packet-tracer-skill 0.3.0 → 0.3.1

package/scripts/generate_pkt.py

@@ -41,8 +41,8 @@ from packet_tracer_env import (
 )
 from pkt_builder import build_packet_tracer_xml
 from pkt_codec import decode_pkt_file, decode_pkt_modern, encode_pkt_modern, serialize_pkt_xml
-from pkt_editor import _set_config_block, apply_plan_operations, decode_pkt_to_root, edit_pkt_file, inventory_devices, inventory_links, inventory_root
-from pkt_transformer import donor_interface_names, port_capacity, port_exists, transform_from_blueprint
+from pkt_editor import _align_hostname_with_name, _ensure_text, _profile_nodes, _set_config_block, apply_plan_operations, decode_pkt_to_root, edit_pkt_file, inventory_devices, inventory_links, inventory_root
+from pkt_transformer import donor_interface_names, port_capacity, port_exists, transform_from_blueprint, wireless_router_port_names
 import pkt_verify
 import usage_ledger
 from remote_search import (
@@ -52,7 +52,7 @@ from remote_search import (
     search_remote_candidates,
     write_remote_sample_audit,
 )
-from sample_catalog import ReferencePattern, SampleCandidate, SampleDescriptor, load_catalog, load_curated_donor_catalog, load_reference_catalog, summarize_pkt_descriptor
+from sample_catalog import ReferencePattern, SampleCandidate, SampleDescriptor, load_catalog, load_curated_donor_catalog, load_reference_catalog, normalize_device_type as _normalize_device_type, summarize_pkt_descriptor
 from sample_selector import rank_curated_donor_samples, rank_reference_samples, rank_samples, select_best_sample
 from workspace_repair import inspect_donor_coherence, inspect_workspace_integrity, validate_donor_coherence, validate_workspace_integrity
 
@@ -1302,6 +1302,42 @@ def _record_generation_outcome(
         return
 
 
+def _switch_model_affinity(sample: object, blueprint: dict[str, object]) -> int:
+    """How many of this donor's switches are the model the plan asked for.
+
+    Donor-prune reuses the donor's devices, so the model in the blueprint is
+    advisory: `_choose_switch_model` returns `2960-24TT` and the lab ships
+    whatever the donor happened to hold. Measured across the corpus, 43 of 53
+    switches came out on a different model than planned, and 42 of them were
+    `IE-9320` -- an industrial switch, in labs asked for as plain campus
+    networks.
+
+    The material is there: of 70 bundled labs, 27 hold a `2960-24TT` and 36
+    such switches exist in total. So this is a selection problem, not a
+    scarcity one, and the donor that already owns the right model is the one to
+    prefer.
+
+    Counted rather than scored as a fraction: a donor with four matching
+    switches serves a four-switch prompt better than one with a single match,
+    and the count says so directly.
+    """
+    wanted = {
+        str(device.get("model") or "").strip()
+        for device in blueprint.get("devices", [])
+        if str(device.get("type", "")).endswith("Switch")
+    }
+    wanted.discard("")
+    if not wanted:
+        return 0
+    devices = getattr(sample, "devices", None) or []
+    return sum(
+        1
+        for device in devices
+        if str(device.get("type", "")).endswith("Switch")
+        and str(device.get("model") or "").strip() in wanted
+    )
+
+
 def _rerank_candidates_for_blueprint(
     candidates: list[SampleCandidate],
     blueprint: dict[str, object],
@@ -1312,7 +1348,7 @@ def _rerank_candidates_for_blueprint(
     # bet than one that merely scores well on paper.
     learned = learned_scores or {}
 
-    def _sort_key(candidate: SampleCandidate) -> tuple[int, int, int, int, int, int, int]:
+    def _sort_key(candidate: SampleCandidate) -> tuple[int, int, int, int, int, int, int, int]:
         fit = build_donor_graph_fit(candidate.sample, blueprint)
         acceptance_penalty, _ = _candidate_acceptance_penalty(candidate, blueprint)
         adjusted_score = candidate.total_score - acceptance_penalty
@@ -1325,6 +1361,11 @@ def _rerank_candidates_for_blueprint(
             fit.fit_score - acceptance_penalty,
             -len(fit.port_media_conflicts),
             -len(fit.missing_pairs),
+            # Below the fit signals on purpose: a donor that wires up correctly
+            # matters more than one holding the right switch model, and a lab
+            # that opens beats a lab with prettier hardware. This decides
+            # between donors the checks above rate the same.
+            _switch_model_affinity(candidate.sample, blueprint),
             adjusted_score,
         )
 
@@ -1378,7 +1419,7 @@ def _root_has_serial_link(root: ET.Element) -> bool:
     counted here.
 
     Nor is a serial-looking name enough. A lab pruned from
-    `Senan_Haciyev_tapsiriq.pkt` was measured wiring `Serial0/0/0 <-> Serial0/0/0`
+    the saved serial-WAN lab was measured wiring `Serial0/0/0 <-> Serial0/0/0`
     between two routers whose only serial interfaces are `Serial2/0` and
     `Serial3/0`; `port_exists` accepts the name, but the devices' own interface
     lists do not have it. A cable between ports that do not exist is not a WAN,
@@ -1739,6 +1780,9 @@ def _default_name_for_type(device_type: str, index: int) -> str:
     return {
         "Router": f"R{index}",
         "Switch": f"SW{index}",
+        # Named in the switch series on purpose: it is one of the switches the
+        # prompt counted, promoted to a multilayer model to fit the donors.
+        "MultiLayerSwitch": f"SW{index}",
         "PC": f"PC{index}",
         "Server": f"Server{index}",
         "LightWeightAccessPoint": f"AP{index}",
@@ -1796,6 +1840,21 @@ HOST_DEVICE_KINDS = {
     "NetworkController",
     "LightWeightAccessPoint",
     "MerakiServer",
+    # Each of these arrived in the file with no cable on it. The port each
+    # one uses is measured off real cables in 200 saved labs, below in
+    # `_host_port`; `Wall Mount` is left out because not one lab cables it,
+    # and guessing is what puts hardcoded port names back into the file.
+    "Hub",
+    "WiredEndDevice",
+    "Patch Panel",
+    "Bridge",
+    "Repeater",
+    "TV",
+    # A firewall the prompt asked for used to arrive cabled to nothing:
+    # present in the file, valid, and not part of the network. It is an
+    # end device as far as the link synthesiser is concerned -- one cable,
+    # to the switch.
+    "ASA",
 }
 
 
@@ -1807,12 +1866,50 @@ def _is_wireless_client_device(device: dict[str, object]) -> bool:
     return _device_kind(device) in {"Tablet", "Smartphone"}
 
 
+WIRELESS_ROUTER_KINDS = {"WirelessRouter", "WirelessRouterNewGeneration"}
+
+
+def _wireless_router_lan_port(index: int) -> str:
+    """A home router's LAN port, counting from 1.
+
+    Measured across 348 saved labs: the new-generation home router's cables sit
+    on `GigabitEthernet 1` .. `GigabitEthernet 4`, twenty of them, and the older
+    Linksys model's on `Ethernet 1` .. `Ethernet 4`, two. The space is part of
+    the name. Both count from one, which is why the index is not offset.
+
+    `Internet` is deliberately not reachable from here. Fourteen cables in those
+    labs use it and every one is an uplink -- it is the WAN port, and a host
+    plugged into it is on the wrong side of the router.
+    """
+    return f"GigabitEthernet {index}"
+
+
+# Router interface naming, read off Packet Tracer's own device list rather
+# than guessed from a prefix. The table used to know `2901` and `ISR` and fell
+# back to FastEthernet for everything else, which is wrong for most of the
+# modern models: a 2911 has `GigabitEthernet0/0` .. `0/2` and no FastEthernet
+# at all.
+#
+# The cost of getting it wrong is not a rejected file. `FastEthernet0/0` on a
+# 2911 is invalid, so the port repair relocates the cable to the first free
+# valid interface -- `GigabitEthernet0/0`, the one addressing had already made
+# the WAN uplink. The lab then carried its router-on-a-stick subinterfaces on
+# `GigabitEthernet0/1`, which no cable reached: ten subinterfaces
+# protocol-down, no gateway for any VLAN, and a lab that opened and read
+# correctly throughout.
+ROUTER_PORT_SHAPES = {
+    "GigabitEthernet0/{n}": ("1941", "2901", "2911", "CGR1240"),
+    "GigabitEthernet0/0/{n}": ("ISR4321", "ISR4331", "ISR"),
+    "GigabitEthernet{n}": ("819HG", "819HGW", "829"),
+}
+
+
 def _router_port(device: dict[str, object], index: int = 1) -> str:
     model = str(device.get("model") or "")
-    if model.startswith("2901"):
-        return f"GigabitEthernet0/{index - 1}"
-    if model.startswith("ISR"):
-        return f"GigabitEthernet0/0/{index - 1}"
+    for shape, models in ROUTER_PORT_SHAPES.items():
+        if any(model.startswith(prefix) for prefix in models):
+            return shape.format(n=index - 1)
+    # 1841, 2620XM, 2621XM, 2811 and the generic Router-PT.
     return f"FastEthernet0/{index - 1}"
 
 
@@ -1886,6 +1983,26 @@ def _host_port(device: dict[str, object]) -> str:
         return "GigabitEthernet0"
     if kind == "WirelessLanController":
         return "GigabitEthernet1"
+    # Measured the same way, off the cables in 150 saved labs: every ASA
+    # link uses `Ethernet0/N`, while the live device palette reports
+    # `GigabitEthernet1/1` for a 5506-X. The models differ, so this is the
+    # starting name and `_repair_invalid_link_ports` moves it to whatever
+    # the chosen device really has -- the same way router and switch ports
+    # are already corrected per model.
+    if kind == "ASA":
+        return "Ethernet0/0"
+    # Read off the cables in 200 saved labs, the same way as the kinds
+    # above. A hub is the strongest of them, cabled in six labs on
+    # `FastEthernet0`; the rest appear once each, and the port repair
+    # corrects any that do not fit the device that is finally chosen.
+    if kind == "Patch Panel":
+        return "PunchDown1"
+    if kind == "Bridge":
+        return "Ethernet0/1"
+    if kind == "Repeater":
+        return "Ethernet0"
+    if kind == "TV":
+        return "Port 0"
     return "FastEthernet0"
 
 
@@ -1961,6 +2078,13 @@ def _operation_category(bucket_name: str, operation: dict[str, object]) -> str:
             # `port_reassignment` put it on the blocked list and made donor-prune
             # generation forbid its own core operation.
             return "link_prune"
+        if op_name == "apply_cli":
+            # `cli R1: ...` writes IOS text into a device's configuration and
+            # touches nothing else -- the same class as the switch and router
+            # operations below. Falling through to the default named it a
+            # physical workspace change, which is blocked in open-first mode, so
+            # the first prompt that carried arbitrary CLI refused to generate.
+            return "config_mutation"
         return "workspace_physical_mutation"
     if bucket_name in {"switch_ops", "router_ops", "management_ops"}:
         return "config_mutation"
@@ -2409,15 +2533,103 @@ def _write_pkt_root(root: ET.Element, pkt_path: Path, xml_path: Path | None = No
     _repair_invalid_link_ports(root)
     _assign_unique_macs(root)
     _match_link_port_families(root)
+    # After the families agree and before the addresses are handed out: a
+    # copper cable in a fibre socket is dropped by Packet Tracer on load,
+    # silently, in a file that still opens.
+    _move_copper_cables_off_fibre_ports(root)
     _assign_unique_interface_addresses(root)
     _assign_unique_switch_management_ips(root)
     _reconcile_cable_media(root)
+    # First of the configuration repairs: a block for hardware the device does
+    # not have carries the donor's whole address plan into every pass that
+    # reads the router's networks.
+    _retarget_config_to_real_interface_names(root)
+    _drop_config_for_absent_interfaces(root)
     _trunk_uplinks_in_file(root)
+    # Before the access-VLAN pass, which would otherwise strip the tagging:
+    # a switch port facing router subinterfaces has to be a trunk. The
+    # subinterfaces move to the cabled port first, or there is nothing there
+    # for the trunk to carry.
+    _move_subinterfaces_to_the_cabled_port(root)
+    _trunk_router_on_a_stick(root)
     _align_router_access_vlan(root)
+    # After the router's own port is settled: a host whose address belongs to
+    # one VLAN and whose port sits in another cannot reach its own subnet.
+    _align_host_vlans_to_addresses(root)
     _align_router_gateway(root)
+    # Last, because `_align_router_gateway` writes the gateway onto the
+    # physical cabled interface -- correct for an access link, wrong for a
+    # trunk, where every frame arrives tagged and the address has to sit on
+    # the subinterface for its VLAN. Running before it left VLAN 10 with its
+    # gateway stranded on `GigabitEthernet0/0` and no host able to reach it,
+    # while every other VLAN routed.
+    _move_subinterfaces_to_the_cabled_port(root)
+    # A learned sticky MAC belongs to the donor's device, not to the one now
+    # plugged in, and `restrict` drops every frame that does not match it.
+    _drop_inherited_sticky_macs(root)
+    # Both ends of every trunk must name the same native VLAN, or spanning
+    # tree blocks the port and the cable carries nothing.
+    _match_trunk_native_vlans(root)
+    # After every trunk is settled: port security on a trunk cuts the switch
+    # behind it off entirely.
+    _drop_port_security_from_trunks(root)
+    # After the trunks are settled: a channel-group naming ports the cable
+    # never joined takes the switch behind it off the network.
+    _align_etherchannels_with_cabling(root)
+    _align_dhcp_pools_with_interfaces(root)
+    # After the pools point at real networks: a pool with no client is not
+    # DHCP, and the segmented path never emitted the client half.
+    # Before the clients are switched over: a VLAN with hosts and no gateway
+    # cannot serve any of them.
+    # A port with no VLAN sits in VLAN 1, which the plan never gives a
+    # gateway, so the host on it is isolated whatever else is right.
+    _place_hosts_in_a_vlan(root)
+    _serve_every_populated_vlan(root)
+    # Again, now that new VLANs exist: the router-facing trunk lists the
+    # VLANs it may carry, and it was written before those VLANs were
+    # created -- so their hosts had a gateway the trunk would not pass.
+    _trunk_router_on_a_stick(root)
+    # Again, now that the VLAN gateways exist. The first call ran before
+    # `_serve_every_populated_vlan` created them, so it judged the plan's pools
+    # against interfaces that were not there yet: a pool named VLAN20 carrying
+    # the default 192.168.1.0 survived, and the VLAN-20 pass then added a
+    # second pool of the same name for 192.168.20.0. IOS merges pools by name
+    # and keeps the last, so VLAN 20 served a network nothing routes.
     _align_dhcp_pools_with_interfaces(root)
+    _drop_duplicate_dhcp_pools(root)
+    _merge_repeated_interface_blocks(root)
+    _separate_config_blocks(root)
+    _add_missing_vlans_to_the_database(root)
+    _drop_vlan_subinterfaces_off_router_links(root)
+    _move_static_hosts_onto_their_vlan_network(root)
+    # A home router keeps the donor's LAN network unless someone moves it onto
+    # the one its own clients are addressed for, and its clients keep another
+    # donor's network name unless someone puts them on the air it broadcasts.
+    _join_wireless_clients_to_the_network_that_exists(root)
+    _align_home_router_lan_with_its_clients(root)
+    _match_wireless_security_to_the_access_point(root)
+    # After the LAN move, which needs the planned addresses to know where to
+    # put the pool. Once it has, the pool addresses the clients.
+    _let_the_home_router_address_its_own_clients(root)
+    # Last, so the profile copies whatever the passes above settled on.
+    _make_the_wireless_profile_agree_with_the_port(root)
+    _put_workstations_on_dhcp(root)
+    # Snooping without a trusted uplink eats every offer the router sends.
+    _trust_uplinks_for_dhcp_snooping(root)
+    # Last: the standby gateway takes the address the hosts already use,
+    # so nothing written before it has to change.
+    _add_hsrp_gateway_redundancy(root)
+    # A router with no path to another router carries none of its routes.
+    _drop_stale_point_to_point_addresses(root)
+    _mesh_routers_with_point_to_point_links(root)
     _group_hosts_under_their_switch(root)
     _separate_overlapping_devices(root)
+    # After the separation pass, so a leftover nudged sideways is still pulled in.
+    _compact_stray_devices(root)
+    # Last of the layout: a radio link is made by distance, so a wireless
+    # client has to end up inside its access point's reach whatever the rows
+    # above decided.
+    _keep_wireless_clients_within_reach_of_their_access_point(root)
     _save_running_config_to_startup(root)
     prune_unused_images(root)
     xml_bytes = serialize_pkt_xml(root)
@@ -2498,8 +2710,25 @@ def _seed_devices_from_plan(plan: IntentPlan) -> list[dict[str, object]]:
     for device_type, count in plan.device_requirements.items():
         existing = current_counts.get(device_type, 0)
         for next_index in range(existing + 1, count + 1):
+            # A multilayer switch is still one of the switches the prompt asked
+            # for, so it is numbered in the same series. `3 switch 1 router ve 4
+            # komputer qur` is promoted to two switches plus one multilayer
+            # switch to fit the donor pool, and the third one used to arrive
+            # called `MultiLayerSwitch1`: the prompt asked for `SW3`, the lab
+            # shipped without one, and the shortfall check reported a device
+            # missing that was standing there under another name.
+            name_index = next_index
+            if device_type == "MultiLayerSwitch":
+                # Counted once, not summed: whether the plain switches were
+                # seeded before or after this loop reaches the multilayer one
+                # depends on requirement ordering, and adding both counts gave
+                # `SW5` for the third switch of three.
+                name_index += max(
+                    current_counts.get("Switch", 0),
+                    plan.device_requirements.get("Switch", 0),
+                )
             device: dict[str, object] = {
-                "name": _default_name_for_type(device_type, next_index),
+                "name": _default_name_for_type(device_type, name_index),
                 "type": device_type,
             }
             if device_type == "Switch":
@@ -2684,7 +2913,29 @@ def _synthesize_links(plan: IntentPlan, devices: list[dict[str, object]]) -> lis
     switches.sort(key=lambda device: _device_kind(device) != "MultiLayerSwitch")
     hosts = [device for device in devices if _is_host_device(device)]
     if not switches:
-        return []
+        # A home-router lab has no switch, and returning nothing here left both
+        # `wireless_home` and `wireless_ssid` as devices with no path between
+        # them: two laptops on 1.1.10.20 and .21, a router on 192.168.0.1, 0/4
+        # twice over while the labs opened and every static check passed.
+        #
+        # The laptops are wired on purpose: a Laptop-PT arrives with a copper
+        # port and no wireless card, so the cable is the only path it has.
+        # Tablets and phones are skipped -- they associate instead.
+        routers_wireless = [
+            device for device in devices if _device_kind(device) in WIRELESS_ROUTER_KINDS
+        ]
+        if not routers_wireless:
+            return []
+        access_point = routers_wireless[0]
+        wired_hosts = [device for device in hosts if not _is_wireless_client_device(device)]
+        return [
+            {
+                "a": {"dev": device["name"], "port": _host_port(device)},
+                "b": {"dev": access_point["name"], "port": _wireless_router_lan_port(index)},
+                "media": "straight-through",
+            }
+            for index, device in enumerate(wired_hosts, start=1)
+        ]
 
     if archetype == "chain":
         links: list[dict[str, object]] = []
@@ -3166,6 +3417,12 @@ def _synthesize_security_ops(plan: IntentPlan, devices: list[dict[str, object]])
                 },
             )
 
+    # These interface names are a guess -- no cable exists yet, so nothing here
+    # can know which ports face the core or whether the peer bundles too. The
+    # guess is deliberate and it is not the final word: it records the intent to
+    # bundle, and `_align_etherchannels_with_cabling` decides against the real
+    # cabling, keeping the members of a genuine two-cable bundle and removing
+    # the rest. Left on its own the guess cost SW2 its uplink.
     if switches and {"etherchannel", "lacp", "pagp"} & capabilities and len(switches) >= 2:
         mode = "active" if "lacp" in capabilities else ("desirable" if "pagp" in capabilities else "on")
         for switch in switches[:2]:
@@ -3344,6 +3601,7 @@ def _draw_lab_annotations(root, blueprint, plan, add_note, add_rectangle, clear_
     # are. Both are in the file.
     placed: dict[str, tuple[float, float]] = {}
     kinds: dict[str, str] = {}
+    parked = _parked_names(root)
     for device in root.findall(".//DEVICES/DEVICE"):
         name = (device.findtext("./ENGINE/NAME") or "").strip()
         if not name:
@@ -3353,7 +3611,7 @@ def _draw_lab_annotations(root, blueprint, plan, add_note, add_rectangle, clear_
             y = float((device.findtext("./WORKSPACE/LOGICAL/Y") or "").strip())
         except ValueError:
             continue
-        if x >= PARKED_LOGICAL_X:
+        if name in parked:
             continue
         placed[name] = (x, y)
         kinds[name] = (device.findtext("./ENGINE/TYPE") or "").strip()
@@ -4106,6 +4364,18 @@ def _collect_donor_groups(
                 "members_by_type": members_by_type,
             }
         )
+    # Prefix grouping only means anything when the prefixes actually gather
+    # hosts. A donor whose switches are `SW-IDR`, `SW-MUH`, ... collapses into
+    # one group named `SW` holding nothing, because its hosts are `PC-IDR1` and
+    # `SRV-IDR` -- different prefixes. Those empty groups then suppressed the
+    # link-based fallback below, which groups that donor correctly, and every
+    # request for five switch groups was refused against a donor that had five.
+    if groups and not any(
+        any(_fallback_group_member_type(str(member["type"])) for member in group["members"])
+        for group in groups
+    ):
+        groups = []
+
     if groups:
         groups.sort(key=lambda item: _name_sort_key(str(item["group_name"])))
         return groups
@@ -4598,6 +4868,11 @@ def _align_router_access_vlan(root: ET.Element) -> list[str]:
             if kind(refs[near]) in host_types:
                 host_vlans[access_vlan(devices[refs[far]], ports[far])] += 1
             elif kind(refs[near]) == "Router":
+                # A router-on-a-stick end is a trunk, not an access port;
+                # forcing it into the hosts' VLAN would strip the tagging every
+                # other VLAN depends on.
+                if _router_subinterface_vlans(devices[refs[near]], ports[near]):
+                    continue
                 router_ends.append((devices[refs[far]], ports[far]))
 
     if not host_vlans or not router_ends:
@@ -4622,111 +4897,3006 @@ def _align_router_access_vlan(root: ET.Element) -> list[str]:
     return notes
 
 
-def _align_router_gateway(root: ET.Element) -> list[str]:
-    """Put the hosts' gateway address on the router interface they reach it by.
+def _add_hsrp_gateway_redundancy(root: ET.Element) -> list[str]:
+    """Give the VLAN gateways a standby router.
 
-    Host addressing is decided while planning, from the router interface the
-    plan plugs into the switch. Port reconciliation then moves that cable: the
-    plan had GigabitEthernet0/0/0, carrying 192.168.1.1, and the finished lab
-    ran the cable from GigabitEthernet0/0/2, carrying 192.168.3.1. Hosts were
-    addressed 192.168.1.x with a gateway that existed, on an interface attached
-    to nothing.
+    `hsrp olsun` parsed, and nothing came of it: the only implementation here
+    is `set_hsrp_ipv6`, so an IPv4 lab asked for HSRP and got a configuration
+    with no `standby` line anywhere. Measured on the 140-device enterprise
+    lab -- eight routers, five of them with no cable at all.
 
-    Adjusting the hosts to follow the cable was the first attempt and it did
-    nothing, because at planning time the two still agreed. The cabling is what
-    changes last, so the address has to follow it: whichever interface ends up
-    facing the switch is given the gateway the hosts were told to use.
+    The arrangement is the one the specification asks for and the one every
+    textbook uses: the address the hosts already point at becomes the virtual
+    one, and the two routers move aside to .2 and .3. Nothing the hosts or the
+    DHCP pools say has to change, which is what makes it safe to add last.
+
+        10.10.30.1   virtual, what the hosts use
+        10.10.30.2   primary, priority 110, preempt
+        10.10.30.3   standby
+
+    The second router is one the topology already contains and left uncabled,
+    trunked to the same switch as the first: a standby gateway on a different
+    switch would be a different lab.
     """
+    from pkt_editor import _ensure_link
+
     devices = {
-        (device.findtext("./ENGINE/SAVE_REF_ID") or ""): device
+        (device.findtext("./ENGINE/SAVE_REF_ID") or "").strip(): device
         for device in root.findall(".//DEVICES/DEVICE")
     }
-    kinds = {
-        ref: (device.findtext("./ENGINE/TYPE") or "") for ref, device in devices.items()
-    }
+    switch_types = {"Switch", "MultiLayerSwitch"}
+    cabled: set[str] = set()
+    used_ports: set[tuple[str, str]] = set()
+    primary: tuple[ET.Element, str, ET.Element, str] | None = None
+    for link in root.findall(".//LINKS/LINK"):
+        cable = link.find("./CABLE")
+        if cable is None:
+            continue
+        refs = [(cable.findtext(tag) or "").strip() for tag in ("FROM", "TO")]
+        ports = [node.text or "" for node in cable.findall("PORT")]
+        if len(ports) < 2:
+            continue
+        for index, ref in enumerate(refs):
+            device = devices.get(ref)
+            if device is not None:
+                cabled.add((device.findtext("./ENGINE/NAME") or "").strip())
+                used_ports.add(((device.findtext("./ENGINE/NAME") or "").strip(), ports[index]))
+        for near, far in ((0, 1), (1, 0)):
+            router = devices.get(refs[near])
+            switch = devices.get(refs[far])
+            if router is None or switch is None or primary is not None:
+                continue
+            if (router.findtext("./ENGINE/TYPE") or "") != "Router":
+                continue
+            if (switch.findtext("./ENGINE/TYPE") or "") not in switch_types:
+                continue
+            if _router_subinterface_vlans(router, ports[near]):
+                primary = (router, ports[near], switch, ports[far])
 
-    gateways = [
-        (port.findtext("PORT_GATEWAY") or "").strip()
-        for device in devices.values()
-        if (device.findtext("./ENGINE/TYPE") or "") in {"Pc", "PC"}
-        for port in device.findall("./ENGINE/MODULE/SLOT/MODULE/PORT")
+    if primary is None:
+        return []
+    router, router_port, switch, switch_port = primary
+    spare = next(
+        (
+            device
+            for device in root.findall(".//DEVICES/DEVICE")
+            if (device.findtext("./ENGINE/TYPE") or "") == "Router"
+            and (device.findtext("./ENGINE/NAME") or "").strip() not in cabled
+            and port_exists(device, router_port)
+        ),
+        None,
+    )
+    if spare is None:
+        return []
+
+    vlans = _router_subinterface_vlans(router, router_port)
+    subnets = _vlan_subnets_from_router(root)
+    shared = [vlan for vlan in vlans if subnets.get(vlan)]
+    if not shared:
+        return []
+
+    switch_name = (switch.findtext("./ENGINE/NAME") or "").strip()
+    free = next(
+        (
+            f"FastEthernet0/{index}"
+            for index in range(1, 25)
+            if (switch_name, f"FastEthernet0/{index}") not in used_ports
+            and port_exists(switch, f"FastEthernet0/{index}")
+        ),
+        "",
+    )
+    if not free:
+        return []
+
+    spare_name = (spare.findtext("./ENGINE/NAME") or "").strip()
+    _ensure_link(root, spare_name, router_port, switch_name, free, "copper")
+
+    allowed = ",".join(shared)
+    body = [" switchport mode trunk", f" switchport trunk allowed vlan {allowed}"]
+    if (switch.findtext("./ENGINE/TYPE") or "") == "MultiLayerSwitch":
+        body.insert(0, " switchport trunk encapsulation dot1q")
+    switch_config = switch.find("./ENGINE/RUNNINGCONFIG")
+    if switch_config is not None:
+        _set_config_block(switch_config, f"interface {free}", body)
+
+    def standby_block(subnet: str, vlan: str, address: str, priority: int | None) -> list[str]:
+        lines = [
+            f" ip address {address} 255.255.255.0",
+            f" standby {vlan} ip {subnet}.1",
+        ]
+        if priority is not None:
+            lines.append(f" standby {vlan} priority {priority}")
+            lines.append(f" standby {vlan} preempt")
+        return lines
+
+    config = router.find("./ENGINE/RUNNINGCONFIG")
+    spare_config = spare.find("./ENGINE/RUNNINGCONFIG")
+    if config is None or spare_config is None:
+        return []
+    for vlan in shared:
+        subnet = subnets[vlan]
+        _set_config_block(
+            config, f"interface {router_port}.{vlan}", standby_block(subnet, vlan, f"{subnet}.2", 110)
+        )
+        # Appending the block was the obvious way to write it and it is wrong:
+        # a generated lab becomes the donor for the next build, so this pass
+        # runs again over its own output. Measured on the enterprise lab after
+        # five builds -- every subinterface on the standby router written five
+        # times over, `10.10.40.1` then `10.10.40.3` then `10.10.40.1` again.
+        # IOS applies them in order and keeps the last; every reader that scans
+        # for the first sees a different address. A pass has to be safe to run
+        # on what it already produced.
+        _set_config_block(
+            spare_config,
+            f"interface {router_port}.{vlan}",
+            [
+                f" description VLAN{vlan} standby",
+                f" encapsulation dot1Q {vlan}",
+                *standby_block(subnet, vlan, f"{subnet}.3", None),
+            ],
+        )
+    _set_config_block(spare_config, f"interface {router_port}", [" no shutdown"])
+
+    name = (router.findtext("./ENGINE/NAME") or "").strip()
+    return [
+        f"HSRP on {len(shared)} VLAN(s): {name} .2 priority 110, {spare_name} .3, "
+        f"virtual .1 -- the address the hosts already use"
     ]
-    gateway = next((value for value in gateways if value and value != "0.0.0.0"), "")
-    if not gateway:
+
+
+def _trust_uplinks_for_dhcp_snooping(root: ET.Element) -> list[str]:
+    """A switch running DHCP snooping has to trust the way to the server.
+
+    Snooping drops server-sourced DHCP messages arriving on untrusted ports,
+    and every port is untrusted until told otherwise. Enabling it without
+    trusting the uplink is therefore a switch that silently discards every
+    offer the router sends back.
+
+    Measured on the 140-device enterprise lab: `dhcp snooping olsun` turned it
+    on across eighteen switches, no port was trusted, and every workstation
+    fell to APIPA while the statically addressed servers beside them reached
+    their gateway 4/4 -- the path was fine, only the offers were being eaten.
+
+    The trunk is the way out of the switch, so the trunks are what get
+    trusted; the access ports stay untrusted, which is the whole point of
+    turning snooping on.
+    """
+    trusted: list[str] = []
+    for device in root.findall(".//DEVICES/DEVICE"):
+        if (device.findtext("./ENGINE/TYPE") or "") not in {"Switch", "MultiLayerSwitch"}:
+            continue
+        config = device.find("./ENGINE/RUNNINGCONFIG")
+        if config is None:
+            continue
+        lines = [(node.text or "") for node in config.findall("LINE")]
+        if not any(line.strip() == "ip dhcp snooping" for line in lines):
+            continue
+        current = ""
+        trunks: list[str] = []
+        for line in lines:
+            text = line.strip()
+            if text.startswith("interface "):
+                current = text.split(None, 1)[1]
+            elif text == "switchport mode trunk" and current:
+                trunks.append(current)
+        for port in dict.fromkeys(trunks):
+            _set_config_block(config, f"interface {port}", [" ip dhcp snooping trust"])
+            trusted.append(f"{device.findtext('./ENGINE/NAME') or ''}:{port}")
+    if not trusted:
         return []
+    return [f"DHCP snooping trusts {len(trusted)} uplink(s): " + ", ".join(trusted[:6])]
+
 
+def _place_hosts_in_a_vlan(root: ET.Element) -> list[str]:
+    """Every host port in a VLAN lab has to name a VLAN.
+
+    A port with no `switchport access vlan` sits in VLAN 1, which the plan
+    never gives a gateway, so the host on it is isolated however well the rest
+    of the lab is configured. Measured on the 140-device enterprise lab: 50 of
+    112 cabled host ports named no VLAN at all, and every host behind them was
+    stranded.
+
+    The switch decides which one. An access switch serves a department, so the
+    VLAN most of its other host ports already use is the VLAN its bare ports
+    belong to -- and a switch whose ports are all bare takes the lab's lowest
+    VLAN rather than inventing one.
+    """
+    devices_by_ref = {
+        (device.findtext("./ENGINE/SAVE_REF_ID") or "").strip(): device
+        for device in root.findall(".//DEVICES/DEVICE")
+    }
+    switch_types = {"Switch", "MultiLayerSwitch"}
+
+    def access_vlan(switch: ET.Element, port: str) -> str:
+        inside = False
+        for node in switch.findall("./ENGINE/RUNNINGCONFIG/LINE"):
+            line = (node.text or "").strip()
+            if line.startswith("interface "):
+                inside = line == f"interface {port}"
+            elif inside:
+                if line.startswith("switchport access vlan "):
+                    return line.split()[-1]
+                if line.startswith("switchport mode trunk"):
+                    return "TRUNK"
+        return ""
+
+    attachments: list[tuple[ET.Element, str, ET.Element]] = []
     for link in root.findall(".//LINKS/LINK"):
         cable = link.find("./CABLE")
         if cable is None:
             continue
-        refs = [(cable.findtext("FROM") or "").strip(), (cable.findtext("TO") or "").strip()]
+        refs = [(cable.findtext(tag) or "").strip() for tag in ("FROM", "TO")]
         ports = [node.text or "" for node in cable.findall("PORT")]
-        for router_index, switch_index in ((0, 1), (1, 0)):
-            if kinds.get(refs[router_index]) != "Router":
+        if len(ports) < 2:
+            continue
+        for near, far in ((0, 1), (1, 0)):
+            host = devices_by_ref.get(refs[near])
+            switch = devices_by_ref.get(refs[far])
+            if host is None or switch is None:
                 continue
-            if kinds.get(refs[switch_index]) not in {"Switch", "MultiLayerSwitch"}:
+            if (switch.findtext("./ENGINE/TYPE") or "") not in switch_types:
                 continue
-            router = devices[refs[router_index]]
-            config = router.find("./ENGINE/RUNNINGCONFIG")
+            if not _is_host_device(
+                {"type": _normalize_device_type(host.findtext("./ENGINE/TYPE") or "")}
+            ):
+                continue
+            attachments.append((switch, ports[far], host))
+
+    declared: set[str] = set()
+    for device in root.findall(".//DEVICES/DEVICE"):
+        for node in device.findall("./ENGINE/RUNNINGCONFIG/LINE"):
+            text = (node.text or "")
+            match = re.match(r"^vlan (\d+)$", text.strip())
+            if match and not text.startswith(" "):
+                declared.add(match.group(1))
+    fallback = min(declared, key=int) if declared else ""
+
+    votes: dict[str, Counter[str]] = {}
+    for switch, port, _host in attachments:
+        vlan = access_vlan(switch, port)
+        if vlan and vlan != "TRUNK":
+            name = (switch.findtext("./ENGINE/NAME") or "").strip()
+            votes.setdefault(name, Counter())[vlan] += 1
+
+    placed: list[str] = []
+    for switch, port, host in attachments:
+        if access_vlan(switch, port):
+            continue
+        name = (switch.findtext("./ENGINE/NAME") or "").strip()
+        wanted = votes[name].most_common(1)[0][0] if votes.get(name) else fallback
+        if not wanted:
+            continue
+        config = switch.find("./ENGINE/RUNNINGCONFIG")
+        if config is None:
+            continue
+        _set_config_block(
+            config,
+            f"interface {port}",
+            [" switchport mode access", f" switchport access vlan {wanted}"],
+        )
+        placed.append(f"{name}:{port} -> VLAN {wanted} ({host.findtext('./ENGINE/NAME') or ''})")
+    return placed
+
+
+def _drop_stale_point_to_point_addresses(root: ET.Element) -> list[str]:
+    """A router-to-router address on a port with no cable is left over.
+
+    `_mesh_routers_with_point_to_point_links` only ever takes free ports, so it
+    cannot overwrite a live link -- but a generated lab is the next build's
+    donor, and pruning can take the cable while leaving the address behind. The
+    pass then picks a different free port, and the router ends up holding the
+    same /30 address twice. Measured on a six-switch lab: R1 carried
+    `10.255.0.2` on both `GigabitEthernet0/1` and `GigabitEthernet0/2`, one of
+    them cabled and one not.
+
+    Only the range this file hands out is touched, and only where no cable
+    arrives, so a donor's own addressing is never disturbed.
+    """
+    cabled: set[tuple[str, str]] = set()
+    devices_by_ref = {
+        (device.findtext("./ENGINE/SAVE_REF_ID") or "").strip(): device
+        for device in root.findall(".//DEVICES/DEVICE")
+    }
+    for link in root.findall(".//LINKS/LINK"):
+        cable = link.find("./CABLE")
+        if cable is None:
+            continue
+        refs = [(cable.findtext(tag) or "").strip() for tag in ("FROM", "TO")]
+        ports = [node.text or "" for node in cable.findall("PORT")]
+        for index, ref in enumerate(refs):
+            device = devices_by_ref.get(ref)
+            if device is not None and index < len(ports):
+                cabled.add(((device.findtext("./ENGINE/NAME") or "").strip(), ports[index]))
+
+    dropped: list[str] = []
+    for device in root.findall(".//DEVICES/DEVICE"):
+        if (device.findtext("./ENGINE/TYPE") or "") != "Router":
+            continue
+        name = (device.findtext("./ENGINE/NAME") or "").strip()
+        for section in ("RUNNINGCONFIG", "STARTUPCONFIG"):
+            config = device.find(f"./ENGINE/{section}")
             if config is None:
                 continue
-            # Another interface may already hold an address in this subnet --
-            # the one the plan originally chose. Two interfaces on one router
-            # cannot share a subnet, so the stale one gives up its address.
-            prefix = gateway.rsplit(".", 1)[0]
-            lines = [(line.text or "") for line in config.findall("LINE")]
-            cleared: list[str] = []
-            for index, line in enumerate(lines):
-                match = re.match(r"interface ((?:Gigabit|Fast)Ethernet\S*)\s*$", line.strip())
-                if not match or match.group(1) == ports[router_index]:
+            port = ""
+            doomed: list[ET.Element] = []
+            for node in config.findall("LINE"):
+                text = (node.text or "").strip()
+                if text.startswith("interface "):
+                    port = text.split(None, 1)[1]
+                elif (
+                    port
+                    and "." not in port
+                    and (name, port) not in cabled
+                    and re.match(r"^ip address 10\.255\.\d+\.\d+ ", text)
+                ):
+                    doomed.append(node)
+            for node in doomed:
+                if node in list(config):
+                    config.remove(node)
+            if doomed and section == "RUNNINGCONFIG":
+                dropped.append(f"{name}: dropped {len(doomed)} stale point-to-point address(es)")
+    return dropped
+
+
+def _mesh_routers_with_point_to_point_links(root: ET.Element) -> list[str]:
+    """Join the routers to each other on /30 links.
+
+    A campus drawing is mostly routers wired to each other -- `10.10.10.0/30`,
+    `10.10.10.4/30`, `10.10.10.8/30` and so on -- and the generated labs had
+    routers standing alone: eight of them in the enterprise lab, five with no
+    cable at all. A router with no path to another router cannot carry a route
+    from it, so OSPF had nothing to exchange.
+
+    Each pair takes the next /30 and both ends are advertised, which is what
+    makes the mesh do something rather than merely exist. Only interfaces the
+    device really has are used, and a router already carrying the VLAN trunk
+    keeps it -- the trunk is its job, and a second address on the same port
+    would take it away.
+    """
+    from pkt_editor import _ensure_link
+
+    routers = [
+        device
+        for device in root.findall(".//DEVICES/DEVICE")
+        if (device.findtext("./ENGINE/TYPE") or "") == "Router"
+    ]
+    if len(routers) < 2:
+        return []
+
+    busy: set[tuple[str, str]] = set()
+    devices_by_ref = {
+        (device.findtext("./ENGINE/SAVE_REF_ID") or "").strip(): device
+        for device in root.findall(".//DEVICES/DEVICE")
+    }
+    for link in root.findall(".//LINKS/LINK"):
+        cable = link.find("./CABLE")
+        if cable is None:
+            continue
+        refs = [(cable.findtext(tag) or "").strip() for tag in ("FROM", "TO")]
+        ports = [node.text or "" for node in cable.findall("PORT")]
+        for index, ref in enumerate(refs):
+            device = devices_by_ref.get(ref)
+            if device is not None and index < len(ports):
+                busy.add(((device.findtext("./ENGINE/NAME") or "").strip(), ports[index]))
+
+    def free_port(router: ET.Element) -> str:
+        name = (router.findtext("./ENGINE/NAME") or "").strip()
+        for candidate in donor_interface_names(router) or []:
+            if candidate.startswith(("GigabitEthernet", "FastEthernet")) and "." not in candidate:
+                if (name, candidate) not in busy and port_exists(router, candidate):
+                    return candidate
+        for shape in ("GigabitEthernet0/{n}", "FastEthernet0/{n}"):
+            for index in range(0, 4):
+                candidate = shape.format(n=index)
+                if (name, candidate) not in busy and port_exists(router, candidate):
+                    return candidate
+        return ""
+
+    def octets(value: int) -> str:
+        return ".".join(str((value >> shift) & 0xFF) for shift in (24, 16, 8, 0))
+
+    base = _address_to_int("10.255.0.0") or 0
+    notes: list[str] = []
+    made = 0
+    for position, left in enumerate(routers):
+        for right in routers[position + 1 :]:
+            left_port, right_port = free_port(left), free_port(right)
+            if not left_port or not right_port:
+                continue
+            left_name = (left.findtext("./ENGINE/NAME") or "").strip()
+            right_name = (right.findtext("./ENGINE/NAME") or "").strip()
+            network = base + made * 4
+            _ensure_link(root, left_name, left_port, right_name, right_port, "copper")
+            busy.add((left_name, left_port))
+            busy.add((right_name, right_port))
+            for device, port, address in (
+                (left, left_port, network + 1),
+                (right, right_port, network + 2),
+            ):
+                config = device.find("./ENGINE/RUNNINGCONFIG")
+                if config is None:
                     continue
-                cursor = index + 1
-                while cursor < len(lines) and lines[cursor].startswith(" "):
-                    address = re.match(
-                        r"ip address (\d+\.\d+\.\d+\.\d+) ", lines[cursor].strip()
+                _set_config_block(
+                    config,
+                    f"interface {port}",
+                    [
+                        f" description point-to-point to {right_name if device is left else left_name}",
+                        f" ip address {octets(address)} 255.255.255.252",
+                        " ip ospf network point-to-point",
+                        " no shutdown",
+                    ],
+                )
+                if any(
+                    (node.text or "").strip().startswith("router ospf")
+                    for node in config.findall("LINE")
+                ):
+                    _set_config_block(
+                        config,
+                        "router ospf 1",
+                        [f" network {octets(network)} 0.0.0.3 area 0"],
                     )
-                    if address and address.group(1).rsplit(".", 1)[0] == prefix:
-                        cleared.append(match.group(1))
-                        break
-                    cursor += 1
-            for interface in cleared:
-                _set_config_block(config, f"interface {interface}", [" no ip address"])
+            notes.append(f"{left_name}:{left_port} <-> {right_name}:{right_port} {octets(network)}/30")
+            made += 1
+    if not notes:
+        return []
+    return [f"{made} point-to-point link(s): " + "; ".join(notes[:5])]
 
-            _set_config_block(
-                config,
-                f"interface {ports[router_index]}",
-                [f" ip address {gateway} 255.255.255.0", " no shutdown"],
-            )
-            name = router.findtext("./ENGINE/NAME") or ""
-            note = f"{name}: {ports[router_index]} set to {gateway} (gateway the hosts use)"
-            if cleared:
-                note += f"; cleared overlapping address on {', '.join(cleared)}"
-            return [note]
-    return []
+
+def _host_mask_on_port(device: ET.Element) -> str:
+    """The mask a host is actually using, or an empty string."""
+    for port in device.findall(".//PORT"):
+        mask = (port.findtext("SUBNET") or "").strip()
+        if re.fullmatch(r"\d+\.\d+\.\d+\.\d+", mask) and mask != "0.0.0.0":
+            return mask
+    return ""
 
 
-_SVI_ADDRESS_PATTERN = re.compile(r"^ip address (\d+\.\d+\.\d+\.\d+) (\d+\.\d+\.\d+\.\d+)$")
+def _pool_window(network: str, mask: str) -> tuple[str, str, str]:
+    """Where a pool's reserved range ends and its handout range begins.
+
+    Half the subnet is kept back for the gateway, the servers and the printers
+    that are addressed by hand, and the rest is handed out. On a /24 that is
+    the familiar .1 to .99 reserved and .100 upwards served; on a /26 it is .1
+    to .30 and .31 upwards, which is the point of doing the arithmetic rather
+    than writing .99 everywhere -- a /26 has no .99, so the excluded range
+    covered the whole subnet and the pool had nothing left to give.
+    """
+    base = _address_to_int(network + ".0") if network.count(".") == 2 else _address_to_int(network)
+    mask_value = _address_to_int(mask)
+    if base is None or mask_value is None:
+        return "", "", ""
+    size = (~mask_value) & 0xFFFFFFFF
+    if size < 3:
+        return "", "", ""
+    start = (base & mask_value) + 1
+    half = (base & mask_value) + max(2, size // 2)
+
+    def text(value: int) -> str:
+        return ".".join(str((value >> shift) & 0xFF) for shift in (24, 16, 8, 0))
+
+    return text(start), text(half - 1), text(half)
+
+
+def _serve_every_populated_vlan(root: ET.Element) -> list[str]:
+    """Give every VLAN that carries hosts a gateway and a pool.
+
+    A twenty-VLAN prompt produced a router with subinterfaces for seven of
+    them. The other thirteen had hosts cabled into them, on access ports, in
+    VLANs the router had never heard of -- so those hosts had no gateway, no
+    pool, and no way off their own switch. Measured on a 140-device lab: 23
+    distinct host subnets, half of them the donor's 192.168.x, none of which
+    any router interface served.
+
+    The VLAN plan is the statement of intent, and 10.10.<vlan>.0/24 is the
+    scheme the rest of the generator already uses, so a VLAN that hosts sit in
+    gets that network: a subinterface on the trunk the router already has, and
+    a pool behind it. Nothing is invented for a VLAN nobody is plugged into.
+    """
+    devices_by_ref = {
+        (device.findtext("./ENGINE/SAVE_REF_ID") or "").strip(): device
+        for device in root.findall(".//DEVICES/DEVICE")
+    }
+    switch_types = {"Switch", "MultiLayerSwitch"}
+
+    populated: set[str] = set()
+    # What the hosts in a VLAN are already addressed as. Imposing a scheme here
+    # is how a lab ends up with two address plans: this pass used
+    # 10.10.<vlan>.0/24 while the addressing pass had put that VLAN's hosts on
+    # 192.168.<vlan>.0/24, so the gateway it created served a network none of
+    # them were on. The hosts decide; 10.10.<vlan> is only the fallback for a
+    # VLAN whose hosts carry no address yet.
+    host_subnets: dict[str, Counter[str]] = {}
+    # And with what mask. A VLAN plan that uses /26 or /27 -- as a real one
+    # does -- gets a gateway and a pool of that size rather than a /24 nobody
+    # asked for.
+    host_masks: dict[str, Counter[str]] = {}
+    router_trunk: tuple[ET.Element, str] | None = None
+    for link in root.findall(".//LINKS/LINK"):
+        cable = link.find("./CABLE")
+        if cable is None:
+            continue
+        refs = [(cable.findtext(tag) or "").strip() for tag in ("FROM", "TO")]
+        ports = [node.text or "" for node in cable.findall("PORT")]
+        if len(ports) < 2:
+            continue
+        for near, far in ((0, 1), (1, 0)):
+            near_device = devices_by_ref.get(refs[near])
+            far_device = devices_by_ref.get(refs[far])
+            if near_device is None or far_device is None:
+                continue
+            far_kind = (far_device.findtext("./ENGINE/TYPE") or "")
+            near_kind = (near_device.findtext("./ENGINE/TYPE") or "")
+            if far_kind not in switch_types:
+                continue
+            if near_kind == "Router" and router_trunk is None:
+                if _router_subinterface_vlans(near_device, ports[near]):
+                    router_trunk = (near_device, ports[near])
+                continue
+            if not _is_host_device({"type": _normalize_device_type(near_kind)}):
+                continue
+            inside = False
+            for node in far_device.findall("./ENGINE/RUNNINGCONFIG/LINE"):
+                line = (node.text or "").strip()
+                if line.startswith("interface "):
+                    inside = line == f"interface {ports[far]}"
+                elif inside and line.startswith("switchport access vlan "):
+                    vlan = line.split()[-1]
+                    populated.add(vlan)
+                    for candidate in near_device.iter():
+                        text = (candidate.text or "").strip()
+                        if candidate.tag.upper() == "IP" and re.fullmatch(
+                            r"\d+\.\d+\.\d+\.\d+", text
+                        ):
+                            host_subnets.setdefault(vlan, Counter())[
+                                text.rsplit(".", 1)[0]
+                            ] += 1
+                            mask = _host_mask_on_port(near_device)
+                            if mask:
+                                host_masks.setdefault(vlan, Counter())[mask] += 1
+                            break
+                    break
+    if router_trunk is None:
+        return []
+
+    router, parent = router_trunk
+    config = router.find("./ENGINE/RUNNINGCONFIG")
+    if config is None:
+        return []
+    known = set(_router_subinterface_vlans(router, parent))
+    # A subinterface without a pool is half the job: the VLAN routes but hands
+    # out no addresses, and its workstations stay on whatever the donor gave
+    # them. Both halves are counted separately for that reason.
+    # Keyed by network, not by VLAN number: a pool's network says nothing about
+    # which VLAN it serves unless the lab happens to number them alike, and
+    # matching on `10.10.<vlan>` missed every 192.168 pool the addressing pass
+    # had made.
+    pooled_networks: set[str] = set()
+    in_pool = False
+    for node in config.findall("LINE"):
+        text = (node.text or "").strip()
+        if text.startswith("ip dhcp pool"):
+            in_pool = True
+            continue
+        if in_pool:
+            match = re.match(r"^network (\d+\.\d+\.\d+)\.\d+ ", text)
+            if match:
+                pooled_networks.add(match.group(1))
+                in_pool = False
+            elif text.startswith(("interface ", "ip dhcp pool", "router ")):
+                in_pool = False
+
+    # VLAN 1 is nobody's plan, and a number past the third octet has no place
+    # in this scheme.
+    wanted = sorted(
+        (vlan for vlan in populated if vlan != "1" and int(vlan) <= 254), key=int
+    )
+    def already_pooled(vlan: str) -> bool:
+        votes = host_subnets.get(vlan)
+        network = votes.most_common(1)[0][0] if votes else f"10.10.{vlan}"
+        return network in pooled_networks
+
+    if not any(vlan not in known or not already_pooled(vlan) for vlan in wanted):
+        return []
+
+    added: list[str] = []
+    for vlan in wanted:
+        votes = host_subnets.get(vlan)
+        network = votes.most_common(1)[0][0] if votes else f"10.10.{vlan}"
+        masks = host_masks.get(vlan)
+        mask = masks.most_common(1)[0][0] if masks else "255.255.255.0"
+        first, last_reserved, first_served = _pool_window(network, mask)
+        if not first:
+            mask, = ("255.255.255.0",)
+            first, last_reserved, first_served = _pool_window(network, mask)
+        lines: list[str] = []
+        if vlan not in known:
+            lines += [
+                f"interface {parent}.{vlan}",
+                f" description VLAN{vlan}",
+                f" encapsulation dot1Q {vlan}",
+                f" ip address {first} {mask}",
+                " ip nat inside",
+                "!",
+            ]
+        if not already_pooled(vlan):
+            lines += [
+                f"ip dhcp excluded-address {first} {last_reserved}",
+                f"ip dhcp pool VLAN{vlan}",
+                f" network {network}.0 {mask}",
+                f" default-router {first}",
+            ]
+        if not lines:
+            continue
+        for text in lines:
+            node = ET.SubElement(config, "LINE")
+            node.text = text
+        added.append(
+            f"VLAN {vlan}"
+            + (" gateway" if vlan not in known else "")
+            + (" pool" if not already_pooled(vlan) else "")
+        )
+    name = router.findtext("./ENGINE/NAME") or ""
+    return [f"{name}: served {len(added)} VLAN(s) that had hosts and no gateway: " + "; ".join(added)]
+
+
+def _put_workstations_on_dhcp(root: ET.Element) -> list[str]:
+    """Let the pools actually serve someone.
+
+    A DHCP pool and a DHCP client are two halves of one feature, and only the
+    first half was ever emitted for a segmented lab: `_synthesize_service_ops`
+    puts hosts on DHCP only when the prompt names no VLAN, so every VLAN lab
+    shipped one pool per VLAN with not a single device asking for an address.
+    The prompt said `dhcp olsun`, the configuration showed the pools, and every
+    workstation sat on a static address typed by the generator.
 
