diff --git a/crude_engine/schemas/lldp.yaml b/crude_engine/schemas/lldp.yaml
index ab50d81..e25966a 100644
--- a/crude_engine/schemas/lldp.yaml
+++ b/crude_engine/schemas/lldp.yaml
@@ -13,6 +13,13 @@ methods:
     type: list_append
     primary_key: local_port
     key_map: ifindex
+    # #333/#334 SSH: 11/14 attributes wired and live-verified 2026-09-27.
+    # Still SNMP/MOPS-only (partial, not a bug) — see wire/ssh/lldp.yaml and
+    # wire/ssh/lldp-ext-dot3.yaml comments for why each is deferred:
+    #   sys_capabilities / sys_enabled_capabilities — this command's SSH
+    #     output has no capabilities field at all; needs a different command.
+    #   aggregation_enabled — needs a value_map only one text phrase has
+    #     been observed for so far; the "enabled" phrase is unconfirmed.
     defaults:
       port_id: ''
       sys_name: ''
diff --git a/crude_engine/wire/ssh/lldp-ext-dot1.yaml b/crude_engine/wire/ssh/lldp-ext-dot1.yaml
new file mode 100644
index 0000000..a2a8470
--- /dev/null
+++ b/crude_engine/wire/ssh/lldp-ext-dot1.yaml
@@ -0,0 +1,13 @@
+version: "2.9.0"
+feature: lldp-ext-dot1-ssh
+description: "SSH CLI sources for HM2-LLDP-EXT-DOT1-MIB (get_lldp_neighbors_detail)"
+
+attributes:
+  # #333/#334 pvid. "Port VLAN ID....1" — clean digit string, no extra
+  # parsing needed. Live-verified 2026-09-27 per the patch note.
+  # Base wire/lldp-ext-dot1.yaml already declares type: integer for the
+  # SNMP source — this overlay only adds the ssh: sources block.
+  lldpxdot1remportvlanid:
+    sources:
+      ssh:
+        read: {command: "show lldp remote-data", parser: sections, field: "Port VLAN ID"}
diff --git a/crude_engine/wire/ssh/lldp-ext-dot3.yaml b/crude_engine/wire/ssh/lldp-ext-dot3.yaml
new file mode 100644
index 0000000..6580ce1
--- /dev/null
+++ b/crude_engine/wire/ssh/lldp-ext-dot3.yaml
@@ -0,0 +1,44 @@
+version: "2.9.0"
+feature: lldp-ext-dot3-ssh
+description: "SSH CLI sources for HM2-LLDP-EXT-DOT3-MIB (get_lldp_neighbors_detail)"
+
+attributes:
+  # #333/#334. "Link Agg. port ID....0" — clean digit string. Live-verified
+  # 2026-09-27 per the patch note.
+  lldpxdot3remlinkaggportid:
+    type: integer
+    sources:
+      ssh:
+        read: {command: "show lldp remote-data", parser: sections, field: "Link Agg. port ID"}
+
+  # "Port oper. MAU type....30 (1000BaseTFD)" — SNMP's syntax is a bare
+  # Integer32 (e.g. 30); regex strips the "(1000BaseTFD)" annotation SSH
+  # adds that SNMP's OID value doesn't carry.
+  lldpxdot3remportopermautype:
+    type: integer
+    sources:
+      ssh:
+        read: {command: "show lldp remote-data", parser: sections, field: "Port oper. MAU type", regex: '^(\d+)'}
+
+  # "Autoneg. supp./enabled.....yes/yes" — one combined CLI field feeds two
+  # separate schema attributes (supported and enabled), each pulling its own
+  # half via regex against the same source field.
+  lldpxdot3remportautonegsupported:
+    type: boolean
+    sources:
+      ssh:
+        read: {command: "show lldp remote-data", parser: sections, field: "Autoneg. supp./enabled", regex: '^(\w+)/'}
+
+  lldpxdot3remportautonegenabled:
+    type: boolean
+    sources:
+      ssh:
+        read: {command: "show lldp remote-data", parser: sections, field: "Autoneg. supp./enabled", regex: '/(\w+)$'}
+
+  # NOT wired, deliberately: lldpxdot3remlinkaggstatus (aggregation_enabled).
