure"
 					}),
-					/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$17, {
+					/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$16, {
 						size: "sm",
 						variant: "danger",
 						onPress: () => onRemove(controller),
@@ -611,7 +645,7 @@ function CommissioningRow({ row, onResume }) {
 				className: "wg:hidden wg:lg:table-cell",
 				children: ["Updated ", new Date(session.updatedAt).toLocaleString()]
 			}),
-			/* @__PURE__ */ (0, import_jsx_runtime.jsx)(TableCell, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$17, {
+			/* @__PURE__ */ (0, import_jsx_runtime.jsx)(TableCell, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$16, {
 				size: "sm",
 				variant: isResumable(session.state) ? "primary" : "secondary",
 				onPress: () => onResume(session),
@@ -621,9 +655,11 @@ function CommissioningRow({ row, onResume }) {
 	}, row.key);
 }
 function CommissioningStatus({ session }) {
+	const verification = useCommissioningVerification(session);
+	const label = verification.enrollmentComplete ? verification.runtimeVerified ? "Enrollment complete · runtime verified" : "Enrollment complete · runtime setup pending" : verification.unavailable ? "Verification status unavailable" : commissioningLabel(session.state);
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", {
 		className: "wg:mt-1 wg:text-xs wg:text-primary",
-		children: [commissioningLabel(session.state), session.failureReason ? `: ${session.failureReason}` : ""]
+		children: [label, session.failureReason ? `: ${session.failureReason}` : ""]
 	});
 }
 function EmptyControllers() {
@@ -678,27 +714,27 @@ function formatHeartbeat(lastHeartbeatAt) {
 }
 //#endregion
 //#region frontend/src/RuntimeArtifactImport.tsx
-var { useEffect: useEffect$11, useRef: useRef$6, useState: useState$14 } = await importShared("react");
-var { Button: Button$16 } = await importShared("@heroui/react");
-var api$5 = createPluginApiClient("/api/wago/runtime-artifacts");
+var { useEffect: useEffect$11, useRef: useRef$5, useState: useState$13 } = await importShared("react");
+var { Button: Button$15 } = await importShared("@heroui/react");
+var api$4 = createPluginApiClient("/api/wago/runtime-artifacts");
 var maxBytes = 536870912;
 /** Standalone admin panel; uses the host API origin and authenticated session automatically. */
 function RuntimeArtifactImport({ onImported, onBusyChange, onSelectionChange, disabled = false }) {
-	const [current, setCurrent] = useState$14(null);
+	const [current, setCurrent] = useState$13(null);
 	useEffect$11(() => {
 		onSelectionChange?.(current);
 	}, [current, onSelectionChange]);
-	const [artifacts, setArtifacts] = useState$14([]);
-	const [files, setFiles] = useState$14({});
-	const [busy, setBusy] = useState$14(false);
-	const [loading, setLoading] = useState$14(true);
-	const [loadFailed, setLoadFailed] = useState$14(false);
-	const [loadAttempt, setLoadAttempt] = useState$14(0);
-	const [error, setError] = useState$14("");
-	const [status, setStatus] = useState$14("");
-	const form = useRef$6(null);
-	const uploadAbort = useRef$6(null);
-	const busyCallback = useRef$6(onBusyChange);
+	const [artifacts, setArtifacts] = useState$13([]);
+	const [files, setFiles] = useState$13({});
+	const [busy, setBusy] = useState$13(false);
+	const [loading, setLoading] = useState$13(true);
+	const [loadFailed, setLoadFailed] = useState$13(false);
+	const [loadAttempt, setLoadAttempt] = useState$13(0);
+	const [error, setError] = useState$13("");
+	const [status, setStatus] = useState$13("");
+	const form = useRef$5(null);
+	const uploadAbort = useRef$5(null);
+	const busyCallback = useRef$5(onBusyChange);
 	useEffect$11(() => {
 		busyCallback.current = onBusyChange;
 	}, [onBusyChange]);
@@ -715,7 +751,7 @@ function RuntimeArtifactImport({ onImported, onBusyChange, onSelectionChange, di
 	}, []);
 	useEffect$11(() => {
 		const abort = new AbortController();
-		Promise.all([api$5.request("/current", { signal: abort.signal }), api$5.request("", { signal: abort.signal })]).then(([active, entries]) => {
+		Promise.all([api$4.request("/current", { signal: abort.signal }), api$4.request("", { signal: abort.signal })]).then(([active, entries]) => {
 			if (abort.signal.aborted) return;
 			setCurrent(active);
 			setArtifacts(entries);
@@ -730,14 +766,14 @@ function RuntimeArtifactImport({ onImported, onBusyChange, onSelectionChange, di
 		return () => abort.abort();
 	}, [loadAttempt]);
 	async function importRelease() {
-		if (!files.bundle || !files.checksum || !files.signature || disabled || loading || loadFailed || uploadAbort.current) return;
-		if (files.bundle.size > maxBytes || files.checksum.size > 4096 || files.signature.size > 16384) {
-			setError("The runtime tar must be at most 512 MiB, checksum 4 KiB, and signature 16 KiB.");
+		if (!files.bundle || !files.checksum || disabled || loading || loadFailed || uploadAbort.current) return;
+		if (files.bundle.size > maxBytes || files.checksum.size > 4096) {
+			setError("The runtime tar must be at most 512 MiB and checksum 4 KiB.");
 			return;
 		}
 		setBusy(true);
 		setError("");
-		setStatus("Uploading and verifying the signed release…");
+		setStatus("Uploading and checking the runtime release…");
 		const abort = new AbortController();
 		uploadAbort.current = abort;
 		let failureMessage = "Import could not be completed. Check your connection and retry with the selected files.";
@@ -745,15 +781,14 @@ function RuntimeArtifactImport({ onImported, onBusyChange, onSelectionChange, di
 			const body = new FormData();
 			body.append("bundle", files.bundle);
 			body.append("checksum", files.checksum);
-			body.append("signature", files.signature);
-			const response = await api$5.fetch("/import", {
+			const response = await api$4.fetch("/import", {
 				method: "POST",
 				body,
 				signal: abort.signal
 			});
 			if (abort.signal.aborted) return;
 			if (!response.ok) {
-				failureMessage = response.status === 403 ? "Administrator access is required." : response.status === 409 ? "Another upload is in progress. Try again shortly." : "Import failed. Check that all three files belong to the same signed release and try again.";
+				failureMessage = response.status === 403 ? "Administrator access is required." : response.status === 409 ? "Another upload is in progress. Try again shortly." : "Import failed. Check that the runtime tar and checksum belong together and try again.";
 				throw new Error("Import rejected");
 			}
 			const artifact = await response.json();
@@ -778,15 +813,15 @@ function RuntimeArtifactImport({ onImported, onBusyChange, onSelectionChange, di
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("section", {
 		className: "wg:space-y-3",
 		"aria-label": "CC100 runtime release",
-		children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("header", { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("h3", { children: "CC100 runtime release" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: "Download the signed WAGO runtime bundle, extract its archive, then select the three release files. No server paths or signing keys are needed." })] }), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+		children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("header", { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("h3", { children: "CC100 runtime release" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: "Download the WAGO runtime bundle, extract its archive, then select the runtime tar and checksum files." })] }), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 			className: "wg:space-y-3",
 			children: [
 				/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", {
 					href: "https://github.com/Attraccess/Attraccess/actions/workflows/wago-cc100-runtime.yml",
 					target: "_blank",
 					rel: "noreferrer",
-					children: "Official signed runtime build artifacts"
-				}), ". Your software distributor can also provide these files. Only signed builds are importable."] }),
+					children: "Official runtime build artifacts"
+				}), ". Your software distributor can also provide these files. Check the source before importing."] }),
 				loading ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: "Loading releases…" }) : loadFailed ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: "Runtime releases are unavailable." }) : current ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", {
 					className: "wg:break-words",
 					children: [
@@ -826,24 +861,16 @@ function RuntimeArtifactImport({ onImported, onBusyChange, onSelectionChange, di
 						disabled: disabled || busy || loading || loadFailed,
 						className: "wg:flex wg:flex-col wg:gap-3",
 						children: [
-							/* @__PURE__ */ (0, import_jsx_runtime.jsx)("legend", { children: "Signed release files" }),
-							[
-								[
-									"bundle",
-									"Runtime bundle (.tar)",
-									".tar"
-								],
-								[
-									"checksum",
-									"Checksum (.sha256)",
-									".sha256"
-								],
-								[
-									"signature",
-									"Signature (.sig)",
-									".sig"
-								]
-							].map(([field, label, accept]) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { children: [label, /* @__PURE__ */ (0, import_jsx_runtime.jsx)("input", {
+							/* @__PURE__ */ (0, import_jsx_runtime.jsx)("legend", { children: "Runtime release files" }),
+							[[
+								"bundle",
+								"Runtime bundle (.tar)",
+								".tar"
+							], [
+								"checksum",
+								"Checksum (.sha256)",
+								".sha256"
+							]].map(([field, label, accept]) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { children: [label, /* @__PURE__ */ (0, import_jsx_runtime.jsx)("input", {
 								type: "file",
 								accept,
 								required: true,
@@ -852,9 +879,9 @@ function RuntimeArtifactImport({ onImported, onBusyChange, onSelectionChange, di
 									[field]: event.target.files?.[0]
 								}))
 							})] }, field)),
-							/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$16, {
+							/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$15, {
 								type: "submit",
-								isDisabled: disabled || busy || loading || loadFailed || !files.bundle || !files.checksum || !files.signature,
+								isDisabled: disabled || busy || loading || loadFailed || !files.bundle || !files.checksum,
 								children: busy ? "Verifying release…" : "Import and select release"
 							})
 						]
@@ -869,7 +896,7 @@ function RuntimeArtifactImport({ onImported, onBusyChange, onSelectionChange, di
 					role: "alert",
 					children: error
 				}),
-				loadFailed && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$16, {
+				loadFailed && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$15, {
 					variant: "secondary",
 					isDisabled: loading || busy,
 					onPress: () => {
@@ -895,18 +922,18 @@ function RuntimeArtifactImport({ onImported, onBusyChange, onSelectionChange, di
 }
 //#endregion
 //#region frontend/src/ManagementSecurityStatus.tsx
-var { Alert: Alert$8, Button: Button$15, Checkbox: Checkbox$6, Form: Form$2, Input: Input$6, Label: Label$9, TextField: TextField$6 } = await importShared("@heroui/react");
-var { useEffect: useEffect$10, useRef: useRef$5, useState: useState$13 } = await importShared("react");
+var { Alert: Alert$7, Button: Button$14, Checkbox: Checkbox$5, Form: Form$2, Input: Input$5, Label: Label$8, TextField: TextField$5 } = await importShared("@heroui/react");
+var { useEffect: useEffect$10, useRef: useRef$4, useState: useState$12 } = await importShared("react");
 function ManagementSecurityStatus(props) {
-	const [status, setStatus] = useState$13(props.status);
-	const [mode, setMode] = useState$13("baseline");
-	const [exceptions, setExceptions] = useState$13([]);
-	const [confirmed, setConfirmed] = useState$13(false);
-	const [credentialGeneration, setCredentialGeneration] = useState$13(0);
-	const [pending, setPending] = useState$13(false);
-	const [failed, setFailed] = useState$13(false);
-	const form = useRef$5(null);
-	const generation = useRef$5(0);
+	const [status, setStatus] = useState$12(props.status);
+	const [mode, setMode] = useState$12("baseline");
+	const [exceptions, setExceptions] = useState$12([]);
+	const [confirmed, setConfirmed] = useState$12(false);
+	const [credentialGeneration, setCredentialGeneration] = useState$12(0);
+	const [pending, setPending] = useState$12(false);
+	const [failed, setFailed] = useState$12(false);
+	const form = useRef$4(null);
+	const generation = useRef$4(0);
 	useEffect$10(() => {
 		setStatus(props.status);
 	}, [props.status]);
@@ -979,34 +1006,34 @@ function ManagementSecurityStatus(props) {
 					onSubmit: (event) => event.preventDefault(),
 					"aria-label": "Management security actions",
 					children: [
-						/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TextField$6, {
+						/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TextField$5, {
 							name: "managementUsername",
 							isRequired: true,
 							isDisabled: pending,
-							children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Label$9, { children: "Temporary SSH username" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Input$6, {
+							children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Label$8, { children: "Temporary SSH username" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Input$5, {
 								autoComplete: "off",
 								maxLength: 32
 							})]
 						}, `username-${credentialGeneration}`),
-						/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TextField$6, {
+						/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TextField$5, {
 							name: "managementPassword",
 							isRequired: true,
 							isDisabled: pending,
-							children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Label$9, { children: "Temporary SSH password" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Input$6, {
+							children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Label$8, { children: "Temporary SSH password" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Input$5, {
 								type: "password",
 								autoComplete: "off",
 								maxLength: 4096
 							})]
 						}, `password-${credentialGeneration}`),
 						/* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: "Credentials are cleared after each request. Apply and recovery require fresh credentials." }),
-						/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$15, {
+						/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$14, {
 							type: "button",
 							variant: "secondary",
 							isDisabled: pending || !!recovery,
 							onPress: () => void run("inspect"),
 							children: "Inspect management"
 						}),
-						/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$15, {
+						/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$14, {
 							type: "button",
 							variant: mode === "baseline" ? "primary" : "secondary",
 							isDisabled: pending || !!recovery,
@@ -1016,7 +1043,7 @@ function ManagementSecurityStatus(props) {
 							},
 							children: "Full baseline"
 						}),
-						/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$15, {
+						/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$14, {
 							type: "button",
 							variant: mode === "key_only" ? "primary" : "secondary",
 							isDisabled: pending || !!recovery,
@@ -1039,16 +1066,16 @@ function ManagementSecurityStatus(props) {
 								id: "unqualified_privileges",
 								label: "Acknowledge unqualified account privileges (required for key enrollment)"
 							}
-						].map(({ id, label }) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Checkbox$6, {
+						].map(({ id, label }) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Checkbox$5, {
 							isSelected: exceptions.includes(id),
 							isDisabled: pending || !!recovery,
 							onChange: (selected) => {
 								setExceptions((current) => selected ? [...current.filter((value) => value !== id), id] : current.filter((value) => value !== id));
 								setConfirmed(false);
 							},
-							children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$6.Control, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$6.Indicator, {}) }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$6.Content, { children: label })]
+							children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$5.Control, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$5.Indicator, {}) }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$5.Content, { children: label })]
 						}, id)),
-						/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$15, {
+						/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$14, {
 							type: "button",
 							variant: "secondary",
 							isDisabled: pending || !status?.inspection || !!recovery,
@@ -1056,19 +1083,19 @@ function ManagementSecurityStatus(props) {
 							children: "Review changes"
 						}),
 						reviewed && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: mode === "key_only" ? "Review: snapshot authorized keys, arm rollback, add a unique key, verify a new pinned key connection, then retain the recovery snapshot. Existing access remains enabled." : "Review: snapshot access, arm reboot-safe rollback, add and verify a unique management key, restrict access, verify a new connection and the service baseline, then retain recovery." }),
-						/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Checkbox$6, {
+						/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Checkbox$5, {
 							isSelected: confirmed,
 							isDisabled: pending,
 							onChange: setConfirmed,
-							children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$6.Control, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$6.Indicator, {}) }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$6.Content, { children: "I confirm the reviewed change or explicit recovery for this controller." })]
+							children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$5.Control, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$5.Indicator, {}) }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$5.Content, { children: "I confirm the reviewed change or explicit recovery for this controller." })]
 						}),
-						/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$15, {
+						/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$14, {
 							type: "button",
 							isDisabled: pending || !confirmed || !reviewed || status?.support !== "supported",
 							onPress: () => void run("apply"),
 							children: "Apply reviewed change"
 						}),
-						/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$15, {
+						/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$14, {
 							type: "button",
 							variant: "secondary",
 							isDisabled: pending || !confirmed || !recovery,
@@ -1098,9 +1125,9 @@ function ManagementSummary({ status, recovery }) {
 				status?.support ?? "qualification_required"
 			]
 		}),
-		/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$8, {
+		/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$7, {
 			status: "warning",
-			children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$8.Indicator, {}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$8.Content, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$8.Description, { children: "Automatic FW31 management hardening is not implemented. Missing operations are a restricted management account, root/password restrictions, WBM and service restrictions, and recovery that survives reboot. The FW31 vendor procedure for applying, restoring and persisting these changes is still needed. Key enrollment supports an existing non-root OpenSSH account or a detected Dropbear 2025.88 account. The new key disables forwarding and PTY allocation; account privileges and existing access remain enabled. Exceptions never count as hardened. Physical hardware verification is separate." }) })]
+			children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$7.Indicator, {}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$7.Content, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$7.Description, { children: "Automatic FW31 management hardening is not implemented. Missing operations are a restricted management account, root/password restrictions, WBM and service restrictions, and recovery that survives reboot. The FW31 vendor procedure for applying, restoring and persisting these changes is still needed. Key enrollment supports an existing non-root OpenSSH account or a detected Dropbear 2025.88 account. The new key disables forwarding and PTY allocation; account privileges and existing access remain enabled. Exceptions never count as hardened. Physical hardware verification is separate." }) })]
 		}),
 		status?.inspection && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("dl", { children: [
 			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("dt", { children: "Firmware / SSH / service control" }),
@@ -1137,16 +1164,16 @@ function ManagementSummary({ status, recovery }) {
 }
 //#endregion
 //#region frontend/src/CommissioningSecurityPanel.tsx
-var { useEffect: useEffect$9, useRef: useRef$4, useState: useState$12 } = await importShared("react");
-var api$4 = createPluginApiClient("/api/wago/commissioning/sessions");
+var { useEffect: useEffect$9, useRef: useRef$3, useState: useState$11 } = await importShared("react");
+var api$3 = createPluginApiClient("/api/wago/commissioning/sessions");
 function CommissioningSecurityPanel({ sessionId, controllerId }) {
-	const [status, setStatus] = useState$12(null);
-	const [loadError, setLoadError] = useState$12(false);
-	const generation = useRef$4(0);
+	const [status, setStatus] = useState$11(null);
+	const [loadError, setLoadError] = useState$11(false);
+	const generation = useRef$3(0);
 	useEffect$9(() => {
 		const current = ++generation.current;
 		const abort = new AbortController();
-		api$4.request(`/${sessionId}/management`, { signal: abort.signal }).then((value) => {
+		api$3.request(`/${sessionId}/management`, { signal: abort.signal }).then((value) => {
 			if (generation.current === current) setStatus(value);
 		}).catch(() => {
 			if (!abort.signal.aborted) setLoadError(true);
@@ -1158,7 +1185,7 @@ function CommissioningSecurityPanel({ sessionId, controllerId }) {
 	}, [sessionId]);
 	async function request(action, body) {
 		const current = ++generation.current;
-		const value = await api$4.request(`/${sessionId}/management/${action}`, {
+		const value = await api$3.request(`/${sessionId}/management/${action}`, {
 			method: "POST",
 			body
 		});
@@ -1185,18 +1212,19 @@ function CommissioningSecurityPanel({ sessionId, controllerId }) {
 }
 //#endregion
 //#region frontend/src/CommissioningPlatformPreflight.tsx
-var { Alert: Alert$7, Button: Button$14, Checkbox: Checkbox$5, Input: Input$5, Label: Label$8, TextField: TextField$5 } = await importShared("@heroui/react");
-var { useEffect: useEffect$8, useRef: useRef$3, useState: useState$11 } = await importShared("react");
+var { Alert: Alert$6, Button: Button$13, Checkbox: Checkbox$4, Input: Input$4, Label: Label$7, TextField: TextField$4 } = await importShared("@heroui/react");
+var { useEffect: useEffect$8, useRef: useRef$2, useState: useState$10 } = await importShared("react");
 var { useQueryClient: useQueryClient$1 } = await importShared("@tanstack/react-query");
-var api$3 = createPluginApiClient("/api/wago/commissioning/sessions");
+var api$2 = createPluginApiClient("/api/wago/commissioning/sessions");
 function CommissioningPlatformPreflight({ session }) {
 	const client = useQueryClient$1();
-	const [updated, setUpdated] = useState$11(null);
-	const [busy, setBusy] = useState$11(false);
-	const [approved, setApproved] = useState$11(false);
-	const [error, setError] = useState$11("");
-	const form = useRef$3(null);
-	const generation = useRef$3(0);
+	const [updated, setUpdated] = useState$10(null);
+	const [busy, setBusy] = useState$10(false);
+	const [approved, setApproved] = useState$10(false);
+	const [customSsh, setCustomSsh] = useState$10(false);
+	const [error, setError] = useState$10("");
+	const form = useRef$2(null);
+	const generation = useRef$2(0);
 	useEffect$8(() => () => {
 		generation.current++;
 		form.current?.reset();
@@ -1212,16 +1240,17 @@ function CommissioningPlatformPreflight({ session }) {
 		if (busy || !form.current?.reportValidity() || action !== "inspect" && !approved) return;
 		const values = new FormData(form.current);
 		const temporarySsh = {
-			username: String(values.get("preflightUsername") ?? ""),
-			password: String(values.get("preflightPassword") ?? "")
+			username: customSsh ? String(values.get("preflightUsername") ?? "") : "root",
+			password: customSsh ? String(values.get("preflightPassword") ?? "") : "wago"
 		};
 		form.current.reset();
+		setCustomSsh(false);
 		setApproved(false);
 		setBusy(true);
 		setError("");
 		const request = generation.current;
 		try {
-			const value = await api$3.request(`/${session.id}/platform/${action}`, {
+			const value = await api$2.request(`/${session.id}/platform/${action}`, {
 				method: "POST",
 				body: {
 					temporarySsh,
@@ -1233,7 +1262,7 @@ function CommissioningPlatformPreflight({ session }) {
 				client.setQueryData(["wago", "commissioning-sessions"], (entries) => entries?.map((entry) => entry.id === value.id ? value : entry));
 			}
 		} catch {
-			if (request === generation.current) setError("Platform action failed. Recheck the supported action and fresh SSH credential.");
+			if (request === generation.current) setError("Could not inspect or clean up the controller. Check SSH access and try again.");
 		} finally {
 			temporarySsh.password = "";
 			if (request === generation.current) setBusy(false);
@@ -1243,8 +1272,8 @@ function CommissioningPlatformPreflight({ session }) {
 		className: "wg:space-y-3",
 		"aria-label": "Controller installation preflight",
 		children: [
-			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("h3", { children: "Controller installation preflight" }),
-			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: "Optionally inspect firmware, UTC clock skew, digital I/O access, CODESYS and Docker before installation. Inspection does not change the controller. Installation checks these again under your destructive-install approval." }),
+			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("h3", { children: "Check the controller" }),
+			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: "Optional: check firmware and installation prerequisites. This does not change the controller." }),
 			codesysDisabled && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", {
 				role: "status",
 				children: "Controller preparation verified CODESYS stopped and permanently disabled. This is a saved result, not a live controller status check."
@@ -1296,9 +1325,9 @@ function CommissioningPlatformPreflight({ session }) {
 			!codesysDisabled && report?.exclusivity === "codesys-active" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: "CODESYS is active. Destructive installation will stop and permanently disable it. Existing PLC applications and data may be lost; Attraccess will not preserve, back up, or restore them. Installation fails if CODESYS cannot be verified stopped and disabled before I/O." }),
 			!codesysDisabled && report?.exclusivity === "codesys-boot-enabled" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: "CODESYS is configured to start at boot. Destructive installation must disable that startup and verify CODESYS is stopped before I/O. A stopped process alone is insufficient. No separate PLC preservation or restoration approval is required." }),
 			report?.exclusivity === "output-container-conflict" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: "Another container can write the digital outputs. Resolve exclusive ownership before installing this runtime." }),
-			report?.provision === "unsupported-fw31-package-activation" && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$7, {
+			report?.provision === "unsupported-fw31-package-activation" && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$6, {
 				status: "warning",
-				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$7.Indicator, {}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$7.Content, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$7.Description, { children: "This report could not establish a supported Docker package installation path. Retry installation only after the reported package or compatibility issue is resolved. An old inspection does not authorize activation by itself." }) })]
+				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$6.Indicator, {}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$6.Content, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$6.Description, { children: "This report could not establish a supported Docker package installation path. Retry installation only after the reported package or compatibility issue is resolved. An old inspection does not authorize activation by itself." }) })]
 			}),
 			report?.provision === "unsupported-lifecycle-dependencies" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: "This report could not verify the Docker lifecycle dependencies. Installation must validate a supported activation path before changing Docker. Vendor activation can change startup, routing and firewall settings; preexisting settings are not restored by commissioning." }),
 			current.dockerProvisionState && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", {
@@ -1317,34 +1346,40 @@ function CommissioningPlatformPreflight({ session }) {
 				ref: form,
 				onSubmit: (event) => event.preventDefault(),
 				children: [
-					/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TextField$5, {
+					/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { children: ["SSH login: ", customSsh ? "Custom credentials" : "Default root account"] }),
+					/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Checkbox$4, {
+						isSelected: customSsh,
+						onChange: setCustomSsh,
+						isDisabled: busy,
+						children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$4.Control, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$4.Indicator, {}) }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$4.Content, { children: "Advanced: use different SSH credentials" })]
+					}),
+					customSsh && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TextField$4, {
 						name: "preflightUsername",
 						isRequired: true,
 						isDisabled: busy,
-						children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Label$8, { children: "Preflight SSH username" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Input$5, { autoComplete: "off" })]
-					}),
-					/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TextField$5, {
+						children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Label$7, { children: "Preflight SSH username" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Input$4, { autoComplete: "off" })]
+					}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TextField$4, {
 						name: "preflightPassword",
 						isRequired: true,
 						isDisabled: busy,
-						children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Label$8, { children: "Preflight SSH password" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Input$5, {
+						children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Label$7, { children: "Preflight SSH password" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Input$4, {
 							type: "password",
 							autoComplete: "off"
 						})]
-					}),
-					/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$14, {
+					})] }),
+					/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$13, {
 						type: "button",
 						variant: "secondary",
 						isDisabled: busy,
 						onPress: () => void run("inspect"),
 						children: "Inspect installation prerequisites"
 					}),
-					recovery && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Checkbox$5, {
+					recovery && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Checkbox$4, {
 						isSelected: approved,
 						onChange: setApproved,
 						isDisabled: busy,
-						children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$5.Control, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$5.Indicator, {}) }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$5.Content, { children: "I approve cleaning up this controller preparation. Preexisting workloads and host settings will not be restored." })]
-					}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$14, {
+						children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$4.Control, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$4.Indicator, {}) }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$4.Content, { children: "I approve cleaning up this controller preparation. Preexisting workloads and host settings will not be restored." })]
+					}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$13, {
 						type: "button",
 						isDisabled: busy || !approved,
 						onPress: () => void run("recover"),
@@ -1360,109 +1395,6 @@ function CommissioningPlatformPreflight({ session }) {
 	});
 }
 //#endregion
-//#region frontend/src/CommissioningOperationStatus.tsx
-var { useQuery: useQuery$3 } = await importShared("@tanstack/react-query");
-var { Alert: Alert$6, Button: Button$13, Checkbox: Checkbox$4, Input: Input$4, Label: Label$7, TextField: TextField$4 } = await importShared("@heroui/react");
-var { useRef: useRef$2, useState: useState$10 } = await importShared("react");
-var api$2 = createPluginApiClient("/api/wago/commissioning/sessions");
-function CommissioningOperationStatus({ sessionId }) {
-	const query = useQuery$3({
-		queryKey: [
-			"wago",
-			"commissioning-operation",
-			sessionId
-		],
-		queryFn: () => api$2.request(`/${sessionId}/operation`),
-		refetchInterval: 5e3
-	});
-	const [confirmed, setConfirmed] = useState$10(false);
-	const [busy, setBusy] = useState$10(false);
-	const [error, setError] = useState$10(false);
-	const form = useRef$2(null);
-	const status = query.data;
-	async function recover() {
-		if (!form.current?.reportValidity() || busy || !confirmed || status?.state !== "stale") return;
-		const fields = new FormData(form.current);
-		const temporarySsh = {
-			username: String(fields.get("leaseUsername") ?? ""),
-			password: String(fields.get("leasePassword") ?? "")
-		};
-		form.current.reset();
-		setConfirmed(false);
-		setBusy(true);
-		setError(false);
-		try {
-			await api$2.request(`/${sessionId}/operation/recover`, {
-				method: "POST",
-				body: {
-					temporarySsh,
-					owner: status.owner,
-					previousWorkerStopped: true
-				}
-			});
-			await query.refetch();
-		} catch {
-			setError(true);
-		} finally {
-			temporarySsh.password = "";
-			setBusy(false);
-		}
-	}
-	if (!status || status.state === "available") return null;
-	if (status.state !== "active" && status.state !== "stale") return null;
-	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$6, {
-		status: "warning",
-		children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$6.Indicator, {}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$6.Content, { children: [
-			/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$6.Title, { children: status.state === "active" ? "A commissioning operation owns this controller" : "Interrupted coordinator recovery required" }),
-			/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$6.Description, { children: "Another operation cannot change this controller until ownership is released. An application restart never silently takes over an interrupted operation." }),
-			status.state === "stale" && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", {
-				ref: form,
-				onSubmit: (event) => {
-					event.preventDefault();
-					recover();
-				},
-				children: [
-					/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { children: [
-						"Recovery is available after ",
-						new Date(status.recoveryAfter).toLocaleString(),
-						". Stop the previous Attraccess commissioning instance first. The server then checks that both controller locks are idle. Runtime and management snapshots are not removed."
-					] }),
-					/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TextField$4, {
-						name: "leaseUsername",
-						isRequired: true,
-						isDisabled: busy,
-						children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Label$7, { children: "Coordinator recovery SSH username" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Input$4, { autoComplete: "off" })]
-					}),
-					/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TextField$4, {
-						name: "leasePassword",
-						isRequired: true,
-						isDisabled: busy,
-						children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Label$7, { children: "Coordinator recovery SSH password" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Input$4, {
-							type: "password",
-							autoComplete: "off"
-						})]
-					}),
-					/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Checkbox$4, {
-						isSelected: confirmed,
-						onChange: setConfirmed,
-						isDisabled: busy,
-						children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$4.Control, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$4.Indicator, {}) }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$4.Content, { children: "The previous commissioning instance has stopped, not merely paused. I approve checking and releasing its expired operation." })]
-					}),
-					/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$13, {
-						type: "submit",
-						isDisabled: busy || !confirmed,
-						children: "Recover interrupted coordinator"
-					})
-				]
-			}),
-			error && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", {
-				role: "alert",
-				children: "Recovery remains blocked. Check the safe timeout, previous instance and controller access, then retry."
-			})
-		] })]
-	});
-}
-//#endregion
 //#region frontend/src/drawer.tsx
 var { DrawerBackdrop, DrawerContent, DrawerDialog } = await importShared("@heroui/react");
 var DRAWER_DIALOG_CLASSNAME = "wg:md:mx-auto wg:md:max-w-2xl wg:bg-surface-secondary";
@@ -1488,6 +1420,10 @@ var { Alert: Alert$5, Button: Button$12, Checkbox: Checkbox$3, DrawerBody: Drawe
 var { AlertCircleIcon, CheckCircle2Icon, CpuIcon: CpuIcon$1 } = await importShared("lucide-react");
 var { useEffect: useEffect$7, useState: useState$9 } = await importShared("react");
 var { useQuery: useQuery$2 } = await importShared("@tanstack/react-query");
+var DEFAULT_SSH = {
+	username: "root",
+	password: "wago"
+};
 function useCommissioning({ isOpen, session: resumedSession, onOpenChange, onConfigure }) {
 	const createSessionMutation = useCreateCommissioningSessionMutation();
 	const confirmHostKeyMutation = useConfirmCommissioningHostKeyMutation();
@@ -1516,11 +1452,13 @@ function useCommissioning({ isOpen, session: resumedSession, onOpenChange, onCon
 		setIsolatedIdentity(false);
 		setHostKeyFingerprint("");
 	}, [resumedSession?.id, isOpen]);
-	const [sshUsername, setSshUsername] = useState$9("");
-	const [sshPassword, setSshPassword] = useState$9("");
+	const [sshUsername, setSshUsername] = useState$9(DEFAULT_SSH.username);
+	const [sshPassword, setSshPassword] = useState$9(DEFAULT_SSH.password);
+	const [customSsh, setCustomSsh] = useState$9(false);
 	const [confirmInstall, setConfirmInstall] = useState$9(false);
-	const [recoveryUsername, setRecoveryUsername] = useState$9("");
-	const [recoveryPassword, setRecoveryPassword] = useState$9("");
+	const [recoveryUsername, setRecoveryUsername] = useState$9(DEFAULT_SSH.username);
+	const [recoveryPassword, setRecoveryPassword] = useState$9(DEFAULT_SSH.password);
+	const [customRecoverySsh, setCustomRecoverySsh] = useState$9(false);
 	const [confirmRecovery, setConfirmRecovery] = useState$9(false);
 	const [isCancelConfirmationOpen, setCancelConfirmationOpen] = useState$9(false);
 	const attemptSession = recoverSessionMutation.submittedAt > deliverSessionMutation.submittedAt ? recoverSessionMutation.data : deliverSessionMutation.data;
@@ -1535,10 +1473,13 @@ function useCommissioning({ isOpen, session: resumedSession, onOpenChange, onCon
 		confirmHostKeyMutation
 	});
 	useEffect$7(() => {
-		setSshPassword("");
+		setSshUsername(DEFAULT_SSH.username);
+		setSshPassword(DEFAULT_SSH.password);
+		setCustomSsh(false);
 		setConfirmInstall(false);
-		setRecoveryUsername("");
-		setRecoveryPassword("");
+		setRecoveryUsername(DEFAULT_SSH.username);
+		setRecoveryPassword(DEFAULT_SSH.password);
+		setCustomRecoverySsh(false);
 		setConfirmRecovery(false);
 		setHostKeyFingerprint("");
 		setIsolatedIdentity(false);
@@ -1561,12 +1502,14 @@ function useCommissioning({ isOpen, session: resumedSession, onOpenChange, onCon
 		setControllerIp("");
 		setMqttServerId(null);
 		setHostKeyFingerprint("");
-		setSshUsername("");
-		setSshPassword("");
+		setSshUsername(DEFAULT_SSH.username);
+		setSshPassword(DEFAULT_SSH.password);
+		setCustomSsh(false);
 		setConfirmInstall(false);
 		setCancelConfirmationOpen(false);
-		setRecoveryUsername("");
-		setRecoveryPassword("");
+		setRecoveryUsername(DEFAULT_SSH.username);
+		setRecoveryPassword(DEFAULT_SSH.password);
+		setCustomRecoverySsh(false);
 		setConfirmRecovery(false);
 		createSessionMutation.reset();
 		confirmHostKeyMutation.reset();
@@ -1581,11 +1524,10 @@ function useCommissioning({ isOpen, session: resumedSession, onOpenChange, onCon
 		createSessionMutation.mutate({
 			name,
 			targetHost: controllerIp,
-			mqttServerId: selectedMqttServerId,
-			runtimeArtifactDigest: selectedArtifact?.digest
+			mqttServerId: selectedMqttServerId
 		}, { onSuccess: (created) => {
 			setCreatedSession(created);
-			setStep(2);
+			setStep(3);
 		} });
 	}
 	function deliverSession() {
@@ -1598,10 +1540,9 @@ function useCommissioning({ isOpen, session: resumedSession, onOpenChange, onCon
 				password: sshPassword
 			}
 		});
-		setSshPassword("");
+		if (customSsh) setSshPassword("");
 		setConfirmInstall(false);
-		setRecoveryUsername("");
-		setRecoveryPassword("");
+		if (customRecoverySsh) setRecoveryPassword("");
 		setConfirmRecovery(false);
 	}
 	function recoverSession() {
@@ -1614,10 +1555,9 @@ function useCommissioning({ isOpen, session: resumedSession, onOpenChange, onCon
 				password: recoveryPassword
 			}
 		});
-		setRecoveryUsername("");
-		setRecoveryPassword("");
+		if (customRecoverySsh) setRecoveryPassword("");
 		setConfirmRecovery(false);
-		setSshPassword("");
+		if (customSsh) setSshPassword("");
 		setConfirmInstall(false);
 	}
 	function confirmHostKey() {
@@ -1661,12 +1601,16 @@ function useCommissioning({ isOpen, session: resumedSession, onOpenChange, onCon
 		sshPassword,
 		setSshUsername,
 		setSshPassword,
+		customSsh,
+		setCustomSsh,
 		confirmInstall,
 		setConfirmInstall,
 		recoveryUsername,
 		recoveryPassword,
 		setRecoveryUsername,
 		setRecoveryPassword,
+		customRecoverySsh,
+		setCustomRecoverySsh,
 		confirmRecovery,
 		setConfirmRecovery,
 		createSessionMutation,
@@ -1701,7 +1645,7 @@ function CommissioningModal(props) {
 	});
 }
 function CommissioningContent({ model }) {
-	const { onConfigure, session, activeStep, title, loadingStatus, hostKeyFingerprint, setHostKeyFingerprint, isolatedIdentity, setIsolatedIdentity, deliverSessionMutation, sshUsername, sshPassword, setSshUsername, setSshPassword, confirmInstall, setConfirmInstall, isCancelConfirmationOpen, configureController } = model;
+	const { onConfigure, session, activeStep, title, loadingStatus, hostKeyFingerprint, setHostKeyFingerprint, isolatedIdentity, setIsolatedIdentity, deliverSessionMutation, sshUsername, sshPassword, setSshUsername, setSshPassword, customSsh, setCustomSsh, confirmInstall, setConfirmInstall, isCancelConfirmationOpen, configureController } = model;
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(DrawerBody$1, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 		className: "wg:grid wg:min-w-0 wg:gap-5 wg:md:grid-cols-[13rem_minmax(0,1fr)]",
 		children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(DevicePassport, {
@@ -1716,16 +1660,7 @@ function CommissioningContent({ model }) {
 					title: loadingStatus[0],
 					description: loadingStatus[1]
 				}),
-				session && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(CommissioningOperationStatus, { sessionId: session.id }, `operation-${session.id}`),
 				/* @__PURE__ */ (0, import_jsx_runtime.jsx)(ConnectionFields, { model }),
-				session?.runtimeArtifactDigest && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", {
-					className: "wg:break-all wg:text-sm",
-					children: [
-						"Pinned signed release: ",
-						/* @__PURE__ */ (0, import_jsx_runtime.jsx)("code", { children: session.runtimeArtifactDigest }),
-						". Retries keep this release."
-					]
-				}),
 				session?.state === "awaiting_identity_confirmation" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(HostKeyConfirmationStep, {
 					fingerprint: hostKeyFingerprint,
 					expectedFingerprint: session.hostKeyFingerprint,
@@ -1736,21 +1671,31 @@ function CommissioningContent({ model }) {
 					onChange: setIsolatedIdentity,
 					children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$3.Control, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$3.Indicator, {}) }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$3.Content, { children: "Alternatively, I verified the physical 751-9301 label and connected this controller as the only device on an isolated service network. I accept first-key pinning on that connection, not independent cryptographic identity verification. Do not select this on a shared LAN." })]
 				}),
-				session && activeStep === 2 && session.state !== "awaiting_identity_confirmation" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(DeliveryStep, {
+				session && activeStep === 4 && session.state !== "awaiting_identity_confirmation" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(DeliveryStep, {
 					isDelivering: deliverSessionMutation.isPending,
 					session,
 					sshUsername,
 					sshPassword,
 					onSshUsernameChange: setSshUsername,
 					onSshPasswordChange: setSshPassword,
+					customSsh,
+					onCustomSshChange: (custom) => {
+						setCustomSsh(custom);
+						setSshUsername(custom ? "" : DEFAULT_SSH.username);
+						setSshPassword(custom ? "" : DEFAULT_SSH.password);
+					},
 					confirmInstall,
 					onConfirmInstallChange: setConfirmInstall
 				}),
-				session && activeStep === 3 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ProgressStep, {
+				session && activeStep === 5 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ProgressStep, {
 					name: title,
 					session
 				}),
-				session && session.state !== "awaiting_identity_confirmation" && (canInstall(session) || session.dockerProvisionState) && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(CommissioningPlatformPreflight, { session }, `preflight-${session.id}`),
+				session && canInstall(session) && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("details", { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("summary", {
+					className: "wg:cursor-pointer",
+					children: "Optional: inspect controller before installation"
+				}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(CommissioningPlatformPreflight, { session }, `preflight-${session.id}`)] }),
+				session && !canInstall(session) && session.dockerProvisionState && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(CommissioningPlatformPreflight, { session }, `preflight-${session.id}`),
 				session && (["awaiting_verification", "completed"].includes(session.state) || session.managementControllerId) && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(VerificationStatus, {
 					session,
 					onConfigure: onConfigure ? configureController : void 0
@@ -1801,13 +1746,13 @@ function CommissioningActions({ model }) {
 	});
 }
 function RecoveryFields({ model }) {
-	const { session, isLoading, recoveryUsername, recoveryPassword, setRecoveryUsername, setRecoveryPassword, confirmRecovery, setConfirmRecovery } = model;
+	const { session, isLoading, recoveryUsername, recoveryPassword, setRecoveryUsername, setRecoveryPassword, customRecoverySsh, setCustomRecoverySsh, confirmRecovery, setConfirmRecovery } = model;
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_jsx_runtime.Fragment, { children: session && canRecover(session) && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 		className: "wg:space-y-4",
 		children: [
 			/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$5, {
 				status: "warning",
-				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$5.Indicator, {}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$5.Content, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$5.Title, { children: "Clean up failed installation" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$5.Description, { children: "Cleanup interrupts the Attraccess runtime and reconciles this installation and its credentials. It cannot undo broker credential revocation or restore CODESYS, other applications, Docker host settings, or data erased during commissioning. It does not re-enable CODESYS. An incomplete cleanup keeps its recovery record for another attempt. Cleanup does not certify readiness and is never automatic." })] })]
+				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$5.Indicator, {}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$5.Content, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$5.Title, { children: "Clean up failed installation" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$5.Description, { children: "This stops and removes the failed Attraccess installation. It cannot restore previous applications, data, or CODESYS. You can retry after cleanup." })] })]
 			}),
 			/* @__PURE__ */ (0, import_jsx_runtime.jsx)(CredentialFields, {
 				intent: "recovery",
@@ -1815,7 +1760,13 @@ function RecoveryFields({ model }) {
 				username: recoveryUsername,
 				password: recoveryPassword,
 				onUsernameChange: setRecoveryUsername,
-				onPasswordChange: setRecoveryPassword
+				onPasswordChange: setRecoveryPassword,
+				custom: customRecoverySsh,
+				onCustomChange: (custom) => {
+					setCustomRecoverySsh(custom);
+					setRecoveryUsername(custom ? "" : DEFAULT_SSH.username);
+					setRecoveryPassword(custom ? "" : DEFAULT_SSH.password);
+				}
 			}),
 			/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Checkbox$3, {
 				isRequired: true,
@@ -1824,10 +1775,6 @@ function RecoveryFields({ model }) {
 				onChange: setConfirmRecovery,
 				name: "confirm-recovery",
 				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$3.Control, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$3.Indicator, {}) }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$3.Content, { children: "I approve interrupting the Attraccess runtime and cleaning up this failed installation. This does not restore preexisting applications or data." })]
-			}),
-			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", {
-				className: "wg:text-sm wg:text-muted",
-				children: "Enter fresh SSH credentials and approve each recovery attempt separately. Credentials and recovery consent are cleared after submission or closing."
 			})
 		]
 	}) });
@@ -1846,7 +1793,7 @@ function ConnectionFields({ model }) {
 			onControllerIpChange: setControllerIp,
 			onMqttServerIdChange: setMqttServerId
 		}),
-		!session && activeStep === 1 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(RuntimeArtifactImport, {
+		!session && activeStep === 2 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(RuntimeArtifactImport, {
 			disabled: isLoading,
 			onBusyChange: setArtifactBusy,
 			onSelectionChange: setSelectedArtifact
@@ -1855,19 +1802,32 @@ function ConnectionFields({ model }) {
 }
 function CreateSessionActions({ model }) {
 	const { session, isLoading, activeStep, name, controllerIp, mqttServersQuery, setArtifactBusy, artifactBusy, artifactAvailable, selectedMqttServerId, setStep, createSession } = model;
-	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [!session && activeStep === 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$12, {
-		isDisabled: !name.trim(),
-		onPress: () => {
-			setArtifactBusy(true);
-			setStep(1);
-		},
-		children: "Continue"
-	}), !session && activeStep === 1 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$12, {
-		isPending: isLoading,
-		isDisabled: artifactBusy || !artifactAvailable || !controllerIp.trim() || selectedMqttServerId === null || mqttServersQuery.isPending || mqttServersQuery.isError,
-		onPress: createSession,
-		children: isLoading ? "Preparing commissioning" : "Scan controller for review"
-	})] });
+	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+		!session && activeStep === 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$12, {
+			isDisabled: !name.trim(),
+			onPress: () => {
+				setArtifactBusy(true);
+				setStep(1);
+			},
+			children: "Continue"
+		}),
+		!session && activeStep === 1 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$12, {
+			isDisabled: !controllerIp.trim() || selectedMqttServerId === null || mqttServersQuery.isPending || mqttServersQuery.isError,
+			onPress: () => setStep(2),
+			children: "Continue"
+		}),
+		!session && activeStep === 2 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$12, {
+			variant: "secondary",
+			onPress: () => setStep(1),
+			children: "Back to connection"
+		}),
+		!session && activeStep === 2 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$12, {
+			isPending: isLoading,
+			isDisabled: artifactBusy || !artifactAvailable || !controllerIp.trim() || selectedMqttServerId === null || mqttServersQuery.isPending || mqttServersQuery.isError,
+			onPress: createSession,
+			children: isLoading ? "Preparing commissioning" : "Scan controller for review"
+		})
+	] });
 }
 function CancelSessionAction({ model }) {
 	const { session, isLoading, removeSessionMutation, isCancelConfirmationOpen, setCancelConfirmationOpen, close } = model;
@@ -1914,15 +1874,15 @@ function DevicePassport({ className, name, step }) {
 				children: [
 					/* @__PURE__ */ (0, import_jsx_runtime.jsx)(PassportRow, {
 						label: "Identity",
-						value: step >= 2 ? "Review required" : "Not scanned"
+						value: step >= 3 ? "See session status" : "Not scanned"
 					}),
 					/* @__PURE__ */ (0, import_jsx_runtime.jsx)(PassportRow, {
 						label: "Runtime",
-						value: step >= 2 ? "See session status" : "Not installed"
+						value: step >= 4 ? "See session status" : "Not installed"
 					}),
 					/* @__PURE__ */ (0, import_jsx_runtime.jsx)(PassportRow, {
 						label: "Claim",
-						value: step >= 3 ? "See session status" : "Pending"
+						value: step >= 5 ? "See session status" : "Pending"
 					})
 				]
 			}),
@@ -1932,7 +1892,9 @@ function DevicePassport({ className, name, step }) {
 					0,
 					1,
 					2,
-					3
+					3,
+					4,
+					5
 				].map((index) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: `wg:h-1.5 wg:flex-1 wg:rounded-full ${index <= step ? "wg:bg-primary" : "wg:bg-default-300"}` }, index))
 			})
 		]
@@ -1949,10 +1911,12 @@ function PassportRow({ label, value }) {
 }
 function StepHeading({ step }) {
 	const content = [
-		["Give this controller a useful name", "This name is reserved now and applied automatically when the controller comes online."],
-		["Connect the controller", "Enter its private address and choose an MQTT server. Review the scanned identity before installation."],
-		["Review and approve installation", "Confirm the controller identity, enter temporary SSH credentials, and approve the changes for this attempt."],
-		["Commissioning status", "A saved session does not authorize a new installation. After an interruption, review the status before retrying."]
+		["Name the controller", "Choose a name you will recognize later."],
+		["Connect the controller", "Enter its IP address and choose the MQTT server it will use."],
+		["Choose a runtime release", "Select the release to install on this controller."],
+		["Verify the controller", "Check the SSH fingerprint before installation."],
+		["Install the runtime", "Review what installation changes, then approve it."],
+		["Installation progress", "You can close this window and return to the saved session later."]
 	][step];
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { children: [
 		/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", {
@@ -1960,7 +1924,7 @@ function StepHeading({ step }) {
 			children: [
 				"Step ",
 				step + 1,
-				" of 4"
+				" of 6"
 			]
 		}),
 		/* @__PURE__ */ (0, import_jsx_runtime.jsx)("h2", {
@@ -2017,7 +1981,7 @@ function ConnectionStep({ controllerIp, mqttServerId, mqttServersQuery, onContro
 		children: [
 			/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$5, {
 				status: "accent",
-				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$5.Indicator, {}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$5.Content, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$5.Title, { children: "Prepare the CC100 (751-9301), firmware 31" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$5.Description, { children: "Have the controller powered using its specified supply and wait for it to finish starting. Connect its Ethernet cable to the intended local network. Ask your network administrator for its assigned IP address and ensure the Attraccess server can reach it. Keep power and networking connected during installation. If the model or firmware is uncertain, check the device label and your maintenance records with the responsible administrator before proceeding." })] })]
+				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$5.Indicator, {}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$5.Content, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$5.Title, { children: "Prepare the CC100 (751-9301), firmware 31" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$5.Description, { children: "Power on the CC100 and connect it to the local network. Keep it connected during installation. Check the device label and firmware if you are unsure which controller this is." })] })]
 			}),
 			/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TextField$3, {
 				isRequired: true,
@@ -2068,7 +2032,7 @@ function HostKeyConfirmationStep({ fingerprint, expectedFingerprint, onFingerpri
 		children: [
 			/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$5, {
 				status: "warning",
-				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$5.Indicator, {}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$5.Content, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$5.Title, { children: "Review the controller SSH key" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$5.Description, { children: "Compare the scanned fingerprint with a trusted inventory record or a fingerprint obtained independently through a trusted administrator. Copying the scan back here is not independent authentication. If no trusted fingerprint is available, confirm the physical controller and its cabling on an isolated network you control; this reduces exposure but does not independently authenticate the SSH key. Stop if the device or network is uncertain. Confirming the key does not start installation." })] })]
+				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$5.Indicator, {}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$5.Content, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$5.Title, { children: "Review the controller SSH key" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$5.Description, { children: "Compare this fingerprint with a trusted record. If you do not have one, connect only this controller to an isolated service network and confirm its physical label. Stop if you cannot identify the controller." })] })]
 			}),
 			/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", {
 				className: "wg:break-all wg:text-sm",
@@ -2095,33 +2059,48 @@ function canInstall(session) {
 function canRecover(session) {
 	return session.runtimeRecoveryAvailable === true;
 }
-function CredentialFields({ intent = "installation", isDisabled, username, password, onUsernameChange, onPasswordChange }) {
+function CredentialFields({ intent = "installation", isDisabled, username, password, onUsernameChange, onPasswordChange, custom, onCustomChange }) {
 	const prefix = intent === "recovery" ? "Recovery SSH" : "Temporary SSH";
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
-		className: "wg:grid wg:gap-4 wg:sm:grid-cols-2",
-		children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TextField$3, {
-			isRequired: true,
-			isDisabled,
-			name: `${intent}-ssh-username`,
-			children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Label$6, { children: [prefix, " username"] }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Input$3, {
-				autoComplete: "off",
-				value: username,
-				onChange: (event) => onUsernameChange(event.target.value)
-			})]
-		}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TextField$3, {
-			isRequired: true,
-			isDisabled,
-			name: `${intent}-ssh-password`,
-			children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Label$6, { children: [prefix, " password"] }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Input$3, {
-				autoComplete: "off",
-				type: "password",
-				value: password,
-				onChange: (event) => onPasswordChange(event.target.value)
-			})]
-		})]
+		className: "wg:space-y-3",
+		children: [
+			/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", {
+				className: "wg:text-sm",
+				children: ["SSH login: ", custom ? "Custom credentials" : "Default root account"]
+			}),
+			/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Checkbox$3, {
+				isSelected: custom,
+				isDisabled,
+				onChange: onCustomChange,
+				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$3.Control, { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$3.Indicator, {}) }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Checkbox$3.Content, { children: "Advanced: use different SSH credentials" })]
+			}),
+			custom && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+				className: "wg:grid wg:gap-4 wg:sm:grid-cols-2",
+				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TextField$3, {
+					isRequired: true,
+					isDisabled,
+					name: `${intent}-ssh-username`,
+					children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Label$6, { children: [prefix, " username"] }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Input$3, {
+						autoComplete: "off",
+						value: username,
+						onChange: (event) => onUsernameChange(event.target.value)
+					})]
+				}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(TextField$3, {
+					isRequired: true,
+					isDisabled,
+					name: `${intent}-ssh-password`,
+					children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Label$6, { children: [prefix, " password"] }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Input$3, {
+						autoComplete: "off",
+						type: "password",
+						value: password,
+						onChange: (event) => onPasswordChange(event.target.value)
+					})]
+				})]
+			})
+		]
 	});
 }
-function DeliveryStep({ isDelivering, session, sshUsername, sshPassword, onSshUsernameChange, onSshPasswordChange, confirmInstall, onConfirmInstallChange }) {
+function DeliveryStep({ isDelivering, session, sshUsername, sshPassword, onSshUsernameChange, onSshPasswordChange, customSsh, onCustomSshChange, confirmInstall, onConfirmInstallChange }) {
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 		className: "wg:space-y-4",
 		children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(CommissioningStatusPanel, {
@@ -2131,9 +2110,10 @@ function DeliveryStep({ isDelivering, session, sshUsername, sshPassword, onSshUs
 			/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$5, {
 				status: "warning",
 				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$5.Indicator, {}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$5.Content, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$5.Title, { children: "Destructive installation" }), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$5.Description, { children: [
-					"Installing Attraccess on ",
+					"Make connected equipment safe before continuing. Installation stops and disables CODESYS on",
+					" ",
 					session.targetHost,
-					" takes over this controller. Existing applications and workloads may stop working or be erased. CODESYS will be stopped and permanently disabled before digital I/O is enabled; installation fails if this cannot be verified. Attraccess does not preserve, back up, or restore preexisting CODESYS applications or other workloads. Make connected equipment safe for the interruption. Installation does not certify management hardening or physical readiness."
+					". Existing applications and data may be lost and cannot be restored by Attraccess."
 				] })] })]
 			}),
 			/* @__PURE__ */ (0, import_jsx_runtime.jsx)(CredentialFields, {
@@ -2141,7 +2121,9 @@ function DeliveryStep({ isDelivering, session, sshUsername, sshPassword, onSshUs
 				username: sshUsername,
 				password: sshPassword,
 				onUsernameChange: onSshUsernameChange,
-				onPasswordChange: onSshPasswordChange
+				onPasswordChange: onSshPasswordChange,
+				custom: customSsh,
+				onCustomChange: onCustomSshChange
 			}),
 			/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Checkbox$3, {
 				isRequired: true,
@@ -2153,29 +2135,35 @@ function DeliveryStep({ isDelivering, session, sshUsername, sshPassword, onSshUs
 			}),
 			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", {
 				className: "wg:text-sm wg:text-muted",
-				children: "Enter the controller credentials explicitly; no default credentials are used. The password and approval are cleared after submitting or closing. Every retry needs a new approval and password. Restarting the server does not start or resume an installation."
+				children: "Each attempt needs your approval. Custom passwords are cleared after use."
 			})
 		] })]
 	});
 }
 function ProgressStep({ name, session }) {
-	const complete = [
+	const verification = useCommissioningVerification(session);
+	const complete = verification.enrollmentComplete || [
 		"completed",
 		"revoked",
 		"claim_interrupted",
 		"recovery_revocation_pending"
 	].includes(session.state);
+	const progress = verification.enrollmentComplete ? {
+		...session,
+		progressStep: "Runtime enrollment complete",
+		progressDetail: verification.runtimeVerified ? "Permanent MQTT access, enrollment credential revocation, applied configuration and a fresh runtime probe are verified." : "Permanent MQTT access and enrollment credential revocation are verified. Configure inputs and outputs to finish runtime setup."
+	} : session;
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 		className: "wg:space-y-4",
 		children: [
 			/* @__PURE__ */ (0, import_jsx_runtime.jsx)(DevicePassport, {
 				className: "wg:md:hidden",
 				name,
-				step: 3
+				step: 5
 			}),
 			/* @__PURE__ */ (0, import_jsx_runtime.jsx)(CommissioningStatusPanel, {
 				isActive: !complete,
-				session
+				session: progress
 			}),
 			/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 				className: "wg:rounded-large wg:border wg:border-default-200 wg:p-4 wg:text-sm",
@@ -2195,34 +2183,33 @@ function ProgressStep({ name, session }) {
 	});
 }
 function VerificationStatus({ session, onConfigure }) {
-	const verification = useQuery$2({
-		queryKey: [
-			"wago",
-			"commissioning-verification",
-			session.id
-		],
-		queryFn: () => getCommissioningVerification(session.id),
-		refetchInterval: 5e3
-	});
+	const verification = useCommissioningVerification(session);
+	const controllerId = verification.data?.controllerId;
+	const managementControllerId = controllerId ?? session.managementControllerId;
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 		className: "wg:space-y-3",
-		children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$5, {
-			status: "warning",
-			children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$5.Indicator, {}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$5.Content, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$5.Title, { children: "Commissioning is not yet verified" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$5.Description, { children: verification.isError ? "Verification could not be loaded. No readiness claim is made." : verification.data ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("ul", { children: [
-				/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("li", { children: ["Permanent heartbeat: ", verification.data.permanentConnection ? "received" : "pending"] }),
-				/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("li", { children: ["Enrollment credential revoked: ", verification.data.enrollmentRevoked ? "verified" : "pending"] }),
-				/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("li", { children: ["Desired/reported configuration: ", verification.data.configurationApplied ? "applied" : "pending"] }),
-				/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("li", { children: ["Runtime hardware probe: ", verification.data.hardwareReadiness ?? "unverified"] }),
-				/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("li", { children: ["Management hardening: ", verification.data.managementHardening] }),
-				/* @__PURE__ */ (0, import_jsx_runtime.jsx)("li", { children: "Physical qualification: required before production use" })
-			] }) : "Checking commissioning evidence..." })] })]
-		}), (verification.data?.controllerId || session.managementControllerId) && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [onConfigure && verification.data?.controllerId && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$12, {
-			onPress: () => onConfigure(verification.data.controllerId),
-			children: "Configure inputs and outputs"
-		}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(CommissioningSecurityPanel, {
-			sessionId: session.id,
-			controllerId: verification.data?.controllerId ?? session.managementControllerId
-		}, session.id)] })]
+		children: [
+			/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$5, {
+				status: verification.enrollmentComplete ? "success" : "warning",
+				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$5.Indicator, {}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$5.Content, { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$5.Title, { children: verification.enrollmentComplete ? "Enrollment complete" : "Verifying enrollment" }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Alert$5.Description, { children: verification.unavailable ? "Current verification is unavailable. Waiting for a fresh status check." : verification.data ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("ul", { children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("li", { children: ["Permanent heartbeat: ", verification.data.permanentConnection ? "received" : "pending"] }), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("li", { children: ["Enrollment credential revoked: ", verification.data.enrollmentRevoked ? "verified" : "pending"] })] }) : "Checking commissioning evidence..." })] })]
+			}),
+			verification.data && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("section", {
+				"aria-label": "Runtime setup and qualification",
+				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("h3", { children: verification.runtimeVerified ? "Runtime configuration verified" : "Runtime setup checks" }), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("ul", { children: [
+					/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("li", { children: ["Desired/reported configuration: ", verification.data.configurationApplied ? "applied" : "pending"] }),
+					/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("li", { children: ["Runtime hardware probe: ", verification.data.hardwareReadiness ?? "unverified"] }),
+					/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("li", { children: ["Management hardening: ", verification.data.managementHardening] }),
+					/* @__PURE__ */ (0, import_jsx_runtime.jsx)("li", { children: "Physical qualification: required before production use" })
+				] })]
+			}),
+			managementControllerId && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [onConfigure && controllerId && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Button$12, {
+				onPress: () => onConfigure(controllerId),
+				children: "Configure inputs and outputs"
+			}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(CommissioningSecurityPanel, {
+				sessionId: session.id,
+				controllerId: managementControllerId
+			}, session.id)] })
+		]
 	});
 }
 function CommissioningStatusPanel({ isActive, session }) {
@@ -2230,7 +2217,7 @@ function CommissioningStatusPanel({ isActive, session }) {
 	const isQueued = session.state === "awaiting_delivery";
 	const hasFailure = !isActive && Boolean(session.failureReason);
 	const title = isQueued ? "Installation approval required" : session.progressStep ?? (isActive ? "Preparing commissioning" : commissioningLabel(session.state));
-	const detail = isQueued ? "Review the installation, enter temporary SSH credentials, and approve this attempt. Saved sessions do not start or resume installation automatically." : session.progressDetail ?? "Waiting for the next commissioning operation.";
+	const detail = isQueued ? "Review the installation and approve this attempt. Saved sessions do not start automatically." : session.progressDetail ?? "Waiting for the next commissioning operation.";
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 		"aria-live": "polite",
 		className: "wg:rounded-large wg:border wg:border-primary/30 wg:bg-primary/5 wg:p-4",
@@ -2312,13 +2299,13 @@ function parseActivityLog(auditLog) {
 }
 function sessionStep(session) {
 	if (!session) return 0;
+	if (session.state === "awaiting_identity_confirmation") return 3;
 	return [
 		"awaiting_delivery",
 		"delivering",
-		"awaiting_identity_confirmation",
 		"awaiting_codesys_confirmation",
 		"delivery_failed"
-	].includes(session.state) ? 2 : 3;
+	].includes(session.state) ? 4 : 5;
 }
 function ErrorAlert$1({ error }) {
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Alert$5, {
@@ -3568,7 +3555,7 @@ var base = {
 	pollIntervalMs: 5e3,
 	functionCode: 3
 };
-var BUILTIN_MODBUS_PROFILES = ["879-3000", "879-1300"].map((model) => ({
+var legacyProfiles = ["879-3000", "879-1300"].map((model) => ({
 	id: `wago-${model}-unverified`,
 	name: `WAGO ${model} — UNQUALIFIED / map unverified`,
 	version: 1,
@@ -3599,6 +3586,40 @@ var BUILTIN_MODBUS_PROFILES = ["879-3000", "879-1300"].map((model) => ({
 		kind: "cumulative"
 	}))]
 }));
+var BUILTIN_MODBUS_PROFILES = [{
+	id: "wago-879-3000",
+	name: "WAGO 879-3000 — Modbus RTU",
+	version: 1,
+	actions: [],
+	measurements: [
+		...legacyProfiles[0].measurements.map((measurement) => ({
+			...measurement,
+			decimalPlaces: 3
+		})),
+		{
+			...base,
+			id: "voltage-l1",
+			name: "L1 voltage",
+			address: 20482,
+			dataType: "float32",
+			scale: 1,
+			unit: "volt",
+			kind: "live",
+			decimalPlaces: 3
+		},
+		{
+			...base,
+			id: "current-l1",
+			name: "L1 current",
+			address: 20492,
+			dataType: "float32",
+			scale: 1,
+			unit: "ampere",
+			kind: "live",
+			decimalPlaces: 3
+		}
+	]
+}, ...legacyProfiles];
 function freeze(value) {
 	Object.values(value).forEach((child) => {
 		if (child && typeof child === "object") freeze(child);
@@ -3746,7 +3767,8 @@ function validateModbus(value) {
 					"unit",
 					"kind",
 					"pollIntervalMs",
-					"rollover"
+					"rollover",
+					"decimalPlaces"
 				] : ["onValue", "offValue"]
 			], `${path}.${f.id}`);
 		});
@@ -3757,7 +3779,7 @@ function validateModbus(value) {
 				"watt",
 				"watt-hour",
 				"percent"
-			].includes(m.unit) || !["live", "cumulative"].includes(m.kind) || !integer(m.pollIntervalMs, 100, 36e5)) fail(path, "measurement requires FC03/04, physical unit, kind, poll interval 100..3600000ms");
+			].includes(m.unit) || !["live", "cumulative"].includes(m.kind) || m.decimalPlaces !== void 0 && !integer(m.decimalPlaces, 0, 3) || !integer(m.pollIntervalMs, 100, 36e5)) fail(path, "measurement requires FC03/04, physical unit, kind, poll interval 100..3600000ms");
 			if (m?.rollover !== void 0 && (m.kind !== "cumulative" || !Number.isFinite(m.rollover) || m.rollover <= 0)) fail(path, "rollover must be an explicit positive raw modulus on cumulative measurements");
 			if (m?.kind === "cumulative" && m.scale <= 0) fail(path, "cumulative measurements require a positive scale");
 		});
@@ -4340,6 +4362,26 @@ function ModbusProfileForm({ value, onChange, isDisabled = false, showIdentifier
 										});
 									}
 								}),
+								/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Choice$1, {
+									label: "Reading precision (physical units)",
+									value: m.decimalPlaces ?? "exact",
+									options: [
+										"exact",
+										0,
+										1,
+										2,
+										3
+									],
+									labels: {
+										exact: "Exact (no rounding)",
+										0: "Whole units",
+										1: "0.1 units",
+										2: "0.01 units",
+										3: "0.001 units"
+									},
+									disabled: readonly,
+									onChange: (v) => update({ decimalPlaces: v === "exact" ? void 0 : Number(v) })
+								}),
 								/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, {
 									label: "Polling interval (ms)",
 									value: m.pollIntervalMs,
@@ -4563,7 +4605,7 @@ function ModbusConfigurationForm({ value, onChange, isDisabled = false, showIden
 			] }),
 			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", {
 				className: "wg:text-sm wg:text-muted",
-				children: "Built-in register maps are unverified candidates. Check the device manual and qualify the hardware before use."
+				children: "WAGO 879-3000 uses its documented read-only register map. Profiles marked unverified are retained for existing configurations."
 			}),
 			value.connections.map((c, index) => {
 				if (focused && (section !== "connections" || c.id !== selectedId)) return null;
@@ -4609,8 +4651,8 @@ function ModbusConfigurationForm({ value, onChange, isDisabled = false, showIden
 										} : {
 											transport: "rtu",
 											path: "/dev/serial",
-											baudRate: 19200,
-											parity: "even",
+											baudRate: 9600,
+											parity: "none",
 											stopBits: 1
 										}
 									} : item)
@@ -4628,6 +4670,10 @@ function ModbusConfigurationForm({ value, onChange, isDisabled = false, showIden
 								disabled: isDisabled,
 								onChange: (v) => update({ port: Number(v) })
 							})] }) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+								/* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", {
+									className: "wg:text-sm wg:text-muted",
+									children: "CC100 two-wire RS-485: /dev/serial. WAGO 879-3000 factory settings: unit 1, 9600 baud, 8N1."
+								}),
 								/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, {
 									label: "Serial device path",
 									value: c.path,