+    Workstations move; servers and printers do not. A real network gives the
+    first group addresses and pins the second, so only PCs and laptops are
+    switched over, and the pool is told to keep the low addresses free -- the
+    gateway, the servers on .50, the printers on .60 -- and hand out from .100.
+    """
+    pools: list[tuple[ET.Element, str]] = []
+    for device in root.findall(".//DEVICES/DEVICE"):
+        if (device.findtext("./ENGINE/TYPE") or "") != "Router":
+            continue
+        config = device.find("./ENGINE/RUNNINGCONFIG")
+        if config is None:
+            continue
+        in_pool = False
+        for node in config.findall("LINE"):
+            text = (node.text or "").strip()
+            if text.startswith("ip dhcp pool"):
+                in_pool = True
+                continue
+            if in_pool:
+                match = re.match(r"^network (\d+\.\d+\.\d+)\.\d+ 255\.255\.255\.0$", text)
+                if match:
+                    pools.append((device, match.group(1)))
+                    in_pool = False
+                elif text.startswith(("interface ", "ip dhcp pool", "router ")):
+                    in_pool = False
+    if not pools:
+        return []
+
+    served = {subnet for _device, subnet in pools}
+    for device, subnet in pools:
+        config = device.find("./ENGINE/RUNNINGCONFIG")
+        if config is None:
+            continue
+        first, last_reserved, _first_served = _pool_window(subnet, "255.255.255.0")
+        wanted = f"ip dhcp excluded-address {first} {last_reserved}"
+        if any((node.text or "").strip() == wanted for node in config.findall("LINE")):
+            continue
+        node = ET.Element("LINE")
+        node.text = wanted
+        children = list(config)
+        first_pool = next(
+            (
+                child
+                for child in children
+                if (child.text or "").strip().startswith("ip dhcp pool")
+            ),
+            None,
+        )
+        config.insert(children.index(first_pool) if first_pool is not None else len(children), node)
+
+    # A workstation's VLAN is the truth about which network it belongs to; its
+    # address may still be the donor's. Pruning leaves hosts on the donor's
+    # plan -- measured on a 140-device lab, 23 subnets across 95 hosts, half of
+    # them 192.168.x that no router interface serves -- and re-addressing each
+    # one by hand is a second address plan waiting to disagree with the first.
+    # Reading the VLAN off the port and letting DHCP supply the address puts
+    # every host on the network it is actually cabled into.
+    vlan_subnets = _vlan_subnets_from_router(root)
+    devices_by_ref = {
+        (device.findtext("./ENGINE/SAVE_REF_ID") or "").strip(): device
+        for device in root.findall(".//DEVICES/DEVICE")
+    }
+    switch_types = {"Switch", "MultiLayerSwitch"}
+
+    def access_vlan(switch: ET.Element, port: str) -> str:
+        inside = False
+        for node in switch.findall("./ENGINE/RUNNINGCONFIG/LINE"):
+            line = (node.text or "").strip()
+            if line.startswith("interface "):
+                inside = line == f"interface {port}"
+            elif inside and line.startswith("switchport access vlan "):
+                return line.split()[-1]
+        return ""
+
+    vlan_of_host: dict[str, str] = {}
+    for link in root.findall(".//LINKS/LINK"):
+        cable = link.find("./CABLE")
+        if cable is None:
+            continue
+        refs = [(cable.findtext(tag) or "").strip() for tag in ("FROM", "TO")]
+        ports = [node.text or "" for node in cable.findall("PORT")]
+        if len(ports) < 2:
+            continue
+        for near, far in ((0, 1), (1, 0)):
+            host = devices_by_ref.get(refs[near])
+            switch = devices_by_ref.get(refs[far])
+            if host is None or switch is None:
+                continue
+            if (switch.findtext("./ENGINE/TYPE") or "") not in switch_types:
+                continue
+            vlan = access_vlan(switch, ports[far])
+            if vlan:
+                vlan_of_host[(host.findtext("./ENGINE/NAME") or "").strip()] = vlan
+
+    moved: list[str] = []
+    for device in root.findall(".//DEVICES/DEVICE"):
+        kind = _normalize_device_type(device.findtext("./ENGINE/TYPE") or "")
+        if kind not in {"PC", "Laptop"}:
+            continue
+        address = ""
+        for node in device.iter():
+            text = (node.text or "").strip()
+            if node.tag.upper() == "IP" and re.fullmatch(r"\d+\.\d+\.\d+\.\d+", text):
+                address = text
+                break
+        vlan = vlan_of_host.get((device.findtext("./ENGINE/NAME") or "").strip(), "")
+        served_by_vlan = vlan_subnets.get(vlan, "") in served if vlan else False
+        if not served_by_vlan and (not address or address.rsplit(".", 1)[0] not in served):
+            continue
+        for port in device.findall(".//PORT"):
+            if port.find("PORT_DHCP_ENABLE") is not None:
+                _ensure_text(port, "PORT_DHCP_ENABLE", "true")
+        engine = device.find("./ENGINE")
+        if engine is not None:
+            for profile in _profile_nodes(engine):
+                _ensure_text(profile, "DHCP_ENABLED", "1")
+        moved.append(f"{device.findtext('./ENGINE/NAME') or ''}: {address} -> DHCP")
+    return moved
+
+
+def _retarget_config_to_real_interface_names(root: ET.Element) -> list[str]:
+    """Move a config block onto the interface the device actually has.
+
+    The planner names an interface from the model it planned; the donor supplies
+    a different model; nothing compares the two. `_router_port` gave
+    `GigabitEthernet0/0/0` -- an ISR's shape -- and the device that arrived was a
+    2911 carrying `GigabitEthernet0/0` .. `0/2`. The block was written, and
+    `_drop_config_for_absent_interfaces` then deleted it, which is right for
+    hardware that is genuinely gone and wrong here: the intent was real and the
+    only thing mistaken was the spelling.
+
+    Measured on "2 router 2 switch 6 komputer qur ipv6 ve ospfv3 olsun": the
+    IPv6 address and every OSPFv3 line went out with the block, and the lab
+    shipped with `ipv6 unicast-routing` -- a global line, so it survived -- and
+    not one IPv6 address on anything.
+
+    Only the slot spelling is changed, never the port number: `0/0/2` may become
+    `0/2` and `0/1` may become `0/0/1`, and a subinterface keeps its tag. A name
+    that no rewriting makes real is left for the drop pass to deal with.
+    """
+    from pkt_transformer import port_exists
+
+    moved: list[str] = []
+    for device in root.findall(".//DEVICES/DEVICE"):
+        if (device.findtext("./ENGINE/TYPE") or "") != "Router":
+            continue
+        name = (device.findtext("./ENGINE/NAME") or "").strip()
+        for section in ("RUNNINGCONFIG", "STARTUPCONFIG"):
+            config = device.find(f"./ENGINE/{section}")
+            if config is None:
+                continue
+            taken = {
+                (node.text or "").strip().split(None, 1)[1]
+                for node in config.findall("LINE")
+                if (node.text or "").strip().startswith("interface ")
+            }
+            for node in config.findall("LINE"):
+                text = (node.text or "").strip()
+                if not text.startswith("interface "):
+                    continue
+                port = text.split(None, 1)[1]
+                parent, _, tag = port.partition(".")
+                if port_exists(device, parent):
+                    continue
+                match = re.match(r"^([A-Za-z]+)((?:\d+/)+\d+)$", parent)
+                if match is None:
+                    continue
+                kind, numbers = match.group(1), match.group(2).split("/")
+                shapes = []
+                if len(numbers) == 3:
+                    shapes.append(f"{kind}{numbers[0]}/{numbers[2]}")
+                elif len(numbers) == 2:
+                    shapes.append(f"{kind}{numbers[0]}/0/{numbers[1]}")
+                # Renaming onto a block that already exists is allowed: the
+                # merge pass runs later and combines them by the device's own
+                # rule. Refusing was what made the first version of this do
+                # nothing at all -- `GigabitEthernet0/0/0` maps to
+                # `GigabitEthernet0/0`, and a router already has a block for
+                # its own first interface.
+                replacement = next(
+                    (shape for shape in shapes if port_exists(device, shape)),
+                    "",
+                )
+                if not replacement:
+                    continue
+                wanted = replacement if not tag else f"{replacement}.{tag}"
+                node.text = f"interface {wanted}"
+                taken.discard(port)
+                taken.add(wanted)
+                if section == "RUNNINGCONFIG":
+                    moved.append(f"{name}: {port} -> {wanted}, the interface the device has")
+    return moved
+
+
+def _drop_config_for_absent_interfaces(root: ET.Element) -> list[str]:
+    """Delete configuration for interfaces the device does not have.
+
+    Pruning a donor leaves whole interface blocks behind for hardware that is
+    no longer there. On the generated company lab R1 was a 2911 -- ports
+    `GigabitEthernet0/0` .. `0/2` -- and still carried
+    `GigabitEthernet0/0/0.10` through `.50`, an ISR's naming, each with a
+    192.168.x address.
+
+    They are not merely untidy. They are read as real interfaces by everything
+    that reasons about the router's networks, and they carry the donor's whole
+    address plan: `_align_dhcp_pools_with_interfaces` saw pools serving
+    192.168.30.0 "matching an interface" and left them pointing at a network
+    no cable reaches, so the lab had DHCP configured and handed out nothing.
+
+    A block is removed only when the device's own port list says the parent
+    does not exist, so a subinterface of a real port is never touched.
+    """
+    dropped: list[str] = []
+    for device in root.findall(".//DEVICES/DEVICE"):
+        for section in ("RUNNINGCONFIG", "STARTUPCONFIG"):
+            config = device.find(f"./ENGINE/{section}")
+            if config is None:
+                continue
+            removing = False
+            removed_here: list[str] = []
+            for node in list(config.findall("LINE")):
+                text = (node.text or "")
+                stripped = text.strip()
+                if stripped.startswith("interface "):
+                    name = stripped.split(None, 1)[1]
+                    parent = name.split(".", 1)[0]
+                    # A VLAN interface, a loopback, a port-channel or a tunnel
+                    # is configuration, not a socket -- `port_exists` says so
+                    # deliberately, and reading that as "the device does not
+                    # have it" deletes the management SVI. Measured: "management
+                    # vlan 99 ve telnet olsun" produced a lab with VLAN 99
+                    # declared, its ports assigned and its trunks allowing it,
+                    # and no `interface Vlan99` for anything to telnet into.
+                    removing = not parent.startswith(
+                        ("Vlan", "Loopback", "Port-channel", "Tunnel", "PRP-channel")
+                    ) and not port_exists(device, parent)
+                    if removing:
+                        removed_here.append(name)
+                        config.remove(node)
+                    continue
+                if removing and (text.startswith((" ", "\t")) or stripped == "!"):
+                    config.remove(node)
+                    continue
+                removing = False
+            if removed_here and section == "RUNNINGCONFIG":
+                dropped.append(
+                    f"{device.findtext('./ENGINE/NAME') or ''}: dropped {len(removed_here)} "
+                    f"block(s) for absent interfaces ({', '.join(removed_here[:3])})"
+                )
+    return dropped
+
+
+def _drop_port_security_from_trunks(root: ET.Element) -> list[str]:
+    """Port security belongs on an access port, never on a trunk.
+
+    A trunk carries every MAC address behind the switch on the other end, so
+    `switchport port-security maximum 2` on one is a violation waiting for the
+    third host to speak. Measured on the generated company lab: SW1's trunk to
+    SW3 carried port security, SW3 was cut off from the rest of the network,
+    and its whole VLAN 10 -- three workstations -- fell back to APIPA because
+    no DHCP offer could reach them. Every other VLAN leased normally.
+
+    The port-security operation is emitted against a port chosen before the
+    trunks are settled, so the two decisions are made independently and only
+    the cable knows which port ended up carrying a trunk.
+    """
+    dropped: list[str] = []
+    for device in root.findall(".//DEVICES/DEVICE"):
+        if (device.findtext("./ENGINE/TYPE") or "") not in {"Switch", "MultiLayerSwitch"}:
+            continue
+        for section in ("RUNNINGCONFIG", "STARTUPCONFIG"):
+            config = device.find(f"./ENGINE/{section}")
+            if config is None:
+                continue
+            blocks: dict[str, list[ET.Element]] = {}
+            current = ""
+            for node in config.findall("LINE"):
+                text = (node.text or "").strip()
+                if text.startswith("interface "):
+                    current = text.split(None, 1)[1]
+                    blocks.setdefault(current, [])
+                elif current:
+                    blocks.setdefault(current, []).append(node)
+            for port, body in blocks.items():
+                if not any((n.text or "").strip() == "switchport mode trunk" for n in body):
+                    continue
+                removed = [n for n in body if "port-security" in (n.text or "")]
+                for node in removed:
+                    if node in list(config):
+                        config.remove(node)
+                if removed and section == "RUNNINGCONFIG":
+                    dropped.append(
+                        f"{device.findtext('./ENGINE/NAME') or ''}:{port} port security "
+                        f"removed ({len(removed)} line(s)) -- it is a trunk"
+                    )
+    return dropped
+
+
+def _align_etherchannels_with_cabling(root: ET.Element) -> list[str]:
+    """An EtherChannel is two or more cables between the same two switches.
+
+    `_synthesize_security_ops` writes `channel-group 1 mode on` onto
+    `GigabitEthernet0/1` and `GigabitEthernet0/2` of the first two switches it
+    finds, without ever asking what those ports are cabled to. Measured on the
+    153-device enterprise lab: SW2's `Gi0/1` is its only uplink to the core and
+    `Gi0/2` has no cable at all, so the pass bundled a live trunk with a dead
+    port towards a peer -- SW18 -- that was not bundling anything. The port
+    joins a `Port-channel1` that no line in the file configures, the trunk
+    settings stop applying, and the switch drops off the network: Printer6, the
+    one routable host behind SW2, could not reach even its own gateway's real
+    address on VLAN 50, while identical hosts behind SW3 and SW4 -- neither of
+    which was given a channel-group -- answered normally.
+
+    Which ports form a bundle is a fact about the cabling, and the plan settles
+    it before any cable exists, so the two decisions are made independently and
+    nothing compares them. This pass is the one that can see the cables.
+
+    A pair asked to bundle needs two of them. Where only one exists and both
+    switches still have a free port, the second is laid here -- the only place
+    that knows both which pair was asked and which ports are still free -- and
+    every cable between the pair becomes a member, with one channel number, one
+    mode, the trunk settings copied onto the ports that were not trunks before,
+    and the `interface Port-channelN` that holds them. Where the second cable
+    cannot be laid the line goes, because a bundle of one is not a bundle: it is
+    an ordinary port carrying configuration that stops it working.
+    """
+    switch_types = {"Switch", "MultiLayerSwitch"}
+    devices_by_ref: dict[str, ET.Element] = {}
+    devices_by_name: dict[str, ET.Element] = {}
+    for device in root.findall(".//DEVICES/DEVICE"):
+        devices_by_ref[(device.findtext("./ENGINE/SAVE_REF_ID") or "").strip()] = device
+        devices_by_name[(device.findtext("./ENGINE/NAME") or "").strip()] = device
+
+    members: dict[tuple[str, str], tuple[int, str]] = {}
+    for name, device in devices_by_name.items():
+        if (device.findtext("./ENGINE/TYPE") or "") not in switch_types:
+            continue
+        current = ""
+        for node in device.findall("./ENGINE/RUNNINGCONFIG/LINE"):
+            text = (node.text or "").strip()
+            if text.startswith("interface "):
+                current = text.split(None, 1)[1]
+                continue
+            match = re.match(r"^channel-group (\d+) mode (\S+)$", text)
+            if match and current:
+                members[(name, current)] = (int(match.group(1)), match.group(2))
+    if not members:
+        return []
+
+    from pkt_editor import _ensure_link
+
+    busy: set[tuple[str, str]] = set()
+    for link in root.findall(".//LINKS/LINK"):
+        cable = link.find("./CABLE")
+        if cable is None:
+            continue
+        refs = [(cable.findtext(tag) or "").strip() for tag in ("FROM", "TO")]
+        ports = [node.text or "" for node in cable.findall("PORT")]
+        for index, ref in enumerate(refs):
+            device = devices_by_ref.get(ref)
+            if device is not None and index < len(ports):
+                busy.add(((device.findtext("./ENGINE/NAME") or "").strip(), ports[index]))
+
+    bundles: dict[tuple[str, str], list[tuple[tuple[str, str], tuple[str, str]]]] = {}
+    for link in root.findall(".//LINKS/LINK"):
+        cable = link.find("./CABLE")
+        if cable is None:
+            continue
+        refs = [(cable.findtext(tag) or "").strip() for tag in ("FROM", "TO")]
+        ports = [node.text or "" for node in cable.findall("PORT")]
+        if len(ports) < 2:
+            continue
+        left, right = devices_by_ref.get(refs[0]), devices_by_ref.get(refs[1])
+        if left is None or right is None:
+            continue
+        if (left.findtext("./ENGINE/TYPE") or "") not in switch_types:
+            continue
+        if (right.findtext("./ENGINE/TYPE") or "") not in switch_types:
+            continue
+        ends = (
+            ((left.findtext("./ENGINE/NAME") or "").strip(), ports[0]),
+            ((right.findtext("./ENGINE/NAME") or "").strip(), ports[1]),
+        )
+        # One end asking is enough to record the intent. Which end was given the
+        # line is an accident of the order the planner walked the switches.
+        if ends[0] not in members and ends[1] not in members:
+            continue
+        bundles.setdefault(tuple(sorted((ends[0][0], ends[1][0]))), []).append(ends)
+
+    def trunk_body(name: str, port: str) -> list[str]:
+        device = devices_by_name.get(name)
+        wanted: list[str] = []
+        if device is None:
+            return wanted
+        inside = False
+        for node in device.findall("./ENGINE/RUNNINGCONFIG/LINE"):
+            text = (node.text or "").strip()
+            if text.startswith("interface "):
+                inside = text == f"interface {port}"
+            elif inside and text.startswith("switchport") and text not in wanted:
+                wanted.append(text)
+        return [f" {line}" for line in wanted]
+
+    def drop_line(config: ET.Element, port: str, prefix: str) -> None:
+        """`_set_config_block` matches on the first two words, so an access VLAN
+        left on a port that is now a trunk survives writing `switchport mode
+        trunk` beside it."""
+        current = ""
+        for node in list(config.findall("LINE")):
+            text = (node.text or "").strip()
+            if text.startswith("interface "):
+                current = text.split(None, 1)[1]
+            elif current == port and text.startswith(prefix):
+                config.remove(node)
+
+    def free_ports(name: str, family: str, count: int) -> list[str]:
+        """Free sockets of one speed, because a bundle cannot mix them.
+
+        A gigabit port bundled with a FastEthernet one is refused for speed
+        mismatch, and the first attempt at this produced exactly that: SW3
+        offered `GigabitEthernet0/1` to one neighbour and `FastEthernet0/1` to
+        the next, because the search preferred gigabit rather than matching.
+        """
+        device = devices_by_name.get(name)
+        if device is None or not family:
+            return []
+        found: list[str] = []
+        for candidate in donor_interface_names(device) or []:
+            if not candidate.startswith(family) or "." in candidate:
+                continue
+            if (name, candidate) not in busy and port_exists(device, candidate):
+                found.append(candidate)
+                if len(found) == count:
+                    break
+        return found
+
+    def family_of(port: str) -> str:
+        for prefix in ("GigabitEthernet", "FastEthernet"):
+            if port.startswith(prefix):
+                return prefix
+        return ""
+
+    # A switch in two bundles needs two channel numbers: members of different
+    # neighbours cannot share one Port-channel. The planner writes `1` for
+    # every switch it touches, so SW3 came out with four members of "channel 1"
+    # facing two different neighbours.
+    taken_channels: dict[str, set[int]] = {}
+
+    keep: dict[tuple[str, str], tuple[int, str]] = {}
+    notes: list[str] = []
+    for pair, cables in sorted(bundles.items()):
+        stated = [members[end] for cable in cables for end in cable if end in members]
+        template = next((end for cable in cables for end in cable if trunk_body(*end)), cables[0][0])
+        body = trunk_body(*template)
+
+        def lay(left: tuple[str, str], right: tuple[str, str]) -> tuple[tuple[str, str], tuple[str, str]]:
+            _ensure_link(root, left[0], left[1], right[0], right[1], "crossover", allow_parallel=True)
+            busy.add(left)
+            busy.add(right)
+            return (left, right)
+
+        if len(cables) == 1:
+            # A bundle needs a second cable, and the pass that lays cables ran
+            # long before anything asked for a bundle. Adding it here is the
+            # only place both facts are known: which pair was asked to bundle,
+            # and which of their ports are still free.
+            (left_name, left_member), (right_name, right_member) = cables[0]
+            family = family_of(left_member)
+            if family == family_of(right_member):
+                left_free = free_ports(left_name, family, 1)
+                right_free = free_ports(right_name, family, 1)
+                if left_free and right_free:
+                    cables.append(lay((left_name, left_free[0]), (right_name, right_free[0])))
+        if len(cables) == 1:
+            # The member's own speed has no socket left -- on a 2960 both
+            # gigabit ports are usually the two uplinks. A bundle can still be
+            # built beside it out of two cables of a speed that does have room;
+            # the original cable stays an ordinary trunk and loses its line.
+            (left_name, _), (right_name, _) = cables[0]
+            for family in ("GigabitEthernet", "FastEthernet"):
+                left_free = free_ports(left_name, family, 2)
+                right_free = free_ports(right_name, family, 2)
+                if len(left_free) == 2 and len(right_free) == 2:
+                    cables = [
+                        lay((left_name, left_free[index]), (right_name, right_free[index]))
+                        for index in range(2)
+                    ]
+                    break
+        if len(cables) < 2:
+            continue
+        mode = stated[0][1]
+        used = taken_channels.setdefault(pair[0], set()) | taken_channels.setdefault(pair[1], set())
+        channel = next(
+            number
+            for number in [min(n for n, _ in stated), *range(1, 65)]
+            if number not in used
+        )
+        taken_channels[pair[0]].add(channel)
+        taken_channels[pair[1]].add(channel)
+        for cable in cables:
+            for end in cable:
+                keep[end] = (channel, mode)
+                if end in members:
+                    continue
+                # A port that was never a trunk -- either the far end of the
+                # intent, or the one just cabled -- has to carry what the rest
+                # of the bundle carries, or the two halves disagree.
+                config = devices_by_name[end[0]].find("./ENGINE/RUNNINGCONFIG")
+                if config is not None and body:
+                    _set_config_block(config, f"interface {end[1]}", body)
+                    drop_line(config, end[1], "switchport access vlan")
+        notes.append(
+            f"{pair[0]} <-> {pair[1]} bundled on Port-channel{channel} "
+            f"({len(cables)} cables, mode {mode})"
+        )
+
+    for (name, port), (channel, mode) in sorted(keep.items()):
+        device = devices_by_name.get(name)
+        config = device.find("./ENGINE/RUNNINGCONFIG") if device is not None else None
+        if config is None:
+            continue
+        _set_config_block(config, f"interface {port}", [f" channel-group {channel} mode {mode}"])
+        body = trunk_body(name, port)
+        if body:
+            _set_config_block(config, f"interface Port-channel{channel}", body)
+
+    removed = 0
+    for name, device in sorted(devices_by_name.items()):
+        if (device.findtext("./ENGINE/TYPE") or "") not in switch_types:
+            continue
+        for section in ("RUNNINGCONFIG", "STARTUPCONFIG"):
+            config = device.find(f"./ENGINE/{section}")
+            if config is None:
+                continue
+            current = ""
+            doomed: list[ET.Element] = []
+            for node in config.findall("LINE"):
+                text = (node.text or "").strip()
+                if text.startswith("interface "):
+                    current = text.split(None, 1)[1]
+                elif text.startswith("channel-group ") and (name, current) not in keep:
+                    doomed.append(node)
+            for node in doomed:
+                if node in list(config):
+                    config.remove(node)
+            if doomed and section == "RUNNINGCONFIG":
+                removed += len(doomed)
+    if removed:
+        notes.append(f"{removed} channel-group line(s) removed -- no bundle on the other end")
+    return notes
+
+
+def _match_trunk_native_vlans(root: ET.Element) -> list[str]:
+    """Both ends of a trunk have to agree on the native VLAN.
+
+    One end saying `switchport trunk native vlan 99` while the other says
+    nothing -- which means VLAN 1 -- is a mismatch, and Packet Tracer does not
+    let it pass quietly. Measured on the generated company lab, in SW2's own
+    log:
+
+        %CDP-4-NATIVE_VLAN_MISMATCH: ... Gi0/1 (99), with SW5 Fa0/2 (1)
+        %SPANTREE-2-BLOCK_PVID_LOCAL: Blocking Gi0/1 on VLAN0099
+
+    Spanning tree blocks the port, so the switch is cabled, configured, shown
+    as up, and carrying nothing. Three of the four inter-switch trunks were
+    like that: the access switches took `native vlan 99` from the plan and the
+    core's side of the same cable was written by the uplink pass, which never
+    mentioned a native VLAN.
+
+    The end that names one wins, because that is the deliberate choice; VLAN 1
+    is only ever the default nobody asked for.
+    """
+    devices = {
+        (device.findtext("./ENGINE/SAVE_REF_ID") or "").strip(): device
+        for device in root.findall(".//DEVICES/DEVICE")
+    }
+    switch_types = {"Switch", "MultiLayerSwitch"}
+
+    def native_of(device: ET.Element, port: str) -> str:
+        inside = False
+        for node in device.findall("./ENGINE/RUNNINGCONFIG/LINE"):
+            line = (node.text or "").strip()
+            if line.startswith("interface "):
+                inside = line == f"interface {port}"
+            elif inside:
+                match = re.match(r"^switchport trunk native vlan (\d+)$", line)
+                if match:
+                    return match.group(1)
+        return ""
+
+    notes: list[str] = []
+    for link in root.findall(".//LINKS/LINK"):
+        cable = link.find("./CABLE")
+        if cable is None:
+            continue
+        refs = [(cable.findtext(tag) or "").strip() for tag in ("FROM", "TO")]
+        ports = [node.text or "" for node in cable.findall("PORT")]
+        if len(ports) < 2:
+            continue
+        left, right = devices.get(refs[0]), devices.get(refs[1])
+        if left is None or right is None:
+            continue
+        if (left.findtext("./ENGINE/TYPE") or "") not in switch_types:
+            continue
+        if (right.findtext("./ENGINE/TYPE") or "") not in switch_types:
+            continue
+        natives = [native_of(left, ports[0]), native_of(right, ports[1])]
+        if natives[0] == natives[1]:
+            continue
+        wanted = natives[0] or natives[1]
+        if not wanted:
+            continue
+        for device, port, current in ((left, ports[0], natives[0]), (right, ports[1], natives[1])):
+            if current == wanted:
+                continue
+            config = device.find("./ENGINE/RUNNINGCONFIG")
+            if config is None:
+                continue
+            _set_config_block(
+                config,
+                f"interface {port}",
+                [" switchport mode trunk", f" switchport trunk native vlan {wanted}"],
+            )
+            notes.append(
+                f"{device.findtext('./ENGINE/NAME') or ''}:{port} native VLAN "
+                f"{current or '1'} -> {wanted}"
+            )
+    return notes
+
+
+def _drop_inherited_sticky_macs(root: ET.Element) -> list[str]:
+    """Remove sticky MAC addresses the donor's devices left behind.
+
+    `switchport port-security mac-address sticky` is a directive: learn the
+    address of whatever is plugged in. `... sticky 00E0.F925.3A9E` is the
+    result of that learning on the donor's hardware, and a generated lab plugs
+    a different device into the port. The address no longer matches, every
+    frame is a violation, and `restrict` drops them all.
+
+    Measured on the company lab the skill generated: PC1's port on SW1 carried
+    the donor's learned address, PC2's port on SW2 carried none. PC2 reached
+    its gateway and routed across VLANs; PC1 could not reach anything outside
+    its own switch. Same generator, same prompt, one stale line apart.
+
+    The directive stays -- port security is what the prompt asked for. Only the
+    learned address goes, and Packet Tracer learns the new one on first frame.
+    """
+    dropped: list[str] = []
+    for device in root.findall(".//DEVICES/DEVICE"):
+        for section in ("RUNNINGCONFIG", "STARTUPCONFIG"):
+            config = device.find(f"./ENGINE/{section}")
+            if config is None:
+                continue
+            for node in list(config.findall("LINE")):
+                text = (node.text or "").strip()
+                if re.fullmatch(
+                    r"switchport port-security mac-address sticky [0-9A-Fa-f.:-]{12,}", text
+                ):
+                    config.remove(node)
+                    if section == "RUNNINGCONFIG":
+                        dropped.append(f"{device.findtext('./ENGINE/NAME') or ''}: {text}")
+    return dropped
+
+
+def _router_subinterface_vlans(device: ET.Element, physical_port: str) -> list[str]:
+    """VLANs the router carries as subinterfaces of `physical_port`."""
+    vlans: list[str] = []
+    on_port = False
+    for node in device.findall("./ENGINE/RUNNINGCONFIG/LINE"):
+        line = (node.text or "").strip()
+        if line.startswith("interface "):
+            name = line.split(None, 1)[1]
+            on_port = name.startswith(f"{physical_port}.")
+            continue
+        if not on_port:
+            continue
+        match = re.match(r"^encapsulation dot1Q (\d+)", line)
+        if match and match.group(1) not in vlans:
+            vlans.append(match.group(1))
+    return sorted(vlans, key=int)
+
+
+def _move_subinterfaces_to_the_cabled_port(root: ET.Element) -> list[str]:
+    """Put the router's dot1Q subinterfaces on the port the switch cable uses.
+
+    Addressing writes the subinterfaces onto one interface while the link
+    synthesiser and port reconciliation settle the cable onto another. Measured
+    on a five-switch lab the skill generated: R1 carried
+    `GigabitEthernet0/1.10` .. `.99` and its only cable ran from
+    `GigabitEthernet0/0`. Packet Tracer showed one linked port and ten
+    subinterfaces protocol-down, so every VLAN except the one the access port
+    happened to be in was unreachable.
+
+    The cable is the harder fact -- it exists in the topology and in Packet
+    Tracer's own model -- so the configuration moves to meet it.
+    """
+    devices = {
+        (device.findtext("./ENGINE/SAVE_REF_ID") or "").strip(): device
+        for device in root.findall(".//DEVICES/DEVICE")
+    }
+    switch_types = {"Switch", "MultiLayerSwitch"}
+    cabled_to_switch: dict[str, str] = {}
+    for link in root.findall(".//LINKS/LINK"):
+        cable = link.find("./CABLE")
+        if cable is None:
+            continue
+        refs = [(cable.findtext(tag) or "").strip() for tag in ("FROM", "TO")]
+        ports = [node.text or "" for node in cable.findall("PORT")]
+        if len(ports) < 2:
+            continue
+        for near, far in ((0, 1), (1, 0)):
+            router = devices.get(refs[near])
+            switch = devices.get(refs[far])
+            if router is None or switch is None:
+                continue
+            if (router.findtext("./ENGINE/TYPE") or "") != "Router":
+                continue
+            if (switch.findtext("./ENGINE/TYPE") or "") in switch_types:
+                cabled_to_switch.setdefault(refs[near], ports[near])
+
+    notes: list[str] = []
+    for ref, cabled_port in cabled_to_switch.items():
+        router = devices[ref]
+        configured = ""
+        for node in router.findall("./ENGINE/RUNNINGCONFIG/LINE"):
+            line = (node.text or "").strip()
+            if not line.startswith("interface ") or "." not in line:
+                continue
+            parent = line.split(None, 1)[1].split(".", 1)[0]
+            if parent != cabled_port and port_exists(router, parent):
+                configured = parent
+                break
+        if not configured or not _router_subinterface_vlans(router, configured):
+            continue
+        for node in router.findall("./ENGINE/RUNNINGCONFIG/LINE"):
+            line = (node.text or "")
+            stripped = line.strip()
+            if stripped.startswith(f"interface {configured}."):
+                node.text = line.replace(f"interface {configured}.", f"interface {cabled_port}.", 1)
+        notes.append(
+            f"{router.findtext('./ENGINE/NAME') or ''}: subinterfaces moved from "
+            f"{configured} to {cabled_port} (where the switch cable is)"
+        )
+
+    # Once the link is a trunk, an address on the physical port is unreachable:
+    # every frame arrives tagged. Measured on the same lab -- VLAN 10's
+    # subinterface carried `encapsulation dot1Q 10` and no address at all,
+    # while `GigabitEthernet0/0` held 10.10.10.1, so VLAN 10 had no gateway.
+    # Moved only when the pairing is unambiguous: one addressless subinterface
+    # and one address stranded on its parent.
+    for ref, cabled_port in cabled_to_switch.items():
+        router = devices[ref]
+        lines = list(router.findall("./ENGINE/RUNNINGCONFIG/LINE"))
+        blocks: dict[str, list[ET.Element]] = {}
+        current = ""
+        for node in lines:
+            text = (node.text or "").strip()
+            if text.startswith("interface "):
+                current = text.split(None, 1)[1]
+                blocks.setdefault(current, [])
+            elif current:
+                blocks.setdefault(current, []).append(node)
+
+        def address_node(name: str) -> ET.Element | None:
+            for node in blocks.get(name, []):
+                if (node.text or "").strip().startswith("ip address "):
+                    return node
+            return None
+
+        parent_address = address_node(cabled_port)
+        if parent_address is None:
+            continue
+        orphans = [
+            name
+            for name in blocks
+            if name.startswith(f"{cabled_port}.") and address_node(name) is None
+        ]
+        if len(orphans) != 1:
+            continue
+        moved_text = (parent_address.text or "").strip()
+        # The subinterface is addressless because it carries `no ip address`.
+        # Leaving that line in place lets IOS apply the address and then wipe
+        # it -- measured: VLAN 10's gateway read 0.0.0.0 in Packet Tracer while
+        # the configuration plainly showed 10.10.10.1 three lines above.
+        for node in list(blocks.get(orphans[0], [])):
+            if (node.text or "").strip() == "no ip address":
+                config_parent = router.find("./ENGINE/RUNNINGCONFIG")
+                if config_parent is not None and node in list(config_parent):
+                    config_parent.remove(node)
+                blocks[orphans[0]].remove(node)
+        blocks[orphans[0]].append(parent_address)
+        config = router.find("./ENGINE/RUNNINGCONFIG")
+        if config is None:
+            continue
+        index = list(config).index(parent_address)
+        config.remove(parent_address)
+        # After `encapsulation dot1Q`, not straight after the header. IOS
+        # refuses an address on a subinterface that has no encapsulation yet,
+        # and the refusal is silent in a saved file: measured, VLAN 10's
+        # gateway read 0.0.0.0 in Packet Tracer while `ip address 10.10.10.1`
+        # sat two lines above `encapsulation dot1Q 10`. The subinterfaces that
+        # worked all carry the address after the encapsulation.
+        anchor = next(
+            (
+                node
+                for node in blocks.get(orphans[0], [])
+                if (node.text or "").strip().startswith("encapsulation ")
+            ),
+            None,
+        )
+        if anchor is None:
+            anchor = next(
+                (
+                    node
+                    for node in config.findall("LINE")
+                    if (node.text or "").strip() == f"interface {orphans[0]}"
+                ),
+                None,
+            )
+        if anchor is None:
+            config.insert(index, parent_address)
+            continue
+        config.insert(list(config).index(anchor) + 1, parent_address)
+        notes.append(
+            f"{router.findtext('./ENGINE/NAME') or ''}: '{moved_text}' moved from "
+            f"{cabled_port} to {orphans[0]}, which had none"
+        )
+
+    # A trunk parent cannot also be the WAN uplink. Pruning leaves the donor's
+    # `ip nat outside` and its address on the physical interface, and once the
+    # subinterfaces live there the same port is described as both sides of the
+    # network at once: measured on the company lab, every subinterface came up
+    # and no host could still reach its gateway.
+    for ref, cabled_port in cabled_to_switch.items():
+        router = devices[ref]
+        if not _router_subinterface_vlans(router, cabled_port):
+            continue
+        config = router.find("./ENGINE/RUNNINGCONFIG")
+        if config is None:
+            continue
+        inside = False
+        for node in list(config.findall("LINE")):
+            text = (node.text or "").strip()
+            if text.startswith("interface "):
+                inside = text == f"interface {cabled_port}"
+                continue
+            if not inside:
+                continue
+            if text in {"ip nat outside", "ip nat inside"} or text.startswith("ip address "):
+                config.remove(node)
+                notes.append(
+                    f"{router.findtext('./ENGINE/NAME') or ''}: '{text}' removed from "
+                    f"{cabled_port}, which is the trunk parent"
+                )
+    return notes
+
+
+def _trunk_router_on_a_stick(root: ET.Element) -> list[str]:
+    """A switch port facing router subinterfaces has to be a trunk.
+
+    Measured on a five-switch lab the skill generated: R1 carried eight dot1Q
+    subinterfaces for VLANs 10 to 99, and its single cable landed on an access
+    port in VLAN 10. Packet Tracer reported one linked port on the router and
+    every subinterface protocol-down, so no host could reach its gateway and
+    nothing crossed a VLAN boundary -- while the lab opened and read correctly.
+
+    The router's configuration is the statement of intent here: subinterfaces
+    with `encapsulation dot1Q` mean the link is a trunk.
+    """
+    devices = {
+        (device.findtext("./ENGINE/SAVE_REF_ID") or "").strip(): device
+        for device in root.findall(".//DEVICES/DEVICE")
+    }
+    switch_types = {"Switch", "MultiLayerSwitch"}
+    notes: list[str] = []
+    for link in root.findall(".//LINKS/LINK"):
+        cable = link.find("./CABLE")
+        if cable is None:
+            continue
+        refs = [(cable.findtext(tag) or "").strip() for tag in ("FROM", "TO")]
+        ports = [node.text or "" for node in cable.findall("PORT")]
+        if len(ports) < 2:
+            continue
+        for near, far in ((0, 1), (1, 0)):
+            router = devices.get(refs[near])
+            switch = devices.get(refs[far])
+            if router is None or switch is None:
+                continue
+            if (router.findtext("./ENGINE/TYPE") or "") != "Router":
+                continue
+            if (switch.findtext("./ENGINE/TYPE") or "") not in switch_types:
+                continue
+            vlans = _router_subinterface_vlans(router, ports[near])
+            if not vlans:
+                continue
+            config = switch.find("./ENGINE/RUNNINGCONFIG")
+            if config is None:
+                continue
+            body = [" switchport mode trunk", f" switchport trunk allowed vlan {','.join(vlans)}"]
+            if (switch.findtext("./ENGINE/TYPE") or "") == "MultiLayerSwitch":
+                body.insert(0, " switchport trunk encapsulation dot1q")
+            _set_config_block(config, f"interface {ports[far]}", body)
+            notes.append(
+                f"{switch.findtext('./ENGINE/NAME') or ''}:{ports[far]} -> trunk for VLAN "
+                f"{','.join(vlans)} ({router.findtext('./ENGINE/NAME') or ''})"
+            )
+    return notes
+
+
+def _vlan_subnets_from_router(root: ET.Element) -> dict[str, str]:
+    """VLAN number -> the /24 its gateway sits in, read off the subinterfaces.
+
+    A router-on-a-stick writes the mapping down: `encapsulation dot1Q 20`
+    followed by `ip address 10.10.20.1` says VLAN 20 is 10.10.20.0. Nothing
+    else in the file states it, and guessing it from the third octet only works
+    for labs that happen to number that way.
+
+    A router keeps subinterfaces the pruning left behind, so the same VLAN can
+    appear twice with different addresses: one lab carried
+    `GigabitEthernet0/0/0.20` on 192.168.20.1 from its donor alongside the live
+    `GigabitEthernet0/1.20` on 10.10.20.1 -- and the stale one named an
+    interface a 2911 does not even have. Only subinterfaces whose parent the
+    device really owns are read.
+    """
+    subnets: dict[str, str] = {}
+    for device in root.findall(".//DEVICES/DEVICE"):
+        if (device.findtext("./ENGINE/TYPE") or "") != "Router":
+            continue
+        vlan = ""
+        parent_is_real = False
+        for node in device.findall("./ENGINE/RUNNINGCONFIG/LINE"):
+            line = (node.text or "").strip()
+            if line.startswith("interface "):
+                name = line.split(None, 1)[1]
+                parent_is_real = port_exists(device, name.split(".", 1)[0])
+                vlan = ""
+                continue
+            if not parent_is_real:
+                continue
+            match = re.match(r"^encapsulation dot1Q (\d+)", line)
+            if match:
+                vlan = match.group(1)
+                continue
+            address = re.match(r"^ip address (\d+\.\d+\.\d+)\.\d+ ", line)
+            if address and vlan:
+                subnets[vlan] = address.group(1)
+                vlan = ""
+    return subnets
+
+
+def _align_host_vlans_to_addresses(root: ET.Element) -> list[str]:
+    """Put each host's access port in the VLAN its address belongs to.
+
+    Addressing and VLAN assignment are decided by different passes, and nothing
+    made them agree. Measured on a five-switch lab the skill generated: PC5 on
+    10.10.10.12 sat in VLAN 30 while PC1 on 10.10.10.11 sat in VLAN 10 -- same
+    subnet, different broadcast domains -- and PC2 on 10.10.20.11 sat in VLAN
+    10. Six of twelve hosts were in the wrong VLAN for their address. The lab
+    opened, every static check passed, and PC1 could not reach PC5.
+
+    The same shape as every other defect here: two independent models of one
+    concept that disagree where nothing looks.
+
+    The address wins, because it is what the router's subinterfaces already
+    agree with -- a host moved to another VLAN would need a new address, a new
+    gateway, and a DHCP pool to match.
+    """
+    by_subnet = {subnet: vlan for vlan, subnet in _vlan_subnets_from_router(root).items()}
+
+    devices = {
+        (device.findtext("./ENGINE/SAVE_REF_ID") or "").strip(): device
+        for device in root.findall(".//DEVICES/DEVICE")
+    }
+    switch_types = {"Switch", "MultiLayerSwitch"}
+
+    def host_subnet(device: ET.Element) -> str:
+        for node in device.iter():
+            text = (node.text or "").strip()
+            if node.tag.upper() in {"IP", "IPADDRESS", "ADDRESS"} and re.fullmatch(
+                r"\d+\.\d+\.\d+\.\d+", text
+            ):
+                return text.rsplit(".", 1)[0]
+        return ""
+
+    def current_vlan(switch: ET.Element, port: str) -> str:
+        inside = False
+        for node in switch.findall("./ENGINE/RUNNINGCONFIG/LINE"):
+            line = (node.text or "").strip()
+            if line.startswith("interface "):
+                inside = line == f"interface {port}"
+            elif inside and line.startswith("switchport access vlan "):
+                return line.split()[-1]
+        return ""
+
+    attachments: list[tuple[ET.Element, str, ET.Element, str]] = []
+    for link in root.findall(".//LINKS/LINK"):
+        cable = link.find("./CABLE")
+        if cable is None:
+            continue
+        refs = [(cable.findtext(tag) or "").strip() for tag in ("FROM", "TO")]
+        ports = [node.text or "" for node in cable.findall("PORT")]
+        if len(ports) < 2:
+            continue
+        for near, far in ((0, 1), (1, 0)):
+            host = devices.get(refs[near])
+            switch = devices.get(refs[far])
+            if host is None or switch is None:
+                continue
+            if (switch.findtext("./ENGINE/TYPE") or "") not in switch_types:
+                continue
+            # Saved files spell it `Pc`; `HOST_DEVICE_KINDS` holds `PC`. Asking
+            # without normalising skipped every PC in the lab and left eight of
+            # fourteen hosts unexamined.
+            if not _is_host_device(
+                {"type": _normalize_device_type(host.findtext("./ENGINE/TYPE") or "")}
+            ):
+                continue
+            subnet = host_subnet(host)
+            if subnet:
+                attachments.append((host, subnet, switch, ports[far]))
+
+    # A subnet the router does not map still has to end up in one VLAN, or its
+    # hosts cannot reach each other. The VLAN most of them already sit in is
+    # the one that needs the fewest ports moved.
+    votes: dict[str, Counter[str]] = {}
+    for _host, subnet, switch, port in attachments:
+        vlan = current_vlan(switch, port)
+        if vlan:
+            votes.setdefault(subnet, Counter())[vlan] += 1
+    wanted_for: dict[str, str] = {}
+    for _host, subnet, _switch, _port in attachments:
+        if subnet in wanted_for:
+            continue
+        chosen = by_subnet.get(subnet)
+        if not chosen and subnet in votes:
+            chosen = votes[subnet].most_common(1)[0][0]
+        if chosen:
+            wanted_for[subnet] = chosen
+
+    notes: list[str] = []
+    for host, subnet, switch, port in attachments:
+        wanted = wanted_for.get(subnet)
+        if not wanted or current_vlan(switch, port) == wanted:
+            continue
+        config = switch.find("./ENGINE/RUNNINGCONFIG")
+        if config is None:
+            continue
+        _set_config_block(
+            config,
+            f"interface {port}",
+            [" switchport mode access", f" switchport access vlan {wanted}"],
+        )
+        notes.append(
+            f"{switch.findtext('./ENGINE/NAME') or ''}:{port} -> VLAN {wanted} "
+            f"({host.findtext('./ENGINE/NAME') or ''})"
+        )
+    return notes
+
+
+def _align_router_gateway(root: ET.Element) -> list[str]:
+    """Put the hosts' gateway address on the router interface they reach it by.
+
+    Host addressing is decided while planning, from the router interface the
+    plan plugs into the switch. Port reconciliation then moves that cable: the
+    plan had GigabitEthernet0/0/0, carrying 192.168.1.1, and the finished lab
+    ran the cable from GigabitEthernet0/0/2, carrying 192.168.3.1. Hosts were
+    addressed 192.168.1.x with a gateway that existed, on an interface attached
+    to nothing.
+
+    Adjusting the hosts to follow the cable was the first attempt and it did
+    nothing, because at planning time the two still agreed. The cabling is what
+    changes last, so the address has to follow it: whichever interface ends up
+    facing the switch is given the gateway the hosts were told to use.
+    """
+    devices = {
+        (device.findtext("./ENGINE/SAVE_REF_ID") or ""): device
+        for device in root.findall(".//DEVICES/DEVICE")
+    }
+    kinds = {
+        ref: (device.findtext("./ENGINE/TYPE") or "") for ref, device in devices.items()
+    }
+
+    gateways = [
+        (port.findtext("PORT_GATEWAY") or "").strip()
+        for device in devices.values()
+        if (device.findtext("./ENGINE/TYPE") or "") in {"Pc", "PC"}
+        for port in device.findall("./ENGINE/MODULE/SLOT/MODULE/PORT")
+    ]
+    gateway = next((value for value in gateways if value and value != "0.0.0.0"), "")
+    if not gateway:
+        return []
+
+    for link in root.findall(".//LINKS/LINK"):
+        cable = link.find("./CABLE")
+        if cable is None:
+            continue
+        refs = [(cable.findtext("FROM") or "").strip(), (cable.findtext("TO") or "").strip()]
+        ports = [node.text or "" for node in cable.findall("PORT")]
+        for router_index, switch_index in ((0, 1), (1, 0)):
+            if kinds.get(refs[router_index]) != "Router":
+                continue
+            if kinds.get(refs[switch_index]) not in {"Switch", "MultiLayerSwitch"}:
+                continue
+            router = devices[refs[router_index]]
+            config = router.find("./ENGINE/RUNNINGCONFIG")
+            if config is None:
+                continue
+            # Another interface may already hold an address in this subnet --
+            # the one the plan originally chose. Two interfaces on one router
+            # cannot share a subnet, so the stale one gives up its address.
+            prefix = gateway.rsplit(".", 1)[0]
+            lines = [(line.text or "") for line in config.findall("LINE")]
+            cleared: list[str] = []
+            for index, line in enumerate(lines):
+                match = re.match(r"interface ((?:Gigabit|Fast)Ethernet\S*)\s*$", line.strip())
+                if not match or match.group(1) == ports[router_index]:
+                    continue
+                cursor = index + 1
+                while cursor < len(lines) and lines[cursor].startswith(" "):
+                    address = re.match(
+                        r"ip address (\d+\.\d+\.\d+\.\d+) ", lines[cursor].strip()
+                    )
+                    if address and address.group(1).rsplit(".", 1)[0] == prefix:
+                        cleared.append(match.group(1))
+                        break
+                    cursor += 1
+            for interface in cleared:
+                _set_config_block(config, f"interface {interface}", [" no ip address"])
+
+            _set_config_block(
+                config,
+                f"interface {ports[router_index]}",
+                [f" ip address {gateway} 255.255.255.0", " no shutdown"],
+            )
+            name = router.findtext("./ENGINE/NAME") or ""
+            note = f"{name}: {ports[router_index]} set to {gateway} (gateway the hosts use)"
+            if cleared:
+                note += f"; cleared overlapping address on {', '.join(cleared)}"
+            return [note]
+    return []
+
+
+_SVI_ADDRESS_PATTERN = re.compile(r"^ip address (\d+\.\d+\.\d+\.\d+) (\d+\.\d+\.\d+\.\d+)$")
+
+
+def _address_to_int(address: str) -> int | None:
+    parts = address.split(".")
+    if len(parts) != 4:
+        return None
+    value = 0
+    for part in parts:
+        if not part.isdigit() or not 0 <= int(part) <= 255:
+            return None
+        value = (value << 8) | int(part)
+    return value
+
+
+def _same_subnet(left: str, right: str, mask: str) -> bool:
+    left_value = _address_to_int(left)
+    right_value = _address_to_int(right)
+    mask_value = _address_to_int(mask)
+    if left_value is None or right_value is None or mask_value is None:
+        return False
+    return left_value & mask_value == right_value & mask_value
+
+
+def _drop_duplicate_dhcp_pools(root: ET.Element) -> list[str]:
+    """One pool name, one block.
+
+    IOS merges two `ip dhcp pool VLAN20` blocks and keeps the last, so a
+    duplicate is never harmless: whichever block the reader happens to see is
+    not necessarily the one that runs. They arise because the plan emits a pool
+    from its default addressing and the VLAN pass emits one from the VLAN's own
+    hosts -- two derivations of the same pool, which is this file's usual
+    defect. Retargeting the first onto the right network leaves the names
+    colliding, so the redundant block goes.
+
+    The first block wins; by the time this runs, alignment has already pointed
+    both at a network the router is on.
+    """
+    dropped: list[str] = []
+    for device in root.findall(".//DEVICES/DEVICE"):
+        config = device.find("./ENGINE/RUNNINGCONFIG")
+        if config is None:
+            continue
+        seen: set[str] = set()
+        doomed: list[ET.Element] = []
+        current = ""
+        for node in config.findall("LINE"):
+            text = (node.text or "").rstrip()
+            stripped = text.strip()
+            if not text.startswith((" ", "	")):
+                if stripped.startswith("ip dhcp pool "):
+                    name = stripped[len("ip dhcp pool ") :].strip()
+                    current = name if name in seen else ""
+                    seen.add(name)
+                    if current:
+                        doomed.append(node)
+                    continue
+                current = ""
+                continue
+            if current:
+                doomed.append(node)
+        for node in doomed:
+            if node in list(config):
+                config.remove(node)
+        if doomed:
+            dropped.append(
+                f"{device.findtext('./ENGINE/NAME') or ''}: removed a repeated pool block"
+            )
+    return dropped
+
+
+def _add_missing_vlans_to_the_database(root: ET.Element) -> list[str]:
+    """Create the VLAN in the switch, not only in its configuration text.
+
+    A `vlan 80` line in the running config does not put VLAN 80 in Packet
+    Tracer's VLAN database; the database is its own structure,
+    `ENGINE/VLANS/VLAN`, carrying `name`, `number` and `rspan`. A port assigned
+    to a VLAN the database does not hold forwards nothing, and the lab reads as
+    fully configured throughout.
+
+    Measured on the enterprise lab, and it is the whole difference between the
+    VLANs that worked and the ones that did not. `pt_read_vlans` on SW5 listed
+    1, 10, 20, 30, 40, 50, 60, 70, 99 and the four factory entries -- exactly
+    the donor's own -- while the file's config declared 80, 120, 130, 140, 150,
+    190, 200, 210 as well. Hosts in the donor's VLANs reached their gateway
+    4/4; hosts in the added ones reached nothing, on any switch.
+
+    This is why the earlier VLAN-declaration pass was reverted as useless: it
+    wrote the config line, which was never the thing that was missing.
+    """
+    reserved = {1002, 1003, 1004, 1005}
+    added: list[str] = []
+    for device in root.findall(".//DEVICES/DEVICE"):
+        if (device.findtext("./ENGINE/TYPE") or "") not in {"Switch", "MultiLayerSwitch"}:
+            continue
+        wanted: dict[int, str] = {}
+        pending = 0
+        for node in device.findall("./ENGINE/RUNNINGCONFIG/LINE"):
+            text = (node.text or "").strip()
+            match = re.match(r"^vlan (\d+)$", text)
+            if match:
+                pending = int(match.group(1))
+                wanted.setdefault(pending, f"VLAN{pending}")
+                continue
+            named = re.match(r"^name (\S+)$", text)
+            if named and pending:
+                wanted[pending] = named.group(1)
+                continue
+            pending = 0
+            for pattern in (
+                r"^switchport access vlan (\d+)$",
+                r"^switchport trunk native vlan (\d+)$",
+            ):
+                hit = re.match(pattern, text)
+                if hit:
+                    number = int(hit.group(1))
+                    wanted.setdefault(number, f"VLAN{number}")
+
+        for container in device.findall(".//VLANS"):
+            present = {
+                int(entry.get("number") or 0)
+                for entry in container.findall("VLAN")
+                if (entry.get("number") or "").isdigit()
+            }
+            missing = sorted(number for number in wanted if number not in present and number not in reserved)
+            if not missing:
+                continue
+            for number in missing:
+                entry = ET.SubElement(container, "VLAN")
+                entry.set("name", wanted[number])
+                entry.set("number", str(number))
+                entry.set("rspan", "0")
+            parent = next(
+                (node for node in device.iter() if container in list(node)),
+                None,
+            )
+            if parent is not None and parent.find("VLAN_COUNT") is not None:
+                parent.find("VLAN_COUNT").text = str(len(container.findall("VLAN")))
+            added.append(
+                f"{device.findtext('./ENGINE/NAME') or ''}: VLAN {', '.join(str(n) for n in missing)} "
+                f"created in the database"
+            )
+    return added
+
+
+def _separate_config_blocks(root: ET.Element) -> list[str]:
+    """Put the `!` back between a sub-block and the command that follows it.
+
+    A pass that appends an `interface` block after an `ip dhcp pool` writes the
+    header straight after the pool's own indented lines. IOS reads a top-level
+    command there as leaving the sub-mode; Packet Tracer does not always, and
+    the block is swallowed. Measured on the enterprise lab: the file carried
+    `interface GigabitEthernet0/1.80` with an address and HSRP, and Packet
+    Tracer's own port list for R1 -- nineteen interfaces -- did not contain it.
+    VLAN 80 had a gateway on paper and nothing answered on it.
+
+    Every subinterface the donor wrote is preceded by `!`; every one this
+    project appended is preceded by ` default-router ...`. That is the whole
+    difference between the ones that exist and the one that did not.
+    """
+    from pkt_editor import _replace_lines
+
+    separated: list[str] = []
+    for device in root.findall(".//DEVICES/DEVICE"):
+        for section in ("RUNNINGCONFIG", "STARTUPCONFIG"):
+            config = device.find(f"./ENGINE/{section}")
+            if config is None:
+                continue
+            lines = [(node.text or "") for node in config.findall("LINE")]
+            rebuilt: list[str] = []
+            added = 0
+            for line in lines:
+                indented = line.startswith((" ", "	"))
+                previous = rebuilt[-1] if rebuilt else ""
+                if (
+                    not indented
+                    and line.strip()
+                    and line.strip() != "!"
+                    and previous.startswith((" ", "	"))
+                ):
+                    rebuilt.append("!")
+                    added += 1
+                rebuilt.append(line)
+            if not added:
+                continue
+            _replace_lines(config, rebuilt)
+            if section == "RUNNINGCONFIG":
+                separated.append(
+                    f"{device.findtext('./ENGINE/NAME') or ''}: {added} block separator(s) restored"
+                )
+    return separated
+
+
+def _merge_repeated_interface_blocks(root: ET.Element) -> list[str]:
+    """Make the file say what the device would actually do.
+
+    IOS applies repeated `interface` blocks in order and keeps the last value
+    for each setting; every reader here scans for the first. A file carrying
+    both is correct and unreadable at once -- measured on a lab built five
+    times over, where `GigabitEthernet0/1.40` appeared five times holding
+    `10.10.40.1`, then `10.10.40.3`, then `10.10.40.1` again.
+
+    The passes that caused it are fixed, but a lab generated before that, or a
+    donor from anywhere, still carries the damage -- and a generated lab is a
+    candidate donor for the next build, so it propagates. Merging applies the
+    device's own rule: one block, settings in first-appearance order, each
+    holding the value the last block gave it.
+    """
+    from pkt_editor import _replace_lines, _setting_name
+
+    merged: list[str] = []
+    for device in root.findall(".//DEVICES/DEVICE"):
+        for section in ("RUNNINGCONFIG", "STARTUPCONFIG"):
+            config = device.find(f"./ENGINE/{section}")
+            if config is None:
+                continue
+            lines = [(node.text or "") for node in config.findall("LINE")]
+            order: list[str] = []
+            bodies: dict[str, list[str]] = {}
+            other: list[tuple[int, str]] = []
+            current = ""
+            repeated = 0
+            for line in lines:
+                stripped = line.strip()
+                if stripped.startswith("interface "):
+                    current = stripped
+                    if current in bodies:
+                        repeated += 1
+                    else:
+                        order.append(current)
+                        bodies[current] = []
+                    continue
+                if current and line.startswith((" ", "	")):
+                    # Same rule `_set_config_block` writes by, so a merged
+                    # block and a written one agree on what overwrites what.
+                    # Keying on the first two words instead kept both
+                    # `description Satis` and `description VLAN40 standby`,
+                    # where IOS keeps only the last.
+                    body = bodies[current]
+                    name = _setting_name(line)
+                    for index, existing in enumerate(body):
+                        if _setting_name(existing) == name:
+                            body[index] = line
+                            break
+                    else:
+                        body.append(line)
+                    continue
+                current = ""
+                if stripped != "!":
+                    # The rebuild puts a separator after every block; keeping
+                    # the originals as well doubles them.
+                    other.append((len(order), line))
+            if not repeated:
+                continue
+            rebuilt: list[str] = []
+            for index, header in enumerate(order):
+                rebuilt.extend(text for position, text in other if position == index)
+                rebuilt.append(header)
+                rebuilt.extend(bodies[header])
+                rebuilt.append("!")
+            rebuilt.extend(text for position, text in other if position >= len(order))
+            _replace_lines(config, rebuilt)
+            if section == "RUNNINGCONFIG":
+                merged.append(
+                    f"{device.findtext('./ENGINE/NAME') or ''}: merged {repeated} repeated interface block(s)"
+                )
+    return merged
+
+
+def _drop_vlan_subinterfaces_off_router_links(root: ET.Element) -> list[str]:
+    """A dot1Q subinterface needs a switch on the other end of its parent port.
+
+    Measured on the enterprise lab: R5 through R8 each carried eight VLAN
+    subinterfaces holding `10.10.10.1`, `10.10.20.1` and so on -- the very
+    addresses R1 offers as its HSRP virtual gateways -- on a `GigabitEthernet0/1`
+    cabled to another router. A VLAN cannot cross a routed link, so those
+    subinterfaces could never carry traffic; all they did was claim the gateway
+    address four more times each.
+
+    The parent port is worse off still: the point-to-point pass had given it a
+    /30 address, so one port was a routed link and a trunk at once.
+
+    Only subinterfaces whose parent faces something other than a switch are
+    dropped, so the routers that really are trunked keep everything.
+    """
+    switch_types = {"Switch", "MultiLayerSwitch"}
+    devices_by_ref = {
+        (device.findtext("./ENGINE/SAVE_REF_ID") or "").strip(): device
+        for device in root.findall(".//DEVICES/DEVICE")
+    }
+    faces_switch: set[tuple[str, str]] = set()
+    cabled: set[tuple[str, str]] = set()
+    for link in root.findall(".//LINKS/LINK"):
+        cable = link.find("./CABLE")
+        if cable is None:
+            continue
+        refs = [(cable.findtext(tag) or "").strip() for tag in ("FROM", "TO")]
+        ports = [node.text or "" for node in cable.findall("PORT")]
+        if len(ports) < 2:
+            continue
+        left, right = devices_by_ref.get(refs[0]), devices_by_ref.get(refs[1])
+        if left is None or right is None:
+            continue
+        for near, far, port in ((left, right, ports[0]), (right, left, ports[1])):
+            name = (near.findtext("./ENGINE/NAME") or "").strip()
+            cabled.add((name, port))
+            if (far.findtext("./ENGINE/TYPE") or "") in switch_types:
+                faces_switch.add((name, port))
+
+    dropped: list[str] = []
+    for device in root.findall(".//DEVICES/DEVICE"):
+        if (device.findtext("./ENGINE/TYPE") or "") != "Router":
+            continue
+        name = (device.findtext("./ENGINE/NAME") or "").strip()
+        for section in ("RUNNINGCONFIG", "STARTUPCONFIG"):
+            config = device.find(f"./ENGINE/{section}")
+            if config is None:
+                continue
+            doomed: list[ET.Element] = []
+            removed: set[str] = set()
+            keep = False
+            for node in config.findall("LINE"):
+                text = (node.text or "")
+                stripped = text.strip()
+                if stripped.startswith("interface "):
+                    port = stripped.split(None, 1)[1]
+                    parent = port.split(".")[0]
+                    # An uncabled parent is left alone: the lab may still be
+                    # waiting for its trunk, and nothing conflicts until it is
+                    # cabled to something that is not a switch.
+                    keep = (
+                        "." in port
+                        and (name, parent) in cabled
+                        and (name, parent) not in faces_switch
+                    )
+                    if keep:
+                        doomed.append(node)
+                        removed.add(port)
+                    continue
+                if keep and (text.startswith((" ", "	")) or stripped == "!"):
+                    doomed.append(node)
+                    continue
+                keep = False
+            for node in doomed:
+                if node in list(config):
+                    config.remove(node)
+            if removed and section == "RUNNINGCONFIG":
+                dropped.append(
+                    f"{name}: dropped {len(removed)} VLAN subinterface(s) on a port facing a router"
+                )
+    return dropped
+
+
+HOST_DEVICE_TYPES = {
+    "Pc",
+    "Laptop",
+    "Server",
+    "Printer",
+    "Tablet",
+    "IpPhone",
+    "HomeVoip",
+    "AnalogPhone",
+    "TV",
+    "IoT",
+    "SBC",
+    "MCU",
+    "WiredEndDevice",
+    "WirelessEndDevice",
+}
+
+
+def _network_from(address: str, mask: str) -> tuple[int, int] | None:
+    left, right = _address_to_int(address), _address_to_int(mask)
+    if left is None or right is None:
+        return None
+    return left & right, right
+
+
+def _octets(value: int) -> str:
+    return ".".join(str((value >> shift) & 0xFF) for shift in (24, 16, 8, 0))
+
+
+def _join_host_part(address: str, gateway: str, mask: str) -> str:
+    """Keep the host's own number, move it onto the gateway's network.
+
+    `192.168.80.10` under a gateway of `10.10.80.1/24` becomes `10.10.80.10`,
+    so a renumbered lab still reads the way whoever asked for it expects.
+    """
+    host, network = _address_to_int(address), _network_from(gateway, mask)
+    if host is None or network is None:
+        return gateway
+    return _octets(network[0] | (host & ~network[1] & 0xFFFFFFFF))
+
+
+def _next_address(address: str) -> str:
+    value = _address_to_int(address)
+    return address if value is None else _octets(value + 1)
+
+
+def _set_text(parent: ET.Element, tag: str, value: str) -> None:
+    node = parent.find(tag)
+    if node is None:
+        node = ET.SubElement(parent, tag)
+    node.text = value
+
+
+def _live_profile_nodes(engine: ET.Element) -> list[ET.Element]:
+    """The profile a client is actually using, not its saved list.
+
+    `pkt_editor._profile_nodes` returns both, and writing the live network into
+    both is what every working lab does not do. Measured across the ones that
+    ping: `hr-guest` has its client on `home`/WPA2 in `CURRENT_PROFILE` while
+    `PROFILES` still holds the untouched `Default`/open boilerplate, and the
+    donor's own access-point clients are on `TestNetwork`/WEP with `PROFILES`
+    left exactly the same way. Not one working client has its saved list
+    rewritten.
+    """
+    return engine.findall("./WIRELESS_CLIENT/CURRENT_PROFILE/WIRELESS_PROFILE")
+
+
+def _keep_wireless_clients_within_reach_of_their_access_point(root: ET.Element) -> list[str]:
+    """A radio link is made by distance, and the layout was deciding distance blind.
+
+    The layout places hosts in rows under the switch they hang off. A wireless
+    client hangs off nothing, so it landed wherever the row logic left it --
+    measured on the generated lab, 420 units below a router whose radio reaches
+    250. Everything else about the lab was by then correct: same SSID, same
+    security, same key, the client a DHCP client and the router serving DHCP.
+    Packet Tracer still reported `ip 0.0.0.0`, no lease, 0/4, and the port as
+    `up` and `linked`, which is what made it look fine.
+
+    Moving that one laptop to 128 units away changed the reading immediately:
+    leased `192.168.10.101` out of the router's pool, radio negotiated up from
+    24 Mbps to 300, and 4/4 to the gateway. The second laptop the same, and
+    then 4/4 between them.
+
+    So this is the last of the pair: the wired topology decides the rows, the
+    radio's coverage decides whether the link exists, and nothing compared
+    them. Clients already in range are left where they are -- the pass has
+    nothing to add there, and moving them would make it depend on its own
+    output.
+    """
+    positions: dict[int, tuple[float, float]] = {}
+
+    def _place(device: ET.Element, x: float, y: float) -> None:
+        logical = device.find("./WORKSPACE/LOGICAL")
+        if logical is None:
+            workspace = device.find("./WORKSPACE")
+            if workspace is None:
+                workspace = ET.SubElement(device, "WORKSPACE")
+            logical = ET.SubElement(workspace, "LOGICAL")
+        for tag, value in (("X", x), ("Y", y)):
+            node = logical.find(tag)
+            if node is None:
+                node = ET.SubElement(logical, tag)
+            node.text = f"{value:.1f}"
+
+    def _at(device: ET.Element) -> tuple[float, float] | None:
+        logical = device.find("./WORKSPACE/LOGICAL")
+        if logical is None:
+            return None
+        try:
+            return float(logical.findtext("X") or ""), float(logical.findtext("Y") or "")
+        except ValueError:
+            return None
+
+    cabled: set[int] = set()
+    for cable in root.findall(".//LINKS/LINK/CABLE"):
+        for tag in ("FROM", "TO"):
+            reference = (cable.findtext(tag) or "").strip()
+            if reference:
+                cabled.add(hash(reference))
+
+    access_points: list[tuple[ET.Element, str, float]] = []
+    for device in root.findall(".//DEVICES/DEVICE"):
+        common = device.find("./ENGINE/WIRELESS_SERVER/WIRELESS_COMMON")
+        if common is None:
+            continue
+        ssid = (common.findtext("SSID") or "").strip()
+        reach = 0.0
+        for port in device.findall(".//PORT"):
+            if not (port.findtext("TYPE") or "").startswith("eAccessPointWireless"):
+                continue
+            try:
+                reach = max(reach, float(port.findtext("COVERAGERANGE") or 0))
+            except ValueError:
+                continue
+        if ssid and reach > 0:
+            access_points.append((device, ssid, reach))
+    if not access_points:
+        return []
+
+    moved: list[str] = []
+    for access_point, ssid, reach in access_points:
+        here = _at(access_point)
+        if here is None:
+            continue
+        clients = []
+        for device in root.findall(".//DEVICES/DEVICE"):
+            if device is access_point:
+                continue
+            common = device.find("./ENGINE/WIRELESS_CLIENT/WIRELESS_COMMON")
+            if common is None or (common.findtext("SSID") or "").strip() != ssid:
+                continue
+            reference = (device.findtext("./ENGINE/SAVE_REF_ID") or "").strip()
+            if reference and hash(reference) in cabled:
+                # A cabled client is on the wire, and the row it sits in is
+                # about that cable, not about the radio.
+                continue
+            clients.append(device)
+        if not clients:
+            continue
+
+        # Half the reach is comfortably inside it and leaves the icons apart.
+        radius = reach / 2
+        for index, device in enumerate(clients):
+            there = _at(device)
+            if there is not None:
+                span = ((there[0] - here[0]) ** 2 + (there[1] - here[1]) ** 2) ** 0.5
+                if span <= radius:
+                    continue
+            angle = 2 * math.pi * index / max(len(clients), 1)
+            x = here[0] + radius * math.cos(angle)
+            y = here[1] + radius * math.sin(angle)
+            _place(device, max(x, float(LOGICAL_ICON_SPACING)), max(y, float(LOGICAL_ICON_SPACING)))
+            name = (device.findtext("./ENGINE/NAME") or "").strip()
+            moved.append(f"{name} moved inside the {int(reach)}-unit reach of {(access_point.findtext('./ENGINE/NAME') or '').strip()}")
+    return moved
+
+
+def _the_only_access_point(root: ET.Element) -> tuple[ET.Element, ET.Element] | None:
+    """The one device broadcasting, and its wireless settings.
+
+    Two networks on the air is more than these passes can attribute, and
+    guessing which client belongs to which would be the same mistake they
+    exist to fix.
+    """
+    found: list[tuple[ET.Element, ET.Element]] = []
+    for device in root.findall(".//DEVICES/DEVICE"):
+        common = device.find("./ENGINE/WIRELESS_SERVER/WIRELESS_COMMON")
+        if common is not None and (common.findtext("SSID") or "").strip():
+            found.append((device, common))
+    return found[0] if len(found) == 1 else None
+
+
+def _let_the_home_router_address_its_own_clients(root: ET.Element) -> list[str]:
+    """A wireless client of a home router takes a lease; it does not hold a static address.
+
+    Measured on the donor this lab is pruned from, which works: `Laptop3` sits
+    on the Linksys's network as a DHCP client, is leased `192.168.0.100` out of
+    the router's own pool, and pings the router 4/4. Meanwhile the generated
+    lab wrote a static `192.168.10.20` onto its laptop's port and profile, and
+    Packet Tracer reported the radio associated, `dhcp_client: true`, `ip
+    0.0.0.0`, 0/4 -- it re-asserts DHCP on this kind of client whatever the
+    file says, which is why forcing the static address never took.
+
+    So the router's pool is the authority for its own clients, and this runs
+    after `_align_home_router_lan_with_its_clients` has moved that pool onto
+    the network the plan chose. The planned addresses are what tell it where to
+    move; once it has, they have done their job.
+
+    Only a router actually serving DHCP counts. One with its server off has
+    nothing to lease, and a client switched to DHCP there would end up with no
+    address at all.
+    """
+    access_point = _the_only_access_point(root)
+    if access_point is None:
+        return []
+    broadcaster, common = access_point
+    if (broadcaster.findtext("./ENGINE/DHCP_SERVER/ENABLED") or "").strip() != "1":
+        return []
+    if _normalize_device_type(broadcaster.findtext("./ENGINE/TYPE") or "") not in WIRELESS_ROUTER_KINDS:
+        return []
+    ssid = (common.findtext("SSID") or "").strip()
+
+    changed: list[str] = []
+    for device in root.findall(".//DEVICES/DEVICE"):
+        if device is broadcaster:
+            continue
+        client = device.find("./ENGINE/WIRELESS_CLIENT/WIRELESS_COMMON")
+        if client is None or (client.findtext("SSID") or "").strip() != ssid:
+            continue
+        moved = False
+        for port in device.findall(".//PORT"):
+            if not (port.findtext("TYPE") or "").startswith("eHostWireless"):
+                continue
+            if (port.findtext("PORT_DHCP_ENABLE") or "").strip().lower() == "true":
+                continue
+            _ensure_text(port, "PORT_DHCP_ENABLE", "true")
+            _ensure_text(port, "IP", "")
+            _ensure_text(port, "SUBNET", "")
+            _ensure_text(port, "PORT_GATEWAY", "")
+            moved = True
+        if moved:
+            name = (device.findtext("./ENGINE/NAME") or "").strip()
+            changed.append(f"{name} now takes its address from {(broadcaster.findtext('./ENGINE/NAME') or '').strip()}, which is what serves {ssid}")
+    return changed
+
+
+def _match_wireless_security_to_the_access_point(root: ET.Element) -> list[str]:
+    """A client set to WEP cannot join a WPA2 network, whatever its SSID says.
+
+    `set_wireless_ssid` writes the access point's authentication, encryption
+    and key. `associate_wireless_client` wrote the client's SSID and nothing
+    else -- so the security was decided once, on the access point, and the
+    client kept whatever the donor left it with. Measured on the lab built from
+    "ssid EvSebeke wpa2 sifre Gizli123":
+
+        WRT1     AUTHEN_TYPE 4  ENCRYPT_TYPE 4  WPA_PASSPHRASE Gizli123
+        Laptop1  AUTHEN_TYPE 1  ENCRYPT_TYPE 1  key 1234567890   (WEP)
+                 second profile AUTHEN_TYPE 0                    (open)
+
+    Three answers on one client, none of them the network's. The radio
+    associated -- Packet Tracer reports the port up and linked -- and not one
+    packet crossed it.
+
+    The client shape comes from three labs that work, `hr-guest`,
+    `meraki_SA_wireless_wpa2_psk` and a saved coursework lab: the key goes in
+    `WEP_PROCESS/KEY` and in each profile's `WEP_KEY` whatever the
+    authentication is. Those field names are legacy; WPA2 uses them too.
+    """
+    from pkt_editor import _profile_nodes
+
+    access_point = _the_only_access_point(root)
+    if access_point is None:
+        return []
+    broadcaster, common = access_point
+    ssid = (common.findtext("SSID") or "").strip()
+    authen = (common.findtext("AUTHEN_TYPE") or "").strip()
+    encrypt = (common.findtext("ENCRYPT_TYPE") or "").strip()
+    if not authen:
+        return []
+    # `WEP_PROCESS/KEY` first: that is where a working access point keeps its
+    # key whatever the security is, and the other two are older spellings that
+    # some donors still carry.
+    key = ""
+    for path in ("WEP_PROCESS/KEY", "WPA_PASSPHRASE", "WEP_KEY"):
+        value = (common.findtext(path) or "").strip()
+        if value:
+            key = value
+            break
+
+    # A profile also records the kind of network it is joining, and a home
+    # router will not take a client set to the narrower one. Measured on the
+    # donor: its two clients on the Linksys, which ping it 4/4, carry
+    # `NETWORK_TYPE` 7; its four clients on the access point carry 3. Ours
+    # were pruned from the access-point side and kept the 3, so they never
+    # associated to the router they were given -- Packet Tracer reported the
+    # radio linked at 24 Mbps, no lease, 0/4. Across 152 wireless labs, 1422
+    # of 1440 client profiles are on 7 whatever their authentication.
+    #
+    # Only for a home router: the access point's own clients work on 3, and
+    # rewriting those would be changing something measured to be fine.
+    network_type = (
+        "7"
+        if _normalize_device_type(broadcaster.findtext("./ENGINE/TYPE") or "") in WIRELESS_ROUTER_KINDS
+        else ""
+    )
+
+    changed: list[str] = []
+    for device in root.findall(".//DEVICES/DEVICE"):
+        if device is broadcaster:
+            continue
+        engine = device.find("./ENGINE")
+        if engine is None:
+            continue
+        client = engine.find("./WIRELESS_CLIENT/WIRELESS_COMMON")
+        if client is None or (client.findtext("SSID") or "").strip() != ssid:
+            continue
+        before = {
+            (client.findtext("AUTHEN_TYPE") or "").strip(),
+            *[(profile.findtext("AUTHEN_TYPE") or "").strip() for profile in _live_profile_nodes(engine)],
+        }
+        _ensure_text(client, "AUTHEN_TYPE", authen)
+        _ensure_text(client, "ENCRYPT_TYPE", encrypt)
+        process = client.find("WEP_PROCESS")
+        if process is None:
+            process = ET.SubElement(client, "WEP_PROCESS")
+        _ensure_text(process, "KEY", key)
+        _ensure_text(process, "ENCRYPTION", encrypt)
+        for profile in _live_profile_nodes(engine):
+            _ensure_text(profile, "AUTHEN_TYPE", authen)
+            _ensure_text(profile, "ENCRYPT_TYPE", encrypt)
+            _ensure_text(profile, "WEP_KEY", key)
+            if network_type and (profile.findtext("NETWORK_TYPE") or "").strip() != network_type:
+                _ensure_text(profile, "NETWORK_TYPE", network_type)
+                before = before | {"a network type the router does not take"}
+        if before != {authen}:
+            name = (device.findtext("./ENGINE/NAME") or "").strip()
+            changed.append(f"{name} now uses the security {ssid} is on, not {'/'.join(sorted(before - {authen}))}")
+    return changed
+
+
+def _make_the_wireless_profile_agree_with_the_port(root: ET.Element) -> list[str]:
+    """A wireless host takes its addressing from its profile, not from its port.
+
+    Both record it. The port carried `192.168.10.20` with `PORT_DHCP_ENABLE`
+    false; the profile carried `DHCP_ENABLED` 1 and no address at all. Packet
+    Tracer obeys the profile, so the laptop associated, asked for a lease, and
+    sat on `0.0.0.0` while the file said it was statically addressed -- and
+    every check that read the port agreed the lab was fine.
+
+    Measured live: `Wireless0` up, linked, `dhcp_client: true`, `ip 0.0.0.0`,
+    0/4 to a gateway that by then existed.
+
+    The port is the one the rest of the generator writes and reads, so the
+    profile follows it.
+    """
+    changed: list[str] = []
+    for device in root.findall(".//DEVICES/DEVICE"):
+        engine = device.find("./ENGINE")
+        if engine is None:
+            continue
+        profiles = _live_profile_nodes(engine)
+        if not profiles:
+            continue
+        radio = next(
+            (
+                port
+                for port in device.findall(".//PORT")
+                if (port.findtext("TYPE") or "").startswith("eHostWireless")
+            ),
+            None,
+        )
+        if radio is None:
+            continue
+        by_dhcp = (radio.findtext("PORT_DHCP_ENABLE") or "").strip().lower() == "true"
+        address = (radio.findtext("IP") or "").strip()
+        mask = (radio.findtext("SUBNET") or "").strip()
+        gateway = (radio.findtext("PORT_GATEWAY") or "").strip()
+        if not by_dhcp and not address:
+            # Neither source says anything; inventing an answer here would be
+            # the same mistake in a new place.
+            continue
+        wanted = {
+            "DHCP_ENABLED": "1" if by_dhcp else "0",
+            "IP_ADDRESS": "" if by_dhcp else address,
+            "SUBNET_MASK": "" if by_dhcp else mask,
+            "DEFAULT_GATEWAY": "" if by_dhcp else gateway,
+        }
+        touched = False
+        for profile in profiles:
+            for tag, value in wanted.items():
+                if (profile.findtext(tag) or "").strip() != value:
+                    touched = True
+                _ensure_text(profile, tag, value)
+        if touched:
+            name = (device.findtext("./ENGINE/NAME") or "").strip()
+            how = "DHCP" if by_dhcp else f"{address} statically"
+            changed.append(f"{name} now uses {how} on its radio, which is what its port already said")
+    return changed
+
+
+def _join_wireless_clients_to_the_network_that_exists(root: ET.Element) -> list[str]:
+    """A client cannot associate to a network name nothing is broadcasting.
+
+    Same shape as the addressing fault beside it, one layer down. Measured on
+    `wireless_home`, built from "1 wireless router 2 laptop qur" -- no network
+    name asked for, so nobody set one: the laptops kept the donor's
+    `TestNetwork` and the router kept the donor's `Default`. Two residues from
+    two different donors, and no association between them. `wireless_ssid`
+    names a network in the prompt and both ends get it, which is why only the
+    unnamed case was broken.
+
+    The router broadcasts and the clients join, so the clients move. When the
+    lab has more than one network on the air there is nothing here to infer,
+    and the pass stands aside.
+    """
+    from pkt_editor import _wireless_common_nodes
+
+    broadcasters: dict[str, ET.Element] = {}
+    for device in root.findall(".//DEVICES/DEVICE"):
+        ssid = (device.findtext("./ENGINE/WIRELESS_SERVER/WIRELESS_COMMON/SSID") or "").strip()
+        if ssid:
+            broadcasters[ssid] = device
+    if len(broadcasters) != 1:
+        return []
+    ssid, broadcaster = next(iter(broadcasters.items()))
+
+    changed: list[str] = []
+    for device in root.findall(".//DEVICES/DEVICE"):
+        if device is broadcaster:
+            continue
+        engine = device.find("./ENGINE")
+        if engine is None or engine.find("./WIRELESS_CLIENT") is None:
+            continue
+        # `_wireless_common_nodes` walks from ENGINE, so the cellular radio --
+        # nested under CELLULAR_CLIENT and always on `ptcellular` -- is out of
+        # reach, which is what we want.
+        nodes = [
+            node
+            for node in _wireless_common_nodes(engine)
+            if engine.find("./WIRELESS_SERVER/WIRELESS_COMMON") is not node
+        ]
+        profiles = _live_profile_nodes(engine)
+        current = {
+            (node.findtext("SSID") or "").strip()
+            for node in [*nodes, *profiles]
+            if (node.findtext("SSID") or "").strip()
+        }
+        if not current or current == {ssid}:
+            continue
+        for node in nodes:
+            _ensure_text(node, "SSID", ssid)
+        for profile in profiles:
+            _ensure_text(profile, "NAME", ssid)
+            _ensure_text(profile, "SSID", ssid)
+        name = (device.findtext("./ENGINE/NAME") or "").strip()
+        changed.append(f"{name} now joins {ssid}, the only network on the air, instead of {'/'.join(sorted(current))}")
+    return changed
+
+
+def _align_home_router_lan_with_its_clients(root: ET.Element) -> list[str]:
+    """A home router has to serve the network its own clients are addressed on.
+
+    Two places decide what that network is and neither reads the other. The
+    addressing pass hands the laptops `192.168.10.20` and `.21` with a gateway
+    of `192.168.10.1`; the home router keeps whatever the donor was configured
+    with, `192.168.0.1/24` with a pool from `.100` to `.149`. Measured on
+    `wireless_home` and `wireless_ssid`: the lab opens, the laptops associate,
+    the coherence report says `gateway_answers_for_nobody` twice, and nothing
+    can reach anything because the gateway they point at does not exist.
+
+    The router moves, not the hosts. Its LAN address is a setting; the hosts'
+    addresses are the plan, and the rest of the lab is written against them.
+
+    Only static clients count. A DHCP client takes its address and its gateway
+    from this router at runtime, so it can never disagree with it, and reading
+    its stale address would make an aligned lab look broken.
+    """
+    from lab_coherence import _interface_addresses
+
+    devices = root.findall(".//DEVICES/DEVICE")
+    routers = [
+        device
+        for device in devices
+        if _normalize_device_type(device.findtext("./ENGINE/TYPE") or "") in WIRELESS_ROUTER_KINDS
+    ]
+    if not routers:
+        return []
+
+    # An address some interface in the lab really answers for is not a gap,
+    # whoever holds it.
+    held: set[str] = set()
+    for device in devices:
+        for _port, address, _mask in _interface_addresses(device):
+            held.add(address)
+        for node in device.iter("LAN_IP_ADDRESS"):
+            if (node.text or "").strip():
+                held.add((node.text or "").strip())
+
+    wanted: dict[str, tuple[str, str]] = {}
+    for device in devices:
+        for port in device.findall(".//PORT"):
+            if (port.findtext("PORT_DHCP_ENABLE") or "").strip().lower() == "true":
+                continue
+            gateway = (port.findtext("PORT_GATEWAY") or "").strip()
+            address = (port.findtext("IP") or "").strip()
+            mask = (port.findtext("SUBNET") or "").strip()
+            if not gateway or gateway in held or not address or not mask:
+                continue
+            wanted.setdefault(gateway, (gateway, mask))
+
+    if not wanted:
+        return []
+    # More than one orphaned gateway is more than this pass can attribute, and
+    # guessing which router owns which would be the same mistake again.
+    if len(wanted) > 1 or len(routers) > 1:
+        return []
+
+    gateway, mask = next(iter(wanted.values()))
+    router = routers[0]
+    name = (router.findtext("./ENGINE/NAME") or "").strip()
+    current = (router.findtext("./ENGINE/LAN_IP_ADDRESS") or "").strip()
+    if current == gateway:
+        return []
+
+    network = _network_address(gateway, mask)
+    if not network:
+        return []
+    first, last = _dhcp_pool_bounds(network, mask)
+    first_offset, last_offset = _dhcp_pool_offsets(mask)
+    present = {
+        (port.findtext("MACADDRESS") or "").strip().lower()
+        for device in devices
+        for port in device.findall(".//PORT")
+        if (port.findtext("MACADDRESS") or "").strip()
+    }
+
+    # Written by path, not by tag. `ENGINE` carries a stray empty `START_IP`
+    # beside the real one in `DHCP_SERVER/POOLS/POOL`, and a search by tag name
+    # filled both -- putting a pool bound on a field the donor left blank on
+    # purpose.
+    engine = router.find("./ENGINE")
+    if engine is None:
+        return []
+    for tag, value in (("LAN_IP_ADDRESS", gateway), ("LAN_SUBNET_MASK", mask)):
+        node = engine.find(tag)
+        if node is None:
+            node = ET.SubElement(engine, tag)
+        node.text = value
+    for pool in engine.findall("./DHCP_SERVER/POOLS/POOL"):
+        for tag, value in (
+            ("NETWORK", network),
+            ("MASK", mask),
+            ("DEFAULT_ROUTER", gateway),
+            ("START_IP", first),
+            ("END_IP", last),
+        ):
+            node = pool.find(tag)
+            if node is None:
+                node = ET.SubElement(pool, tag)
+            node.text = value
+        # A lease records which client holds which address, and Packet Tracer
+        # restores a client from it when the file opens. Deleting them -- which
+        # this pass did at first, on the reasoning that an address on the old
+        # network is stale -- is why a wireless client came up holding nothing
+        # and reached nothing: with no lease to restore it would have had to
+        # associate and ask again, which opening a file does not make it do.
+        #
+        # Measured: the donor's router carries five leases, one of them against
+        # the very MAC our laptop has, and its client pings 4/4. Ours carried
+        # none. The addresses were stale; the records were not, so they are
+        # renumbered into the new pool instead of dropped.
+        leases = pool.find("DHCP_POOL_LEASES")
+        if leases is not None:
+            for lease in list(leases):
+                mac = (lease.findtext("MAC_ADDRESS") or "").strip().lower()
+                if mac and mac not in present:
+                    # The client it was written for was pruned out of the lab.
+                    leases.remove(lease)
+            for offset, lease in enumerate(list(leases)):
+                held = lease.find("IP_ADDRESS")
+                if held is None:
+                    held = ET.SubElement(lease, "IP_ADDRESS")
+                held.text = _address_at(network, first_offset + offset, last_offset)
+    return [f"{name} now serves {network} with its gateway on {gateway}, which its clients point at"]
+
+
+def _network_address(address: str, mask: str) -> str:
+    try:
+        octets = [int(part) for part in address.split(".")]
+        bits = [int(part) for part in mask.split(".")]
+    except ValueError:
+        return ""
+    if len(octets) != 4 or len(bits) != 4:
+        return ""
+    return ".".join(str(octet & bit) for octet, bit in zip(octets, bits))
+
+
+def _dhcp_pool_offsets(mask: str) -> tuple[int, int]:
+    """Where a home router's pool starts and stops inside its own network."""
+    try:
+        bits = [int(part) for part in mask.split(".")]
+    except ValueError:
+        return 1, 1
+    if len(bits) != 4:
+        return 1, 1
+    size = 1
+    for bit in bits:
+        size *= 256 - bit
+    return min(100, max(size - 2, 1)), min(149, max(size - 2, 1))
+
+
+def _address_at(network: str, offset: int, ceiling: int) -> str:
+    """The address `offset` into `network`, never past the pool's last one."""
+    try:
+        octets = [int(part) for part in network.split(".")]
+    except ValueError:
+        return network
+    if len(octets) != 4:
+        return network
+    value = (octets[0] << 24) + (octets[1] << 16) + (octets[2] << 8) + octets[3] + min(offset, ceiling)
+    return ".".join(str((value >> shift) & 0xFF) for shift in (24, 16, 8, 0))
+
+
+def _dhcp_pool_bounds(network: str, mask: str) -> tuple[str, str]:
+    """The same span the donor used, `.100` to `.149`, kept inside the network.
+
+    A /24 is what a home router serves in practice; anything narrower gets a
+    pool that fits rather than one that runs past the broadcast address.
+    """
+    try:
+        octets = [int(part) for part in network.split(".")]
+        bits = [int(part) for part in mask.split(".")]
+    except ValueError:
+        return network, network
+    size = 1
+    for bit in bits:
+        size *= 256 - bit
+    first_offset = min(100, max(size - 2, 1))
+    last_offset = min(149, max(size - 2, 1))
+
+    def _at(offset: int) -> str:
+        value = (octets[0] << 24) + (octets[1] << 16) + (octets[2] << 8) + octets[3] + offset
+        return ".".join(str((value >> shift) & 0xFF) for shift in (24, 16, 8, 0))
+
+    return _at(first_offset), _at(last_offset)
+
+
+def _move_static_hosts_onto_their_vlan_network(root: ET.Element) -> list[str]:
+    """A static host has to sit on the network its own VLAN is routed on.
+
+    Two passes decide a host's address: one hands out addresses, one decides
+    what each VLAN's gateway is, and neither reads the other. Measured on the
+    enterprise lab: Server6 sat in VLAN 10 holding `192.168.10.13` with a
+    default gateway of `192.168.10.1`, while VLAN 10 is routed on
+    `10.10.10.0/24`. Nineteen servers and printers were like that -- addressed,
+    cabled, in the right VLAN, and pointing at a gateway no interface in the
+    lab answers for.
+
+    The VLAN's gateway is shared infrastructure and the host is one device, so
+    the host moves. Its host part is kept where it fits, which leaves the
+    lab's addressing readable, and the gateway it is given is the HSRP virtual
+    address when the VLAN has one -- the address the rest of the lab already
+    points at.
+
+    DHCP clients are not touched: Packet Tracer replaces their address at
+    runtime, so there is nothing here to correct.
+    """
+    from lab_coherence import _interface_addresses
+
+    switch_types = {"Switch", "MultiLayerSwitch"}
+    devices_by_ref = {
+        (device.findtext("./ENGINE/SAVE_REF_ID") or "").strip(): device
+        for device in root.findall(".//DEVICES/DEVICE")
+    }
 
-def _address_to_int(address: str) -> int | None:
-    parts = address.split(".")
-    if len(parts) != 4:
-        return None
-    value = 0
-    for part in parts:
-        if not part.isdigit() or not 0 <= int(part) <= 255:
-            return None
-        value = (value << 8) | int(part)
-    return value
+    gateways: dict[int, tuple[str, str]] = {}
+    held: set[str] = set()
+    for device in root.findall(".//DEVICES/DEVICE"):
+        vlan = 0
+        address = mask = virtual = ""
+        for node in [*device.findall("./ENGINE/RUNNINGCONFIG/LINE"), None]:
+            text = (node.text or "").strip() if node is not None else "interface END"
+            if text.startswith("interface "):
+                if vlan and address and vlan not in gateways:
+                    gateways[vlan] = (virtual or address, mask)
+                vlan = 0
+                address = mask = virtual = ""
+                continue
+            encapsulation = re.match(r"^encapsulation dot1Q (\d+)", text)
+            if encapsulation:
+                vlan = int(encapsulation.group(1))
+            addressed = re.match(r"^ip address (\d+\.\d+\.\d+\.\d+) (\d+\.\d+\.\d+\.\d+)$", text)
+            if addressed:
+                address, mask = addressed.group(1), addressed.group(2)
+                held.add(address)
+            standby = re.match(r"^standby \d+ ip (\d+\.\d+\.\d+\.\d+)$", text)
+            if standby:
+                virtual = standby.group(1)
+                held.add(virtual)
+    # No early return on an empty `gateways`: a lab with no VLANs still has a
+    # router interface per segment, and its hosts still have to be on it. The
+    # loop below already skips a host for which neither source knows an answer.
+    port_vlan: dict[tuple[str, str], int] = {}
+    for device in root.findall(".//DEVICES/DEVICE"):
+        if (device.findtext("./ENGINE/TYPE") or "") not in switch_types:
+            continue
+        name = (device.findtext("./ENGINE/NAME") or "").strip()
+        port = ""
+        for node in device.findall("./ENGINE/RUNNINGCONFIG/LINE"):
+            text = (node.text or "").strip()
+            if text.startswith("interface "):
+                port = text.split(None, 1)[1]
+            elif text.startswith("switchport access vlan ") and port:
+                port_vlan[(name, port)] = int(text.rsplit(" ", 1)[1])
+
+    # Which router interface answers for each switch, when no VLAN says so.
+    # Switches cabled to each other share one segment, so a router reached
+    # through a neighbouring switch is still this host's way out.
+    neighbours: dict[str, set[str]] = {}
+    router_on_switch: dict[str, tuple[str, str]] = {}
+    for link in root.findall(".//LINKS/LINK"):
+        cable = link.find("./CABLE")
+        if cable is None:
+            continue
+        refs = [(cable.findtext(tag) or "").strip() for tag in ("FROM", "TO")]
+        ports = [node.text or "" for node in cable.findall("PORT")]
+        if len(ports) < 2:
+            continue
+        left, right = devices_by_ref.get(refs[0]), devices_by_ref.get(refs[1])
+        if left is None or right is None:
+            continue
+        left_name = (left.findtext("./ENGINE/NAME") or "").strip()
+        right_name = (right.findtext("./ENGINE/NAME") or "").strip()
+        left_kind = (left.findtext("./ENGINE/TYPE") or "")
+        right_kind = (right.findtext("./ENGINE/TYPE") or "")
+        if left_kind in switch_types and right_kind in switch_types:
+            neighbours.setdefault(left_name, set()).add(right_name)
+            neighbours.setdefault(right_name, set()).add(left_name)
+        for near, near_port, far, far_name in (
+            (left, ports[0], right, right_name),
+            (right, ports[1], left, left_name),
+        ):
+            if (near.findtext("./ENGINE/TYPE") or "") != "Router":
+                continue
+            if (far.findtext("./ENGINE/TYPE") or "") not in switch_types:
+                continue
+            for port, address, mask in _interface_addresses(near):
+                if port == near_port and mask not in {"255.255.255.252", "255.255.255.254"}:
+                    router_on_switch[far_name] = (address, mask)
+                    break
 