+  # SNMP's shape is a bit_map-decoded list (lldp_agg_status: 0=aggCapable,
+  # 1=aggEnabled). SSH's "Link Agg. status....agg. capable" is human text,
+  # not raw bits — needs a value_map from every observed text phrase to the
+  # matching list, and only one phrase ("agg. capable") has been observed
+  # live so far. Needs more captures (esp. an "enabled" case) before the
+  # value_map can be written without guessing.
diff --git a/crude_engine/wire/ssh/lldp.yaml b/crude_engine/wire/ssh/lldp.yaml
index 35622d7..d2349d1 100644
--- a/crude_engine/wire/ssh/lldp.yaml
+++ b/crude_engine/wire/ssh/lldp.yaml
@@ -1,8 +1,72 @@
 version: "2.9.0"
 feature: lldp-ssh
-description: "SSH CLI sources for LLDP — write-only (reads need block parser)"
+description: "SSH CLI sources for LLDP"
 
 attributes:
+  # #333/#334 get_lldp_neighbors(+detail) read side. Uses the existing
+  # parser: sections (unwired until now — see ssh_driver.py _parse_sections).
+  # Live-verified 2026-09-27 per the patch note ("show lldp remote-data",
+  # real capture). section_pattern/key_extract defaults match
+  # this command's real output ("Remote data, 1/1 - #1") verbatim — no
+  # override needed.
+  #
+  # local_port is the section key itself (e.g. "1/1"), not translated through
+  # key_map: ifindex — that remapping is SNMP-specific (walked OID-index →
+  # ifName lookup); SSH's own parsed text is already human-format, same
+  # pattern as get_interface_statistics's `name` (wire: ifdescr, source: if).
+  lldpremlocalportnum:
+    type: string
+    sources:
+      ssh:
+        read: {command: "show lldp remote-data", parser: sections, key: true}
+
+  lldpremsysname:
+    type: string
+    sources:
+      ssh:
+        read: {command: "show lldp remote-data", parser: sections, field: "System name"}
+
+  lldpremsysdesc:
+    type: string
+    sources:
+      ssh:
+        read: {command: "show lldp remote-data", parser: sections, field: "System description"}
+
+  lldpremportdesc:
+    type: string
+    sources:
+      ssh:
+        read: {command: "show lldp remote-data", parser: sections, field: "Port description"}
+
+  # SNMP's lldpremportid/lldpremchassisid return bare lowercase MAC strings
+  # (verified via live SNMP capture: "aa:bb:cc:dd:ee:ff" shape). SSH's text has a
+  # trailing " (subtype: macAddress)" annotation this command doesn't need —
+  # regex extracts just the MAC, case: lower matches SNMP's format exactly.
+  lldpremportid:
+    type: string
+    sources:
+      ssh:
+        read: {command: "show lldp remote-data", parser: sections, field: "Port ID", regex: '^([0-9A-Fa-f:]+)', case: lower}
+
+  lldpremchassisid:
+    type: string
+    sources:
+      ssh:
+        read: {command: "show lldp remote-data", parser: sections, field: "Chassis ID", regex: '^([0-9A-Fa-f:]+)', case: lower}
+
+  # NOT wired, deliberately — no data available from this command:
+  #   lldpremsyscapsupported / lldpremsyscapenabled (sys_capabilities /
+  #     sys_enabled_capabilities) — "show lldp remote-data" carries no
+  #     capabilities field at all in this capture. Needs a different command
+  #     (untried: "show lldp med remote-device detail") — separate item.
+  #   lldpxdot3remlinkaggstatus (aggregation_enabled) — SNMP's shape is a
+  #     bit_map-decoded list (lldp_agg_status: 0=aggCapable, 1=aggEnabled).
+  #     SSH's "Link Agg. status....agg. capable" is human text, not raw
+  #     bits — needs a value_map from every observed text phrase to the
+  #     matching list, and only one phrase ("agg. capable") has been
+  #     observed live so far. Needs more captures (esp. an "enabled" case)
+  #     before the value_map can be written without guessing.
+
   hm2lldpadminstatus:
     sources:
       ssh: