[CctrGy]

This draft integrates the experimental GUI and shared services for LANCTL 0.3.4-alpha.1, fixes the repeated CI failures, and validates the candidate on Windows and Linux. It retains the existing public Core contract files and 89 reviewed call signatures. The remote-user CLI output intentionally redacts passwordHash while preserving its JSON key and adding passwordConfigured.

• Access security validates HTTPS cookie identifiers, uses fixed MIME types for published assets, and pins SSH test clients to generated known host keys. Metadata and diagnostic output have regression coverage against credential disclosure.
• Clink registration handles an already-applied operation by checking the exact native registration state. UTF-8 decoding preserves paths with accents; real CMD/Clink tests cover completion, repeated registration and removal without changing unrelated registrations.
• The GUI preserves failed first-scan requests for retry, reports plugin revocation/runtime limits, and ships five actual theme preview images in Setup. The optional lanaccess remote-setup wizard creates only the first service administrator account through the existing Scrypt authentication service, preserves existing accounts, validates OS privilege and storage scope, and keeps passwords out of argv, temporary files and output. It does not enable listeners or firewall rules. Unsupported platforms are rejected before loading WebView.
• CI uses dev,gui, retains diagnostics, and exercises Windows Python 3.10/3.11 with Edge regressions alongside Linux. Linux fake-Windows fixtures and Windows 8.3 path expectations are corrected. Coverage 7.16.2 and Ruff 0.17.0 are pinned; the 60% coverage gate is unchanged. Stable-release metadata distinguishes stable and experimental channels.

Validation on 7a60daac7ed4239d9202bd6a4b424a699fcd3a67:

• Complete local suite including legacy/browser tests: 1,270 passed, 645 subtests passed, one platform skip; 69.9160% coverage. Ruff, formatting, Bandit, dependency audit, public-contract checks, CLI/web references, repository hygiene and the 1,435-point error catalog pass.
• CI: Linux and Windows Python 3.10/3.11 pass.
• Full branch security analysis: passes; the same ten inspected metadata/path/timestamp findings remain, with no added results or remote dismissals. The dependency graph was enabled and the formerly failing dependency-review runs for PRs 23/25 passed without weaker thresholds.
• Package certification: Windows Setup installation/update/uninstall preserving data, six-launcher portable GUI/CLI/TUI checks, and native Linux amd64/arm64 package installation/update/uninstall pass. This manual run skips the publishing job; no stable branch, tag or release was published.

Keep this PR in draft. Remaining work includes REF-P34-runtime for cancellable legacy trusted execution, the official plugin publisher/signatures for P40/P42, real multi-interface/external-host checks, and Clink uninstall under another administrator. The final local native-window smoke was interrupted by the user; the elevated interactive account-wizard walkthrough remains unverified. The five theme previews were separately confirmed by the user, and account creation/authentication was tested through the real API with isolated storage. Installer Authenticode signing is not configured. P50 and the remaining P69-P73 interface/installer features retain their documented dependencies and scope.