+    segment_gateway: dict[str, tuple[str, str]] = {}
+    for start in list(neighbours) + list(router_on_switch):
+        if start in segment_gateway:
+            continue
+        seen = {start}
+        queue = [start]
+        found: tuple[str, str] | None = None
+        while queue:
+            current = queue.pop()
+            if current in router_on_switch:
+                found = router_on_switch[current]
+                break
+            for neighbour in neighbours.get(current, ()):
+                if neighbour not in seen:
+                    seen.add(neighbour)
+                    queue.append(neighbour)
+        if found is not None:
+            for name in seen:
+                segment_gateway.setdefault(name, found)
+
+    taken = set(held)
+    for device in root.findall(".//DEVICES/DEVICE"):
+        for port in device.findall(".//PORT"):
+            value = (port.findtext("IP") or "").strip()
+            if value:
+                taken.add(value)
 
-def _same_subnet(left: str, right: str, mask: str) -> bool:
-    left_value = _address_to_int(left)
-    right_value = _address_to_int(right)
-    mask_value = _address_to_int(mask)
-    if left_value is None or right_value is None or mask_value is None:
-        return False
-    return left_value & mask_value == right_value & mask_value
+    moved: list[str] = []
+    for link in root.findall(".//LINKS/LINK"):
+        cable = link.find("./CABLE")
+        if cable is None:
+            continue
+        refs = [(cable.findtext(tag) or "").strip() for tag in ("FROM", "TO")]
+        ports = [node.text or "" for node in cable.findall("PORT")]
+        if len(ports) < 2:
+            continue
+        left, right = devices_by_ref.get(refs[0]), devices_by_ref.get(refs[1])
+        if left is None or right is None:
+            continue
+        for switch, switch_port, host in ((left, ports[0], right), (right, ports[1], left)):
+            if (switch.findtext("./ENGINE/TYPE") or "") not in switch_types:
+                continue
+            # Only end devices. A router cabled to an access port is not a host
+            # with a default gateway, and the first version of this rewrote
+            # R1's WAN address from 200.10.0.2 to 10.10.30.4 because it read
+            # the PORT node the same way.
+            if (host.findtext("./ENGINE/TYPE") or "") not in HOST_DEVICE_TYPES:
+                continue
+            switch_name = (switch.findtext("./ENGINE/NAME") or "").strip()
+            vlan = port_vlan.get((switch_name, switch_port))
+            if vlan and vlan in gateways:
+                gateway, mask = gateways[vlan]
+            elif switch_name in segment_gateway:
+                # Not `not vlan`: the donor's access ports carry a VLAN number
+                # whether or not any router subinterface serves it, so keying
+                # on "has no VLAN" skipped every host in a lab that had VLAN
+                # tags and no router-on-a-stick. A VLAN nothing routes cannot
+                # answer for a host; the segment's own router interface can.
+                # A lab with no VLANs still has one router interface per
+                # segment, and a host still has to be on it. Measured on
+                # "2 router 2 switch 6 komputer": R1's LAN is 192.168.3.254,
+                # PC4 was correctly on it, and the other five sat on
+                # 192.168.1.x pointing at .254 and .1 -- three address plans
+                # in a lab of six workstations.
+                gateway, mask = segment_gateway[switch_name]
+            else:
+                continue
+            current_gateway = (host.findtext(".//GATEWAY") or "").strip()
+            if current_gateway in held:
+                continue
+            socket = next(
+                (
+                    node
+                    for node in host.findall(".//PORT")
+                    if (node.findtext("IP") or "").strip()
+                    and (node.findtext("IP") or "").strip() != "0.0.0.0"
+                    and (node.findtext("PORT_DHCP_ENABLE") or "").strip().lower() != "true"
+                ),
+                None,
+            )
+            if socket is None:
+                continue
+            was = (socket.findtext("IP") or "").strip()
+            network = _network_from(gateway, mask)
+            wanted = _network_from(was, mask)
+            if network is None or (wanted is not None and wanted == network):
+                continue
+            candidate = _join_host_part(was, gateway, mask)
+            while candidate in taken or candidate == gateway:
+                candidate = _next_address(candidate)
+            taken.add(candidate)
+            _set_text(socket, "IP", candidate)
+            _set_text(socket, "SUBNET", mask)
+            node = host.find(".//GATEWAY")
+            if node is None:
+                node = ET.SubElement(host, "GATEWAY")
+            node.text = gateway
+            moved.append(
+                f"{host.findtext('./ENGINE/NAME') or ''} {was} -> {candidate} "
+                f"(VLAN {vlan}, gateway {gateway})"
+            )
+    return moved
 
 
 def _align_dhcp_pools_with_interfaces(root: ET.Element) -> list[str]:
@@ -4769,30 +7939,45 @@ def _align_dhcp_pools_with_interfaces(root: ET.Element) -> list[str]:
         if not interfaces:
             continue
 
-        pools: list[tuple[str, ET.Element, ET.Element | None]] = []
+        # A pool serves a LAN. A /30 is a router-to-router link and never has a
+        # client on it, so it must not be offered as a home for a pool that has
+        # nowhere else to go: measured, a workstation was handed 200.10.0.1/30
+        # -- the ISP's own WAN address -- and two more got /30 masks on a /24
+        # segment, because the search took the first free interface of any
+        # shape.
+        lan_interfaces = [
+            (address, mask)
+            for address, mask in interfaces
+            if (_address_to_int(mask) or 0) <= _address_to_int("255.255.255.0")
+        ]
+
+        pools: list[tuple[str, ET.Element, ET.Element | None, list[ET.Element]]] = []
         pool_name = ""
         network_node: ET.Element | None = None
         gateway_node: ET.Element | None = None
+        block: list[ET.Element] = []
         for line in lines:
             text = (line.text or "").rstrip()
             stripped = text.strip()
             if not text.startswith((" ", "\t")):
                 if pool_name and network_node is not None:
-                    pools.append((pool_name, network_node, gateway_node))
+                    pools.append((pool_name, network_node, gateway_node, block))
                 pool_name = stripped[len("ip dhcp pool ") :] if stripped.startswith("ip dhcp pool ") else ""
                 network_node = None
                 gateway_node = None
+                block = [line] if pool_name else []
                 continue
             if not pool_name:
                 continue
+            block.append(line)
             if stripped.startswith("network "):
                 network_node = line
             elif stripped.startswith("default-router "):
                 gateway_node = line
         if pool_name and network_node is not None:
-            pools.append((pool_name, network_node, gateway_node))
+            pools.append((pool_name, network_node, gateway_node, block))
 
-        for name, network_line, gateway_line in pools:
+        for name, network_line, gateway_line, block in pools:
             parts = (network_line.text or "").split()
             if len(parts) != 3:
                 continue
@@ -4801,15 +7986,24 @@ def _align_dhcp_pools_with_interfaces(root: ET.Element) -> list[str]:
                 continue
             served = {
                 (address, interface_mask)
-                for other_name, other_network, _ in pools
+                for other_name, other_network, _gateway, _block in pools
                 if other_name != name
-                for address, interface_mask in interfaces
+                for address, interface_mask in lan_interfaces
                 if _same_subnet(address, (other_network.text or "").split()[1], interface_mask)
             }
-            replacement = next(
-                (pair for pair in interfaces if pair not in served),
-                interfaces[0],
-            )
+            replacement = next((pair for pair in lan_interfaces if pair not in served), None)
+            if replacement is None:
+                # More pools than LANs to serve. A pool with nowhere to live is
+                # not harmless: left pointing at a link, it hands a workstation
+                # the address of a router-to-router segment.
+                for node in block:
+                    if node in list(config):
+                        config.remove(node)
+                repaired.append(
+                    f"{device.findtext('./ENGINE/NAME') or ''}: pool {name} removed, "
+                    f"no LAN left for it to serve"
+                )
+                continue
             address, interface_mask = replacement
             address_value = _address_to_int(address)
             mask_value = _address_to_int(interface_mask)
@@ -4981,6 +8175,45 @@ LOGICAL_ICON_SPACING = 110
 PARKED_LOGICAL_X = 9000
 
 
+# How far apart two rows of switch blocks sit, and how far the hosts hang
+# below their switch. Taken from the spacing the annotation already draws its
+# frames with, so a frame still wraps its own block.
+BLOCK_ROW_PITCH = 420
+BLOCK_HOST_DROP = 200
+
+
+def _parked_names(root: ET.Element) -> set[str]:
+    """Devices deliberately set aside, which is not the same as "far to the right".
+
+    The parked column holds the donor's leftovers when
+    `PACKET_TRACER_SPARE_STRATEGY=park` is in force: renamed `UNUSED-*` and
+    moved offscreen so they are visibly not part of the lab. Four passes tested
+    for that by comparing x against `PARKED_LOGICAL_X` and nothing else, which
+    is the same rule written four times and it was wrong in every copy. A lab
+    whose blocks had been laid end to end ran past the threshold halfway
+    through, and from there the layout pass stopped tidying, the compaction
+    stopped pulling in, the overlap pass stopped separating and the annotation
+    stopped drawing frames -- measured as SW13 and its eight hosts stranded at
+    x 15,510, and nine frames for seventeen blocks.
+
+    A cabled device is never parked, whatever its coordinates. One function
+    answers that now, so the four passes cannot drift apart again.
+    """
+    wired = {name for pair in _link_device_pairs(root) for name in pair}
+    parked: set[str] = set()
+    for device in root.findall(".//DEVICES/DEVICE"):
+        name = (device.findtext("./ENGINE/NAME") or "").strip()
+        if not name or name in wired:
+            continue
+        try:
+            x = float((device.findtext("./WORKSPACE/LOGICAL/X") or "").strip())
+        except ValueError:
+            continue
+        if x >= PARKED_LOGICAL_X:
+            parked.add(name)
+    return parked
+
+
 def _group_hosts_under_their_switch(root: ET.Element) -> list[str]:
     """Lay each switch's hosts out beneath it, one block per switch.
 
@@ -4998,9 +8231,18 @@ def _group_hosts_under_their_switch(root: ET.Element) -> list[str]:
     Routers, the core, and anything not cabled to an access switch are left
     where they are: they sit above this row and the reader expects them there.
     """
+    # An agent that has already drawn the topology -- deciding where each
+    # department sits and which switch faces which -- knows more about the
+    # intended shape than a packing rule does. `PACKET_TRACER_LAYOUT=keep`
+    # leaves every coordinate exactly as the blueprint gave it.
+    if (os.getenv("PACKET_TRACER_LAYOUT") or "").strip().lower() == "keep":
+        return []
+
     kinds: dict[str, str] = {}
     nodes: dict[str, tuple[ET.Element, ET.Element]] = {}
     position: dict[str, tuple[float, float]] = {}
+    parked = _parked_names(root)
+    wired = {name for pair in _link_device_pairs(root) for name in pair}
     for device in root.findall(".//DEVICES/DEVICE"):
         name = (device.findtext("./ENGINE/NAME") or "").strip()
         x_node = device.find("./WORKSPACE/LOGICAL/X")
@@ -5012,7 +8254,7 @@ def _group_hosts_under_their_switch(root: ET.Element) -> list[str]:
             y = float((y_node.text or "").strip())
         except ValueError:
             continue
-        if x >= PARKED_LOGICAL_X:
+        if name in parked:
             continue
         kinds[name] = (device.findtext("./ENGINE/TYPE") or "").strip()
         nodes[name] = (x_node, y_node)
@@ -5033,15 +8275,52 @@ def _group_hosts_under_their_switch(root: ET.Element) -> list[str]:
     if len(blocks) < 2:
         return []
 
-    ordered = sorted(blocks, key=lambda name: position[name][0])
-    host_row = max(position[host][1] for members in blocks.values() for host in members)
+    # Document order, not current x. Sorting by position made the pass depend
+    # on its own output: run twice, the blocks pack differently, and a lab
+    # regenerated from itself drifts. Measured at 2,530 units wide on the first
+    # run and 2,715 on the second.
+    appearance = {
+        (device.findtext("./ENGINE/NAME") or "").strip(): index
+        for index, device in enumerate(root.findall(".//DEVICES/DEVICE"))
+    }
+    ordered = sorted(blocks, key=lambda name: appearance.get(name, 0))
     moved: list[str] = []
-    cursor = min(position[name][0] for name in ordered) - LOGICAL_ICON_SPACING
 
+    widths = {
+        name: max(len(blocks[name]) - 1, 0) * LOGICAL_ICON_SPACING for name in ordered
+    }
+    # One row of blocks reads as a strip, not a diagram. Eighteen switches laid
+    # end to end measured 15,840 units across against 4,020 tall -- a lab you
+    # scroll sideways through for a minute and never see at once.
+    #
+    # How many blocks per row: the packing is greedy, so a budget taken from
+    # the total width leaves a third of each row empty and the diagram comes
+    # out as tall as the strip was wide -- 2,510 by 3,560 on the first attempt.
+    # Counting in whole blocks instead balances the two spans: with `columns`
+    # blocks across, the lab is columns x pitch wide and count/columns x
+    # BLOCK_ROW_PITCH tall, and those are equal at the square root below.
+    pitch_x = max(widths.values(), default=0) + LOGICAL_ICON_SPACING
+    columns = max(1, round((len(ordered) * BLOCK_ROW_PITCH / pitch_x) ** 0.5))
+    budget = columns * pitch_x
+    # A fixed anchor, not one read back from the devices this pass just moved.
+    # Each switch ends up centred over its hosts, so the minimum switch x is
+    # larger after a run than before it; deriving the left margin from that
+    # walked the whole diagram to the right on every regeneration while the
+    # routers stayed put, and the lab grew wider each time -- 2,430 units, then
+    # 2,616, then 2,946.
+    left = float(LOGICAL_ICON_SPACING)
+    switch_row = min(position[name][1] for name in ordered)
+
+    cursor = left
+    row = 0
     for switch_name in ordered:
+        width = widths[switch_name]
+        if cursor > left and cursor - left + width > budget:
+            row += 1
+            cursor = left
         members = sorted(blocks[switch_name], key=lambda name: _name_sort_key(name))
-        width = max(len(members) - 1, 0) * LOGICAL_ICON_SPACING
         start = cursor + LOGICAL_ICON_SPACING
+        host_row = switch_row + row * BLOCK_ROW_PITCH + BLOCK_HOST_DROP
         for index, host in enumerate(members):
             target = (start + index * LOGICAL_ICON_SPACING, host_row)
             if position[host] == target:
@@ -5054,10 +8333,356 @@ def _group_hosts_under_their_switch(root: ET.Element) -> list[str]:
         # The switch sits centred over the hosts it serves, so the block reads
         # as one shape rather than a row with a label somewhere off to the side.
         centre = start + width / 2
+        top = switch_row + row * BLOCK_ROW_PITCH
         x_node, y_node = nodes[switch_name]
         x_node.text = str(int(centre))
-        position[switch_name] = (centre, position[switch_name][1])
+        y_node.text = str(int(top))
+        # The node holds the rounded value, so remember that, not the float:
+        # otherwise every later run sees a mismatch and moves it again.
+        position[switch_name] = (float(int(centre)), float(int(top)))
         cursor = start + width + LOGICAL_ICON_SPACING
+
+    # A switch with no hosts of its own -- the core, carrying only trunks --
+    # is in no block, so nothing placed it. On the enterprise lab that left
+    # SW18 alone at y 4,080, a screen and a half below the network it serves,
+    # with every trunk drawn as a long diagonal across the diagram. It belongs
+    # above the access rows, between them and the routers.
+    core = [
+        name
+        for name, kind in kinds.items()
+        if kind in switch_kinds and name not in blocks and name in wired
+    ]
+    if core:
+        spread = max(position[name][0] for name in ordered) + LOGICAL_ICON_SPACING
+        base = min(position[name][0] for name in ordered)
+        step = max((spread - base) / (len(core) + 1), LOGICAL_ICON_SPACING)
+        for index, name in enumerate(sorted(core, key=lambda text: appearance.get(text, 0))):
+            x_node, y_node = nodes[name]
+            target = (base + step * (index + 1), switch_row - BLOCK_ROW_PITCH)
+            if position[name] == target:
+                continue
+            x_node.text = str(int(target[0]))
+            y_node.text = str(int(target[1]))
+            position[name] = (float(int(target[0])), float(int(target[1])))
+            moved.append(f"{name}: -> above the access rows")
+    return moved
+
+
+# How far a cable-less leftover may sit outside the wired lab before it is
+# pulled in. Wide enough that a device merely sitting at the edge is left alone.
+STRAY_DEVICE_MARGIN = 400
+
+
+def _drop_cables_the_plan_did_not_ask_for(root: ET.Element, blueprint: dict[str, object]) -> list[str]:
+    """A host socket takes one cable, and the plan says which one.
+
+    Holding a surplus donor device back so it can answer to a planned name
+    keeps its donor cabling too. The plan then lays its own cable to that name,
+    and the device ends up on two switches at once -- Packet Tracer refuses the
+    file, and the corpus caught four cases of it in one run:
+
+        port PC3 FastEthernet0 is used by both link 3 and link 8
+
+    The inherited cable is the one to drop: the plan chose which switch that
+    host belongs to, and the donor's arrangement is an accident of which lab it
+    came from. Where neither cable matches the plan the first is kept, because
+    leaving both is the one outcome that does not open.
+    """
+    from pkt_editor import _remove_link
+
+    planned: dict[str, set[str]] = {}
+    for link in blueprint.get("links", []) or []:
+        left = str((link.get("a") or {}).get("dev") or "")
+        right = str((link.get("b") or {}).get("dev") or "")
+        if left and right:
+            planned.setdefault(left, set()).add(right)
+            planned.setdefault(right, set()).add(left)
+
+    names = {
+        (device.findtext("./ENGINE/SAVE_REF_ID") or "").strip(): (device.findtext("./ENGINE/NAME") or "").strip()
+        for device in root.findall(".//DEVICES/DEVICE")
+    }
+    on_port: dict[tuple[str, str], list[str]] = {}
+    for link in root.findall(".//LINKS/LINK"):
+        cable = link.find("./CABLE")
+        if cable is None:
+            continue
+        refs = [(cable.findtext(tag) or "").strip() for tag in ("FROM", "TO")]
+        ports = [node.text or "" for node in cable.findall("PORT")]
+        if len(ports) < 2:
+            continue
+        left, right = names.get(refs[0], ""), names.get(refs[1], "")
+        if not left or not right:
+            continue
+        on_port.setdefault((left, ports[0]), []).append(right)
+        on_port.setdefault((right, ports[1]), []).append(left)
+
+    dropped: list[str] = []
+    for (device_name, port), partners in sorted(on_port.items()):
+        if len(partners) < 2:
+            continue
+        wanted = planned.get(device_name, set())
+        keep = next((partner for partner in partners if partner in wanted), partners[0])
+        for partner in partners:
+            if partner == keep:
+                continue
+            _remove_link(root, device_name, partner)
+            dropped.append(f"{device_name}:{port} no longer also cabled to {partner}")
+    return dropped
+
+
+def _adopt_planned_names(root: ET.Element, blueprint: dict[str, object]) -> list[str]:
+    """Give a device the plan's name when it is doing the plan's job.
+
+    Four corpus labs came out one device short of their blueprint, always the
+    last switch. The device was never missing. `hosts_across_switches` planned
+    `SW1, SW2, SW3` and the file held `SW1`, `SW2` and `MultiLayerSwitch1` --
+    and that third switch is the core of the topology: the router connects to
+    it, and it connects to the other two. It had simply kept the donor's name.
+
+    Whether the rename lands depends on the donor. Applying the same plan
+    against the saved floor-switch lab by hand produced `SW3` correctly; the donor the
+    corpus picked has its own `MultiLayerSwitch` devices, and one of them was
+    reused without being renamed.
+
+    So rather than chase the donor-specific path, the name is adopted here: a
+    device the plan did not name, of the kind the plan is missing, and already
+    cabled into the lab, takes the missing name. Cabled matters -- an idle
+    spare parked off to the side is not doing the job the plan described, and
+    handing it the name would produce a lab whose `SW3` connects to nothing.
+    """
+    planned_names: list[str] = []
+    for device in blueprint.get("devices", []):
+        name = str(device.get("name") or "").strip()
+        if name:
+            planned_names.append(name)
+    if not planned_names:
+        return []
+
+    by_name: dict[str, ET.Element] = {}
+    for device in root.findall(".//DEVICES/DEVICE"):
+        name = (device.findtext("./ENGINE/NAME") or "").strip()
+        if name:
+            by_name[name] = device
+
+    missing = [name for name in planned_names if name not in by_name]
+    if not missing:
+        return []
+
+    cabled = {name for pair in _link_device_pairs(root) for name in pair}
+    spare = [
+        name
+        for name in by_name
+        if name not in planned_names and name in cabled
+    ]
+    if not spare:
+        return []
+
+    def family(kind: str) -> str:
+        lowered = kind.lower()
+        if "switch" in lowered:
+            return "switch"
+        if "router" in lowered:
+            return "router"
+        return lowered
+
+    adopted: list[str] = []
+    for wanted in missing:
+        wanted_family = family(_device_kind_of_blueprint(blueprint, wanted))
+        if not wanted_family:
+            continue
+        match = next(
+            (
+                name
+                for name in spare
+                if family((by_name[name].findtext("./ENGINE/TYPE") or "").strip()) == wanted_family
+            ),
+            None,
+        )
+        if match is None:
+            continue
+        spare.remove(match)
+        device = by_name.pop(match)
+        name_node = device.find("./ENGINE/NAME")
+        if name_node is None:
+            continue
+        name_node.text = wanted
+        by_name[wanted] = device
+        _align_hostname_with_name(device, wanted)
+        adopted.append(f"{match} answers to {wanted}, the name the plan gave its job")
+    return adopted
+
+
+def _report_unwired_devices(root: ET.Element, blueprint: dict[str, object]) -> list[str]:
+    """Name any requested device that arrived with no cable on it.
+
+    `1 router 1 switch 3 komputer ve 1 firewall qur` produces a lab holding an
+    ASA, and Packet Tracer opens it, and the ASA is connected to nothing. The
+    same is true of a requested patch panel. The device count is right, the file
+    is valid, and the thing the prompt asked for does not participate in the
+    network.
+
+    The link synthesiser cables the kinds in `HOST_DEVICE_KINDS`, each with a
+    port name measured off real donor cables rather than taken from the device
+    palette. Extending it to these kinds needs the same evidence, and the
+    measurement says it is not there yet: across 150 labs, ASA cables use
+    `Ethernet0/0` on a 5505 while the palette reports `GigabitEthernet1/1` for
+    the 5506-X, and patch panels, bridges, repeaters and wired end devices carry
+    no cable at all in any of them. Guessing one constant per kind is how a
+    hardcoded port name gets into the file, which is the defect this project
+    spent a long time removing.
+
+    So the gap is reported rather than papered over. A lab whose firewall is
+    unplugged should say so.
+    """
+    requested = {
+        str(device.get("name") or "").strip(): str(device.get("type") or "").strip()
+        for device in blueprint.get("devices", [])
+        if str(device.get("name") or "").strip()
+    }
+    if not requested:
+        return []
+    present = {
+        (device.findtext("./ENGINE/NAME") or "").strip()
+        for device in root.findall(".//DEVICES/DEVICE")
+    }
+    cabled = {name for pair in _link_device_pairs(root) for name in pair}
+    # A lab with no cables at all is a wireless scenario, not a wiring failure.
+    if not cabled:
+        return []
+    stranded = sorted(
+        name for name in requested if name in present and name not in cabled
+    )
+    if not stranded:
+        return []
+    described = ", ".join(f"{name} ({requested[name]})" if requested[name] else name for name in stranded[:6])
+    if len(stranded) > 6:
+        described += f", and {len(stranded) - 6} more"
+    return [f"WARNING: {len(stranded)} requested device(s) have no cable: {described}"]
+
+
+def _report_coherence(root: ET.Element) -> None:
+    """Say what the finished lab contradicts about itself.
+
+    A lab whose halves disagree opens perfectly well and passes every static
+    check -- that is how a printer in VLAN 200 with a 192.168.110 address, a
+    gateway no interface answered for, and a subinterface declared five times
+    all reached a delivered file. The report never repairs and never fails the
+    build: a checker that fixes what it finds stops being able to tell you
+    whether the thing it checks is working.
+    """
+    try:
+        from lab_coherence import check_lab_coherence, summarise
+
+        contradictions = check_lab_coherence(root)
+        if not contradictions:
+            return
+        print(f"WARNING: {summarise(contradictions)}")
+        for finding in contradictions[:5]:
+            print(f"  {finding}")
+        if len(contradictions) > 5:
+            print(f"  ... and {len(contradictions) - 5} more; run --coherence-report for all")
+    except Exception as exc:  # reporting must never take a working build down
+        print(f"WARNING: coherence check did not run ({exc})")
+
+
+def _report_undelivered_devices(root: ET.Element, blueprint: dict[str, object]) -> list[str]:
+    """Name any device the plan asked for that is not in the written file.
+
+    Generation reported success for `2 router serial WAN, 2 switch, 8 komputer,
+    1 server`: the blueprint held thirteen devices and the file held three, with
+    the eight PCs and the server simply absent. Nothing said so. Silence is the
+    worst of the three outcomes here -- a refusal explains itself, a working lab
+    needs no explanation, and a lab quietly missing most of what was asked for
+    looks like the tool worked.
+
+    Auditing the corpus found four labs short by one device each, always a
+    switch, and always one that kept its donor name instead of being renamed.
+    That number moves with donor selection, so this reports rather than refuses:
+    failing labs that open and mostly serve the prompt would cost more than it
+    saves. The point is that the gap is now visible on every run.
+    """
+    planned = {
+        str(device.get("name")).strip()
+        for device in blueprint.get("devices", [])
+        if str(device.get("name") or "").strip()
+    }
+    if not planned:
+        return []
+    present = {
+        (device.findtext("./ENGINE/NAME") or "").strip()
+        for device in root.findall(".//DEVICES/DEVICE")
+    }
+    missing = sorted(planned - present)
+    if not missing:
+        return []
+    shown = ", ".join(missing[:8])
+    if len(missing) > 8:
+        shown += f", and {len(missing) - 8} more"
+    return [
+        f"WARNING: {len(missing)} of {len(planned)} planned device(s) are not in the file: {shown}"
+    ]
+
+
+def _compact_stray_devices(root: ET.Element) -> list[str]:
+    """Pull cable-less donor leftovers back beside the lab that was asked for.
+
+    Every corpus lab measured between 2440 and 2550 units wide, including
+    `minimal`, which is one router, one switch and three PCs. Those five sit in
+    340 units; the width came from two `Power Distribution Device` nodes still
+    at their donor coordinates, x=2620 and x=2730, roughly 2100 units to the
+    right of anything cabled. Packet Tracer shows about 1500 units at the
+    default zoom, so the lab opened on an empty patch of canvas with the real
+    topology off to the left.
+
+    They are not pruned here. They came with the donor, nothing is wired to
+    them, and removing devices is the kind of change that has broken donor
+    coherence before. Moving them is enough: the canvas shrinks to the lab.
+
+    A lab with fewer than two cabled devices has no bounding box worth
+    speaking of -- the wireless scenarios have no cables at all -- so those are
+    left exactly as they are.
+    """
+    parked = _parked_names(root)
+    positions: dict[str, tuple[ET.Element, ET.Element, float, float]] = {}
+    for device in root.findall(".//DEVICES/DEVICE"):
+        name = (device.findtext("./ENGINE/NAME") or "").strip()
+        x_node = device.find("./WORKSPACE/LOGICAL/X")
+        y_node = device.find("./WORKSPACE/LOGICAL/Y")
+        if not name or x_node is None or y_node is None:
+            continue
+        try:
+            x = float((x_node.text or "").strip())
+            y = float((y_node.text or "").strip())
+        except ValueError:
+            continue
+        if name in parked:
+            continue
+        positions[name] = (x_node, y_node, x, y)
+
+    cabled = {name for pair in _link_device_pairs(root) for name in pair}
+    anchored = [positions[name] for name in cabled if name in positions]
+    if len(anchored) < 2:
+        return []
+
+    right = max(entry[2] for entry in anchored)
+    top = min(entry[3] for entry in anchored)
+    bottom = max(entry[3] for entry in anchored)
+
+    strays = sorted(
+        (name for name, entry in positions.items() if name not in cabled and entry[2] > right + STRAY_DEVICE_MARGIN),
+        key=lambda name: positions[name][2],
+    )
+    moved: list[str] = []
+    for index, name in enumerate(strays):
+        x_node, y_node, _, _ = positions[name]
+        x = int(right + 140 + (index % 2) * 120)
+        y = int(top + (index // 2) * 110)
+        if y > bottom:
+            y = int(bottom)
+        x_node.text = str(x)
+        y_node.text = str(y)
+        moved.append(f"{name}: pulled beside the lab at {x},{y}")
     return moved
 
 
@@ -5086,6 +8711,7 @@ def _separate_overlapping_devices(root: ET.Element) -> list[str]:
             for other_x, other_y in placed
         )
 
+    parked = _parked_names(root)
     placed: list[tuple[float, float]] = []
     moved: list[str] = []
     for device in root.findall(".//DEVICES/DEVICE"):
@@ -5098,7 +8724,7 @@ def _separate_overlapping_devices(root: ET.Element) -> list[str]:
             y = float((y_node.text or "").strip())
         except ValueError:
             continue
-        if x >= PARKED_LOGICAL_X:
+        if (device.findtext("./ENGINE/NAME") or "").strip() in parked:
             continue
         if not too_close(x, y, placed):
             placed.append((x, y))
@@ -5278,6 +8904,121 @@ def _match_link_port_families(root: ET.Element) -> list[str]:
     return changed
 
 
+def _ordered_port_media(device: ET.Element) -> dict[str, list[str]]:
+    """This device's sockets, in Packet Tracer's own order, grouped by kind.
+
+    The PORT nodes carry a media type and no name, and the document order is
+    the order Packet Tracer numbers them in: an IE-9320's twenty-eight nodes are
+    `GigabitEthernet1/0/1` .. `1/0/28`, a 2960's twenty-six are
+    `FastEthernet0/1` .. `0/24` followed by `GigabitEthernet0/1` .. `0/2`.
+    Verified against the live device listing for both.
+
+    Zipping the nodes against `donor_interface_names` looks like the obvious
+    way to get names and does not work: that returns 29 entries for a
+    twenty-eight port switch, because a configuration also mentions interfaces
+    the hardware does not have, and the pairing silently slips. Grouping by kind
+    and counting within the kind survives that.
+    """
+    grouped: dict[str, list[str]] = {}
+    for port in device.findall(".//PORT"):
+        media = (port.findtext("./TYPE") or "").strip()
+        if "FastEthernet" in media:
+            grouped.setdefault("FastEthernet", []).append(media)
+        elif "GigabitEthernet" in media:
+            grouped.setdefault("GigabitEthernet", []).append(media)
+    return grouped
+
+
+def _port_is_fiber(device: ET.Element, port_name: str) -> bool:
+    """Whether that named socket takes fibre rather than copper."""
+    name = (port_name or "").strip()
+    for kind in ("GigabitEthernet", "FastEthernet"):
+        if not name.startswith(kind):
+            continue
+        tail = name[len(kind):].strip()
+        if "/" not in tail:
+            return False
+        try:
+            index = int(tail.rsplit("/", 1)[-1])
+        except ValueError:
+            return False
+        media = _ordered_port_media(device).get(kind, [])
+        if 1 <= index <= len(media):
+            return "Fiber" in media[index - 1]
+        return False
+    return False
+
+
+def _move_copper_cables_off_fibre_ports(root: ET.Element) -> list[str]:
+    """Keep a copper cable out of a socket that only takes fibre.
+
+    Packet Tracer does not refuse such a file. It opens it and silently drops
+    the cable. Measured on a three-switch lab: sixteen links in the file,
+    thirteen in the running topology, and the three missing ones all landed on
+    `GigabitEthernet1/0/1` or `1/0/2` of an IE-9320 -- that switch's only two
+    fibre ports. One of them was the router uplink, so nothing could reach the
+    DHCP pool and every host fell back to an APIPA address. The open check
+    reported `opened` throughout.
+
+    That is worth stating plainly: a lab opening is not the same as Packet
+    Tracer having loaded the topology that was written.
+
+    The cable is moved rather than the media changed. A copper cable between
+    two switches is what the topology asked for; the fibre socket is an
+    accident of which port was free first.
+    """
+    device_order = list(root.findall(".//DEVICES/DEVICE"))
+    device_by_ref: dict[str, ET.Element] = {}
+    for index, device in enumerate(device_order):
+        ref = (device.findtext("./ENGINE/SAVE_REF_ID") or "").strip()
+        if ref:
+            device_by_ref[ref] = device
+        device_by_ref.setdefault(str(index), device)
+
+    taken: set[tuple[str, str]] = set()
+    for link in root.findall(".//LINKS/LINK"):
+        cable = link.find("./CABLE")
+        if cable is None:
+            continue
+        refs = [(cable.findtext("FROM") or "").strip(), (cable.findtext("TO") or "").strip()]
+        for ref, node in zip(refs, cable.findall("PORT")):
+            taken.add((ref, (node.text or "").strip()))
+
+    moved: list[str] = []
+    for link in root.findall(".//LINKS/LINK"):
+        cable = link.find("./CABLE")
+        if cable is None or (link.findtext("TYPE") or "").strip() != "eCopper":
+            continue
+        refs = [(cable.findtext("FROM") or "").strip(), (cable.findtext("TO") or "").strip()]
+        nodes = cable.findall("PORT")
+        if len(nodes) < 2:
+            continue
+        for ref, node in zip(refs, nodes):
+            device = device_by_ref.get(ref)
+            name = (node.text or "").strip()
+            if device is None or not name or not _port_is_fiber(device, name):
+                continue
+            kind = "GigabitEthernet" if name.startswith("GigabitEthernet") else "FastEthernet"
+            replacement = ""
+            for candidate in donor_interface_names(device):
+                # Same kind of interface, so a gigabit uplink stays gigabit.
+                if not candidate.startswith(kind) or candidate == name:
+                    continue
+                if (ref, candidate) in taken:
+                    continue
+                if not port_exists(device, candidate) or _port_is_fiber(device, candidate):
+                    continue
+                replacement = candidate
+                break
+            if not replacement:
+                continue
+            taken.discard((ref, name))
+            taken.add((ref, replacement))
+            node.text = replacement
+            moved.append(f"{name} -> {replacement} (copper cable off a fibre socket)")
+    return moved
+
+
 def _reconcile_cable_media(root: ET.Element) -> list[str]:
     """Make each cable's family agree with the interfaces it ends on.
 
@@ -5336,7 +9077,7 @@ def _declare_serial_dce_ends(root: ET.Element) -> list[str]:
     Adding `DCEDEV` and `DCEPORT` to that refused file opens it.
 
     The `FROM` end is named as DCE, which is what the donors do: every serial
-    link in `Senan_Haciyev_tapsiriq.pkt` names its `FROM` device and port.
+    link in the saved serial-WAN lab names its `FROM` device and port.
     """
     changed: list[str] = []
     for link in root.findall(".//LINKS/LINK"):
@@ -5513,6 +9254,7 @@ def _repair_invalid_link_ports(root: ET.Element) -> list[str]:
 
     repairs: list[str] = []
     seen: set[tuple[str, str]] = set()
+    doomed: list[ET.Element] = []
     for link in root.findall(".//LINKS/LINK"):
         cable = link.find("./CABLE")
         if cable is None:
@@ -5537,6 +9279,14 @@ def _repair_invalid_link_ports(root: ET.Element) -> list[str]:
                 reason = "interface does not exist"
             name = device.findtext("./ENGINE/NAME") or ref
             candidates = donor_interface_names(device)
+            if not candidates:
+                # A home router writes no interfaces into its configuration, so
+                # the probe list below -- all of it slotted -- offered nothing
+                # its sockets are called. Tightening `port_exists` to reject
+                # `FastEthernet0/1` on a device whose ports are `Ethernet 1` ..
+                # `4` would then have removed the cable instead of renaming it,
+                # which is why the two changes belong together.
+                candidates = wireless_router_port_names(device)
             if not candidates:
                 # Some devices carry no running config to read interfaces from,
                 # and a repair with nothing to offer leaves the fault in place:
@@ -5570,6 +9320,19 @@ def _repair_invalid_link_ports(root: ET.Element) -> list[str]:
                 None,
             )
             if replacement is None:
+                if reason == "interface does not exist":
+                    # Reporting it and leaving it is the one outcome that
+                    # cannot work: this pass's own subject is that an invalid
+                    # interface name stops Packet Tracer opening the file at
+                    # all. Measured on "1 wireless router 2 laptop qur": the
+                    # donor's laptops carry `eHostWirelessN` and `eBluetooth`
+                    # and no copper socket, the plan cabled them on
+                    # `FastEthernet0`, no relocation existed, and the lab was
+                    # refused. Removing the cable is also what the lab means --
+                    # a laptop with only a wireless card joins over the air.
+                    doomed.append(link)
+                    repairs.append(f"{name}: cable on {port} removed -- the device has no such socket")
+                    break
                 repairs.append(f"{name}: {port} unusable ({reason}) and no free interface was available")
                 seen.add((ref, port))
                 continue
@@ -5584,6 +9347,12 @@ def _repair_invalid_link_ports(root: ET.Element) -> list[str]:
             seen.add((ref, replacement))
             port_node.text = replacement
             repairs.append(f"{name}: {port} -> {replacement} ({reason})")
+
+    links_parent = root.find(".//LINKS")
+    if links_parent is not None:
+        for link in doomed:
+            if link in list(links_parent):
+                links_parent.remove(link)
     return repairs
 
 
@@ -5729,9 +9498,9 @@ def _align_donor_groups_to_targets(
     refusal: the donor "does not contain that device-to-device link", when it did
     contain it, on different switches.
 
-    `Senan_K231.pkt` is Router-Mertebe3-Mertebe2-Mertebe1. Name order gave
-    SW2 -> Mertebe 1, so `SW1 <-> SW2` mapped to a pair with no link. Distance
-    ordering gives SW1/SW2/SW3 -> Mertebe 3/2/1, which follows the real chain.
+    The saved floor-switch lab is Router-Floor3-Floor2-Floor1. Name order gave
+    SW2 -> Floor 1, so `SW1 <-> SW2` mapped to a pair with no link. Distance
+    ordering gives SW1/SW2/SW3 -> Floor 3/2/1, which follows the real chain.
     """
     if len(donor_groups) < 2 or not target_groups:
         return donor_groups
@@ -5766,6 +9535,14 @@ def _align_donor_groups_to_targets(
             ),
         )
     ]
+    # Preferring the switch model the plan named was tried here, between hop
+    # distance and name, so it could only choose between switches the same
+    # distance from the router. It did what it was meant to -- `voice_devices`
+    # came out on the `2960-24TT` the plan asked for instead of an `IE-9320` --
+    # and Packet Tracer then refused that lab, taking the corpus from 32 open
+    # to 31. The whole gain across the corpus was one switch, 10 matching to
+    # 11 of 53. A case that opens outranks a case that merely carries the right
+    # model, so it is not here.
     ranked_donors = sorted(
         donor_groups,
         key=lambda group: (
@@ -5815,6 +9592,17 @@ def _build_donor_prune_plan_for_donor(plan: IntentPlan, blueprint: dict[str, obj
     donor_groups = _collect_donor_groups(donor_root)
     target_groups = _target_groups_from_blueprint(plan, blueprint)
     adapted_plan = copy.deepcopy(plan)
+    # The donor-shaping operations are rebuilt from scratch below, so the
+    # list is cleared -- but it also holds what the *user* asked for, and
+    # `cli R1: ...` was being thrown away with it. The parser produced the
+    # operation correctly and the plan reaching the file contained none, so
+    # arbitrary IOS never arrived. Held aside here and appended after the
+    # renames, since it addresses devices by their final name.
+    carried_operations = [
+        operation
+        for operation in adapted_plan.edit_operations
+        if operation.get("op") == "apply_cli"
+    ]
     adapted_plan.edit_operations = []
     donor_devices = inventory_devices(donor_root)
     donor_links = inventory_links(donor_root)
@@ -5852,6 +9640,14 @@ def _build_donor_prune_plan_for_donor(plan: IntentPlan, blueprint: dict[str, obj
                     for member in seed_members
                     if _device_kind(member) == kind
                 ]
+                # Truncated on purpose. A seed group with three PCs cannot fill
+                # a target that wants eight, and cloning the same member twice
+                # to make up the difference was measured and reverted: it took
+                # the 100-PC lab from 140 devices to 65 and from 13 undelivered
+                # devices to 88. Whatever consumes these names downstream
+                # cannot have one source duplicated twice in a batch, so the
+                # shortfall belongs in the donor -- a group with more hosts --
+                # rather than here.
                 seed_hosts.extend(matching[:count])
             # Emitted after the rename/prune pass, not here. The verified
             # experiment duplicated a group *after* all other mutations, from a
@@ -5876,7 +9672,11 @@ def _build_donor_prune_plan_for_donor(plan: IntentPlan, blueprint: dict[str, obj
             # which was read before duplication. Register them so the rename and
             # link-reuse logic downstream sees the copies as donor-provided —
             # otherwise it asks to *create* a host link, which is refused.
-            for host in seed_hosts:
+            # `enumerate`, not `.index`: a seed member cloned twice appears
+            # twice in `seed_hosts`, and looking the name up returns the first
+            # position both times -- so the second clone would be registered
+            # under the first one's name and arrive with no cable.
+            for position, host in enumerate(seed_hosts):
                 original = next(
                     (
                         link
@@ -5889,7 +9689,7 @@ def _build_donor_prune_plan_for_donor(plan: IntentPlan, blueprint: dict[str, obj
                     continue
                 cloned = dict(original)
                 cloned["from"] = duplicate_name
-                cloned["to"] = f"{duplicate_name}-H{seed_hosts.index(host) + 1}"
+                cloned["to"] = f"{duplicate_name}-H{position + 1}"
                 donor_links.append(cloned)
             members_by_type: dict[str, list[dict[str, object]]] = {}
             for member in cloned_members:
@@ -6261,6 +10061,26 @@ def _build_donor_prune_plan_for_donor(plan: IntentPlan, blueprint: dict[str, obj
             int(target.get("y", 0)),
         )
 
+    # A surplus donor device is only surplus once every planned device of its
+    # kind has been filled. Measured on "2 switch, 1 router, 6 PC": the donor
+    # holds eight PCs across three switches, the plan keeps two switches, and
+    # PC4 and PC5 went out with the switch they hung off -- while PC7 and PC8,
+    # cabled to a switch that survived, were deleted as spares. Six were asked
+    # for and four arrived, out of eight that were there.
+    #
+    # `_adopt_planned_names` already gives a missing planned name to a cabled
+    # device that has one to spare. It ran after these were deleted, so it had
+    # nothing to work with. Keeping them is all it needs.
+    planned_kinds = {
+        str(device.get("name") or ""): _device_kind(device)
+        for device in blueprint.get("devices", [])
+    }
+    claimed = set(rename_map.values()) | set(kept_devices)
+    shortfall: dict[str, int] = {}
+    for planned_name, planned_kind in planned_kinds.items():
+        if planned_name and planned_name not in claimed:
+            shortfall[planned_kind] = shortfall.get(planned_kind, 0) + 1
+
     spare_name_counts: dict[tuple[str | None, str], int] = {}
     for device_type, candidates in spare_candidates_by_type.items():
         for candidate in candidates:
@@ -6269,6 +10089,21 @@ def _build_donor_prune_plan_for_donor(plan: IntentPlan, blueprint: dict[str, obj
             count_key = (str(group_name) if group_name is not None else None, device_type)
             spare_name_counts[count_key] = spare_name_counts.get(count_key, 0) + 1
             spare_index = spare_name_counts[count_key]
+            if shortfall.get(device_type, 0) > 0:
+                # Held back for the planned name it is about to be given, but
+                # renamed first: leaving the donor's name on it collided with a
+                # planned name already handed to another device, and the lab
+                # came out with two PC1s and two cables on one port.
+                shortfall[device_type] -= 1
+                holding = f"SPARE-{device_type.upper()}{spare_index}"
+                donor_name = str(donor_member["name"])
+                kept_devices.add(donor_name)
+                rename_map[donor_name] = holding
+                if donor_name != holding:
+                    adapted_plan.edit_operations.append(
+                        {"op": "rename_device", "device": donor_name, "new_name": holding}
+                    )
+                continue
             spare_name = (
                 f"{group_name}-SPARE-{device_type.upper()}{spare_index}"
                 if group_name
@@ -6664,6 +10499,9 @@ def _build_donor_prune_plan_for_donor(plan: IntentPlan, blueprint: dict[str, obj
             adapted_plan.edit_operations.append({"op": "prune_device", "device": final_name})
             already_pruned.add(final_name)
 
+    # Every switch port a clone has been given, so a port planned for one is
+    # not handed to another.
+    clone_ports_taken: set[tuple[str, str]] = set()
     for clone in pending_host_clones:
         source_final = rename_map.get(str(clone["source"]), str(clone["source"]))
         if source_final in parked_set:
@@ -6699,15 +10537,21 @@ def _build_donor_prune_plan_for_donor(plan: IntentPlan, blueprint: dict[str, obj
                 planned_link = link
                 break
 
-        if planned_port:
+        # A planned port is only good if no earlier clone has taken it. Two
+        # clones can be planned onto the same interface, and trusting the plan
+        # without checking put three pairs of hosts on one port once the donor
+        # grew enough groups for a hundred-host lab to reach this path.
+        if planned_port and (switch_name, planned_port) not in clone_ports_taken:
             switch_port = planned_port
         else:
+            planned_link = None
             used_ports = {
                 str(link[end]["port"])
                 for link in blueprint.get("links", [])
                 for end in ("a", "b")
                 if str(link[end]["dev"]) == switch_name
             }
+            used_ports |= {port for switch, port in clone_ports_taken if switch == switch_name}
             switch_port = next(
                 (
                     candidate
@@ -6726,6 +10570,7 @@ def _build_donor_prune_plan_for_donor(plan: IntentPlan, blueprint: dict[str, obj
                 if gap not in adapted_plan.blocking_gaps:
                     adapted_plan.blocking_gaps.append(gap)
                 continue
+        clone_ports_taken.add((switch_name, switch_port))
         adapted_plan.edit_operations.append(
             {
                 "op": "duplicate_host",
@@ -6772,6 +10617,9 @@ def _build_donor_prune_plan_for_donor(plan: IntentPlan, blueprint: dict[str, obj
         mutation_groups=mutation_groups,
         layout_strategy="donor_park_clean",
     )
+    # Last, so every rename the plan makes has already happened and the
+    # device the user named exists under that name.
+    adapted_plan.edit_operations.extend(carried_operations)
     return adapted_plan, archetype_plan
 
 
@@ -6843,7 +10691,7 @@ def _build_donor_prune_plan(
     # one pays for this pass.
     #
     # This pass was held out for a while: the donor it reaches on this machine
-    # is `Senan_Haciyev_tapsiriq.pkt`, and Packet Tracer refused the lab built
+    # is the saved serial-WAN lab, and Packet Tracer refused the lab built
     # from it -- an unwired device costs one device, a refused file costs the
     # whole lab. That refusal is fixed now. It was a serial cable with no DCE
     # end declared, plus two port names taken from an assumed switch model.
@@ -7576,6 +11424,7 @@ def generate_from_blueprint(blueprint_path: Path, output_path: Path, xml_out_pat
     output_path.parent.mkdir(parents=True, exist_ok=True)
     output_path.write_bytes(pkt_bytes)
     print(f"PKT file created: {output_path}")
+    _report_coherence(root)
     print(f"XML bytes: {len(xml_bytes)}")
     print(f"PKT bytes: {len(pkt_bytes)}")
 
@@ -7657,6 +11506,15 @@ def generate_from_prompt(
             blueprint_out_path.parent.mkdir(parents=True, exist_ok=True)
             blueprint_out_path.write_text(json.dumps(blueprint_plan, indent=2, ensure_ascii=False), encoding="utf-8")
         raise PlanningError("Scenario is not generate-ready in safe-open mode; generation was skipped.", prepared_plan)
+    # What the prompt asked things to be called, kept before donor adaptation
+    # gets to rewrite it. The chosen donor substitutes its own device names into
+    # the blueprint -- `SW3` became `MultiLayerSwitch1` -- and the file then
+    # honours the rewritten plan, so a lab asked for `SW3` ships without one.
+    # Both checks below measure against the request, not against what the donor
+    # turned it into.
+    requested_devices = {
+        "devices": [dict(device) for device in blueprint.get("devices", [])]
+    }
     try:
         adapted_plan, donor_archetype = _build_donor_prune_plan(prepared_plan, blueprint, resolved_donor_roots)
     except PlanningError as exc:
@@ -7686,6 +11544,10 @@ def generate_from_prompt(
     port_repairs = _repair_invalid_link_ports(root)
     mac_repairs = _assign_unique_macs(root)
     _match_link_port_families(root)
+    # After the families agree and before the addresses are handed out: a
+    # copper cable in a fibre socket is dropped by Packet Tracer on load,
+    # silently, in a file that still opens.
+    _move_copper_cables_off_fibre_ports(root)
     _assign_unique_interface_addresses(root)
     _assign_unique_switch_management_ips(root)
     media_notes = _reconcile_cable_media(root)
@@ -7693,18 +11555,110 @@ def generate_from_prompt(
     # serial: a cable demoted to copper must lose its clocking end, and one
     # promoted to serial must gain one.
     _declare_serial_dce_ends(root)
+    # First of the configuration repairs: a block for hardware the device does
+    # not have carries the donor's whole address plan into every pass that
+    # reads the router's networks.
+    _retarget_config_to_real_interface_names(root)
+    absent_notes = _drop_config_for_absent_interfaces(root)
     trunk_notes = _trunk_uplinks_in_file(root)
+    trunk_notes += absent_notes
+    # Before the access-VLAN pass, which would otherwise strip the tagging:
+    # a switch port facing router subinterfaces has to be a trunk. The
+    # subinterfaces move to the cabled port first, or there is nothing there
+    # for the trunk to carry.
+    trunk_notes += _move_subinterfaces_to_the_cabled_port(root)
+    trunk_notes += _trunk_router_on_a_stick(root)
     vlan_notes = _align_router_access_vlan(root)
+    # After the router's own port is settled: a host whose address belongs to
+    # one VLAN and whose port sits in another cannot reach its own subnet.
+    vlan_notes += _align_host_vlans_to_addresses(root)
     gateway_repairs = _align_router_gateway(root)
+    # Last, because `_align_router_gateway` writes the gateway onto the
+    # physical cabled interface -- correct for an access link, wrong for a
+    # trunk, where the address has to sit on the subinterface for its VLAN.
+    trunk_notes += _move_subinterfaces_to_the_cabled_port(root)
+    # A learned sticky MAC belongs to the donor's device, not to the one now
+    # plugged in, and `restrict` drops every frame that does not match it.
+    trunk_notes += _drop_inherited_sticky_macs(root)
+    # Both ends of every trunk must name the same native VLAN, or spanning
+    # tree blocks the port and the cable carries nothing.
+    trunk_notes += _match_trunk_native_vlans(root)
+    # After every trunk is settled: port security on a trunk cuts the switch
+    # behind it off entirely.
+    trunk_notes += _drop_port_security_from_trunks(root)
+    # After the trunks are settled: a channel-group naming ports the cable
+    # never joined takes the switch behind it off the network.
+    trunk_notes += _align_etherchannels_with_cabling(root)
     _stamp_target_version(root)
     unexpected_workspace_issues = _unexpected_workspace_issues(donor_root, root)
     if unexpected_workspace_issues:
         raise ValueError("; ".join(unexpected_workspace_issues))
     validate_donor_coherence(donor_root, root)
     _align_dhcp_pools_with_interfaces(root)
+    # After the pools point at real networks: a pool with no client is not
+    # DHCP, and the segmented path never emitted the client half.
+    # Before the clients are switched over: a VLAN with hosts and no gateway
+    # cannot serve any of them.
+    # A port with no VLAN sits in VLAN 1, which the plan never gives a
+    # gateway, so the host on it is isolated whatever else is right.
+    _place_hosts_in_a_vlan(root)
+    _serve_every_populated_vlan(root)
+    # Again, now that new VLANs exist: the router-facing trunk lists the
+    # VLANs it may carry, and it was written before those VLANs were
+    # created -- so their hosts had a gateway the trunk would not pass.
+    _trunk_router_on_a_stick(root)
+    # Again, now that the VLAN gateways exist. The first call ran before
+    # `_serve_every_populated_vlan` created them, so it judged the plan's pools
+    # against interfaces that were not there yet: a pool named VLAN20 carrying
+    # the default 192.168.1.0 survived, and the VLAN-20 pass then added a
+    # second pool of the same name for 192.168.20.0. IOS merges pools by name
+    # and keeps the last, so VLAN 20 served a network nothing routes.
+    _align_dhcp_pools_with_interfaces(root)
+    _drop_duplicate_dhcp_pools(root)
+    _merge_repeated_interface_blocks(root)
+    _separate_config_blocks(root)
+    _add_missing_vlans_to_the_database(root)
+    _drop_vlan_subinterfaces_off_router_links(root)
+    _move_static_hosts_onto_their_vlan_network(root)
+    # A home router keeps the donor's LAN network unless someone moves it onto
+    # the one its own clients are addressed for, and its clients keep another
+    # donor's network name unless someone puts them on the air it broadcasts.
+    _join_wireless_clients_to_the_network_that_exists(root)
+    _align_home_router_lan_with_its_clients(root)
+    _match_wireless_security_to_the_access_point(root)
+    # After the LAN move, which needs the planned addresses to know where to
+    # put the pool. Once it has, the pool addresses the clients.
+    _let_the_home_router_address_its_own_clients(root)
+    # Last, so the profile copies whatever the passes above settled on.
+    _make_the_wireless_profile_agree_with_the_port(root)
+    _put_workstations_on_dhcp(root)
+    # Snooping without a trusted uplink eats every offer the router sends.
+    _trust_uplinks_for_dhcp_snooping(root)
+    # Last: the standby gateway takes the address the hosts already use,
+    # so nothing written before it has to change.
+    _add_hsrp_gateway_redundancy(root)
+    # A router with no path to another router carries none of its routes.
+    _drop_stale_point_to_point_addresses(root)
+    _mesh_routers_with_point_to_point_links(root)
     _group_hosts_under_their_switch(root)
     _separate_overlapping_devices(root)
+    # After the separation pass, so a leftover nudged sideways is still pulled in.
+    _compact_stray_devices(root)
+    # Last of the layout: a radio link is made by distance, so a wireless
+    # client has to end up inside its access point's reach whatever the rows
+    # above decided.
+    _keep_wireless_clients_within_reach_of_their_access_point(root)
     _save_running_config_to_startup(root)
+    # Before the annotation and the serialisation: the annotation names the
+    # devices, and a rename after `serialize_pkt_xml` would change nothing
+    # in the file that was written.
+    for _note in _adopt_planned_names(root, requested_devices):
+        print(_note)
+    # After the rename, not before: the cleanup asks the plan which switch a
+    # device belongs to, and until adoption the device still answers to a
+    # holding name the plan never mentions.
+    for _note in _drop_cables_the_plan_did_not_ask_for(root, requested_devices):
+        pass
     _annotate_generated_lab(root, blueprint, prepared_plan)
     prune_unused_images(root)
     xml_bytes = serialize_pkt_xml(root)
@@ -7714,6 +11668,11 @@ def generate_from_prompt(
     pkt_bytes = encode_pkt_modern(xml_bytes)
     output_path.parent.mkdir(parents=True, exist_ok=True)
     output_path.write_bytes(pkt_bytes)
+    for note in _report_undelivered_devices(root, requested_devices):
+        print(note)
+    for note in _report_unwired_devices(root, requested_devices):
+        print(note)
+    _report_coherence(root)
     print(f"Selected donor: {donor_archetype.compat_donor}")
     compat_donor, compat_donor_version = _compat_donor_details()
     if compat_donor is not None:
@@ -7872,7 +11831,7 @@ def edit_from_prompt(
             plan,
         )
 
-    edit_pkt_file(pkt_path, plan, output_path, xml_out_path)
+    edit_pkt_file(pkt_path, plan, output_path, xml_out_path, repair=_align_etherchannels_with_cabling)
     print(f"Edited PKT file created: {output_path}")
 
 
@@ -8613,6 +12572,12 @@ def main() -> None:
     parser.add_argument("--compare-scenarios", action="append", help="Compare multiple prompts and print a scenario acceptance matrix")
     parser.add_argument("--parity-report", help="Print prompt-scoped capability parity JSON")
     parser.add_argument("--validate-open", help="Launch Packet Tracer with the given .pkt file")
+    parser.add_argument(
+        "--coherence-report",
+        help="Report the contradictions a .pkt states about itself: addresses held twice, "
+        "gateways no interface answers for, pools no interface serves, bundles the cable "
+        "does not join, interfaces declared more than once",
+    )
     parser.add_argument("--validate-open-debug", help="Build staged donor compatibility debug report for a prompt")
     parser.add_argument("--compat-donor", help="Explicit Packet Tracer 9.0 donor .pkt path for strict compatibility mode")
     parser.add_argument("--reference-root", action="append", help="Optional local folder of imported external sample .pkt files")
@@ -8692,6 +12657,17 @@ def main() -> None:
             inventory_out=Path(args.inventory_out) if args.inventory_out else None,
         )
         return
+    if args.coherence_report:
+        from lab_coherence import check_lab_coherence, summarise
+
+        root = decode_pkt_to_root(Path(args.coherence_report))
+        findings = check_lab_coherence(root)
+        print(summarise(findings))
+        for finding in findings:
+            print(f"  {finding}")
+        # A lab that contradicts itself opens perfectly well, so the exit code
+        # is the only place the answer can be acted on.
+        raise SystemExit(1 if findings else 0)
     if args.edit:
         if not args.prompt:
             parser.error("--edit requires --prompt")